RFP_Attachment_E_CRADA_TSA_Pre_Check_Expansion.pdf

RFP Attachment E

COOPERATIVE RESEARCH AND DEVELOPMENT AGREEMENT

(CRADA)

Offeror’s Name and

THE DEPARTMENT OF HOMELAND SECURITY,

Homeland Security Advanced Research Projects Agency (HSARPA)

Synopsis

This Cooperative Research and Development Agreement (CRADA), dated __ December 2015 is entered into by and between [Offeror’s Name] (hereinafter “Offeror”), and the United States of America, as represented by the HSARPA, a Federal Laboratory within the Department of Homeland Security (DHS)/Science and Technology Directorate (S&T), (individually, a “Party” and, collectively the “Parties”).

The HSARPA will collaborate with Offeror under this CRADA (also referred to the “Agreement”) to evaluate proposed screening and identity algorithm(s) and data as authorized by the Transportation Security Administration (“TSA”), and as expressed in the Statement of Work (“SOW”), Appendix A of this Agreement. The Offeror as authorized by TSA shall have access to TSA provided data, including but not limited to PII, sensitive security information (“SSI”), sensitive but unclassified (“SBU”), and critical infrastructure information (“CII”) (collectively referred to as “Restricted Access Data”). There are special requirements for access to and handling of such Restricted Rights Data, set forth in the Articles below and Appendix A of the Agreement. The work will be performed under the supervision of Stephen Dennis, Innovation Director, for HSARPA, who is responsible for HSARPA’s scientific and technical conduct of this project.

Article 1. Authority

This Agreement is entered into pursuant to the authority contained in 15 U.S.C. § 3710a, Stevenson-Wydler Technology Innovation Act of 1980, as amended;

Article 2. Definitions

2.1 “Agreement” means this Cooperative Research and Development Agreement or “CRADA”. “CRADA” means any agreement between one or more Federal laboratories and one or more non-Federal parties under which the Government, through its laboratories, provides personnel, services, facilities, equipment, Intellectual Property, or other resources with or without reimbursement (BUT NOT FUNDS TO NON-FEDERAL PARTIES) and the non-Federal parties provide funds, personnel, services, facilities, equipment, Intellectual Property, or other resources toward the conduct of specified research, development or related efforts which are consistent with the mission of the laboratory; except that such term does not include a procurement contract or cooperative agreement as those terms are used in §§ 6303, 6304, and 6305 of Title 31. See 15 U.S.C. § 3710a(d)(1).

2.2 “Background” when used in connection with any form of Intellectual Property means that the form of Intellectual Property was not Made under this CRADA.

2.3 “Cooperative Research and Development Program” means the research and development work expressed in Article 5, General Obligation of the Parties, of this Agreement.

2.4 “Copyright” means any original works of authorship fixed in any tangible medium of expression protected under the Copyright Act, as amended. Works of authorship include the following categories: (1) literary works;(2) musical works, including any accompanying words;(3) dramatic works, including any accompanying music;(4) pantomimes and choreographic works;(5) pictorial, graphic, and sculptural works;(6) motion pictures and other audiovisual works;(7) sound recordings; and (8) architectural works.

2.5 “Data” means all recorded information of any kind regardless of the form or method of the recording, including computer software.

2.6 “Data Rights” means the rights in any recorded information, regardless of form or the media on which it may be recorded. The term includes rights in technical data and computer software. The term does not include rights in information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

2.7 “Effective Date” means the date on which the Director of the HSARPA signs the Agreement following the signing of the Agreement by the Offeror.

2.8 “Foreground ” when used in connection with any form of Intellectual Property means that the form of Intellectual Property was Made under this CRADA regardless of form or type, including that of a proprietary, scientific, technical, business, or financial nature, whether or not subject to Intellectual Property protections, but excluding any Background.

2.9 “Generated Information” means Information produced in the performance of this CRADA. The term “Generated Information” will also include “Data” as defined under this CRADA.

2.10 ”Information” is anything recognized as being contained in a record subject to the Freedom of Information Act under 5 USC 552(b)

2.11 “Invention” means any invention or discovery that is or may be patentable or otherwise protected under Title 35 of the United States Code or any novel variety of plant, which is or may be protectable under the Plant Variety Protection Act (7 U.S.C. § 7321 et seq.).

2.12 “Made” in relation to any Subject Invention means the conception or first actual reduction to practice of such Subject Invention.

2.13 “Proprietary Data” means data, which embodies trade secrets or which:

a) is not generally known, or is not available from other sources without obligations restricting its disclosure;

b) is not been made available by the owners to others without obligation restricting its disclosure;

c) is not described in an issued patent or a published copyrighted work or is not otherwise available to the public without obligation restricting its disclosure; or

d) can be withheld from disclosure under 15 U.S.C. § 3710a(c)(7)(A) & (B) and the Freedom of Information Act, 5 U.S.C. § 552 et seq.; or

e) is identified as such by labels or markings designating the information as proprietary; or

f) has not been developed independently by persons who have had no access to the information.

