HSI MAMMOTH RFP v2 08-21-2024.pdf

IMMIGRATION & CUSTOMS ENFORCEMENT (ICE),

HOMELAND SECURITY INVESTIGATIONS (HSI)

OFFICE OF ACQUISITION MANAGEMENT (OAQ)

RYAN DOLAN

MAMMOTH

REQUEST FOR PROPOSAL

HSI-MAMMOTH

70CMSD24R00000011

JULY 24, 2024

IMMIGRATION & CUSTOMS ENFORCEMENT

OFFICE OF ACQUISITION MANAGEMENT

8222 N. BELTLINE ROAD

IRVING, TX 75063

RYAN DOLAN

CONTRACTING OFFICER

RYAN.DOLAN@ICE.DHS.GOV

314.928.7546

TABLE OF CONTENTS

PART I- THE SCHEDULE

SECTION B SUPPLIES, SERVICES, AND PRICING

B.1 DESCRIPTION OF SUPPLIES & SERVICES

B.2 TYPE OF CONTRACT

B.3 CONTRACT AND ORDER LIMITATIONS

B.4 PRICING AND CONTRACT LENGTH

SECTION C DESCRIPTION/SPECIFICATIONS/STATEMENT OF REQUIREMENTS

C.1 GENERAL DESCRIPTION

C.2 SCOPE

C.3 GENERAL REQUIREMENTS

C.4 CONTRACT REQUIREMENTS

C.5 REPORTS

C.6 SECURITY & ACCESS CONTROL

C.7 MEDIA STATEMENTS

SECTION D PACKAGING AND MARKING

D.1 PACKAGING AND MARKING

SECTION E INSPECTION AND ACCEPTANCE

E.1 CLAUSES INCORPORATED BY REFERENCE

E.2 QUALITY ASSURANCE

E.3 WARRANTIES

SECTION F DELIVERIES AND PERFORMANCE

F.1 CLAUSES INCORPORATED BY REFERENCE

F.2 PERIOD OF PERFORMANCE

F.3 DELIVERABLES/REPORTS

F.4 DELIVERY SCHEDULE

F.5 NOTICE TO THE GOVERNMENT OF DELAYS

F.6 PLACE OF DELIVERY

F.7 F.O.B. DESTINATION

SECTION G CONTRACT ADMINISTRATION DATA

G.1 CONTRACT ADMINISTRATION

G.2 CONTRACTING OFFICER’S REPRESENTATIVE

G.3 DELIVERY LOCATION POC’S

G.4 INVOICING REQUIREMENTS

G.5 PAYMENT

G.6 SMALL BUSINESS ACCELERATED PAYMENT

G.7 WITHHOLDING OF CONTRACT PAYMENTS

SECTION H SPECIAL CONTRACT REQUIREMENTS

H.1 DISCLOSURE OF DATA UNDER FOIA

H.2 GOVERNMENT RIGHTS IN DATA AND COPYRIGHTS

H.3 ACCESS TO IMMIGRATION & CUSTOMS ENFORCEMENT LOCATIONS

H.4 SYSTEM FOR AWARD MANAGEMENT

H.5 TECHNOLOGY ENHANCEMENT CLAUSE

H.6 RELEASE OF INFORMATION

H.7 DHS 4300A- DHS SENSITIVE SYSTEMS POLICY AND DHS 4300A SENSITIVE

SYSTEMS HANDBOOK

H.8 ITAR 4.5.3.4 AND ITAR 4.5.4.4- SECURITY REVIEW TERMS AND

CONDITIONS

H.9 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (CUI)

(JULY 2023)

PART II- CONTRACT CLAUSES

SECTION I CONTRACT CLAUSES

I.1 CLAUSES INCORPORATED BY REFERENCE

I.2 CONTRACT TERMS CONDITIONS- COMMERCIAL ITEMS

I.3 ORDERING

I.4 ORDER LIMITATIONS

I.5 INDEFINITE QUANTITY

I.6 OPTION TO EXTEND THE TERM OF THE CONTRACT

I.7 CONTINUING CONTRACT PERFORMANCE DURING A PANDEMIC,

INFLUENZA, OR OTHER NATIONAL EMERGENCY

I.8 CONTRACTOR CERTIFICATION OF COMPLIANCE WITH FEDERAL TAX

REQUIREMENTS

I.9 INVERTED DOMESTIC CORPORATION

PART III- LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J LIST OF ATTACHMENTS

J.1 PRODUCT MATRIX

J.2 STATEMENT OF REQUIREMENTS

J.3 PAST PERFORMANCE QUESTIONNAIRE

PART IV- REPRESENTATIONS AND INSTRUCTIONS

SECTION K REPRESENTATIONS AND CERTIFICATIONS

K.1 UNIQUE ENTITY IDENTIFIED

K.2 SYSTEM FOR AWARD MANAGEMENT

K.3 ANNUAL REPRESENTATIONS AND CERTIFICATIONS

K.4 CERTIFICATION REGARDING RESPONSIBILITY MATTERS

K.5 INFORMATION REGARDING RESPONSIBILITIES

K.6 EVALUATION OF OPTIONS

SECTION L INSTRUCTIONS OF CONDITIONS AND NOTICES TO OFFERORS

L.1 CLAUSES INCORPORATED BY REFERENCE

L.2 COMMITMENT

L.3 TYPE OF CONTRACT

L.4 PROPROSED PREPARATION COST

L.5 INSTRUCTIONS TO OFFERORS

L.6 PROTESTS FILED DIRECTLY

L.7 REQUEST FOR CLARIFICATIONS

SECTION M EVALUATION FACTORS FOR AWARD

M.1 EVALUATION FACTORS

PART I- THE SCHEDULE

SECTION B SUPPLIES, SERVICES, AND PRICING

B.1 DESCRIPTION OF SUPPLIES & SERVICES

Contractor shall provide all products listed in the enclosed Product Matrix. Additionally, the contractor shall provide an e-commerce ordering website/ platform (herein after, “platform”) for the purpose of collecting requirements.

B.2 TYPE OF CONTRACT

The contract will be structured as a Firm-Fixed price, single award, Indefinite Delivery/ Indefinite Quantity (IDIQ) type contract for one (1) twelve-month base year and four (4) additional one-year option periods. This requirement is a total small business set-aside.

B.3 CONTRACT AND ORDER LIMITATIONS

Delivery shall be made only as authorized by orders issued in accordance with the Ordering clause. The Contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the “maximum,” hereby established as $49 million over the life of the contract. The Government shall order at least the quantity of supplies or services designated in the Schedule as the “minimum,” hereby established as $20,000.00 in the base year of the contract.

The Government shall not be required to purchase from the offeror any additional quantities other than the initial guaranteed minimum. The obligation of funds and specific quantities will be ordered through individual delivery orders and the Government Purchase Card Program.

B.4 PRICING AND CONTRACT LENGTH

Contractor shall provide a complete pricing list for the products listed in the matrix (refer to Section I). Pricing shall be provided for the base period and four option years.

(END OF SECTION)

SECTION C DESCRIPTION/SPECIFICATIONS/STATEMENT OF REQUIREMENTS

C.1 GENERAL DESCRIPTION

HSI has a need to (1) properly outfit (clothing) and provide personal protection equipment and complimentary supplies to maintain a uniform (standard) and professional National Tactical Program (NTP) across HSI, while ensuring the safety and welfare of employees operating in hostile environments and multiple/varying adverse climates across the United States. In addition, (2) an online ordering platform that offers tactical teams across HSI the ability to order items from the approved Product Matrix is required. The platform enables teams to process purchase requests in a more efficient manner, as opposed to multiple purchase card and purchase order transactions. As a result, the platform will drastically reduce redundant administrative workload for employees, some of whose positions on the tactical teams are deemed collateral duties to their investigative roles in the organization. The platform will also afford the NTP the ability to track all purchases throughout the year, identify purchasing trends, and provide purchasing data for further decision-making purposes.

C.2 SCOPE

2.1 This Request for Proposal is for both products and creation of an online ordering platform. The products requested for the contract are included in the Product Matrix attachment (Section J). The minimum requirements for the platform are included in the Statement of Requirements attachment (Section J). The total requirement for this RFP includes both the pricing of products and the e-commerce platform. Proposals submitted without the e-commerce platform capability and availability for testing/ evaluation will be deemed nonresponsive. A fully functional e-commerce platform with the product matrix loaded for the purposes of ordering must be established within 60 days of award.

Over the life of the contract, there exists the possibility for additional programs and agencies within DHS to place orders off the contract. As a result, the CO will work with the vendor to establish a semi-customized platform experience specific to that group(s). On occasion, the CO may authorize other federal agencies to place orders off the contract on a limited basis.

2.2 Deliver products within 30 days after receipt of order. For products that are only manufactured upon order, the vendor shall negotiate lead times with the Contracting Officer. Deliveries to be shipped FOB Destination to all ICE (and other approved Federal Government) CONUS locations, Hawaii, Alaska, Puerto Rico, and U.S. Virgin Islands.

2.3 HSI is the only agency authorized to place orders against this contract. The Contracting Officer reserves the right to authorize additional agencies the ability to place orders against the contract.

C.3 GENERAL REQUIREMENTS

See attached Product Matrix for deliverables/ requirements. Further deliverables are outlined in the Statement of Requirements for the e-commerce platform. If for any reason an item becomes End of Life during the five (5) year IDIQ, the new product replacing it shall be added to the contract once the Contracting Officer has negotiated the price with the awardee and determined the price to be fair and reasonable. Should HSI wish to add products deemed within scope of the contract, the Contracting Officer will negotiate a fair & reasonable price with the contractor and publicize the addition of the product to the matrix.

C.4 CONTRACTOR REQUIREMENTS

4.1 The contractor shall be capable of providing the entire Product Matrix and e-commerce platform for the length of the contract. The contractor shall offer all products in the catalog. This is not a requirement for brand name or equal, however, the products listed in the matrix are examples that meet the Government’s requirement. Other products might also meet the Government’s requirements. The contractor should propose the product it thinks best suited to meet or exceed the quality and/or capability of products listed in the matrix. The Government will evaluate the product catalog submitted for adherence to Trade Agreements Act (TAA) compliance as noted in FAR 52.225-5 (Section I.2 of this document).

4.2 The contractor shall ensure e-commerce platform security is maintained as outlined in the attached Statement of Requirements.

4.3 The contractor shall provide key personnel for this contract as described in Section 4 (Key Personnel) of the Statement of Requirements. These personnel include Program Manager, Customer Service POC, and Technical Support.

C.5 REPORTS

The contractor shall provide a quarterly usage report to the Contracting Officer within ten (10) calendar days of the end of the quarter (January-March, April- June, July- September, October-December) during which products were ordered. Reports shall include:

i. Contract Number

ii. Period of Performance (e.g.- Base Year, Quarter 1)

iii. List of individual delivery orders and Government purchase card transactions “ACCEPTED” during the quarter for each authorized buyer (include delivery order or Government Purchase Card transaction number and dollar value of order).

iv. Total dollar value of all accepted orders during the quarter (combined quarterly figure).

v. Total dollar value of usage to date (current quarterly figure combined with previous quarters) under the contract.

C.6 SECURITY AND ACCESS CONTROL

From time to time, the contractor may need to visit HSI & ICE Facilities. On-site visits require a minimum of 48 hours advance notice, unless exigent circumstance exists, which will require prior Contracting Officer (CO) approval. All required security forms and fingerprint cards will be provided to the contractor by the CO upon request. Please see Section G.3 for additional details.

C.7 MEDIA STATEMENTS

All press statements and releases related to the contract shall receive advance written approval by the Contracting Officer and the Office of the Principal Legal Advisor (OPLA).

Examples include, but not limited to, website notices & advertisements, use of DHS names & seals, and images of DHS personnel.

SECTION D PACKAGING AND MARKING

D.1 PACKAGING & MARKING

Preservation, packaging, and packaging for all items delivered hereunder shall be in accordance with commercial practice and adequate to ensure acceptance by a common carrier and safe arrival at the destination.

1.1 The products shall be packaged in a manner which clearly identifies the products contained in each package, including product number(s) and quantity(s). This can be placed on the bill of lading in the package.

1.2 The contractor shall possess the capability of tracking different parts sold and shipped under the terms and conditions of this contract if a recall becomes necessary for the purpose of warranty replacement. The contractor shall supply this information to, and upon request of, the Contracting Officer.

1.3 It is preferred that, whenever possible, packaging shall be constructed of a biodegradable or recyclable material, to minimize environmental impact after disposal, or to allow recycling.

1.4 The contractor should be capable of meeting delivery schedules with the entire quantity(s) of products ordered. Partial shipments may be accepted with prior authorization.

1.5 Shipments delivered directly from the manufacturer must clearly identify the delivery point of contact (POC) either on the outside of the package or on the bill of lading.

SECTION E INSPECTION AND ACCEPTANCE

E.1 CLAUSES INCORPORATED BY REFERENCE (FAR 52.252-2, FEB., 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/far/

(a) FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSES

CLAUSE NUMBER TITLE DATE

FAR 52.246-2 INSPECTION OF SUPPLIES- FIXED PRICE AUGUST, 1996

(END OF CLAUSE)

E.2 QUALITY ASSURANCE

The Government shall monitor customer satisfaction by reviewing shipments. The satisfactory delivery of products will be closely monitored and tracked by the Contracting Officer (CO). Items tracked include the time delivery of supplies, accuracy of orders, and condition of deliveries upon receipt. The contractor will be notified by the CO of quality assurance results. It is the contractor’s responsibility to correct any/all deficiencies.

Damaged/defective products may be returned to the contractor/manufacturer, at no cost to the Government, and replaced with an equal product. The contractor will be notified in writing of the nature of the defective/damaged products and shall implement corrective action within 30 days of written notification, by providing a replacement product.

If a product on the Product Matrix fails to maintain quality, durability, and reliability standards as those expressed at time of award, the Government reserves the right to replace the item(s) with a similar product via modification to the contract.

E.3 WARRANTIES

The contractor warrants the products to be free of defects and of merchantable quality within the meaning of the Uniform Commercial Code.

https://www.acquisition.gov/far/

SECTION F DELIVERIES AND PERFORMANCE

F.1 CLAUSES INCORPORATED BY REFERENCE (FAR 52.252-2; FEB., 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/far/

(b) FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSES

FAR 52.242-15 STOP-WORK ORDER AUGUST, 1989

F.2 PERIOD OF PERFORMANCE

The anticipated period of performance for this contract shall be a 12-month base period, to begin upon the date of the award, with four one-year option periods.

F.3 DELIVERABLES/REPORTS

The contractor shall provide all requirements outlined in the Statement of Requirements in relation to the e-commerce platform. Additionally, as outlined in Section B.5, the contractor shall provide Quarterly Usage Reports to the Contracting Officer.

F.4 DELIVERY SCHEDULE

All deliveries shall be received by the requestor no later than 30 days after receipt of order. For products that are only manufactured upon order, the vendor shall negotiate lead times with the Contracting Officer.

If the delivery cannot be made within this time frame, the contractor shall provide notification, including a detailed reason for non-shipment to the Contracting Officer (CO) and the requestor.

The contractor is to make its best effort to deliver within 30 days or provide requestor and CO with a realistic delivery date at the time the order is placed.

F.5 NOTICE TO THE GOVERNMENT OF DELAYS

In the event the contractor encounters difficulty in meeting performance requirements, or when the contractor anticipates difficulty in complying with contract delivery schedules, or whenever the contractor has knowledge that any actual or potential situation is delaying or threatens to delay the timely performance of this contract, the contractor shall immediately notify the Contracting Officer in writing, giving pertinent details; provided, however, that this data shall be informational only and that provision shall not be construed as a waiver by the Government of any delivery schedule or date, or any rights or remedies provided by law or under this contract.

F.6 PLACE OF DELIVERY

The contractor shall drop-ship products to destinations identified on individual delivery orders and Government purchase card transactions, to include all ICE (and other approved Federal Government) CONUS locations, Hawaii, Alaska, Puerto Rico and U.S.

Virgin Islands.

F.7 F.O.B. DESTINATION

(a) The term “F.O.B. Destination,” as used in this clause, means–

(1) Free of expense to the Government, on board the carrier’s conveyance, at a specified delivery point where the consignee’s facility (plant, warehouse, store, lot, or other location to which shipment can be made) is located; and

(2) Supplies shall be delivered to the destination consignee’s wharf (if destination is a port city and supplies are for export), warehouse unloading platform, or receiving dock, at the expense of the Contractor. The Government shall not be liable for any delivery, storage, demurrage, accessorial, or other charges involved before the actual delivery (or “constructive placement” as defined in carrier tariffs) of the supplies to the destination, unless such charges are caused by an act or order of the Government acting in its contractual capacity. If rail carrier is used, supplies shall be delivered to the specified unloading platform of the consignee. If motor carrier (including “piggyback”) is used, supplies shall be delivered to truck tailgate at the unloading platform of the consignee, except when the supplies delivered meet the requirements of Item 568 of the National Motor Freight Classification for “heavy or bulky freight.”

When supplies meeting the requirements of the referenced Item 568 are delivered, unloading (including movement to the tailgate) shall be performed by the consignee, with assistance from the truck driver, if requested. If the contractor uses rail carrier or freight forwarder for less than carload shipments, the Contractor shall ensure that the carrier will furnish tailgate delivery, when required, if transfer to truck is required to complete delivery to consignee.

(b) For each shipment the Contractor shall --

(1)

(i) Pack and mark the shipment to comply with the contract specifications; or

(ii) In the absence of specifications, prepare the shipment in conformance with carrier requirements;

(2) Prepare and distribute commercial bills of lading;

(3) Deliver the shipment in good order and condition to the point of delivery specified in the contract;

(4) Be responsible for any loss of and/or damage to the goods occurring before receipt of the shipment by the consignee at the delivery point specified in the contract;

(5) Furnish a delivery schedule to the end user/ ordering authority (i.e., verbal, electronic, written) and designate the mode of delivering carrier; and,

(6) Pay and bear all charges to the specified point of delivery.

SECTION G CONTRACT ADMINISTRATION DATA

G.1 CONTRACT ADMINISTRATION

Any/all contract related matters shall be addressed to the attention of the Contracting Officer (CO) throughout the life of the contract. The Contracting Officer for this requirement is:

Ryan Dolan Ryan.Dolan@ice.dhs.gov 314.928-7546

G.2 CONTRACTING OFFICER’S REPRESENTATIVE (COR) (JAR 2852.201-70; JANUARY, 1985)

A. An individual that shall be named after contract award is hereby designated to act as the COR under this contract.

B. The COR is responsible, as applicable, for: receiving all deliverables, inspecting and accepting the supplies or services provided hereunder in accordance with the terms and conditions of this contract; providing direction to the contractor which clarifies the contract effort, fills in details or otherwise serves to accomplish the contractual Scope of Work; evaluating performance; and certifying all invoices/vouchers for acceptance of the supplies or services furnished for payment.

C. The COR does not have the authority to alter the Contractor’s obligations under the contract; and/or modify any of the expressed terms, conditions, specifications, or cost of the agreement. If as a result of technical discussions, it is desirable to alter/ change contractual obligations or the Scope of Work, the Contracting Officer shall issue such changes.

(End of Clause)

G.3 DELIVERY LOCATION POINTS OF CONTACT (POCS)

A point of contact (POC) shall be established for all delivery locations for this contract.

The POC’s are responsible for inspection and acceptance of deliveries, certifying invoices are valid, and provide contract performance information to the Contracting Officer. A listing of POC’s shall be provided to the contractor after award.

G.4 INVOICING REQUIREMENTS

(a) The contractor shall submit an original itemized invoice directly to Invoice.Consolidation@ice.dhs.gov. At later date, ICE will move invoicing to Department of Treasury’s Invoice Processing Platform (IPP).

To constitute a proper invoice, each invoice shall be annotated with the following information:

(1) Name of vendor;

(2) Invoice date;

(3) Government contract/deliver order number, or authorization for delivery of goods or services;

(4) Vendor invoice number, account number, and/or any other identifying number agreed to by the contract;

(5) Description (including contract line/subline), price, and quantity of goods and services rendered;

(6) Taxpayer Identification Number (TIN);

(7) Banking information necessary to facilitate an electronic funds transfer (EFT) payment;

(8) Contact name (where practicable), title and telephone number;

The invoice should be attached to an email, and sent to the following address:

Invoice.Consolidation@ice.dhs.gov. It is imperative that the invoice contains current and accurate contract information (as requested above), otherwise risks being rejected.

Upon receipt of the invoice, a confirmation email will be sent back to the sending email address. At this point, the invoice is considered received, and will begin processing through ICE/HSI’s internal payment system. Please note, invoices received before 5pm EST (Monday-Friday) will be considered “received” that business day. Any invoice received after 5pm EST will be considered “received” and will be entered into the invoice system on the following day.

Should ICE/HSI transition to Department of Treasury’s Invoice Processing Platform (IPP), the Contracting Officer will provide proper notice to the vendor on the date invoices should be routed to IPP for processing and payment.

G.5 PAYMENT

Payment shall be made by ICE/HSI’s Burlington (VT) Finance Center in accordance with the Prompt Payment Act upon Delivery Location POC certification of receipt of supplies.

G.6 SMALL BUSINESS ACCELERATED PAYMENT

The contractor must indicate its business size on each invoice to assist the payment office in determining eligibility for accelerated payment in accordance with OMB Memo

M-11-32, ‘ACCELERATING PAYMENTS TO SMALL BUSINESSES FOR GOODS AND

SERVICES’, dated 10/14/2011. The Prompt Payment Act still applies to this action;

however, the agency will make best efforts to pay proper invoices within 15 days.

G.7 WITHHOLDING OF CONTRACT PAYMENTS

Notwithstanding any other payment provision of this contract, failure of the Contractor to submit required reports when due or failure to perform or deliver required work, supplies, or services will result in the withholding of payments under this contract unless such failure arises out of causes beyond the control, and without the fault or negligence of the Contractor as defined by the terms and conditions of the contract. The Government shall promptly notify the contractor of its intention to withhold payment of any invoice or voucher submitted.

SECTION H SPECIAL CONTRACT REQUIREMENTS

H.1 DISCLOSURE OF DATA UNDER THE FREEDOM OF INFORMATION ACT (FOIA)

If a request for information contained in a proposal is requested under the FOIA, the Government shall have the right to disclose any information or data contained in a proposal that results in a contract to the extent provided under the FOIA, notwithstanding any restrictive legends that may have been placed upon it in accordance with other contract provisions. The Government will, before disclosure, make an administrative determination on a case basis as to whether the information requested is exempt from disclosure by one of the established exceptions to the ACT. In making this determination the procedures outlined in 28 CFR, paragraph 16.7 shall be followed which, in part, affords the submitter of a proposal an opportunity to object to disclosure.

H.2 GOVERNMENT RIGHTS IN DATA AND COPYRIGHTS

The Government shall have unlimited rights, as delineated in the FAR clause Rights in data-special works (52.227-17) which is included in SECTION I by reference, to all documentation and other data developed by the Contractor under this contract.

For the avoidance of doubt, the only rights contemplated to be granted to the Government are developments for which the Government may have specifically requested development and for which the Government has made payment in full expressly attributed to such development in writing to the contractor; however, no rights are contemplated to be granted to the Government in any technical details, technical data, or any other confidential and/or proprietary information of contractor that was developed at private expense, and for which contractor hereby expressly reserves all rights.

The Contractor shall not duplicate or disclose in any manner, for any purpose whatsoever, or have or permit others to do so, any documentation or other data developed and/or obtained by the Contractor under this contract. Any publications, presentations and other release of information regarding this contract must be pre-approved by the Contracting Officer.

H.3 ACCESS TO IMMIGRATION & CUSTOMS ENFORCEMENT LOCATIONS

Performance under this contract may require access to ICE/HSI locations to provide some service, product, or perform some other official function of interest to ICE/HSI.

Contractors will be required to comply with all visitor access requirements, which may include submission of driver’s license and other biographical information. Completed forms should be provided to the assigned Contracting Officer (CO) at least 10 days prior to required access.

H.4 SYSTEM FOR AWARD MANAGEMENT

The contractor shall be registered in System for Award Management (SAM)- All vendors must be registered in SAM, effective July 29, 2012 to receive Government contracts.

SAM is located at www.SAM.gov. ICE is utilizing a financial system that has a direct interface with SAM. If any current ICE vendor data conflicts with SAM Data, the information contained in SAM may override our current information. Please ensure that your company’s SAM information is updated and accurate. This includes: TIN, EFT, UEI (Unique Entity Identifier), addresses and contact information. The EFT banking information on file in SAM will be what ICE uses to process payment to your organization.

H.5 TECHNOLOGY ENHANCEMENT CLAUSE

During the life of this contract, new products and technologies may become available in the marketplace that offer significant advantages to the Government in terms of economy, efficiency, quality and mission effectiveness. It is in the Government’s interest to take advantage of such technology in a disciplined manner consistent with law, regulation and its valid requirements. The contract shall be modified from time to time to take advantage of these new products and technologies.

H.6 RELEASE OF INFORMATION-PUBLICATIONS BY CONTRACTOR PERSONNEL

Immigration & Customs Enforcement (ICE) specifically requires that Contractors shall not divulge, publish or disclose information or produce material acquired as or derived from the performance of their duties.

For purposes of this clause, “Information” shall include, but not be limited to: in any media or all media including on the web or websites; publication, studies, books, thesis, photographs, films or public announcements, press releases describing any part of the subject matter of this contract or any phase of any program hereunder, except to the extent such as:

(i) Already known to the contractor prior to commencement of the contract

(ii) Required by law, regulation, subpoena or government or judicial order to be disclosed, including the Freedom of Information Act (FOIA).

No release of information shall be made without the prior written consent of the Office of Public Affairs and the Contracting Officer. The Contractor and author are warned that disclosure is not without potential consequences. HSI will make every effort to review proposed publications in a timely manner to accommodate these and other publications.

H.7 DHS 4300A- DHS SENSITIVE SYSTEMS POLICY AND DHS 4300A SENSITIVE SYSTEMS

HANDBOOK

In accordance with Information Technology Acquisition Review (ITAR) 4.5.3.1 – Compliance with DHS Security Policy Terms and Conditions: All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive Systems Policy and DHS 4300A Sensitive Systems Handbook.

H.8 ITAR 4.5.3.4 AND ITAR 4.5.4.4- SECURITY REVIEW TERMS AND CONDITIONS

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

H.9 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (CUI) (JULY 2023)

(a) Definitions. As used in this clause— Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security https://www.dhs.gov/sites/default/files/publications/Sensitive%20Systems%20Policy%20Directive%204300A.pdf https://www.dhs.gov/sites/default/files/publications/Sensitive%20Systems%20Policy%20Directive%204300A.pdf

(including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement.

The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information;

and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information.

The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S.

Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

Notification and Credit Monitoring Requirements for Personally Identifiable Information Incidents (July 2023)

(a) Definitions. Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(1) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(2) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual.