Draft_SOW_CEEOSS 4Dec23.docx

DEPARTMENT OF HOMELAND SECURITY (DHS)

STATEMENT OF WORK (SOW)

FOR

Cybersecurity and Infrastructure Security Agency (CISA) Enterprise Engineering and Operations Support Services (CEEOSS)

December 4, 2023

1.0 GENERAL

1.1 BACKGROUND

CISA’s mission is to lead the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. CISA includes the CISA Mission Enabling Offices (MEOs) and six Divisions: the Cybersecurity Division (CSD), the Emergency Communications Division (ECD), the Integrated Operations Division (IOD), Infrastructure Security Division (ISD), the Stakeholder Engagement Division (SED), as well as, the National Risk Management Center (NRMC), which are headquartered within the National Capital Region (NCR).

CISA’s information technology (IT) landscape has historically produced networks and systems individually managed and maintained within each of its Divisions as well as its MEOs. This task order is to provide Enterprise Engineering and Operations Support Services (EEOSS) to CISA/OCIO to establish enterprise IT capabilities. These enterprise IT capabilities shall support CISA’s ability to continue establishing a modern IT infrastructure; engaging in various initiatives to evaluate and implement emerging technologies; migrating to the cloud; supporting mobility and collaboration platforms; and continually improving the performance, security, and availability of enterprise IT services.

1.2 SCOPE

The Contractor shall perform the services listed below for the functional areas and shall ensure the services are integrated, well defined, and documented, standardized, repeatable, accurate and timely. All the associated processes in all functional areas shall produce secure, high quality and cost-effective services, work products and IT solutions, and shall be properly documented using the ITIL v3 framework. The Contractor shall perform these services in a manner that will drive efficiencies through continual maintenance and improvement of documented processes.

This SOW is details CISA’s requirement for the following services:

· Technology Evaluation and Integration

· Enterprise Technology Services and Solutions Strategy and Architecture

· Technical Solutions Engineering and Implementation

· Operations and Maintenance Support

· Program / Project Management

1.3 OBJECTIVE

CISA’s objective is to obtain expertise to support the:

· Engineering subdivision in architecting, designing, and engineering CISA enterprise IT capabilities and services to include but not limited to network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, and communication services.

· Management of system operations, configurations, and support; overseeing infrastructure asset management; advanced network/infrastructure/application support. The Engineering Subdivision partners work closely with the IT Operations and Service Management subdivision on enhancements and the transition of those enhancements into the production environments for operations and support.

1.4 APPLICABLE DOCUMENTS

1.4.1 Compliance Documents

The following documents provide specifications, standards, or guidelines that must be complied with in order to meet the requirements of this task order:

1. Federal Information Security Management Act of 2014 https://www.gpo.gov/fdsys/pkg/PLAW-113publ283/pdf 3.pdf

2. Section 508 of the Rehabilitation Act of 1973 (amended) https://www.gpo.gov/fdsys/pkg/USCODE-2011-title29/html/USCODE-2011-title29- chap16-subchapV-sec794d.htm

3. Federal Travel Regulations, General Services Administration https://www.gsa.gov/policy- regulations/regulations/federal-travel-regulation-ftr?asset=105444

4. Government Performance Results Act of 1993 https://www.gpo.gov/fdsys/pkg/STATUTE- 107/pdf/STATUTE-107-Pg285.pdf

5. FIPS-140-2 Security Requirements for Cryptographic Modules.

6. FIPS-199 Standards for Security Categorization of Federal Information and Information systems.

7. NIST SP800-53 rev 4 Security and Privacy Controls for Federal Information Systems and Organizations.

8. DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified Information

9. DHS Management Directive 4300A Sensitive Systems Policy

10. DHS Management Directive 142-02-001 Information Technology Integration & Management

11. DHS Instructions 102-01-103 System Engineering Life Cycle (SELC)

12. DHS Management Directive 140-01 Information Technology Security Program Revision 2

13. DHS Section 508 Compliance Test Process for Applications https://www.dhs.gov/publication/dhs-section-508-compliance-test-processes

