Attch 1 Spec Ktrt Req .doc

Attachment 1

HSCETC-11-R-00002

Special Contract Requirements Contract Minimum & Maximum Amounts and Contract Value Indefinite-Delivery, Indefinite Quantity (ID/IQ)]

(a) The minimum guarantee will be $500K.

(b) A combined maximum ceiling of $400,000,000.00 is established as the cumulative total of all TOs for the entire ordering period. The contract maximum represents the total requirement for the life of the contract (including options, if exercised).

Notice to Proceed

The Offeror shall take no action on this contract, or incur any costs, without the Contracting Officer's (CO) official written notice to proceed. It is anticipated that this notice to proceed will generally be issued within 30 days or less following notification of contract award. The performance of this contract shall begin as specified in the notice to proceed.

Notice of Delay

If, because of technical difficulties, the Offeror becomes unable to complete the contract work at the time specified, notwithstanding the exercise of good faith and diligent efforts in performing the work called for under this contract, the Offeror shall give the CO written notice of the anticipated delay and the reasons for it. The notice and reasons shall be delivered promptly after the condition creating the anticipated delay becomes known to the Offeror but in no event less than 45 days before the completion date specified in this contract, unless otherwise permitted by the CO. When notice is given, the CO may extend the time specified in the Schedule for such period as is deemed advisable.

Technical Direction and Surveillance

(a) Performance of the work under this contract shall be subject to the surveillance and written technical direction of the Contracting Officer's Technical Representative (COTR), who shall be specifically appointed by the CO in writing. Technical direction is defined as a directive to the Offeror which approves approaches, solutions, designs, or refinements; fills in details or otherwise completes the general description of work of documentation items; shifts emphasis among work areas or tasks; or otherwise furnishes guidance to the Offeror. Technical direction includes the process of conducting inquiries, requesting studies, or transmitting information or advice by the COTR, regarding matters within the general tasks and requirements in Section C of this contract.

(b) The COTR does not have the authority to, and shall not, issue any technical direction which:

(1) constitutes an assignment of additional work outside the Statement of Work;

(2) Constitutes a change as defined in the contract clause entitled "Changes";

(3) In any manner causes an increase or decrease in the total estimated contract cost, the fixed fee (if any), or the time required for contract performance;

(4) Changes any of the expressed terms, conditions, or specifications of the contract; or

(5) Interferes with the Offeror's right to perform the specifications of the contract.

(c) All technical directions shall be issued in writing by the COTR via e-mail

(d) The Offeror shall proceed promptly with the performance of technical directions duly issued by the COTR in the manner prescribed by this clause and within his/her authority under the provisions of this clause. Any instruction or direction by the COTR which falls within one, or more, of the categories defined in (b)(1) through (5) above, shall cause the Offeror to notify the CO in writing within five (5) working days after receipt of any such instruction or direction and shall request the CO to modify the contract accordingly. Upon receiving the notification from the Offeror, the CO shall either issue an appropriate contract modification within a reasonable time or advice the Offeror in writing within thirty (30) days after receipt of the Offeror's Letter that:

(1) The technical direction is rescinded in its entirety; or

(2) The technical direction is within the scope of the contract, does not constitute a change under the "Changes" clause of the contract and that the Offeror should continue with the performance of the technical direction.

(e) A failure of the Offeror and CO to agree that the technical direction is within scope of the contract, or a failure to agree upon the contract action to be taken with respect thereto shall be subject to the provisions of the "Disputes" clause of this contract.

(f) Any action(s) taken by the Offeror in response to any direction given by any person other than the CO or the Project Officer whom the CO shall appoint shall be at the Offeror's risk.

Packing, Packaging, Marking and Storage of Equipment

(a) Unless otherwise specified, all items to be delivered under this contract shall be preserved, packaged, and packed in accordance with best commercial practices to meet the packing requirements of the carrier and to ensure safe delivery at destination at the most economical rate.

(b) All initial packing, marking, and storage incidental to shipping of equipment to be provided under this contract shall be at the Contractor’s expense. Unless otherwise specified, the Contractor shall supervise the packing of all Contractor acquired equipment and shall supervise the unpacking of equipment to be installed.

(c) The Contractor shall place identical requirements on all subcontracts.

