Final Sign LSJ_Cincinnati Security.pdf

CUI//PRIVILEGE

Controlled by U.S. Environmental Protection Agency

Limited Sources Justification for Extension of Bridge Contract

This is a limited sources justification, pursuant to the requirements of FAR 8.405-6, Limiting Sources under Federal Supply Schedules under the authority of the Multiple-Award Schedule Program.

1. Agency: United States Environmental Protection Agency

Contracting Activity: EPA Cincinnati Acquisition Division Requisition No.: PR-OMS-25-00614 Title: Cincinnati Security Management Services

2. Nature and/or description of the action:

The Cincinnati Acquisition Division intends to award an extension of the bridge contract via modification to a General Services Administration (GSA) Schedule (Federal Supply Schedule) Firm Fixed Price (FFP) task order. EPA intends to issue an extension to the existing armed security guard bridge contract issued to Diversified Protection Corporation (DPC). The extension will be for an additional three (3) months of services with three one-month options as described in Paragraph 3 while the next iteration of this requirement is competed on GSA Schedules, in accordance with FAR Part 8. The period of performance for the current task order (GS-07F-120GA / 68HE0C18F0866) expires April 30, 2025. This modification will extend the period of performance end date to July 31, 2025, with three one-month options potentially extending the period of performance to October 31, 2025.

3. A description of the supplies or services required to meet the agency’s needs (including the estimated value):

The contractor shall provide armed staff and security support services 24 hours per day, 7 days a week for all eight US EPA locations in Cincinnati, OH and Northern Kentucky. In addition, the contractor shall manage the EPA Security Program. The contractor shall assess threats and vulnerabilities through risk analysis and determine the required level of security necessary to provide oversight for physical security programs at multiple locations with a variety of operational functions. Security threats include, but are not limited to, human threats, which are those typically defined as active threats, crimes, terrorism, sabotage, and operational and procedural deficiencies.

In addition, the contractor shall have an understanding and knowledge of emergency operations/preparedness procedures to manage a crisis caused by natural disasters such as fires, floods, tornadoes, earthquakes, and in other threatening environments such as chemical releases. The contractor shall be knowledgeable of the current Homeland Security Alert Levels established by the National Terrorism Advisory System (NTAS), as well as the Risk Management Process for Federal Facilities: An interagency Security Committee Standard Appendix B: Countermeasures. A complete description

Controlled by U.S. Environmental Protection Agency of the requirements can be found in the attached Performance Work Statement.

Total value is estimated to be $2,469,437.28 for a six (6) month period.

4. Authority and supporting rationale and, if applicable, demonstration of the proposed contractor’s unique qualifications to provide the required supply or service:

FAR 8.405-6(a)(1)(i)(A) - An urgent and compelling need exists, and following the procedures would result in unacceptable delays.

This justification is based on the consideration that armed security guards are a critical, necessary service for EPA.

A GSA task order, GS-07F-168GA / 68HERC24F0255, was solicited via solicitation number 68HERC23Q0113 and competitively awarded to 8(a) contractor Servexo on March 15, 2024, with an initial effective date of April 1, 2024. Servexo subsequently requested that the Agency terminate the order. The reasons for Servexo’s request are detailed in a separate document titled “Memorandum on Termination Request - GS-07F-168GA - 68HERC24F0255”, which is included in Tab 122 of the contract file, and which is incorporated by reference into this justification. However, because that document may include proprietary or confidential information, EPA is not including it with the public version of this justification in accordance with FAR 8.405-6(a)(2)(iii). EPA terminated the GSA task order GS-07F-168GA - 68HERC24F0255 on April 26, 2024, and the 1-year bridge via extension modification was awarded on April 30, 2024.

The PR for the Cincinnati follow-on GSA Task Order was received on May 21, 2024. Due to a high workload in the CO’s branch and other procurements taking priority, the acquisition team was not able to start reviewing requirement documents and going over acquisition strategy with the COR until August 2024. The CO started developing the solicitation in October 2024. Due to the accelerated timeline for awarding the follow-on security requirement, the CO began exploring solutions to speed up the evaluation process. On October 8, 2024, the CO met with OGC for a concept review of a new evaluation strategy to better streamline the evaluation process through a phased approach involving oral interviews followed by evaluation of technical proposals. The solicitation, with the piloted evaluation process, was submitted for Branch Chief review on February 6, 2025. As a result of subsequent internal reviews, significant revisions were made to the solicitation. The solicitation was released on April 21, 2025, and the follow-on GSA task order has a projected award date of July 2025. Conflicting priorities as well as piloting a new evaluation process slowed the development and release of the security follow-on solicitation.

GS-07F-120GA / 68HE0C18F0866 is set to expire on April 30, 2025, and without an extension to provide additional time to award the follow-on security task order, there would be a break in these critical armed security services, potentially causing disastrous life, Controlled by U.S. Environmental Protection Agency property and safety issues for all Cincinnati, OH and Northern Kentucky US EPA facilities.

With no extension to the existing GSA Task Order in place, it is highly likely that EPA’s facilities would need to be closed until a new contractor can begin performance due to lack of security at these facilities. This would be a situation where EPA-owned buildings, leased spaces, equipment, property, EPA personnel, EPA contractors, and visitors could be physically harmed without security contract support. A lapse in critical and essential security services could cause catastrophic failures to laboratory experiments and numerous stop-work situations with onsite contracts, among other detrimental impacts to the Agency.

Following competitive procedures to solicit and award a new order will take more time than EPA currently must prevent an unacceptable break in service. The CO has determined that, given the history of this requirement and CAD’s current heavy workload, an additional 90 days (3 months) in options should be included to allot for potential delays. This additional 3 months would be included as three one-month option periods after the 3-month extension base period and only exercised if delays prevent an award in 3 months. EPA cannot afford to take on any additional risk associated with these critical services, as such, a maximum 6-month bridge on the current GSA task order is in EPA’s best interest.

Current Contractor:

Diversified Protection Corporation 8020 S. Rainbow Blvd., Suite 100-530 Las Vegas, NV 89139

Current Task Order (TO) Number: GS-07F-120GA / 68HE0C18F0866 TO Total Price, including Option Periods: $30,118,901.97 TO Period of Performance, including Option Periods: 10/01/2018 – 04/30/2024

First Bridge Extension Task Order Total Price, including Option Periods: $4,846,510.44 First Bridge Extension Period of Performance: 05/01/2024 – 04/30/2025

Proposed Extension Period of Performance: 05/01/2025 – 10/31/2025 Proposed Estimated 3 Month Base Extension Total Price: $1,234,718.64 Proposed Estimated Base plus 1 Month Option Extension Total Price: $1,646,291.52 Proposed Estimated Base plus 2 Month Option Extension Total Price: $2,057,864.40 Proposed Estimated Base plus 3 Month Option Extension Total Price: $ 2,469,437.28

5. A determination by the ordering activity contracting officer that the order represents the best value consistent with 8.404(d).

The anticipated cost to the Government will be evaluated based on the contractor’s level of expertise, skill, and labor force mix, as well as a comparison to the pricing for the previous year of service. As this is a GSA task order, the contractor cannot exceed their

GSA labor rates. The Contracting Officer will conduct a complete analysis, including a

Attachment 1 Performance Work Statement

68HE0C18Q0052

comparison of the proposed price for the bridge to the most recent twelve-month period of the existing task order, to confirm the quotation is fair and reasonable and within the best interest of the Government.

6. A description of the market research conducted among schedule holders and the results or a statement of the reason market research was not conducted.

No additional market research was completed for the current extension. Urgency and the critical nature of this requirement requires EPA to utilize the current contractor.

7. Any other facts supporting the justification.

n/a.

8. A statement of the actions, if any, the agency may take to remove or overcome any barriers that led to the restricted consideration before any subsequent acquisition for the supplies or services is made.

A new task order will be competed between eligible small business 8(a) vendors on GSA MAS 561612 (Security and Protection – Security Services) to replace the terminated task order GS-07F-168GA - 68HERC24F0255. There are no particular barriers that led to restricted consideration in the case of this bridge. As explained above, EPA elected to use a novel procurement approach for the follow-on requirement, which resulted in a longer solicitation development period than anticipated. Having refined the approach for the follow-on requirement, subsequent solicitations using the same or a similar approach will not take as long to develop.

Attachment A

EPA Cincinnati Facilities

Security Management Program

Attachment A

EPA Cincinnati Facilities Security Management Program

1. General Requirements The Security Management Contractor shall provide armed security staff and support services 24 hours per day 7 days per week to maintain a comprehensive security posture for EPA Cincinnati facilities to meet the requirements of the EPA Research Centers, Administration Facilities, Homeland Security Maintenance and Material Division (HSMMD), Bio-Containment Suite Facility (BCS), which is registered with the Centers for Disease Control and Prevention and the Central Intelligence Agency, National Emergency Response Team (ERT) and Consequence Management Advisory Division (CMAD) Facility, National Publication Office and Equipment / Property Storage Warehouse, Research Boat Facility, and Critical Server Rooms located at various Cincinnati EPA locations.

The following is a list of facilities requiring security management services in accordance with the Interagency Security Committee (ISC), Physical Security Criteria for Federal Agencies:

Andrew W. Briedenbach Environmental Research Center (AWBERC) 26 W. Martin Luther King Drive Cincinnati, OH 45268 350,000 gross sq. ft.

22 Acres Approximately 680 employees

AWBERC Annex 1 32,557 gross sq. ft.

Approximately 50 employees

AWBERC Annex 2 (North and West Wings) 45,387 gross sq. ft.

(Contains the National Homeland Security Research Center (NHSRC) and a BSL-3 Bio- Containment Facility) Approximately 161 employees

AWBERC Full Containment Facility (FCF) 7,500 gross sq. ft.

Approximately 20 employees AWBERC FEI Child Care Center 123 W. Nixon Street Cincinnati, Ohio 45268 5,950 gross sq. ft Approximately 60 occupants

Center Hill Facility 5995 Center Hill Road Cincinnati, Ohio 21,000 gross sq. ft.

25.5 Acres

Approximately 25 employees

Test and Evaluation Facility 1600 Gest Street Cincinnati, Ohio 45268 24,000 gross sq. ft. High Bay 14,000 gross sq. ft. Laboratory & Office Approximately 16 employees

National ERT / CMAD Facility 4900 Olympic Blvd. Building A Erlanger, Kentucky 41018 13,947 gross sq. ft.

Approximately 19 employees

Boat Warehouse Facility 5871 Highland Ridge Drive Cincinnati, Ohio 45232 7,920 gross sq. ft.

Streams Facility 1003 US Highway 50 Milford, Ohio 45150

6,56 gross sq. ft.

Approximately 3 employees

Kenwood Warehouse Storage 11029 Kenwood Road

Cincinnati, Ohio 45242 115,000 gross sq. ft.

Approximately 1 employee

2. Tasks The Security Management Contractor shall manage the EPA Security Program with direction from the EPA Contracting Officer’s Representative (COR). The contractor shall assess threats and vulnerabilities through risk analysis and make recommendations to the COR on determining any changes in required level of security necessary to provide oversight for physical security programs at multiple locations with a variety of operational functions. Security threats include but are not limited to human threats which are those typically defined as active threats, crimes, terrorism, sabotage, and operational and procedural deficiencies. In addition, the contractor shall have an understanding and knowledge of emergency operations/preparedness procedures to manage a crisis caused by natural disasters such as fires, floods, tornadoes, earthquakes chemical release, etc., and in other threatening environments. The contractor shall be knowledgeable of the current Homeland Security Alert Levels established by the National Terrorism Advisory System (NTAS), the Risk Management Process for Federal Facilities: An interagency Security Committee Standard Appendix B: Countermeasures (to be provided by the COR) as well as the Armed Contract Security Officers in Federal Facilities: An Interagency Security Committee Best Practice.

The contractor shall be knowledgeable with security requirements and management techniques for building structures, vehicle screening, and physical security for Secure Access Facilities (up to SECRET).

The Security Management Contractor shall also train, operate, manage, maintain, and coordinate required upgrades to security related equipment which includes the Radios, X- Ray Units, Magnetometers, (training will be IAW DHS National Weapons Detection Training Program (NWDTP) standards). Hand Wand Metal Frisk Devices, and mirrors on wheels, which are located throughout each facility.

The contractor shall provide one (1) passenger patrol vehicle not more than four-years old for the AWBERC Facility for travel to all Cincinnati EPA facilities to complete required security rounds and emergency response. The passenger patrol vehicle shall meet EPA ‘s Alternate Fuel Vehicle Standards which are designed to reduce or eliminate fossil fuel carbon emissions.

The contractor shall comply with all current and amended EPA Standard Operating Procedures (SOPs) as specified in Appendix A.

The contractor shall provide professional uniforms IAW ISC Armed Contract Security Officers in Federal Facilities Best Practice, Paragraph 5.0 and 5.2.2.

Security Management Services shall include, but are not limited, to the following:

(a) Deter and report unauthorized personnel or vehicular entry.

(b) Deter and report damage, pilferage, removal, secreting, misappropriation, misuse, larceny, theft, or other improper or unlawful threats to, or disposition of, government or personnel property or acts of espionage, sabotage, or wrongful destruction within EPA designated properties.

(c) Endeavor to prevent the occurrence of fires, explosions, collapses, and other catastrophes. In such an event, the contractor shall summon appropriate response forces and then notify appropriate government personnel as identified in the Standard Operating Procedures (SOPs); Assist in minimizing the effects thereof; and assist in restoring the area to a safe condition.

(d) Safeguard personnel, deter the commission of crimes against persons, summon appropriate response forces, and assist those response forces as required. This includes Active Threats.

(e) Deter and report violations of local, state, and federal laws, and enforce rules established by EPA regarding parking, and entry into buildings, as required.

(f) Provide proper documentation and reports of all incidents and investigations.

(g) Perform duties to administer physical access using the Physical Access Control System (PACS).

(h) Provide an on-call contingent (surge capacity) of additional guard force personnel to quickly and decisively back up any contractor employee confronted with a situation requiring additional personnel.

(i) Provide additional acceptable guard force personnel for special details and or events.

(j) Receive, secure, issue, and account for all keys issued to government and contractor personnel under the contractor’s control.

(k) Enforce the property pass program.

(l) Manage a lost and found program. Articles found will be turned over to the COR, if not claimed.

(m) Provide fixed post/monitoring station guards and roving patrols.

(n) Provide escorts for visitors and materials as directed by the COR.

(o) Provide camera and intrusion alarm monitoring.

(p) Provide emergency assistance to local police and fire departments and other law enforcement agencies as necessary.

(q) Provide Security Guard Support Services for Research Field Site Activities on a case-by-case basis to protect EPA Assets and Employees.

(r) Operate and maintain armory for stowage of firearms and ammunition.

Armed Security Guard Services

The Security Management Services Contractor shall provide Armed Security Guard Services the EPA facilities listed above. EPA understands there will be an extensive amount of classroom and firing range training associated with this aspect of the contract. Therefore, the contractor will be provided a maximum of 120 days from the effective date of the contract to safely implement an armed security guard force at the U.S. EPA facilities located in Cincinnati, Ohio area.

Authority

a) The Security Management Services Contractor shall obtain a permit for each employee to carry a firearm for the state of Ohio and Commonwealth of Kentucky. Firearm permits shall be carried by each employee while on duty unless local or state law requires the Contractor to maintain the records. The Contractor shall provide any official bonds required and pay any fees or costs involved or related to the authorization for the arming of any employees engaged in providing services specified under this contract.

b) The Security Management Services Contractor shall obtain all licenses, certificates, training and/or permits necessary for each employee to perform as an armed security guard in the state of Ohio and Commonwealth of Kentucky. Copies of all licenses, permits and certifications described herein shall be furnished to the COR prior to the commencement of work under this contract.

Firearms, Ammunition and Storage

a) The Security Management Services Contractor shall provide Firearms to equip each employee while on duty. Privately owned firearms are not authorized for use by the Contractor employees while on duty and shall not be brought onto the premises at any time. Firearms shall be similar or equal to Glock Model 19 or Glock Model 17 semi-auto 9mm. In addition, five (5) firearms (9mm) shall be kept in the AWBERC armory in reserve to replace any firearms found to be defective. The COR is responsible for verifying the furnished firearms comply with the requirements outlined herein. In the event of a dispute regarding whether firearms meet the requirements, the government will make the final decision.

b) Appropriate and ample supplies of firearm maintenance equipment such as cleaning solvents, lubricating oils, rods, brushes, patches, and other normal maintenance tools, shall be provided by the Security Management Services Contractor. Firearms shall be inspected by the Contractor’s Training Officer prior to issuance to employees. Weapons inspection and issuance will be documented on a Firearms/Guard Equipment Control Register Log or equivalent.

Firearms shall be cleaned and oiled weekly or more frequently as weather and/or environmental conditions may require, ensuring optimal operating conditions. The Security Management Services Contractor shall maintain documentation of firearms cleaning and submit to the COR monthly.

c) The contractor shall store the firearms and ammunition in the Armory located inside of Command Center (G14). The Security Management Services Contractor shall be responsible for strict accountability for all firearms and ammunitions.

d) Firearms shall be handled in a safe and prudent manner. Weapons inspections, which shall include loading and unloading of ammunition and the clearing of the firearm, shall take place in the armory. The Armory is the only area designated for weapons inspections. Note:

Inspections shall occur monthly.

e) On-site weapons storage will be permitted under this Task Order. The Security Management Services Contractor shall implement a plan to safely store the weapons and ammunition on-site in accordance with The Department of Homeland Security Uniformed Force Operations Handbook. (https//www.dhs.gov).

f) All firearms shall be always accounted for. On-site supervisors and employees shall keep an accurate account of issued firearms /equipment on a Firearms/Guard Equipment Control

Register Log provided by the Security Management Services Contractor.

g) The Security Management Services Contractor shall provide a list of serial numbers of firearms to be utilized during performance of this contract to the COR prior to beginning work on this contract. The list shall be always kept current by the Security Management Services Contractor. Copies of this list shall be provided to the COR on an annual basis.

h) Ammunition for authorized firearms shall be provided by the Security Management

Services Contractor. Each employee, entering on duty, shall have thirty (30) rounds of standard 115 grain, Federal Hydra Shock, or equivalent, +P type Ammunition. Ten (10) rounds shall be used in the weapon with twenty (20) rounds carried in an ammo pouch. Ammunition shall be inspected daily by the Security Management Services Contractor to ensure it is safe for effective use.

i) One thousand rounds of ammunition for the Glock 19 or Glock 17 shall be stored at an on-site location to accommodate emergencies and to be available in the event additional services are ordered. Ammunition shall be replaced every twelve months by the Security Management Services Contractor.

Firearms, Training/Qualification and Certification

a) Firearms training. The Security Management Services Contractor shall provide firearms training for all guards, including supervisors, working under this Task Order. Firearms qualifications for certification must be equivalent to or higher than the Standard Automatic Weapon Course identified herein. Written confirmation of completed training shall be provided to the COR on a quarterly basis or as completed.

b) Qualification and Certification. All Security Management Services Contractor employees shall complete and pass the firearms proficiency testing prior to assignment of a weapon under this contract. The testing of applicants will be conducted by a Federal/State Certified Security Institution or Police Academy. The Security Management Services Contractor must submit to the COR a Pistol Qualification Record and document the firearms qualification of each Security Management Services Contractor Security Officer. Each Pistol Qualification Record shall be signed by a certified firearms instructor, certifying the applicant has been tested and has successfully passed the firearms qualification course specified herein under the Standard Automatic Weapon Course.

1) Firearms qualification and training shall be performed with weapons and ammunition specified in this Performance Work Statement. In addition, the Security Management Services Contractor shall provide the necessary weapons and ammunition for qualification testing.

2) Firearms qualification under this contract will be valid for six (6) months from the date of qualification and testing. The Security Management contractor shall immediately remove from duty under this task order any personnel who fail to maintain current qualifications.

3) The maximum number of attempts to qualify shall be limited to two (2) attempts within a 30-day period, with the 30-day period commencing with the date of the first attempt. The Federal/State Certified Security Institution or Police Academy Instructor will have final decision on pass/fail at the end of the training day. The contractor shall ensure compliance by ensuring a supervisor attends all qualification training dates and confirms qualification status to the PM and COR via an arming roster.

4) The Security Management Services Contractor shall be responsible for notifying the COR when its employees are ready to be tested for firearms qualifications. The COR is authorized to witness the firearm qualification of employees both at the time of the initial qualification and at the annual qualification. The contractor shall ensure a supervisor is available at all firearm qualifications.

5) Firearms Safety. The contractor will provide a portable clearing barrel.

Disciplinary Action The Security Management Services Contractor shall implement a Zero Tolerance Policy which will ensure the immediate removal from duty under this order of any employee who after a thorough investigation is determined to have:

a) Removed their weapon from their holster unless being attacked by lethal means or protecting employees (Examples: Knife, Gun, pepper spray, or Explosive Device).

b) Participated in Horse Play.

c) Handled the weapon in an unsafe manner.

d) Implied the use of the weapon in an inappropriate manner/situation.

e) Left the weapon unattended in an unsecured area.

f) Assumed their assigned post while intoxicated

Maintain the Software House C-Cure 9000 Physical Access Control System (PACS) The Security Management Services Contractor shall provide day-to-day management of the Physical Access Control System (PACS). This includes adding and removing card reader access, database management, creating local badges, monitoring of event logs, and responding to alarms.

Maintain the Video Surveillance and Monitoring System The Contractor shall agree to provide unlimited service and maintenance calls by a qualified technician to ensure all cameras, servers, client computers (includes all software updates) are fully functional and operational at all EPA Cincinnati Facilities (AWBERC, Annex 1 Annex North and West with CSAF, FCF, Child Care, CH, T&E, and ERT). The Contractor shall ensure all equipment needing replacement are replaced with new equipment authorized by the COR. Service calls shall be responded to within no less than 24 hours, Monday through Friday (Verbal / Written action Plan within 4 hours). Service is also possible on holidays and weekends if mutually agreed to by the Security Management Services Contractor and the COR.

Maintain the Public Address System The Contractor shall agree to provide unlimited service and maintenance calls by a qualified technician to ensure all speakers, amplifiers, intercoms, computers (includes software updates), master controllers, A-phones, and servers are fully functional and operational at EPA Cincinnati (AWBERC, Annex 1 Annex North and West, FCF and Childcare) as well as the outlying facilities (Erlanger ERT, Center Hill Research Facility and T&E). Furthermore, the contractor shall agree to provide annual diagnostic checks to service calls. Service calls shall be responded to within no less than 24 hours, Monday through Friday (Verbal / Written action Plan within 4 hours). Service is also possible on holidays and weekends if mutually agreed to by the Security Management Services Contractor and the COR.

Cybersecurity Tasks:

Cybersecurity and Protecting Sensitive Information Task A - Personally Identifiable Information Contract Closeout

(a) Definition. Personally Identifiable Information (PII) - as defined in OMB Memorandum M- 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, PII refers to sensitive information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.

https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf

(b) Certification of Sanitization of EPA-provided and EPA-Activity-Related Files and Information (including but not limited to all records, files, and metadata in electronic or hardcopy format). As part of contract closeout, the Contractor shall submit a Certification of Sanitization of EPA-provided and EPA-Activity-Related Files and Information to the Contracting Officer and the Contracting Officer’s Representative (COR) following the template provided in Appendix G of National Institute of Standards and Technology (NIST) Special Publication 800- 88, Guidelines for Media Sanitization Revision 1, which assesses risk associated with Personally Identifiable Information (PII) that was generated, maintained, transmitted, stored or processed by the Contractor. The Senior Agency Official for Privacy (SAOP) shall review the Certification and coordinate with the Contracting Officer and the COR.

Task E - Authority to Operate (ATO) Suspension or Revocation

(a) Definitions.

(i) Authority to Operate (ATO) - Signed by the Agency chief information officer (CIO) or deputy CIO, ATOs are issued for all information systems that input, store, process, and/or output Government information. In order to be granted an ATO, all federal information systems must be compliant with National Institute of Standard and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems. Contractors whose internal information systems will process Sensitive Information incidental to Agency product or service development must meet requirements for NIST SP 800- 171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, instead of NIST SP 800-53.

ii) Information Security Incident - an occurrence that results in actual or potential jeopardy to the confidentiality, integrity, or availability of an information system or the information the system processes, stores or transmits, or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. The Contractor must report all known Information Security Incidents to the NSI Representative within 30 minutes if they involve Sensitive Information.

(iii) Sensitive Information - As defined in NIST SP 800-53, Security and Privacy

Controls for Federal Information Systems and Organizations, Sensitive Information is any information where the loss, misuse or unauthorized access to, or modification of, could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a (the Privacy Act), but that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy. Sensitive Information is subject to http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf stricter handling requirements than non-sensitive information because of the increased risk if the data are compromised. Some categories of Sensitive Information include Financial, Medical or Health, Legal, Strategic and Business, Human Resources, Personally Identifiable Information (PII), and Sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

(b) In the event of an Information Security Incident, the Government may suspend or revoke an existing ATO (either in part or in whole). If an ATO is suspended or revoked in accordance with this requirement, the Contracting Officer may direct the Contractor to take additional security measures to secure Sensitive Information. These measures may include restricting access to Sensitive Information on the Contractor information technology (IT) system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the Sensitive Information from the Internet or other networks or applying additional security controls.

(c) The Contractor agrees to insert in each subcontract or consultant agreement placed hereunder, provisions which shall conform substantially to the language of this requirement, including this paragraph, unless otherwise authorized by the Contracting Officer.

Task F - Security Monitoring and Alerting Requirements

(a) The Contractor must comply with the EPA-used Department of Homeland Security (DHS)

Continuous Diagnostics and Mitigation (CDM) policy for security monitoring and alerting, which includes requirements not limited to:

(1) System and Network Visibility and Policy Enforcement at the following levels:

(i) Edge

(ii) Server / Host

(iii) Workstation / Laptop / Client

(iv) Network

(v) Application

(vi) Database

(vii) Storage

(viii) User

(2) Alerting and Monitoring

(3) System, User, and Data Segmentation

(b) The Contractor agrees to insert in each subcontract or consultant agreement placed https://www.dhs.gov/cdm https://www.dhs.gov/cdm hereunder, provisions which shall conform substantially to the language of this requirement, including this paragraph, unless otherwise authorized by the Contracting Officer.

Task G - IT Security and Privacy Awareness Training

(a) The Contractor must ensure all Contractor personnel complete EPA-provided mandatory security and privacy training prior to gaining access to EPA information systems. Non-compliance may result in denial of system access.

(b) The Contractor must ensure all Contractor personnel complete security and privacy refresher training on an annual basis. EPA will provide notification and instructions to the Contractor on completing this training.

(c) The Contractor must ensure each Contractor employee review and sign the EPA Rules of Behavior pertaining to appropriate use of EPA information systems prior to gaining access to EPA information systems. The Contractor must also ensure each Contractor employee reviews these EPA Rules of Behavior at least annually. EPA will provide notification to the Contractor when these reviews are required.

(d) The Contractor agrees to insert in each subcontract or consultant agreement placed hereunder, provisions which shall conform substantially to the language of this requirement, including this paragraph, unless otherwise authorized by the Contracting Officer.

Task H - Specialized Information Security Training for Staff with Significant Security Responsibilities

(a) The Contractor must ensure all IT and Information Security personnel receive the necessary technical

(for example, operating system, network, security management, and system administration) and security training to carry out their duties and maintain certifications.

(b) The Contractor agrees to insert in each subcontract or consultant agreement placed hereunder, Task M - Contractor Access to EPA IT Systems

(a) Immediately following contract award, the Contractor shall provide to the Contracting Officer’s

Representative (COR) a complete list of Contractor employee names requiring access to EPA information systems.

(b) The Contractor shall provide a Contractor employee change report by the fifth day of each month after contract award to the COR. The report shall contain the listing of all Contractor employees who separated or were hired under the contract in the past 60 days. This report shall be submitted even if no separations or hires have occurred during this period. Failure to submit a contractor employee change report may, at the Government’s discretion, result in the suspension of all network accounts associated with this contract. The format for this report will be provided by the COR.

(c) (1) The Contractor shall require each of its employees who will need system access for six months or less to utilize a Personal Identity Verification-Interoperable (PIV-I) card or equivalent, as determined by EPA, to access EPA information technology (IT) systems. The Contractor shall ensure its employees will not share accounts to access EPA IT systems and Sensitive Information. (2) The Contractor shall require each of its employees who will need system access for more than six months to utilize an HSPD-12 compliant Personal Identity Verification (PIV) card, to access EPA IT systems and Sensitive Information. The Contractor shall ensure its employees complete a federal government-initiated background investigation as part of the PIV issuance process.

(d) EPA, at its discretion, may suspend or terminate Contractor access to any systems, information/data, and/or facilities when an Information Security Incident or other electronic access violation, use or misuse issue warrants such action. The suspension or termination shall last until EPA determines the situation has been corrected or no longer exists. Upon request by EPA, the Contractor shall immediately return all EPA information/data, as well as any media type that houses or stores Government information.

(e) The Contractor shall notify the COR at least five days prior to a Contractor employee being removed from a contract (notification shall be at least 15 days for key personnel in accordance with requirement 1552.237-72, Key Personnel). For unplanned terminations or removals of Contractor employees from the Contractor organization occurring with less than five days’ notice, the Contractor shall notify the COR immediately. The Contractor shall ensure HSPD-12/PIV cards issued to a Contractor’s employee shall be returned to the COR prior to the employee’s departure

(f) The Contractor agrees to insert in each subcontract or consultant agreement placed hereunder, Task N - Individual Notification for Personally Identifiable Information

(a) Definitions.

(1) Information Security Incident is an occurrence resulting in actual or potential jeopardy to the confidentiality, integrity, or availability of an information system or the information the system processes, stores or transmits, or constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.

(2) Personally Identifiable Information (PII), as defined in OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, refers to sensitive information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment made by the EPA Privacy Officer of the specific risk an individual can be identified. Non-PII can become PII whenever additional information is publicly available — in any medium and from any source — is or can be combined to identify an individual. As an example, PII includes a name and an address because it uniquely identifies an individual, but alone may not constitute Sensitive PII.

3) Sensitive PII refers to personally identifiable information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling than PII because of the increased risk to an individual or associates if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Social Security Numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), are also considered Sensitive PII. In addition, the context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or complaint.

(b) The Contractor shall have in place procedures and the capability to notify any individual whose

Personally Identifiable Information (PII) resided in the Contractor information technology (IT) system at the time of an Information Security Incident not later than five business days after being directed by the Contracting Officer to notify individuals, unless otherwise approved by the Contracting Officer. The procedures must be approved by the EPA prior to use. The method and content of any notification by the Contractor shall be coordinated with, and subject to prior written approval, by the Contracting Officer in consultation with authorized EPA officials at EPA’s discretion. The Contractor shall not proceed with notification unless the Contracting Officer has determined in writing that notification is appropriate.

(c) Subject to Government analysis of the incident and the terms of its instructions to the Contractor regarding any resulting notification, the notification method may consist of letters to affected individuals sent by first class mail, electronic means, or public notice, as approved by the Government. Notification may require the Contractor’s use of address verification and/or address location services. At a minimum, the notification shall include:

(1) A brief description of the incident.

(2) A description of the types of PII and Sensitive PII involved.

(3) A statement as to whether the PII or Sensitive PII was encrypted or protected by other means.

(4) Steps individuals may take to protect themselves.

(5) What the Contractor and/or the Government are doing to investigate the incident, to mitigate the incident, and to protect against any future incidents;

and

(6) Information identifying who individuals may contact for additional information, including Contractor name and point of contact (POC) and contract number.

(d) The Contractor agrees to insert in each subcontract or consultant agreement placed hereunder, Task P - Compliance with IT Security Policies

(a) Information systems and system services provided to EPA by the Contractor must comply with current EPA information technology (IT), IT security, physical and personnel security and privacy policies and guidance, and EPA Acquisition Regulation 1552.211-79, Compliance with EPA Policies for Information Resources Management.

(b) Contractors are also required to comply with current Federal regulations and guidance found in the

Federal Information Security Modernization Act (FISMA) of 2014, Privacy Act of 1974, E- Government Act of 2002, Federal Information Processing Standards (FIPS), the 500- and SP500- and 800-Series Special Publications (SP), Office of Management and Budget (OMB) memoranda and other relevant Federal laws and regulations that are applicable to EPA.

(c) The Contractor agrees to insert in each subcontract or consultant agreement placed hereunder, Task V - Termination for Default - Failure to Report Information Security Incident

(a) Definition. Information Security Incident is an occurrence that results in actual or potential jeopardy to the confidentiality, integrity, or availability of an information system or the information the system processes, stores or transmits, or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.

(b) If the Contractor was aware of an Information Security Incident and did not disclose it in accordance with the requirements specified in this contract or misrepresented relevant information to the Contracting Officer, the Government may terminate the contract for default, debar the Contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

(c) The Contractor agrees to insert in each subcontract or consultant agreement placed hereunder, Note: The Security Management Services Contractor shall insure coordination is made with the facility IT staff through the COR, so all installation areas are identified and agreed to by all parties prior to initiation of work.

Identification Proofing, Electronic/Manual Fingerprinting, and HSPD -12, Smart Card/ Identification Badge Issuance The Security Management Services Contractor shall provide service required to meet Homeland Security Presidential Directive 12 (HSPD -12). When directed by the COR the Security Management Services Contractor shall schedule and obtain electronic fingerprints and submit them to Office of Personnel Management (OPM) electronically to begin the required Background Investigation. Once favorable investigation results are acquired the new employee will be issued the Government Smart Card. It normally takes up to 2-3 weeks to receive their PIV card.

Note: All new hires that plan to work at EPA Cincinnati Facilities shall require identification proofing/verification, and sponsorship prior to issuance of the Government mandated Smart Card.

Standard Operating Procedures (SOPs) The Security Management Services Contractor shall maintain a current copy of the EPA’s SOPs at each fixed/monitoring guard station. A detailed review of the SOPs shall be provided as part of each employee’s initial training, and each time the SOP are updated. No employee shall be assigned to duty unless he/she is thoroughly knowledgeable of and understands the SOPs. The SOPs are considered a living document and will be modified periodically or as required to reflect required changes in the government’s guard services policies and procedures.

3. Government Furnished Property, Materials and Services The Government will provide to the Security Management Services Contractor the property identified in Attachment 5 GFE “Government Furnished Equipment” for use in connection with this contract. The Government will also provide all utilities (water, electricity, heating, and air conditioning) to the Security Management Services Contractor.

4. Contract Management

The Security Management Services Contractor shall manage the total work effort associated with the security management services required herein to assure fully adequate and timely completion of these services. Such management includes, but is not limited to, planning, scheduling, report preparation, establishing and maintaining records, quality control, and periodic maintenance, and upgrades of all furnished equipment. The Security Management Services Contractor shall provide appropriate staff with the necessary management expertise to assure the performance of the required work. In addition, the Contractor shall ensure all guard force personnel are trained to be proficient at all posts.

a) Work Control:

The Contractor shall implement all necessary scheduling and personnel/equipment control procedures to ensure timely accomplishment of all guard services requirements.

b) Initial Work Schedule:

Within 15 calendar days after contract award, the Security Management Services Contractor shall submit to the COR, a general schedule of planned performance of work for the contract period. The schedule shall indicate the day or days of the week that weekly or more frequent services will be accomplished, the week of the month that items of less than weekly frequency will be accomplished, the location to provide services, and the services to be accomplished.

c) Monthly Work Schedule:

The Security Management Services Contractor’s monthly work schedule shall indicate the specific hours of the day each post/monitoring station will be manned, including the number of personnel per post. Proposed changes to the monthly work schedule shall be submitted to the COR at least 72 hours prior to the start of the period in question.

d) Records and Reports:

The Contractor shall maintain records and prepare all reports as set forth in the Performance Work Statement. A copy of all reports shall be always maintained onsite and available for inspection by the Government. All records and copies of records shall be turned over to the COR within five (5) calendar days after contract completion.

Monthly Reports:

Following the first complete calendar month of the contract, one copy of each of the following reports will be submitted to the COR on the 3rd day of the beginning of the month. The reports are the Firearms, Servers rooms, Training report, Monthly attendance summary, Local Badge Issuance and Pass Office Activity Reports. In addition, the Contractor shall include a written report on the maintenance status of all equipment listed in the Performance Work Statement.

Daily Reports:

The contractors shall submit an End of Day report of all Pass Office Activities and all visitor log in reports.

Incident Reports:

Incident reports shall be submitted to the COR within 30 minutes of an incident of criminal activity, medical emergency, emergency response by police or fire department, or other circumstances that the COR deems that a report is required, either in hard copy or via email.

Identification Card Listings:

Identification card listings shall be submitted to the COR, upon request, identifying Agency employees, contractor, grantee, temporary and special category employees. The listings shall be maintained by ID number, and order, and by facility location, using the database designed for this function.

Key Control Card Listing, EPA 143 (CIN) shall be provided to the COR, upon request, showing…