Maynard Inner Perimeter Fence Expansion - SOW - v20250722.pdf

DHS Statement of Work (SOW)

Version 2025.07.22 1

Federal Emergency Management Agency

STATEMENT OF WORK (SOW) FOR:

Region 1 – Maynard FRC – Inner Perimeter Fence Expansion

Anhur Maklef, Contracting Officer

Nicholas Bruno, Contracting Officer’s Representative (COR)

DEPARTMENT OF HOMELAND SECURITY (DHS)

Version 2025.07.22 2

Statement of Work (SOW) For Region 1 – Maynard FRC – Inner Perimeter Fence Expansion

1.0 GENERAL

1.1 BACKGROUND

1.1.1 The installation of a high-security perimeter fence is required to enhance the safety and control access to critical infrastructure at the site. The project consists of constructing a 10-foot-high chain link fence, incorporating high-security features and a cantilever gate system, all adhering to relevant ASTM standards.

1.2 SCOPE

1.2.1 The project includes installation of approximately 1,600 linear feet of 10-foot-high galvanized or stainless-steel chain-link fencing, inclusive of buried fabric, barbed wire, top and bottom rails, posts set in concrete, and a manually operated cantilever gate. All work shall adhere to ASTM standards.

The area shall be cleared of debris post-installation. If funding permits, Part B (provided as an optional, separate line item) includes removing existing gates and installing an automatic cantilever gate system.

1.3 OBJECTIVE

1.3.1 To secure the perimeter of the property with a robust, ASTM-compliant fence system that includes manual and potentially automated access gates, while ensuring safety, durability, and alignment with security protocols.

1.4 APPLICABLE DOCUMENTS

1.4.1 COMPLIANCE DOCUMENTS

1.4.1.1 Includes but is not limited to: ASTM A392, A824, F567, F900, F1083, F1043, F626, F668, F1910, F1184, F2200, UL 325.

1.4.2 REFERENCE DOCUMENTS

1.4.2.1 Includes but is not limited to: ASTM A392, A824, F567, F900, F1083, F1043, F626, F668, F1910, F1184, F2200, UL 325.

Version 2025.07.22 3

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 Site Preparation and Fence Installation

2.1.1 SITE PREPERATION

2.1.1.1 The contractor shall clear the fence line a minimum of 15 feet from the woods line.

2.1.1.1.1 In areas where the 15-foot set back is not possible, variations less than 3 feet may be made without approval. Variations over 3 feet must seek approval from the Contracting Officer’s Representative.

2.1.1.2 Areas of excavation must be marked utilizing DigSafe standard colors.

2.1.1.3 DigSafe survey and FEMA Infrastructure Survey must be completed and underground utilities will be marked.

2.1.1.4 The area shall be surveyed and graded as necessary.

2.1.2 FENCE CONSTRUCTION

2.1.2.1 The Contractor shall install approximately 1600 linear feet of 10’ high, chain link fence with:

2.1.2.1.1 6-gauge with 1-3/4 mesh or 9-gauge with ½“ mesh.

2.1.2.1.2 Chain link fabric buried a minimum of 12”.

2.1.2.1.3 Galvanized or Stainless Steel Material.

2.1.2.1.4 Top and bottom tension wire.

2.1.2.1.5 Top and bottom rails.

2.1.2.1.6 Posts buried 3 feet deep and set in 2500psi concrete.

2.1.2.2 The Contractor shall install barbed wire with:

2.1.2.2.1 12 ½ gauge, double strans, double barb, reverse twist barbed wire

2.1.2.2.2 Installation of “V” Bracing to secure barbed wire along the entirety of the fence line

2.1.2.2.2.1 Exception: Gates will not have V-Brace. Vertical straight braces shall be used on all gates.

2.1.2.2.2.2 Exception: Area where cantilever gate will roll will need to transition to a 45 degree outward facing brace to allow the gate to open and close.

2.1.2.2.2.3 3-barbed wire strands shall be hung on each side of the “V” Brace for a total of 6 strands.

Version 2025.07.22 4

2.1.2.3 Other Construction Requirements:

2.1.2.3.1 All bolts shall be peened.

2.1.2.3.2 Screws shall have security heads to prevent easy tampering.

2.1.2.3.3 Entirety of fence line shall be properly grounded.

2.1.2.3.4 All debris shall be removed from site post-construction. Use of government dumpsters is prohibited.

2.1.3 MANUAL GATE INSTALLATION

2.1.3.1 The contractor shall install a 12-foot wide, manually operated, cantilever gate matching the mesh and barbed wire requirements (with exception of the “V” Brace; a vertical straight brace shall be used on all gates. This location shall be approved by the COR to access the land between the inner perimeter and outer perimeter fence.