(d). All containers, data, and correspondence submitted to the CO and the COTR shall comply with the following as identified in the individual TO. Exterior shipping containers and items not shipped in containers shall be clearly marked on an external surface as follows:

(1) Name of Contractor

(2) Contract number and order number

(3) Itemized list of contents including quantity and CLIN

(4) Consignee’s name, title, addresses and telephone number

(5) Package number of multiple packages (e.g., 1 of 5, 2 of 5 etc.)

Inspection and Acceptance Criteria

a. Final inspection and acceptance of all work, performance, reports and other deliverables under this contract shall be performed at the location specified in individual TO. Each order will also designate the individual responsible for inspection and acceptance.

b. The basis for acceptance shall be in compliance with the requirements set forth in the TO; and other terms and conditions of the contract. Deliverable items rejected under resulting TOs shall be corrected in accordance with the applicable clauses.

c. The Government requires a period not to exceed thirty (30) days after receipt of final deliverable item(s) for inspection and acceptance or rejection, unless otherwise specified in the individual TO.

IAW HSAM 3046.670 Inspection and receiving report

(a) Unless otherwise prescribed by Component procedures, a receiving report statement shall be signed by the authorized Government representative to evidence Government inspection and receipt, except for simplified acquisitions using OF 347. The receiving report shall be completed at the place(s) specified in the contract for performance of Government quality assurance.

(b) For simplified acquisitions using OF 347, or an equivalent authorized Component form, the receiving report section shall be completed for inspection and receipt and signed by the authorized Government representative.

Submittal and Payment of Invoices

(a) The Offeror shall submit a proper invoice in accordance with Attachment 2 – Provisions and Clauses, FAR clause 52.232-25 “Prompt Payment”. Invoices shall be submitted in accordance with HSAM 3032.7002 titled “Invoice and Voucher Review and Approval.

(b) Invoice submission and payment shall be in accordance with the respective “Payment” clause and other clauses and instructions depending on the respective contract type, as identified in individual TO.

(1) Fixed priced invoices shall be submitted pursuant to FAR clause, 52.232-1, “Payments”.

(2) Time and Materials invoices shall be submitted pursuant to FAR clause 52.232-7, “Payments under Time and Material and Labor Hour Contracts”.

(3) Cost-Reimbursement invoices shall be submitted pursuant to FAR clause 52.216-7, “Allowable Cost and Payment”,

(c) Invoices shall be submitted via one of the following three methods:

a. By mail: DHS, ICE, Burlington Finance Center, P.O. Box 1620, Williston, VT 05495-1620 ATTN: ICE-ITFO

b. By facsimile (fax) at: 802-288-7658 (include a cover sheet with point of contact & # of pages)

c. By e-mail at: Invoice.Consolidation@dhs.gov Invoices submitted by other than these three methods will be returned. Offeror Taxpayer Identification Number (TIN) must be registered in the Central Offeror Registration (http://www.ccr.gov) prior to award and shall be notated on every invoice submitted to ICE/OAQ. The ICE program office identified in the delivery order/contract shall also be notated on every invoice.

(d) In accordance with FAR 52.232-25 (a) (3), Prompt Payment, the information required with each invoice submission is as follows:

An invoice must include:

(i) Name and address of the Offeror;

(ii) Invoice date and number;

(iii) Contract number, contract line item number and, if applicable, the order number;

(iv) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered;

(vii) Name and address of official to whom payment is to be sent;

(viii) Name, title, and phone number of person to notify in event of defective invoice; and

(ix) Taxpayer Identification Number (TIN). The Offeror shall include its TIN on the invoice only if required elsewhere in this contract. (See paragraph 1 above.)

(x) Electronic funds transfer (EFT) banking information.

(A) The Offeror shall include EFT banking information on the invoice only if required elsewhere in this contract.

(B) If EFT banking information is not required to be on the invoice, in order for the invoice to be a proper invoice, the Offeror shall have submitted correct EFT banking information in accordance with the applicable solicitation provision, contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer; Central Offeror Registration, or 52.232-34, Payment by Electronic Funds Transfer; Other Than Central Offeror Registration), or applicable agency procedures.

(C) EFT banking information is not required if the Government waived the requirement to pay by EFT.

Invoices without the above information may be returned for resubmission.

The Offeror shall also submit the invoice electronically to: Contract Specialist: Tonya Modlin@dhs.gov and the COTR: TBD.

Ordering

(a) Ordering under the contract is authorized to meet the needs of the Immigration and Custom Enforcement (ICE) Office of the Chief Information Officer, Information Technology Field Operations only.

(b) Any request for deviation from the terms of this Contract must be submitted to the CO as identified in A.2.

(c) All TO (‘s) issued under this contract are subject to the terms and conditions of this contract. The contract takes precedence in the event of conflict with any order.

(d) All services under this contract will be ordered by issuance of written TOs in accordance with FAR subpart 16.5, Indefinite Delivery Contracts as implemented by HSAM 3016.504, Indefinite Delivery Contracts. An appropriate order form (SF Form 347) shall be issued for each order.

(e) Performance under TO(s) shall commence only after receipt of an executed order via facsimile, e-mail, or by verbal direction from the TO CO. If verbal direction is given, written confirmation will be provided within five working days of the verbal order. The Government shall not be obligated to reimburse the Offeror for work performed, items delivered, or any costs incurred, nor shall the Offeror be obligated to perform, deliver, or otherwise incur costs except as authorized by duly executed TO.

Release of News Information

No new release (including photographs and films, public announcements, denial or confirmation of same) on any part of the subject matter of this contract or any phase of any program hereunder shall be made without the prior written approval of the CO and Program Executive Officer.

Work on a Government Installation.

In performing work under this contract on a Government installation or in a Government building, the Offeror shall:

(1) Conform to the specific safety requirements established by this contract and individual TOs.

(2) Comply with the safety rules of the Government installation that concern related activities not directly addressed in this contract.

(3) Take all reasonable steps and precautions to prevent accidents and preserve the life and health of Offeror and Government personnel connected in any way with performance under this contract.

(4) Take such additional immediate precautions as the CO may reasonably require for safety and accident prevention purposes.

REQUIRED SECURITY CLAUSE

SENSITIVE /UNCLASSIFED CONTRACTS

General

The Department of Homeland Security (DHS) has determined that performance of the task as described in ITFO Statement of Work, requires that the Offeror, SubOfferor(s), vendor(s), etc. (herein known as Offeror) have access to sensitive ICE information.

The Offeror shall adhere to the following requirements.

Suitability Determination DHS shall have and exercise full control over granting, denying, withholding, or terminating unescorted Government facility and/or sensitive Government information access for Offeror employees, based upon the results of a background investigation. DHS may, as it deems appropriate, authorize and make a favorable Entry On Duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment suitability authorization will follow as a result thereof. The granting of a favorable EOD decision or a full employment suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the contract. No employee of the Offeror shall be allowed to EOD and/or access sensitive information or systems without a favorable EOD decision or suitability determination by the Office of Professional Responsibility, Personnel Security Unit (OPR-PSU). No employee of the Offeror shall be allowed unescorted access to a Government facility without a favorable EOD decision or suitability determination by OPR-PSU. Contract employees assigned to the contract not needing access to sensitive DHS information or recurring access to DHS’ facilities will not be subject to security suitability screening.

Background Investigations

Contract employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive information, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. Background investigations will be processed through the Personnel Security Unit. Prospective Offeror employees with adequate security clearances issued by the Defense Industrial Security Clearance Office (DISCO) may not be required to submit complete security packages, as the clearance issued by DISCO may be accepted. Perspective Offeror employees without adequate security clearances issued by DISCO shall submit the following completed forms to the Personnel Security Unit through the COTR no less than 5 days before the starting date of the contract or 5 days prior to expected entry on duty of any employees, whether a replacement, additional, Sub-Offeror employee, or vendor:

Standard Form 86P, “Questionnaire for Public Trust Positions”. Form will be submitted via e-QIP (electronic Questionnaires for Investigation Processing) (2 copies) FD Form 258, “Fingerprint Card” (2 copies)

Foreign National Relatives or Associates Statement DHS 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act” Optional Form 306 Declaration for Federal Employment (applies to Offerors as well) Authorization for Release of Medical Information Required forms will be provided by DHS at the time of award of the contract. Only complete packages will be accepted by OPR-PSU. Specific instructions on submission of packages will be provided upon award of the contract.

Be advised that unless an applicant requiring access to sensitive information has resided in the U.S. for three of the past five years, the Government may not be able to complete a satisfactory background investigation. In such cases, DHS retains the right to deem an applicant as ineligible due to insufficient background information.

The use of Non-U.S. Citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of this contract for any position that involves access to, development of, or maintenance to any DHS IT System.

Continued Eligibility

If a prospective employee is found to be ineligible for access to Government facilities or information, the COTR will advise the Offeror that the employee shall not continue to work or to be assigned to work under the contract.

The OPR-PSU may require drug screening for probable cause at any time and/or when the Offeror independently identifies, circumstances where probable cause exists. The OPR-PSU may require reinvestigations when derogatory information is received and/or every 5 years.

DHS reserves the right and prerogative to deny and/or restrict the facility and information access of any Offeror employee whose actions are in conflict with the standards of conduct, 5 CFR 2635 and 5 CFR 3801, or whom DHS determines to present a risk of compromising sensitive Government information to which he or she would have access under this contract.

The Offeror shall report any adverse information coming to their attention concerning contract employees under the contract to the OPR-PSU through the COTR. Reports based on rumor or innuendo should not be made. The subsequent termination of employment of an employee does not obviate the requirement to submit this report. The report shall include the employees’ name and social security number, along with the adverse information being reported.

The OPR-PSU must be notified of all terminations/resignations within five days of occurrence. The Offeror shall return any expired DHS issued identification cards and building passes, or those of terminated employees to the COTR. If an identification card or building pass is not available to be returned, a report must be submitted to the COTR, referencing the pass or card number, name or individual to whom issued, the last known location and disposition of pass or card. The COTR will return the identification cards and building passes to the responsible ID Unit.

Security Management

The Offeror shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with the OPR-PSU through the COTR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Offeror.

The COTR and the OPR-PSU shall have the right to inspect the procedures, methods, and facilities utilized by the Offeror in complying with the security requirements under this contract. Should the COTR determine that the Offeror is not complying with the security requirements of this contract; the Offeror shall be informed in writing by the CO of the proper action to be taken in order to effect compliance with such requirements.

The following computer security requirements apply to both Department of Homeland Security (DHS) operations and to the former Immigration and Naturalization Service operations (FINS). These entities are hereafter referred to as the Department.

Information Technology Security Clearance

When sensitive Government information is processed on Department telecommunications and automated information systems, the Offeror agrees to provide for the administrative control of sensitive data being processed and to adhere to the procedures governing such data as outlined in DHS IT Security Program Publication DHS MD 4300 Publication or its replacement. Offeror personnel must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Offerors who fail to comply with Department security policy are subject to having their access to Department IT Systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g. Privacy Act).

Information Technology Security Training and Oversight

Offerors, who are involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the Department, shall receive periodic training at least annually in security awareness and accepted security practices and system rules of behavior. Department Offerors with significant security responsibilities shall receive specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Department information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures shall be reported to the local Security Office or Information System Security Officer (ISSO).

Security Requirements for Contractor Personnel

General Requirement ICE has determined that performance of this contract will require that the Offeror, SubOfferor(s), and associated vendor(s), etc. (herein known as Offeror) access ICE sensitive information in accordance with all applicable Component policies and DHS MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information, National Security Information in accordance with all applicable Component policies and DHS 4300B. To ensure the security of the DHS/ICE information in their charge, ICE Offerors and sub-Offerors must adhere to the same computer security requirements and regulations as ICE federal employees unless an exception to policy is agreed to by the prime Offerors, ICE ISSM and CO and detailed in the contract. The DHS Rules of Behavior document applies to both DHS federal employees and DHS support Offerors and sub-Offerors.

Security Policy References The following two primary DHS/ICE IT Security requirements documents are applicable to Offeror/SubOfferor operations supporting Sensitive But Unclassified (SBU) based contracts. Additionally, ICE and its Offerors must conform to other DHS Management Directives (MD) (Note: these additional MD documents appear on DHS-Online in the Management Directives Section. Volume 11000 “Security and Volume 4000 “IT Systems” are of particular importance in the support of computer security practices)

DHS 4300A Sensitive Systems Policy Directive (ICE IAD Intranet Site)

DHS 4300A, IT Security Sensitive Systems Handbook (ICE IAD Intranet Site)

ICE Directive, IT Security Policy for SBU Systems

Offeror Information Systems Security Officer (ISSO) Point Of Contact Requirement

The Offeror shall appoint and submit the name to ICE Information Systems Security Manager (ISSM) for approval, via the ICE COTR, of a qualified individual to act as the Contractor ISSO to interact with ICE personnel on any Offeror IT security issues at the Post Award Conference.

Protection of ICE Sensitive but Unclassified Information The Offeror shall protect all DHS/ICE “sensitive information” to which the Offeror is granted physical or electronic access by adhering to the specific IT security requirements of this contract and the DHS/ICE security policies specified in the Reference Section above. Offeror shall ensure that their systems containing DHS/ICE information and data be protected from unauthorized access, modification and denial of service. Further, the data must be protected in order to ensure the privacy of individual’s personal information.

Security Requirements for Unclassified Information Technology Resources

(a) The Offeror shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Offeror for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Offeror must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission. The security requirements include, but are not limited to, how the Department of Homeland Security’s sensitive information is to be handled and protected at the Offeror’s site, (including any information stored, processed, or transmitted using the Offeror’s computer systems), the background investigation and/or clearances required, and the facility security required. This requirement includes information technology, hardware, software, and the management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems. Examples of tasks that require security provisions include—

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the Offeror’s copy be corrupted; and

(2) Access to DHS networks or computers at a level beyond that granted the general public, (e.g. such as bypassing a firewall).

(b) At the expiration of the contract, the Offeror shall return all sensitive DHS information and IT resources provided to the Offeror during the contract, and a certification that all DHS information has been purged from any Offeror-owned system used to process DHS information. Organizational elements shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

(c) The Offeror shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan shall describe those parts of the contract to which this clause applies. The Offeror’s IT Security Plan shall be compliant with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.), and the Government Information Security Reform Act of 2000, and the Federal Information Security Management Act of 2002. The plan shall meet IT security requirements in accordance with Federal policies and procedures that include, but are not limited to OMB Circular A-130, Management of Federal Information Resources, Appendix III, and Security of Federal Automated Information Resources;

(d) Within 30 days after contract award, the Offeror shall submit for approval an IT Security Plan. This plan shall be consistent with and further detail the approach contained in the Offeror's proposal or quote that resulted in the award of this contract and in compliance with the requirements stated in this clause. The plan, as approved by the CO, shall be incorporated into the contract as a compliance document.

(e) Within 6 months after contract award, the Offeror shall submit written proof of IT Security accreditation to DHS for approval by the DHS CO. Accreditation will be according to the criteria of the Homeland Security Information Technology Security program Publication, DHS MD 4300.Pub., Volume I, Policy Guide, Part A, Sensitive Systems, which is available from the CO upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the CO, shall be incorporated into the contract as a compliance document, and shall include a final security plan, a risk assessment, security test and evaluation, and disaster recovery/continuity of operations plan. The Offeror shall comply with the approved accreditation documentation.

(f) The Company’s databases, to the extent they are located in the United States at the time this contract is executed, and which form the basis for products and services supplied under this contract at the time of execution, shall remain located in the United States;

(g) the Company shall ensure that reasonable cyber security measures are in place to protect the products and services being supplied to DHS, and the Company shall respond to and take reasonable action to address any concerns DHS may raise regarding the cyber security practices of the Company that are relevant to the products and services supplied under this contract;

(h) the Company’s databases, referenced in paragraph (1) shall remain under control of a U.S. company (to the extent they are controlled by a U.S. company at the time this contract is executed), which shall have sole authority to determine the purposes and means of the processing of personal data in the United States; and

(i) should the foreign ownership, control, or influence of the Company’s databases referenced in paragraph (1) change, the Company will inform Nancy J. Maples-Remley, CO at DHS, so that the parties may agree on further risk mitigation measures as appropriate.