2.14 “Proprietary Information” means Information which embodies (i) trade secrets or (ii) commercial or financial information which is privileged or confidential under the Freedom of Information Act (5 U.S.C. 552 (b)(4)), either of which is developed at private expense outside of this CRADA and which is marked as Proprietary Information.

2.15 “Protected CRADA Information” means Generated Information which is marked as being Protected CRADA Information by a Party to this CRADA and which would have been Proprietary Information had it been obtained from a non- Federal entity.

2.16 “Participant” means a support services contractor assisting the Government in its performance of this CRADA or a contractor designated by Offeror as assisting Offeror in performance of this CRADA.

2.17 “Restricted Rights Data” means Government provided data that is restricted from disclosure, including but not limited to personally identifying information

(“PII”), sensitive security information (“SSI”), sensitive but unclassified information (“SBU”), and critical infrastructure information (“CII”).

2.18 “Special Purpose License” means a limited license to the Government conveying a nonexclusive, nontransferable, irrevocable, worldwide, royalty-free license to practice and have practiced an Invention for or on behalf of the Government for research or other government purposes and conveying a limited nonexclusive, nontransferable, irrevocable, worldwide, royalty-free license to use, duplicate, prepare derivative works, distribute or disclose copyrighted works or Proprietary Information in whole or in part and in any manner, and to have or permit others to do so, for research or other government purposes. Research or other government purposes include competitive procurement, but do not include the right to have or permit others to practice an Subject Invention or use, duplicate, prepare derivative works, distribute or disclose copyrighted works or Proprietary Information for commercial purposes.

2.19 “Subject Data” means that Data first recorded in the performance of the Cooperative Research and Development Program.

2.20 “Subject Invention” means any Invention Made in the performance of work under this Agreement. For clarity, excluded from Subject Inventions are any refinements, improvements, modifications, alternation or change to the Offeror’s Background Information.

2.21 “Trademarks” means any word, design, or visual identity as defined under the Lanham Act, as amended, or under common law associated with or developed under this Agreement.

2.22 “Government” means the Federal Government of the United States of America and agencies thereof.

2.23 “Intellectual Property” means patents, copyrights, Trademarks, mask works, and other forms of comparable property rights protected by federal, and state laws and foreign counterparts.

Article 3. Government Policies for Handling and Use of Restricted Access Data.

3.1 TSA shall provide the Offeror, Restricted Access Data and Offeror shall protect such Restricted Access Data in according to DHS and TSA security policies and mandates. However, before Restricted Access Data can be provided to Offeror, Offeror must provide assurances that all its support personnel will understand and rigorously follow DHS and TSA requirements, policies, and procedures for safeguarding SSI and PII.

3.2 The Offeror shall ensure that its employees and subcontractors shall execute a DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement

(“NDA”) prior to receiving access to Restricted Access Information and as a condition of access to such Restricted Access Information.

3.3 The Offeror shall comply with DHS and TSA technical, management and operational security controls requirements and policies, set forth in DHS 4300A, “Sensitive Systems Handbook Incident Response and Reporting”; TSA MD 1400 Series, “Information Assurance Handbook and Technical Standards” based on NIST Special Publication (SP) 800-53, rev 4; NIST SP 800-88, “Guidelines for Media Sanitization”; and TSA MD 3700.4 for “Handling Sensitive Personally Identifiable Information” (current version).

3.4 The Offeror’s shall be responsible for the security of all Restricted Access Data that is: (i) generated by the Offeror on behalf of TSA; (ii) transmitted by the Offeror, and, (iii) otherwise received, stored, or processed by the Offeror regardless of who owns or controls the underlying systems while that data is under the Offeror’s control.

3.5 The Offeror shall maintain data control according to the TSA security level of the data. Data separation shall include the use of discretionary access control methods, VPN encryption methods, data aggregation controls, data tagging, media marking, backup actions, and data disaster planning and recovery.

3.6 The Offeror shall comply with request by HSARPA and TSA to be audited for compliance with DHS and TSA technical, management and operational security controls requirements and policies. Upon receipt of an audit request from HSARPA or TSA, the Offeror shall provide a response within three (3) business days containing the requested data, information, and analysis as may be required by TSA Information Assurance and Cyber Security Division.

3.7 HSARPA or TSA may elect to conduct random periodic reviews of the Offerors facility and system to ensure that the security requirements in this CRADA are being appropriately implemented and enforced. If a review is initiated, the Offeror shall afford HSARPA, TSA, the Office of the Inspector General, and other authorized Government organization access to Offeror’s facilities, installation, operations, documentation, databases, and personnel used in performance of the

CRADA.

3.8 With respect to transmitting of Restricted Access Data, the Offeror shall ensure its IT system transmitting Restricted Access Data is encrypted. The following methods are acceptable for encrypting sensitive information:

1. FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2. (current version)

2. National Security Agency (NSA) Type 2 or Type 1 encryption. (current version)

3. Public Key Infrastructure (PKI)

3.9 Data Stored/Processed at Offeror Site. Any storage of Restricted Access

Data must be contained within the resources allocated by the Offeror to support TSA and may not be on systems that are shared with other commercial or government clients. TSA prohibits duplication of data provided for purposes outlined in the CRADA.

