HSBP1009R2595-1.doc

HSBP1009R2595

B. Supplies or Services and Prices/Costs

B.1. Contract Type

The Department of Homeland Security/Customs and Border Protection anticipates awarding a Firm Fixed Price contract for Low Energy Mobile Imaging Systems.

B.2.

Schedule

The U.S. Customs and Border Protection (CBP) has a valid requirement for the procurement of Large Scale Non Intrusive Inspection (NII) equipment for the Office of Field Operations (OFO). These systems will be low energy mobile imaging systems. They will be provided to CBP Officers at U.S. Ports of Entry (POE).

CBP officers, in the course of their work examine cargo and personnel seeking entry into the United States. These inspections take place at controlled ports of entry and are aimed at detecting items prohibited from import into the United States. Each day CBP officers use a myriad of inspection equipment. The NII requirement is for use in detecting contraband and terrorist weapons hidden in vehicles and buses.

Section B – Schedule & Pricing Spreadsheet

Date of Award – September 30, 2009

Section B – Schedule & Pricing Spreadsheet

October 1, 2009 - September 30, 2010

Section B – Schedule & Pricing Spreadsheet

October 1, 2010 – September 30, 2011

C – Statement of Objectives

STATEMENT OF WORK

1.0

SCOPE

Customs and Border Protection (CBP) has a need for improving its inspection of cargo conveyances arriving in the United States at various CBP Ports of Entry (POE). Due to recent world events it is imperative for security that incoming cargo conveyances are subjected to a high level of scrutiny. Therefore, CBP seeks to procure Commercial off the Shelf (COTS) large-scale NII imaging systems for various POE, located throughout the United States or as designated by CBP. This Statement of Work (SOW) defines the tasks necessary to provide NII systems to include equipment, installation, testing, verification, documentation, and logistics requirements needed to satisfy the procurement.

1.2 Contractor Management Organization

Each vendor is required to submit a Project Management Plan (PMP) (Item Description number A001) which shall include the overall plan for production of the units and completing the required deliverables. Each PMP shall include a detailed Work Breakdown Structure, which shall reflect the total number of resources that will be dedicated to this project with the amount of time allocated.

2.0 Applicable Documents

· Code of Federal Regulations, 10CFR20, (Standards for Protection Against Radiation), 2002 (NRC)

· American National Standard for General Radiation Safety, ANSI N43.3 (Installations Using Non-Medical X-Ray and Sealed Gamma-Ray Sources, energies up to 10 MeV), 1993

· Code of Federal Regulations, 21CFR179 (Irradiation in the Production, Processing and Handling of Food), 1996 (FDA)

· Code of Federal Regulations, 14 CFR108.17 (e), Use of X-Ray Systems (Photographic Film Safety) (FAA)

· Code of Federal Regulations, 49CFR172 (Hazardous Materials Table, etc.), 2003 (DOT)

· Code of Federal Regulations, 10CFR71 (Packaging and Transportation of Radioactive Materials), 2002 (NRC)

· Occupational Safety and Health Standards (OSHA), 29 CFR 1910, 2004

· American National Standard, ANSI N42.35 (Evaluation and Performance of Radiation Detection Portal Monitors for Homeland Security), 2004

· American National Standard, ANSI N42.38 (Performance Criteria for Spectroscopy-Based Portal Monitors for Homeland Security), Draft

· American National Standard, ANSI N42.41 (Performance Criteria and Evaluation of Active Interrogation Systems for Homeland Security), in development.

· American Society of Testing and Materials (ASTM),(Performance Standards for CBRNE Sensors), in development

· American Society of Mechanical Engineers Standards

· CBP Information Systems Security Policies and Procedures Handbook HB 1400-05C dated October 18, 2006.

· DHS-CBP N.25 Version 1.5 (will be provided GFI as requested)

· DHS-CBP N.25 Version 1.5 (will be provided GFI as requested)

· NFPA 79, Electrical Standards for Industrial Machinery

· NFPA 70, Recommended Practice for Electrical Equipment Maintenance

· DHS and CBP IT security policies, including the guidelines and policies stated in the Department of Homeland Security (DHS) Management Directive (MD) Number 4300.1, titled Information Technology Systems Security; DHS Sensitive Systems Policy Directive 4300A, Information Technology Security Program and the DHS 4300A Sensitive Systems Handbook.

· DHS personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201, Personal Identity Verification (PIV) of Federal Employees and Contractors.

· Homeland Security and CBP Enterprise Architecture documents and reference models.

· Federal Information Processing Standards Publication (FIPS PUB) Number 140-2, Security Requirements for Cryptographic Modules.

· Any future applicable ANSI standards.

3.0

REQUIREMENTS

The contractor shall perform all tasks within this SOW through issued delivery orders. CBP is seeking currently available Commercial off the Shelf (COTS) technology. As such, the vendor shall submit actual pictures (no artist renditions or simulated photos will be accepted) of the system and actual images from the proposed system. The government may choose to request a live demonstration of the vendor’s proposed system. The contractor shall abide by all applicable Code of Federal Regulations in performing all tasks. The contractor shall be held liable for adhering to such regulations. Requirements for this effort shall include the fabrication, integration, test, installation, training and logistics support of NII inspection systems. These systems will be located at various CBP POE along the southwest/northern borders, seaports, and airports within the United States or as designated by CBP. Specific sites and schedules shall be identified during contract negotiations.

This NII LE-MIS must contain the following requirements:

3.1 Operating Requirements

1) The system shall be based upon x-ray or gamma energies and shall have a material discrimination capability that can highlight low density and high density materials (systems based upon reflective x-ray technology are preferred). Systems shall quickly generate quality images of organic material even when such substances are hidden in complex environments.

2) The system shall have a material discrimination capability that can highlight low density and high density materials. Systems shall quickly generate quality images of organic material even when such substances are hidden in complex environments.

3) The system shall be able to discriminate between organic and inorganic material (actual images shall be provided).

4) The system shall be able to operate in temperatures ranging from -30ºC to 50ºC (-22ºF to 122 ºF), withstand wind speeds of up to 40 mph, and operate 24 hours per day 7 days per week, 365 days per year without the need for additional structures (canopies, buildings).

5) The system shall detect both gamma rays and neutrons (Price as an option). Detection notification shall be integrated into the detection software (actual screen shots showing the integration shall be provided) Specifically:

a. Gamma Detection

i. Smallest level detected shall be 40 micro-R

ii. Smallest source detectable is 100 micro-Ci of Cs-137 at a distance of 1 meter and a scan speed of .5 kph.

b. Neutron Detection

i. Smallest neutron flux detected .04 neutrons/second/cm2

ii. Smallest source detectable shall be Am-241/Be or Cf-252 at a distance of 2 meters at scan speed of .5 kph.

6) The system shall operate in an area no wider than 20 feet wide (including target width).

a. A diagram showing length, width and height of the Radiation Controlled Area shall also be provided. The Radiation Controlled Area shall be defined as the area where the radiation dose is .05 mrem per hour or greater. This rate is inclusive of background radiation. Small Radiation Controlled Areas is preferred.

7) The system shall be able to operate within land border, seaport and airport, and border checkpoint environments.

8) The system shall be able to operate in either a mobile or stationary mode (price as option)

9) The system shall operate using either shore power or an onboard power system independent of shore connections.

10) The system shall be capable of capturing and storing scanned images.

11) The system shall contain the capability to copy stored files to a flash drive, CD or DVD.

12) The system shall be capable of exporting scanned images as a tif or jpg file.

13) The system shall the system shall use an LCD display(s) of at least 15”.

3.2 Vehicle Requirements

1) The Vehicle shall accommodate at least 4 Officers (1 driver and 3 passengers).

2) The vehicle shall have 4 wheel drive allowing for off-road usage. The system shall be capable of off-road use at speeds no greater than 40 mph. Each response shall include maximum off-road speed rating for the system.

3) The chassis shall be a standard commercial chassis cable of being serviced by ASE certified mechanics. No military specified chassis shall be accepted.

