HRPG SOW.pdf

RFI Notice ID: 70RSAT25RFI000003

Statement of Work

70RSAT25RFI000003

Department of Homeland Security Science and Technology Directorate

Compliance Assurance Program Office Human Research Protections Group Support

1.0 GENERAL

1.1 Background: Compliance Assurance Program Office (CAPO), Human Research Protections Group (HRPG)

The Department of Homeland Security (DHS) is committed to using cutting edge technologies and scientific talent in our quest to make America safer. DHS Science & Technology (S&T) Directorate is tasked with researching and organizing the scientific, engineering, and technological resources of the United States and leveraging these existing resources into technological tools to help protect the homeland. Central to the integrity and advancement of these endeavors is the need to ensure departmental compliance with applicable federal laws, regulations, and guidelines. This is achieved through the regulatory oversight and compliance mandate of the Compliance Assurance Program Office’s (CAPO) Human Research Protections Group (HRPG).

With department-wide purview, the CAPO HRPG works to ensure that the rights and welfare of human subjects are adequately protected in research via its regulatory oversight and compliance activities, as well as through its issuance of policies and guidance. The HRPG upholds the basic ethical principles of the Belmont Report in the review of all research activities, including informed consent, risk/benefit analysis, and the selection of human subjects for research. As an oversight and compliance entity, the HRPG conducts audit and compliance monitoring activities, that include departmental and operational inspections, testing, monitoring, assurance mapping, record-keeping, enforcement, and reporting.

Further, the HRPG provides educational opportunities to the DHS research enterprise, overseeing required human subjects protections training, and coordinating with ancillary committees, groups and individuals on the conduct of human subjects research (HSR) sponsored by the Department.

Support services are required to provide technical expertise and programmatic assistance to meet these needs.

1.2 Scope

The scope of this effort will be to support the operations of the Human Research Protections Group (HRPG), to be managed within S&T. This Statement of Work (SOW) defines the support services and expertise the HRPG requires to ensure that all activities conducted or sponsored by the Department shall comply fully with:

• Federal regulations, standards, policies, and guidelines for the protection of human research subjects; and

• Other legal and/or policy initiatives or developments.

In fulfilling these oversight functions, HRPG also ensures compliance with associated DHS policies and procedures.

2.0 SPECIFIC REQUIREMENTS

Important note for all content under section 2.0: The management structure for the HRPG is governed by the following federal employees: Human Subjects Protections Specialist (HSPS) and the Compliance Assurance Program Office Manager (CAPM). The task order staff closely support the federal management on all elements discussed in this SOW. All supporting work noted in the SOW is delivered to the federal staff for their review and validation prior to processing for dissemination. The federal staff will give final approvals for all reviews and recommendations conducted by the task order staff.

All task order staff are expected to provide high quality reviews and assignments which do not need significant grammatical, concept-based feedback, or edits from other staff (unless designated to serve in this function) or the Federal managers and leaders. Analysis of Quality will be conducted on a biannual basis by the applicable team lead or designee (i.e., open to any HRPG task order support personnel that has this skill set as a strength).

Once cleared to work independently, the rate of error for each task order staff member should be ≤10% for all applicable work products provided to the Federal staff. NOTE: The HRPG has documents which outline additional expectations for engagement and delivery of work products.

However, some expectations will be provided through verbal instruction and will be provided to task order staff at the start of their service within CAPO or prior to execution of a task.

The support services involved in this effort will include:

2.1 HUMAN RESEARCH PROTECTIONS COMPLIANCE

Support a centralized, comprehensive assessment program for DHS research compliance and provide policy support in this area, to include:

2.1.1 Providing support to the Government in developing or revising DHS directives, instructions, policies, procedures, guidance, and other information to ensure research compliance for activities conducted, supported or funded by DHS (“DHS-sponsored”).

2.1.2 Facilitating the identification of DHS-sponsored activities subject to regulatory and compliance assurance reviews.

