Sections_D_-_M.DOCX

HSCECR-16-R-00001

SECTION D—PACKAGING AND MARKING

There are no clauses incorporated with this section for this RFP.

SECTION E—INSPECTION AND ACCEPTANCE

E.1 52.246-2 Inspection of Supplies-Fixed Price. (AUG 1996)

E.2 52.246-4 Inspection of Services-Fixed Price. (AUG 1996)

E.3 52.246-16 Responsibility for Supplies. (APR 1984)

E.4 Inspection Requirements

The content requirements and/or formats for deliverables identified that are not specified within the SOW or Technical Exhibits will be mutually agreed upon by the COR and the Contractor after award. All other deliverables shall be in accordance with documents provided to the Contractor by the COR/Government.

Deliverables specified to be in electronic form may be delivered via email in accordance with IT security requirements noted herein. All deliverables, including the electronic copy, shall be provided in a MS Office format acceptable to the COR, and shall be delivered to the following individual:

COR:

U.S. Immigration and Customs Enforcement Office of Professional Responsibility Office of Detention Oversight 950 L’Enfant Plaza SW Washington, DC 20536 Tel No: 202-732-0533 E-mail: Reiss.M.Kuczera@ice.dhs.gov Assistant COR: Evelin.Montenegro@ice.dhs.gov

US Customs and Border Protection Office of the Commissioner Washington, DC Tel No: 202-344-1357 E-mail: susan.j.calongne@cbp.dhs.gov

The Contractor shall provide the following services and/or deliverables:

Deliverable /Service

a. Initial Meeting

Electronically to the COR in format and manner to be determined and approved by COR.

h. Ad Hoc Reports

Request.

4.2.

Contractor employees. Submit completion certificates electronically to COR.

j. List of Cleared Employees and Status Changes

E.5 Acceptance Criteria

DHS will accept or reject deliverables within twenty-one (21) days after delivery. If rejected, the Contractor shall make corrections as specified and resubmit the deliverable for review and approval within the agreed upon timeframe, or not later than seven (7) days from notification of the rejected deliverable.

[Balance of page intentionally left blank]

[END OF SECTION E]

SECTION F—DELIVERIES OR PERFORMANCE

F.1 52.242-15 Stop-Work Order. (AUG 1989)

F.2 52.242-17 Government Delay of Work. (APR 1984)

F.3 Places of Performance - (See Solicitation Section C.2)

F.4 Period of Performance

The period of performance for this contract is anticipated to be a one (1) year base period with two (2) one (1) year option periods and one six month option in accordance with FAR 52.217-8 exercisable at the Government’s sole discretion.

F.5 52.217-9 Option to Extend the Term of the Contract (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 15 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed three (3) years and six (6) months, in the event that an extension is exercised in accordance with FAR 52.217-8.

(End of clause)

[END OF SECTION F]

SECTION G—CONTRACT ADMINISTRATION

G.1 Contract Management

Notwithstanding the Contractor’s responsibility for total management responsibility during the performance of this contract, the administration of the contract will require maximum coordination between the ICE and the Contractor. The individuals outlined in Section G will be the Government points of contact during the performance of this contract for their respective roles as identified herein:

Contract Specialist(s):

Brandiss Smith Office of Acquisition Management – Detention, Compliance and Removals Immigration & Customs Enforcement 801 I Street NW, Suite 910 Washington, DC 20536 Email: Brandiss.Smith@ice.dhs.gov

Contracting Officer:

James D. Adams Office of Acquisition Management – Detention, Compliance and Removals Immigration & Customs Enforcement 801 I Street NW, Suite 910 Washington, DC 20536 Email: James.D.Adams@ice.dhs.gov

The CO has the authority to award, modify or terminate contracts and obligate Government funds. The CO is responsible for ensuring performance of all necessary actions for effective contracting, ensuring compliance with the terms of the contract, and safeguarding the interest of the United States in its contractual relationships.

G.2 Contracting Officer’s Representative (COR)

The following individual is designated and authorized by the CO to perform contract administration functions related to the technical performance of this contract.

COR:

U.S. Immigration and Customs Enforcement Office of Professional Responsibility Office of Detention Oversight 950 L’Enfant Plaza SW Washington, DC 20536 Tel No: 202-732-0533 E-mail: Reiss.M.Kuczera@ice.dhs.gov Assistant COR: Evelin.Montenegro@ice.dhs.gov

US Customs and Border Protection Office of the Commissioner Washington, DC Tel No: 202-344-1357 E-mail: susan.j.calongne@cbp.dhs.gov

The COR’s principal role is to support the CO in managing the contract, providing technical administration and direction within the scope of the contract, managing technical execution, monitoring performance and ensuring requirements are met within the terms of the contract.

G.3 Invoice Requirements

Service Providers/Contractors shall use these procedures when submitting an invoice.

1. Invoice Submission: Invoices shall be submitted in a .pdf format on a monthly basis via email to:

Invoice.Consolidation@ice.dhs.gov

Each email shall contain only one (1) invoice and the subject line of the email will annotate the invoice number. The emailed invoice shall include the “bill to” address shown below:

DHS, ICE

Financial Operations - Burlington P.O. Box 1620

ATTN: ICE/ERO/FHQ/DMD

Williston, VT 05495-1620

Note: The Service Provider's or Contractor's Dunn and Bradstreet (D&B) DUNS Number must be registered in the System for Award Management (SAM) at https://www.sam.gov prior to award and shall be notated on every invoice submitted to ensure prompt payment provisions are met. The ICE program office identified in the task order/contract shall also be notated on every invoice.

2. Content of Invoices: Each invoice submission shall contain the following information:

(i) Name and address of the Service Provider/Contractor. Note: the name, address and DUNS number on the invoice MUST match the information in both the Contract/Agreement and the information in the SAM. If payment is remitted to another entity, the name, address and DUNS information of that entity must also be provided which will require Government verification before payment can be processed;

(ii) Dunn and Bradstreet (D&B) DUNS Number;

(iii) Invoice date and invoice number;

(iv) Agreement/Contract number, contract line item number and, if applicable, the order number;

(v) Description, quantity, unit of measure, unit price, extended price and period of performance of the items or services delivered;

(vi) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vii) Terms of any discount for prompt payment offered;

(viii) Remit to Address;

(ix) Name, title, and phone number of person to notify in event of defective invoice; and

3. Invoice Supporting Documentation: In order to ensure payment, the vendor must also submit supporting documentation to the Contracting Officer's Representative (COR) identified in the contract as described below. Supporting documentation shall be submitted to the COR or contract Point of Contact (POC) identified in the contract or task order with all invoices, as appropriate. See paragraph 4 for details regarding the safeguarding of information. Invoices without documentation to support invoiced items, containing charges for items outside the scope of the contract, or not based on the most recent contract base or modification rates will be considered improper and returned for resubmission. Supporting documentation requirements include:

(i) Firm Fixed Price Items (items not subject to any adjustment on the basis of the contractor’s cost experience, such as pre-established monthly guaranteed minimums for detention or transportation): do not require detailed supporting documentation unless specifically requested by the Government.

(ii) Fixed Unit Price Items (items for allowable incurred costs, such as detention and/or transportation services with no defined minimum quantities, stationary guard or escort services, transportation mileage or other Minor Charges such as sack lunches and detainee wages): shall be fully supported with documentation substantiating the costs and/or reflecting the established price in the contract and submitted in .pdf format.

4. Safeguarding Information: As a contractor or vendor conducting business with Immigration and Customs Enforcement (ICE), you are required to comply with DHS Policy regarding the safeguarding of Sensitive Personally Identifiable Information (PII).

Sensitive PII is information that identifies an individual, including an alien, and could result in harm, embarrassment, inconvenience or unfairness. Examples of Sensitive PII include information such as: Social Security Numbers, Alien Registration Numbers (ANumbers), or combinations of information such as the individual’s name or other unique identifier and full date of birth, citizenship, or immigration status.

As part of your obligation to safeguard information, the follow precautions are required:

(i) Email supporting documents containing Sensitive PII in an encrypted attachment with password sent separately.

(ii) Never leave paper documents containing Sensitive PII unattended and unsecure.

When not in use, these documents will be locked in drawers, cabinets, desks, etc. so the information is not accessible to those without a need to know.

(iii) Use shredders when discarding paper documents containing Sensitive PII.

(iv) Refer to the DHS Handbook for Safeguarding Sensitive Personally Identifiable Information (March 2012) found at http://www.dhs.gov/xlibrary/assets/privacy/dhsprivacy-safeguardingsensitivepiihandbook-march2012.pdf for more information on and/or examples of Sensitive PII.

5. If you have questions regarding payment, please contact ICE Financial Operations at 1-877-491-6521 or by e-mail at OCFO.CustomerService@ice.dhs.gov Invoices without the above information may be returned for resubmission.

[END OF SECTION G]

SECTION H—SPECIAL CONTRACT REQUIREMENTS

H.1 Contractor’s Insurance

The Contractor shall maintain insurance in an amount not less than the minimum coverage limits applicable to each state/jurisdiction where employees are stationed to protect the Contractor from claims under workman’s compensation acts and from any other claims for damages for personal injury, including death which may arise from operations under this contract whether such operations by the Contractor itself or by any Subcontractor or anyone directly or indirectly employed by either business entity. The Contractor shall maintain General Liability insurance: bodily injury liability coverage written on a comprehensive form of policy of at least $500,000 per occurrence is required.

Additionally, the Contractor shall maintain an automobile liability insurance policy providing for bodily injury and property damage liability covering automobiles operated in the United States. The Contractor’s automobile liability insurance policy shall provide coverage that meets or exceeds the minimum coverage limits applicable to the each state/jurisdiction where the vehicle is registered and/or operated in, per occurrence for both bodily injury and for property coverage. Certificates of such insurance shall be subject to the approval of the CO for adequacy of protection. All insurance certificates required under this contract shall provide 30 days advance notice to the Government of any contemplated cancellation.

H.2 Security Requirements for Sensitive/But Unclassified (SBU) Contracts

H.2.1 General

The United States Immigration and Customs Enforcement (ICE) has determined that performance of the tasks as described in Contract TBD requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor) have access to sensitive DHS information, and that the Contractor will adhere to the following:

H.2.2 Preliminary Determination

ICE will exercise full control over granting; denying, withholding or terminating unescorted government facility and/or sensitive Government information access for Contractor employees, based upon the results of a background investigation. ICE may, as it deems appropriate, authorize and make a favorable expedited pre-employment determination based on preliminary security checks. The expedited pre-employment determination will allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable pre-employment determination shall not be considered as assurance that a favorable full employment determination will follow as a result thereof. The granting of a favorable pre-employment determination or a full employment determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by ICE, at any time during the term of the contract. No employee of the Contractor shall be allowed to enter on duty and/or access sensitive information or systems without a favorable preliminary fitness determination or final fitness determination by the Office of Professional Responsibility, Personnel Security Unit (OPR-PSU). No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable pre-employment determination or full employment determination by the OPR-PSU. Contract employees are processed under the ICE Management Directive 6-8.0. The contractor shall comply with the pre-screening requirements specified in the DHS Special Security Requirement – Contractor Pre-Screening paragraph located in this contract, if HSAR clauses 3052.204-70, Security Requirements for Unclassified Information Technology (IT) Resources; and/or 3052.204-71, Contractor Employee Access are included in the Clause section of this contract.

H.2.1 Background Investigations

See Section C 6.3 – 6.9

H.3 Authority to Operate (ATO)

An ATO is specific to the contractor-defined system boundary. This boundary shall include all components of the contractor information system to be authorized for operation by an ICE authorizing official, wherein ICE data is processed. The contractor will initially provide, as part of their proposal, a plan/baseline (milestone schedule) on how their proposed technical solution/approach will meet the Federal Information Processing Standard (FIPS) 199 system security categorization of High, High, and Moderate, and a response to the ICE-provided security baseline controls questionnaire describing the minimum controls currently in place for their proposed solution Ultimately, a Third Party Assessment Report (TPAR) and ATO will be required for the IT system(s) that processes, stores or transmits electronic records created or maintained for background investigative services.

