Version_1.0_Attachment_B_OTHER_TRANSACTION_AGREEMENT(OTA)_12-2-2015.pdf

AGREEMENT

BETWEEN

TRANSPORTATION SECURITY ADMINISTRATION (TSA)

AND

[ENTITY NAME]

RELATING TO

TSA PRE✓® APPLICATION EXPANSION

NEGOTIATED BY THE TSA PURSUANT TO

AVIATION AND TRANSPORTATION SECURITY ACT, PUB. L. 107-71, 115 STAT. 597

49 U.S.C. § 114(M)(L), AND § 106(L) (6)

HSTS02-16-R-OIA011

Version 1.0 December 2, 2015

Other Transaction Agreement (OTA) Between Transportation Security Administration (TSA) and [Contractor Name] Relating to TSA Pre✓® Application Expansion. Negotiated by the TSA pursuant to Aviation and Transportation Security Act, Pub. L. 107-71, 115 Stat. 597, 49 U.S.C.

114(m)(1), and 106(l)(6)

ARTICLE I – PARTIES

This Other Transaction Agreement (hereinafter referred to as “Agreement” or “OTA”) is entered into between the United States of America (hereinafter referred to as the “Government”)

Transportation Security Administration (hereinafter referred to as “TSA”) and [ENTITY

NAME]. The TSA and the [ENTITY NAME] agree to cooperate in good faith and to perform their respective obligations using their cooperative good faith efforts in executing the purpose of this Agreement.

ARTICLE II – AUTHORITY

TSA and the [ENTITY NAME] enter into this Agreement under the authority of the Aviation and Transportation Security Act, Pub. L. 107-71, 115 Stat. 597, specifically 49 U.S.C. 114(m), and 106(l) and (m), which authorizes agreements and other transactions on such terms and conditions as the Administrator determines necessary.

ARTICLE III – SCOPE

The purpose of this Agreement is to establish the tasks necessary to develop, deliver, and deploy application capabilities to expand the public’s enrollment opportunities for TSA Pre✓®. This includes the ability to offer convenient and accessible enrollment options, reliably perform identity validation and verification as well as appropriately apply disqualifying criminal history convictions, and potentially makes effective, provisional, determinations to pre-screen potential applicants for TSA Pre✓® eligibility.

At a minimum, the [ENTITY NAME] must deliver the following:

1. the ability to offer convenient and accessible enrollment locations and options;

2. reliably perform identity validation and verification to NIST 800-63 Assurance Level 3 standards;

3. conduct a criminal history records check according to TSA disqualifying criteria by either using a designated channeler or using commercially available data solutions;

4. Collect documentation to enable TSA to make final citizenship determinations;

5. provide effective, provisional pre-screening eligibility recommendations in order to allow TSA to make final TSA Pre è Application eligibility determinations; and

6. executing a marking strategy for TSA Pre✓® enrollment in alignment with TSA Pre

✓® brand identity and positioning.

Depending upon Contracting Officer direction, the [ENTITY NAME] may also use commercially available data to accomplish the following:

1. Pre-screen potential applicants for TSA Pre✓® eligibility by appropriately identifying disqualifying criminal history convictions using commercially available data; and

2. Perform Identity validation and verification

Under no circumstances will TSA permit the [ENTITY NAME] to:

1. Use publicly available social media information to perform any type of pre-screening effort;

2. Rely on or evaluate factors such as religion, financial status, health records, constitutionally protected activity, or other records reflecting an individual’s socio-economic status; or

3. Use other individual characteristics, such as race, sex, age, and nationality, beyond what is necessary and appropriate to verify the identity of an applicant.