3.10 Disposition of Restricted Access Data. The Offeror must return all Restricted Access Data and IT resources provided to it by the TSA upon completion of this CRADA. The Offeror shall also provide a certification that all assets containing or used to process Restricted Access Data have been sanitized in accordance with the TSA MD 1400.3, TSA Information Assurance Handbook and Technical Standards and the NIST Special Publication 800-88, Guidelines for Media Sanitization.

Article 4. Security Information Incident Reporting.

4.1 The Offeror shall report all known and suspected sensitive information incidents to HSARPA and to TSA Security Operations Center (“SOC”) within one hour of discovery of the incident as required by DHS 4300A and detailed in Appendix A.

4.2 The Offeror reporting of a security information incident shall include data elements identified in Appendix A.

4.3 The Offeror shall provide full access and cooperation for all activities determined by HSARPA and TSA to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

Article 5. General Obligation of the Parties.

The cooperative research and development program performed under this Agreement shall be performed in accordance with the Statement of Work (SOW), in Appendix A. The utilization of the HSARPA’s personnel, resources, facilities, equipment, skills, know-how, computer software and information will be consistent with its own policies, missions, and requirements. It is understood that the nature of this cooperative research is such that completion within the period of performance specified, or within the limits of financial support allocated, cannot be guaranteed. Accordingly, it is agreed that all cooperative research is to be performed on a best efforts basis. Any modifications to the SOW shall be by mutual agreement between the Parties and shall be incorporated into this Agreement by a formally executed written amendment.

Article 6. Review of Work.

Periodic conferences and meetings may be held between personnel of the HSARPA and Offeror for the purpose of reviewing the progress of work defined in the SOW.

Article 7. Government Contractors.

If HSARPA wishes to utilize a contractor to perform work under this Agreement, HSARPA shall provide Offeror a minimum of thirty (30) days advance notice prior to utilizing a contractor to perform such work. Offeror shall raise any objection that it may have to any HSARPA proposed contractor within ten (10) days after receipt of any such notice. Offeror shall have the right to object to the disclosure of Offeror’s Proprietary Data and/or Proprietary Information to a competitor.

Article 8. Reports

All reporting requirements, if any, shall be specified in Appendix A.

Article 9. Funding

All funding requirements, if any, shall be specified in Appendix A.

Article 10. Term

The term of this Agreement is for a period no more than 12 months commencing on the Effective Date of this Agreement, unless modified pursuant to Article 18.

Article 11. Furnished Equipment

Under this Agreement, each Party may provide equipment to the other Party for purposes of joint research, development, test, and evaluation (RDTE). All furnished equipment intended for use under this Agreement will be listed in Appendix B.

Article 12. Prohibition on Endorsement

Neither the HSARPA nor DHS, directly or indirectly, endorses any product or service provided, or to be provided, by Offeror, its successors, assignees, or licensees. Offeror shall not in any way imply that this Agreement is an endorsement by the HSARPA, TSA, DHS or the United States Government of any such product or service.

Article 13. Handling of Information and Data

13.1 Nondisclosure. HSARPA and Offeror agree not to disclose, in any manner, Information or Data including anything restricted as proprietary, classified, controlled unclassified information, sensitive but unclassified, for official use only, Restricted Access Data, or otherwise controlled by federal law without receiving written prior approval by the other party.

13.2 Publication of Information or Data. Neither Party shall not publish, permit to be published, or distribute for public release and consumption, any Information or

Data, oral or written, produced or used in connection with this Agreement without the prior written consent of the other Party. All requests for release, publication, or distribution shall include an electronic copy or printed copy of the proposed Information or Data and shall be submitted, if by Offeror, to the recipient Principal Investigator (PI) and DHS S&T Technology Transfer Program Manager, or if by HSARPA, to Offeror’s notice recipient set forth in this Agreement below, at least 30 days in advance of any expected publication date.

13.3 Applicability of the Freedom of Information Act (FOIA), 5 U.S.C.§ 552(b).

Under this Agreement, the Government shall not disclose any Offeror’s trade secret, commercial or financial information that is privileged or confidential under the meaning of § 552(b)(4) of Title 5, of Offeror. See 15 U.S.C. § 3710a(c)(7)(A) and (B).

Article 14. Intellectual Property

14.1 Foreground Intellectual Property

14.1.1 Subject Invention.

14.1.1.1 Reporting of Subject Invention The HSARPA shall

promptly report to the DHS Assistant General Counsel for Intellectual Property each Subject Invention in which a DHS employee conceived of an invention or reduced the invention to practice, in whole or in part, under this Cooperative Research and Development Agreement. HSARPA shall promptly disclose to Offeror each Subject Invention reported by a DHS employee. Offeror shall promptly disclose to HSARPA, with copies to the DHS Assistant General Counsel for Intellectual Property, each Subject Invention reported to Offeror by any of its employees. The Parties agree that Subject Inventions shall not include: (a) any Invention Made solely by Offeror’s employees or (b) any refinement, improvement, or modification to Offeror’s Background Intellectual Property identified in Appendix C.

14.1.1.2 Inspection and Copies of Patent Application. Each Party shall provide the other with copies of any patent applications, continuations in parts, divisional or reissues it files on any Subject Invention. Each Party shall execute the documents necessary to authorize the other Party to inspect and make copies of all documents included in the official patent application file(s) , except as may be prohibited by law or regulation.

14.1.1.3 Filing Patent Applications on Subject Invention. Consistent with Article 14.1.1.1, Offeror has no obligation under this Agreement with respect to any Invention Made solely by Offeror’s employees, but with respect to any Invention Made solely by HSARPA employees, HSARPA shall have the first option to file a patent application for such Subject Invention. Offeror shall have the first right to election of title for any jointly Made Subject Inventions. If Offeror elects to file a patent application on a jointly Made Subject Invention, Offeror shall give written notice to the HSARPA, with copies to the DHS Office of Technology Transfer within three (3) months after disclosure of the Subject Invention under Article 14.1 of this Agreement, and by filing a patent application in the U.S. Patent and Trademark Office within six (6) months after written notice is given. If Offeror elects not to file or not to continue prosecution of a patent application on any such jointly Made Subject Invention in any country or countries, Offeror shall notify the HSARPA, with copies to the DHS Office of Technology Transfer, thereof at least three (3) months prior to the expiration of any applicable filing or response deadline, priority period or statutory bar date. In any country in which Offeror does not file, or does not continue prosecution of, or make any required payment on, an application or patent on any such jointly Made Subject Invention, DHS may file, or continue prosecution of, or make any required payment on, an application or patent, and Offeror agrees, upon request by DHS, to assign to the Government all right, title and interest of Offeror in any such application or patent and to cooperate with the HSARPA executing all necessary documents and obtaining cooperation of its employees in executing such documents related to such application or patent.

14.1.1.4 Rights in Subject Invention. Subject to Art 14.1.1.3., the

HSARPA and Offeror shall separately own any Subject Invention Made solely by its respective employees under this Agreement. The Parties shall jointly own Subject Inventions Made jointly by the HSARPA and the Offeror’s employees. Pursuant to Bayh-Dole Act, Offeror shall have the first option to file a patent application on any jointly owned Subject Inventions Made under this CRADA. Subject to Article 14.1.1.3 of this Agreement, Offeror shall have an option to choose an exclusive license for a pre-negotiated field of use at a reasonable royalty rate, subject to the conditions set forth in 15 U.S.C.§ 3710a(b)(1)(A), (B) & (C), in any Subject Invention Made solely by HSARPA employees under this Agreement. Offeror shall exercise the option to obtain a license by giving written notice thereof to the HSARPA, with copies to the DHS Office of the General Counsel for Technology Programs, within three (3) months after disclosure of the Subject Invention under paragraph 14.1. The royalty rate, field of use and other terms and conditions of the license shall be set forth in a separate license agreement and shall be negotiated promptly after notice is given. The Government hereby waives its right to the license spelled out in 15 U.S.C. § 3710a(b) in a Subject Invention Made solely by Offeror’s employees.

Consistent with Article 14.1.1.1, Subject Inventions shall not include any refinement, improvement, modification of the Background Intellectual Property identified in Appendix C.

14.1.1.5 Contractor Rights in Subject Invention. Offeror may, at its own discretion, negotiate with its contractor prior to the contractor commencing work under this Agreement or once its contractor has Made a

Subject Invention under this Agreement, to determine the allocation of rights between Offeror and the contractor to any Subject Invention the contractor makes, solely or jointly, under this Agreement. Offeror understands and agrees that the Government may not be able to offer Offeror the option to an exclusive license for a pre-negotiated field of use in a Subject Invention, as described in Section 14.1.1.4 of this Agreement, if a contractor makes, solely or jointly, such Subject Invention under this Agreement.

14.1.1.6 Required Statement of Government Rights in Subject

Invention. Any patent application filed on any Subject Invention Made under this Agreement shall include in the patent specification thereof the statement:

"This invention was made in the performance of a Cooperative Research and Development Agreement with the HSARPA Laboratory, Department of Homeland Security. The Government of the United States has certain rights to use the invention".

14.1.1.7 Allocation of Filing Expenses. Unless otherwise agreed, the party filing an application shall pay all patent application preparation and filing expenses and issuance, post issuance and patent maintenance fees associated with that application.

14.1.2 Foreground Data

14.1.2.1 Rights in Data First Produced/Generated Information. The

Parties agree that they shall have no obligations of nondisclosure or limitations on their use of, and the Parties shall have unlimited rights in, all Generated Information produced and Information provided by the Parties under this CRADA and for the purposes of this CRADA, except for (a) information which is marked as being Copyrighted (subject to section 12.1.3) or as Protected CRADA Information (subject to section 12.1.2.2) or as Proprietary Information (subject to section 12.1.2.3), or (b) information that discloses an invention which may later be the subject of a U.S. or foreign patent application.

14.1.2.2 Rights in Protected CRADA Information. A Party may

designate as Protected CRADA Information any Generated Information produced by its employees with the agreement of both Parties. All such designated Protected CRADA Information shall be appropriately marked in accordance with the marking requirements in section 14.2.4. For a period of 5 years from the date Protected CRADA Information is produced, the Parties agree not to further disclose such information except with the other Party’s consent: (i) as necessary to perform this CRADA; or (ii) as requested by HSARPA for us at a DHS facility with the same protection in place as the HSARPA; or (iii) to existing or potential licensees, affiliates, customers, or suppliers of Offeror in support of commercialization of the technology with the same protection in place; or (iv) as mutually agreed in advance.

14.1.2.3 Rights in Proprietary Information. Pursuant to 15 USC §

3710a(c)(7)(A), each Party agrees to not disclose Proprietary Information provided by another Party to anyone other than the Offeror and the Government without written approval of the providing Party. Proprietary Information will be handled according to the following terms and conditions:

(i) if Proprietary Information is orally disclosed to a Party, it shall be identified as such, orally, at the time of disclosure and confirmed in a written summary thereof, appropriately marked by the disclosing Party, within 5 days as being Proprietary Information; (ii) all Proprietary Information of the provider shall be returned to the provider thereof at the conclusion of this CRADA; (iii) the Parties may disclose Proprietary Information that becomes publicly known without the fault of the recipient, independently comes into recipient’s possession, or is independently developed by recipient’s employees who did not have access to such Proprietary Information; and (iv) the Government may provide Proprietary Information to its contractors in accordance with Article 7, but in no case shall the Government provide Proprietary Information to any person or entity for commercial purposes.

HSARPA’s contractors are subject to confidentiality and non-disclosure obligations set forth in DHS Form No, 11000-6.

14.1.3 Foreground Copyright

14.1.3.1 Assertion of Copyright Ownership in Generated Information.

It is not the intention of the Parties of this Agreement to develop or create any software in the work described in Appendix A. If, however, any software is created, Offeror shall have the right to copyright all software (including modifications, variations, improvements, and enhancements thereto), documentation, and other works created in whole or in part by Offeror under this Agreement, which is subject to being copyrighted under 17 U.S.C. § 101 et seq. Offeror shall mark any such works with a copyright notice showing Offeror as the author or co-author and shall in its reasonable discretion determine whether to file applications for registration of copyright.

14.1.3.2 Assignment of Copyright Ownership in Generated

Information. Should Offeror choose not to retain ownership of the copyright in any software referenced in section 14.1.3.1, it will execute an assignment of the copyright to the U.S. Government. The Government, as represented by the HSARPA, agrees to license such software to Offeror on terms acceptable to the parties.

14.1.3.3 Rights in Copyrighted Generated Information. Offeror grants and acknowledges that the Government has for itself and others acting on its behalf, a royalty-free, nontransferable, nonexclusive, irrevocable worldwide Copyright license to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the

Government, all Copyrightable works produced in the performance of this CRADA, subject to the restrictions this CRADA places on publication of Proprietary Information and Protected CRADA Information under Articles

14.1.2.2 and 14.1.2.3.

14.1.3.4 Rights in Copyrighted Computer Software. For all

Copyrighted computer software produced in the performance of this CRADA, the Offeror will provide to HSARPA at the completion of performance under the SOW, the executable object code and the minimum support documentation needed by a competent user to understand and use the software. The Addendum will be treated in the same manner as Generated Information in section 12.1.2.1 of this Article.

14.1.3.5 Copyright Royalties – Terms and conditions of any copyright royalties will be set forth in Appendix D.

14.2 Background Intellectual Property.

14.2.1 There is no transfer of ownership for any Background patents, patent applications, and copyright or other forms of Intellectual Property under this Agreement. At a minimum, Offeror shall grant to DHS a non-exclusive, irrevocable, royalty-free, non-transferrable license to use, reproduce, adapt, modify, publish, test, evaluate, and communicate Background patents, patent applications, data, and copyright for the purpose of the collaboration established by this CRADA subject to Article 14.1.2.3. A more expansive use of Background forms of Intellectual Property or a special purpose license may be authorized in writing by the furnisher of the Background form of Intellectual Property. The Party furnishing the Background Information shall list the Background Information in Appendix C.

14.2.2 Rights in Background Copyrighted Computer Software.

For all preexisting Background Copyrighted computer software furnished under this CRADA, the submitting Party will identify in Appendix B the executable object code, and the minimum support documentation needed by a competent user to understand and use the Background Copyrighted computer software.

14.2.3 Copyright Markings. The Parties agree to place Copyright notices, as appropriate for the protection of Copyright, in human-readable form onto all physical media, and in digitally encoded form in the header of machine-readable information recorded on such media such that the notice will appear in human-readable form when the digital data are off loaded or the data are accessed for display or printout. For all Copyrighted Information provided to HSARPA under this Agreement, Offeror may use a notice that substantially conforms to the following:

Copyright, [YEAR] [NAME OF PARTY]. All rights are reserved under U.S. Copyright Law. Any unauthorized use, including reproduction, modification, distribution or publication, without the prior written consent of [Offeror’s Name], is strictly prohibited.

[end of notice]

14.2.4 Proprietary Information Markings. Offeror will mark all of its

Proprietary Information provided to HSARPA with a notice that substantially conforms to the following:

(a) This Information contains Proprietary Information as defined under Department of Homeland Security Cooperative Research and Development Agreement No.

(b) This Proprietary Information shall be protected from disclosure pursuant to 15 U.S.C. § 3710a(c)(7)(A) and 5 U.S.C. § 552(b), unless such Proprietary Information becomes publicly known without the fault of the recipient, independently comes into recipient’s possession without breach by the recipient of any of the obligations set forth in Department of Homeland Security Cooperative and Research and Development Agreement No. _______, or is independently developed by recipient’s employees who did not have access to such Proprietary Information.

(c) The Government may provide, under obligations of confidentiality, Proprietary Information to its support services contractors, which are assisting the Government in its performance of this CRADA. This Information shall not be provided to any person or entity for commercial purposes, unless otherwise agreed to in writing by the Government and all of the Parties to the CRADA identified above.

14.2.5 Protected CRADA Information Markings. Offeror will mark all of its

Protected CRADA Information provided to the Government with the following notice:

(a) This embodies Protected CRADA Information under Department of Homeland Security Cooperative Research and Development Agreement No. ____________.

(b) For a period of 5 years from the date Protected CRADA Information is produced, this Protected Information will be protected from disclosure by the Receiving Party in accordance with the CRADA identified above, pursuant to 15 U.S.C. § 3710a(c)(7)(B) and 5 U.S.C. § 552(b).

(c) The Government may, under obligations of confidentiality, provide Protected CRADA Information to its support services contractors, which are assisting the Government in its performance of this CRADA. This Protected CRADA Information shall not be provided to any person or entity for commercial purposes, unless otherwise agreed to in writing by the Government or other Parties of the CRADA identified above.

Article 15. Export Control

Information and/or products developed pursuant to this Agreement may contain information for which export is restricted by the Arms Export Control Act (22 U.S.C. § 2751 et seq.), the Export Administration Act (50 U.S.C. App 2401 et seq.), or other applicable export control laws and regulations. Nothing in this Agreement shall be construed to permit any disclosure in violation of those restrictions.

Article 16. Liability of the Parties

16.1 The HSARPA shall be liable for its activities conducted pursuant to this Agreement in accordance with the Federal Tort Claims Act, 28 U.S.C. § 2671 et seq.

16.2 Offeror shall be liable for its activities conducted pursuant to this Agreement in accordance with applicable Federal and State law.

Article 16. Force Majeure

Neither Party shall be liable for any unforeseeable event beyond its reasonable control not caused by the fault or negligence of such Party, which causes such party to be unable to perform its obligations under this Agreement (and which it has been unable to overcome by the exercise of due diligence), including, but not limited to, flood, drought, earthquake, storm, fire, pestilence, lightning, and other natural catastrophes, epidemic, war, riot, civic disturbance, or disobedience, strikes, labor dispute, or failure, threat of failure, or sabotage, or any order or injunction made by a court or public agency. In the event of the occurrence of such a force majeure event, the Party unable to perform shall promptly notify the other Party. It shall further use its best efforts to resume performance as quickly as possible and shall suspend performance only for such period of time as is necessary as a result of the force majeure event.

Article 18. Miscellaneous Provisions

18.1 Dispute Resolution. The Parties agree that they will seek to informally resolve all disputes arising from this Agreement.

18.2 Modification. If either Party wishes to propose a modification in this Agreement, the Party shall, upon reasonable notice of the proposed modification by the proposing Party, confer in good faith to determine the desirability of such modification.

Such modification shall not be effective until all the Parties hereto by their representatives duly authorized to execute such amendment sign a written amendment.

18.3 Termination. Either Party can terminate this Agreement with 30 days written notice to the other Party.

18.4 Extension. Extensions of the Term of this Agreement may be made prior to the expiration of the Agreement without the need for additional review beyond that of the Director of the HSARPA. If the parties wish to continue the work under in the SOW after the expiration of this Agreement, they must enter into a new CRADA. The parties may extend the Term of this Agreement through written modification.

18.5 Corporate Organization. Offeror, as of the date hereof, is a corporation duly organized, validly existing and in good standing under the laws of the State of

18.6 Statement of Ownership. Offeror is a subsidiary of a foreign entity, however it has mitigated FOCI pursuant to a Special Security Agreement.

Article 19. Reports and Notices

19.1 Notices to HSARPA. All reports and notices required under this Agreement will be sent to the Principle Investigator with copies to the DHS Technology Transfer Program Manager, as set forth in Article 21 of this Agreement.

19.2 Notices to Offeror. All reports and notices required under this Agreement will be sent to Offeror’s designated point(s) of contact, as set forth in Article 21 of this Agreement.

Article 20. Certification

The Director of the HSARPA has reviewed this Agreement and acknowledges it is consistent with the mission of the HSARPA and the participation by the HSARPA in this Agreement is endorsed and supported by the HSAPRA.

Article 21. Points of Contact

All notices, communications, and payments shall be deemed made if given by registered or certified envelope, postage prepaid, or by Federal Express or similar overnight delivery, postage prepaid, and addressed to the Party to receive such notice, communication or payment at the address given below, or such other address as may hereafter be designated by notice in writing.

FOR HSARPA:

Name: Stephen Dennis, Innovation Director Address: Homeland Security Advanced Research Projects Agency (HSARPA) 245 Murray Lane Washington, DC 20223

MS: 0201

Telephone: 202.254.5788

Name: Scott Pugh DHS Technology Transfer Program Manager Address: Science and Technology Directorate Department of Homeland Security 245 Murray Drive Lane, SW Mail Stop:

Washington, DC 20528 Email: Scott.pugh@hq.dhs.gov

Name: Armand M. Hill

Office of the General Counsel for Technology Program Address: Science and Technology Directorate Department of Homeland Security 245 Murray Drive Lane, SW Mail Stop: 0205 Washington, DC 20528-0205 Email: Armand.hill@hq.dhs.gov

Offeror’s Name:

Name:

Address:

Telephone:

Article 20. Signatures

Offeror’s Name

BY: __________________________

NAME:

TITLE:

DATE: ___________________________

HSARPA

BY: __________________________

NAME: Adam Cox, PhD

TITLE: Director (A), HSARPA

DATE: _________________________

APPENDIX A

Statement of Work

Identity (ID) Assurance and Criminal Screening Algorithm Test and Evaluation

Background HSARPA is testing the technical performance of ID assurance and criminal screening algorithms for use in the TSA Pre-check Application Expansion program.

Objective HSARPA and Offeror will collaborate to test the performance of proposed identity assurance and criminal screening algorithms for supporting the TSA Pre-check Application Expansion mission.

Requirements For The Protection Of TSA Sensitive Information

For purpose of this CRADA, the Offeror agrees to comply with the below data security requirements and to include the below data security requirements in all agreements under which the Offeror’s subcontractor will obtain access to TSA sensitive information.

Requirements For The Protection Of TSA Sensitive Information

For purpose of this CRADA, the Offeror agrees to comply with the below data security requirements and to include the below data security requirements in all agreements under which the Offeror’s subcontractor will obtain access to TSA sensitive information.

1. Under this CRADA, the term “TSA sensitive information” includes all biographic/biometric test data materials that DHS Science and Technology (S&T) will provide to the Offeror for the DHS S&T’s Test and Evaluation phase of proposal evaluations under the TSA Pre® Application Expansion solicitation as well as all data that an Offeror may generate on behalf of DHS/TSA, TSA data transmitted by the Offeror, and TSA data otherwise received, stored, or processed by the Offeror (and/or its subcontractors) during this DHS S&T Test and Evaluation phase. This includes but is not limited to personally identifiable information (PII), sensitive security information (SSI), sensitive but unclassified (SBU), and critical infrastructure information (CII).

2. All Offeror’s employees with access to TSA sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as prerequisite for access to such TSA sensitive information. The Offeror shall provide copies of the signed NDA to DHS no later than two (2) days after execution of the form. The Offeror shall maintain signed copies of the NDA for all employees as a record of compliance.

3. All Offeror’s subcontractors’ employees at any tier with access to TSA sensitive information shall also execute DHS Form 11000-6, Department of Homeland

Security Non-Disclosure Agreement (NDA), as a prerequisite for access to such TSA sensitive information. The Offeror shall provide copies of its sub-contactors’ employees signed NDA to DHS no later than two (2) days after execution of the form. The Offeror shall also maintain signed copies of the NDA for all of its subcontractors’ employees as a record of compliance.

4. The Offeror and its subcontractors with access to TSA sensitive information shall be responsible for the security of i) all TSA sensitive information that is generated by the Offeror on behalf of DHS/TSA, ii) TSA sensitive information transmitted by the Offeror, and iii) TSA sensitive information otherwise received, stored, or processed by the Offeror regardless of who owns or controls the underlying systems while that data is under the Offeror’s control. All TSA sensitive information, including but not limited to PII, sensitive security information (SSI), sensitive but unclassified (SBU), and critical infrastructure information (CII), shall be protected according to DHS and TSA security policies and mandates.

5. The Offeror shall maintain data control according to the TSA security level of the data. Data separation shall include the use of discretionary access control methods, VPN encryption methods, data aggregation controls, data tagging, media marking, backup actions, and data disaster planning and recovery. The Offeror’s handling of PII must comply with TSA MD 3700.4, Handling Sensitive Personally Identifiable Information (current version).

6. The Offeror must satisfy requirements to work with and safeguard Sensitive Security Information (SSI), and Personally Identifiable Information (PII). All support personnel must understand and rigorously follow DHS and TSA requirements, policies, and procedures for safeguarding SSI and PII.

7. The Offeror shall comply with Department of Homeland Security (DHS) and Transportation Security Administration (TSA) technical, management and operational security controls to ensure that the Government's security requirements are met. These controls are described in DHS 4300A and TSA MD 1400 series security policy documents and are based on the NIST Special Publication (SP) 800- 53, rev 4 standards.

8. The Offeror shall ensure IT systems transmitting TSA unclassified/SSI information is encrypted. The following methods are acceptable for encrypting sensitive information:

i. FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

(current version)

ii. National Security Agency (NSA) Type 2 or Type 1 encryption. (current version)

iii. Public Key Infrastructure (PKI)

9. The Offeror shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Offeror’s facilities, installations, operations, documentation, databases, and personnel used in the performance of the CRADA.

10. Sensitive Information Incident Reporting Requirements. All known or suspected sensitive information incidents shall be reported to DHS and to TSA Security

Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting requirements. When notifying the TSA SOC, the Offeror shall also notify the TSA Privacy Officer, and US-CERT using the contact information identified in the CRADA. The Offeror shall not include any sensitive information in the subject or body of any e-mail. To transmit sensitive information, the Offeror shall use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption methods to protect sensitive information in attachments to email. Passwords shall not be communicated in the same email as the attachment. A sensitive information incident shall not, by itself, be interpreted as evidence that the Offeror has failed to provide adequate information security safeguards for sensitive information, or has otherwise failed to meet the requirements of the CRADA.

o Any computer incident discovered while conducting business on the Offeror’s network or to TSA data on an external network or the Offeror’s subcontractor’s network, shall be documented and reported to the TSA SOC immediately. The TSA CISO shall be informed of any incident that may have an impact on network resources via the following points of contact:

TSA Single Point-of-Contact (SPOC) helpdesk (1-800-253-8571), the TSA SOC (1-877-242-4533 or TSA-CSIRT@tsa.dhs.gov).

11. Offeror’s shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Point of contact (POC) (address, position, telephone, email);

(ii) Name of subcontractor if this was an incident on a subcontractor network;

(iii) Government programs, platforms or systems involved;

(iv) Location(s) of incident;

(v) Date and time the incident was discovered;

(vi) Server names where sensitive information resided at the time of the incident, both at the Offeror and subcontractor level;

(vii) Description of the Government PII and/or SPII contained within the system;

(viii) Number of people potentially affected and the estimate or actual number of records exposed and/or contained within the system; and

(ix) Any additional information relevant to the incident.

• The Offeror shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections,

(ii) Investigations, (iii)Forensic reviews, and

(iv) Data analyses and processing.

(v) The Government, at its sole discretion, may obtain the assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

12. Disposition of Government Resources: At the expiration of the DHS S&T Test and Evaluation phase, the Offeror (and all Offeror’s subcontractors’ employees at any tier with access to TSA sensitive information ) shall return all TSA information and IT resources provided to the Offeror during the CRADA testing, and provide a certification that all assets containing or used to process TSA information have been sanitized in accordance with the TSA MD 1400.3, TSA Information Assurance Handbook and Technical Standards. The Offeror shall certify in writing that sanitization or destruction has been performed, as outlined in the NIST Special Publication 800-88 Guidelines for Media Sanitization, using the TSA Form 1412 Media Santization Certificate. Upon completion of the testing period, DHS/TSA will reexamine the Offeror’s environment to ensure that all government-furnished data has been properly sanitized from the Offeror’s environment.

13. Data Stored/Processed at Offeror Site: Any storage of data must be contained within the resources allocated by the Offeror to support the CRADA testing and may not be on systems that are shared with other commercial or government clients. TSA prohibits duplication of data provided for purposes outlined in the CRADA.

REVOCATION OF ACCESS TO TSA SENSITIVE INFORMATION AND

EXCLUSION FROM FURTHER CONSIDERATION FOR OTA AWARD

In the event of a sensitive information incident, the Government may suspend or revoke the existing access to TSA sensitive information (either in part or in whole). If access is suspended or revoked in accordance with this provision, the Contracting Officer may direct the Offeror to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Offeror IT system under this contract.

Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. “Sensitive Information Incident” as used in the CRADA means an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Offeror system, or sensitive information.

In the event of a sensitive information incident, the Government may exclude the Offeror from further participation in the CRADA process, to include exclusion from consideration for OTA award by TSA. The Offeror agrees it must continue to cooperate with the Government in taking any additional security measures directed by the Contracting Officer and to in the above paragraph to secure to suspend or revoke the existing access to TSA sensitive information (either in part or in whole). The Offeror also agrees it shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response.

Expected Results HSARPA anticipates that this test and evaluation…