2.1.3.2 Heavy-duty wheels, rollers, and brackets to be used when available.

2.1.3.3 Gate shall have bracket to allow installation of a padlock to prevent gate from being opened.

2.1.3.4 Installation should account for and mitigate unauthorized entry under, through, or over the gate.

2.1.3.4.1 Large gaps under the gate may need to mitigated in various ways such as cold top build up, rip rap with gravel build up, etc. Solutions will need to be discussed and approved by the COR. Modifications to mitigate these measures shall be considered in the proposal and additional request for funding cannot be made.

2.2 Automated Gate Installation (Part B – Optional if Funded)

2.2.0 If funding permits, removal of existing gates and installation of an automatic gate opener shall be installed and integrated into PACS. 2.2 shall be listed as a separate line item and will be inclusive of the project if funding exists. If funding does not exist, Part B shall be excluded from the executed contract.

2.2.1 GATE REMOVAL AND FENCE MODIFICATION

2.2.1.1 Remove existing gates from the existing inner perimeter fence to accommodate a 12-foot automatic cantilever gate.

2.2.2 GATE INSTALLATION

2.2.2.1 Install an automatic cantilever gate with:

2.2.2.1.1 Electric gate operator with battery backup and PACS Integration.

Version 2025.07.22 5

2.2.2.1.2 Photo eye, safety edge, audio warning, manual override, and emergency stop button located on the inside of the gate.

2.2.2.1.3 Installation of a “geared” track rather than a tire track to ensure gate remains operational in harsh New England climates.

2.2.3 ELECTRICAL AND PACS INTEGRATION

2.2.3.1 Install low and high voltage conduit (minimum size 1¼’)

2.2.3.1.1 Hand digging will be required over the bunker to ensure no damage to the rubber membrane of the building.

2.2.3.2 All conduit shall be ran to the “Doghouse” on top of the bunker where it will transition the low voltage wiring high voltage wiring to the electrical panel.

2.2.3.3 PACS

2.2.3.3.1 Install (2) Veridt Stealth Dual Card Readers on the “Driver’s” left on pedestals (1 internal to the gate, 1 external to the gate).

2.2.3.3.2 Install Remote Management Boards and appropriate size power supply in a lockable, weatherproof enclosure that can be mounted by the pedestal or in the “doghouse”.

2.2.3.3.3 Run appropriate size wire to all components of the system to avoid transmission loss. Color shall be purple or approved by the COR.

2.2.3.3.4 Tie RM Boards into the existing Software House iStar panel located in the lower server room.

2.3 Documentation and Photography

2.3.1 PHOTOGRAPHY

2.3.1 Photography shall be permitted on the property to properly document all phases of the installation.

2.3.2 Photographs should be captured to document each of the tasks listed above in sections 2.1 and 2.2.

2.3.3 No photographs shall be taken of anything other than what is listed in this project.

2.3.4 Photographs shall not be used on any public websites, fliers, or disseminated to anyone other than the Contracting Officer and the COR.

2.3.5 Within 5 days after final acceptance, Contractor must delete or destroy all electronic and digital photos captured during the project

Version 2025.07.22 6

2.3.2 DOCUMENTATION

2.3.2.1 A final document shall be provided to the Contracting Officer and COR at the completion of the project. The document shall include but is not limited to:

2.3.2.1.1 Photos and short description of each task listed in sections 2.1 and 2.2 to show progress and completion of each task as defined in this SOW.

3.0 CONTRACTOR PERSONNEL

3.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW.

3.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all contract support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

3.3 Section is Reserved

3.4 Project Manager

3.4.0 The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this SOW. The Project Manager shall be a single point of contact for the Contracting Officer and the COR. It is anticipated that the Project Manager shall be one of the senior level employees provided by the Contractor for this work effort. The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. The Project Manager is further designated as Key by the Government. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak and understand English. Additionally, the Contractor shall not replace the Project Manager without notification the Contracting Officer.

3.4.1 THE PROJECT MANAGER SHALL BE AVAILABLE TO THE COR VIA TELEPHONE BETWEEN THE

HOURS OF 0800 AND 1400 EST, MONDAY THROUGH FRIDAY, AND SHALL RESPOND TO A

Version 2025.07.22 7

REQUEST FOR DISCUSSION OR RESOLUTION OF TECHNICAL PROBLEMS WITHIN 24 HOURS OF

NOTIFICATION.

3.5 Employee Identification

3.5.1 CONTRACTOR EMPLOYEES VISITING GOVERNMENT FACILITIES SHALL WEAR AN IDENTIFICATION

BADGE THAT IS STANDARD FOR VISITORS AT THE SITE.

3.5.1.1 Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

3.5.2 CONTRACTOR EMPLOYEES WORKING ON-SITE AT GOVERNMENT FACILITIES SHALL WEAR A

GOVERNMENT ISSUED IDENTIFICATION BADGE. ALL CONTRACTOR EMPLOYEES SHALL IDENTIFY

THEMSELVES AS CONTRACTORS WHEN THEIR STATUS IS NOT READILY APPARENT (IN MEETINGS, WHEN ANSWERING GOVERNMENT TELEPHONES, IN E-MAIL MESSAGES, ETC.) AND DISPLAY THE

GOVERNMENT ISSUED BADGE IN PLAIN VIEW ABOVE THE WAIST AT ALL TIMES.

3.6 Employee Conduct

3.6.1 Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security.

3.7 Removing Employees for Misconduct or Security Reasons

3.7.1 The Government may, at its sole discretion (via the Contracting Officer or Contracting Officer’s

Representative), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

4.0 Other Applicable Conditions

4.1 Security

4.1.0 Personnel may require access to information up to the sensitive but unclassified, for official use only

(FOUO) levels. Contractor must ensure contractor employees receive a favorably adjudicated public

Version 2025.07.22 8 trust suitability prior to entry on duty (EOD). All individuals will be U.S. citizens or Legal Permanent Residents. The contractor shall follow the standards established within DHS and FEMA policy.

4.1.1 UNAUTHORIZED DISCLOSURE OF CLASSIFIED OR UNCLASSIFIED INFORMATION

4.1.1.1 Contractors and Subcontractors who are working on this contract shall receive Unauthorized

Disclosure of Classified or Unclassified Information training.

Access to the training can be obtained at: Unauthorized Disclosure of Classified Information and Controlled Unclassified Information (usalearning.gov)

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

4.1.2 OPSEC TRAINING

4.1.2.1 Contractors and Subcontractors who are working on this contract shall receive the OPSEC Awareness

Brief. Access to the briefing can be obtained at OPSEC Awareness for Military Members, DOD Employees and Contractors (usalearning.gov). Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

4.1.3 INISDER THREAT TRAINING

4.1.3.1 Insider Threat training for Contractors can be found at: Insider Threat Awareness (usalearning.gov)

Certificate of training is required for all cleared contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

4.1.4 FOR OFFICIAL USE ONLY (FOUO) INFORMATION:

4.1.4.1 In accordance with DHS Management Directive 11042.1 contractors, consultants and others to whom access is granted will abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities.

4.1.4.2 The contractor will:

Version 2025.07.22 9

4.1.4.2.1 Be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

4.1.4.2.2 Participate in formal classroom or computer-based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

4.1.4.2.3 Be aware that divulging information without proper authority could result in administrative or disciplinary action.

4.1.4.3 Contractors and Consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified Information Non¬ Disclosure Agreement (NDA), as a condition of access to such information. Other individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an NDA as determined by the applicable program manager.

Execution of the NDA shall be effective upon date of the DHS Policy and not applied retroactively.

4.1.5 FOREIGN TRAVEL AND GOVERNMENT-ISSUED EQUIPMENT

4.1.5.1 Per DHS and FEMA IT policy, FEMA employees and contractors are not authorized to take government-issued equipment, including cell phones, computers, or tablets such as iPads, outside of the United States regardless of the reason for travel. If government-issued equipment is required for official foreign travel, FEMA government employees may request a temporary loaner device through the Mobility Service Center.Office of the Chief Information Officer, Service Center for the duration of their trip. FEMA contractors must contact their contracting officer’s representative (COR) for further guidance.

If your device is detected as operating outside of the United States and its territories it will be disabled, and your information will be forwarded to the Office of Professional Responsibility for review.

4.1.6 SECTION IS RESERVED

4.1.7 BACKGROUND INVESTIGATIONS

4.1.7.1 All contractor personnel who require access to DHS or FEMA information systems, routine access to

DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

4.1.7.1.1 Low Risk Without Information System Access

Version 2025.07.22 10

4.1.7.1.1.1 Contractor personnel occupying positions or performing functions with a Low Risk designation and who do not require access to DHS or FEMA information systems may undergo a Tier 1 investigation with a credit check and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

(also reference Facility Access).

4.1.7.1.2 Low Risk With Information System Access

4.1.7.1.2.1 Contractor personnel occupying positions or performing functions with a Low Risk designation and who require access to DHS or FEMA information systems shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

4.1.7.1.3 Moderate Risk

4.1.7.1.3.1 Contractor personnel occupying positions or performing functions with a Moderate Risk designation shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

4.1.7.1.4 High Risk

4.1.7.1.4.1 Contractor personnel occupying positions or performing functions with a High Risk designation shall undergo a Tier 4 Suitability Background Investigation (T4) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

4.1.8 BACKGROUND INVESTIGATION PROCESS

4.1.8.1 To initiate the request to process contractor personnel, the Contractor shall provide the FEMA

Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 11000-25, “Contract Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 11000-25 are complete prior to submitting the form to FEMA PSD for processing.

The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

• the investigation was completed within the last five years,

• it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract, Version 2025.07.22 11

• the contractor personnel have not had a break in employment since the prior favorable adjudication, and,

• FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email directly to the contractor applicant/personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the National Background Investigation Services (NBIS) e-Application (eAPP) online system and instructions for submitting the necessary information:

• Standard Form 85P, “Questionnaire for Public Trust Positions”

• Optional Form 306, “Declaration for Federal Employment”

• SF 87, “Fingerprint Card” (2 copies)

• DHS Form 11000-6, “Non-Disclosure Agreement”

• DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

FEMA PSD will only accept complete packages consisting of all of the above document and Standard Form 85P, which must be completed electronically through the National Background Investigation Services (NBIS) e-Application (eAPP) online system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

Version 2025.07.22 12

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

4.1.9 CONTINUED ELIGIBILITY AND REINVESTIGATION

4.1.9.1 Eligibility determinations based on a Low Risk T1, Moderate Risk T2S or High Risk T4 are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract

4.1.10 EXCLUSION BY CONTRACTING OFFICER

4.1.10.1 The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the

Contractor be excluded from working on this contract. Any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency may be removed.

4.1.11 FACILITY ACCESS

4.1.11.1 The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification

Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and an OF306, Declaration for Federal Employment, and receive approval from FEMA PSD.

Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

Version 2025.07.22 13

4.1.12 SEPERATION OF CONTRACT

4.1.12.1 The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a contractor employee’s employment.

• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the Contractor to civil and criminal liability.

4.2 Period of Performance

4.2.1 The period of performance for this contract is 90 days from the date of award.

4.3 Place of Performance

4.3.1 The primary place of performance will be 63 Old Marlboro Road, Maynard, MA. 01754.

4.4 Hours of Operation

4.4.1 Contractor employees shall generally perform all work between the hours of 0700 and 1500 EST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, this must be approved by the CO or the COR and hours outside of the “normal” business hours shall not incur overtime, differential, etc. rates billable to the government.

4.5 Travel

4.5.1 Contractor travel shall not be required for this requirement.

4.6 Post Award Conference

4.6.1 The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 5 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held

Version 2025.07.22 14 at the Government’s facility, located at 63 Old Marlboro Road, Maynard, MA. 01754 or via teleconference.

4.7 Project Plan

4.7.1 The Contractor shall provide a draft Project Plan at the Post Award Conference for Government review and comment. The Contractor shall provide a final Project Plan to the COR not later than 5 business days after the Post Award Conference.

4.8 Section is Reserved

4.9 Progress Reports

4.9.1 The Project Manager shall provide an informal progress report to the COR daily via face-to-face at the end of each working daily. A formal written progress report shall be submitted via email to the Contracting Officer and COR at the end of each working week. This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

4.10 Progress Meetings

4.10.1 The Project Manager shall be available to meet with the COR upon request to present deliverables, discuss progress, exchange information and resolve emergent technical problems and issues. These meetings shall take place insert location or means of communication at the Government's facility or via teleconference.

4.11 General Report Requirements

4.11.1 The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows 11 and Microsoft Office Applications).

4.12 This section is reserved

4.13 Protection of Information

4.13.1 Contractor access to proprietary information is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

Version 2025.07.22 15

4.14 Section 508 Compliance

4.14.1 Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-

220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

4.15 Safeguarding of Controlled Unclassified Information

4.15.1 DEFINITIONS: AS USED IN THIS CLAUSE-

4.15.1.1 Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls

4.15.1.2 Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

4.15.1.2.1 Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008).

4.15.1.2.2 Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Public Law 116–283), PCII's implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee.

4.15.1.2.3 Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”.

http://www.access-board.gov/ http://www.section508.gov/

Version 2025.07.22 16

4.15.1.2.4 Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015.

4.15.1.2.5 Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department.

4.15.1.2.6 International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization.

4.15.1.2.7 Information Systems Vulnerability Information (ISVI) means:

4.15.1.2.7.1 Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

4.15.1.2.7.2 Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

4.15.1.3 Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department.

4.15.1.4 Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting.

4.15.1.5 Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, Version 2025.07.22 17 grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation.

4.15.1.6 Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

4.15.1.6.1 Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

4.15.1.6.2 Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements:

• Truncated SSN (such as last 4 digits);

• Date of birth (month, day, and year);

• Citizenship or immigration status;

• Ethnic or religious affiliation;

• Sexual orientation;

• Criminal history;

• Medical information; and

• System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs).

4.15.1.7 Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Version 2025.07.22 18

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

4.15.1.8 Incident means an occurrence that:

4.15.1.8.1 Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

4.15.1.8.2 Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

4.15.1.8.3 Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

4.15.1.9 Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

4.15.1.9.1 Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity.

4.15.1.9.2 Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

4.15.1.9.3 Availability, which means ensuring timely and reliable access to and use of information.

4.15.1.10 Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

4.15.2 HANDLING OF CONTROLLED UNCLASSIFIED INFORMATION

4.15.2.1 Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in

Version 2025.07.22 19 effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

4.15.2.2 The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

4.15.2.3 The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer's Representative (COR) or other government personnel associated with the administration of the contract, as needed.

4.15.2.4 Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

4.15.3 INCIDENT REPORTING REQUIREMENTS

4.15.3.1 Contractors and subcontractors shall report all known or suspected incidents to the Component

Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

4.15.3.2 All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

4.15.3.3 CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140–2/140–3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projectscryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

https://www.dhs.gov/dhs-security-and-training-requirements-contractors

Version 2025.07.22 20

4.15.3.4 An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

4.15.3.5 If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

4.15.3.5.1 Unique Entity Identifier (UEI)

4.15.3.5.2 Contract numbers affected unless all contracts by the company are affected;

4.15.3.5.3 Facility CAGE code if the location of the event is different than the prime Contractor location

4.15.3.5.4 Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

4.15.3.5.5 Contracting Officer POC (address, telephone, and email);

4.15.3.5.6 Contract clearance level;

4.15.3.5.7 Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

4.15.3.5.8 Government programs, platforms, or systems involved

4.15.3.5.9 Location(s) of incident;

4.15.3.5.10 Date and time the incident was discovered;

4.15.3.5.11 Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

4.15.3.5.12 Description of the government PII or SPII contained within the system; and

4.15.3.5.13 Any additional information relevant to the incident.

4.15.4 INCIDENT RESPONSE REQUIREMENTS

4.15.4.1 All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

4.15.4.2 The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

Version 2025.07.22 21

4.15.4.3 Incident response activities determined to be required by the Government may include, but are not limited to, the following:

4.15.4.3.1 Inspections;

4.15.4.3.2 Investigations;

4.15.4.3.3 Forensic Reviews;

4.15.4.3.4 Data analyses and processing; and

4.15.4.3.5 Revocation of the Authority to Operate (ATO), if applicable.

4.15.4.4 The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

4.15.4.5 The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

4.15.5 CERTIFICATE OF SANITIZATION OF GOVERNMENT AND GOVERNMENT-ACTIVITY-RELATED FILES

AND INFORMATION

4.15.5.1 Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

4.15.6 OTHER REPORTING REQUIREMENTS

4.15.6.1 Incident reporting required by this clause in no way rescinds the Contractor's responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

4.15.7 SUBCONTRACTS

4.15.7.1 The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

Version 2025.07.22 22

4.15.8 AUTHORITY TO OPERATE

4.15.8.0 The Contractor shall not collect, process, store, or transmit CUI within a Federal information system until an ATO has been granted by the Component or Headquarters CIO, or designee. Once the ATO has been granted by the Government, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. Unless otherwise specified in the ATO letter, the ATO is valid for 3 years. An ATO is granted at the sole discretion of the Government and can be revoked at any time.

Contractor receipt of an ATO does not create any contractual right of access or entitlement. The Government's grant of an ATO does not alleviate the Contractor's responsibility to ensure the information system controls are implemented and operating effectively.

4.15.8.1 Complete the Security Authorization process: The Security Authorization (SA) process shall proceed according to DHS Policy Directive…