To accomplish these general requirements, the [ENTITY NAME] must meet the specific requirements found in the following attachments:

Attachment #1 - Statement of Work (SOW)

Attachment #2 – TSA Pre✓® Application Expansion High Level

Requirements_10_08_2015

Attachment #3 - Technical Overview Document v1.0

Attachment #4 - Fee Collection Requirements

Attachment #5 - TSA Pre✓® License for OTA

Attachment #6 - TSA Brand Positioning

Attachment #7 – TSA Branding Guidelines

Attachment #8 – 4300B.000 National Security Systems Policy Cover page

Attachment #9 – 4300B.000_TOC_4300B_05102013

Attachment #10 – 4300B.100 - Safeguarding and Risk Mgmt for NSS

Attachment #11 – 4300B.101 - Risk Management Framework

Attachment #12 – 4300B.102 - NSS Security Control Guidance FINAL

Attachment #13 – 4300B.103-1 - System Security Plans FINAL

Attachment #14 – 4300B.103-3 - Security Assessment Reports

Attachment #15 – 4300B.103-4 - Plans of Action and Milestones

Attachment #16 – 4300B.103.2 - Risk Assessment Reports

Attachment #17 – 4300B.106 - User Minimum Requirements

Attachment #18 – 4300B.107 - Decommissioning Strategy

Attachment #19 – 4300B.108-1 - NSS References

Attachment #20 – 4300B.108.2 - NSS Policy Change Request

Attachment #21 – 4300B.200 COMSEC

Attachment #22 – 11042.1 Safeguarding Sensitive But Unclassified (For

Official Use Only) Information

Attachment #23 – 4300A Sensitive Systems Policy

Attachment #24 – TSA MD 1400.3, FINAL, 140408

Attachment #25 – TSA MD 3700.4, FINAL, 081209v.4

Attachment #26 – TSA_MD_2800_71

Attachment # 27 – TSA Validation Criteria

Attachment #28 - DHS 4300 Sensitive Systems Policy

Attachment #29 - TSA Commonly Asked Questions

Attachment#30 – DHS ST Results Form

ARTICLE IV – RESPONSIBILITIES

The parties agree to cooperate, act in good faith, and to meet their respective obligations in furtherance of the purposes of this OTA and TSA Pre✓® Application Expansion Statement of

Work (SOW) and SOW Attachments and other relevant documents, which are incorporated by reference by this article.

ARTICLE V - EFFECTIVE DATE AND TERM

The effective date of this Agreement is the date on which it is signed by the TSA or the

[ENTITY NAME], whichever is later. This agreement will continue in effect for a three (3) year base and seven (7) one year option a total period of performance of Ten Years (10) from the effective date, unless earlier terminated by the parties as provided herein.

The [ENTITY NAME] agrees to meet the following timelines:

* No later than 60 days from OTA award, the Contractor must be ready to begin integration/interface testing with TSA and TSA-required systems (to include TSA and pay.gov testing) as referenced in SOW Section 4.4.

* No later than 120 days from OTA award, the Contractor must achieve Authority to Operation

(ATO) from TSA as referenced in SOW Section 4.14.3 – O. * No later than 120 days from OTA award, the Contractor must achieve approval to begin enrolling applicants (i.e. launch operations) from TSA. In order to receive approval to launch operations, the Contractor must provide evidence that all operations and technology are established and meeting the requirements described in SOW Section 4.15.

ARTICLE VI – ACCEPTANCE AND TESTING

[ENTITY NAME] will perform in accordance to the Statement of Work (SOW), SOW attachment and related attachments.

ARTICLE VII - FUNDING AND LIMITATIONS

The Contractor shall collect and remit payment to TSA, pursuant to 6 U.S.C. 469, for each application that they submit. The Contractor shall remit fees to TSA in form and manner consistent with SOW Attachment #3 - Fee Collection Requirements, describing requirements for the collection of government funds.

ARTICLE VIII – BILLING PROCEDURE AND PAYMENT

This Agreement does not involve any payments from the Government to the [ENTITY NAME] – rather, the Contractor shall remit the specified fees amounts to TSA in accordance with Section

(TBD) of this agreement, as payment for services provided to complete each vetting instance.

No appropriated or other Government funding will be obligated under this Agreement. The

[ENTITY NAME] agrees to provide these enrollment services, throughout the life of this agreement, at no cost to the government. The [ENTITY NAME] is encouraged to establish novel business models and pricing mechanisms to recover the costs of their efforts and continue to expand enrollments. TSA will not provide for any government reimbursement of any cost incurred in making necessary studies or designs for the preparation of the systems or incurred in obtaining services or supplies.