H.3.1 Full Authorization

Contractors shall provide their Milestone Schedule, Transition Plan and/or certification for the following:

a) Authority to Operate (ATO) -The ATO will be obtained approximately 60 days after award and prior to the anticipated commencement date. The contractor must show what level of security is in place. Consequently this will encompass the TPAR and Plan of Action and Milestones (POA&Ms) for all identified weaknesses that must be remediated.

The contractor shall not process DHS sensitive information without acceptance of an Authority to Operate (ATO) from the ICE Authorizing Official (AO).

b) Security Authorization - Upon award, in order to achieve an Authority to Operate (ATO), an organization shall conduct a Security Authorization [formerly known as Certification and Accreditation (C&A)] of the system boundary that will be processing ICE data. The Security Authorization leads to the ATO. The Security Authorization provided by the contractor, which is validated by a third party ensures that the system meets minimum security requirements for processing, storing or transmitting ICE data.

(i) Contractor Security Authorization (SA) documentation shall be developed using the Government provided Security Requirements Traceability Matrix and Government security documentation templates, as adapted for Contractor IT systems. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

(ii) Traceability Matrix (SRTM) and Third Party Assessment Report (TPAR).

At a minimum, the solution provided by the contractor must meet a high confidentiality rating, high integrity rating, and a moderate availability rating as defined in National Institute of Standards and Technology (NIST) Security Publication (SP) 800-53 (Revision 4) Security and Privacy Controls for Federal Information Systems and Organizations. The NIST SP 800-53 document can be found on the NIST Computer Resource Center website - http://csrc.nist.gov/publications/PubsSPs.html.

For the Security Authorization, a contractor company senior executive (i.e., CIO for the organization) must attest to the results of the TPAR and provide concurrence with the dates to address outstanding findings via POA&Ms prior to presenting the package to the Government ATO acceptance. The ICE Authorizing Official will make the ATO determination by granting the ATO, granting a provisional ATO that requires remediation of specific weaknesses within a limited timeframe, or deny the ATO. There will be no processing of ICE data until the ATO has been accepted.

c) Independent Testing - The contractor shall have an independent assessment validate the security and privacy controls in place for the system. The independent third party shall review and analyze the SA package, and report on technical, operational and management level deficiencies as outlined in NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations. The independent testing shall be conducted by individual’s holding an ISO 27001 certification, ISACA Certified Information Security Manager (CISM) certification, and/or an ISC2 Certified Information Systems Security Professional (CISSP) certification. The contractor shall submit the Security Requirements Traceability Matrix (SRTM), the Third Party Assessment Report (TPAR), System Security Plan, Contingency Plan and POA&Ms as part of the Security Authorization Package. The contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

d) Renewal of ATO - Unless otherwise directed by the Contracting Officer, the ATO shall be renewed every three (3) years. The contractor is required to update its SA package as part of the ATO renewal process. The contractor shall update its SA package by one of the following methods: (1) Updating the SA documentation in the DHS automated information assurance tool for acceptance by the ICE CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls; or (2) Submitting an updated SA package directly to the COR for approval by the ICE CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls. The 90 day review process is independent of the system production date and therefore it is important that the contractor build the review into project schedules. The reviews may include onsite visits that involve physical or logical inspection of the contractor environment to ensure controls are in place.

e) Continuous Monitoring - All contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis. The contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities. The Government may elect to perform continuous monitoring and IT security scanning of contractor systems from Government tools and infrastructure.

f) Federal Reporting Requirements - Contractors operating information systems on behalf of the Government or operating systems containing sensitive information shall comply with Federal Information Security Management Act (FISMA) reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors shall provide the COR with requested information within three (3) business days of receipt of the request. Reporting requirements are determined by the Government and are defined in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The Contractor shall provide the Government with all information to fully satisfy FISMA reporting requirements for Contractor systems.

g) Incident Reporting

(1) All known or suspected sensitive information incidents shall be reported to the ICE Security Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting requirements. Reports may be made via the ICE SOC Main Line: (480) 496-6627 or email SOC@ice.dhs.gov within one hour of discovery.

