General IT Clauses (003).pdf

- 1 -

INFORMATION SECURITY ............................................................................................. - 3 -

1.1. Information Security Incidents ................................................................................... - 3 -

1.1.1. Information Security Incident Reporting Requirements ...................................... - 3 -

1.1.2. Information Security Incident Response Requirements ..................................... - 3 -

1.2. Information Types ...................................................................................................... - 3 -

1.2.1. Sensitive Information ............................................................................................. - 4 -

1.2.2. Personally Identifiable Information (PII) ................................................................. - 4 -

1.2.3. Sensitive PII ........................................................................................................... - 4 -

1.3. Compliance with Security IT Policies ......................................................................... - 4 -

1.4. Security Assessment and Authorization .................................................................... - 5 -

1.5. Federal Reporting Requirements .............................................................................. - 5 -

1.6. Acquiring And/Or Implementing Software Applications ............................................. - 6 -

1.7. Processing, Storing, Transmitting Government Data to Non-Government System ... - 6 - COMMUNICATION ........................................................................................................... - 7 -

2.1. General Communication ............................................................................................ - 7 - PERSONAL SERVICES ................................................................................................... - 7 - PERSONNEL .................................................................................................................... - 8 -

4.1. General Requirements .............................................................................................. - 8 -

4.2. Personnel Security .................................................................................................... - 8 -

4.2.1. Background Investigation Requirements ............................................................ - 8 -

4.2.2. HSPD-12 -Credentials ........................................................................................ - 8 -

4.3. Training ...................................................................................................................... - 8 -

4.3.1. Contractor Staff Training .................................................................................... - 8 -

4.3.2. Mandatory Government Training ........................................................................ - 9 -

4.4. Personnel Retention and Recruitment ..................................................................... - 10 - QUALITY ........................................................................................................................ - 10 -

5.1. Quality Control ......................................................................................................... - 10 -

5.2. Quality Assurance ................................................................................................... - 11 - DELIVERABLES ............................................................................................................. - 11 -

6.1. Contractor Submission ............................................................................................ - 11 -

6.2. Government Review ................................................................................................ - 11 -

6.3. Data and Deliverable Rights .................................................................................... - 11 -

6.4. Transfer of Ownership ............................................................................................. - 12 -

6.5. Monthly Invoice ........................................................................................................ - 12 -

6.6. Monthly Status Report ............................................................................................. - 12 -

6.7. Deliverable Matrix .................................................................................................... - 13 -

6.8. Other Reporting Requirements ................................................................................ - 13 - PERFORMANCE ............................................................................................................ - 13 -

7.1. General .................................................................................................................... - 13 -

7.2. Place of Performance .............................................................................................. - 13 -

7.2.1. Primary Work Location ..................................................................................... - 13 -

7.2.2. Alternative Work Sites ...................................................................................... - 14 -

7.2.3. Hours of Work .................................................................................................. - 17 -

GOVERNMENT FURNISHED PROPERTY/INFORMATION/ACCESS ......................... - 17 -

8.1. General .................................................................................................................... - 17 -

8.2. Contractor Access to IT Systems ............................................................................ - 18 -

8.3. Property ................................................................................................................... - 19 -

8.3.1. Facilities ........................................................................................................... - 19 -

8.3.2. Safety ............................................................................................................... - 19 -

8.3.3. Equipment at Authorized On-Site Federal Work Locations .............................. - 19 -

8.3.4. Facilities and Equipment at Remote Work Locations ....................................... - 19 -

- 2 -

8.3.5. Materials ........................................................................................................... - 20 -

8.3.6. Validation of Government Furnished Items (GFI) and Equipment Inventory .... - 20 -

8.3.7. Use of Government Property ............................................................................ - 20 -

8.3.8. Return of Government Property ....................................................................... - 22 -

8.3.9. Conservation of Utilities .................................................................................... - 22 -

NON-DISCLOSURE OF SENSITIVE OR PROPRIETARY INFORMATION .................. - 22 -

9.1. Non-Disclosure Agreement ..................................................................................... - 22 -

9.2. Data Access ............................................................................................................ - 22 -

9.3. Privacy Act Compliance ........................................................................................... - 23 -

- 3 -

INFORMATION SECURITY

1.1. Information Security Incidents

An Information Security Incident is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government systems or information, including, but not limited to, Sensitive Information.