IT Security Requirements

General Requirement To ensure the security of the DHS/ICE information in their charge, ICE Offerors and sub-Offerors must adhere to the same computer security rules and regulations as government employees unless an exception to policy is agreed to by the prime Offerors, ICE ISSM and CO and detailed in the contract. Non-DHS Federal employees or Offerors who fail to comply with DHS/ICE security policies are subject to having their access to DHS/ICE IT systems and facilities terminated, whether or not the failure results in criminal prosecution. The DHS Rules of Behavior document applies to DHS/ICE support Offerors and Sub-Offerors.

Federal Desktop Core Configuration (FDCC)

The Offeror shall certify that applications are fully functional and operate correctly as intended on systems using the FDCC. This includes Internet Explorer 7 configured to operate on Windows XP, Vista, and Windows 7. The standard installations, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the approved FDCC. The information technology should also use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall.

Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

Access to Unclassified Facilities, Information Technology Resources, And Sensitive Information

The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information, describes how Offerors must handle sensitive but unclassified information. DHS MD 4300.1 Information Technology Systems Security and the DHS Sensitive Systems Handbook prescribe policies and procedures on security for IT resources. Offerors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering Offerors specifically for all Task Order(s) that require access to DHS facilities, IT resources or sensitive information. Offerors shall not use or redistribute any DHS information processed, stored, or transmitted by the Offeror except as specified in the task order.

Interconnection Security Agreements

Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements.

Security Policy References The following primary DHS/ICE IT Security documents are applicable to Offeror/SubOfferor operations supporting Sensitive But Unclassified (SBU) based contracts. Additionally, ICE and its Offerors must conform to other DHS Management Directives (MD) (Note: these additional MD documents appear on DHS-Online in the Management Directives Section. Volume 11000 “Security and Volume 4000 “IT Systems” are of particular importance in the support of computer security practices). All services, hardware, and software provided under this task order must be compliant with DHS Information Security Policy, identified in MD4300.1, Information Technology Systems Security Program and 4300A Sensitive Systems Handbook.

DHS 4300A, Sensitive Systems Policy Directive

DHS 4300A, IT Security Sensitive Systems Handbook

ICE Directive, IT Security Policy for SBU Systems

DHS Information Technology Systems Security Policy, MD4300.1

Use of Government Equipment

Offerors are not authorized to use government office equipment of IT systems/computers for personal use under any circumstances, unless limited personal use is specifically permitted by the contract. When so authorized, Offerors shall be governed by the limited personal use policies in the referenced documents.

(a) Sensitive Information, as used in this Section, means any information, the loss, misuse, disclosure, or unauthorized access to or modification of which could adversely affect the national or homeland security interest, or the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal

Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

(b) “Information Technology Resources” include, but are not limited to, computer equipment, networking equipment, telecommunications equipment, cabling, network drives, computer drives, network software, computer software, software programs, intranet sites, and internet sites.

(c) Offeror employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the CO. Upon the CO's request, the Offeror's employees shall be fingerprinted, or subject to other investigations as required. All Offeror employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The CO may require the Offeror to prohibit individuals from working on the contract if the government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to sensitive information. Therefore, the Offeror shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the CO. For those Offeror employees authorized access to sensitive information, the Offeror shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

(f) The Offeror shall include the substance of this clause in all subcontracts at any tier where the SubOfferor may have access to Government facilities, sensitive information, or resources.

When the contract will require Offeror employees to have access to Information Technology (IT) resources, add the following paragraphs:

(g) Before receiving access to IT resources under this contract the individual must receive a security briefing, which the CO’s Technical Representative (COTR) will arrange, and complete any nondisclosure agreement furnished by DHS.

(h) The Offeror shall have access only to those areas of DHS information technology resources explicitly stated in this contract or approved by the COTR in writing as necessary for performance of the work under this contract. Any attempts by Offeror personnel to gain access to any information technology resources not expressly authorized by the statement of work, other terms and conditions in this contract, or as approved in writing by the COTR, is strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

(i) Offeror access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Offeror performs business for the DHS Component. It is not a right, a guarantee of access, a condition of the contract, or Government Furnished Equipment (GFE).

(j) Offeror access will be terminated for unauthorized use. The Offeror agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

(k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department’s Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

(1) The individual must be a legal permanent resident of the U.S. or a citizen of Ireland, Israel, the Republic of the Philippines, or any nation on the Allied Nations List maintained by the Department of State;

(2) There must be a compelling reason for using this individual as opposed to a U.S. citizen; and

(3) The waiver must be in the best interest of the Government.

(l) Offerors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the CO.

Accessibility Requirements

All electronic and information technology procured under this contract must meet applicable accessibility standards at 36 CFR Part 1194, unless an exception exists, or, for commercial items, unless and to the extent that individual standards cannot be met with supplies or services available in the commercial marketplace in time to meet delivery requirements. All exception must be documented by the CO on a case-by-case basis.

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology, they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable standards have been identified:

36 CFR 1194.21 – Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 – Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous JavaScript and XML (AJAX) then “1194.21 Software” standards also apply to fulfill functional performance criteria.

36 CFR 1194.23 – Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non end-user interfaces such as switches, circuits, etc. that are procured, developed or used by the Federal Government.

36 CFR 1194.24 – Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available. This standard applies to any training videos provided under this work statement.

36 CFR 1194.31 – Functional Performance Criteria applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 – Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required “1194.31 Functional Performance Criteria”, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply:

36 CFR 1194.2(b) – (COTS/GOTS products). When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meets some but not all of the standards, the agency must procure the product that best meets the standards.

When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires approval from the DHS Office on Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

The Offeror shall perform and complete miscellaneous tasks, projects, or activities identified and assigned by the COTR or designee that are not specifically addressed by the above descriptions and line items but are associated with the Task Area functions duties and responsibilities.

36 CFR 1194.3(b) – Incidental to Contract, all EIT that is exclusively owned and used by the Offeror to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those Offerors assign to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

Organization Conflict of Interest

(a) The provisions of FAR Subpart 9.5, Organization and Consultant Conflicts of Interest, concerning organizational conflicts of interest govern TOs issued under this contract.

(b) Potential conflicts may exist in accordance with FAR 9.505-1, Providing Information Technology Field Operations support, through 9.505-4, Obtaining Access to Proprietary Information.

(c) The Offeror is responsible for identifying any actual or potential organizational conflict of interest to the CO that would arise as the result of the issuance of a TO under this contract.

(d) The CO will determine on a case-by-case, TO by TO basis whether a conflict of interest is likely to arise.

To avoid or mitigate a potential conflict, the CO will impose appropriate constraints, such as the following.

(1) The Offeror agrees that if it provides, under a contract or TO, systems engineering and technical guidance for systems and programs, but does not have overall contractual responsibility, it will not be allowed to be awarded a contract or TO to supply the system or any of its major components or be a SubOfferor or consultant to a supplier of the system or any of its major components (FAR 9.505-1).

(2) The Offeror agrees that if it prepares specifications for non-developmental items or assists in the preparation of work statements for a system or services under a contract or TO, it will not be allowed to furnish these items, either as a prime Offeror, a SubOfferor or as a consultant (FAR 9.505-2).

(3) The Offeror agrees that if it gains access to proprietary data of other companies, it will protect such data and it will not use such proprietary data in supplying systems or components in future competitive procurements (FAR 9.505-4). In addition, the Offeror agrees to protect the proprietary data and rights of other organizations disclosed to the Offeror during performance of any TO with the same caution that a reasonably prudent Offeror would use to safeguard highly valuable property. The Offeror also agrees that if it gains access to the proprietary information of other companies, it will enter into an agreement with the other companies to protect their information from unauthorized use or disclosure for as long as it remains proprietary and refrain from using the information for any purpose other than that for which it was furnished.

(4) The Offeror agrees that it will not distribute reports, data or information of any nature arising from its performance under this contract, except as provided by the TO or as may be directed by the TO CO.

(5) The Offeror agrees that it will neither evaluate nor advise the Government with regard to its own products or activities. The Offeror will objectively evaluate or advise the Government concerning products or activities of any prospective competitors.

(6) The Offeror agrees that it will include the above provisions, including this paragraph, in agreements with teaming partners, consultants or SubOfferors at any tier which involve access to information covered above. The use of this clause in such agreements shall be read by substituting the word "consultant" or "SubOfferor" for the word "Offeror" whenever the latter appears.

(f) The Offeror shall effectively educate its employees,…