2.1.3 Determining documentation requirements for regulatory and compliance assurance reviews.

2.1.4 Managing the collection, analysis, and archiving of documentation for regulatory and compliance assurance reviews and record-keeping in a centralized database.

2.1.5 Conducting systematic assessments of relevant DHS-sponsored activities for compliance with federal laws, regulations, policies, and guidelines, in accordance with applicable DHS directives, instructions, policies, procedures, and other guidance.

2.1.6 Assisting in conducting onsite inspections of DHS-sponsored activities.

2.1.7 Coordinating with appropriate federal agencies for joint inspections, including, as applicable, under interagency agreements and arrangements.

2.1.8 Providing timely support and recommendations, as needed, for departmental review and oversight of activities that could reasonably raise compliance concerns.

2.1.9 Ensuring that research involving human subjects is conducted in compliance with 6 CFR Part 46 (the DHS codification of “the Common Rule."). Contractor shall make in-house determinations and review research activities involving human subjects to ensure the Institutional Review Board (IRB) review is compliant with the requirements within the Common Rule and the ethical principles of the Belmont Report. Contractor shall confirm that organizations, including third-party performers, conducting or supporting research that is not exempt from the purview of the Common Rule, are operating under an active and approved Assurance of Compliance (Federalwide Assurance (FWA)) from the Department of Health and Human Services (HHS) Office for Human Research Protections (OHRP). Contractor shall request documentation verifying that human subjects research (HSR) protocols have been reviewed and approved by an IRB or equivalent ethics committee established in accordance with the Common Rule, and that continuing IRB review has been obtained as needed. Contractor shall verify, as applicable, that IRB approval of informed consent documents and the associated consent procedures is as specified in the Common Rule. Contractor shall ensure that all HSR has received any other applicable regulatory and/or compliance approvals.

Contractor shall facilitate DHS/S&T involvement and participation in relevant intradepartmental and interagency groups and meetings including those conducted by the Office of Human Research Protections (OHRP).

3.0 PROGRAM TASKS

3.1 Task One – Program Management and Administration

3.1.1 The Contractor shall provide programmatic and task management support to DHS/S&T.

Effectively support a comprehensive DHS Compliance Assurance Program (CAPO) Human Research Protections Group (HRPG). As a priority, the Contractor shall support the development of the administrative policy, structure, and processes necessary to sustain the work and responsibilities of the HRPG. The Contractor shall support and facilitate DHS program management meetings and maintain communications with compliance offices in other executive departments and agencies as well as external regulatory entities, compliance stakeholders in the Federal, academic, non-profit, and private sectors.

3.2 Task Two – Information Management

3.2.1 The Contractor shall collect, analyze, track, store, and archive compliance program information through a database, the CAPO shared drive, and/or other means deemed acceptable by the Government.

3.2.2 The Contractor shall provide information management support, to include development and maintenance of DHS compliance review database(s) for departmental review, meetings, oversight, and administrative recordkeeping.

3.2.3 The Contractor shall develop and then maintain a system to track, manage, audit, and respond to CAPO taskers.

3.3 Task Three – Program Compliance

3.3.1 Contractor shall facilitate DHS efforts to ensure human research protections (HRP) compliance as outlined for each of the below tasks by:

3.3.1.1 Planning and executing all HSR post-approval compliance activities including for-cause audits, routine desk-audits, site-visits, and on-site meetings as needed.

3.3.1.2 Informing stakeholders, including program managers and investigators of applicable compliance issues and concerns regarding federal laws, regulations, and related DHS requirements, policies, and procedures.

3.3.1.3 Providing guidance and support to DHS Components, as well as DHS-sponsored entities, in their efforts to achieve HRP research compliance.

3.3.1.4 Acquiring relevant information, preparing a compliance assessment, and maintaining records on relevant DHS- sponsored activities in the area of HRP compliance.