1.1.1. Information Security Incident Reporting Requirements

All Information Security Incidents must be reported in accordance with the requirements below, even if it is believed the Incident may be limited, small, or insignificant.

a) The Contractor must report all Information Security Incidents immediately, but not later than 30 minutes after becoming aware of the Incident.

b) Copy the Contracting Officer Representative (COR) if possible, or if Contracting Officer Representative (COR) email is not immediately available; contact the Contracting Officer Representative (COR) immediately after reporting the incident.

c) Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

1.1.2. Information Security Incident Response Requirements

a) All determinations related to Information Security Incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made by authorized USDA officials.

b) The Contractor must provide full access and cooperation for all activities (determined by the authorized Government official to be required) to ensure an effective Incident Response, including providing all requested images, log files, and event information to facilitate rapid resolution of Information Security Incidents.

c) Incident Response activities determined to be required may include but are not limited to: inspections, investigations, forensic reviews, data analyses & processing, and final determinations of responsibility for the Incident and/or liability for any additional Response activities.

d) USDA, at its sole discretion, may obtain the assistance of Federal agencies and/or third party firms to aid in Incident Response activities.

1.2. Information Types

The term Information is synonymous with Data, regardless of format or medium.

Personally Identifiable Information (PII) is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of Sensitive Information. All requirements for

- 4 -

Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII.

1.2.1. Sensitive Information

Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government’s interests. Sensitive Information is subject to stricter handling requirements because of the increased risk if the data is compromised. Some categories of Sensitive Information include Financial, Medical/Health, Legal, Strategic, Security, Intellectual Property & Business, Human Resources, Personally Identifiable Information (PII), and Sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

1.2.2. Personally Identifiable Information (PII)

PII, as defined in OMB Memorandum M-07-16, refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified.

In performing this assessment, it is important to recognize that non-PII can become PII whenever additional information [that is publicly available] — in any medium and from any source — is or can be combined to identify an individual. As an example, PII includes a name and an address because it uniquely identifies an individual, but alone may not constitute Sensitive PII.

1.2.3. Sensitive PII

Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling because of the increased risk to an individual or associates if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Social Security numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), is also considered Sensitive PII. In addition, the context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or complaint.

1.3. Compliance with Security IT Policies

Information systems and system services provided by the Contractor must comply with the current USDA IT security and privacy policies, specifically the 3500 – 3599 Cyber Security

- 5 -

Department regulations - https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories.

The Contractor is required to comply with current Federal regulations and guidance found in the Federal Information Security Modernization act of 2014 (FISMA); Privacy Act of 1974;

E-Government Act of 2002, Section 208; National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and the 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise Patch Management Technologies;

Office of Management and Budget (OMB) memoranda; USDA Information Security Program policies and other relevant Federal laws and regulations with which USDA must comply.

House Resolution 83-15 “Consolidated and Further Continuing Appropriations Act, 2015” requires that USDA demonstrate each project/investment is “being managed in accordance with applicable lifecycle management policies and guidance.” This mandates that USDA development projects are required to follow the Agency’s System Development Lifecycle (SDLC). All projects listed in USDA Plan for Expenditure (PFE) can expect to be audited for compliance. Audits may occur at any time after the PFE is submitted to Congress.

The Contractor must protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational client software are exposed. If new vulnerabilities are identified after the acceptance of COTS software, the vendor must review and remediate the vulnerabilities and present the results for Government approval within the timeframes documented in USDA IT security policies.

1.4. Security Assessment and Authorization

a. This contract requires the Contractor to develop, deploy, and/or use information systems to access and/or store Government information, including Sensitive Information. The Contractor must cooperate and support the Government in the development of required documentation and artifacts.

b. All information systems that input, store, process, and/or output Government information must be provided an Authority to Operate (ATO) signed by the authorizing official as identified by the CIO. The Contractor must adhere to current policies, procedures, and guidance for security Assessment and Authorization (A&A) activities.

