HSI MAMMOTH SOR 07-24-2024 FINAL.pdf

STATEMENT OF REQUIREMENTS

MAMMOTH E-COMMERCE PLATFORM

July 24, 2024

RYAN DOLAN

CONTRACTING OFFICER

RYAN.DOLAN@ICE.DHS.GOV

314-928-7546

1 Scope

This is a contract to provide for the routine and standard acquisition of clothing, personal protective equipment, and tactical supplies for Homeland Security Investigations (HSI). In conjunction with the Indefinite Delivery Indefinite Quantity (IDIQ) contract for the clothing, equipment, and supplies, the awardee (hereafter referred to as “vendor”) shall provide a secure online ordering platform (hereafter referred to as the “platform”), accessible via the World Wide Web, which allows the end-user to make purchases, track orders, and view order history, among other requirements as described in this document. The platform shall be accessible via web browsers for computers and mobile devices.

Over the life of the contract, there exists the possibility for additional programs and agencies within DHS to place orders off the contract. As a result, the CO will work with the vendor to establish a semi-customized platform experience specific to that group(s). On occasion, the CO may authorize other federal agencies to place orders off the contract on a limited basis.

1.1 Description of Services & Background

HSI has a need to (1) properly outfit (clothing) and provide personal protection equipment and complimentary supplies to maintain a uniform (standard) and professional National Tactical Program (NTP) across HSI, while ensuring the safety and welfare of employees operating in hostile environments and multiple/varying adverse climates across the United States. In addition, (2) an online ordering platform that offers tactical teams across HSI the ability to order items from the approved product matrix is required. The online ordering platform enables teams to process purchase requests in a more efficient manner, as opposed to multiple purchase card and purchase order transactions. As a result, the platform will drastically reduce redundant administrative workload for employees, some of whose positions on the tactical teams are deemed collateral duties to their investigative roles in the organization. The platform will also afford the NTP the ability to track all purchases throughout the year, identify purchasing trends, and provide purchasing data for further decision-making purposes.

2 APPLICABLE DOCUMENTS

-- MAMMOTH Request for Proposal

-- MAMMOTH Product Matrix

3 REQUIREMENTS

In conjunction with the IDIQ Contract for clothing, personal protective equipment and tactical supplies, the vendor shall also provide an online ordering platform for ease of purchasing for end users across HSI throughout the thirty-one (31) Special Agent in Charge (SAC) Offices and other HSI Divisions. The following are the minimum requirements for the e-commerce platform.

3.1 PLATFORM- PLATFORM ARCHITECTURE

URL & Availability

The vendor shall provide HSI with a vanity URL for the internet address of the website/platform. For example, “mammoth.vendorABC.com”, “mammoth-vendor.com”, “hsimammoth.com”. The specific URL will be coordinated by the Contracting Officer (CO) with the vendor upon award of the contract.

The platform shall be accessible twenty-four (24) hours per day, seven (7) days per week. The platform shall be accessible from desktop computer, tablet, mobile devices (tablets & smart phones), and laptop computers. The vendor is allowed periodic platform closures for maintenance & development purposes.

Such closures shall be communicated to the Contracting Officer (CO) and the Contracting Officer Representative (COR) forty-eight (48) hours prior to the closure, unless such closure is necessitated by emergency circumstance, which shall be communicated immediately to the CO and COR.

Platform Front End

The vendor shall provide an e-commerce platform through a modern and responsive web interface. The front end shall be built using technologies such as HTML, Cascading Style Sheets (CSS), and JavaScript.

The interface shall include features such as product browsing, search functionality, user account management, and shopping cart experience.

Platform Back End

The back end of the platform is responsible for processing user purchase request, managing data, and orchestrating various services and reporting functions. These functions must be able to accommodate future increases in scalability with the possibility of including multiple agencies beyond HSI.

Additional core services include user authentication, product catalog management, order processing, and payment handling.