3.3.1.5 Reviewing activities for HRP compliance in accordance with departmental policy.

Contractor shall provide programmatic, policy, and administrative support to relevant DHS staff in fulfilling the HRP compliance program task area. Contractor shall document compliance review findings for DHS certification and communicate outcomes to program managers as appropriate. When necessary, Contractor shall recommend actions to resolve deficiencies and achieve compliance. Contractor shall develop, upon request, reports and briefings pertaining to DHS compliance status and activities. Contractor shall serve as the focal point to support DHS's HRP compliance guidance, requirements, policies, and procedures. Contractor shall develop processes to provide technical and instructional support and products in order to establish and maintain departmental awareness of HRP compliance requirements.

3.3.1.6 Maintain related documentation, and databases for relevant DHS- sponsored activities.

3.4 Task Four – Training and Outreach

3.4.1 Contractor shall develop processes to provide technical and instructional support and products and/or procure training and instructional products in order to establish and maintain departmental awareness of initiatives noted in Scope (section 1.2).

Training and outreach programs shall be implemented in accordance with federal regulations, standards, and guidelines.

3.4.2 The Contractor shall support and facilitate outreach and training events to include materials, briefings, instructional media, training programs, curricula, and schedules.

3.4.3 Historical records indicate that CAPO HRPG conduct a minimum of 10 training and outreach events per year. These events include internal S&T trainings, trainings for other DHS Components, and outreach/trainings to extramural performers of DHS-sponsored work. Approximately half of them are short, recurring briefings (e.g., new hire trainings), and the rest are evenly split between an hour to an hour and a half long sessions, and half day visits.

3.5 Task Five – Policy Support

3.5.1 The Contractor shall support DHS policy development and initiatives in HRP compliance, including support for DHS participation in interagency and/or international meetings, preparation of briefing materials, support for departmental/other data calls related to research compliance, and providing alerts, substantive analysis, and recommendations to address current issues and emerging trends in the overall HRP compliance enterprise.

3.5.2 The Contractor shall generate directives, instructions, guidance, briefing materials, presentations, reports, analysis, meeting notes, and other material to support federal and DHS policies, to include draft, interim, and final documents and related coordination history for Government approval and acceptance.

3.5.3 The Contractor shall maintain ongoing awareness (i.e., expertise in identifying, analyzing, and informing federal personnel) of emerging technologies, administrative and industry best practices, as they relate to the human research protections enterprise in order to inform policy support activities.

4.0 CONTRACTOR PERSONNEL

4.1 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained in accordance with the terms of the task order. The required level of staffing support for this task order is 66%. If the staffing level falls below 66%, then the Contractor shall notify the Contracting Officer’s Representative (COR) and the Government Program Managers (PM). The Contractor shall ensure that task order support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification (or through an alternate method approved by the COR or Government PMs) to the COR and the Federal Program Managers, prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

4.2 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW. The HRPG compliance portfolio requires a minimum of three (3) FTE personnel for twelve (12) months. Contractors may require access to DHS classified information and physical spaces. The minimum level of clearance required for contractors is Public Trust, while the highest level of clearance required for contractors is Top Secret and Sensitive Compartmentalized Information (TS-SCI). While the TS-SCI clearance is a preferred aspect, it shouldn’t take precedence over a highly qualified staff to conduct the work activities related to human subjects research protections oversight and compliance. The decision regarding necessity of security clearance for HRP contractors should be coordinated with the Federal HRPG manager prior to onboarding.

4.3 Specific Qualifications Required of HRPG FTE Personnel (All Non-Key Personnel):

a) Must meet the minimum required experience and education requirements for a Scientist /

Engineer I labor category.

b) Moderate working knowledge of human subjects’ protection regulations, policies, and guidelines.

i. Alternatively, must demonstrate prior professional experience related to quality control/quality assurance or in providing high-level administrative support.

c) Ability to assist the HRPG team lead with analyzing complex problems and providing administrative support for reporting of recommendations to executive level management.

d) Good written and oral communication skills, and the ability to work well with, organize work assignments and manage teams.

e) Available to travel locally, regionally, and nationally.

4.4 Preferred Qualifications (Non-Key Personnel):

a) Working knowledge of human research protections or other direct ethical/IRB experience to include but not limited to protocol reviews; and the ability to apply knowledge of pertinent human research protections laws and regulations.

b) Experience with or ability to assist in the development of policies and procedures based upon Federal, state, local and other laws, policies, and guidelines.

c) Prior experience within the DHS or other federal systems and processes.

d) Experience in compliance monitoring and/or auditing within the research enterprise and/or regulatory affairs arena required.

e) Minimum two (2) years’ experience in any of the following: scientific research, clinical research, clinical program management, analysis, engineering, or related fields (i.e., public health, allied health).

A. Lead Analyst :

i. At minimum, be eligible to take the Certified IRB Professional (CIP) exam.

ii. Strong working knowledge of the Common Rule and other regulations/policies relevant to the protection of human subjects, DHS and other Federal regulations, regulatory compliance, Good Clinical Practice (GCP) and clinical trials standards, and other research standards for all aspects of human subject research regardless of discipline.

iii. Strong working knowledge of human subjects’ protection regulations, policies, and guidelines.

iv. Ability to analyze extremely complex problems and recommend, monitor, and execute best practice solutions to executive level management.

v. Experience with or ability to assist in the development of policies and procedures based upon Federal, state, local and other laws, policies, and guidelines.

vi. Ability to meet with and present to senior officials.

vii. Education: bachelor’s degree with extensive human research protections experience, master’s degree or higher in any discipline but preferably in the sciences, health policy, law, or information technology (IT).

4.5 Key Personnel

Prior to removing or replacing any of the designated Key Personnel, the Contractor shall notify the Contracting Officer (CO) and COR of any proposed changes in the Key Personnel identified in the proposal and/or assigned to this TO. All substitutions must be submitted in writing to the CO and

COR at least fifteen (15) days in advanced of the proposed substitution. All requests for substitution must include a detailed explanation of the circumstances necessitating the proposed substitution. Requests for substitution shall include a complete resume of the proposed substitute and any other information required by the CO or COR which is necessary to approve or disapprove the proposed substitution. The Contractor shall demonstrate that the qualifications/expertise of the substitution are equal to or better than the qualifications of the personnel being replaced. The CO and COR will evaluate such requests. The COR will recommend, and the CO will approve or disapprove substitutions and promptly notify the Contractor of the Government decision in writing.

Key Personnel designated for this requirement is the HRP Lead Analyst. Contractor Key Personnel shall not be assigned by the Contractor to more than one key position for this requirement.

4.5.1 Senior Project Manager/ Human Research Protections (HRP) Team Lead (Lead

Analyst/Senior Associate):

The Contractor shall provide a Team Lead who shall be responsible for all Contractor work performed under this SOW in HRP. The name of the HRP Team Lead, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the HRP Team Lead, shall be provided to the Government as part of the Contractor's proposal. The HRP Team Lead is further designated as Key by the Government. During any absence of the HRP Team Lead, only one alternate shall have full authority to act for the Contractor on all matters relating to HRP work performed under this task order. The HRP Team Lead and all designated alternates shall be able to read, write, speak, and understand English.

Specific Qualifications:

a) At minimum, must meet the required experience and education requirements for a

Lead Analyst (Management) labor category.

b) Demonstrated knowledge of the Common Rule and other regulations/policies relevant to the protection of human subjects, DHS and other Federal regulations, research compliance, Good Clinical Practice (GCP) and clinical trials standards, and other research standards for all aspects of HSR regardless of discipline.

c) Alternatively, must demonstrate prior management experience, including the ability to train analysts who are more junior.

d) Expertise in quality control/quality management.

e) Strong working knowledge and ability to develop policies and procedures based on

Federal, state, and local laws, policies, and guidelines.

f) Ability to analyze complex problems and recommend, monitor, and execute best practice solutions to executive level management.

g) Excellent written and oral communication skills, and the ability to work well with federal leadership and personnel.

h) Organize work assignments and manage teams.

i) Education: bachelor’s degree with extensive human research protections experience;

master’s degree or higher in any discipline but preferably in the sciences, health policy, law, or information technology (IT).

Preferred Qualifications:

a) Strong working knowledge of human research protections or other ethical committee/IRB experience to include but not limited to protocol reviews; and the ability to lead and apply expert knowledge of pertinent human research protections laws and regulations.

b) Available to travel locally, regionally, and nationally.

c) Eligible to obtain Certified IRB Professional (CIP) certification.

d) Prior experience within the DHS or other federal systems and processes.

e) Experience in compliance monitoring and/or auditing within the research enterprise.

4.6 EMPLOYEE IDENTIFICATION

4.6.1 Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance- level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

4.6.2 Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e- mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

4.6.3 Personal Identity Verification (PIV) Credentials and Identification Badges Contractor employees shall be required to always wear Department approved Personal Identity Verification (PIV) credentials/identification badges when working in Government facilities.

The Homeland Security Presidential Directive 12 (HSPD-12) requires the use of the Personal Identity Verification (PIV) credentials as the common means of authentication for access to DHS facilities, networks, and information systems. PIV credentials shall be used as the primary means of logical authentication for DHS sensitive systems. The Contractor must use his or her federal issued PIV credentials to access DHS resources to include IT applications and physical facility.

The DHS Security Office shall be notified of all terminations/resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer Representative (COR) all DHS issued Personal Identity Verification (PIV) credentials/identification cards and building passes that have either expired or have been collected from terminated employees. If a PIV credential/identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the PIV credential, pass or card number, name of individual to who it was issued and the last known location and disposition of the PIV credential, pass or card.

4.7 EMPLOYEE CONDUCT

Contractor’s employees shall comply with all applicable Government regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at

Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Program Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations, and policies concerning safety and security.

5.0 OTHER APPLICABLE CONDITIONS

5.1 Technical Direction

Performance of work under this task order shall be subject to the technical direction of the COR.

The term “Technical Direction” is defined to include, without limitation, the following:

(a) Directions to the Contractor which redirect the task order effort, shift work emphasis between work areas of tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish contractual statement of work.

(b) Provision of information to the Contractor that assists in the interpretation of drawings, specifications or technical portions of the work description.

(c) Review and, where required by the task order, approval of technical reports, drawings, specifications and technical information to be delivered by the Contractor to the Government under the task order. Technical direction must be within the general scope of work stated in the task order. The COR does not have authority to and may not issue any technical direction which

(i) constitutes an assignment of additional work outside the general scope of the task order;

(ii) constitutes a change as defined in the task order clause entitled “Changes” (FAR 52.243-1);

(iii) in any manner cause an increase or decrease in the total task order cost or price, the fixed fee or the time required for task order performance; or

(iv) changes any of the expressed terms, conditions, or specifications of the task order. All technical direction shall be issued in writing by the COR or shall be confirmed in writing within five (5) working days after issuance. The Contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed by this article. If, in the opinion of the Contractor, any instruction or direction issued by the COR is within one of the categories and defined in (i) through (iv) above, the Contractor shall not proceed but shall notify the CO in writing within five (5) working days after the receipt of any instruction or direction and shall request the CO to modify the task order accordingly. Upon receiving such notification from the Contractor, the CO shall issue an appropriate task order modification or advise the Contractor in writing that, in his/her opinion, the technical direction is within the scope of the task order. The Contractor shall thereupon proceed immediately with the direction given. A failure of the parties to agree upon the nature of the instruction or direction or upon the task order action to be taken with respect thereto shall be subject to the provisions of the task order clause titled, “Disputes”

(FAR 52.233-1.).

5.2 Non-Disclosure Agreement

Contractor shall sign "DHS Non- Disclosure Agreement DHS Form 11000-6 (08-24)" and/or "SF 312- Classified Information Nondisclosure Agreement (07-13)," upon award of Task Order (TO), for all Contractor personnel assigned to this effort. Contracting Officer’s Representative (COR) shall make the determination as to which NDA will be signed.

5.3 Security

5.3.1. Special Security Requirements: Contractor Pre-screening Contractors requiring recurring access to Government facilities or access to sensitive but unclassified (SBU) information and/or logical access to Information Technology (IT) resources shall verify minimal fitness requirements for all persons/candidates designated for employment under any Department of Homeland Security (DHS) task order by prescreening the person/candidate prior to submitting their name for consideration to work on the task order. Pre- screening the candidate ensures that minimum fitness requirements are considered and mitigates the burden of DHS having to conduct background investigations on objectionable candidates.

The Contractor shall submit only those candidates that have not had a felony conviction within the past 36 months, illegal drug use within the past 12 months, or misconduct such as criminal activity on the job relating to fraud or theft within the past 12 months from the date of submission of their name as a candidate to perform work under this task order.

Contractors are required to follow this requirement down to subcontractors. Pre-screening involves contractors and subcontractors reviewing. Felony convictions within the past 36 months. An acceptable means of obtaining information on felony convictions is from public records, free of charge, or from the National Crime Information Center (NCIC).

Illegal drug use within the past 12 months. An acceptable means of obtaining information related to drug use is through employee self-certification, by public records check; or if the contractor or subcontractor already has drug testing in place. There is no requirement for contractors and/or subcontractors to initiate a drug testing program if they do not have one already in place. Misconduct such as criminal activity on the job relating to fraud or theft within the past 12 months. An acceptable means of obtaining information related to misconduct is through employee self-certification, by public records check, or other reference checks conducted in the normal course of business. Pre-screening shall be conducted within 15 business days after task order award. This requirement shall be placed in all subcontracts if the subcontractor requires routine physical access, access to sensitive but unclassified.

5.3.2 Access to DHS Facilities and Resources: DHS may exercise full control over granting, denying, withholding, or terminating unescorted access to DHS facilities, DHS systems, and/or sensitive DHS information for government/task order employees. Access will be based upon the results of a DHS fitness/suitability investigation. DHS may, as appropriate, make favorable entry of duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the government/task order employee to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full DHS fitness / suitability authorization will follow. The granting of a favorable EOD decision or a full DHS fitness/suitability authorization determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the task order/task order. No employee of the government/contractor shall be allowed unescorted access to a DHS facility, access to any sensitive DHS information, or access to DHS Systems without a favorable EOD decision or DHS fitness/suitability determination by the DHS HQ Office of Security. Government/task order employees assigned to the task order/task order not needing access to sensitive DHS information, DHS systems, or access to DHS facilities will not be subject to DHS fitness/suitability screening.

Government/task order employees waiting on an EOD decision may not begin work on the task order. Limited access to DHS facilities is allowable prior to the EOD decision if the government/task order employee is escorted by an approved DHS employee. This limited access is to allow government/task order employees to attend briefings, nonrecurring meetings, and begin transition work. During one’s limited access the government/task order employee will not have access to sensitive or classified DHS information.

Classified information is government information which requires protection in accordance with Executive Order 13526, National Security Information (NSI) as amended and supplemental directives. If the government/task order employee has access to classified information at a DHS owned or leased facility, it shall comply with the security requirements of DHS and the facility.

If the government/task order employee is required to have access to classified information at another Government Facility, it shall abide by the requirements set forth by the agency.

5.3.3.Additional Guidance: Contractor access to classified information and physical spaces is required under this SOW. The details will be provided in a Department of Defense (DD) Form 254. DD Form 254- "Task order Security Classification Specification" requirement of TS-SCI. No safeguarding of classified information is required at the Contractor’s site. Access to all classified information will occur at DHS facilities only.

FAR clause 52.204-2 Security Requirements Clause (prescribes requirements, restrictions, and other safeguards that are necessary to prevent unauthorized disclosure of classified information and to control authorized disclosure of information released by the U.S.