1.5. Federal Reporting Requirements

Contractors operating information systems must comply with Federal Information Security Modernization Act (FISMA) reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors must provide the Government with the requested information based on the timeframes provided with each request. Reporting requirements are determined by the Office of Management and Budget (OMB), and may change each reporting period. The Contractor will provide the Government with all information to fully satisfy FISMA reporting requirements for Contractor systems.

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories

- 6 -

1.6. Acquiring And/Or Implementing Software Applications

Secure Coding Skills: Contractor must certify that at least one member of each programming team working on any code (including C, Java, .Net, ASP.NET, Visual Basic) to be delivered to the Govt. has earned the Global Information Assurance Certification for Secured Software Programming or equivalent.

Source code testing, binary code testing, application scanning, and penetration testing: At least one (1) week prior to delivery of any code due under this contract, Contractor will deliver to the COR the following reports covering all code that will be delivered:

A. Source code testing results showing all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.” The Contractor must then correct the vulnerabilities, resend the code, and ensure the health of delivered source code.

B. For web applications, web application scanning test results showing all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.”

C. For all applications: application penetration results.

Copyright Management and Responsibility: By delivering applications or programming code to the Federal Government, the vendor or Contractor certifies that they have the proper authority to transfer the property and will defend the Government against copyright or other lawsuit resulting from the application or programming delivered.

1.7. Processing, Storing, Transmitting Government Data to Non-Government System

The Contractor or other external organizations will develop, provide, implement, and maintain an IT System Security Plan for any system that includes acquisition, transmission or analysis of data owned by the Government with significant replacement cost should the Contractor’s and other external organization’s copy be corrupted. This plan will describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan will describe those parts of the contract to which this clause applies. The Contractor or other external organization’s IT System Security Plan will be compliant with applicable Federal laws that include, but are not limited to:

(e.g., the Clinger-Cohen Act of 1996 and the Federal Information Security Management Act of 2002). The IT System Security Plan will meet IT security requirements in accordance with Government policies and procedures that include, but are not limited to: National Institute of Standards and Technology (NIST) SP 800-53 Guidelines.

The Contractor and other external organizations will ensure that the appropriate security banners are displayed on all Government systems (both public and private) operated by the contractors and other external organizations prior to allowing anyone access to the system.

- 7 -

COMMUNICATION

2.1. General Communication

Regular and direct Contractor interface with the Contracting Officer’s Representative (COR) is mandatory under this contract. The Contractor must not contact nor take direction from unauthorized FPAC employees, under any circumstances. The Contractor must work with other Government personnel, as designated by the COR, in review of specified requests and implementation of the specified task assignment request. When technical interchange meetings are scheduled, any actions resulting from such meetings that affect the contract or Work Definition Form level or scope of work, or administrative issues, including work schedules and resources, must be documented and reported to the COR and the Contracting Officer (CO), as appropriate, for approval before being implemented by the Contractor. The Contractor must direct all written and/or oral communications, throughout the project life cycle, to the CO and the COR.

PERSONAL SERVICES

The Government has determined that use of this contract to satisfy this requirement is in the best interest of the Government, economic and other factors considered and is not being used to procure personal services prohibited by the Federal Acquisition Regulation (FAR) Part 37.104 titled “Personal services contract”. To counter the circumstances that infer personal services and to preserve the non-personal nature of the contract, the Contractor must adhere to the following guidelines in the performance of the task:

• Provide direct supervision of all contract employees assigned to the contract.

• Refrain from discussing issues such as skill levels & hours, salaries, cost & funding data, or administrative & personnel matters affecting Contractor employees with the COR or TPOCs.

• Ensure close communication/coordination with the PM, reporting problems to the PM as they occur (not waiting for a monthly meeting).

• Do not permit Government officials to interview potential Contractor employees, approve leave or work scheduling of Contractor employees, terminate Contractor employees, assist Contractor employees in doing their jobs or obtain assistance from the Contractor in doing Government job.

• Do not assign Contractor personnel to work under direct Government supervision.

• Maintain a professional distance from Government employees.

• Provide Contractor employees with badges, if appropriate, identifying them as

Contractors.

• Ensure proper communications with the Government (technical discussion and

Government surveillance is okay, but the Government cannot tell the Contractor how to do the job).

- 8 -

• Assign a task leader to the task order. The task leader or alternate should be the only one who accepts tasking from the assigned Government point of contact or alternative.

PERSONNEL

4.1. General Requirements

Contractor personnel must exhibit exceptional customer service by:

Actively gathering input from customers to identify needs and expectations.

Providing responses that are prompt, consistent, professional, and address the individual customer’s circumstances.

Referring customer requests to the proper channel when appropriate.

4.2. Personnel Security

4.2.1. Background Investigation Requirements

Contractor personnel must be able to obtain a favorable suitability decision in accordance with 5 CFR part 731. The duties of this contract range from low risk to high risk positions and, as such, Contractor personnel will be required to submit all required documentation necessary for the agency to provide a favorable preliminary decision on suitability. This decision is required prior to commencing work on the contract.

Contractor personnel who receive an unfavorable suitability decision must be immediately removed from consideration for work on the contract.

4.2.2. HSPD-12 -Credentials

Contractor personnel must complete necessary requirements to obtain HSPD-12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD-12 credentials is grounds for removal/suspension of Contractor personnel from the contract.

4.3. Training

4.3.1. Contractor Staff Training

The Contractor must provide fully trained and experienced support staff for performance of the contract. Training of Contractor personnel must be performed at the Contractor's expense, except when the Government changes the requirements during performance of an on-going task and it is determined to be in the best interest of the Government. This will be negotiated on a case-by-case basis. Training at Government expense will not be authorized for replacement personnel nor for the purpose of keeping Contractor personnel abreast of advances in the state-of-the-art or for training Contractor employees on equipment, computer languages, or computer operating systems that are available in the commercial market.

- 9 -

4.3.2. Mandatory Government Training

Mandatory Government training must be tracked and monitored through USDA’s current education/learning application (e.g., AgLearn). All required courses must be completed by the required dates by all contract employees. Mandatory Government training classes may be completed during work hours. It is the intent of USDA to provide thirty (30) calendar days written notice of annual training requirements to the Contractor’s contract manager. The contract manager will be responsible for notifying subordinate Contractor employees. In the event the Contractor does not receive thirty

(30) calendar day notice, the Contractor is still required to complete the training by the specified required date(s).

These mandatory courses are typically provided through USDA’s education/learning application and are free-of-charge. The education/learning application will typically load mandatory training to the individual’s education/learning application profile to-do list. The COR will notify the Contractor of new training requirements. Training can typically be completed within 30-60 minutes. This training includes:

Information Security Awareness Training (ISAT) - All Contractor personnel working on this contract are required to complete USDA provided ISAT both before beginning work and annually thereafter. Failure to take this training within the prescribed window will result in removal of the Contractor employee from the contract.

Records Management training - is a one-time training that is required for everyone within ninety (90) days of their start date.

Other training that is federally mandated or required by the agency.

4.3.2.1. IT Security and Privacy Awareness Training

a. All Contractor personnel must complete provided mandatory security and privacy training prior to gaining access to information systems and provide their completion certificate to the COR or supervisor. Non-compliance may result in revocation of system access.

b. Security and privacy refresher training must be completed on an annual basis.

Notification and instruction will be provided.

c. The Rules of Behavior must be signed by each user prior to gaining access to information systems and will be reviewed at least annually.

4.3.2.2. Specialized Security Awareness Training

The Contractor will be identified as required to complete specialized security training based on role-based requirements, and is required to report training completion (to the Government) to ensure competencies that address this training.

- 10 -

4.4. Personnel Retention and Recruitment

Government review and acceptance is required for all resumes of key personnel proposed to support the contract effort. The Contractor must make every effort to retain personnel in order to ensure continuity until contract completion. If it should become necessary to substitute or replace personnel, the Contractor must immediately notify the COR in writing of any potential vacancies and must submit the resume(s) of replacement personnel within fourteen (14) calendar days of the notification. Additionally, for all new positions identified by the Government, the Contractor must submit the resume(s) of proposed personnel within fourteen (14) calendar days of the Government’s initial request. The Contractor must submit the resume(s) of all potential personnel selected to perform under this contract to the COR for Government review and acceptance/rejection. Upon Government acceptance of a personnel resume(s), the candidate must be available to begin performance within fourteen (14) calendar days. The Contractor must ensure continuity of operations during periods of personnel turnover and long-term absences. Long-term absences are considered those longer than one (1) week in duration.

