HSSCCG08R00001.pdf

FOIA Backlog Reduction Services HSSCCG-08-R-00001

TABLE OF CONTENTS

DESCRIPTION PAGE(S)

Part I – The Schedule SF 1449, Solicitation/Contract/Order For Commercial Items 1 - 3 Supplies or Services/Prices 4 Description/Specifications – Performance Work Statement 5 - 17

Part II – Contract Clauses 18 - 25

Part III – List of Documents, Exhibits and Other Attachments 26

Part IV – Representations, Certifications and Other Statements of Bidders Representations and Certifications 27 - 37 Instructions to Offerors – Commercial Items 38 - 44 Evaluation Factors for Award 45 - 46

Attachment 1 - Statement of Equivalent Rates for Federal Hires 47 Attachment 2 - SCA Wage Determination – 2005-2307, Rev. 5 48 - 56 Attachment 3 - Requisition – Materials-Supplies-Equipment, G-514 58

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

CIS

South Burlington VT 05403

70 Kimball Avenue

Department of Homeland Security

USCIS Contracting Office

NRC

CODE 16. ADMINISTERED BYCODE

X

X

561499

SIZE STANDARD:

100.00

% FOR:SET ASIDE:UNRESTRICTED OR

CIS

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

03/12/2008 1200 ET

02/13/2008

802-872-4111Stephen Hill

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION

8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

HSSCCG-08-R-00001

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

1. REQUISITION NUMBER PAGE OF

1 58OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

Lees Summit MO 64064

150 Space Center Loop

Citizenship & Immigration Services

Department of Homeland Security

National Records Center

15. DELIVER TO

South Burlington VT 05403

70 Kimball Avenue

Department of Homeland Security

USCIS Contracting Office

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$6.5

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

HUBZONE SMALL

BUSINESS

EMERGING SMALL

BUSINESS

8(A)X

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Tax ID Number: Not Available

DUNS Number: Not Available

The minimum guarantee under this IDIQ contract is

5000 FOIA Cases. The maximum quantity is 65,000

FOIA Cases.

The ordering activity is designated as the

Department of Homeland Security, USCIS

Contracting Office, located at 70 Kimball Avenue, South Burlington, VT 05403-6813.

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

X

X

DATED

Ned R. Ross

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDEND

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 3/2005)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED

ARE NOT ATTACHED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS

NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY

39. S/R VOUCHER NUMBER

38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS 42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 3/2005) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

0001 Routine Case (Track 1) Base Year - Processing of 1000 EA a Routine (Track 1) Freedom of Information Act

(FOIA) request as outlined in the enclosed

Performance Work Statement (PWS). This fixed unit price CLIN is inclusive of all direct and indirect labor costs and other costs associated with accomplishing all tasks and work elements contained in the PWS.

0002 Complex Case (Track 2) Base Year - Processing of 55000 EA a Complex (Track 2) Freedom of Information Act

(FOIA) request as outlined in the enclosed

Performance Work Statement (PWS). This fixed unit price CLIN is inclusive of all direct and indirect labor costs and other costs associated with accomplishing all tasks and work elements contained in the PWS.

0003 Performance Incentive - Base Year EA

(Not Separately Priced)

OPTION YEAR ITEMS

1001 Routine Case (Track 1) Option Year - Processing 500 EA of a Routine (Track 1) Freedom of Information Act

(FOIA) request as outlined in the enclosed

Performance Work Statement (PWS). This fixed

Continued ...

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

582 of

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

3 58

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED

PAGE OF

(A) (B) (C) (D) (E) (F)

HSSCCG-08-R-00001

unit price CLIN is inclusive of all direct and indirect labor costs and other costs associated with accomplishing all tasks and work elements contained in the PWS.

(Option Line Item)

04/01/2009

1002 Complex Case (Track 2) Option Year - Processing 8500 EA of a Complex (Track 2) Freedom of Information

Act (FOIA) request as outlined in the enclosed

Performance Work Statement (PWS). This fixed unit price CLIN is inclusive of all direct and indirect labor costs and other costs associated with accomplishing all tasks and work elements contained in the PWS.

(Option Line Item)

04/01/2009

1003 Performance Incentive - Option Year EA

(Option Line Item)

04/01/2009

(Not Separately Priced)

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

PART I

Supplies or Services/Prices

Block 20 – Schedule of Supplies/Services

CLIN DESCRIPTIONS AND INSTRUCTIONS

0001 Routine Case (Track 1) Base Year – The vendor shall provide a fixed unit price to accomplish all task and work elements contained in the Performance Work Statement (PWS). The fixed unit price is inclusive of all direct and indirect labor costs and other costs associated with accomplishing all tasks and work elements contained in the Performance Work Statement.

0002 Complex Case (Track 2) Base Year - The vendor shall provide a fixed unit price to accomplish all task and work elements contained in the Performance Work Statement (PWS). The fixed unit price is inclusive of all direct and indirect labor costs and other costs associated with accomplishing all tasks and work elements contained in the Performance Work Statement.