Search Functionality

In order to create a dynamic shopping experience, the platform shall include a search function that supports keyword-based searches with auto-suggestions. Keywords may be based upon manufacturer name, product name, product description (e.g.- “field pants”), and product numbers. There shall be advanced filters to refine search results based upon such factors as price range, product colors, brand name, and availability. The platform shall also incorporate a predictive search algorithm for quick and accurate results. The search functionality of utmost importance for user satisfaction.

Although not a requirement of the contract, should the vendor have the ability to provide search history of platform users, this information is welcomed by the contracting officer to provide product suggestions for future modifications.

Product Category Tabs

The platform will feature intuitive tabs for easy navigation across product categories. These tabs will categorize products logically and prominently display main categories, (e.g.- “Clothing”, “Medical Supplies”, and “Sniper Equipment”). The platform shall allow users to easily switch between categories without leaving the main browsing page. From time to time, the Government may require updates to the Product Category Tabs if the mission requires.

Product Pages

Each product from the product matrix shall have its own dedicated product page with information about the product, including up-to-date product photos. The product matrix is subject to modification based upon product availability, advances in technology, and changing needs of the Government. The product pages of the platform must include the following details for each product:

1. Manufacturer

2. Model

3. Part Number

4. Available Color(s)

5. Availability/Back-order Status

6. Approximate Delivery Lead Time

7. Country of Origin—USA, Trade Agreements Act (TAA) Compliant, Non-TAA Compliant

8. Price

9. Picture(s)

10. Product Specifications

11. Product Description

12. Product Review Submission Area (internal to Government use only).

13. Add to Cart Functionality, to include selection of the quantity, sizing, and color, as appropriate.

Top Selling Items Page

The platform shall include a page dedicated to highlighting top-selling items to attract user attention and to promote uniformity across multiple teams. Occasionally, the Government may suggest to the vendor products that shall be included in the “Top Selling Items Page” to influence the uniformity of the National Tactical Program. The “Top Selling Items Page” will display a curated listed of best-selling products based upon real-time sales data. It may also include dynamic elements such as trending indicators or badges to highlight the popularity of the items.

Fast Shipping Page

The Government often encounters episodes in which faster product delivery times provide greater benefit over cost. As a result, the platform shall include a page of products that have expedited shipping times, expected to be delivered within 30 days or less. The “Fast Shipping Page” shall clearly communicate estimated delivery times and shipping options.

Recent Activity on Home Screen

The platform shall highlight recent browsing history at the home screen once a user logs into the site.

This will assist in providing users with the ability to resume a shopping experience from previous logins.

Kitting

To maximize product uniformity across the National Tactical Program, and to provide the ability for individual teams the ability to “kit” items specifically for those mission sets, the platform shall provide users the ability to create “kits” of specific products. In this capacity, a user will add products to a “kit” and provide it a respective name for ease of access. This kit functionality shall be easily accessed from the main platform page.

Agent Profile Tool

As described in a later section, only one employee (“quartermaster”) within a specific team will have access to the funding provided by the National Tactical Program, and will have the responsibility for ordering products, including clothing, for all members of that respective team. In order to increase efficiency within the ordering process, the platform shall have the ability for this user to create “agent profiles” for each team member whereby the platform stores each member’s clothing and PPE sizes, along with any additional product preferences. This will negate the need for the quartermaster to routinely ask for several employees’ clothing sizes.

Page Load Time

The platform is required to adhere to stringent performance standards to ensure optimal user experience. Page load time is a critical factor in user satisfaction and engagement. Under normal server load conditions, a page on the platform shall take no longer than 5 seconds to load. As a result, the platform should incorporate performance optimization measures.

Shopping Cart

Similar to the online retail store fronts, the platform shall have similar “shopping cart” functionality synonymous with other online shopping experiences. The user shall have the ability to review all items in the cart, to include quantities, prior to submitting an order. The user shall have the ability to select the default shipping address detailed in the account profile or have the ability to input an alternate address for one-time use. The vendor shall provide a method for an Administrative User (described in detail later) to ship to multiple locations, either via the platform or an “offline order”. Further, the user shall have the ability to provide notes/comments with the order for the vendor to assist in order processing. The platform shall also include a button/field to indicate whether or not partial shipments will be accepted by the user. The vendor shall make every effort to ship complete orders.

Funding & Allocations

The contract will be funded on each delivery order issued against the IDIQ with additional funding added to the delivery orders as required.

As the CO cannot legally obligate the Government until an order has been placed, the CO will communicate to the vendor the amount of available funding for the contract. The platform shall allow the CO and/or the COR to assign funding allotments to each Standard & Administrative User accounts.

This funding amount will be determined by available funding at the time of the allotment, and the size of the respective team to which the Standard/Administrative User is responsible for purchasing. This funding allotment is not actual funding obligated to the vendor; it is only representative of the available budget of the respective Standard User at the time. The platform shall also allow for increase in funding allotments based upon availability of funding, and in the instance the HSI has exigent circumstances to expand its purchase requirements, such as large-scale operational events and emergency purchases.

Only the CO possesses the ability to provide additional funding to the contract. However, both the CO and the COR shall have the ability to direct how the allotment of funding added to the contract is directed to specific user accounts, and the corresponding amounts.

A user’s respective allotment shall be easily accessible on the platform. The spending allotment shall be “real time”, in that the amount listed on the platform includes available funding, additions in funding, deductions from recent purchases, and credits for recent returns/exchanges.

The Government will allow purchases on the platform to be made outside of the funding available on delivery orders. For example, end-users shall have the ability to make purchases via Government Purchase Cards (GPC). The end-user shall have the ability to select from a drop-down menu which method of funding will be used for the transaction. Only one method of funding will be available for an individual order. Purchases made via GPC will not be recorded against the monetary ceiling of the contract.

Post Order

Upon completion of an order, the user shall receive an email confirmation of the order submission. The email confirmation shall include, but not be limited to, estimated delivery date(s), detailed order information (product list, prices, and totals), shipping location, and a unique order number. The user shall receive delivery email confirmations upon shipment of products. These delivery confirmations shall include tracking information for the convenience of the user.

A user shall have the ability to retrieve all orders placed within the period of performance of the contract. The order status page shall indicate whether an order remains open & processing or is fully delivered & closed. Upon retrieving an archived order, the platform shall display detailed itemized ordering information.

The platform shall offer users the ability to track orders online by entering order number or searchable within the user account.

Upon delivery of an order, the vendor shall submit invoices to HSI via email to Invoice.Consolidation@ice.dhs.gov. The COR will route the invoice to the appropriate receiving office for confirmation of receipt of goods prior to processing for payment. Partial invoices for partial deliveries will be accepted.

**DHS will be migrating to Department of Treasury’s Invoice Processing Platform (IPP) in the future. The CO will communicate these changes to the vendor at said time.**

Technical & Customer Support

The vendor shall provide technical support to the Government for all platform assistance. All users shall be able to electronically obtain password resets during all times. The vendor is also responsible for providing platform assistance via telephone/email between the hours of 9am-5pm eastern time, Monday-Friday, excluding federal holidays. The vendor shall have dedicated personnel for the purpose of customer support in relation to placing orders, order status, returns/exchanges, and corresponding customer service requirements. Personnel shall be available via telephone/email between the hours of 9am-5pm eastern time, Monday- Friday, excluding federal holidays.

Returns/Exchanges

The vendor shall allow for exchanges within 30-days of the Government’s receipt of the product(s) without a restocking fee. Should the need for a return/exchange be that of the Government, the Government shall be responsible for return shipping expenses to the vendor. Should the need for the return/exchange due to fault of the vendor, the vendor shall be responsible for return shipping expenses.

The platform shall have the ability to process returns/exchanges through the platform. This will reduce telephonic requests for returns/exchanges. The platform shall also have the ability to track returns/exchanges in the ordering process.

In instances where users are processing multiple, frequent returns/exchanges, the vendor shall immediately notify the CO for potential remedies.

3.2 Access Control

Role Based Access Controls

The platform shall provide a seamless user account management system for all users. All user accounts and types of accounts shall be approved by the CO or the COR. The CO or COR will provide a list of new accounts no more frequently than on a weekly basis, absent any urgent circumstances. There will be three types of accounts: “Standard User”, “View Only” and “Administrative User”. Vendor shall limit amount of personally identifiable information (PII) required for the creation of the user accounts, not to exceed name, business shipping & billing locations, and contact information. All users shall have the ability to update their respective profiles, such as shipping address and contact information.

Standard User- Standard Users will request access directly from the CO and/or COR. The Standard User will provide a business case to the CO/COR for the access. Standard Users will have the ability to shop for products in a similar fashion to retail e-commerce websites. Standard Users will serve in a role of a “quartermaster” by purchasing products for an entire team. Standard Users shall have the ability to create “kits”, as described previously, for their respective teams. To be detailed later in this document, Standard Users shall have the ability to perform all product returns/exchanges via the platform.

Standard Users will be able to generate simplified reports, such as order reports. Standard Users shall have the ability to change/add shipping addresses within the profile management. All addresses are assumed to be US Government facilities, unless the CO explicitly authorizes the ability to ship to non- Government facilities in times of urgency. At the discretion of the CO and/or COR, certain products within the product matrix may not be able to viewed/order by a Standard User.

Administrative Users- Administrative Users shall have all of the capabilities of the Standard User.

Administrative User accounts are reserved for the CO, COR, and designated program managers.

Administrative Users shall have the ability to create universal kits, available to the entire enterprise.

Additionally, Administrative Users shall have the ability to view all products within the product matrix.

Administrative Users shall have full report generating functionality, as outlined in a later section. The reports generated by Administrative Users can be as local as a single team or as macro as the entire enterprise.

View Only- Each team has the ability to have a View Only account created for the purpose of providing access to non-Standard/Administrative Users/non-quartermasters. This single account login information would be shared across the team for the entire team to use. The View Only account will not have the ability to purchase via the platform, to include Government Purchase Card transactions. In order to limit PII sharing, the login for the View Only accounts will be generic, such as, fresno@hsi.dhs.gov. Only the CO, COR, any Administrative User, and/or the Standard User assigned to that team shall have the ability to request password resets from the vendor for View Only accounts.

User Authentication

The platform will implement standard secure authentication mechanism for user access. Users shall use their respective .gov email address to login to the platform. Passwords at a minimum shall be 12 characters, and must include a number, a letter, and special character. The vendor can provide guidance on which special characters are available for use. The platform shall employ industry-standard password hashing algorithms to securely store and manage user information and passwords. The platform shall enhance security by implementing account lock out policies to prevent brute-force attacks. The platform shall adhere to relevant data protection regulations, ensuring that user authentication processes comply with privacy and security standards.

In order to further enhance security of user accounts, the platform shall offer Two-Factor Authentication (2FA). This involves the user opting for text or email methods for 2FA.

In the event a user has forgotten his/her password, a “forgot password" button will be displayed at the login screen. The platform will then provide a secure email with password resetting procedures. The vendor will also provide procedures to unlock an account due to inactivity and/or incorrect login attempts. The vendor shall implement continuous monitoring and logging of authentication events to detect and respond to any suspicious activities and unauthorized access attempts promptly.

Further enhancement of security will be the implementation of session management practices, such as session timeouts to mitigate the risk of unauthorized access due to session hijacking.

Beginning six months after initiating the platform, the vendor, on a quarterly basis, shall provide the CO & COR with a list of accounts that have been inactive for 180 days or more. In most situations, the CO will instruct the vendor to place these accounts in an inactive stage, and require a password reset to unlock the account.

3.3 Reporting & Analytics

The platform shall provide robust reporting capabilities for order and contract management. The platform shall provide any report for a given date range up to 24 months prior to date of report generation. All reports shall be delivered in Microsoft Excel format, but additional graphical reporting, such as pie charts and bar graphs may be included. This information shall be provided to the CO and COR on a quarterly basis, and on occasion by special request of the CO. The reporting may be generated for a single data point (number of orders for a particular product) and/or multiple data points. This data will be used by the CO and the vendor to enhance contract and program management, while also seeking to reduce costs in certain areas. The following data points are required for all reports generated from the platform:

- Product Ordering History- Frequency of purchases, including quantities, for all products. This report will be used to assist in decision making such as “Top Selling Products” page, reducing the number of products in the product matrix.

- Order Date

- Order ID

- Products Ordered, including product manufacturer, product name, price, product number, color, size

- Order Quantity

- Total Amount of Order

- Associated Delivery Order Number

- Order Status- Open/Pending, Fulfilled, Canceled

- Estimated Shipping Timeframe

- Actual Shipping Timeframe

- Shipping Carrier Name & Tracking Information

- Shipping Address(es)

- User Information, including name & email address

- Invoice Status- Issued, Past Due, Pending, Closed

- Invoice Amount

- Invoice Date, Generated

- Invoice Date, Submitted

- Invoice Date, Payment Received

- Product Returns, including product name, date of return, reason for returning/exchanging, refund/exchange status.

Should the Government terminate this contract for convenience and/or default, foregoes executing an option, or the contract ends, the vendor shall provide the Government with all reporting data previously explained in this document.

Data Ownership

1. Accessibility of Government-owned Data

All stored program data associated with this acquisition shall be owned by the Government. As such, it shall be made accessible to the Government in accordance with the Minimum Data Access Capability described below. This accessibility is required to allow full data transparency, flexibility in performing data analytics, and integration with data from other government programs.

In addition to the Minimum Data Access Capability, the Government prefers, but does not require, that program data be accessible via Enhanced Access Capabilities as described below.

Definition of “program data”: Program Data refers to any data resulting from ICE and DHS organizational activity. Examples of such data include but are not limited to administrative data resulting from human resource, management, and financial actions, as well as operational data resulting from performance of the ICE mission.

Definition of “associated with this acquisition”: Program Data is associated with an acquisition if it is created by DHS organizational activity that is facilitated by the contractor. Examples of how a contractor might facilitate organizational activity follow:

o Program data is stored by contractor personnel o Program data is stored by software that is managed, developed, or used by the contractor o Program data is stored in a repository that is managed, developed, or used by the contractor

2. Minimum Data Access Capability

• The current version of all Program Data is accessible to the Government within 24 hours of request, as well as on any pre-defined schedule as required by the Government.

Data access can occur by various means, provided that Government security requirements are met, and data is accessible in a format that is acceptable to the Government. Examples include but are not limited to APIs that are consumable by the Government, files made available for Government download (e.g., Excel Spreadsheets), or direct database query by federal or contractor personnel.

• The contractor shall format program data accessed by the Government to anticipate the maximum file size of any data to be accessed. File size shall be small enough to assure rapid processing by government applications.

• The contractor shall provide the means for the Government to interpret accessible Program Data as follows:

o Data elements and groupings of data elements shall be clearly identifiable by labels embedded in the data itself, or by a separate schema or file layout which allows such elements and groupings to be identified.

In the case of a relational database schema defined through Data Definition Language (DDL), data elements would be represented as columns, and groupings of data would be represented as tables. In addition, relationships between tables would be described as foreign key relations.

• Labels or names used to identify data elements and groupings of data elements shall be approved by the Government. In addition, each label or name shall be associated with a government approved definition which describes the content of data held therein.

• Program data delivered to the Government shall conform to the Government approved definition for each data element and grouping of data elements.

• All data accessible by the Government shall be both machine readable and human-readable in plain text.

• All reference data associated with Program Data also needs to be accessible to the Government. Such reference data is required to provide complete understanding of a record.

Reference Data Example: Program data may include a city code which uniquely identifies a city.

Reference data associated with a city code may include its name, geographic boundaries, population, median income, etc. This example is provided for clarification of the meaning of reference data and may or may not apply to this specific acquisition. Examples of other reference data codes would include codes representing eye color, gender, country of origin, etc.

3. Enhanced Access Capabilities

The Government prefers that sharing of program data take place via an Application Programming Interface (API) or multiple APIs. APIs allow the Government to efficiently consume data via a widely recognized standard where the data has been completely abstracted from the technology platform that produces it.

In addition, the Government prefers that sharing of program data take place using techniques that enhance efficiency, such as Change Data Capture (CDC). CDC enhances efficiency of data transfer by providing only incremental updates to program data as opposed to providing all program data each time data is shared.

3.4 Platform Security

Security

The platform must employ robust data encryption mechanisms to ensure sensitive information is safeguarded at all times. This includes data in transit whereby the platform will use industry-standard encryption protocols to secure data transmitted between users and the platform, and data at rest must be safeguarded, such as customer information, order details, and payment data.

In accordance with Information Technology Acquisition Review (ITAR) 4.5.3.1 – Compliance with DHS Security Policy Terms and Conditions: All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive Systems Policy and DHS 4300A Sensitive Systems Handbook.

Platform- General Security

The HSI (and other Government associated) name, logos, seals, and other intellectual property, including the “MAMMOTH” logo are not to be used in any other manner than for specific use in the platform. These intellectual properties and any other images/likenesses associated with the HSI may not be used by the vendor for marketing purposes unless explicitly authorized by the Contracting Officer.

The platform shall not include any advertisements, to include those originating from the vendor of the contract. For example, the vendor cannot advertise to a user a 20% discount when shopping via the vendor’s public website. The vendor may provide product recommendations when a user is searching for products or add a particular product to the shopping cart. The recommendations are limited to only those products included in the product matrix of the contract.

The platform shall not allow pop-up windows to be produced, unless required for order reports.

The vendor shall not send marketing emails to any user of the platform. Only emails related to platform operations (username, password retrieval) and purchase related events are approved.

The vendor may not resell or distribute any information provided, created, or inferred from the contractual relationship without the written consent from the CO. All information generated from the contractual relationship, except for awardee name, contract period of performance, and total dollar award, is deemed sensitive.

The platform is intended for use solely by the Government, specifically HSI at time of award. No one outside of the employees of the vendor and of HSI (and any other authorized federal agencies) shall have access to the platform, to include demonstration (“dummy”) logins without the written consent of the CO. Over the life of the contract, there exists the possibility for additional programs and agencies within DHS to place orders off the contract. As a result, the CO will work with the vendor to establish a semi-customized platform experience specific to that group(s). On occasion, the CO may authorize other federal agencies to place orders off the contract on a limited basis.

https://www.dhs.gov/sites/default/files/publications/Sensitive%20Systems%20Policy%20Directive%204300A.pdf https://www.dhs.gov/sites/default/files/publications/Sensitive%20Systems%20Policy%20Directive%204300A.pdf

Platform- Security Standard & Encryption

The platform shall be certified as meeting the ISO/IEC 27001:2022 (International Organization for Standard/International Electronic Commission) standard.

The platform shall have a completed System & Organization Controls (SOC) 2, “SOC 2”, Audit & Certification prior to contract award.

At a minimum, the platform shall use 2048-bit SSL with 256-bit encryption security for all traffic completed between the Government and the vendor. This shall include the URL requirement of “https”, and the “pad lock” in the address bar.

Security Audits

The vendor shall perform routine and thorough security audits of the platform. At a frequency of no less than once per year, the vendor shall conduct penetration testing for the entire platform, web applications, APIs and network infrastructure. Depending on the dynamic nature of the platform, the vendor shall conduct routine vulnerability assessments of the platform, including software, configurations, and infrastructure. The vendor is required to notify the CO of any vulnerabilities uncovered in these security audits and provide an action plan for remediation. The vendor shall maintain a continuous improvement plan with respect to platform security.

In accordance with ITAR 4.5.3.4 and ITAR 4.5.4.4 – Security Review Security Review Terms and Conditions:

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

Handling of Personally Identifiable Information (PII)

The Government will furnish PII in the lowest necessary requirement for the operations of the platform.

The platform shall provide security parameters for PII as outlined in previous sections. Each user account shall be limited to the following information:

- Employee’s Name

- Employee’s Official Government Email Address

- Employee’s Telephone Number

- Employee’s Delivery Address https://www.iso.org/standard/27001

Safeguarding of Controlled Unclassified Information (July 2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116– 283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need.

Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information.

Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required.

Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information.