QUALITY

Both the Contractor and Government have responsibilities for providing and ensuring quality services, respectively.

5.1. Quality Control

The Contractor must establish and maintain a complete Quality Control Plan (QCP) to ensure the requirements of this contract are provided as specified in accordance with the applicable Inspection of Services Clause. The CO will notify the Contractor of acceptance or required modifications to the plan. The Contractor must make appropriate modifications (at no additional costs to the Government) and obtain acceptance of the plan from the CO. The Government has the right to require revisions of the QCP (at no cost to the Government) should the incorporated plan fail to deliver the quality of the services provided at any time during the contract performance. The plan must include but is not limited to the following:

A description of the inspection system covering all services listed.

The specification of inspection frequency.

The title of the individual(s) who must perform the inspection and their organizational placement.

A description of the methods for identifying, correcting, and preventing defects in the quality of service performed before the level becomes unacceptable.

On-site records of all inspections conducted by the Contractor are required. The format of the inspection record must include, but is not limited to, the following:

Date, time, and location of the inspection.

A signature block for the person who performed the inspection.

- 11 -

Rating of acceptable or unacceptable.

Area designated for deficiencies noted and corrective action taken.

Total number of inspections.

5.2. Quality Assurance

The Government will perform periodic reviews of the Contractor’s performance in accordance with the Government’s Quality Assurance Surveillance Plan (QASP). The Government reserves the right to review services to be provided, including those developed or performed at the Contractor's facilities, to determine conformity with performance and technical requirements. Government quality assurance will be conducted on behalf of the CO. The COR will be appointed to coordinate the overall quality assurance of technical compliance.

DELIVERABLES

Deliverables and due dates are identified in subsequent paragraphs.

6.1. Contractor Submission

Deliverables are to be transmitted electronically as required per the Government’s request.

The Contractor must provide hard copy deliverables as required per the Government’s request. All deliverables must be produced using recommended software tools/versions as approved by the Government. All reports must be accomplished utilizing the MS Office Software Suite to include MS Project as required.

6.2. Government Review

Government personnel will have ten (10) workdays to review deliverables (to include resubmissions) and provide written acceptance/rejection. The COR will notify the Contractor of deliverable acceptance or provide comments in writing. The Contractor must incorporate Government comments, or provide rationale for not doing so within five (5) days of receipt of comments. Government acceptance of the final deliverable will be based on inclusion of Government comments or acceptance of rationale for non-inclusion.

Additional changes volunteered by the Contractor will be considered a resubmission of the deliverable.

6.3. Data and Deliverable Rights

All information such as software, data, designs, test materials, documents, documentation, notes, records, software tools acquired, and/or software source code and modifications produced by the Contractor under this PWS is the sole property of the U.S. Government, which has unlimited rights to all materials and can determine the scope of publication and distribution. The Contractor must deliver electronic copies of all documents, notes, records and software to the Government upon termination of the contract. The Government

- 12 -retains ownership of all proprietary information and intellectual property generated under this contract.

6.4. Transfer of Ownership

All data and documentation, including all studies, reports, spreadsheets, software, data, designs, presentations, documentation, etc., produced by the Contractor or for the Government using this PWS are the property of the Government upon its taking possession of task deliverables or upon termination of the contract.

6.5. Monthly Invoice

The Contractor must provide a monthly invoice to be submitted simultaneously with the monthly status report. Both documents must be provided to applicable parties. The invoice and monthly status report must be submitted as a single file. The components of the single file must be arranged in the following order: accounting format invoice, monthly status report, and additional documentation as required.

The invoice must include but not limited to:

Clear identification of all costs.

Travel costs.

Supporting documentation for travel costs. Invoices including travel costs must include supporting documentation as required by the Federal Travel Regulation (FTR) (receipts for all costs $75.00 or greater). Invoice submissions including travel costs must include completed travel expense sheets (i.e. travel voucher) for each trip for each employee.

All travel costs must be compiled into the Government provided travel expense sheet (provided by the CO). The travel expense sheet must be submitted with the invoice.

The Contractor must comply with line item (i.e., per individual positions, different programs, program areas, etc.) billing requests.

6.6. Monthly Status Report

Monthly status reports (MSR) must include, but is not limited to, the items identified below.

Status of directives, schedules, deliverables: Status of task directives must include a summary description and schedule of all directives completed during the reporting period, all directives currently on-going during the reporting period and all known directives assigned for future reporting periods.

Current and cumulative funding status (direct labor and travel funding status to be reported separately as required)

Outstanding issues, and proposed resolution approaches and actions to resolve any outstanding issues.

Staffing report identifying current staffing roster, all current vacancies, and a record of all staffing departures.

- 13 -

Listing of all training to be completed within the two month period following the end of the MSR reporting period.

The monthly invoice must be submitted simultaneously with the monthly status report.

6.7. Deliverable Matrix

As applicable, the delivery dates must be based on the task orders, approved work definition forms and approved project plans as updated after the completion of the analysis phase for each project. If a delivery date falls on a Federal holiday, Saturday or Sunday, the deliverable due date must be the next scheduled federal workday. The deliverable due time must be on or before close of business (COB) (1700) on the day the deliverable is due unless otherwise stated within this PWS.

Deliverable Description Due Date

6.8. Other Reporting Requirements

In addition to the deliverable requirements identified above, the Contractor must comply with the following:

The Contractor must bring problems or potential problems affecting performance to the attention of the COR as soon as possible. Verbal reports must be followed up with written reports, when directed by the COR, within twenty-four (24) hours.

The Contractor must provide, in writing to the COR, the results of all meetings with the client that affect and/or change conditions or result in additional agreements or requirements. The Contractor must not perform any work outside the scope or requirements of this contract without express written approval of the CO.

PERFORMANCE

7.1. General

Certification by the Government of satisfactory services provided is contingent upon the Contractor performing in accordance with the terms and conditions of this document, the approved technical and cost quotes, and all amendments. The CO, COR, TPOCs and Contractor representative(s) must meet when and where deemed necessary.

7.2. Place of Performance

7.2.1. Primary Work Location

The Primary Place of Performance must be in USDA Government facilities to include, but not limited to, the Beacon complex in Kansas City, Missouri or USDA Washington DC complex. When required by the Government, the Contractor must also perform contract related activities at other Government and Contractor facilities within the local area.

- 14 -

For the purposes of this contract, local area facilities are defined as those within 50 miles of a Primary Place of Performance. Reimbursement for local area travel or commuter travel will not be authorized. Contractor requests for alternate performance locations (i.e. telework and work from other Government facilities) will be reviewed and considered on a case-by-case basis. The Contractor must obtain the required authorization prior to performing work at an alternate performance location.

7.2.2. Alternative Work Sites

All work performed at locations other than those identified as Government and/or Contractor facilities must be approved prior to performing the work.

7.2.2.1. Applicability of Telework

Federal Contractors are not governed by Office of Personnel Management (OPM) or agency policies; however, this does not prohibit contract employees from actually working at an alternate site, when/as appropriate and specifically authorized by the Government. The Contractor must develop telework policies to comply with the guidelines established in the PWS and address them at a generic level within their Quality Control Plan. Alternate work arrangements for Contractors must be negotiated with the Contractor’s own employer and the appropriate agency official, to ensure policies and procedures are in close alignment and there is a clear and concise arrangement documenting the agreement. It remains the Contractor’s responsibility to ensure the services are performed in accordance with the terms and conditions of the contract award.

7.2.2.2. Guidelines for Telework

The Contractor must address the pertinent facts impacting performance and ensure all affected Contractor resumes reflect the applicable work site. The Contractor must provide justification to the Government when identifying and submitting an individual as a telecommuter and address implementation processes and procedures within the quality control plan. The Contractor must be responsible for ensuring the Government has the required access/details necessary for the Government to perform quality assurance responsibilities.

The Contractor must comply with all agency security telework policies. The Contractor must ensure all services provided from an alternate site comply with the Federal Information Security Management Act of 2002 (FISMA) and address the following, as a minimum:

Controlling access to agency information and information systems;

Protecting agency information (including personally identifiable information) and information systems;

Limiting the introduction of vulnerabilities;

- 15 -

Protecting information systems not under the control of the agency that are used for teleworking;

Safeguarding wireless and other telecommunications capabilities that are used for teleworking; and

Preventing inappropriate use of official time or resources that violates surt G of the Standards of Ethical Conduct for Employees of the Executive Branch by viewing, downloading, or exchanging pornography, including child pornography.

7.2.2.3. Guideline Constraints

Contractor telework is granted by the Government for the necessity and benefit of the Government and is not a Contractor benefit or right. Contractor telework can be revoked by the Government if deemed appropriate. The contract program manager must assess the validity of all telework requests for their contract employees. Approvals must not conflict with the best interest of the Government.

7.2.2.4. Quality Control for Telework

The Contractor must address the pertinent facts impacting performance and ensure all affected Contractor resumes reflect the applicable work site. The Contractor must provide justification to the Government when identifying and submitting an individual as a tele-commuter and address implementation processes and procedures within the quality control plan. The Contractor must be responsible for ensuring the Government has the required access/details necessary for the Government to perform quality assurance responsibilities.

7.2.2.5. Compliance with Agency Telework Policies

The Contractor must comply with all agency security telework policies. The Contractor must ensure all services provided from an alternate site comply with the Federal Information Security Management Act of 2002 (FISMA) and address the following, as a minimum:

Controlling access to agency information and information systems;

Protecting agency information (including personally identifiable information) and information systems;

Limiting the introduction of vulnerabilities;

Protecting information systems not under the control of the agency that are used for teleworking;

Safeguarding wireless and other telecommunications capabilities that are used for teleworking; and Preventing inappropriate use of official time or resources that violates surt G of the Standards of Ethical Conduct for Employees of the Executive Branch by

- 16 -viewing, downloading, or exchanging pornography, including child pornography.

7.2.2.6. Continuity of Operations (COOP)/Disaster Recovery Temporary

Relocation

The National Security Presidential Directive/NSPD-51/Homeland Security Presidential Directive/ HSPD-20, National Continuity Policy, requires Federal departments and agencies to maintain a comprehensive and effective continuity capability, including a Continuity of Operations (COOP) program. The COOP program, which also includes pandemic preparedness, ensures the continuation of essential functions under emergency situations.

An emergency may require personnel to temporarily relocate to a pre-designated, alternate work site or telework to ensure continuity of essential functions. A contract position may support the FPAC COOP plan, and the Contractor may be required to report for work to assist the federal staff in supporting critical business functions following a formal disaster declaration. Contractor employees, under this scenario, are required to deploy to the alternate work site within 12 hours of COOP Plan activation for the support of Government identified essential functions. The deployment to the alternative work site may last for up to 30 days. Travel and per diem expenses, if required, will be reimbursed in accordance with the Federal Travel Regulation (FTR).

The Government will also engage in “PLANNED” Disaster Recovery Exercises throughout a given Fiscal Year. As these exercises are typically planned well in advance, FPAC may require Contractor employees’ participation in these exercises after appropriately coordinated advance notice. There may also be the limited possibility of an “UN-PLANNED” Disaster Recovery Exercise. Unplanned exercises are typically conducted during business hours and GOVERNMENT may require Contractor employees’ participation after immediate notice. Travel is not expected to be required during Disaster Recovery Exercises/testing.

7.2.2.7. Work Locations Requiring Non-Local Travel

The Contractor may also be required to support non-commuter travel in support of this contract, as required by the Government. The COR, or the appointed representative, must have sole authority to approve non-local travel requests necessary to support contract performance. Not later than five (5) business days prior to the Contractor’s estimated date of departure, the Contractor must submit to the COR, via email, a travel request, to include travel justification, the proposed itinerary, and cost estimates for such travel. Federal Travel Regulations apply. The Contractor must be responsible for all travel arrangements including airline, hotel, and rental car reservations. The Contractor must make every commercially

- 17 -reasonable effort to schedule travel far enough in advance to take advantage of reduced airfares.

7.2.3. Hours of Work

7.2.3.1. Standard Duty Hours Support

When working at Government facilities, work will be accomplished during normal duty hours (6AM-6PM). Core work hours when all personnel should be available is 9:30AM- 2:30PM unless approved by site personnel. Contractor personnel will not report to Government facilities to work nor remain at the work locations any time the Government is unexpectedly required to close their offices. The Contractor will not be compensated for these Government closures. The Contractor is responsible for all notification of their Contractor staff during times of closure.

7.2.3.2. Holidays

The Contractor is hereby advised that Government personnel observe the following holidays: New Year's Day, Martin Luther King's Birthday, President's Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran's Day, Thanksgiving Day, and Christmas. In addition to the days designated as holidays, the Government may observe the following days: any other days designated by Federal Statute; any other days designated by Executive Order; and any other days designated by the President's Proclamation. This includes Inauguration Day (Washington, D.C. metropolitan area only). Observance of such days by Government personnel must not be a reason for an additional period of performance, or entitlement of compensation. Work on a holiday follows non-standard duty hour rules requiring pre-approval by the COR. In the event the Contractor's personnel work during the holiday, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost.

7.2.3.3. Government Administrative Leave Situations

When the agency grants administrative leave to its employees, on-site assigned Contractor personnel may be dismissed by the Contractor. The Contractor agrees to continue to provide sufficient personnel to perform tasks already in operation or scheduled, and must be guided by the instructions issued by the COR. The Government will not pay for the labor hours during the leave granted to non-working contract personnel as a result of inclement weather, potentially hazardous conditions, explosions, and other special circumstances.

GOVERNMENT FURNISHED PROPERTY/INFORMATION/ACCESS

8.1. General

The Government must provide, without cost, the facilities, equipment, materials and services listed below. The Government furnished property and services provided as part of

- 18 -this contract must be used only by the Contractor only to perform under the terms of this contract. No expectation of personal privacy or ownership using any USDA electronic information or communication equipment must be expected. All property at Government work sites, except for Contractor personal items will be assumed to be Government property unless an inventory of Contractor property is submitted and approved by the CO/COR. Contractor personal items do not include computers, external drives, software, printers, and/or other office equipment (e.g., chairs, desks, file cabinets). The Contractor must maintain an accurate inventory of Government furnished property.

Contractor employees must clearly identify themselves as such at all times (badge display;

identification announcement prior to or at the commencement of meetings and teleconferences; and correspondence including e-mail, etc.).

8.2. Contractor Access to IT Systems

a. Immediately following contract award, the Contractor must provide Contracting Officer’s Representative a complete list of employee names, approval to work and current FY year completion certificate of USDA Information Security Awareness Training.

b. Each Contractor is required to utilize a Personal Identity Verification (PIV) card to access IT systems and Sensitive Information. Using shared accounts to access IT systems and Sensitive Information is strictly prohibited. USDA/FPAC may disable accounts, and access to IT systems may be revoked and denied if Contractors share accounts. Users of the systems will be subject to periodic auditing to ensure compliance with USDA and Agency policies.

c. Each Contractor is required to utilize Government furnished equipment as appropriate.

d. In coordination with the Contracting Officer Representative (COR), USDA may suspend or terminate the access to any systems and/or facilities when an Information Security Incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as USDA determines that the situation has been corrected or no longer exists.

e. Upon request of USDA, the Contractor must immediately return all Government issued equipment including, but not limited to Government issued external storage media (i.e.

external drives, thumb drives).

f. Copying of USDA information outside of USDA controlled space or technology is prohibited. The Contractor must request permission from the COR to remove any data from the USDA environments. Upon request of USDA, the Contractor must immediately return all Government information and attest by non-disclosure agreement the Government information is properly and securely removed from media that is not Government furnished equipment.

g. The Contracting Officer’s Representative (COR) must be notified at least five (5) days prior to a Contractor being removed from a contract. For unplanned terminations or removals of Contractors from the organization that occur with less than five (5) days’ notice, the COR must be notified immediately. PIV cards issued to Contractors must be returned to the COR prior to departure.

- 19 -

h. All access to USDAIT systems will be accomplished using Personal Identity Verification (PIV) credentials, in accordance with NIST FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors. At USDA the PIV credential is branded “LincPass”.

8.3. Property

8.3.1. Facilities

The Government will provide facilities at the authorized primary work locations as specified in the contract and each task order. Use of the facilities by Contractor employees will include all utilities, telephone, janitorial services and furniture for Contractor employees…