4) The vehicle shall have a minimum ground clearance of 16 inches.

regulations following national standard for tint allowable in each state.

5) The vehicle shall have power mirrors.

6) On board power systems (generator) and vehicle shall utilize the same fuel type

7) No special driver requirements beyond a standard state driver’s license shall be required to drive the vehicle on local, state roads (i.e.: no commercial driver’s license shall be required).

8) Be able to operate in tight confines (provide vehicle turning radius). Lower turning radius is preferred.

9) The vehicle shall be equipped with an audible type backup system with a visual LED mounted in plain site on the dash.

3.3 Imaging Requirements

1) Resolution of 7mm at a distance of up to 4.5 meters

2) Penetration – image ten (10) pounds of organic materials to a depth of 6mm (.24 inches) in steel equivalent density at a distance of five feet

3) Be able to manipulate images using image analysis tools to include and not be limited to the following: sharpen, different color pallets, zoom, contrast, etc.

4) Scan size shall show the entire target (length and height (ground to roof). Actual images shall be provided.

4.0 System Support Requirements

The following identify the programmatic and logistical requirements for NII Inspection Systems. The contractor shall prepare Monthly Progress Reports in accordance with the attached Data Item Description number A002.

5.0 System Training

Training development and delivery is required for all NII systems and related items produced under this contract. The Training shall consist of procedures for installation, setup, image viewer software, operating and maintaining the NII systems developed or produced as appropriate. Documentation of the Training may include but is not limited to a Training Plan, Outline, Student Guide, Instructor Guide, handout materials and other training aids, “hands on” exercises, a training report, and student evaluations of the training. All training shall be customized to CBP missions and requirements, and provided in accordance with CBP Office of Training and Development criteria. All training documentation shall be incorporated into the Technical Documentation package. The Government shall have full access to all data in the Technical Documentation file for the purposes of maintaining and upgrading the NII system, and training NII system operators and Maintenance Technicians.

In addition, a Train-the-Trainer program shall be delivered to CBP and its approved contract trainers that will certify them as qualified to instruct on the piece of equipment.

Any and all training materials will be used for initial training as well as for follow-on performance and future new operator (attrition) training.

5.1 Operator Training

The contractor shall provide on-site training for CBP operator personnel at each site using materials to include classroom instruction, video, and on-the-job training aids. The training shall cover the imaging equipment, transport system operation, normal and emergency systems operations, image interpretation, and operator console operations. Training shall also include all items contained in the System User’s Manual. The number of personnel to be trained at each site is variable, but efforts shall be made to limit each training class to 12 operators.

Training Model:

Day 1

Radiation Safety Day 2

Classroom and Hands-On Day 3

Classroom and Hands-On Day 4

Classroom and Hands-On Day 5

Classroom and Hands-On

Day 6

Reinforcement/ Live Stream of Commerce Day 7

Reinforcement/ Live Stream of Commerce Day 8

Reinforcement/ Live Stream of Commerce Day 9

Reinforcement/ Live Stream of Commerce Day 10

Reinforcement/ Live Stream of Commerce

5.2 Radiation Safety:

To be conducted by CBP or its approved contractor personnel

5.3 Classroom and Hands-On

2 instructors and 12 students

Includes the following in addition to the DID requirements.

· Sixteen (16) hours of image analysis, including 1 hour focused on Weapons of Mass Effect (WME)

· This material shall not be available as a leave-behind for student participants

· This material shall not be retained or used by the contractor for any purpose whatsoever

· One (1) hour Core Messages delivered by CBP or its approved contract personnel

· One (1) hour of NII Reporting delivered by CBP or its approved contract personnel

Reinforcement and Live Stream of Commerce:

2 instructors and 6 students (2, 5-day sessions)

· While not the norm, it may be required for the contractor trainers to conduct both reinforcement sessions over the course of one week using double shifts. In addition, every attempt will be made to schedule the two weeks of reinforcement training using back-to-back weeks, however, the contractor should be prepared to support two weeks of reinforcement training that are not serial in nature.

Includes:

· Personal Qualification Standard (PQS) checklist designed for instructor sign-off that students have successfully demonstrated image analysis and mechanics skills

The contractor shall develop and provide training materials using the Instructional Systems Development (ISD) methodology which includes (1) Training Plan Outline, (2) Course Syllabus, (3) Instructors Guide, (4) NII System description, (5) Student Guide, (6) Operator and Maintainer Manuals, (7) Operation Procedures Handouts, (8) operator’s video, and (9) other materials. This shall be prepared in accordance with Data Item Description number A003.

Products developed under prior contract with the United States Customs Service shall be used to the maximum extent possible and be written to conform to the requirements of the CBP Office of Training and Development standards. All deliverables shall be conveyed free of trademark and proprietary claim by the Contractor, and with the unlimited right of alteration, reproduction and/or distribution within the Government.

Deliverables shall be created through the use of Microsoft Office word processing and graphics software.

Legitimate copies of the system viewer tool in quantities sufficient to support the training mode. The image viewer software shall present the operator with responses to inputs identical to the responses provided by the operational system. Image viewer software shall operate when loaded on workstation or laptops presently in use by CBP.

Training for CBP designated Acceptance Team personnel shall be completed seven days before system acceptance testing. Details of the training and training schedule shall be included in the Training Plan (TP). The TP, associated documentation and operator’s video shall be prepared in accordance with Best Commercial Practice. A copy of the operator’s training Video shall be left at each site at the conclusion of testing. Operator training shall be completed within 15 working days after system acceptance.

5.4 Train-the-Trainer

The contractor shall develop and provide Train-the-Trainer courses to include classroom, video and on-the-job training aids. As a minimum, the training shall cover all the topics contained in the Student Guide including, but not limited to the imaging equipment and transport system operation, normal and emergency systems operations, target interpretation, and operator console operations. Training shall also include all items contained in the System Users’ Manual.

The Train-the-Trainer course shall be presented to all instructors designated by CBP. It shall encompass 40 hours of classroom instruction plus a minimum of 2 days of reinforcement training providing instructors with every opportunity to ask detailed and specific equipment questions, to participate in hands-on training on the equipment and conduct teach backs. These CBP instructors are located in various parts of the U.S, but they must all be afforded the opportunity to work in a hands-on environment with the equipment. The contractor shall deliver at least two train-the-trainer sessions per system. The contractor shall be required to present this training to the CBP instructors at the Federal Law Enforcement Training Center (FLETC) in Brunswick, GA on dates established by mutual agreement between CBP’s Office of Training Development representatives and the contractor.

6.0 Technical Manuals

The contractor shall provide a System’s User Manual and Maintenance/Service Manual and Vendor Technical Documentation prepared in accordance with the attached Data Item Descriptions numbers A004, A005 and A006. Use commercial-off-the-shelf manuals when feasible. Make all manuals in the interactive electronic format.

6.1 User’s Manual

A User’s Manual prepared in accordance with Data Item Description number A004 is required for each unit developed or produced under this contract. It is preferred that the User’s Manual be separated into an Operator’s Manual and a Software User’s Guide. The Operator’s Manual shall include an Introduction, System Description, Operating Procedures, and Inspections and Troubleshooting. The Software User’s Guide shall contain a detail description of the software functions and procedures that the Operator is to use.

6.2 Operational/Storage Checklist

A laminated Operators Checklist shall be provided on a single sheet, listing each step in the procedure required: (1) for operating the NII system, (2) for preparing an operational system for short or long-term storage, and (3) for preparing a stored NII system for operation. The checklist shall only list the sequential steps. Each step shall be described in detail in the Operator’s Manual and each step shall reference an Operator’s Manual page number. The checklist shall be attached to the NII system near the operator’s station.

6.3 Maintenance Manual

Corrective and Preventive Maintenance actions and procedures shall be documented in a Maintenance Manual. A Maintenance Manual is required for each production lot of NII systems developed or produced under this contract. A single Maintenance Manual may apply to more than one (1) NII system provided the systems are similar or a revision of an existing system. Identification of NII model number and/or revision number shall be clearly explained in the Maintenance Manual. The Maintenance Manual shall contain a description of the NII device and its operation. System limitations, safety information, and other important information shall be highlighted. The Maintenance Manual shall be prepared in accordance with the attached Data Item Description number A005

7.0 Preventive Maintenance

The Maintenance Manual shall contain a detailed explanation of every task required on the Preventive Maintenance Schedule. All components with a service life less than the NII system shall be identified and addressed in the preventive maintenance schedule. The vendor shall provide a list and cost associated with all (vehicle and x-ray system) yearly preventative and scheduled maintenance.

7.2 Corrective Maintenance

The Maintenance Manual shall contain a detailed explanation of every foreseeable task from the Level of Repair Analysis required to repair the NII system in case of failure. The Maintenance Manual shall be continuously updated during the service life of the NII system to incorporate unforeseen corrective maintenance tasks.

7.3 Technical Reviews

The contractor shall host, at his facility, a contract kick-off meeting, System Review (SR), a Final Configuration Review (FCR) and a Factory Acceptance Test meeting. Quarterly reviews will be held at a government site or the contractor’s facility and may be combined with major program reviews. The contractor shall document and prepare for CBP approval all meeting and review minutes. The contract kick-off meeting shall be within 20 days after contract award. The SR shall be 40 days and the FCR 60 days after contract award. All meeting dates shall be mutually agreed upon.

8.0 Warranty

The contractor shall provide a minimum of one-year Failure Free total system warranty for all NII systems, to include the transporter, detectors, imaging source, signal processors and operator console equipment. All repair actions during the warranty shall be included in a Failure and Error Report prepared in accordance with the attached Data Item Description number A009

9.0 Quality Assurance

The contractor shall provide for government review a quality assurance plan prepared in accordance with Data Item Description number A010 as it pertains to the production and manufacturing of NII Inspection Systems. The Contractor shall provide for Government review a plan for measuring performance during the warranty period. CBP technical team members shall observe and evaluate the contractor’s Factory Acceptance Test program on an “as required” basis.

10.0 Factory Testing

The contractor shall be responsible for the preparation of and submission to CBP for approval, an Acceptance Test Plan (ATP), in accordance with the attached Data Item Description (DID) A007. The ATP will include tests to verify compliant with all Operating, Vehicle, and Imaging requirements of this RFQ. The CBP approved ATP will be used by the contractor to conduct the Contractor’s Factory Acceptance Test (CFAT) of each unit. The contractor’s FAT shall demonstrate compliance with the requirements of the RFQ and verify that the system can be operated in accordance with the System User’s Manual, attached DID A004. In addition, the contractor’s tests shall include a 40-hour “burn-in” period of the entire integrated system to ensure infant mortality failures are discovered and corrected prior to any CBP tests. CBP officials, or their representatives, shall witness the CFAT of the first unit and may conduct a CBP Factory Test (FT) of all or selected units at the contractor’s facility to verify that the unit is suitable for shipment to it designed location.

For this procurement the LE-MIS shall be N25 (DHS-CBP N.25 Version 1.5) compliant and the contractor shall demonstrate functionality during the CFAT.

The contractor shall prepare and submit all materials necessary for FDA review in accordance with regulations and apply for waivers as necessary. The FDA submission and any exception to this certification must be clearly identified and copied to the CBP COTR.

10.1 Acceptance Testing

A CBP Site Acceptance Test (SAT) shall be conducted for each unit at its designed location. The CBP SAT shall be conducted in accordance with a CBP Site Acceptance Test Plan (SATP). The SAT shall consist of a review of the contractor’s FAT, system and vehicle documentation, and the contractor’s Radiation Survey, plus an inventory and physical inspection of the system, vehicle and system component operations, and tests of the systems performance against actual targets.

11.0 Calibration

The contractor shall provide to CBP all requirements associated with calibration of the NII system. The contractor shall identify in the maintenance manuals the calibration procedures and any special test equipment. The contractor shall identify all systems, subsystems, equipment, and support equipment, which requires calibration.