When notifying the ICE SOC, the Contractor shall also notify the Contracting Officer, COR, ICE Privacy Officer, and US-CERT using the contact information identified in the contract. If the incident is reported by phone or the Contracting Officer’s email address is not immediately available, the Contractor shall contact the Contracting Officer immediately after reporting the incident to the ICE SOC. The Contractor shall not include any sensitive information in the subject or body of any e-mail. To transmit sensitive information, the Contractor shall use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption methods to protect sensitive information in attachments to email. Passwords shall not be communicated in the same email as the attachment. A sensitive information incident shall not, by itself, be interpreted as evidence that the Contractor has failed to provide adequate information security safeguards for sensitive information, or has otherwise failed to meet the requirements of the contract.

(2) If a sensitive information incident involves PII or SPII, in addition to the reporting requirements in 4300A Sensitive Systems Handbook Incident Response and Reporting, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Data Universal Numbering System (DUNS).

(ii) Contract numbers affected unless all contracts by the company are affected.

(iii) Facility CAGE code if the location of the event is different than the prime contractor location.

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, email).

(v) Contracting Officer POC (address, telephone, email).

(vi) Contract clearance level.

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network.

(viii) Government programs, platforms or systems involved.

(ix) Location(s) of incident.

(x) Date and time the incident was discovered.

(xi) Server names where sensitive information resided at the time of the incident, both at the Contractor and subcontractor level.

(xii) Description of the Government PII and/or SPII contained within the system.

(xiii) Number of people potentially affected and the estimate or actual number of records exposed and/or contained within the system.

(xiv) Any additional information relevant to the incident.

h) Sensitive Information Incident Response Requirements.

(1) All determinations related to sensitive information incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made in writing by the Contracting Officer in consultation with the ICE CIO and ICE Privacy Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections,

(ii) Investigations,

(iii) Forensic reviews, and

(iv) Data analyses and processing.

(4) The Government, at its sole discretion, may obtain the assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

i) Additional PII and/or SPII Notification Requirements.

(1) The Contractor shall have in place procedures and the capability to notify any individual whose PII resided in the Contractor IT system at the time of the sensitive information incident not later than 5 business days after being directed to notify individuals, unless otherwise approved by the Contracting Officer. The method and content of any notification by the Contractor shall be coordinated with, and subject to prior written approval by the Contracting Officer, in consultation with the ICE Component Privacy Officer, utilizing the DHS Privacy Incident Handling Guidance. The Contractor shall not proceed with notification unless the Contracting Officer, in consultation with the ICE Privacy Officer, has determined in writing that notification is appropriate.

(2) Subject to Government analysis of the incident and the terms of its instructions to the Contractor regarding any resulting notification, the notification method may consist of letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by the Government. Notification may require the Contractor’s use of address verification and/or address location services. At a minimum, the notification shall include:

(i) A brief description of the incident;

(ii) A description of the types of PII and SPII involved;

(iii) A statement as to whether the PII or SPII was encrypted or protected by other means;

(iv) Steps individuals may take to protect themselves;

(v) What the Contractor and/or the Government are doing to investigate the incident, to mitigate the incident, and to protect against any future incidents; and

(vi) Information identifying who individuals may contact for additional information.

j) Credit Monitoring Requirements - In the event that a sensitive information incident involves PII or SPII, the Contractor may be required to, as directed by the Contracting Officer:

(1) Provide notification to affected individuals as described above; and/or

(2) Provide credit monitoring services to individuals whose data resided in the Contractor IT system at the time of the sensitive information incident for a period beginning the date of the incident and extending not less than 18 months from the date the individual is notified. Credit monitoring services shall be provided from a company with which the Contractor has no affiliation. At a minimum, credit monitoring services shall include:

(i) Triple credit bureau monitoring;

(ii) Daily customer service;

(iii) Alerts provided to the individual for changes and fraud; and

(iv) Assistance to the individual with enrollment in the services and the use of fraud alerts; and/or

(3) Establish a dedicated call center. Call center services shall include:

(i) A dedicated telephone number to contact customer service within a fixed period;

(ii) Information necessary for registrants/enrollees to access credit reports and credit scores;

(iii) Weekly reports on call center volume, issue escalation (i.e., those calls that cannot be handled by call center staff and must be resolved by call center management or ICE, as appropriate), and other key metrics;

(iv) Escalation of calls that cannot be handled by call center staff to call center management or ICE, as appropriate;

(v) Customized FAQs, approved in writing by the Contracting Officer in coordination with the ICE Chief Privacy Officer; and

(vi) Information for registrants to contact customer service representatives and fraud resolution representatives for credit monitoring assistance.

H.4 Information Technology Acquisition Review (ITAR) Clauses

H.4.1 ITAR 4.5.3.1 – Compliance with DHS Security Policy Terms and Conditions

(1) Compliance with DHS Security Policy Terms and Conditions - All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Policy and DHS 4300A Sensitive Systems Handbook.

H.4.2 ITAR 4.5.3.2 - Encryption Compliance Terms and Conditions - If encryption is required, the following methods are acceptable for encrypting sensitive information

(1) Federal Information Processing Standards (FIPS) 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

(2) National Security Agency (NSA) Type 2 or Type 1 encryption.

(3) Public Key Infrastructure (PKI) (see paragraph 5.5.2.1 of the Department of Homeland Security (DHS) IT Security Program Handbook (DHS Management Directive (MD) 4300A) for Sensitive Systems).

H.4.3 ITAR 4.5.3.4 and ITAR 4.5.4.4 – Security Review Terms and Conditions

The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor shall contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computers used in performance of this contract and to preserve evidence of computer crime.

H.4.4 ITAR 4.5.3.5 – Interconnection Security Agreement (ISA) Terms and Conditions

Interconnections between ICE and non-ICE IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be authorized at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnection security agreements.

H.4.5 ITAR 4.5.3.6 and ITAR 4.5.4.6 – Required Protections for DHS Systems Hosted in Non-DHS Data Centers - Security Authorization Terms and Conditions

a) A Security Authorization of any infrastructure directly in support of ICE information system shall be performed as a general support system (GSS) prior to ICE occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results. The Security Authorization shall be performed in accordance with the DHS Sensitive System Security Policy Directive (SSPD) 4300A and the controls provided by the hosting provider shall be equal to or stronger than the FIPS 199 security categorization of the ICE information system.

b) At the beginning of the contract, and annually thereafter, the contractor shall provide the results of an independent assessment and verification of security controls. The independent assessment and verification shall apply the same standards that ICE applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the COR for entry into ICE’s POA&M Management Process. The contractor shall use ICE’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS SSPD 4300A POA&M Management Process. Contractor procedures shall be subject to periodic, unannounced assessments by ICE officials. The physical aspects associated with contractor activities shall also be subject to such assessments.

c) On a periodic basis, DHS and its Components, including DHS Office of Inspector General, may choose to evaluate any or all of the security controls implemented by the contractor under these clauses. Evaluation could include, but is not limited to vulnerability scanning. The DHS and its Components reserve the right to conduct assessments and audits at their discretion. With ten working days’ notice, at the request of the Government, the contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein DHS ICE information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of ICE, including those initiated by the DHS Office of the Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by ICE in the event of a security incident.

H.4.6 ITAR 4.5.3.8 – PIV Credential Compliance Terms and Conditions

1) Procurements for products, systems, services, hardware, or software involving controlled facility or information system shall be PIV-enabled by accepting HSPD-12 PIV credentials as a method of identity verification and authentication.

2) Procurements for software products or software developments shall be compliant by accepting PIV credentials as the common means of authentication for access for federal employees and contractors.

3) PIV-enabled information systems must demonstrate that they can correctly work with PIV credentials by responding to the cryptographic challenge in the authentication protocol before granting access.

4) If a system is identified to be non-compliant with HSPD-12 for PIV credential enablement, a remediation plan for achieving HSPD-12 compliance shall be required for review, evaluation, and approval by the CISO.

H.4.7 Requirements for Handling Sensitive Information Terms and Conditions

Contractor compliance with this clause, as well as the policies and procedures described below, is required.

1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

3) All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Sensitive but Unclassified Information Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

H.4.8 Sensitive Information Storage

1) Sensitive But Unclassified (SBU) information, data, and/or equipment will be disclosed only to authorize personnel on a need-to-know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST SP 800-88, Guidelines for Media Sanitization.

2) The disposition of all data will be at the written direction of the COR, this may include documents returned to Government control; destroyed; or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the COR.

H.4.9 Protection of Information

1) The contractor shall be responsible for properly protecting all information used, gathered, or developed because of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as SBU information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

2) The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on contractor’s infrastructure, as well as maintains the right to request full copies of these at any time.

3) The data that is processed and stored by the various applications within the network infrastructure contains financial data as well as personally identifiable information (PII). This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure.

4) The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

5) No data shall be released by the Contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the COR/CO.

H.4.10 Security Classification

The preparation of the deliverables in this contract will be completed at a Sensitive but Unclassified level.

H.4.11 Confidentiality and Nondisclosure

1) The preliminary and final deliverables and all associated working papers and other material deemed relevant by the agency that have been generated by the contractor in the performance of this contract, are the property of the U.S. Government, and must be submitted to the COR at the conclusion of the contract. The U.S. Government has unlimited data rights to all deliverables and associated working papers and materials in accordance with FAR 52.227-14.

2) All documents produced for this project are the property of the U.S. Government and cannot be reproduced, or retained by the contractor. All appropriate project documentation will be given to the agency during and at the end of this contract. The contractor shall not release any information without the written consent of the CO.

3) Personnel working on any of the described tasks may, at Government request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents.

H.4.12 Disclosure of Information

1) Any information made available to the Contractor by the Government shall be used only for carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

H.4.13 FIPS 140-2 Validated Cryptography for Secure Communications

All deliverables shall be labeled “Sensitive but Unclassified”. External transmission/dissemination of deliverables to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140 (as amended), “Security requirements for Cryptographic Modules.”

H.4.14 Separation Checklist for Contractor Employees

Contractors shall enact a protocol to use a separation checklist before its employees, sub-Contractor employees, or independent Contractors terminate working on the contract. The separation check list must cover areas such as: (1) return of any government-furnished equipment; (2) return or proper disposal of Sensitive PII (paper or electronic) in the custody of the Contractor/sub-Contractor employee or independent Contractor, including the wiping of data on any computer systems or media as appropriate; and (3) termination of any technological access to the Contractor’s facilities or systems that would permit the terminated employee’s access Sensitive PII to the COR.

In the event of adverse job actions resulting in the dismissal of an employee, sub-Contractor employee, or independent Contractor, the Contractor shall notify the COR within 24 hours. For normal separations, the Contractor shall submit the checklist on the last day of the employment or work on the contract.

H.4.15 Safeguarding Sensitive PII Requirement

Contractor employees shall comply with the DHS Handbook for Safeguarding Sensitive PII and with DHS Sensitive System Policy Directive 4300A at all times when handling Sensitive PII, including encryption of SPII as required in the Handbook and in DHS 4300A information security policy. This requirement will be passed down in all sub-contracts as well.

H.4.16 Requirements for Contractor IT Systems Hosting Government Data

The Contractor is required to obtain an information security Authority To Operate for any IT environment owned or controlled by the Contractor, or any subcontractor, on which Government data shall reside for purposes of IT system development, design, data migration, testing, training, or disposal. The Contractor shall certify in writing the destruction or return of all Government data at the conclusion of the contract.

H.4.17 Handling of Government Deliverables

The Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable without the express permission of the Contracting Officer or Contracting Officer’s representative. The Government Agency owns the rights to all data/records produced as part of this contract.

H.4.18 Government Data Rights

The Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation created as part of this contract. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

H.4.19 Government Approval for Sub-Contracting

The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

H.5 Privacy Requirements

H.5.1 Required Security and Privacy Training for Contractors

Contractor shall provide training for all employees and…