SOW_-_FINAL_09-05-2017.docx

STATEMENT OF WORK

United States Citizenship and Immigration Services National Record Center CIPP/G Training

1 Background.

The USCIS National Records Center (NRC) has a requirement to train employees in preparation for certification as a Certified Information Privacy Professional/Government (CIPP/G) as recognized by the International Association of Privacy Professionals (IAPP). This training should cover the Body of Knowledge for CIPP/G.

2 Scope.

The contractor will provide a CIPP/G qualified instructor to teach Certification Foundation and CIPP/G Training. In addition, contractor will administer the CIPP/G certification test by providing an IAPP approved proctor. The contractor shall provide all necessary personnel, equipment, materials and services necessary to perform the course of instruction and administer the IAPP test for CIPP/G certification.

3 Period of Performance.

The full period of performance for this contract is will be 5 years. One base year and four option years. Training and testing will be held during regular work hours, Monday through Friday, 8 am – 4 pm with a one hour break for lunch.

4 Place of Performance.

All training and testing will be conducted at the USCIS National Records Center located in Lee’s Summit, Missouri.

5 Training Topics/Modules:

5.1 Certification Foundation Training:

Module 1: Privacy Definitions and Principles which introduces definitions of privacy and PII, explains the importance of privacy as a core value in U.S. society, reviews the FIPPs, and compares and contrasts information privacy and information security.

Module 2: OMB Circular A-130 Core Concepts which explains the purpose of the Federal Privacy Council, describes the duties of the SAOP, reviews general requirements of agency privacy programs, summarizes the concepts and practice of continuous monitoring and describes agency responsibilities for employee and contractor training and accountability.

Module 3: The Privacy Act of 1974 which reviews the major purpose and policy objectives of the Privacy Act of 1974, to whom it applies and whom it protects, as well as which agencies are exempt from specific provisions of the Act; describes the intention of systems of records and systems of records notices; summarizes the benefits of computer matching programs and the privacy protections built into them; reviews the civil remedies and criminal penalties for Privacy Act violations.

Module 4: U.S. Constitutional Issues which describes the Fourth Amendment and the related questions used to evaluate whether an individual’s rights under this amendment have been violated; reviews the concept of third-party doctrine; reviews the Stored Communications Act.

5.2 CIPP/G Training:

Module 1: The E-Government Act of 2002 which reviews the purpose and policy objectives of the E-Government Act of 2002; provides the definition of a PIA, describes when to conduct one and, at a high level, what information needs to be included; describes website privacy policy requirements and content for agency-facing public websites; outlines appropriate agency uses for, and how to communicate privacy protections when working with, third-party websites and applications (TPWA).

Module 2: Other U.S. Government Privacy Laws which explains the implications of the Federal Information Security Management Act (FISMA) for federal agencies; describes key responsibilities of federal agencies as a result of several U.S. government privacy laws, including: the Paperwork Reduction Act, Data Quality Act, Federal Agency Data Mining Reporting Act, Federal Records Act, Controlled Unclassified Information (CUI) Office Notice, and Cybersecurity Information Sharing Act (CISA); describes the objective of federal open meetings laws.

Module 3: Risk Management and Incident Response which reviews the various NIST publications and OMB memoranda that govern risk management of privacy and security in government systems, as well as the Fair Information Practice Principles (FIPPs) underlying these standards; describes agency requirements for tracking and documenting breach response activities, according to OMB M-17- 12; explains the difference between incidents and breaches; introduces the three privacy engineering objectives outlined in NISTIR 8062, “An Introduction to Privacy Engineering and Risk Management in Federal Systems.”

Module 4: Other U.S. Government Privacy Practices Describes the rights granted by the Freedom of Information Act (FOIA) of 1966, as well as several exceptions to the act and the purpose of institutional review boards (IRBs); reviews the privacy-related requirements set forth by OMB M-17-06, “Policies for Federal Agency Public Websites and Digital Services.”; explains privacy safeguards that agencies should put into place when working with contractors and third parties.

Module 5: Laws Affecting Both the Public and Private Sectors which identifies the privacy-related components of laws related to protected health information (PHI); describes the major points of laws relating to intelligence and homeland security; explains the significant differences, from a privacy perspective, between the USA PATRIOT Act and the USA FREEDOM Act, reviews federal government aspects of privacy-related laws in the financial and communications sectors.

Module 6: Guidance and Reporting Summary

5.3 Exam:

5.3.1 Administer on-site IAPP Certified Information Privacy Professional / Government certification exam with an IAPP approved proctor.

5.3.2 Course test and scheduling will be confirmed not less than 60 days prior to course start date.

5.4 The base class size will be structured for 10 students.

6.0 Government furnished materials and services.

6.1 Government will provide training room with audio visual capabilities.

7.0 Contractor furnished materials, equipment and responsibilities.

7.1 Training provided by the contractor shall be based on the revised CIPP/G Common Body of Knowledge referred to on the IAPP website.

8.0 DELIVERABLES:

1. The Contractor shall provide all submittals specified in the deliverable table for review and acceptance.

2. Unless otherwise specified, the Government will have ten (10) business days to review and provide comments to the Contractor prior to acceptance of all deliverables. The COR will review the submittal and notify the contractor if it is rejected or accepted.

3. The government has the right to reject or require corrections of any deficiencies. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection.

4. The Contractor shall have an opportunity to correct the rejected deliverable. The Contractor must respond with corrections within ten (10) business days after receipt of Government comments.

5. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying that the deliverable has been accepted.

6. Class Materials will include Ten text books: U.S. Government Privacy: Essential Policies and Practices for Privacy Professionals, Second Edition (or newer) and Ten Principles of Privacy in the U.S. Government: Participant Guide. Both published by International Association of Privacy Profession available at www.privacyassociation.org.

7. Rosters of students attendance

8. Certificates for each student

9.0 Security

All security shall be in accordance with the security attachment.

Employee Identification Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee's photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

10.0 Travel

All travel shall be included in the cost per class price.

11.0 Instructor Qualifications

The contractor shall provide specialized instructors who are CIPP/G certified with experience, education, & certification that qualify them to instruct and advise students. .

1. Working Experience: Minimum of two (2) years working in government or private industry delivering certification testing courses. .

1. Minimum of a Bachelor’s degree.