Government Executive Branch Departments and Agencies to their Contractors; the proscribed federal guidance is the National Industrial Security Program Manual

[NISPOM]).

Some DHS projects are classified and may involve Sensitive Compartmentalized Information (SCI) materials. Therefore, the highest level of clearance contractors will require access to is TS-SCI. The DD Form 254 will include this requirement. The SCI material will be handled at Government controlled environments (e.g., DHS S&T Directorate at St. Elizabeth’s; Ft. Detrick COOP).

Contractors will require access to DHS classified information and physical spaces. The minimum level of clearance required for contractors is Public Trust, but it is preferred that at least one contractor supporting this SOW hold Top Secret and Sensitive Compartmentalized Information (TS-SCI). Requests for those personnel requiring TS-SCI clearance shall be submitted to the COR. They will be approved on a case-by-case basis with appropriate justification prior to submitting the required documentation to the COR for submission to DHS Security Office for clearance nomination.

The COR and/or CO will process a DD-254 and any required documentation to DHS

Security Office as required.

5.4 Safeguarding of Sensitive Information

The S&T Privacy Office, Office of the Chief Information Officer, and the Office of the Chief Security Office require the insertion of FAR 52.224-3 Privacy Training – Alternate I (DEVIATION) (see FAR Class Deviation 17-03, Revision 1); and Information Technology Security Awareness Training (July 2023).

5.4.1. Applicability: This clause applies to the awardee and its contractors, its subcontractors, and their employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

5.4.2 Definitions.

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

5.4.2.1 Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto

(Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

5.4.2.2 Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

5.4.2.3 Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

5.4.2.4 Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

a) Truncated SSN (such as last 4 digits)

b) Date of birth (month, day, and year)

c) Citizenship or immigration status

d) Ethnic or religious affiliation

e) Sexual orientation

f) Criminal History

g) Medical Information

h) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

5.5.3 Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

5.5.3.1 DHS Management Directive 11042.1 Safeguarding Sensitive but Unclassified (for

Official Use Only) Information

5.5.3.2 DHS Sensitive Systems Policy Directive 4300A

5.5.3.3 DHS 4300A Sensitive Systems Handbook and Attachments

5.5.3.4 DHS Security Authorization Process Guide

5.5.3.5 DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

5.5.3.6 DHS Instruction Handbook 121-01-007 Department of Homeland Security

Personnel Suitability and Security Program

5.5.3.7 DHS Information Security Performance Plan (current fiscal year)

5.5.3.8 DHS Privacy Incident Handling Guidance

5.5.3.9 Federal Information Processing Standard (FIPS) 140-2 Security Requirements for

Cryptographic Modules accessible at:

http://csrc.nist.gov/groups/STM/cmvp/standards.html National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

5.5.3.10 NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

5.5.4 Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

5.5.4.1 Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources.

The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

5.5.4.2 The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the task order.

http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://www.dhs.gov/dhs-security-and-training-requirements-contractors at:%20http://csrc.nist.gov/groups/STM/cmvp/standards.html at:%20http://csrc.nist.gov/groups/STM/cmvp/standards.html

5.5.4.3 All Contractor employees with access to sensitive information shall execute DHS

Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the COR no later than two (2) days after execution of the form.

5.5.4.4 The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the task order, as needed.

5.5.1 Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or Component Privacy Officer. Unless otherwise specified in the ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

a) Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.

(i) Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package.

Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the task order as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

(iii) Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

b) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years. The Contractor is required to update its SA package as part of the ATO renewal process. The Contractor shall update its SA package by one of the following methods: (1) Updating the SA documentation in the DHS automated information assurance tool for acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls; or (2) Submitting an updated SA package directly to the COR for approval by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls. The 90-day review process is independent of the system production date and therefore it is important that the Contractor build the review into project schedules. The reviews may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place.

c) Security Review. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this task order are being implemented and enforced. The Contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this task order. The Contractor shall, through the Contracting Officer and COR, contact the Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to the DHS.