ARTICLE IX – AUDITS

TSA shall have the right to examine or audit relevant financial records for each [ENTITY

NAME] facility, while this Agreement, or any part thereof, remains in force and effect. For each facility, [ENTITY NAME] shall maintain: project records, technology maintenance records, and data associated with this TSA Pre✓® Application Expansion while this Agreement, or any part thereof, remains in force and effect. If this Agreement is completely or partially terminated, the records relating to the work terminated shall be made available at termination. Records relating to appeals under the “Disputes” provision in Article XII regarding this Agreement shall be made available until such appeals are finally resolved.

As used in this provision, “records” includes books, documents and other data, regardless of type and regardless of whether such items are in written form, in the form of computer or other electronic data, or in any other form that relate to this TSA Pre✓® Application Expansion for each facility.

[ENTITY NAME] shall also maintain all records and other evidence sufficient to reflect fees collected from the public, and fees forward to TSA as payment for services rendered, in accordance with Section TBD in the conduct of TSA Pre✓® Application Expansion. The

Contracting Officer, Contracting Officer’s Technical Representative, or the authorized representatives of these officers shall have the right to examine and audit those records at any time. This right of examination shall include inspection at all reasonable times at the [ENTITY

NAME]’s offices directly responsible for managing the TSA Pre✓® Application Expansion.

The Comptroller General of the United States shall also have access to, and the right to examine, any records involving transactions related to this Agreement during the period of performance.

This article shall not be construed to require [ENTITY NAME], or its contractors or subcontractors who are associated with or engaged in activities relating to this OTA, to create or maintain any record that they do not maintain in the ordinary course of business pursuant to a provision of law, provided that those entities maintain records which conform to generally accepted accounting procedures.

ARTICLE X – AUTHORIZED REPRESENTATIVES

TSA Contacts [TSA Contracting Officer/Specialist contact info and COTR contact info]

[ENTITY NAME] Contacts (Please include telephone numbers and email addresses.)

The COR is responsible for the technical administration and liaison of this Agreement. The COR is not authorized to change the scope of work, to make any commitment or otherwise obligate the TSA, or authorize any changes which affect the liability of the TSA. The [ENTITY NAME] will inform the Contracting Officer in the event that the COR takes any action which is interpreted by the [ENTITY NAME] as a change in scope or liability to either party.

ARTICLE XI - LIMITATIONS ON LIABILITY

A. Subject to the provisions of Federal law, including the Federal Torts Claims Act, each party expressly agrees without exception or reservation that it shall be solely and exclusively liable for the acts or omissions of its own agents and/or employees and that neither party looks to the other to save or hold it harmless for the consequences of any act or omission on the part of one or more of its own agents or employees, subject to the same conditions provided above.

B. [ENTITY NAME] has the affirmative duty to notify the TSA Contracting Officer in the event that [ENTITY NAME] believes that any act or omission of a TSA agent or employee would increase [ENTITY NAME] costs and cause the [ENTITY NAME] to seek compensation from

TSA beyond TSA’s liability as stated in Article IV (Responsibilities), or Article VI (Funding

And Limitations). Claims against either party for damages of any nature whatsoever pursued under this Agreement shall be limited to direct damages not to exceed the aggregate outstanding amount of funding obligated under this Agreement at the time the dispute arises. If the [ENTITY

NAME] receives any communication which it interprets as instructions to change the work encompassed in this Agreement, or to incur costs not covered by funding obligated at that time, the [ENTITY NAME] must not act on that communication, and must contact the Contracting

Officer verbally and in writing immediately.

C. In no event, beyond the Contractor’s liabilities under the Protection of Information (Article

XVIII, shall either party be liable to the other for consequential, punitive, special and incidental damages, claims for lost profits, or other indirect damages.

D. No third party shall assert any rights under this Agreement unless expressly provided herein.

ARTICLE XII – DISPUTES

When possible, disputes will be resolved by informal discussion between the parties. All disputes arising under or related to this Agreement shall be resolved under this Article. Disputes, as used in this Agreement, mean a written demand or written assertion by one of the parties seeking, as a matter of right, the adjustment or interpretation of Agreement terms, or other relief arising under this Agreement. The dispute shall be made in writing and signed by a duly authorized representative of the OTA Holder or the TSA. At a minimum, a dispute under this

Agreement shall include a statement of facts, adequate supporting data and a request for relief. In the event that the parties are unable to resolve any disagreement through good faith negotiations, the dispute will be reviewed and adjudicated by the TSA Head of the Contracting Activity or his or her designee. If a party disagrees with the decision of the TSA Head of the Contracting

Activity or his or her designee, the party may pursue other available legal remedies.

ARTICLE XIII – TERMINATION

In addition to any other termination rights provided by this Agreement, either party may terminate this Agreement at any time prior to its expiration date, with or without cause, by giving the other party at least thirty (30) days’ prior written notice of termination. Upon receipt of a 30 day notice of termination, the receiving party will be allowed 90 to 120 days to wind-down

/shutdown operations. In addition, the OTA holder shall take immediate steps to stop the accrual of any additional obligations that might require payment. Termination of the program or this

OTA will be at no cost to the Government.

ARTICLE XIV- SUSPENSION

In addition to any other termination rights provided by this Agreement, the Government reserves the right to suspend work of the provider until the performance flaw is corrected and confirmed by the Government. This suspension will be at no cost to the Government. This suspension will be at no cost to the Government and can occur without prior suspension notice from the

Government. If performance issues continues to occur and are not corrected in a timely matter the Government will proceed with the termination in accordance with Article XIII.

ARTICLE XV - CHANGES AND/OR MODIFICATIONS

Changes or modifications to this Agreement shall be in writing and signed by the TSA

Contracting Officer and the authorized representative of [ENTITY NAME]. The modification shall cite the subject provision to this Agreement and shall state the exact nature of the modification. No oral statement by any person shall be interpreted as modifying or otherwise affecting the terms of this Agreement. Reasonable administrative modifications such as changes in address changes, Key Personnel, name of the TSA Contracting Officer, etc. may be issued unilaterally by TSA. All changes or modification to this Agreement will be at no cost to the

Government.

ARTICLE XVI – NEW OR UPGRADED TECHNOLOGIES, SOLUTIONS, AND

PROVIDERS

The Government encourages the [ENTITY NAME] to continuously propose to TSA technological and process improvements to further enhance TSA Pre™ enrollments. To that end, the Government reserves the right to modify this and other OTAs to incorporate these improvements, if in the best interest of the government. All changes or modification to this

Agreement will be at no cost to the Government. Further, TSA may determine, at any time during the life of this agreement, to seek/consider additional proposals and award additional

OTAs to entities for these services.

ARTICLE XVII - CONSTRUCTION OF THE AGREEMENT

This Agreement is issued under 49 U.S.C. §106 (l)(6) and §114(m) and is not a procurement contract, grant, cooperative agreement, or other financial assistance. It is not intended to be, nor shall it be construed as a partnership, corporation, or other business organization. Both parties agree to provide their best efforts to achieve the objectives of this Agreement. The Agreement constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior agreements, understanding, negotiations and discussions whether oral or written of the parties. Each party acknowledges that there are no exceptions taken or reserved under this Agreement.

ARTICLE XVIII - PROTECTION OF INFORMATION

The parties agree that they shall take appropriate measures to protect proprietary, privileged, or otherwise confidential information that may come into their possession as a result of this Agreement.

A. RELEASE OF TECHNICAL DATA

No information, oral or written, concerning the scope of this Agreement, shall be published or released to the public without the prior written approval of the TSA Contracting Officer.

B. RECORDS AND RELEASE OF INFORMATION

All Sensitive Security Information (SSI), as defined in 49 CFR Part 1520, shall be handled in accordance with that regulation and TSA policies. All members assigned to work under this

Agreement are subject to the provisions of 49 CFR Part 1520, Protection of Sensitive Security

Information. SSI may not be disclosed except in accordance with the provisions of that rule.

C. MEDIA

All media releases and other contact with or by media related to this Agreement and in accordance with the terms of this Agreement shall be referred to the Contracting Officer.

IN WITNESS WHEREOF, the Parties have entered into this Agreement by their duly authorized officers.

[ENTITYNAME]

THE UNITED STATES OF AMERICA

[CONTRACTING OFFICER NAME]

Contracting Officer

Transportation Security Administration (TSA)

Date

Date

ARTICLE XIX – RIGHTS IN DATA

The Government espouses no ownership rights in data or software, created or produced by performers under this agreement, including tools provided to the Government. Applicant data is not data created or produced under the OTA; applicant data will be considered TSA data. The

Government reserves the right to order access to or delivery of, and license to review all

Contractor data or software produced or utilized under the OTA for purposes of audit and compliance. Such license shall provide a right of use, solely for the purposes of this OTA.

ARTICLE XX PRIVACY ACT

(a) The Contractor agrees to—

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—

(i) The systems of records; and

(ii) The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(3) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

(c)(1) “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(2) “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(3) “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

PRIVACY ACT NOTIFICATION

The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

ARTICLE XXI – DATA STORAGE AND USAGE

All applicant data collected and stored by the Contractor for the purpose of applying for TSA Pre

✓® must be held in a separate database that can follow TSA prescribed data retention requirements.

The Contractor shall not use data collected from applicants for any purpose other than pre-screening for TSA Pre✓® unless the Contractor obtains express permission from the applicants after completion of the enrollment process for the program.

The Contractor must clearly distinguish the completion of the enrollment process for TSA Pre✓ ® before requesting permission from applicants to continue communication regarding any other marketing opportunities not affiliated with TSA Pre✓®. Any such marketing communications would require the applicants to affirmatively opt-in to such additional marketing. Contractors must obtain written authorization from each applicant to use the applicant’s biographic or biometric data for any purposes beyond those directly related to TSA, Pre✓® and must segregate TSA data from other data that the contractor may maintain on the same individual even where the same data element (name, for example) appears. Contractors will operate a "system of records" within the Privacy Act of 1974, 5 U.S.C. 552a, that limits the authorized disclosure and use of TSA data.

All prohibitions must be clearly stated in Terms and Conditions which are presented to applicants at the beginning of the enrollment process prior to the collection of information.

ARTICLE XXII - CHANGES

(a) The Contracting Officer may at any time, by written order, unilaterally direct changes within the general scope of this agreement in order to correct a security weakness, revise the schedule for specific activity, change operational parameters, adapt to new threats, or provide for more efficient operations, and shall modify the contract accordingly.

(b) If any such change cannot be accommodated by the performer within the time allowed by the

Contracting Officer, the Government may suspend the performer’s right to conduct any operations under this agreement, until the change can be implemented, for a fixed period, or permanently.

ARTICLE XXIII - INTERRELATIONSHIPS OF CONTRACTORS

(a) The Government has entered into other contractual relationships in order to provide technical support services in the conduct of studies, analyses and engineering activities separate from the work to be performed under this Agreement, yet having links and interfaces to them.

Further, the Government may extend these existing relationships or enter into new relationships.

The Performer may be required to coordinate with such other Contractor(s) through the Program

Manager in providing suitable, non-conflicting technical interfaces and in avoidance of duplication of effort. By suitable tasking, such other Contractor(s) may be requested to assist the

Government in the technical review of the Performer’s technical efforts. Information on reports provided under this SOW and related documents may, at the discretion of the Government, be provided to such other Contractor(s) for the purpose of such review.

(b) A Non-Disclosure Agreement (NDA), DHS Form 11000-6, shall be signed by all

Contractor employees assigned to perform services under this OTA prior to any work.

(c) The Government will not facilitate the signing of 3-way NDAs. Vendors must execute

NDAs with other companies to protect their information from unauthorized use or disclosure.

Any NDAs between vendors must be executed in a prompt manner to avoid impact on TSA.

ARTICLE XXIV - LIMITATION OF ASSIGNMENT

The [ENTITY NAME] may not assign its rights or obligations under this Agreement to any other entity or person without the prior written consent of the TSA.

ARTICLE XXV - PUBLICITY

All publicity or public affairs activities related to the subject matter of this Agreement must be coordinated with the TSA Office of Strategic Communication and Public Affairs.

ARTICLE XXVI – THE LICENSING OF THE TSA PRE✓®

TRADEMARK

1. The TSA Pre✓® trademark constitutes DHS-owned intellectual property, and is used in connection with the Department’s efforts to facilitate expedited security screening experiences for selected travelers of participating airlines. DHS hereby confers to Contractor a nonexclusive, nontransferable, royalty free use of the TSA Pre✓® trademark, including the right to copy, display and distribute, for the sole and exclusive purpose of including the trademark on materials authorized by DHS as part of contractors marketing to prospective TSA Pre✓® Program members. To maintain the legal protections associated with the trademark, TSA on behalf of

DHS must control the use of the trademark. Contractor agrees that no modifications to DHS

Materials, if provided, will be published without TSA review and prior written approval from

TSA (email communication is sufficient) other than the inclusion of [Entity Name]’s logos and other necessary data. Contractor also agrees that it shall not use the trademark in a manner or context that reflects unfavorably upon any component of DHS or which will diminish or damage the goodwill associated with the TSA Pre✓® trademark. Accordingly, such marketing materials shall be “non-controversial,” meaning the advertisements will be consistent with normal standards for mainstream public advertising, as well as DHS’s own advertising standards. In addition, the term precludes any political advertising, including but not limited to those pertaining to candidates, issues, parties, campaign committees, specific elections, etc., or any other advertising that may create a sense of sponsorship or imply endorsement by the government. Additionally, to protect and ensure the Governments interest against dilution of the

TSA Pre✓® trademark, i.e., dilution by “blurring” and/or dilution by “tarnishment”, for

Materials created by Contractor regarding participation in the TSA Pre✓® Program, Contractor agrees to release the Materials only after obtaining TSA’s prior written approval (email communication is sufficient). TSA prior approval is not needed for each individual item, provided that the use is substantially the same as prior approved materials. TSA will provide approval for classes of items associated with advertising.

2. Contractor will represent itself as an independent entity, and not as an affiliate of the TSA or

DHS. Any use of the TSA Pre✓® trademark on Contractor Materials shall include the following or similar credit, as appropriate:

“Contractor is not a government entity or affiliated with the Federal government. Contractor provides pre-enrollment services for the Transportation Security Administration’s TSA Pre✓®

Risk Based Screening Program. The TSA Pre✓® trademark is used under license with the permission of the U.S. Department of Homeland Security.” (The notice must be displayed in a type font of legible size). Contractor shall abide by the TSA Pre✓® License agreement. (See

SOW attachment # 5).

ARTICLE XXVII - SURVIVAL OF PROVISIONS

In the event of the completion of the performance of the scope of work of the OTA, or the termination of this OTA, whichever event occurs first, the following provisions shall remain in full force and effect: Article I – Parties; Article IV Responsibilities; Article VII – Funding and

Limitations; Article - Audits; Article XII - Disputes; Article XI- Limitation of Liability; Article

XVII - Protection of Information; Article XX – Privacy Act; Article XXV– Publicity; Article

XXVI – The Licensing of the TSA Pre✓® Trademark; Article XXIX – Required Federal

Procurement Provisions; and Article XXVII – Survival of Provisions.

ARTICLE XXVIII - FLOW DOWN PROVISIONS

All clauses within the Statement of Work (SOW), SOW attachments and related documents flow down in the provisions of the OTA. All SOW, SOW Attachments, and related documents flow down to subcontractors, suppliers, and all partners and affiliates, etc., of the [ENTITY NAME].

ARTICLE XXIX - INSURANCE

[ENTITY NAME] must arrange insurance or otherwise for the full protection of [ENTITY

NAME] from and against all liability to the third parties out of, or related to, it’s performance of this OTA.

The Department of Homeland Security (DHS) has not determined at this point that the TSA

Preè Application Expansion initiative satisfies the technical criteria for SAFETY Act

Designation and presumptively satisfies the criteria for SAFETY Act Certification.

TSA has not requested and the Department of Homeland Security (DHS) has not determined that the TSA Pre✓® Application Expansion initiative satisfies the technical criteria for SAFETY Act

Designation and presumptively satisfies the criteria for SAFETY Act Certification.

ARTICLE XXX - SECTION 504 COMPLIANCE (FEB 2015)

The [ENTITY NAME] shall comply fully with Section 504 of the Rehabilitation Act of 1973, as amended, which prohibits discrimination against qualified individuals with disabilities. No otherwise qualified individual with a disability shall, solely by reason of his or her disability, be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any program or activity for which [ENTITY NAME] is awarded a contract and/or receives

Federal financial assistance from the Transportation Security Administration. This includes, but is not limited to, providing reasonable accommodations and effective communication to persons with disabilities and ensuring physical accessibility to all participants.

ARTICLE XXXI - Sensitive Information Required Special Contract Terms (MARCH

2015) SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

(a) Applicability. This clause applies to [ENTITY NAME], its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of

Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure

Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-

296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal

Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of

Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation

Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for

Official Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel

Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for

Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53

Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://csrc.nist.gov/publications/PubsSPs.html

Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the

DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding

Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of

Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS

Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

(3) All Contractor employees with access to sensitive information shall execute DHS

Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the

COR or other Government personnel associated with the administration of the contract, as needed.

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the

Headquarters or Component Privacy Officer. Unless otherwise specified in the ATO letter, the

ATO is valid for three (3) years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

(1) Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version

9.1, July 24, 2012), or any successor publication, and the Security Authorization Process

Guide including templates.

(i) Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements

Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security

Plan, Contingency Plan, Contingency Plan Test Results, Configuration

Management Plan, Security Assessment Plan, Security Assessment

Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and

Interconnection Security Agreement(s). During the development of

SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the

SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53

Security and Privacy Controls for Federal Information Systems and

Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

(iii) Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy

Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years. The Contractor is required to update its SA package as part of the ATO renewal process. The Contractor shall update its SA package by one of the following methods: (1) Updating the SA documentation in the DHS automated information assurance tool for acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls; or (2) Submitting an updated SA package directly to the COR for approval by the Headquarters or Component CIO, or designee, at least 90 days before the

ATO expiration date for review and verification of security controls. The 90 day review process is independent of the system production date and therefore it is important that the

Contractor build the review into project schedules. The reviews may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place.

(3) Security Review. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and COR, contact the

Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to the DHS. Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of Government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

(4) Continuous Monitoring. All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security

Performance Plan, or successor publication. The plan is updated on an annual basis. The

Contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities.

The Government may elect to perform continuous monitoring and IT security scanning of

Contractor systems from Government tools and infrastructure.

(5) Revocation of ATO. In the event of a sensitive information incident, the Government may suspend or revoke an existing ATO (either in part or in whole). If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the Contractor to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor IT system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

(6) Federal Reporting Requirements. Contractors operating information systems on behalf of the Government or operating systems containing sensitive information shall comply with Federal reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors shall provide the COR with requested information within three (3) business days of receipt of the request. Reporting requirements are determined by the Government and are defined in the Fiscal Year 2014

DHS Information Security Performance Plan, or successor publication. The Contractor shall provide the Government with all information to fully satisfy Federal reporting requirements for Contractor systems.

(f) Sensitive Information Incident Reporting Requirements.

(1) All known or suspected sensitive information incidents shall be reported to the Headquarters or Component Security Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting requirements. When notifying the Headquarters or Component SOC, the Contractor shall also notify the Contracting

Officer, COR, Headquarters or Component Privacy Officer, and US-CERT using the contact information identified in the contract. If the incident is reported by phone or the Contracting

Officer’s email address is not immediately available, the Contractor shall contact the Contracting

Officer immediately after…