0003 Performance Incentive – Base Year – CONTRACTOR WILL NOT PROPOSE PRICING FOR THIS CLIN; Pricing for this CLIN is contained in the Performance Work Statement

1001 Routine Case (Track 1) Option Year – The vendor shall provide a fixed unit price to accomplish all task and work elements contained in the Performance Work Statement (PWS). The firm fixed unit price is inclusive of all direct and indirect labor costs and other costs associated with accomplishing all tasks and work elements contained in the Performance Work Statement.

1002 Complex Case (Track 2) Option Year - The vendor shall provide a fixed unit price to accomplish all task and work elements contained in the Performance Work Statement (PWS). The fixed unit price is inclusive of all direct and indirect labor costs and other costs associated with accomplishing all tasks and work elements contained in the Performance Work Statement.

1003 Performance Incentive – Option Year – CONTRACTOR WILL NOT PROPOSE PRICING FOR THIS CLIN; Pricing for this CLIN is contained in the Performance Work Statement

PERIOD OF PERFORMANCE: The period of performance will be 365 days after acknowledgement of a Notice to Proceed issued by the Contracting Officer. The Notice to Proceed will be issued upon notification from Contractor that they are able to commence performance. The ability of the Contractor to commence performance is based upon having a significant portion of their workforce obtain USCIS Entry on Duty (EOD) suitability determinations as described in the Performance Work Statement.

Vendor shall provide pricing data and assumptions utilized to derive a fixed unit price. The pricing data and assumptions should contain the labor categories, number of labor hours and the labor rates for each labor category proposed and details outlining other direct costs necessary during the performance of tasks contained in the Performance Work Statement.

PART I

Description/Specifications

FREEDOM OF INFORMATION ACT BACKLOG ELIMINATION SUPPORT

PERFORMANCE WORK STATEMENT

1.0 BACKGROUND AND PURPOSE

1.1 Background

The Department of Homeland Security (DHS) United States Citizenship and Immigration Services (USCIS) Freedom of Information Act (FOIA)/Privacy Act (PA) Program is administered by National Security and Records Verification Directorate, Records Division, National Records Center (NRC). Through the FOIA/PA Program external customers are provided access to agency records in accordance with the applicable statutes.

The NRC processes the majority of the USCIS FOIA requests for information using the FOIA Information Processing System (FIPS), an automated image-based system. Agency records include but are not limited to the electronic records, Alien Files (A-Files), and Receipt Files. The majority of the FOIA requests are for information contained in the A-Files. Currently, a backlog of FOIA requests exists.

1.2 Purpose

The purpose of this contract is to eliminate the current FOIA backlog. The work consists of accessing pre-scanned images of the records containing the information requested in the FOIA/PA request, validating the requestor entitlement for the information requested, redacting information and applying exemptions as necessary, preparing the appropriate responses, and electronically submitting to the Government staff for approvals.

2.0 SCOPE

The scope of this contract is to provide support services to eliminate a backlog of 65,000 FOIA requests in compliance with 5 U.S.C. §552, FOIA, and 5 U.S.C. §552a, PA.

3.0 ABBREVIATIONS AND ACRONYMS

Appendix 1 provides a table that identifies abbreviations and related acronyms.

4.0 SPECIFIC TASKING

The Contractor shall perform the tasks as described below. The Government will provide the contractor with specific guidance, through the identification of Acceptable Quality Levels (AQLs) in the Performance Requirements Summary, on the priority and timeframes with which the contractor shall direct and manage its resources to accomplish these tasks. The Contractor shall manage the tasks in a manner that is beneficial, equitable, and cost-effective to the Government.

4.1 The Contractor shall perform all functions relating to reviewing the request for content and consent in FIPS, to include verifying the requestor information, the type of request, and ensuring the correct file was scanned.

4.2 The Contractor shall perform all functions relating to reviewing and processing the responsive record, to include redacting all portions of record that cannot be released to the requestor, identifying the correct exemptions used, and identifying documents or other items in a file that require special processing. Contractor shall not process any FOIA requests involving proprietary information of other offerors who took part in this procurement.

4.3 The Contractor shall perform all functions relating to modifying the template letter to prepare the final action letters.

5.0 PERFORMANCE REQUIREMENTS SUMMARY

5.1 The workload is divided into two categories, Routine (Track 1) cases; and Complex (Track 2) cases that normally necessitate additional search and review time. The estimated FOIA workload is 1,500 Routine (Track 1) cases and 63,500 Complex (Track 2) cases. The average size of the responsive records contained in FOIA/PA Information Processing System (FIPS) for Routine (Track 1) cases is 60 pages and Complex (Track 2) cases is 168 pages.

5.2 The average processing time for a Routine (Track 1) case is 45 minutes per case and for a Complex (Track

2) is 120 minutes per case.

5.3 Workload assignment. The FIPS program assigns cases in a first in first out (FIF0) based upon date of receipt. After completion of their case and submission to the case approver, the case processor will receive their next case assignment automatically through FIPS.

5.4 The Acceptable Quality Level (AQL) for cases submitted for review and approval is 95%, equating to an acceptable rejection rate of 5% based on the tasks outlined in paragraph 4, above.

5.5 The contractor shall maintain a monthly production goal of 3835 cases reviewed and approved.

5.6 Government employees shall confirm contractor case quality. Government Quality Assurance staff shall inspect 100% of the contractor’s FOIA/PA cases processed. At the case approval step in FIPS, the Quality Assurance personnel shall conduct inspections before providing final approval and signature. Casework shall be rejected and returned to the Contractor for correction, as needed, to conform to the FOIA/PA, appropriate FOIA/PA processing guidelines, and Executive Orders.

5.7 Cases submitted and returned to case processors as rejected shall be resubmitted no later than 2 business days from the rejection date and time, to the Government Quality Assurance personnel for approval.

5.8 The Contractor shall correct all deficiencies and resubmit the cases for approval.

5.9 Performance Incentives and Disincentives. The Acceptable Rejection Rate of cases submitted for review and approval to Government Quality Assurance personnel is 5%. For each case rejected above or below the Acceptable Rejection Rate of 5%, the Contractor will be rewarded an incentive at the rate of $10.00 per case above the Acceptable Rejection Rate during each rating period. The Contractor will be assessed a disincentive at the rate of $10.00 per case below the Acceptable Rejection Rate during each rating period.

5.10 Rating period is defined as 90 day of performance. The first rating period starts the 91st day of performance from the acknowledgement date of the Notice to Proceed issued by the Contracting Officer. Each subsequent rating period starts the day after the end of the proceeding rating period.

5.11 The rejection rate is established by calculating the number of cases submitted during a rating period against the number of cases approved during the rating period.

5.12 The incentive or disincentive fees will be reviewed and reconciled by the contractor and the COTR utilizing the monthly reports and productivity data extracted from FIPS. Upon reconciliation, the contractor and COTR mutually agree upon the incentive and/or disincentive fees, and the contractor will include the incentive or disincentive fees on their monthly invoice for the last month of the rating period. If a mutual agreement cannot be reached, the Contracting Officer will review data and make the final determination of the fees for that rating period.

6.0 DELIVERABLES

6.1 Schedule for Deliverables

Deliverable Expected Due Date

Monthly Status Report Within 5 business days of prior months end SOP’s 5 business days prior to full performance commencement Contractor Developed Materials Within 5 days of contract completion

6.2 Meet or exceed all established performance standards contained in Section 5, Performance Requirements Summary, above, during each rating period.

6.3 The Contractor shall develop Standard Operating Procedures (SOPs), as needed, to document their processes and provide reference information to their employees. The Contractor will submit to COTR for all necessary SOPs for review. The Contractor will submit any revision or updates to SOPs after initial submission to the COTR for review.

6.4 The Government will provide to Contractor personnel, a one time training course on the procedures, standards, automated systems, and documents associated to accomplish the task contained in this PWS. The Contractor is responsible to provide follow-on training to Contractor personnel not available (i.e. new hire’s, employees without EOD’s), in other words ‘Train the Trainer’. Additionally, the Government will provide training to Contractor personnel on newly acquired equipment, hardware, and software associated with FIPS operations and DHS proprietary systems, as needed. Follow-up training, as needed will be the Contractors responsibility.

6.5 Reporting Requirements:

Monthly status report shall outline accomplishments for the month for each task identified in the PWS, significant problems encountered and actions taken to resolve them and shall identify percent of task completed to date. The report shall identify such items as: number of cases processed; number of cases rejected; issues/problems encountered; resolution and/or recommendations to resolve said issues/problems;

and plans for the following reporting period and any other information as directed by the COTR.

6.6 All materials developed by the Contractor for use during the performance of this contract , that use Government provided data, shall become sole property of the Government. Materials include, but are not limited to:

Standard Operating Procedures; database programs; database products; spreadsheet programs; spreadsheet products;

search programs and products; Government business related training materials (e.g. training videos, orientation programs, manuals, etc.); studies; reports (e.g. on productivity, accuracy, etc.); quality analysis and data gathered.

ALL SUCH MATERIALS SHALL BE DELIVERED TO THE COTR WITHIN 5 DAYS OF COMPLETING

CONTRACT PERFORMANCE.

7.0 GOVERNMENT FURNISHED INFORMATION/EQUIPMENT

7.1 Government Furnished Information Technology

The Government will provide the Contractor with Federal Information Technology (IT) resources necessary to perform work at the NRC. These resources include office automation equipment. In addition, the Contractor will be allowed access (with appropriate security level access) to applications and automated IT systems. Automated IT systems to which the Contractor will have access, as needed, will include the following:

FOIA/PA Information Processing System (FIPS) Central Index System (CIS)

7.2 Government Furnished Equipment

USCIS will provide workspace with desks and other office furniture for up to 36 Contractor employees. The Government will furnish computer resources, telephones, computer terminals, custodial services, and equipment maintenance. The Government will provide maintenance and repairs on all government furnished equipment unless the maintenance or repairs are required because of Contractor misuse. The Contractor shall be responsible for replacing or repairing any Government furnished equipment/materials that is damaged due to negligence or if untrained personnel are allowed to operate equipment.

7.3 Government Furnished Training

The Contractor shall receive initial training in all USCIS-proprietary systems, as needed. This training will take place at the NRC by appropriate Government personnel. The schedule will be determined at the Kick-Off meeting.

Contractor personnel shall not load any programs or applications on Government-owned equipment. The Government will provide to Contractor personnel, a one time training course on the procedures, standards, automated systems, and documents associated to accomplish the task contained in this PWS. The Contractor is responsible to provide follow-on training to Contractor personnel not available (i.e. new hire’s, employees without EOD’s), in other words ‘Train the Trainer’. Additionally, the Government will provide training to Contractor personnel on newly acquired equipment, hardware, and software associated with FIPS operations and DHS proprietary systems, as needed. Follow-up training, as needed will be the Contractors responsibility.

7.4 Consumable Supplies/Administrative Supplies

The Government will supply all consumable and administrative supplies in a reasonable amount necessary to perform required tasks for this task order. The Contractor shall maintain and manage a sufficient level of identified supplies to perform job tasks. The Contractor shall be required to complete a G-514, supply requisition, to replenish supplies and submit the requisition to the COTR for approval. Lack of supplies will not exempt the contractor from performing tasks unless a work surge or other issues occur. A blank G-514 is attached at Part III.

7.5 Work Area Cleanliness

The Contractor shall keep assigned work area floors clear of debris such as paper clips, binder clips, acco-fasteners, rubber bands, routing slips, buck slips, paper, etc. The Contractor shall also be responsible for maintaining clean desktop surfaces and/or other work surfaces. This is to be completed daily.

8.0 CONTRACTOR FURNISHED INFORMATION

The Contractor shall provide the Government with applicable security information for all employees assigned to this Contract.

9.0 PERIOD OF PERFORMANCE

The period of performance for this contract is one year from the date of acknowledgement of the Notice to Proceed issued by the Contracting Officer and maybe extended upon exercising of the option period. The Contractor will have a 90 day phase in period from the acknowledgement date of the Notice to Proceed. The phase in period consists of employees with EOD’s attending and successfully completing the initial Government provided training, and the remaining time provides the contractor and it’s workforce the ability to obtain full performance capabilities prior to starting the incentive and disincentive portion of the performance standards.

10.0 PLACE OF PERFORMANCE

The Contractor shall perform the work at the USCIS National Records Center (NRC), 150 Space Center Loop, and Lee’s Summit, Missouri. Adequate free and open parking is available on a first come first serve basis. Due to the nature of the records being processed, off site work and telecommuting are not authorized. The NRC is an underground facility.

11.0 HOURS OF OPERATIONS

The Contractor shall perform work during the National Records Center normal hours of operations, 6:00 am to 11:30 pm, Monday through Friday, unless otherwise directed by Contacting Officer. All Federal Holidays are observed. The Contractor may elect to work multiple shifts during these normal work hours.

12.0 GOVERNMENT POINTS OF CONTACT

The Government’s points of contact will be identified in the contract award documents.

13.0 REFERENCES

DHS publications, handbooks, manuals, or regulations direct the performance of specific job duties and functions. These documents will be referenced throughout this document. The most current versions can be accessed at the web sites indicated below.

Freedom of Information Act, 5 U.S.C. §552: The federal statute that governs FOIA Program.

http://www.dhs.gov/xfoia/editorial_0318.shtm

Privacy Act, 5 U.S.C. §552a: The federal statute that governs PA Program.

Department of Justice Freedom of Information Act Guide: Contains an overview discussion of the FOIA exemptions, the law enforcement record exclusions, and the most important procedural aspects.

http://www.usdoj.gov/oip/foi-act.htm

Privacy Act Overview: Contains a discussion of the Privacy Act's disclosure prohibitions, its access and amendment provisions, and agency recordkeeping requirements. http://www.usdoj.gov/oip/04_7_1.html

FOIA/PA Information Processing System (FIPS) User Guide: The automated administrative and production system for responding to requests to USCIS for information under the FOIA/PA. Copy to be furnished after contract award.

Central Index System (CIS) Users Manual: Contains instructions on the use and functions of CIS. Copy to be furnished after contract award.

Information on USCIS’ FOIA/PA Program: Explains and answers questions concerning FOIA/PA.

http://www.uscis.gov/portal/site/uscis/menuitem.eb1d4c2a3e5b9ac89243c6a7543f6d1a/?vgnextoid=34139 c7755cb9010VgnVCM10000045f3d6a1RCRD&vgnextchannel=34139c7755cb9010VgnVCM10000045f3d6 a1RCRD

USCIS FOIA Handbook: A comprehensive FOIA/PA guide on how to process requests for access to

USCIS records. Copy to be furnished after contract award.

DHS Administrative Manuals and Guides: Applicable DHS Administrative Manuals and Guides to include the Security Officers Handbook will be available after contract award, as required.

http://www.dhs.gov/xfoia/editorial_0318.shtm http://www.usdoj.gov/oip/foi-act.htm http://www.usdoj.gov/oip/04_7_1.html http://www.uscis.gov/portal/site/uscis/menuitem.eb1d4c2a3e5b9ac89243c6a7543f6d1a/?vgnextoid=34139c7755cb9010VgnVCM10000045f3d6a1RCRD&vgnextchannel=34139c7755cb9010VgnVCM10000045f3d6a1RCRD http://www.uscis.gov/portal/site/uscis/menuitem.eb1d4c2a3e5b9ac89243c6a7543f6d1a/?vgnextoid=34139c7755cb9010VgnVCM10000045f3d6a1RCRD&vgnextchannel=34139c7755cb9010VgnVCM10000045f3d6a1RCRD http://www.uscis.gov/portal/site/uscis/menuitem.eb1d4c2a3e5b9ac89243c6a7543f6d1a/?vgnextoid=34139c7755cb9010VgnVCM10000045f3d6a1RCRD&vgnextchannel=34139c7755cb9010VgnVCM10000045f3d6a1RCRD

14.0 SECURITY REQUIREMENTS

14.1 GENERAL

U.S. Citizenship & Immigration Services (USCIS) has determined that performance of this contract requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor), have access to sensitive but unclassified information, and that the Contractor will adhere to paragraph 15.0, Security Requirement.

14.2 SUITABILITY DETERMINATION

USCIS shall have and exercise full control over granting, denying, withholding or terminating access of unescorted Contractor employees to government facilities and/or access of Contractor employees to sensitive but unclassified information, based upon the results of a background investigation. USCIS may, as it deems appropriate, authorize and make a favorable entry on duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment suitability authorization will follow as a result thereof. The granting of a favorable EOD decision or a full employment suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by USCIS, at any time during the term of the contract. No employee of the Contractor shall be allowed unescorted access to a USCIS facility without a favorable EOD decision or suitability determination by the Office of Security & Integrity

(OSI).

14.3 BACKGROUND INVESTIGATIONS

Contract employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive but unclassified information, shall undergo a position sensitivity analysis based on the duties, outlined in the Position Designation Determination (PDD) for Contractor Personnel, each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. All background investigations will be processed through OSI. Prospective Contractor employees shall submit the following completed forms to OSI through the COTR no less than 30 days before the starting date of the contract or 30 days prior to entry on duty of any employees, whether a replacement, addition, subcontractor employee, or vendor:

Standard Form 85P, “Questionnaire for Public Trust Positions”

DHS Form 11000-6, “Conditional Access to Sensitive But Unclassified Information Non- Disclosure Agreement”

FD Form 258, “Fingerprint Card” (2 copies)

Form DHS-11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

Position Designation Determination for Contract Personnel Form

Foreign National Relatives or Associates Statement

Required forms will be provided by USCIS at the time of award of the contract. Only complete packages will be accepted by OSI. Specific instructions on submission of packages will be provided upon award of the contract.

Be advised that unless an applicant requiring access to sensitive but unclassified information has resided in the US for three of the past five years, OSI may not be able to complete a satisfactory background investigation. In such cases, USCIS retains the right to deem an applicant as ineligible due to insufficient background information.

The use of Non-U.S. citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of this contract for any position that involves access to or development of any DHS IT system.

USCIS will consider only U.S. Citizens for employment on this contract. USCIS will not approve LPRs for employment on this contract in any position that requires the LPR to access or assist in the development, operation, management or maintenance of DHS IT systems. By signing this contract, the contractor agrees to this restriction. In those instances where other non-IT requirements contained in the contract can be met by using LPRs, those requirements shall be clearly described.

14.4 EMPLOYMENT ELIGIBILITY

The Contractor must agree that each employee working on this contract will have a Social Security Card issued and approved by the Social Security Administration. The Contractor shall be responsible to USCIS for acts and omissions of his own employees and for any Subcontractor(s) and their employees to include financial responsibility for all damage or injury to persons or property resulting from the acts or omissions of the contractor's employees.

Subject to existing law, regulations and/ or other provisions of this contract, illegal or undocumented aliens will not be employed by the Contractor, or with this contract. The Contractor will ensure that this provision is expressly incorporated into any and all Subcontracts or subordinate agreements issued in support of this contract.

14.5 CONTINUED ELIGIBILITY

If a prospective employee is found to be ineligible for access to USCIS facilities or information, the COTR will advise the Contractor that the employee shall not continue to work or to be assigned to work under the contract.

USCIS reserves the right and prerogative to deny and/ or restrict the facility and information access of any Contractor employee whose actions are in conflict with the standards of conduct, 5 CFR 2635 and 5 CFR 3801, or whom USCIS determines to present a risk of compromising sensitive but unclassified information to which he or she would have access under this contract.

The Contractor will report any adverse information coming to their attention concerning contract employees under the contract to USCIS OSI. The subsequent termination of employment of an employee does not obviate the requirement to submit this report. The report shall include the employees’ name and social security number, along with the adverse information being reported.

OSI must be notified of all terminations/ resignations within five days of occurrence. The Contractor will return any expired USCIS issued identification cards and building passes, or those of terminated employees to the COTR. If an identification card or building pass is not available to be returned, a report must be submitted to the COTR, referencing the pass or card number, name of individual to whom issued, the last known location and disposition of the pass or card.

14.6 SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OSI through the COTR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COTR and OSI shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COTR determine that the Contractor is not complying with the security requirements of this contract; the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

14.7 COMPUTER AND TELECOMMUNICATIONS SECURITY REQUIREMENTS

Security Program Background The DHS has established a department wide IT security program based on the following Executive Orders (EO), public laws, and national policy:

Public Law 107-296, Homeland Security Act of 2002.

Federal Information Security Management Act (FISMA) of 2002, November 25, 2002.

Public Law 104-106, Clinger-Cohen Act of 1996 [formerly, Information Technology Management

Reform Act (ITMRA)], February 10, 1996.

Privacy Act of 1974, As Amended. 5 United States Code (U.S.C.) 552a, Public Law 93-579, Washington, D.C., July 14, 1987.

Executive Order 12829, National Industrial Security Program, January 6, 1993.

Executive Order 12958, Classified National Security Information, as amended.

Executive Order 12968, Access to Classified Information, August 2, 1995.

Executive Order 13231, Critical Infrastructure Protection in the Information Age, October 16, 2001.

National Industrial Security Program Operating Manual (NISPOM), February 2001.

DHS Sensitive Systems Policy Publication 4300A v2.1, July 26, 2004 DHS National Security Systems Policy Publication 4300B v2.1, July 26, 2004

Homeland Security Presidential Directive 7, Critical Infrastructure Identification, Prioritization, and Protection, December 17, 2003.

Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources.

National Security Directive (NSD) 42, National Policy for the Security of National Security Telecommunications and Information Systems (U), July 5, 1990, CONFIDENTIAL.

5 Code of Federal Regulations (CFR) §2635, Office of Government Ethics, Standards of Ethical Conduct for Employees of the Executive Branch.

DHS SCG OS-002 (IT), National Security IT Systems Certification & Accreditation, March 2004.

Department of State 12 Foreign Affairs Manual (FAM) 600, Information Security

Technology, June 22, 2000.

Department of State 12 FAM 500, Information Security, October 1, 1999.

Executive Order 12472, Assignment of National Security and Emergency Preparedness

Telecommunications Functions, dated April 3, 1984.

Presidential Decision Directive 67, Enduring Constitutional Government and Continuity of

Government Operations, dated October 21, 1998.

FEMA Federal Preparedness Circular 65, Federal Executive Branch Continuity of Operations

(COOP), dated July 26, 1999.

FEMA Federal Preparedness Circular 66, Test, Training and Exercise (TT&E) for Continuity of

Operations (COOP), dated April 30, 2001.

FEMA Federal Preparedness Circular 67, Acquisition of Alternate Facilities for Continuity of

Operations, dated April 30, 2001.

Title 36 Code of Federal Regulations 1236, Management of Vital Records, revised as of July 1, 2000.

National Institute of Standards and Technology (NIST) Special Publications for computer security and FISMA compliance.

14.8 GENERAL

Due to the sensitive nature of USCIS information, the contractor is required to develop and maintain a comprehensive Computer and Telecommunications Security Program to address the integrity, confidentiality, and availability of sensitive but unclassified (SBU) information during collection, storage, transmission, and disposal. The contractor’s security program shall adhere to the requirements set forth in the DHS Management Directive 4300 IT Systems Security Pub Volume 1 Part A and DHS Management Directive 4300 IT Systems Security Pub Volume I Part B. This shall include conformance with the DHS

Sensitive Systems Handbook, DHS Management Directive 11042 Safeguarding Sensitive but Unclassified (For Official Use Only) Information and other DHS or USCIS guidelines and directives regarding information security requirements. The contractor shall establish a working relationship with the USCIS IT Security Office, headed by the Information Systems Security Program Manager (ISSM).

14.9 IT SYSTEMS SECURITY

In accordance with DHS Management Directive 4300.1 “Information Technology Systems Security”, USCIS Contractors shall ensure that all employees with access to USCIS IT Systems are in compliance with the requirement of this Management Directive. Specifically, all contractor employees with access to USCIS IT Systems meet the requirement for successfully completing the annual “Computer Security Awareness Training (CSAT).” All contractor employees are required to complete the training within 60-days from the date of entry on duty (EOD) and are required to complete the training yearly thereafter.

CSAT can be accessed at the following: http://otcd.uscis.dhs.gov/EDvantage.Default.asp or via remote access from a CD which can be obtained by contacting uscisitsecurity@dhs.gov.

14.10 IT SECURITY IN THE SYSTEMS DEVELOPMENT LIFE CYCLE (SDLC)

The USCIS SDLC Manual documents all system activities required for the development, operation, and disposition of IT security systems. Required systems analysis, deliverables, and security activities are identified in the SDLC manual by lifecycle phase. The contractor shall assist the appropriate USCIS ISSO with development and completion of all SDLC activities and deliverables contained in the SDLC. The SDLC is supplemented with information from DHS and USCIS Policies and procedures as well as the National Institute of Standards Special Procedures related to computer security and FISMA compliance.

These activities include development of the following documents:

Sensitive System Security Plan (SSSP): This is the primary reference that describes system sensitivity, criticality, security controls, policies, and procedures. The SSSP shall be based upon the completion of the DHS FIPS 199 workbook to categorize the system of application and completion of the RMS Questionnaire. The SSSP shall be completed as part of the System or Release Definition Process in the SDLC and shall not be waived or tailored.

Privacy Impact Assessment (PIA) and System of Records Notification (SORN). For each new development activity, each incremental system update, or system recertification, a PIA and SORN shall be evaluated. If the system (or modification) triggers a PIA the contractor shall support the development of PIA and SORN as required. The Privacy Act of 1974 requires the PIA and shall be part of the SDLC process performed at either System or Release Definition.

Contingency Plan (CP): This plan describes the steps to be taken to ensure that an automated system or facility can be recovered from service disruptions in the event of emergencies and/or disasters. The Contractor shall support annual contingency plan testing and shall provide a Contingency Plan Test Results Report.

Security Test and Evaluation (ST&E): This document evaluates each security control and countermeasure to verify operation in the manner intended. Test parameters are established based on results of the RA. An ST&E shall be conducted for each Major Application and each General Support System as part of the certification process. The Contractor shall support this process.

Risk Assessment (RA): This document identifies threats and vulnerabilities, assesses the impacts of the threats, evaluates in-place countermeasures, and identifies additional countermeasures necessary to ensure an acceptable level of security. The RA shall be completed after completing the NIST 800-53 evaluation, Contingency Plan Testing, and the ST&E. Identified weakness shall be documented in a Plan of Action and Milestone (POA&M) in the USCIS Trusted Agent FISMA (TAF) tool. Each POA&M entry shall identify the cost of mitigating the weakness and the schedule for mitigating the weakness, as well as a POC for the mitigation efforts.

http://otcd.uscis.dhs.gov/EDvantage.Default.asp

Certification and Accreditation (C&A): This program establishes the extent to which a particular design and implementation of an automated system and the facilities housing that system meet a specified set of security requirements, based on the RA of security features and other technical requirements (certification), and the management authorization and approval of a system to process sensitive but unclassified information (accreditation). As appropriate the Contractor shall be granted access to the USCIS TAF and Risk Management System (RMS) tools to support C&A and its annual assessment requirements. Annual assessment activities shall include completion of the NIST 800-26 Self Assessment in TAF, annual review of user accounts, and annual review of the FIPS categorization. C&A status shall be reviewed for each incremental system update and a new full C&A process completed when a major system revision is anticipated.

14.11 SECURITY ASSURANCES

DHS Management Directives 4300 requires compliance with standards set forth by NIST, for evaluating computer systems used for processing SBU information. The Contractor shall ensure that requirements are allocated in the functional requirements and system design documents to security requirements are based on the DHS policy, NIST standards and applicable legislation and regulatory requirements. Systems shall offer the following visible security features:

User Identification and Authentication (I&A) – I&A is the process of telling a system the identity of a subject (for example, a user) (I) and providing that the subject is who it claims to be (A). Systems shall be designed so that the identity of each user shall be established prior to authorizing system access, each system user shall have his/her own user ID and password, and each user is authenticated before access is permitted. All system and database administrative users shall have strong authentication, with passwords that shall conform to established DHS standards. All USCIS Identification and Authentication shall be done using the Password Issuance Control System (PICS) or its successor. Under no circumstances will Identification and Authentication be performed by other than the USCIS standard system in use at the time of a systems development.

Discretionary Access Control (DAC) – DAC is a DHS access policy that restricts access to system objects (for example, files, directories, devices) based on the identity of the users and/or groups to which they belong. All system files shall be protected by a secondary access control measure.

Object Reuse – Object Reuse is the reassignment to a subject (for example, user) of a medium that previously contained an object (for example, file). Systems that use memory to temporarily store user I&A information and any other SBU information shall be cleared before reallocation.

