Attch 1 Spec Ktrt Req(REV1).doc

Attachment 1

HSCETC-11-R-00002

Special Contract Requirements Contract Minimum & Maximum Amounts and Contract Value Indefinite-Delivery, Indefinite Quantity (ID/IQ)]

(a) The minimum guarantee will be $500K.

(b) A combined maximum ceiling of $400,000,000.00 is established as the cumulative total of all TOs for the entire ordering period. The contract maximum represents the total requirement for the life of the contract (including options, if exercised).

Notice to Proceed

The Offeror shall take no action on this contract, or incur any costs, without the Contracting Officer's official written notice to proceed. It is anticipated that this notice to proceed will generally be issued within 30 days or less following notification of contract award. The performance of this contract shall begin as specified in the notice to proceed.

Notice of Delay

If, because of technical difficulties, the Offeror becomes unable to complete the contract work at the time specified, notwithstanding the exercise of good faith and diligent efforts in performing the work called for under this contract, the Offeror shall give the Contracting Officer written notice of the anticipated delay and the reasons for it. The notice and reasons shall be delivered promptly after the condition creating the anticipated delay becomes known to the Offeror but in no event less than 45 days before the completion date specified in this contract, unless otherwise permitted by the Contracting Officer. When notice is given, the Contracting Officer may extend the time specified in the Schedule for such period as is deemed advisable.

Technical Direction and Surveillance

(a) Performance of the work under this contract shall be subject to the surveillance and written technical direction of the Contracting Officer's Technical Representative (COTR), who shall be specifically appointed by the Contracting Officer in writing. Technical direction is defined as a directive to the Offeror which approves approaches, solutions, designs, or refinements; fills in details or otherwise completes the general description of work of documentation items; shifts emphasis among work areas or tasks; or otherwise furnishes guidance to the Offeror. Technical direction includes the process of conducting inquiries, requesting studies, or transmitting information or advice by the COTR, regarding matters within the general tasks and requirements in Section C of this contract.

(b) The COTR does not have the authority to, and shall not, issue any technical direction which:

(1) constitutes an assignment of additional work outside the Performance Work Statement;

(2) Constitutes a change as defined in the contract clause entitled "Changes";

(3) In any manner causes an increase or decrease in the total estimated contract cost, the fixed fee (if any), or the time required for contract performance;

(4) Changes any of the expressed terms, conditions, or specifications of the contract; or

(5) Interferes with the Offeror's right to perform the specifications of the contract.

(c) All technical directions shall be issued in writing by the COTR via e-mail

(d) The Offeror shall proceed promptly with the performance of technical directions duly issued by the COTR in the manner prescribed by this clause and within his/her authority under the provisions of this clause. Any instruction or direction by the COTR which falls within one, or more, of the categories defined in (b)(1) through (5) above, shall cause the Offeror to notify the Contracting Officer in writing within five (5) working days after receipt of any such instruction or direction and shall request the Contracting Officer to modify the contract accordingly. Upon receiving the notification from the Offeror, the Contracting Officer shall either issue an appropriate contract modification within a reasonable time or advice the Offeror in writing within thirty (30) days after receipt of the Offeror's Letter that:

(1) The technical direction is rescinded in its entirety; or

(2) The technical direction is within the scope of the contract, does not constitute a change under the "Changes" clause of the contract and that the Offeror should continue with the performance of the technical direction.

(e) A failure of the Offeror and Contracting Officer to agree that the technical direction is within scope of the contract, or a failure to agree upon the contract action to be taken with respect thereto shall be subject to the provisions of the "Disputes" clause of this contract.

(f) Any action(s) taken by the Offeror in response to any direction given by any person other than the Contracting Officer or the Project Officer whom the Contracting Officer shall appoint shall be at the Offeror's risk.

Packing, Packaging, Marking and Storage of Equipment

(a) Unless otherwise specified, all items to be delivered under this contract shall be preserved, packaged, and packed in accordance with best commercial practices to meet the packing requirements of the carrier and to ensure safe delivery at destination at the most economical rate.

(b) All initial packing, marking, and storage incidental to shipping of equipment to be provided under this contract shall be at the Contractor’s expense. Unless otherwise specified, the Contractor shall supervise the packing of all Contractor acquired equipment and shall supervise the unpacking of equipment to be installed.

(c) The Contractor shall place identical requirements on all subcontracts.

(d). All containers, data, and correspondence submitted to the CO and the COTR shall comply with the following as identified in the individual TO. Exterior shipping containers and items not shipped in containers shall be clearly marked on an external surface as follows:

(1) Name of Contractor

(2) Contract number and order number

(3) Itemized list of contents including quantity and CLIN

(4) Consignee’s name, title, addresses and telephone number

(5) Package number of multiple packages (e.g., 1 of 5, 2 of 5 etc.)

Inspection and Acceptance Criteria

a. Final inspection and acceptance of all work, performance, reports and other deliverables under this contract shall be performed at the location specified in individual TO. Each order will also designate the individual responsible for inspection and acceptance.

b. The basis for acceptance shall be in compliance with the requirements set forth in the TO; and other terms and conditions of the contract. Deliverable items rejected under resulting TOs shall be corrected in accordance with the applicable clauses.

c. The Government requires a period not to exceed thirty (30) days after receipt of final deliverable item(s) for inspection and acceptance or rejection, unless otherwise specified in the individual TO.

IAW HSAM 3046.670 Inspection and receiving report

(a) Unless otherwise prescribed by Component procedures, a receiving report statement shall be signed by the authorized Government representative to evidence Government inspection and receipt, except for simplified acquisitions using OF 347. The receiving report shall be completed at the place(s) specified in the contract for performance of Government quality assurance.

(b) For simplified acquisitions using OF 347, or an equivalent authorized Component form, the receiving report section shall be completed for inspection and receipt and signed by the authorized Government representative.

Submittal and Payment of Invoices

(a) The Offeror shall submit a proper invoice in accordance with Section I, FAR clause 52.232-25 “Prompt Payment”. Invoices shall be submitted in accordance with HSAM 3032.7002 titled “Invoice and Voucher Review and Approval.

(b) Invoice submission and payment shall be in accordance with the respective “Payment” clause and other clauses and instructions depending on the respective contract type, as identified in individual TO.

(1) Fixed priced invoices shall be submitted pursuant to Section I, FAR clause, 52.232-1, “Payments”.

(2) Time and Materials invoices shall be submitted pursuant to Section I, FAR clause 52.232-7, “Payments under Time and Material and Labor Hour Contracts”.

(3) Cost-Reimbursement invoices shall be submitted pursuant to Section I, FAR clause 52.216-7, “Allowable Cost and Payment”,

(c) Invoices shall be submitted via one of the following three methods:

a. By mail: DHS, ICE, Burlington Finance Center, P.O. Box 1620, Williston, VT 05495-1620 ATTN: ICE-ITFO

b. By facsimile (fax) at: 802-288-7658 (include a cover sheet with point of contact & # of pages)

c. By e-mail at: Invoice.Consolidation@dhs.gov Invoices submitted by other than these three methods will be returned. Offeror Taxpayer Identification Number (TIN) must be registered in the Central Offeror Registration (http://www.ccr.gov) prior to award and shall be notated on every invoice submitted to ICE/OAQ. The ICE program office identified in the delivery order/contract shall also be notated on every invoice.

(d) In accordance with FAR 52.232-25 (a) (3), Prompt Payment, the information required with each invoice submission is as follows:

An invoice must include:

(i) Name and address of the Offeror;

(ii) Invoice date and number;

(iii) Contract number, contract line item number and, if applicable, the order number;

(iv) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered;

(vii) Name and address of official to whom payment is to be sent;

(viii) Name, title, and phone number of person to notify in event of defective invoice; and

(ix) Taxpayer Identification Number (TIN). The Offeror shall include its TIN on the invoice only if required elsewhere in this contract. (See paragraph 1 above.)

(x) Electronic funds transfer (EFT) banking information.

(A) The Offeror shall include EFT banking information on the invoice only if required elsewhere in this contract.

(B) If EFT banking information is not required to be on the invoice, in order for the invoice to be a proper invoice, the Offeror shall have submitted correct EFT banking information in accordance with the applicable solicitation provision, contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer; Central Offeror Registration, or 52.232-34, Payment by Electronic Funds Transfer; Other Than Central Offeror Registration), or applicable agency procedures.

(C) EFT banking information is not required if the Government waived the requirement to pay by EFT.

Invoices without the above information may be returned for resubmission.

The Offeror shall also submit the invoice electronically to: Contract Specialist: Tonya Modlin@dhs.gov and The Contracting Officer’s Technical Representative: TBD.

Ordering

(a) Ordering under the contract is authorized to meet the needs of the Immigration and Custom Enforcement (ICE) Operations Division only.

(b) Any request for deviation from the terms of this Contract must be submitted to the Contracting Officer as identified in A.2.

(c) All TO (‘s) issued under this contract are subject to the terms and conditions of this contract. The contract takes precedence in the event of conflict with any order.

(d) All services under this contract will be ordered by issuance of written TOs in accordance with FAR subpart 16.5, Indefinite Delivery Contracts as implemented by HSAM 3016.504, Indefinite Delivery Contracts. An appropriate order form (SF Form 347) shall be issued for each order.

(e) Performance under TO(s) shall commence only after receipt of an executed order via facsimile, e-mail, or by verbal direction from the TO CO. If verbal direction is given, written confirmation will be provided within five working days of the verbal order. The Government shall not be obligated to reimburse the Offeror for work performed, items delivered, or any costs incurred, nor shall the Offeror be obligated to perform, deliver, or otherwise incur costs except as authorized by duly executed TO.

Release of News Information

No new release (including photographs and films, public announcements, denial or confirmation of same) on any part of the subject matter of this contract or any phase of any program hereunder shall be made without the prior written approval of the Contracting Officer and Program Executive Officer.

Work on a Government Installation.

In performing work under this contract on a Government installation or in a Government building, the Offeror shall:

(1) Conform to the specific safety requirements established by this contract and individual TOs.

(2) Comply with the safety rules of the Government installation that concern related activities not directly addressed in this contract.

(3) Take all reasonable steps and precautions to prevent accidents and preserve the life and health of Offeror and Government personnel connected in any way with performance under this contract.

(4) Take such additional immediate precautions as the Contracting Officer may reasonably require for safety and accident prevention purposes.

REQUIRED SECURITY CLAUSE

SENSITIVE /UNCLASSIFED CONTRACTS

General

The Department of Homeland Security (DHS) has determined that performance of the task as described in ITFO Statement of Work, requires that the Offeror, SubOfferor(s), vendor(s), etc. (herein known as Offeror) have access to sensitive ICE information.

The Offeror shall adhere to the following requirements.

Suitability Determination DHS shall have and exercise full control over granting, denying, withholding, or terminating unescorted Government facility and/or sensitive Government information access for Offeror employees, based upon the results of a background investigation. DHS may, as it deems appropriate, authorize and make a favorable Entry On Duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment suitability authorization will follow as a result thereof. The granting of a favorable EOD decision or a full employment suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the contract. No employee of the Offeror shall be allowed to EOD and/or access sensitive information or systems without a favorable EOD decision or suitability determination by the Office of Professional Responsibility, Personnel Security Unit (OPR-PSU). No employee of the Offeror shall be allowed unescorted access to a Government facility without a favorable EOD decision or suitability determination by OPR-PSU. Contract employees assigned to the contract not needing access to sensitive DHS information or recurring access to DHS’ facilities will not be subject to security suitability screening.

Background Investigations

Contract employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive information, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. Background investigations will be processed through the Personnel Security Unit. Prospective Offeror employees with adequate security clearances issued by the Defense Industrial Security Clearance Office (DISCO) may not be required to submit complete security packages, as the clearance issued by DISCO may be accepted. Perspective Offeror employees without adequate security clearances issued by DISCO shall submit the following completed forms to the Personnel Security Unit through the COTR no less than 5 days before the starting date of the contract or 5 days prior to expected entry on duty of any employees, whether a replacement, additional, Sub-Offeror employee, or vendor:

Standard Form 86P, “Questionnaire for Public Trust Positions”. Form will be submitted via e-QIP (electronic Questionnaires for Investigation Processing) (2 copies) FD Form 258, “Fingerprint Card” (2 copies)

Foreign National Relatives or Associates Statement DHS 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act” Optional Form 306 Declaration for Federal Employment (applies to Offerors as well) Authorization for Release of Medical Information Required forms will be provided by DHS at the time of award of the contract. Only complete packages will be accepted by OPR-PSU. Specific instructions on submission of packages will be provided upon award of the contract.

Be advised that unless an applicant requiring access to sensitive information has resided in the U.S. for three of the past five years, the Government may not be able to complete a satisfactory background investigation. In such cases, DHS retains the right to deem an applicant as ineligible due to insufficient background information.

The use of Non-U.S. Citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of this contract for any position that involves access to, development of, or maintenance to any DHS IT System.

Continued Eligibility

If a prospective employee is found to be ineligible for access to Government facilities or information, the COTR will advise the Offeror that the employee shall not continue to work or to be assigned to work under the contract.

The OPR-PSU may require drug screening for probable cause at any time and/or when the Offeror independently identifies, circumstances where probable cause exists. The OPR-PSU may require reinvestigations when derogatory information is received and/or every 5 years.

DHS reserves the right and prerogative to deny and/or restrict the facility and information access of any Offeror employee whose actions are in conflict with the standards of conduct, 5 CFR 2635 and 5 CFR 3801, or whom DHS determines to present a risk of compromising sensitive Government information to which he or she would have access under this contract.

The Offeror shall report any adverse information coming to their attention concerning contract employees under the contract to the OPR-PSU through the COTR. Reports based on rumor or innuendo should not be made. The subsequent termination of employment of an employee does not obviate the requirement to submit this report. The report shall include the employees’ name and social security number, along with the adverse information being reported.

The OPR-PSU must be notified of all terminations/resignations within five days of occurrence. The Offeror shall return any expired DHS issued identification cards and building passes, or those of terminated employees to the COTR. If an identification card or building pass is not available to be returned, a report must be submitted to the COTR, referencing the pass or card number, name or individual to whom issued, the last known location and disposition of pass or card. The COTR will return the identification cards and building passes to the responsible ID Unit.

Security Management

The Offeror shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with the OPR-PSU through the COTR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Offeror.

The COTR and the OPR-PSU shall have the right to inspect the procedures, methods, and facilities utilized by the Offeror in complying with the security requirements under this contract. Should the COTR determine that the Offeror is not complying with the security requirements of this contract; the Offeror shall be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

The following computer security requirements apply to both Department of Homeland Security (DHS) operations and to the former Immigration and Naturalization Service operations (FINS). These entities are hereafter referred to as the Department.

Information Technology Security Clearance

When sensitive Government information is processed on Department telecommunications and automated information systems, the Offeror agrees to provide for the administrative control of sensitive data being processed and to adhere to the procedures governing such data as outlined in DHS IT Security Program Publication DHS MD 4300 Publication or its replacement. Offeror personnel must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Offerors who fail to comply with Department security policy are subject to having their access to Department IT Systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g. Privacy Act).

Security Requirements for Contractor Personnel

General Requirement ICE has determined that performance of this contract will require that the Offeror, SubOfferor(s), and associated vendor(s), etc. (herein known as Offeror) access ICE sensitive information in accordance with all applicable Component policies and DHS MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information, National Security Information in accordance with all applicable Component policies and DHS 4300B. To ensure the security of the DHS/ICE information in their charge, ICE Offerors and sub-Offerors must adhere to the same computer security requirements and regulations as ICE federal employees unless an exception to policy is agreed to by the prime Offerors, ICE ISSM and Contracting Officer and detailed in the contract. The DHS Rules of Behavior document applies to both DHS federal employees and DHS support Offerors and sub-Offerors.

Security Policy References The following two primary DHS/ICE IT Security requirements documents are applicable to Offeror/SubOfferor operations supporting Sensitive But Unclassified (SBU) based contracts. Additionally, ICE and its Offerors must conform to other DHS Management Directives (MD) (Note: these additional MD documents appear on DHS-Online in the Management Directives Section. Volume 11000 “Security and Volume 4000 “IT Systems” are of particular importance in the support of computer security practices)

DHS 4300A Sensitive Systems Policy Directive (ICE IAD Intranet Site)

DHS 4300A, IT Security Sensitive Systems Handbook (ICE IAD Intranet Site)

ICE Directive, IT Security Policy for SBU Systems

Offeror Information Systems Security Officer (ISSO) Point Of Contact Requirement

The Offeror shall appoint and submit the name to ICE Information Systems Security Manager (ISSM) for approval, via the ICE COTR, of a qualified individual to act as the Contractor ISSO to interact with ICE personnel on any Offeror IT security issues at the Post Award Conference.

Protection of ICE Sensitive but Unclassified Information The Offeror shall protect all DHS/ICE “sensitive information” to which the Offeror is granted physical or electronic access by adhering to the specific IT security requirements of this contract and the DHS/ICE security policies specified in the Reference Section above. Offeror shall ensure that their systems containing DHS/ICE information and data be protected from unauthorized access, modification and denial of service. Further, the data must be protected in order to ensure the privacy of individual’s personal information.

Security Requirements for Unclassified Information Technology Resources

(a) The Offeror shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Offeror for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Offeror must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission. The security requirements include, but are not limited to, how the Department of Homeland Security’s sensitive information is to be handled and protected at the Offeror’s site, (including any information stored, processed, or transmitted using the Offeror’s computer systems), the background investigation and/or clearances required, and the facility security required. This requirement includes information technology, hardware, software, and the management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems. Examples of tasks that require security provisions include—

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the Offeror’s copy be corrupted; and

(2) Access to DHS networks or computers at a level beyond that granted the general public, (e.g. such as bypassing a firewall).

(b) At the expiration of the contract, the Offeror shall return all sensitive DHS information and IT resources provided to the Offeror during the contract, and a certification that all DHS information has been purged from any Offeror-owned system used to process DHS information. Organizational elements shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

(c) The Offeror shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan shall describe those parts of the contract to which this clause applies. The Offeror’s IT Security Plan shall be compliant with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.), and the Government Information Security Reform Act of 2000, and the Federal Information Security Management Act of 2002. The plan shall meet IT security requirements in accordance with Federal policies and procedures that include, but are not limited to OMB Circular A-130, Management of Federal Information Resources, Appendix III, and Security of Federal Automated Information Resources;

(d) Within 30 days after contract award, the Offeror shall submit for approval an IT Security Plan. This plan shall be consistent with and further detail the approach contained in the Offeror's proposal or quote that resulted in the award of this contract and in compliance with the requirements stated in this clause. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

(e) Within 6 months after contract award, the Offeror shall submit written proof of IT Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will be according to the criteria of the Homeland Security Information Technology Security program Publication, DHS MD 4300.Pub., Volume I, Policy Guide, Part A, Sensitive Systems, which is available from the Contracting Officer upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document, and shall include a final security plan, a risk assessment, security test and evaluation, and disaster recovery/continuity of operations plan. The Offeror shall comply with the approved accreditation documentation.

(f) The Company’s databases, to the extent they are located in the United States at the time this contract is executed, and which form the basis for products and services supplied under this contract at the time of execution, shall remain located in the United States;

(g) the Company shall ensure that reasonable cyber security measures are in place to protect the products and services being supplied to DHS, and the Company shall respond to and take reasonable action to address any concerns DHS may raise regarding the cyber security practices of the Company that are relevant to the products and services supplied under this contract;

(h) the Company’s databases, referenced in paragraph (1) shall remain under control of a U.S. company (to the extent they are controlled by a U.S. company at the time this contract is executed), which shall have sole authority to determine the purposes and means of the processing of personal data in the United States; and

(i) should the foreign ownership, control, or influence of the Company’s databases referenced in paragraph (1) change, the Company will inform Paul T. Osterhaus, Contracting Officer at DHS, so that the parties may agree on further risk mitigation measures as appropriate.

IT Security Requirements

General Requirement

To ensure the security of the DHS/ICE information in their charge, ICE Offerors and sub-Offerors must adhere to the same computer security rules and regulations as government employees unless an exception to policy is agreed to by the prime Offerors, ICE ISSM and Contracting Officer and detailed in the contract. Non-DHS Federal employees or Offerors who fail to comply with DHS/ICE security policies are subject to having their access to DHS/ICE IT systems and facilities terminated, whether or not the failure results in criminal prosecution. The DHS Rules of Behavior document applies to DHS/ICE support Offerors and Sub-Offerors.

Federal Desktop Core Configuration (FDCC)

The Offeror shall certify that applications are fully functional and operate correctly as intended on systems using the FDCC. This includes Internet Explorer 7 configured to operate on Windows XP, Vista, and Windows 7. The standard installations, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the approved FDCC. The information technology should also use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall.

Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

Access to Unclassified Facilities, Information Technology Resources, And Sensitive Information

The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information, describes how Offerors must handle sensitive but unclassified information. DHS MD 4300.1 Information Technology Systems Security and the DHS Sensitive Systems Handbook prescribe policies and procedures on security for IT resources. Offerors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering Offerors specifically for all Task Order(s) that require access to DHS facilities, IT resources or sensitive information. Offerors shall not use or redistribute any DHS information processed, stored, or transmitted by the Offeror except as specified in the task order.

Interconnection Security Agreements

Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements.

Security Policy References

The following primary DHS/ICE IT Security documents are applicable to Offeror/SubOfferor operations supporting Sensitive But Unclassified (SBU) based contracts. Additionally, ICE and its Offerors must conform to other DHS Management Directives (MD) (Note: these additional MD documents appear on DHS-Online in the Management Directives Section. Volume 11000 “Security and Volume 4000 “IT Systems” are of particular importance in the support of computer security practices). All services, hardware, and software provided under this task order must be compliant with DHS Information Security Policy, identified in MD4300.1, Information Technology Systems Security Program and 4300A Sensitive Systems Handbook.

DHS 4300A, Sensitive Systems Policy Directive

DHS 4300A, IT Security Sensitive Systems Handbook

ICE Directive, IT Security Policy for SBU Systems

DHS Information Technology Systems Security Policy, MD4300.1

CLASSIFIED CONTRACTS

REQUIRED SECURITY CLAUSE

SECURITY REQUIREMENTS

GENERAL

The Department of Homeland Security (DHS) has determined that performance of the task as described in requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor) access classified National Security Information (herein known as classified information). Classified information is Government information which requires protection in accordance with Executive Order 13526, Classified National Security Information, and supplementing directives.

52.204-2 Security Clause Requirements.

This clause applies to the extent that this contract involves access to information classified _______________. “ Instructions -Only write the highest level the contractor will be performing, include other security access levels i.e.: SCI, SAP, COMSEC, NATO, RD, FRD, CNWDI…” The Contractor shall comply with—

(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M); and

(2) Any revisions to that manual, notice of which has been furnished to the Contractor.

(a) If, subsequent to the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract.

(b) The Contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

The Contractor will abide by the requirements set forth in the DD Form 254, Contract Security Classification Specification, included in the contract, and the National Industrial Security Program Operating Manual (NISPOM) for the protection of classified information at its cleared facility, if applicable, as directed by the Defense Security Service. If the Contractor has access to classified information at a DHS or other Government Facility, it will abide by the requirements set by the agency.

SUITABILITY DETERMINATION

DHS shall have and exercise full control over granting, denying, withholding or terminating unescorted government facility and/or sensitive Government information access for Contractor employees, based upon the results of a background investigation. DHS may, as it deems appropriate, authorize and make a favorable entry on duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment suitability authorization will follow as a result thereof. The granting of a favorable EOD decision or a full employment suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the contract. No employee of the Contractor shall be allowed to EOD and/or access sensitive information or systems without a favorable EOD decision or suitability determination by the Office of Professional Responsibility, Personnel Security Unit (OPR-PSU). No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable EOD decision or suitability determination by the OPR-PSU. Contract employees assigned to the contract not needing access to sensitive DHS information or recurring access to DHS ’ facilities will not be subject to security suitability screening.

BACKGROUND INVESTIGATIONS

Contract employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive information, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. Background investigations will be processed through the OPR-PSU. Prospective Contractor employees with adequate security clearances issued by the Defense Industrial Security Clearance Office (DISCO) may not be required to submit complete security packages, as the clearance issued by DISCO may be accepted. Prospective Contractor employees without adequate security clearances issued by DISCO shall submit the following completed forms to the OPR-PSU through the COTR, no less than 35 days before the starting date of the contract or 35 days prior to the expected entry on duty of any employees, whether a replacement, addition, subcontractor employee, or vendor:

1. Standard Form 86, “Questionnaire for National Security Positions” Form will be submitted via e-Qip (electronic forms submission).

2. FD Form 258, “Fingerprint Card” (2 copies)

3. Foreign National Relatives or Associates Statement

4. DHS 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

5. Optional Form 306 Declaration for Federal Employment (applies to contractors as well)

6. Authorization for Release of Medical Information If the contract authorizes positions which do not require access to classified information:

In those instances where a Prospective Contractor employee will not require access to classified information, areas or classified systems the Vendor will add to and the COTR will insure the following statement is added to the eQip Worksheet prior to submitting it to OPR PSU: “Employee will not require NSI Access to Classified Information or Classified Systems at any level”.

Required forms will be provided by DHS at the time of award of the contract. Only complete packages will be accepted by the OPR-PSU. Specific instructions on submission of packages will be provided upon award of the contract.

Be advised that unless an applicant requiring access to sensitive information has resided in the US for three of the past five years, the Government may not be able to complete a satisfactory background investigation. In such cases, DHS retains the right to deem an applicant as ineligible due to insufficient background information.

The use of Non-U.S. citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of this contract for any position that involves access to, development of, or maintenance to any DHS IT system.

CONTINUED ELIGIBILITY

If a prospective employee is found to be ineligible for access to Government facilities or information, the COTR will advise the Contractor that the employee shall not continue to work or to be assigned to work under the contract.

The OPR-PSU may require drug screening for probable cause at any time and/ or when the contractor independently identifies, circumstances where probable cause exists.

The OPR-PSU may require reinvestigations when derogatory information is received and/or every 5 years.

DHS reserves the right and prerogative to deny and/ or restrict the facility and information access of any Contractor employee whose actions are in conflict with the standards of conduct, 5 CFR 2635 and 5 CFR 3801, or whom DHS determines to present a risk of compromising sensitive Government information to which he or she would have access under this contract.

The Contractor will report any adverse information coming to their attention concerning contract employees under the contract to the OPR-PSU through the COTR. Reports based on rumor or innuendo should not be made. The subsequent termination of employment of an employee does not obviate the requirement to submit this report. The report shall include the employees’ name and social security number, along with the adverse information being reported.

The OPR-PSU must be notified of all terminations/ resignations within five days of occurrence. The Contractor will return any expired DHS issued identification cards and building passes, or those of terminated employees to the COTR. If an identification card or building pass is not available to be returned, a report must be submitted to the COTR, referencing the pass or card number, name of individual to whom issued, the last known location and disposition of the pass or card. The COTR will return the identification cards and building passes to the responsible ID Unit.

EMPLOYMENT ELIGIBILITY

The contractor will agree that each employee working on this contract will successfully pass the DHS Employment Eligibility Verification (E-Verify) program operated by USCIS to establish work authorization.

The Contractor must agree that each employee working on this contract will have a Social Security Card issued and approved by the Social Security Administration. The Contractor shall be responsible to the Government for acts and omissions of his own employees and for any Subcontractor(s) and their employees.

Subject to existing law, regulations and/ or other provisions of this contract, illegal or undocumented aliens will not be employed by the Contractor, or with this contract. The Contractor will ensure that this provision is expressly incorporated into any and all Subcontracts or subordinate agreements issued in support of this contract.

SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with the OPR-PSU through the COTR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COTR and the OPR-PSU shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COTR determine that the Contractor is not complying with the security requirements of this contract; the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

The following computer security requirements apply to both Department of Homeland Security (DHS) operations and to the former Immigration and Naturalization Service operations (FINS). These entities are hereafter referred to as the Department.

INFORMATION TECHNOLOGY SECURITY CLEARANCE

When sensitive government information is processed on Department telecommunications and automated information systems, the Contractor agrees to provide for the administrative control of sensitive data being processed and to adhere to the procedures governing such data as outlined in DHS MD 140-01 - Information Technology Systems Security and DHS MD 4300 Sensitive Systems Policy. Contractor personnel must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractors who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

All contractor employees using Department automated systems or processing Department sensitive data will be required to receive Security Awareness Training. This training will be provided by the appropriate component agency of DHS.

Contractors who are involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the Department, shall receive periodic training at least annually in security awareness and accepted security practices and systems rules of behavior. Department contractors, with significant security responsibilities, shall receive specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Department information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer (ISSO).

INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

All contractor employees using Department automated systems or processing Department sensitive data will be required to receive Security Awareness Training. This training will be provided by the appropriate component agency of DHS.

Contractors who are involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the Department, shall receive periodic training at least annually in security awareness and accepted security practices and systems rules of behavior. Department contractors, with significant security responsibilities, shall receive specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Department information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer (ISSO).

Use of Government Equipment

Offerors are not authorized to use government office equipment of IT systems/computers for personal use under any circumstances, unless limited personal use is specifically permitted by the contract. When so authorized, Offerors shall be governed by the limited personal use policies in the referenced documents.

(a) Sensitive Information, as used in this Section, means any information, the loss, misuse, disclosure, or unauthorized access to or modification of which could adversely affect the national or homeland security interest, or the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal

Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

(b) “Information Technology Resources” include, but are not limited to, computer equipment, networking equipment, telecommunications equipment, cabling, network drives, computer drives, network software, computer software, software programs, intranet sites, and internet sites.

(c) Offeror employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability.