SOW OB 07-2010 Mail Ops

Department of Homeland Security (DHS) Federal Emergency Management Agency (FEMA)

SCOPE OF WORK

Outbound Mail Operations Support

July 2010

PROCUREMENT SENSITIVE INFORMATION:

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

Background The Federal Emergency Management Agency (FEMA), a component of the U.S. Department of Homeland Security, is authorized pursuant to the Robert T. Stafford Disaster Relief and Emergency Assistance Act , as amended (42 U.S.C. Chapter 68), to assist individuals and households following Presidentially-declared disasters and emergencies. In cooperation with state governments, FEMA provides grant assistance to disaster victims in accordance with the Act. These programs receive extensive visibility from the highest levels of federal, state, and local governments and are continually reported on in the public media.

Disaster declarations and resulting assistance applications create a need to process large quantities of outbound applicant correspondence in a short timeframe. Privacy, accuracy, and timely delivery of services are required to ensure the needs of the disaster applicant are met through the most expedient means possible.

FEMA has determined the most efficient way to manage an outbound mail operation is through contractor support.

Purpose This contract supports FEMA’s Individuals and Households Program (IHP) by providing readiness and surge resources for disaster applicants’ correspondence. The contractor shall establish mail operations with an adequate infrastructure and qualified, trained staff. The contractor shall be ready at the time of a disaster to begin processing outbound correspondence to applicants from designated geographical area(s) covered by each Presidential Declaration for Individual Assistance (IA).

The processing of outbound mail includes selecting and printing documents, inserting correspondence into envelopes, sealing envelopes, applying postage, pre-sorting outbound correspondence for optimal savings to the government, and inserting into the mail stream

The contractor must maintain a readiness level, infrastructure, equipment, and system capabilities adequate to meet the performance requirements specified in this Statement of Work (SOW).

Scope Outbound mail operations include printing, inserting, applying postage, and pre-sorting outbound correspondence addressed to disaster victims. Mailings will include correspondence to applicants containing sensitive personal information (#10 and #11 envelopes) and flat envelopes (9X12) containing both sensitive personally identifiable information (PII) and public information in the form of the Applicant Guide.

The contractor shall provide all management, personnel, services, supplies, equipment (except for Government Furnished Equipment described below), and facilities necessary to operate an outbound mail processing operation in accordance with the requirements of this SOW.

The contractor shall be responsible for meeting Service Levels as identified in this SOW. Based on disaster activity, volume will vary greatly. Holidays and weekends are considered regular calendar production days to ensure that Service Levels are met.

The contractor shall reference historical scenarios included in the solicitation for reference prior to bidding. The contractor shall address all three (3) scenarios in their proposal to demonstrate technical approach and understanding of the work to be performed.

The contractor shall perform phase-in activities that ensure their ability to assume full performance on or before the end of the phase-in period. The phase-in shall include actions to minimize disruption and start-up requirements. The phase-in actions shall include recruiting, hiring, training, security requirements, and any other special considerations.

The contractor is required to be fully operational, including facilities, equipment, information technology, training, personnel and requisite supplies within 90 calendar days from date of contract award. All contractor facilities and employees dedicated to FEMA contract obligations must be located within the continental United States (CONUS).

Type of Contract The award will be an indefinite-delivery indefinite-quantity contract with task orders issued on a firm-fixed price or cost reimbursable basis.

Period of Performance The period of performance for this contract will be a base period of one year, consisting of a three-month transition period (90 calendar days), and a nine-month full operations period, with four consecutive one-year options, exercised at FEMA’s discretion.

Contractor Requirements The contractor shall:

· Process outbound mail through a Multi-line Optical Character Reader (MLOCR) sorter with a Coding Accuracy Support System (CASS) and a Multi-Line Accuracy Support System (MASS) certification cycle that evaluates the ability of MLOCRs and encoding stations to process address information and applies an accurate delivery point barcode (DPBC) to the piece of mail.

· Maintain a capability to process a minimum monthly volume of 1,000,000 images of outbound mail. Increase production to accommodate a monthly surge volume up to 13,800,000 images of outbound mail.

· Provide plain white stock paper (8.5 x 11, 20lb weight), postage meter ink and all necessary items to print.

· Accommodate site storage of all materials and equipment required to accomplish the requirements and performance objectives of this SOW.

· Have the capability to process and track outbound accountable mail, as identified by the COTR.

· Ensure queue date identified on work in NEMIS Mail Utility queue is less than 48 hours of age unless otherwise approved or directed by the COTR.

· Print documents in compliance with industry standard for contrast and readability.

· Print documents in duplex format (two-sided) to reduce paper consumption.

· Prioritize and select correspondence to be printed and route to printer. Note: During periods of increased activity the COTR may establish the outbound mail assignment.

· Print all documents included on FEMA transmitted files, to include foreign language documents, unless otherwise directed by the COTR.

· Insert printed letters into appropriate size envelopes using an automated inserter process. Any manual insert of printed letters must be approved by the COTR in advance.

· Add Applicant Guide to accompany all 9069 letters (9x12) and other documents as directed by the COTR.

· Pre-sort mail for optimal postage savings.

· Apply correct postage to outbound mail based on letter weight.

· Coordinate mail pickup or drop-off with USPS, UPS, DHL, FedEx, or other commercially viable sources, as required.

· Monitor print jobs, ensuring all pages are printed and formatting is correct.

· Monitor mail inserter, ensuring envelopes contain information for only one applicant and proper inserts have been included, when applicable.

· Maintain a log of inventory received and used.

· Store no less than 1,500,000 government-provided envelopes (#10 and/or #11); 500,000 government-provided Applicant Guides (English and Spanish - 500,000 of each); and 500,000 9x12 flat envelopes to support production requirements and to ensure readiness.

· Provide production reports as outlined in Section 9 of this SOW.

· Maintain hours of operation sufficient for accomplishing all requirements and objectives of this SOW.

· Within 30 minutes of identification, disruption/problems affecting the contractor’s ability to meet performance standards and any security issues including privacy breaches shall be reported by the contractor to the COTR.

· The contractor shall provide a Continuity of Operations Plan (COOP) within 30 calendar days of award. This plan shall include procedures to ensure that operational support is available, without interruption, to support 50 percent of all capacity requirements. The plan shall also address the actions and timeframe required to regain 100 percent of the capacity requirements of the SOW. Finally, the plan shall include a complete description of the alternative mail operations site and, 1) a detailed breakdown of costs to maintain and operate the COOP site and, 2) a detailed breakdown of costs unexpended at the closed original facility. The COOP Plan must be approved by the COTR.

Test Printing, High Priority Printing, Special Printing

· Test printing – The contractor shall test print a limited number of documents (letters) prior to full production to check for margin, spacing and other potential formatting problems, e.g. newly created letters, revised letters, etc. FEMA will provide the contractor with the specific test letter: disaster number, program and letter code, and registration identification number(s) to be printed. The contractor shall print (and insert if requested), the documents and advise FEMA in writing of the results (and provide a scanned copy if requested). FEMA will require testing to be completed and a response provided within a specific time period depending on the urgency and/or circumstances. Response time frames are 2hr, 4hr, 24hr, and 48hrs. The contractor shall not mail any test letters. Upon notice from FEMA, the contractor shall shred all test letters. Response time frame begins when FEMA notifies the contractor in writing that letters are in the queue and ready for testing. Response time frame ends when the contractor notifies FEMA (COTR) in writing, of the results.

· High Priority Mailings – The contractor shall, from time to time, at the request of FEMA provide for high priority mailings. High priority mailing requires the contractor to accelerate the service level for printing, inserting and metering documents, as well as placing documents into the United States Postal Service (USPS) system. FEMA will advise the contractor in writing, no less than one day (24 hrs) prior to the need, with the estimated number of letters and the expected timeframe that they will be added to the queue for processing. The contractor shall ensure that the documents are placed in the mail system (includes printing, inserting, applying postage and releasing into USPS system) on the specified date or within 24hrs from notice that the letters are in queue. The contractor shall advise FEMA by written notice when the process is complete. The contractor must achieve required service levels for non priority mailings at all times, including periods in which high priority mail is being processed.

· Special Print Jobs - Periodically FEMA must ensure that certain letters are printed on a specific day and are subsequently released into the mail stream on a specific day. The Contractor shall coordinate printing and mailing according to the COTR directions. These letters may or may not be considered high priority printing projects as defined within this SOW. The volume of these letters can vary. COTR will provide the contractor with the specific print and mail date requirements.

Additionally the COTR may direct the Contractor to delay printing some letters until authorized. At the time of authorization from the COTR, the contractor shall include these letters in the regular daily printing.

Response time frames for test, high priority and special print jobs begin when FEMA notifies the Contractor in writing that letters are in the queue and ready for printing. Response time frame ends when Contractor notifies FEMA in writing, of the test results or delivery of print job into the USPS mail system.

All contractor facilities and employees dedicated to the services under this Statement of Work (SOW) must be located within the continental United States (CONUS).

Performance Standards The contractor shall perform all requirements outlined in this SOW and achieve the performance standards for each function of the operation as described below:

Timeliness

· All work waiting to be printed is less than 48 hours of age unless otherwise approved or directed by the COTR.

· Printed documents are correctly inserted, postage applied and placed in USPS system within 72 hours of NEMIS Mail Utility queue date.

· Any service level may be temporarily extended by up to 48 hours with prior written approval from the COTR.

Quality

· The security of personally identifiable information is of the utmost importance to FEMA. Thus information contained in each envelope must pertain to only one addressee 100 percent of the time.

· Printed documents comply with industry standards for contrast and readability 99.9 percent of the time.

· Appropriate inserts are included in the envelope 99 percent of the time.

· All outbound mail has correct postage, and mechanically and manually processed mail items comply with USPS weight, size, and rate standards 99 percent of the time.

· Record and page counts on the FEMA transmitted file balance with the print item and page counts from the vendor batch report 98 percent of the time.

Contract Requirements Contractor Resources The contractor is required to furnish all facilities, equipment, personnel, supplies, computers (except for GFE), communications, and other resources to achieve the comprehensive mail operations requirements of this SOW.

Staffing

· The contractor shall perform all recruiting, screening, hiring, and monitoring of staff under this contract.

· The contractor shall provide supervisory/management personnel and quality assurance personnel required for effective management of the work.

· The contractor shall train employees on processes, procedures, and performance standards identified in this SOW and any attachments hereto.

· The contractor shall ensure personnel have met HSPD- 12 and NIST Pub 201 requirements prior to the employees having any access to a DHS information system or FEMA applicant information. See Attachment B for details

· The contractor shall comply with applicable Department of Labor (DOL) wage determinations and provide the FEMA CO with access to payroll records for required monitoring.

· The contractor shall maintain an updated listing of all contractor personnel working under this contract and provide a copy to the COTR upon staffing changes. This listing must be provided to the COTR and must include personnel information, including but not limited to the following: the person’s full legal name, Social Security number, home address, contact phone, date of hire, date(s) of training completion, dates and results of security clearance(s). Reports should identify any personnel separated and reason for separation.

· No later than two weeks prior to start of performance, the contractor shall provide to the COTR a listing of all personnel who will require logistical access to FEMA's IT network for performance of work under this contract.

· All contractor supervisors, managers, quality assurance personnel must speak, read, and write English fluently.

· The contractor shall ensure that the personnel assigned to this contract have the ability to use the Government’s computerized database using a standard Microsoft Windows PC capable of performing functions such as opening and closing a mail utility, selecting records from the utility and navigating with a mouse and/or keyboard.

Contractor IT Personnel:

· The contractor shall identify an on-site information technology (IT) system security officer responsible for ensuring client privacy and confidentiality.

· The contractor shall identify two (minimum) contractor provided personnel as points of contact for FEMA IT. These personnel will be responsible for working with FEMA IT personnel to resolve technical issues causing service disruptions.

Quality Control

· Within 30 calendar days of award, the contractor shall submit two copies of the updated Quality Control Plan (QCP) to the COTR (draft plan to be submitted with proposal). The QCP shall outline the contractor’s plan to ensure achievement of the performance standards of the SOW, as provided in Section 7 of this SOW. The QCP shall address identifying and correcting deficiencies, scheduled delivery of services, technical performance, and staff training. The COTR will review and accept the QCP or return it for revision or implementation.

· The contractor shall implement and maintain the COTR approved QCP.

· The contractor shall establish and maintain an inspection system that ensures compliance with the contractor’s QCP and maintain a local file of all QCP inspections. This file shall be available to the COTR or designee at all times during the life of the contract.

· Subsequent to award, any revisions to the QCP shall be submitted to the COTR for review and approval.

Hardware, Software, Supplies and Data Services The contractor shall:

· Provide and maintain all necessary facilities, equipment, supplies and services to support all processes for outbound applicant correspondence services and any other requirements under this SOW (exception, FEMA provided GFE).

· Provide and maintain printers compatible with FEMA’s current print format (Post Script/mail utility software), including duplex printing on plain white stock paper.

· Provide and maintain insert stations that handle standard #10/11 envelopes and 9X12 flat envelopes. Inserters must have the ability to read two of five barcodes and optical mark recognition (OMR) scan marks.

· Provide workstation access for on-site FEMA representatives with the ability to access the NEMIS Mail Management software during site visits. The contractor shall estimate that FEMA representatives will make a minimum of 4 visits per year. The contractor shall provide workspace and telephones at the contractor provided site. Provide access to facsimile machines with send-and-receive capability, equipment to perform copying and printing, access to shipping and receiving, and standard office supplies for government personnel to assist in the administration of the contract.

Contractor IT:

Provide a dedicated data connection exclusively for the purposes of achieving the requirements of this SOW, with a 5MB minimum with 20MB burst capability, 100MB recommended connection. The printing functions require sufficient memory and bandwidth. The contractor shall submit proposed Cisco VPN concentrator specifications to FEMA’s IT cyber security for approval.

· Provide FEMA network account requests in a CSV (comma-separated values) or XLS (Microsoft Excel spreadsheet) file with the following information in the specified column order: legal last name, legal first name, Social Security number (SSN), facility location, and security clearance. All fields must be provided before an account will be created. Account creation requests should be submitted to COTR or designated representative.

· Provide operations support to maintain equipment and software on the contractor-owned and/or contractor-leased systems.

8.5 Compliance with Laws, Regulations and Manuals

The contractor shall be responsible for having a good working knowledge and technical understanding of the following laws, regulations and manuals pertaining to Official Mail and the DHS/FEMA Mail Management Program. Knowledge of laws, regulations and mail management procedures are necessary to operate a professional Mail Center for FEMA. Contractor personnel shall be trained in mail regulations and general mail management information.

· Title 39, U.S.C., Sections 3202-3209

· Title 18, U.S.C., Section 1719, "Franking Privilege"

· Title 41 Code of Federal Regulations (CFR), Chapter 102, Part 102-192

· Title 39 CFR, United States Postal Service, Chapter I, Sub-chapter E - Restrictions on Private Carriage of Letters, Part 310 and 320

· GSA Bulletin, FPMR B-65, Archives and Records, "Mail Preparation and Economy"

· USPS Domestic Mail Manual

· USPS International Mail Manual

· Annual USPS letter, "Payment of Official Mail"

· DHS MD 4300A

Upon request, the contractor shall provide to the COTR copies of mail management manuals and Standard Operating Procedures (SOP) demonstrating contractor adherence and understanding of the above guidance in performing the requirements and functions of this SOW.

The contractor shall maintain a clean and safe working environment in full compliance with applicable Occupational Safety and Health Administration (OSHA) standards.

Reporting Requirements

9.1 Daily Reporting

The reporting period is Sunday through Saturday. All contractor provided reports are due daily to the COTR by 9:00 a.m. ET Monday - Saturday unless otherwise approved in writing by the COTR. Reporting content is as follows:

· Number of Reprints by letter type Daily Cumulative

· Number of images printed for each document type Daily Cumulative

· Number of items (letters) printed by document type Daily Cumulative

· Number of images inserted and placed into USPS mail system by document type Daily Cumulative

· Number of documents inserted and placed into USPS mail system by document type Daily Cumulative

· Number of images printed but not mailed by document type Daily Cumulative Date of oldest document to be mailed

· Number of documents printed but not mailed by document type Daily Cumulative Date of oldest document to be mailed

· Number of documents mailed with requirement for accountable mail Daily Cumulative

· Quality control variances and issues occurring during reporting period Compliance with industry standard for contrast and readability for printed materials Appropriate inserts included and information contained in the envelope is for only one applicant

9.2 Weekly Reporting

Weekly reports are due to the COTR by 9:00 a.m. ET Monday unless otherwise approved in writing by the COTR. Reporting content is as follows:

· Inventory of Government Furnished Supplies Balance of supplies on hand (i.e. envelopes 9X12 or #10 & #11, Applicant Guide- English, Applicant Guide- Spanish) Supplies used (provide breakdown by item) Supplies received (provide breakdown by item)

· Postage costs applied Weekly Cumulative for the month

9.3 Monthly Reporting

The reporting period is the entire calendar month. Contractor monthly reports are due to the COTR on the 1st day of the following month by noon ET, unless otherwise approved in writing by the COTR. Report content is as follows:

· Postage costs

· Production Report Include all categories required in the daily reports

9.4 Ad Hoc Reporting

The contractor shall provide ad hoc reports (not more than 10 per month) at the request of the COTR to track contractor and program performance.

*NEMIS dates are reflected in Greenwich Mean Time. Contractor must ensure that all service levels and production reports reconcile to GMT.

FEMA’S Responsibilities FEMA’s designated COTR will establish weekly meetings or conference calls with the contractor and/or its representatives to monitor performance and ensure specific work requirements are accomplished.

FEMA will perform periodic on-site quality/quantity checks with no prior notice to the contractor. These site visits will consist of personnel, physical and cyber security site surveys to ensure that the contractor is adhering to DHS/FEMA security requirements for handling and protecting sensitive information as well as programmatic service and quality reviews.

FEMA will monitor contractor operations to ensure physical access to FEMA servers and applicant information are restricted to authorized contractor personnel only.

FEMA will provide remote and onsite IT support, as required.

FEMA will provide a maximum of two subject matter experts to train contractor’s staff on use of FEMA’s software for a period of up to three days. After this, the contractor shall be responsible for training mail center staff at its own expense.

Government-Furnished Supplies and Equipment FEMA will provide IT security awareness training to the contractor.

FEMA will furnish the following equipment, systems, and provisions:

1. Computers for connectivity to FEMA networks until which time contractor proposed and supplied hardware is approved by FEMA’s IT cyber security, Certification and Accreditation.

1. Data connections to the FEMA Network - - through the use of FEMA approved VPN client installed on GFE.

· Postage metering equipment compatible with contractor’s operating equipment will be provided after award. This equipment will be governed by the Government Property clause of the contract.

· Postage on outbound mail. FEMA will monitor and prepay postage for the metering equipment. FEMA will rely on the contractor’s reports (SOW Section 9) to determine when postage will be prepaid.

· FEMA will provide 9X12 flat envelopes, and #10 and or #11 envelopes for print output with the proper DHS/FEMA branding, however it is the contractor’s responsibility to store and maintain minimum inventory to ensure readiness at all times (SOW Section 6).

· FEMA will provide the printed Applicant Guide-- Help After a Disaster for insertion with specified applicant correspondence, however it is the contractor’s responsibility to store and maintain minimum inventory to ensure readiness at all times (SOW Section 6). http://www.fema.gov/pdf/assistance/process/help_after_disaster_english.pdf

Any equipment provided for FEMA’s contract will be used exclusively by the contractor at the location(s) proposed for contract performance.

Definitions Ad Hoc Reports - are defined as those reports required when the situation makes it necessary or desirable, rather than being arranged in advance or being part of a general plan. Ad hoc does not mean correcting / clarifying data presented in routine reports.

Applicant Guide – Help After a Disaster: Applicant’s Guide to the Individuals and Households Program: A program guide providing information on FEMA’s Individual and Households Program. A copy of this guide is sent to all individuals who register for disaster assistance.

COOP- Contingency of Operations Plan: A plan involving suitable backups, immediate actions and longer term measures for resuming production and responding to emergencies such as attacks, accidents, widespread employee illness in the work place or natural disasters. Contingency plans are part of business resumption planning.

IHP – Individuals and Households Program: Program through which FEMA provides disaster assistance to individuals and households affected by a federally declared disaster. FEMA, under the authority of section 408 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. §5174, and Title 44 of the Code Federal Regulations, may provide financial assistance and, if necessary, direct services to eligible individuals and households who, as a direct result of a major disaster, have necessary expenses and serious needs and are unable to meet such expenses or needs through other means.

Image: One printed side of one page of paper.

MLOCR- Multi-Line Optical Character Reader: A type of mail sorting machine that uses Optical Character Recognition (OCR) technology to determine how to route mail through the postal system. Performs address block location, character recognition, address look-up for the destination address; prints an ID Tag on the back of the mail piece; prints a POSTNET barcode on the front of the mail piece based on the address look-up.

NEMIS - National Emergency Management Information System: This FEMA-wide system of hardware, software, telecommunications, and applications provides the technology base for the collection and processing of information filed by individuals applying for federal disaster assistance.

NPSC – National Processing Service Center: FEMA currently has three NPSCs located in Virginia, Maryland and Texas. The NPSC is a centralized office established to consolidate the processing of disaster applications. Each NPSC represents a combination of caller services, casework processing, and administrative functions.

SBA – Small Business Administration: A federal agency that assists homeowners, renters, and businesses with disaster loan assistance.

ATTACHMENTS

A. Mail Process Flow B. Contractor Personnel Security Requirements C. Physical Security Requirements D. Cyber Security Requirements

Attachment A DHS/FEMA Individual Assistance Correspondence National Processing Service

Center Outbound Mail Process Flow FEMA NPSC generates documents to be printed and routes to NEMIS print queue Contractor interfaces with NEMIS mail utility software, selects documents to be printed and initiates print job Printed documents folded and placed into envelope; applicable inserts added; example: pre-printed Applicant Guide Through the use of an MLOCR sorter , envelopes will be sorted for USPS

CASS

& MASS

discounting and postage applied Metrics collected by MLOCR operator for management reporting Pick-up by USPS or drop-off to USPS Legend 1 NEMIS: National Emergency Management Information System – Program used by FEMA to process applications for disaster assistance 2 MLOCR: Multiple Line Optical Character Recognition Sorter Sorts mail by zip-code through the use of optical character recognition for optimal postal savings

3 CASS / MASS: P

rogram run by NCSC (National Customer Support Sender) that tests the accuracy of OCR/address look-up software.

ATTACHMENT B

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

The contractor shall design, implement, and maintain a Security Plan that ensures its adherence to the security requirements of this SOW. The Security Plan must be approved by the Chief of Physical Security, Office of Security prior to implementation. The contractor shall submit this Security Plan to the COTR for approval within 30 days of award.

· In accordance with FAR 52.204-9, HSAR 3-52.204-70 (JUN 2006), HSAR 3052.204-71, and Homeland Security Presidential Directive 12 (HSPD-12), located at http://www.whitehouse.gov/news/releases/2004/08/20040827-8.html), performance of this contract requires contractor personnel to undergo a Federal government background check as stipulated in HSPD-12 and NIST Publication 201, PIV I, located at (http://csrc.nist.gov/publications/fips) before being allowed any access to a DHS information system, mail, and FEMA NEMIS Mail Management software.

· Commencement of Work:

· HSPD-12 security requirements entail successful adjudication of the fingerprint results of any contractor personnel implementing the security plan or assigned to any task outlined in this SOW. Successful adjudication must be received from FEMA before any individual subject to these requirements may commence work on a task under this SOW. A minimum processing time of three weeks should be allowed for return of adjudication decision.

· All individuals working on this contract must have a background investigation by FEMA demonstrating successful adjudication of fingerprint results and subsequent eQIP suitability. Foreign nationals and/or other individuals (without a DHS waiver) cannot have access to the FEMA/DHS Network or data that is inputted or taken off the FEMA/DHS Network. Additionally, all individuals (including individuals not assigned to this contract) in the area where FEMA Personally Identifiable Information (PII), or Disaster Survivor victim information is located, must also have a background investigation by FEMA.

· Additional Physical Security procedures must be proposed by the contractor, approved by FEMA, and be established to prevent any access to the FEMA/DHS Network and/or FEMA PII data by any individuals not assigned to this contract. The contractor will ensure work is performed in a secured, access controlled environment to safeguard FEMA/DHS Network and/or FEMA PII data, and ensure personnel have met HSPD-12 and NIST Pub 201 requirements prior to employees having access to FEMA/DHS Network or FEMA applicant information.

· To fulfill Office of Security HSPD-12 requirements, all personnel working on tasks related to this SOW must also be “identity-proofed” by presenting two forms of approved identification when fingerprints are scanned. The contractor shall verify identity proofing is completed and report to COTR which forms of valid identification were presented by each individual.

· The staff of the contractor may go to FEMA Headquarters or any operating Joint Field Office or National Processing Service Center (NPSC) location to have fingerprints taken electronically for processing by the FEMA Personnel and Information Security Section. Fingerprints may be taken manually by FEMA staff. If these locations are not accessible, FEMA will send staff members a package including a fingerprint card, which can be taken to any trusted agent, such as a local police department, who will take fingerprints and send them to the FEMA Personnel and Information Security Section for processing. In a case where hard copy fingerprint cards are going to be sent in to FEMA Security by the trusted agent, the fingerprints can be taken by the traditional "ink and roll" method or by electronic means. The FEMA Personnel and Information Security Section will not accept a completed hard copy fingerprint card directly from an individual staff member.

· The contractor shall create a list of names of individuals who will complete tasks under this contract. A hardcopy list, 2 CDs containing the listing and 2 completed fingerprint cards for each employee shall be provided to the COTR.

· FEMA shall notify contractor of adjudication results (either suitable or unsuitable) for contract performance.

· Background Investigation Requirements:

· The contractor shall perform all recruiting, screening, hiring and monitoring of staff suitability determinations except as noted herein. The contractor shall ensure confidentiality and security of data.

· The contractor shall be able to provide fingerprints in sufficient numbers to maintain staffing levels needed to comply with all requirements.

· Submission Requirements:

For each individual to whom these requirements are applicable (e.g. individuals adjudicated as suitable for task performance), the contractor shall return to the COTR the following fully completed forms:

· Fingerprint card (FD-258) (completed above)

· United States of America authorization to Obtain Consumer (Credit) Report

· Non-Disclosure Agreement Statement (DHS Form 11000-6)

· Standard Form Questionnaire for Public Trust Positions (SF 85P)

· FEMA will initially supply contractor with blank forms to meet the requirements above.

· The contractor shall provide COTR any information required for, but not limited to, criminal records checks, financial records check, as well as employment history, resident history, and nationality background necessary for the FEMA Personnel Security and Information Section to complete a suitability determination.

· All contractor management, support, and clerical personnel assigned to the transition team must submit requirements for DHS/FEMA security background clearance within 14 calendar days of award.

· Employees and visitors of contractor shall not have access to applicant data or conduct FEMA work until they have received a favorably adjudicated FBI fingerprint check from the FEMA Personnel and Information Security Section.

· Contractor personnel are prohibited from using another employee’s FEMA Network login at any time.

· The contractor shall provide FEMA with information on all contractor -provided personnel, including but not limited to: full legal name, Social Security number, home address, contact phone, date of hire, dates and results of security background checks, date(s) of training completion, date of separation, and reason for separation.

· The contractor shall immediately notify the FEMA COTR in writing of any suspected fraudulent activity or wrongdoing on the part of its employee immediately. The contractor shall expediently remove any employee from the contractor’s premises when acts of wrongdoing or security breaches are suspected.

· The contractor shall ensure confidentiality of client data by providing a secure facility with controlled access to safeguard personal information.

· The contractor shall ensure that all data transfers over the data connection to the FEMA wide area network are protected from compromise at all times.

· The contractor shall store mail documents in a locked facility (except for those being processed) and shall notify the COTR, or designee, within 2 hours if any mail is lost or stolen. No mail or package shall be left unattended at any time.

· The contractor shall not use FEMA or DHS names or symbols in public advertisements. Under no circumstances shall the contractor, or anyone acting on behalf of the contractor, publicly refer to the supplies, services, or equipment furnished under this contract in any publicity and/or news release or commercial advertising without the explicit written consent from the COTR.

· The contractor shall develop, implement, and maintain a facilities occupational plan for use by employees on contractor provided facilities.

· The contractor shall notify the COTR or his or her designee within 30 minutes, in the event of an emergency or unusual occurrence affecting the security interests of FEMA, and follow the requirements in the occupant emergency plan (including any HazMat procedures) for that facility.

· All contractor staff that will have access to the government network shall complete an on-line security awareness briefing.

ATTACHMENT C

PHYSICAL SECURITY REQUIREMENTS

1. DOORS AND DOOR LOCKS: Doors are of 45 mm (1-3/4 in.) hardwood or hollow steel construction. Dutch or half doors are unacceptable. Removable hinge pins on door exteriors must be retained with set pins or spot welded, preventing their removal. All doors must be fitted with two lock sets. Doors with glass panes must have one lock set, key operated from the interior of the protected area. If a door is not set in a steel frame, one of the two locks must be a jimmy proof rim dead lock. Doors set in steel frames must be fitted with a mortise lock with a deadlock pin feature. One lock (the day lock) must be automatically locking on door closure; requiring reentry to the room with key or lock combination and allowing egress from the room by use of an inside thumb latch. The day lock on the main door must be automatically locking, with a minimum 19 mm (3/4 in.) dead bolt and inside thumb latch. Combinations or keys to day locks will be restricted to authorized personnel and combinations changed immediately on the termination or reassignment of an employee. Medeco ™ high security locking device or equal is recommended.

2. OTHER ROOM ACCESS MEANS: Interstitial overhead areas which enable entry into a secure room from an unsecured room must be barricaded by the installation of a suitable partition in the interstitial space which prevents "up and over" access. Ventilation grills on doors and air circulation ducts which exceed 0.06 m2 (100 sq. in.) in areas must be reinforced to prevent their removal from outside the room. Other possible access means such as dumbwaiter shafts, roof, or wall ventilator housings, trapdoors, etc., must be secured by appropriate means.

3. MOTION INTRUSION DETECTORS: An intrusion detection alarm system which detects entry into the room and which broadcasts a local alarm of sufficient volume to cause an illegal entrant to abandon a burglary attempt. Intrusion detectors must have the following essential features.

b. A remote, key operated activation/deactivation switch installed outside the room and adjacent to the room entrance door frame and/or a central alarm.

c. An automatic reset capability following intrusion detection.

d. A local alarm level of 80 dB (min) to 90 dB (max) within the configuration of the protected area.

e. An integral capability for the attachment of wiring for remote alarm and intrusion indicator equipment (visual or audio). See installation notes below.

g. Installation Notes:

· In addition to the locally sounding alarm, remote visual and/or audio annunciators must be designed to assure 24 hour monitoring. These annunciators will have the capability of identifying individually protected zones.

· In protected leased space, intrusion detector alarms will be remote to a commercial security alarm monitoring firm, a local police department, or a security office charged with building security and reported to the 24 hour monitoring station. The remote alarms will be in addition to locally broadcast alarms in the protected areas.

b. Vault specifications are as follows:

(1) Type I Vault. Enclosure constructed of steel security screen, woven mesh, 1.2 mm (0.04 in.) wire diameter alloy #304 stainless steel, with tensile strength of 29 kg/mm (1,600 pounds per lineal inch). Mesh 10 x 10 per 25 mm (inch) with main frame and sub frames of 2.4 mm (13 gauge) alloy #304 steel. In rooms with dropped ceilings, the vertical frames and mesh walls must meet the actual ceiling or a security mesh ceiling installed below the false ceiling. In lieu of security mesh screening enclosures, type I vaults may be constructed of 2.4 mm (13 gauge) steel wall partition material with corner brackets welded and floor/ceiling anchors firmly set to prevent disassembly. Mesh vaults may be enclosed with drywall or paneling with appropriate ventilation openings.

(2) Type II Vault. Constructed of walls, floors, and ceilings of minimum of 200 mm (8 in.) reinforced concrete or other substantial masonry, reinforced vertically and horizontally with 13 mm (1/2 in.) steel rods tied 150 mm (6 in.) on center or other wall systems with equivalent or better performance criteria for forced entry and ballistics. Doors and day gates must meet GSA class 5 criteria. Vault ventilation and utility ports may not exceed 0.06 m2 (100 sq. in.) in area.

5. CLOSED CIRCUIT TV: Security Surveillance TV camera with motion detector feature on cameras and at monitor location.

6. SPECIAL KEY CONTROL: Room door lock keys and day lock combinations, where applicable, are Special Keys, and are not mastered.

7. ELECTRONIC ACCESS CONTROL SECURITY SYSTEM: For monitoring and controlling access to areas, the following specifications are among those to be considered for inclusion. Proximity card reader’s upgradeable to smart card technology is recommended:

a. Access Safeguard. To prevent learning codes through keypad observations or use of stolen or found access cards.

b. Time Sensitive. The ability to program access by user, shift, and day.

c. Area Sensitive. The ability to program access by door and area for each individual user.

d. Fail-Safe. The ability to maintain access security if the system goes down (i.e. bypass key).

e. Access Record/Audit Trail. The ability to provide for periodic or on demand print-out of names and time/dates of individual accessing.

f. User Coverage. The number of individual access codes that the system will accommodate.

8. GUARD SERVICES:

a. Determining the Need.

(1) Introduction. A guard force is an effective and useful component of a facility’s physical security program. The effectiveness of alarm devices, physical barriers, and intrusion detectors depends ultimately on a response by a skilled guard force. Guard services can be provided by a private company under contract.

(2) Criteria for Determining Need. Evaluating a facility for security guard requirements to include a security guard patrol is desirable for security Level II facilities, may be a standard based on a Building Security Committee facility evaluation for security Level III facilities, and is a minimum-security standard for Level IV facilities. The number of guards at any given time will depend on the size of the facility, the hours of operation, and current risk factors. Guard services are recommended under, but are not limited to, the following circumstances.

(a) At security Level III and IV facilities to meet visitor control and screening requirements.

(b) The mission of the facility is particularly critical.

(c) There is a high level of sensitivity of information handled at the facility, e.g., national security information.

(d) An in-house response capability is needed, e.g., the facility contains alarmed vaults or other sensitive operations, and off-site guards or police are not close enough for quick response.

(e) The facility is vulnerable to theft or damage, e.g. a facility location in a high crime area.

(f) Pedestrian or automobile traffic is heavy or congested and requires special controls.

9. ADDITIONAL REQUIREMENTS:

1) High Security Locks: The entrances to the building need to be High Security locks (Medico, Assa, and Alloi or equal, are some of the manufacturers of high security locks) installed. These locks also need to be installed at the server room door and at the telephone/security room door.

2) Alarm System: The alarm system needs to include intrusion alarms (break-in alarms) on the doors to the server room and the telephone/security room. It was recommended that these alarm sensors be "BMS" (equipment that monitors itself for tampering as well as for forced entry).

3) Card Access: The card access system needs to include a card reader at the doors to the server room and telephone/security room (utility area/room). Telephone equipment, security equipment and other utilities are maintained in the utility area/room.

4) Cameras: The camera surveillance needs to cover the interior of the telephone/security room and access to it. Camera coverage should also include any areas where FEMA data is held after printing (Work In Progress holding).

5) FEMA Server Security: In addition to being kept in the server room, the servers that access the FEMA network and hold data on the applicants needs to be secured inside a security cage. The access to this cage needs a biometric (fingerprint is OK) controlled access. A small, server rack sized enclosure is all that is required. The biometric lock can be self contained, or maintained by a server in the secured rack.

6) A secured and controlled access area should be created to hold WIP documents. This includes documents that are printed and awaiting envelope-stuffing.

ATTACHMENT D

Cyber Security Requirements

General

The Contractor must comply with the provisions of Department of Homeland Security (Department) Management Directive (MD) 4300. Performance of this contract may require the Contractor to gain access to sensitive but unclassified (SBU) information. SBU information is for official use only.

All systems are required to have Certification and Accreditation performed prior to receiving an Authority to Operate from FEMA. The requirements for this action must be coordinated with FEMA IT Security Branch.

DHS MD 140-01

1. Directive 140-01 Information Technology Systems Security (Revision 00) posted on https://dhsonline.dhs.gov/portal/jhtml/tracking/viewdoc.jhtml?doid=4662053

1. The current version of DHS MD 140-01 is available upon written request to FEMA-IT-Security-Branch@dhs.gov DHS Sensitive Systems Policy Directive 4300A

1. The current version of DHS Sensitive Systems Policy Directive 4300A is available upon written request to FEMA-IT-Security-Branch@dhs.gov

Security Management

The contractor shall appoint a senior official to act as a Security Officer. The individual shall work collaboratively with the FEMA IT Security Branch through the COTR on all physical and personnel security matters and on protection of all sensitive documents/materials handled by the Contractor.

The COTR and FEMA Security Office will have the right to inspect procedures, methods and facilities utilized by the Contractor to comply with the security requirements under this contract. Should the COTR or FEMA Security Office determine that the Contractor is not in compliance with the security requirements of the contract, the Contracting Officer shall notify the Contractor, in writing, that corrective actions must be taken to rectify any non-compliance with the contract security requirements.

Information Technology Security Clearance

When sensitive government information is processed on Department telecommunications and automated information systems, the Contractor shall provide for the administrative control of sensitive data being processed and adhere to the procedures governing such data as outlined in “DHS IT Security Program Handbook for Sensitive Systems– Publication DHS MD 4300.” Contractor personnel must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractors who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g. Privacy Act).

Information Technology Security Oversight and Training

Contractor IT services and operations must adhere to all DHS and FEMA IT security policies.

Sensitive information is to be handled and protected at the contractor’s site, including any information stored, processed, or transmitted using the contractor’s computer systems, the background investigation and/or clearances required, and the facility security required.

Security deficiencies in any outsourced operation shall require creation of a program-level POA&M.

All personnel who access Department information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behaviors by personnel accessing systems.

Each Major Application or General Support System must have an Information System Security Officer (ISSO) assigned unless excepted, mitigated, or waived by the FEMA CISO.

Any unauthorized access, sharing of…