14. DHS Management Directive 11056.1, Sensitive Security Information (SSI)

15. DHS Privacy Incident Handling Guide, Version 3.0, January 26, 2012

16. DHS Instruction 047-01-001 Privacy Policy and Compliance

17. DHS Privacy Policy Guidance Memorandum 2011-02 Roles and Responsibilities for Shared IT Services

18. DHS Instruction Manual 047-01-007, Rev # 03 Handbook for Safeguarding Sensitive Personally Identifiable Information; Handbook for Safeguarding Sensitive Personally Identifiable Information March 2012

19. DHS Instruction 047-01-001 Privacy Policy and Compliance

20. DHS 4300A DHS Sensitive Systems Policy Directive, Version 13.1

21. DHS Instructions Guide 026-06-001 Test and Evaluation Master Plan (TEMP)

22. DHS Procedures for Operational Test and Evaluation of Cybersecurity

23. DHS Management Directive (MD) 4010.2: Section 508 Program Management Office Electronic and Information Technology Accessibility.

24. Homeland Security Enterprise Architecture (HLS EA), current version.

25. Office of Management and Budget M-07-16, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” May 22, 2007

1.4.2 Reference Documents

The following documents may be helpful to the Contractor in performing the work described in this document:

· Federal Information Technology Acquisition Reform Act (FITARA), 2015: [footnoteRef:2] [2: Title VIII, Subtitle D of the National Defense Authorization Act (NDAA) for Fiscal Year 2015, Pub. L. No. 113-291. ]

· Provides the statutory basis for Federal-wide IT reform

· Federal Information Technology Shared Services Strategy, May 2, 2012: [footnoteRef:3] [3: https://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/shared_services_strategy.pdf. ]

· Provides organizations in the Executive Branch of the United States Federal Government (Federal Agencies) with policy guidance on the full range and lifecycle of intra- and inter-agency IT shared services that enable mission, administrative, and infrastructure-related IT functions.

· Federal CIO 25 Point Implementation Plan to Reform Federal Information Technology Management, Dec 9, 2010: [footnoteRef:4] [4: https://www.dhs.gov/sites/default/files/publications/digital-strategy/25-point-implementation-plan-to-reform-federal-it.pdf]

· Specifies that “Agencies must focus on consolidating existing data centers, reducing the need for infrastructure growth by implementing a Cloud First policy for services, and increasing the use of available cloud and shared services”.

· Federal Risk and Authorization Management Program (FedRAMP): [footnoteRef:5] [5: https://www.fedramp.gov/about-us/about/]

· Provides joint "provisional" authorizations and continuous security monitoring services applicable to “Executive departments and agencies procuring commercial and non-commercial cloud services that are provided by information systems that support the operations and assets of the departments and agencies, including systems provided or managed by other departments or agencies, contractors, or other sources”.

· Federal Cloud Computing Strategy, Feb 8, 2011: [footnoteRef:6] [6: https://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/federal-cloud-computing-strategy.pdf]

· Intends to articulate the benefits, considerations, and trade-offs of cloud computing by: providing a decision framework and case examples to support agencies in migrating towards cloud computing; highlighting cloud computing implementation resources; and, identifying Federal Government activities and roles and responsibilities for catalyzing cloud adoption.

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 TASK ONE. Technology Evaluation and Integration

Contractor access to classified information will be required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task deals with identifying, evaluating, and recommending emerging technologies and/or services that can be implemented to establish and improve CISA enterprise network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, and communication services to meet CISA mission requirements.

2.1.1 Market Research

Contractor shall track industry trends, engage with vendors and service providers to identify emerging technologies and solutions, and conduct market research to identify viable options for technologies and solutions that will meet CISA mission requirements and establish and improve technology performance, availability, and reliability.

2.1.2 Trade Studies and Evaluations

Contractor shall conduct trade studies to evaluate and identify the most acceptable technology or solution to satisfy a specified set of requirements or criteria. Contractor shall test related solutions / technologies and document findings and recommendations to assist the Government in making decisions regarding solutions and/or services to procure and/or implement. Contractor shall conduct Proof of Concepts (PoCs)/Proof of Values (PoVs) to demonstrate new or improved services/capabilities as directed by the Government.

2.1.3 Technology Refresh Recommendations

Contractor shall test, evaluate, and make recommendations on new technologies or solutions to replace aging related technologies.

2.2 TASK TWO. Enterprise Technology Services and Solutions Strategy and Architecture

Contractor access to classified information will be required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task encompasses the identification of functional requirements; developing the business case for implementation of new CISA enterprise network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, and communication services; developing and maintaining an Enterprise Technology Strategy and Target Architecture, establishing architecture standards, and developing the conceptual and logical designs for DHS CISA/OCIO related systems.

When architecting and designing solutions, strategies, and/or services, the Contractor shall design in accordance with DHS and CISA security requirements to achieve the architecture and engineering objectives of ensuring a secure scalable, interoperable and flexible system.

2.2.1 Requirements Analysis

Contractor shall collaborate with the appropriate stakeholders to identify functional and technical requirements for new or enhanced capabilities and/or services to support the CISA mission.

2.2.2 Business Cases

Contractor shall conduct Return on Investment (ROI) analyses and develop business cases for the procurement and/or implementation of new related technologies and/or services.

2.2.3 Enterprise Technology Strategy and Target Architecture

Contractor shall create and maintain an Enterprise Network Taxonomy document, document the target technology architecture or framework, and develop an Enterprise Technology Strategy to achieve the target architecture.

2.2.4 Technology Architecture Standards and Design

Contractor shall establish and maintain architecture standards and develop and maintain System Design Documents (SDDs) with the conceptual and logical designs for new and existing related systems. Contractor shall develop technology architectures and designs to fulfill functional and business requirements. The Contractor shall install, configure, and manage software defined network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, and communication services and solutions.

2.3 TASK THREE. Technical Solutions Engineering and Implementation

Contractor access to classified information will be required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task encompasses, but is not limited to, the identification of technical requirements and also includes engineering and implementing network, identity and access management, mobility, asset management, imaging, application and systems development, collaboration capabilities, cloud hosting, communication services, and solutions connectivity to cloud services to facilitate migration to the cloud; engineering and implementing solutions and capabilities in data centers, CISA facilities, and/or cloud environments; providing Tier 3 escalation support to troubleshoot and/or resolve related issues in a timely manner; and transitioning management of solutions to operations and support team for continued operations and maintenance.

When engineering and implementing solutions and/or services, the Contractor shall design, implement, and test security controls to meet DHS and CISA security requirements and achieve the architecture and engineering objectives of ensuring a scalable, interoperable and flexible system.

2.3.1 Technology Design

Contractor shall engineer and design secure technologies supporting CISA locations and remote work that meets CISA standards and other functional and business requirements to support CISA end-users’ requirements based on site type, applications, location, and processing needs. The Contractor shall develop a comprehensive Detail Design Document (DDD) based on the System Design Document (SDD) for CISA sites. Contractor shall review and update the DDDs on a periodic basis to reflect a new design(s) and/or technologies.

2.3.2 Enterprise Technology Infrastructure

Contractor shall engineer, design, test, and implement an enterprise network infrastructure and technologies at CISA. These services shall include but not limited to:

· Identity and access management (IAM)

· Mobility,

· Asset management,

· Imaging,

· Application and systems development,

· Collaboration capabilities,

· Cloud hosting and services

· Network communication solutions The contractor shall leverage latest technologies, trends, and best practices to provide a secure, robust, high performance, and reliable network that supports all existing and future CISA applications. In addition, these services shall improve CISA’s business agility and resilience, lower total cost of ownership (TCO), and increases operational efficiency. The Contractor shall develop a comprehensive Technical Requirements Document (TRD) and Detailed Design Document (DDD) for each system, capability, or service, consistent with FRD and SDD and/or comparative Agile Methodology documentation as applicable for the associated system or solution, before transitioning to Information Technology (IT) Operations subdivision. Contractor shall update the DDD when there is a change in the design and/or technologies. Contractor shall develop a standard Test Plan Template that shall be used to test all systems to verify that it meets requirements and shall work as designed prior to implementing in the production environment. Contractor shall collaborate with all stakeholders and submit a test report along with the Implementation plan for each change that Contractor shall perform on the production network. Manage system hardware and software releases, changes, moves and installation to minimize disruption.

2.3.3 Cloud Network Environment

Contractor shall engineer, design, test, and implement secure and reliable network connectivity to cloud services (e.g., commercial cloud services providers (CSPs), private cloud, and hybrid cloud). Contractor shall develop a comprehensive Technical Requirement Document (TRD) and a Detailed Design Document (DDD) associated FRD and DDD and/or comparative Agile Methodology documentation as applicable, before transitioning to Operations. Contractor shall update the DDD when there is change in the cloud design and/or technologies. Contractor shall collaborate with all stakeholders to test all cloud related systems and application migration process to verify that the systems meet requirements and are able to host applications with no degradation to performance or security. The Contractor shall submit a test report along with the Implementation Plan for each change the Contractor performs on the cloud network environment.

2.3.4 Configuration/Change Management Support

Contractor shall prepare Change Requests (CRs) with supporting documentation (e.g., DDDs, Implementation Plans, Test Plans, and As-Is Diagrams), enter the CR into the configuration management tool, present the CR at various review gates, coordinate with all stakeholder(s) for information sharing, approval, and support.

2.3.5 Hardware and Software Testing and Implementation

Contractor shall conduct thorough testing of all new hardware/software and its command line recommended by the vendors to remediate software bugs and/or vulnerabilities in CISA Engineering Lab or at vendor provided lab to ensure the new hardware integrates well with the existing environment and no secondary bug and/or vulnerability that causes other issues. Once testing of new hardware and/or software is completed, the Contractor shall submit a comprehensive test report to the Government for review and approval. Contractor shall manage system hardware and software releases, changes, moves, installation, and transition to minimize disruption.

2.3.6 Transition to Operations

Contractor shall prepare necessary artifacts, diagrams, procedures, and additional information and data as required in executing transfer of capabilities and solutions to IT Operations for operations, maintenance, and management.

2.4 TASK FOUR. Operations and Maintenance Support

Contractor access to classified information is required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task encompasses operations and maintenance (O&M) of capabilities and solutions transitioned to Operations for their operations, maintenance, and management. These responsibilities include, but are not limited to, system administration; network management, system hosting and access; information assurance management; certification and accreditation support; software patches and upgrades; configuration management; user management and support; backup and recovery; and network and performance monitoring.

2.4.1 Operations Support

The contractor shall provide the necessary operations, maintenance, and maintenance support of capabilities and solutions delivered to Operations. Support shall include but is not limited to

· Logistics

· Service desk support

· Trouble ticket incident tracking and management

· Network management and monitoring

· Systems performance monitoring and capacity planning

· System performance evaluation

· Identity and access management

· Technology integration

· System administration

· Data management

· Infrastructure support

· Asset management

· Image management

· Software patches and upgrades

· Information security vulnerability management

· Information security compliance

· Upgrades

· Fault resolution

· Patch management

· Change, configuration, and release management

· Disaster recovery

· Emerging technology assessments

· Testing processes including all tasks related to production deployment

· System artifact and process maintenance

· Technical refresh

2.5 TASK FIVE. Program / Project Management

Contractor access to classified information will be required under this Task. The maximum level of classification for this Task is Top Secret/SCI (TS/SCI). Details will be specified in a DD Form 254.

This task encompasses program management and project management support to include overall reporting to the Contracting Officer’s Representative (COR), management and reporting of progress and activities in all task areas, coordinating and reporting on Contractor work on projects as directed by the Government project managers and leads, conducting the Kick-Off Meeting, and performing transition in/out activities.

2.5.1 Program Management Services

The Contractor shall provide program management support to include, but not necessarily limited to, overall reporting to the COR and the management and reporting of progress and activities in all task areas. The Contractor shall designate a Program Manager as a single point of contact (POC) capable of program management disciplines, task order administration, and effectively interfacing with subcontractors and CISA at various levels. Contractor shall develop and provide recommendations to improve the support procedures and documentation.

The Program Manager and supporting staff shall perform program management activities that include, but are not necessarily limited to the following:

· Performance tracking and reporting

· Quality control

· Risk management

· Invoicing

· Staffing

· Sub-contractor management

· Submitting Weekly Status Reports (WSRs), Monday NLT 2:00pm EST

2.5.2 Monthly Program Management Reviews

The Contractor Program Manager and/or supporting staff shall coordinate, facilitate, and attend the monthly Program Management Review (PMR) meeting to brief Government management regarding the operational performance under this task order 10 business days after the end of the month. The Contractor shall be responsible for all aspects of the review, including preparing meeting agendas, reports, support documentation, providing meeting minutes, and tracking and reporting action items.

2.5.3 Program Management Support

The Contractor shall coordinate work activities on projects as directed by the Government project manager or lead and provide a Quality Control Plan final plan due 10 business days after the kickoff meeting. The Contractor shall perform project management activities that include, but is not limited to:

· Developing or providing input to a project schedule as directed by the government project manager

· Tracking and reporting project progress with respect to the project plan and schedule

· Staffing projects to implement the project plan and achieve the project objectives

· Coordinating performance of project tasks

· Identifying project risks and develop a mitigation strategy

· Performing quality control for project deliverables

3.0 DELIVERABLES

The Contractor shall consider items in BOLD as having mandatory due dates. Items in italics are deliverables or events that must be reviewed and/or approved by the COR prior to proceeding to next deliverable or event in this SOW.

4.0 CONTRACTOR PERSONNEL

4.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW. The Contractor shall furnish a detailed Staffing Plan that clearly demonstrates how the Contractor will obtain the required staff to meet the Government’s requirements as defined in this SOW. The plan shall include the names and resumes of key personnel, as defined in section 4.3, and any other key positions identified in this SOW. The staffing plan is due by the post award conference.

4.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all task order support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

4.3 Key Personnel

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer.

"Key Personnel" is defined as contractor personnel who are recognized by the Government and Contractor as essential to the successful completion and execution of this task order. Contractor shall provide resumes with the proposal for Key Personnel. Contractor shall identify the following positions as key personnel and provide personnel with the qualifications below:

· Program Manager - Contractor shall identify a program manager to oversee the day-to-day operations of the CEEOSS Task Order and serve as the contractor’s Point of Contact (POC) for the Contracting Officer Representative (COR), and senior level Government managers. The contractor Program Manager should have the following qualifications:

· Project Management Professional (PMP) and ITIL v3 Foundation certified to ensure task order functions, program/project management services, performance tracking and reporting, and task order execution are conducted and managed according to industry best practices.

· A minimum of five (5) years of experience in IT program management.

· A bachelor’s degree in Management, computer science, or information systems.

· Experience with applying the Agile and Scrum methodologies.

· In lieu of a bachelor’s degree, the Government the PM should have an additional 10 years' experience in IT program management for a total of 15 years of experience.

· Lead Enterprise Architect – Contractor shall identify a Lead Enterprise Architect, as key personnel, to serve as the subject matter expert in the areas of application development, network and cloud architecture and design activities. The lead enterprise architect shall lead application and network architecture and design efforts, assist the Government in developing business cases for new technologies and solutions, advise the Government on an information technology (IT) system strategy to meet business objectives and requirements, and research and evaluate new networking technologies to support the CISA mission. In addition, the lead enterprise architect shall demonstrate experience in developing business cases and determining the Return on Investment (ROI); identifying and architecting solutions and technologies to meet business and functional requirements; and applying the Agile and Scrum frameworks and methodologies in support of projects. The lead enterprise architect shall possess a broad knowledge of application development framework and methodology that can be leveraged to seamlessly integrate into CISA enterprise network. The Lead Enterprise Architect should have the following qualifications:

· Have a minimum of ten (10) years of experience in software development.

· Experience in network engineering and a minimum of 5 years in network architecture.

· Possess a bachelor’s degree in engineering, computer science, or information systems.

· In lieu of a bachelor’s degree, the Government the Lead Enterprise Architect should have an additional 10 years' experience in IT architecture and engineering for a total of 15 years of experience.

· Lead Network Engineer – Contractor shall identify a Lead Network Engineer, as key personnel, to serve as the contractor’s subject matter expert in the areas of network engineering design, testing, and deployment. In addition, the lead network engineer shall be responsible for maintaining the design and integrity of CISA Wide Area Network (WAN), Local Area Network (LAN), Enterprise Network Tools, Domain Name Servers (DNS), Wireless, and Cloud environments. The lead network engineer shall provide expert technical assistance to team members and Government with high-level system and networking requests and solution identification. The Lead Network Engineer should have the following qualifications:

· have a minimum of ten (10) years of experience in network engineering and design

· possess a bachelor’s degree in engineering, computer science, or information systems.

· In lieu of a bachelor’s degree, the Government the Lead Network Engineer should have an additional 10 years' experience in IT network engineering for a total of 15 years of experience.

Contractor Key personnel shall not be assigned, by the Contractor, to more than one key position for this requirement.

4.4 Program Manager

The Program Manager shall be responsible for all Contractor work performed under this SOW. The Program Manager shall be a single point of contact for the Contracting Officer and the COR. It is anticipated that the Program Manager shall be one of the senior level employees provided by the Contractor for this work effort. The name of the Program Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Program Manager, shall be provided to the Government as part of the Contractor's proposal. During any absence of the Program Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this task order. Additionally, the Contractor shall not replace the Program Manager without prior approval from the Contracting Officer.

The Program Manager shall be available to the COR via telephone between the hours of 0800 and 1600 ET, Monday through Friday, and shall respond with acknowledgement to a request for discussion or resolution of technical problems within 1 hour of notification. Discussion can be scheduled at a later date and time at the discretion of the government COR and government Program Manager.

4.5 Employee Identification

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

4.6 Employee Conduct

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Program Manager shall ensure Contractor employees understand and abide by Department of Homeland Security and CISA established rules, regulations and policies concerning safety and security.

4.7 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Contracting Officer), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the task order. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

5.0 OTHER APPLICABLE CONDITIONS

5.1 SECURITY

The Contractor must obtain and retain an active Top-Secret facility clearance and Safeguarding Level as None granted by the Defense Counterintelligency and Security Agency (DCSA) throught out the Option Period 1 period of performance and subsequent option periods. Individual access to classified information is required under this SOW, therefore contractors are required to hold the following clearance level(s) at the time they are submitted for a DHS Fitness decision and maintain that level throught the entire task order performance period.

Contractor access to classified information is required under this SOW. The maximum level of classification is Top Secret/SCI. The details will be specified in a Department of Defense (DD) Form 254.

The maximum level of classification for this Task order is Top Secret/SCI (TS/SCI). Specific requirements will be detailed in a DD 254, which will be incorporated via a formal modification to the award.

Task 2.4 – Operations and Maintenance Support – Top Secret/SCI (TS/SCI) Labor Category - PKI Systems Engineer/Cloud Engineer 4 - Top Secret/SCI (TS/SCI)

5.2 POST-AWARD INSTRUCTIONS REGARDING SECURITY REQUIREMENTS FOR CONTRACTS/ORDERS

The procedures outlined below shall be followed for the DHS Office of the Chief Security Officer (OCSO), Personnel Security Division (PSD) to process background investigations, Entry on Duty determinations, and Fitness determinations, as required, in a timely and efficient manner.

Carefully read the security clauses in the task order. Compliance with the security clauses in the task order is not optional.

Contractor employees (to include applicants, temporaries, part-time and replacement employees) under the task order, requiring access to sensitive information, shall undergo a position-sensitivity analysis based on the duties each individual will perform on the task order. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. All background investigations will be processed through the DHS OCSO/PSD. Prospective contractor employees shall submit the below completed forms to the DHS OCSO/PSD. The Standard Form (SF) 85-P must be completed electronically through the Office of Personnel Management’s e-QIP SYSTEM. The SF-85P signature pages and other completed forms must be given to the OSCO/PSD after task order award or thirty (30) days prior to the requested entry on duty date, for all contractor employees whether a replacement, addition, subcontractor employee, or vendor:

· Standard Form (SF) 85-P, ―Questionnaire for Public Trust Positions‖

· SF-85P Certification

· SF-85P Authorization for Release of Information

· FD Form 258, ―Fingerprint Card (2 copies)

· DHS Form 11000-6 ―Conditional Access To Sensitive But Unclassified Information Non-Disclosure Agreement

· DHS Form 11000-9, ―Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act

1. Only complete packages will be accepted by the DHS OCSO/PSD. Specific instructions on submission of packages will be provided upon award of the task order.

2. The DHS OCSO/PSD may, as it deems appropriate, authorize and grant a favorable Entry on Duty (EOD) decision based on preliminary checks. A favorable EOD decision allows a contractor employee to commence work temporarily prior to the completion of the full background investigation. The granting of a favorable EOD decision shall not be considered as assurance that a favorable Fitness determination will follow. In addition, a favorable EOD or Fitness determination shall in no way prevent, preclude, or bar DHS from withdrawing or terminating access to government facilities or information, at any time during the term of the task order. No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable EOD or Fitness determination by the DHS OCSO/PSD.

3. Limited access to Government buildings is allowable without an EOD decision if the Contractor is escorted by a Government employee and the purpose of the visit is to attend a limited number of required briefings or nonrecurring meetings in order to facilitate the transition of a task order. The intent of this statement is to allow a minimum amount of meeting / transition attendances to prepare for the new task order.

4. The DHS OCSO/PSD shall be notified of all terminations/resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer’s Representative (COR) all DHS issued identification cards and building passes that have either expired or have been collected from terminated employees. If an identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the pass or card number, name of individual to whom it was issued and the last known location and disposition of the pass or card.

5.3 PERIOD OF PERFORMANCE

The period of performance for this task order is a one-year base period with three one-year option periods as follows:

5.4 PLACE OF PERFORMANCE

The primary place of performance will be a combination of the Contractor’s facilities and the Department of Homeland Security facilities in the Washington Metro Area, to include 1110 Glebe Road, Arlignton VA, and 4200 Wilson Blvd, Arlington, VA, with certain project requirements necessitating support at CISA Regional Office locations. No storage of DHS/CISA classified information at the contractor is allowed.

5.5 CONTRACTOR TELECOMMUTING – REMOTE PERSONAL RESIDENCE WORK LOCATIONS.

All work performed outside of the identified contractor and/or government facility(ies) will be performed at the Unclassified FOUO level. Telecommuting for federal government contractors will be considered on a situational basis to the extent practicable to meet CISA’s mission needs. Telecommuting allows contractor personnel to perform their contractual requirements outside of CISA office locations, typically at a contractor’s personal residence or a corporate telecommuting office location. Telecommuting for contractor personnel provides the government flexibility to meet unique CISA organizational and facility needs and requirements. The goal of telecommuting for contractor personnel is to enhance the delivery of services that support the CISA mission. Telecomuting (Telework) is permitted under this contract, with the approval of the Government Technical Lead and the COR.

All telework that requires access to DHS Government Furnished Equipment (GFE), information, or remote systems must only be conducted from within the Continental United States (CONUS) and U.S. Territories. The use of GFE Outside the Continental United States OCONUS is prohibited unless the contract requires overseas travel. Any access or use of GFE, information, or remote access system OCONUS must be requested by the Government Program Manager and approved by the COR or Contracting Officer, after all requirements are met. Any OCONUS use or access, not authorized, will result in immediate revoking of all privileges and access to systems.

Additionally, the provision to permit contractor telecommuting may be revoked at the task order level at any time if the Government makes such determination. The telecommuting provision does not change any task order requirements; all other terms and conditions of the task order remain in full force and effect.

5.6 CONTRACTOR LABOR RATES CHARGED WHILE TELECOMMUTING

The contractor shall charge the same applicable fixed hourly rate as for a Government site for those contractor personnel when they telecommute at their designated telecommuting location.

5.7 HOURS OF OPERATION

Contractor employees shall generally perform all work between the hours of 0800 and 1700 EST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this SOW.

5.8 TRAVEL

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

5.9 POST AWARD CONFERENCE

The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 14 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this task order and review the Contractor's draft project plan. The Post Award Conference will be held via teleconference.

5.10 PROJECT PLAN

The Contractor shall provide a draft Project Plan at the Post Award Conference for Government review and comment. The Contractor shall provide a final Project Plan to the COR not later than 14 business days after the Post Award Conference.

5.11 BUSINESS CONTINUITY PLAN

The Contractor shall prepare and submit a Business Continuity Plan (BCP) to the Government. The BCP Plan shall be due 15 business days after the date of award, and will be updated on an annual basis. The BCP shall document Contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, shall include the following:

· A description of the Contractor’s emergency management procedures and policy

· A description of how the Contractor will account for their employees during an emergency

· How the Contractor will communicate with the Government during emergencies

· A list of primary and alternate Contractor points of contact, each with primary and alternate:

· Telephone numbers

· E-mail addresses

Individual BCPs shall be activated immediately after determining that an emergency has occurred, shall be operational within 4 hours of activation or as directed by the Government, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the task order is terminated, whichever comes first. In case of a life threatening emergency, the COR shall immediately make contact with the Contractor Program Manager to ascertain the status of any Contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occur, the Contractor Program Manager and the COR shall promptly open an effective means of communication and verify:

· Key points of contact (Government and contractor)

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

· Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.)

· Essential Contractor work products expected to be continued, by priority

The Government and Contractor Program Manager shall make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances. Contractors shall obtain approval from the Contracting Officer prior to incurring costs over and above those allowed for under the terms of this task order. Regardless of task order type, and of work location, Contractors performing work in support of authorized tasks within the scope of their tasks shall charge those hours accurately in accordance with the terms of this task order.

5.12 PROGRESS REPORTS

The Program Manager shall provide a weekly status progress report to the Contracting Officer and COR via electronic mail by COB Monday (for the previous week). This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

5.13 PROGRESS MEETINGS

The Program Manager shall be available to meet with the COR upon request to present deliverables, discuss progress, exchange information and resolve emergent technical problems and issues. These meetings shall take place at the Government's facility or via teleconference.

5.14 GENERAL REPORT REQUIREMENTS

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with CISA workstations (Windows XP and Microsoft Office Applications).

5.15 PROTECTION OF INFORMATION

The Government will provide all necessary information, data and documents to the Contractor for work required under this task order.

The Government will provide copies of the references cited in SOW 1.4 at the Post Award Conference.

The Contractor shall use Government furnished information, data and documents only for the performance of work under this task order, and shall be responsible for returning all Government furnished information, data and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data and documents to outside parties without the prior and explicit consent of the Contracting Officer.

Contractor access to information protected under the Privacy Act is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

Contractor access to proprietary information is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with DHS MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information. The Contractor shall ensure that all Contractor personnel having access to business or procurement sensitive information sign a non-disclosure agreement (DHS Form 11000-6).

REFERENCES:

DHS Management Directive 140-01, “Information Technology System Security Program, Sensitive Systems”

· DHS 4300A Policy Directive (Version 13.3, February 13, 2023).

· DHS National Security Systems Policy Directive 4300B, Version 10.1, November 21, 2018 for NSS Collateral (Unclass, Secret or Top Secret Collateral).

· DHS Sensitive Compartmented Information (SCI) Systems 4300C Instruction Manual, Version 2.1, March 24, 2017 for TS SCI/C-LAN.

5.16 RECORDS MANAGEMENT OBLIGATIONS

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes CISA records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their CISA contract.

4. may include deliverables and documentation associated with deliverables.

Contractor shall comply with all applicable…