11.1 Calibration Maintenance Requirement Report

The contractor shall provide to CBP a Calibration Maintenance Requirement Report (CMRR) for all operational and support equipment. The CMRR Report shall be prepared in accordance with the attached Data Item Description number A011.

11.2 Configuration Management

The contractor shall implement the Configuration Management Plan with the establishment of a Configuration Control Board (CCB). The contractor shall provide an as-built Configuration Baseline as identified in the attached Data Item Description number A012 with the delivery of each NII configuration. All configuration changes require prior approval of ETP’s CCB. Hardware changes beyond Final Configuration Review (FCR) will require prior CBP approval. The contractor shall establish software CCB to review software changes until the delivery of the first NII system. CCB approval shall be required for changes to the software baseline and after the first delivery of a NII system.

12.0 Safety

The contractor for NII Inspection Systems shall maintain a system safety program that continually identifies all hazards and provides a methodology to either eliminate or control these identified hazards.

All products, designs, and specifications provided and all construction and installation activities conducted shall comply with all OSHA and NRC regulations, as well as any other appropriate laws, regulations, standards, codes and health and safety guidelines.

12.1 Radiological Survey and Report

The contractor for NII Inspection Systems shall be required to conduct a radiological survey to ensure that radiation emissions are within specified limits. Each system delivered shall be accompanied with a report of the radiological survey performed on the LS-NII unit, signed by the Radiation Safety Officer of the company. This survey will address both the radiation levels that NII Inspection Operators will be exposed to while at their workstations, and the level of radiation that is transmitted to the environment as a result of system leakage. The report shall show that by means of an outline drawing the levels of emission/scatter radiation measured, the operating conditions (worst case) and the measurement equipment used. The contractor shall provide a radiological survey report in accordance with the attached Data Item Description number A008 for each system delivered.

13.0 Information Technology Security

13.1 Computer Security

All LS-NII System computers and software programs that allow a User to analyze, enhance, and store an image Data Set and the Data Base computers and programs that store the Data Set shall have the following security features incorporated.

1. Levels of Access. Three levels of CBP User access (Operator, Supervisor, and Administrator) shall be provided. The Operator shall be able to perform all system functions except copying and deleting images or Data Sets. The Operator shall not have access to User Accounts. The Supervisor shall be able to perform all Operator functions plus be able to copy and delete images or Data Sets. The Supervisor shall not have access to User Accounts. The Administrator shall be able to perform all Supervisor functions plus have access to User Accounts. The Administrator shall be able to create, edit, and/or delete User Accounts.

2. Login. Each computer will be equipped with the attached approved U.S Department of Homeland Security Log-On Security Warning Banner (a registry hack file that can be used to insert the Banner is available upon request). Each program will require the User to Login upon startup. After no more than 20 minutes of inactivity, the user account will automatically log out. Any User shall be able to Login after that.

3. User Name and Password. Each User shall be required to have a unique User’s Name and Password. Passwords shall consist of at least 8 characters and shall include a capital letter, a lower case letter, a number, and a symbol.

4. User Tracking. It is desired that each scan be tagged with the User’s name and that name be displayed with the Data Set.

13.1.1 Basic Requirements

The Contractor shall adhere to all DHS and CBP IT security policies, including the guidelines and policies stated in the Department of Homeland Security (DHS) Management Directive (MD) Number 4300.1, issued 3/1/2003, titled Information Technology Systems Security. This policy mandates DHS organizational elements, including contractors, follow guidelines outlined in the DHS Sensitive Systems Policy Directive 4300A, Information Technology Security Program, version 5.5, 10/30/07, and the DHS MD 4300A, DHS Sensitive Systems Handbook, Information Technology Security Program, version 5.5, 10/30/07 with attachments.

DHS Directive 4300A outlines the management, operational, and technical baseline security requirements (BLSR) for DHS Components to ensure confidentiality, integrity, availability, authenticity, and non-repudiation of sensitive information systems. The directive was developed in accordance with various Executive orders, public laws, and national policy, including the Federal Information Security Management Act (FISMA) of 2002, various National Institute of Standards and Technology (NIST) publications, and the Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources. The 4300A Handbook provides greater detail of the BLSRs, including the roles and responsibilities associated with each.

CBP shall provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS MD 4300A, DHS Sensitive Systems Policy and Handbook. During all SDLC phases of CBP systems, CBP personnel shall develop documentation and provide any required information for all levels of classification in support of the certification/accreditation process. In addition, all security certification/accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

Security Certification/Accreditation

CBP shall provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS MD 4300A, DHS Sensitive Systems Policy and Handbook. During all SDLC phases of CBP systems, CBP personnel shall develop documentation and provide any required information for all levels of classification in support of the certification/accreditation process. Upon request, the Contractor shall provide any documentation required to support the CBP security certification and accreditation effort. In addition, all security certification/accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

Security Review and Reporting

(a) The Contractor shall include security as an integral element in the management of this contract. The Contractor shall conduct reviews and report the status of the implementation and enforcement of the security requirements contained in this contract and identified references.

(b) The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS including the Office of Inspector General, CBP CISO, and other government oversight organizations, access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

13.1.2

HSAR 3052.204-70. SECURITY REQUIREMENTS FOR UNCLASSIFIED

INFORMATION TECHNOLOGY RESOURCES (JUN 2006)

(a) The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission.

(b) The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

(1) Within 60 days after contract award, the contractor shall submit for approval its IT Security Plan, which shall be consistent with and further detail the approach contained in the offeror's proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

(2) The Contractor’s IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.); the Government Information Security Reform Act of 2000; and the Federal Information Security Management Act of 2002; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130.

(3) The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

(c) Examples of tasks that require security provisions include:

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the contractor’s copy be corrupted; and

(2) Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

(d) At the expiration of the contract, the contractor shall return all sensitive DHS information and IT resources provided to the contractor during the contract, and certify that all non-public DHS information has been purged from any contractor-owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

(e) Within 6 months after contract award, the contractor shall submit written proof of IT Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A (Version 2.1, July 26, 2004) or any replacement publication, which the Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The contractor shall comply with the approved accreditation documentation.

13.1.3

HSAR 3052.204-71. CONTRACTOR EMPLOYEE ACCESS (JUN 2006)

(a) Sensitive Information, as used in this Chapter, means any information, the loss, misuse, disclosure, or unauthorized access to or modification of which could adversely affect the national or homeland security interest, or the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of S SI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

(b) “Information Technology Resources” include, but are not limited to, computer equipment, networking equipment, telecommunications equipment, cabling, network drives, computer drives, network software, computer software, software programs, intranet sites, and internet sites.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the contractor to prohibit individuals from working on the contract if the government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to sensitive information. Therefore, the Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the Contracting Officer. For those contractor employees authorized access to sensitive information, the contractor shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

(f) The Contractor shall include the substance of this clause in all subcontracts at any tier where the subcontractor may have access to Government facilities, sensitive information, or resources.

(g) Before receiving access to IT resources under this contract the individual must receive a security briefing, which the Contracting Officer’s Technical Representative (COTR) will arrange, and complete any nondisclosure agreement furnished by DHS.

(h) The contractor shall have access only to those areas of DHS information technology resources explicitly stated in this contract or approved by the COTR in writing as necessary for performance of the work under this contract. Any attempts by contractor personnel to gain access to any information technology resources not expressly authorized by the statement of work, other terms and conditions in this contract, or as approved in writing by the COTR, is strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

(i) Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the contractor performs business for the DHS Component. It is not a right, a guarantee of access, a condition of the contract, or Government Furnished Equipment (GFE).

(j) Contractor access will be terminated for unauthorized use. The contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

(k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department’s Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

(1) The individual must be a legal permanent resident of the U. S. or a citizen of Ireland, Israel, the Republic of the Philippines, or any nation on the Allied Nations List maintained by the Department of State;

(2) There must be a compelling reason for using this individual as opposed to a U. S. citizen; and

(3) The waiver must be in the best interest of the Government.

(l) Contractors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the contracting officer.

13.1.4 52.204-9 Personal Identity Verification of Contractor Personnel

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system.

13.1.5 Interconnection Security Agreements

Interconnections between DHS and non-DHS IT systems shall be established through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements. Components shall document interconnections with other external networks with an Interconnection Security Agreement (ISA). Interconnections between DHS Components shall require an ISA when there is a difference in the security categorizations for confidentiality, integrity, and availability for the two networks. ISAs shall be signed by both Designated Approval Authority (DAAs) or by the official designated by the DAA to have signatory authority.

13.2 Enterprise Architecture

The contractor shall ensure that the design of its LS NII hardware, systems’ software applications and infrastructure components conform to the Homeland Security (HLS) and Customs and Border Protection (CBP) enterprise architecture (EA), the HLS and CBP technical reference models (TRM), and all HLS and CBP policies and guidelines as promulgated by the Department of Homeland Security (DHS) and CBP Chief Information Officers (CIO), Chief Technology Officers (CTO) and Chief Architects (CA) such as the CBP Information Technology Enterprise Principles and the DHS Service Oriented Architecture - Technical Framework.

The contractor’s LS NII systems shall conform to the federal enterprise architecture (FEA) model and the HLS and CBP versions of the FEA model as described in their respective EAs. Models will be submitted using Business Process Modeling Notation (BPMN) for all models. Universal Modeling Language (UML2) may be used for infrastructure only. Data semantics shall be in conformance with the National Information Exchange Model (NIEM). Development solutions will also ensure compliance with the current version of the HLS and CBP target architectures.

Where possible, the contractor shall use HLS/CBP approved products, standards, services, and profiles as reflected by the hardware software, application, and infrastructure components of the HLS/CBP TRM/standards profile. If new hardware, software and infrastructure components are required to develop, test, or implement the program, these products will be coordinated through the HLS and CBP formal technology insertion process which includes a trade study with no less than four alternatives, one of which shall reflect the status quo and one shall reflect multi-agency collaboration. The HLS/CBP TRM/standards profile will be updated as technology insertions are accomplished.

All data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the DHS Enterprise Data Management Office (EDMO) for review and insertion into the DHS Data Reference Model.

The Contracting Officer (KO), Contracting Officer’s Technical Representative (COTR) or Program Manager (PM) will determine the contractor’s “need to know” regarding access to CBP HLS EA information and sponsor vendor personnel for a DHS Interactive account to access the HLS EA. The HLS EA is available to all DHS Interactive account holders.

13.3 IPv6 In compliance with OMB mandates, all network hardware provided under the scope of this Statement of Work and associated Task Orders shall be IPv6 compatible without modification, upgrade, or replacement.

13.4 DHS Information Technology Portfolio Alignment The NII technologies align with the DHS IT Portfolio below:

Screening/Watchlist/Credentialing - Includes all activities that support the tracking and monitoring of travelers, conveyances and cargo crossing U.S. borders, and traffic pattern analysis, database (Federal, State, and Local) linking and querying, and managing status verification and tracking systems. Different investments and systems may support distinct screening and watchlist activities for people, cargo, and tangible goods. Credentialing encompasses all activities that determine a person’s eligibility for a particular license, privilege, or status, from application for the credential through issuance, use, and potential revocation of the issued credential.

13.5 Accessibility Requirements (Section 508 Compliance) Section 508 of the Rehabilitation Act (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998, requires that when Federal agencies develop, procure, maintain, or use electronic and information technology, they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to and use of information and services that is comparable to the access and use available to non-disabled Federal employees and members of the public.

No Applicable Technical Standards were determined for this work statement. This acquisition has exceptions to Section 508 that will be applied.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein shall be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may be applied:

36 CFR 1194.3(e) - Fundamental Alteration applies to the portions of this work statement where the item requires changes to comply with Section 508 and would render the acquired item useless for its intended purpose. After reviewing the business needs for this work statement, the acquired or developed product is meant to provide information through sight, sound and text concurrently in order for a user to interpret collectively.