Audit – DHS systems shall provide facilities for transaction auditing, which is the examination of a set of chronological records that provide evidence of system and user activity. Evidence of active review of audit logs shall be provided to the USCIS IT Security Office on a monthly basis, identifying all security findings including failed log in attempts, attempts to access restricted information, and password change activity.

Banner Pages – DHS systems shall provide appropriate security banners at start up identifying the system or application as being a Government asset and subject to government laws and regulations. This requirement does not apply to public facing internet pages, but shall apply to intranet applications.

14.12 DATA SECURITY

SBU systems shall be protected from unauthorized access, modification, and denial of service. The Contractor shall ensure that all aspects of data security requirements (i.e., confidentiality, integrity, and availability) are included in the functional requirements and system design, and ensure that they meet the minimum requirements as set forth in the DHS Sensitive Systems Handbook and USCIS policies and procedures. These requirements include:

Integrity – The computer systems used for processing SBU shall have data integrity controls to ensure that data is not modified (intentionally or unintentionally) or repudiated by either the sender or the receiver of the information. A risk analysis and vulnerability assessment shall be performed to determine what type of data integrity controls (e.g., cyclical redundancy checks, message authentication codes, security hash functions, and digital signatures, etc.) shall be used.

Confidentiality – Controls shall be included to ensure that SBU information collected, stored, and transmitted by the system is protected against compromise. A risk analysis and vulnerability assessment shall be performed to determine if threats to the SBU exist. If it exists, data encryption shall be used to mitigate such threats.

Availability – Controls shall be included to ensure that the system is continuously working and all services are fully available within a timeframe commensurate with the availability needs of the user community and the criticality of the information processed.

Data Labeling. – The contractor shall ensure that documents and media are labeled consistent with the DHS Sensitive Systems Handbook.

APPENDIX 1

ABBREVIATIONS AND ACRONYMS

TERM DEFINITION

5 U.S.C. §552 The Freedom of Information Act 5 U.S.C. §552a The Privacy Act Acceptable Quality Level The definition of the minimum standard that must be met before the government will accept a task/service from a contractor A-Files Alien File. A series of records, regardless of medium, consisting of numbered files prefixed with an “A” that are used to document the process or history of an applicant for immigration, an immigrant, or a person who broke immigration law. The Alien File contains all documentation relating to a given individual, identified by the A-number.

Note: Non-Immigrant aliens do not have A-files.

Alien Any person not a citizen or national of the United States.

A-Number A number assigned to the individual at the time an A-File is created or a record is created in CIS.

AQL See Acceptable Quality Level Central Index System A large, centralized database containing summary data about the existence and status of most aliens known to the DHS, the location of their A-Files, and the location of other information pertaining to an alien in other mission-orient databases.

CIS See Central Index System CFR Code of Federal Regulations Classified Information Any information that has been determined, pursuant to Executive Order 12356 or any predecessor order, to require protection against unauthorized disclosure. The classifications TOP SECRET, SECRET, and CONFIDENTIAL are used to classify such information.

CLIN Contract Line Item Contracting Officer’s Technical Representative

A USCIS representative that functions as a liaison between the contractor and USCIS.

COTR See Contracting Officer’s Technical Representative.

Data A specific form of information; sets of individual facts DHS Department of Homeland Security Document Recorded information, regardless of physical form or characteristics and is often used interchangeably with “Record.”

EOD Entry on duty Exemption The specific legal reason a portion of a record cannot be released.

FIPS FOIA/PA Information Processing System A computer system used to track, electronically process, and prepare the necessary documents and reports for FOIA/PA.

File (1) Usually an accumulation of records or non-record material arranged according to a plan. Sometimes an accumulation of personal papers so arranged. (2) A unit, such as a folder, microform, or electronic medium, containing such records, non-record material, or personal papers.

FOIA The Freedom of Information Act FOIA Backlog FOIA requests that are over 20 days old.

FOIA/PA Information Processing System

See FIPS

Immigrant Any alien in the United States, except one legally admitted under specific nonimmigrant categories (INA section 101(a) (15)). An illegal alien who entered the United States without inspection, for example, would be strictly defined as an immigrant under the INA but is not a permanent resident alien. Lawful permanent residents are legally accorded the privilege of residing permanently in the United States.

They may be issued immigrant visas by the Department of State overseas or adjusted to permanent resident status by the Immigration and Naturalization Service in the United States.

ISSO Information System Security Officer IT Information Technology Legal Permanent Resident Status of having been lawfully accorded the privilege of residing and working permanently in the US as an immigrant in accordance with the immigration laws.

LPR See Legal Permanent Resident.

National Records Center See NRC Non-Record Government-owned documentary materials that do not meet the conditions of record status or that are specifically excluded from status as records by statute NRC National Records Center. A national facility for the low-cost storage and servicing of

DHS Records ODC Other Direct Costs OSI Office of Security & Integrity PA The Privacy Act PAS Performance Analysis System

A computer program used to capture workload information.

Records All books, papers, maps, photographs, machine-readable materials, or other documentary materials regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal…