NMCC PWS Draft July 2026.pdf

Performance Work Statement (PWS)

National Managed Care Contract (NMCC)

United States Marshals Service

Office of Medical Operations

July 2026

1.0 INTRODUCTION

The mission of the United States Marshals Service (USMS), Prisoner Operations Division (POD) is to preserve the integrity of the Federal Judicial process by administering the federal detention management system, establishing national detention policy, and implementing national strategies and programs for the housing, transportation, and care of programs for the housing, transportation, and care of federal prisoners in a safe, secure, and cost-effective manner.

The mission of the Office of Medical Operations (OMO) is to ensure that USMS prisoners receive medically necessary healthcare while working to contain the prisoner medical costs incurred by the Federal Prisoner Detention Account; to provide prisoner medical case management, assists with medical prisoner placement, medical designations, and medical transport, responds to medical inquires; and develops medical cost containment initiatives and maintains medical policies, prisoner healthcare standards, and clinical guidelines.

This acquisition seeks to acquire contractor support services to provide a nationwide healthcare delivery system for USMS prisoners.

2.0 OBJECTIVES

The contractor will provide a nationwide healthcare delivery system. The contractor will:

• Establish a medical provider network (PPN) that covers the detention facilities used by the

USMS.

• Establish a dental network that covers the detention facilities used by the USMS.

• Establish a nationwide discounted pharmacy delivery and payment program.

• Ensure that all medical, dental, and non-network pharmacy claims are received from providers and validated, processed, re-priced, and paid consistent with the provisions of 18 U.S.C. 4006, as amended.

• Ensure customer service is provided to the USMS, as well as medical and dental providers serving the USMS prisoner population.

• Ensure that USMS data is securely maintained.

• Ensure that the USMS receives accurate and complete reporting data.

3.0 SCOPE of WORK

In accordance with the provisions 18 U.S.C. § 4013, the USMS is required to provide medical care to the prisoners in its custody. Pursuant to 18 U.S.C. § 4006, the USMS is precluded from paying rates more than Medicare rates for prisoner medical services. USMS prisoners are housed in state, local and contract detention facilities, in or near 285 federal court cities throughout the 50 states, Puerto Rico, the U.S. Virgin Islands and Guam. The USMS requires a preferred PPN to provide health care services to USMS prisoners when they are transported outside of the detention facility for medical reasons.

4.0 BACKGROUND

The current contract was awarded competitively to the Heritage Health Solutions, Inc., a service-disabled veteran-owned small business, on August 4, 2017. The period of performance for the contract started on October 1, 2017 and will end on September 30, 2027. The core tasks of this requirement remains unchanged with minor updates to PWS for the future requirement.

5.0 TYPE of CONTRACT CONTEMPLATED

An Indefinite Delivery, Indefinite Quantity contract with fix-price task orders is contemplated.

6.0 PERIOD of PERFORMANCE

The period of performance for this contract is seven (7) years from the date of award.

7.0 PLACE of PERFORMANCE

The place of performance will be the contractor’s facilities. No facilities will be provided for contractor work.

8.0 APPLICABLE DOCUMENTS

Attachment A – List of Detention Facilities Attachment B – Data Elements Attachment C – Definitions Attachment D – Acronyms

9.0 SPECIFIC REQUIREMENTS/TASKS

The USMS requires the services outlined in this PWS to meet its basic mission of providing health care to USMS prisoners. The contractor’s technical proposal is incorporated as part of the contract.

Task 1: Project Management Outcome: The highest quality project management results in efficient and effective support for

USMS and its prisoners.

1.1 The contractor shall provide project management services in accordance with best practices and shall be responsible for:

a. Meeting PWS performance standards including all deadlines established and agreed to between the Contractor and the Contracting Officer (CO) or the Contracting Officer Representative (COR).

b. Managing personnel.

c. Completing requests for background checks and ensuring personnel are properly cleared to perform services under this effort.

d. Ensuring contractor staff and replacement personnel are promptly acquired, trained and technically competent.

e. Submitting documentation, when requested, to support the staff under this contract

(e.g., company information, staffing expertise, prior experience in work like that required by this contract, past experience, etc.).

1.2 Facilitating a kickoff meeting/call with USMS personnel upon award to initiate the effort and submitting a Transition Plan.

1.3 Maintaining a day-to-day collaborative working relationship with the COR/designee and submitting deliverables.

Reporting

1.4 The contractor shall provide a quarterly status report that identifies, at minimum:

• The number of healthcare providers in the contractor’s PPN network.

• The number of dentists in the dental network.

• The percentage of claims generated by PPN providers as a percentage of claims generated by all providers within the last two years.

• The percentage of providers who are in the PPN network status as a percentage of all providers with USMS claims activity in the last two years.

• The providers that the contractor is proposing to add to the PPN and outcomes of efforts.

• Inaccuracies found on claims and claims re-pricing entries.

• Customer service inquiries require more than one business day for a response.

Meeting participation and support -The contractor shall facilitate:

1.5 Quarterly Contract Management Review meetings.

1.6 Quarterly Pharmacy Clinical Quality Management meetings.

Standard Reports

1.7 The contractor shall develop and provide, in Excel format, reports utilizing the data elements shown in Attachment B. (The reports must include information about various categories of claims both cumulatively and individually (e.g., valid, exception, duplicate, adjustment, dental, pharmacy, medical, etc.) The USMS will dictate the data elements that are required for the reports. The USMS must be able to access and download reports electronically via the contractor’s website or system. The following reports are required:

1. Monthly Transaction Report (MTR)

2. Billing Summary Documents and applicable back-up documents

3. Batch Transmittal Report (BTR)

4. Check Register

5. Check Register Summary

6. Provider Activity Report

7. Hospitalization Report

8. Refund History Report

9. Dialysis Report

10. HIV/AIDS Report

11. Hepatitis C Report

12. TB Report

13. COVID report

14. National Summary Report

15. Preferred Pricing Report (if applicable)

16. Optometry Utilization Report

17. Claims Activity by Jail

18. Diagnosis Activity Report

19. DRG Hospitalization Report

20. Dental Claims/Cost by Network Status

21. Pricing Comparison Report

22. Network Utilization Report by Jail

23. Claims Payment Report

24. “Other” Pricing Report by Jail

25. Claims History Report including options by prisoner, district, and return date

26. Emergency Room Report

27. Charts: a. Costs by Network Status; b. Claims by Network Status; c. Inpatient Claims by Network Status; d. Inpatient Costs by Network Status; e. Professional Claims by Network Status; and f. Professional Costs by Network Status.

28. Pending Contractor Refund Status Summary

29. Implementation Status Report (NMCC Pharmacy Program)

30. Monthly Estimate of Delivered Orders

31. Claims Report by Procedure

Task 2: Preferred Provider Network Outcome: USMS prisoners have access to a PPN that provides offsite inpatient and outpatient healthcare.

The contractor shall provide and maintain a comprehensive, nationwide medical PPN to provide accessible offsite inpatient and outpatient healthcare to USMS prisoners.

The USMS recognizes that network providers may not be available in all instances to treat USMS prisoners. Accordingly, the USMS may send prisoners to medical providers that are not affiliated with the contractor’s PPN. The contractor is required to receive, validate, process, re-price, and pay all claims, including those generated by providers that are not affiliated with the contractor’s PPN. The contractor should strive to maintain a network of providers that is as comprehensive as possible. The USMS will pay the USMS Allowed Amount which is the lowest of the following:

Medicare rate, the PPN rate, full billed charges, or other applicable rate.

PPN Maintenance - The contractor shall:

2.1 Have in place an established PPN upon award of the contract that is sufficient to support the requirements of the PWS. The contractor shall provide the status of the number of healthcare providers in the contractor’s PPN upon request.

2.2 Augment the PPN if additional coverage is required by the USMS.

2.3 Monitor claims activity and initiate contracts with additional providers if warranted by USMS claims activity.

PPN Provider Requirements – The contractor shall:

2.4 Maintain an appropriate number of credentialed network physicians who have staff privileges at network hospitals and ambulatory surgical centers.

2.5 Ensure hospitals are accredited by the Joint Commission or certified by Centers for Medicare and Medicaid Services (CMS).

2.6 In accordance with FAR Clause 52.237-7, ensure that all network providers have adequate indemnification and medical liability insurance stipulated by law in the jurisdiction where the provider operates.

2.7 Identify hospitals where locked wards are available for USMS prisoners.

Required PPN Elements

2.8 The USMS has a need for the following provider specialties. The detention facilities listed in Attachment A have identified medical providers that have agreed to treat USMS prisoners.

Some of these providers are included in the current contracted PPN and others are not.

Allergy/Immunology Ambulance Services Ambulatory Surgery Center Anesthesiology Cardiology Cardiovascular/Thoracic Surgery Chemotherapy Dermatology Dialysis Durable Medical Equipment (DME) Endocrinology Endodontics Gastroenterology General Medicine General Surgery Gynecology Hematology Hepatology Hospital Facility Infectious Disease Laboratory Long Term Care Facility Mental Health/Behavioral Health Nephrology Neurology Neurosurgery Nuclear Medicine Obstetrics Oncology Ophthalmology Optometry Oral Maxilla Facial Surgery Orthopedics Orthodontics Otorhinolaryngology Pain Management Pathology Podiatry Prosthetics Psychiatry Pulmonology Radiation Therapy Radiology Rehabilitation (OT/PT/ST/Cardiac) Skilled Nursing Facility

Urology Vascular Surgery Wound Care

2.9 The contractor shall ensure that medical providers understand that the amount the USMS pays for prisoner medical services, by law, will not exceed the Medicare rate for those services. If a PPN provider refuses to accept Medicare rates for services rendered, the contractor must inform the USMS COR and the District that has custody of the prisoner.

2.10 The contractor shall maintain and provide the USMS and its detention facilities with access to a website that will:

• Contain a current list of PPN providers and profile information.

• Allow the USMS to be able to print PPN profile information from the website by single provider and/or multiple providers by specialty.

2.11 The contractor shall provide a process for the USMS to nominate additional medical providers for inclusion in the PPN.

Task 3: Centralized Claims Processing Outcome: Medical, dental and non-network pharmacy claims for USMS prisoners are accurately processed and re-priced.

The contractor shall establish an automated medical claims system to process and re-price valid claims for prisoner medical care for all categories of claims.

Task Management – Process Claims The contractor shall:

3.1 Upon receiving the award, work in concert with the USMS, to establish a SOP to address day-to-day procedures for processing USMS medical, dental, and non-network pharmacy claims and submit it to the USMS COR for approval. The SOP will be updated annually.

3.2 Review prisoner claims that providers submit to the contractor either electronically or by mail.

Mailed claims must be scanned into the contractor’s claims processing system and maintained by the contractor. The contractor must record and track the date of receipt of all claims and related information in the contractor’s claims database.

3.3 Not processing claims received from any other source other than the medical provider rendering the service. Misdirected claims shall be returned to the sender without action, with directions to the sender for correction.

3.4 Establish an encrypted (comply with FIPS 140-2) email account that will allow for electronic transmission of prisoner Personally Identifiable Information (PII).

3.5 Ensure that all claims other than exception claims comply with CMS coding/forms standards for the CMS1450/CMS1500, the ADA dental coding/forms standards for the J400, or applicable replacement coding/form standards.

3.6 Be responsible for recording and maintaining the data elements identified in Attachment B for all claims and is responsible for obtaining any incomplete or missing information for data elements identified in Attachment B.

3.7 Provide Explanations of Benefits (EOBs) for prisoner claims that show the District name and number, the prisoner’s name and number, the prisoner’s account number, the Contractor’s claim number, the provider/payee’s name and address, the dates and nature of services provided, applicable codes, billed charges, the USMS allowed amount, reasons and explanations for non-payments and adjustments, the Contractor’s contact information, and other items as deemed necessary by the USMS. The draft EOB format must be developed and approved by the USMS. The contractor will obtain USMS approval before making any changes to the EOB format.

3.8 Process valid, duplicate, exception, adjustment, rejection, and revision claims. Valid, duplicate, exception, adjustment, and rejection claims require EOBs. Revision claims do not require EOBs. All adjustment claims will be made available to the USMS COR for review as they occur. An adjustment is a monetary change to a paid USMS prisoner medical claim which will result in either an additional payment or a refund due from the provider. If a refund is received, the contractor will issue credit to the USMS District in its next billing summary document.

3.9 Develop and submit to the USMS a recoupment process for claims requiring refund.

Recoupments of overpayments will be reported to the USMS COR and credited in the following District billing summary document with a credit memo. The contractor shall be able to offset future payments to medical providers within its PPN network as well as non-network providers to recoup payments made to those providers that need to be refunded to the government. The contractor must be able to track these offsets, reporting them on the District billing summary documents and standard reports.

3.10 Ensure that all errors on processed and paid claims are corrected.

3.11 Establish an anti-fraud program that provides oversight of health care providers that identifies unusual patterns of care, over-utilization of services, suspected fraudulent billing practices and other unusual practices. Potential cases of fraud must be reported to the USMS.

3.12 Provide training for USMS staff and other entities, as needed, to support implementation of the claims processing task of the NMCC. Provide online access to all training materials.

3.13 Notify the USMS 60 calendar days prior to making changes to its re-pricing software and claims processing system.

3.14 The contractor’s claims processing system shall:

• Be HIPAA compliant.

• Incorporate historical USMS prisoners claims information for possible later retrieval and usage. (The historical information will be delivered to the contractor upon award).

• Automatically assign an internal control tracking number for each claim.

• Calculate and track the USMS allowed amounts for medical services and consider coordination of benefits where applicable.

• Identify, track, and block duplicate or invalid claims from being processed for payment.

• Identify and track claims by District, Sub-office, provider, prisoner, detention facility, procedures, treatments, surgeries, and other types of medical care.

• Record and maintain data (e.g., look up menus, tables, etc.) that includes at a minimum jail code/name/city/state, prisoner number/name (including aliases), and provider information. Data should be entered into and stored in a way that alleviates errors on claim entries and reports.

• Identify, issue and track provider payments and refunds.

• Track and recover credits/overpayments from providers, including offsets against future payments to all providers.

• Calculate average cost savings per claim by various categories including cost savings in absolute dollar amounts and on a percentage basis by provider, detention facility, prisoner, and on a district and national basis.

• Be capable of conducting trend analysis.

• Track costs by payment date and dates of service.

• Track payments to providers by type (e.g., check, EFT, credit card, etc.).

• Track costs and cost trends by type of care (e.g., inpatient, outpatient, ASC, SNF, lab, DRG, diagnosis, dental, pharmacy, etc.).

• Support and allow for audits as needed. Audits will be performed in accordance with

Government Auditing Standards as referenced by Generally Accepted Accounting Principles.

• Track and report USMS cost avoidance/savings (e.g., compare full billed charges to the USMS Allowed Amount paid; Medicare rate vs. PPN rate paid, etc.).

• Identify and track all valid medical, dental, and non-network pharmacy claims, as well as revisions, duplicates, adjustments, and rejections.

• Maintain Accounts Payable and Accounts Receivable records to support the disbursement and receipt of funds.

• Record all disbursement and credit adjustments, with dates of actions for medical, dental, and non-network pharmacy claims. Keep track of pending and successful recoupments and the status of efforts to recoup payments.

Valid Claims Re-pricing

3.15 Upon receiving the award, work in concert with the USMS, to establish an SOP to address day-to-day procedures for re-pricing USMS prisoner medical claims and submit it to the USMS COR for approval. The SOP will be updated annually.

The Contractor shall:

• Re-price all applicable claims to billed rates, Medicare rates, PPN rates, and any other applicable rates; whichever is lowest

• Determine the USMS Allowed Amount for prisoner medical claims submitted to the contractor and adjust claim amounts as needed. The USMS Allowed Amount is the lowest of the following: Medicare rate, the PPN rate, full billed charges, or another applicable rate. The contractor will be reimbursed at the USMS Allowed Amount.

• Maintain all documentation that supports pricing determination, including the pricing program used, and attach relevant documentation to the electronic file.

• Ensure that re-pricing software is current and be responsible for all system/software errors and for adjusting any claims or payments impacted by the system/software errors.

System errors are errors caused due to a system malfunction. The contractor will not be compensated for processing fees for claims adjusted due to system errors. The contractor will be reimbursed for payment made to the provider if this type of adjustment results in additional monies being paid to the provider.

• Price and verify inpatient hospital claims at the correct DRG.

• Ensure that claims, for which there is no Medicare rate or for which Medicare does not allow payment, are referred to the USMS COR for processing and payment determination.

• Update claims system with new Medicare rates, pricing software, and updates from outside vendors within 5 business days following publication of and availability of the rates and software.

Task 4: Centralized Claims Payment Outcome: Medical, dental and non-network pharmacy claims for USMS prisoners are accurately and promptly paid.

Claims Payment Requirements - The contractor shall:

4.1 Issue accurate payment at the USMS Allowed Amount to providers for USMS prisoner medical, dental, and non-network pharmacy claims. The USMS will then reimburse the contractor for these payments.

4.2 Upon receiving the award, work in concert with the USMS, to establish an SOP to address day-to-day procedures for the payment of USMS prisoner medical claims and submit it to the USMS COR for approval. The SOP will be updated annually. (The contractor may establish a single SOP for claims processing, re-pricing, and payment.)

4.3 Operate and maintain a comprehensive automated financial system capable of accurately tracking disbursements, contract costs, and providing payment for all valid claims.

4.4 Transmit monthly billing summary and backup documents to the Districts for prisoner medical/dental/non-network pharmacy provider payments.

4.5 Consolidate multiple monthly claim/invoice payments to one provider/Tax Identification

Number (TIN) into ONE payment. Contractor shall make monthly payments to providers for calendar month-end activity. The contractor must be able to make payments by EFT, credit card and check.

4.6 Document and track all payment errors and ensure each error is corrected or adjusted as quickly as possible.

4.7 Report system errors and other contractor errors to the COR in writing within 1 business day of the error. System errors are errors caused due to a system malfunction. Other contractor errors include but are not limited to typos in dollar amounts, prisoner numbers, TINs, incorrect provider paid, and incorrect re-pricing of claims that are not due to CMS late reporting of new fee schedules/prices. The contractor shall also report the financial impact of the issue on current and previous claims and a time frame for implementing corrective action. The contractor will not be paid a processing fee for adjustments to claims needed because of system errors or other contractor errors. However, if the claims adjustments described above result in additional money being owed by the providers, the contractor will be reimbursed for those additional provider payments.

4.8 Issue 1099s to service providers.

Task 5: NMCC Pharmacy Program and Payment Services Outcome: USMS prisoners have access to a national pharmacy network. NMCC pharmacy claims are accurately processed and promptly paid through an automated pharmacy claims system.

Approximately 85% of the eligible USMS detention facilities (excluding federal and private contracted facilities) utilized by the USMS participate in the current NMCC Pharmacy Program.

A list of detention facilities that are participating in the current contracted NMCC Pharmacy Program will be provided to the contractor upon contract award to assist the contractor, as needed, in developing an NMCC Pharmacy Services Plan to support the new contract award. The contractor will be required to process and pay pharmacy bills generated by pharmacy providers outside of its pharmacy network (non-network pharmacy claims).

NMCC Pharmacy Program - The contractor shall:

5.1 Develop and maintain a national pharmacy program (mail order and retail) for prisoners located at participating detention facilities utilized by the USMS.

5.2 Provide an NMCC Pharmacy Services Plan that will outline the contractor’s strategy to activate its pharmacy network and enroll USMS jails into the NMCC Pharmacy Program during the transition period as described in Task 10 and 11 of this PWS, and thereafter. The NMCC Pharmacy Services Plan shall include an SOP that addresses the contractor’s day-to-day operations and its plan for providing USMS prisoners with pharmacy services in accordance with the requirements of this task. The contractor shall submit this plan to the NMCC COR for approval The SOP will be updated annually.

5.3 Provide a pharmacist for technical oversight of the NMCC Pharmacy Network.

5.4 Provide and maintain a prescription drug program that:

• Be HIPPA compliant

• Can receive electronic USMS prisoner custody data so that the contractor can determine prisoner eligibility for network pharmacy orders.

• Provides the USMS with the ability to review specific medication requests.

• Provides required prisoner medications on an expedited basis.

• Can acquire high-cost specialty medications at a discounted price.

• Obtains discounts on prescription medications.

• Establishes a formulary and allows for periodic reviews and updating of the formulary.

• Requires the use of generic medications where medically appropriate and available.

• Tracks the type, brands, and costs of drugs by general drug category.

• Calculates the cost per prisoner for the requested period.

• Tracks the prescribing trends of both detention facilities and physicians.

• Identifies jails that are not using the NMCC pharmacy by reviewing non-NMCC pharmacy claims.

• Provides training for USMS staff and other entities, as needed, to support implementation of the pharmacy task of the NMCC. Provides online access to all training materials.

• Monitors costs for district pharmacy purchases for jails not participating in the national pharmacy program to identify high-cost prescriptions and bring them to the attention of the

COR.

• Incorporates an automated financial system capable of accurately tracking disbursements and providing for payment of all valid invoices.

• Issues payments to pharmacies for valid invoices and makes adjustments that require additional payment or credits.

• Provides for an encrypted (comply with FIPS 140-2) electronic process to review District disputes of NMCC pharmacy billings and adjudicates these disputes within 7 business days to include credit or adjustment of the billed or paid amounts and correction of the underlying records by the subsequent billing period.

• Provides for the investigation of billing disputes and keeps Districts and the COR abreast of investigation findings using an encrypted (comply with FIPS 140-2) communication system. The contractor’s adjudication of the dispute may be appealed by the USMS. The Contractor will maintain records and reports of such dispute reviews by fiscal year for access by the USMS.

• Provides reports monthly of pharmacy orders and billings by jail, district and prisoner in Excel and PDF format for use by the USMS and district staff in common USMS data analysis tasks.

• Transmits monthly billing summary and backup documents to the Districts for network pharmacy provider payments.

Task 6: Information Security Outcome: Information is maintained and easily accessed on a secure electronic platform.

Security of Department Information and Systems

6.1 Applicability to Contractors and Subcontractors

6.1.1 This clause applies to all contractors and subcontractors, including cloud service providers (“CSPs”), and personnel of contractors, subcontractors, and CSPs (hereinafter collectively, “Contractor”) that may access, collect, store, process, maintain, use, share, retrieve, disseminate, transmit, or dispose of DOJ Information.

It establishes and implements specific DOJ requirements applicable to this Contract. The requirements established herein are in addition to those required by the Federal Acquisition Regulation (FAR”), including FAR 11.002(g) and 52.239- 1, the Privacy Act of 1974, and any other applicable laws, mandates, Procurement Guidance Documents, and Executive Orders pertaining to the development and operation of Information Systems and the protection of Government Information.

This clause does not alter or diminish any existing rights, obligations or liability under any other civil and/or criminal law, rule, regulation or mandate.

6.2 General Definitions

6.2.1 The following general definitions apply to this clause. Specific definitions also apply as set forth in other paragraphs.

6.2.1.1 Information means any communication or representation of knowledge such as facts, data, or opinions, in any form or medium, including textual, numerical, graphic, cartographic, narrative, or audiovisual. Information includes information in an electronic format that allows it be stored, retrieved or transmitted, also referred to as “data,” and “personally identifiable information” (“PII”), regardless of form.

6.2.1.2 Personally Identifiable Information (or PII) means any information about an individual maintained by an agency, including, but not limited to, information related to education, financial transactions, medical history, and criminal or employment history and information, which can be used to distinguish or trace an individual's identity, such as his or her name, social security number, date and place of birth, mother's maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.

6.2.1.3 DOJ Information means any Information that is owned, produced, controlled, protected by, or otherwise within the custody or responsibility of the DOJ, including, without limitation, Information related to DOJ programs or personnel. It includes, without limitation, Information (1) provided by or generated for the DOJ, (2) managed or acquired by Contractor for the DOJ in connection with the performance of the contract, and/or (3) acquired to perform the contract.

6.2.1.4 Information System means any resources, or set of resources organized for accessing, collecting, storing, processing, maintaining, using, sharing, retrieving, disseminating, transmitting, or disposing of (hereinafter collectively, “processing, storing, or transmitting”) Information.

6.2.1.5 Covered Information System means any information system used for, involved with, or allowing, the processing, storing, or transmitting of DOJ Information.

6.3 Confidentiality and Non-disclosure of DOJ Information

6.3.1 Preliminary and final deliverables and all associated working papers and material generated by contractor containing DOJ Information are the property of the U.S.

Government and must be submitted to the Contracting Officer (“CO”) or the CO’s Representative (“COR”) at the conclusion of the contract. The U.S. Government has unlimited data rights to all such deliverables and associated working papers and materials in accordance with FAR 52.227-14.

6.3.2 All documents produced in the performance of this contract containing DOJ

Information are the property of the U.S. Government and contractor shall neither reproduce nor release to any third-party at any time, including during or at expiration or termination of the contract without the prior written permission of the CO.

6.3.3 Any DOJ information made available to contractor under this contract shall be used only for the purpose of performance of this contract and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract. In performance of this contract, contractor assumes responsibility for the protection of the confidentiality of all DOJ Information processed, stored, or transmitted by the contractor. When requested by the CO (typically no more than annually), contractor shall provide a report to the CO identifying, to the best of Contractor’s knowledge and belief, the type, amount, and level of sensitivity of the DOJ Information processed, stored, or transmitted under the Contract, including an estimate of the number of individuals for whom PII has been processed, stored or transmitted under the Contract and whether such information includes social security numbers (in whole or in part).

6.4 Compliance with Information Technology Security Policies, Procedures and Requirements

6.4.1 For all Covered Information Systems, Contractor shall comply with all security requirements, including but not limited to the regulations and guidance found in the Federal Information Security Management Act of 2014 (“FISMA”), Privacy Act of 1974, E-Government Act of 2002, National Institute of Standards and Technology (“NIST”) Special Publications (“SP”), including NIST SP 800-37, 800-53, and 800-60 Volumes I and II, Federal Information Processing Standards (“FIPS”) Publications 140-2, 199, and 200, OMB Memoranda, Federal Risk and Authorization Management Program (“FedRAMP”), DOJ IT Security Standards, including DOJ Order 2640.2, as amended. These requirements include but are not limited to:

6.4.1.1 Limiting access to DOJ Information and Covered Information Systems to authorized users and to transactions and functions that authorized users are permitted to exercise;

6.4.1.2 Providing security awareness training including, but not limited to, recognizing and reporting potential indicators of insider threats to users and managers of DOJ Information and Covered Information Systems;

6.4.1.3 Creating, protecting, and retaining Covered Information System audit records, reports, and supporting documentation to enable reviewing, monitoring, analysis, investigation, reconstruction, and reporting of unlawful, unauthorized, or inappropriate activity related to such Covered Information Systems and/or DOJ Information;

6.4.1.4 Maintaining authorizations to operate any Covered Information System;

6.4.1.5 Performing continuous monitoring on all Covered Information Systems;

6.4.1.6 Establishing and maintaining baseline configurations and inventories of Covered Information Systems, including hardware, software, firmware, and documentation, throughout the Information System Development Lifecycle, and establishing and enforcing security configuration settings for IT products employed in Information Systems;

6.4.1.7 Ensuring appropriate contingency planning has been performed, including DOJ

Information and Covered Information System backups;

6.4.1.8 Identifying Covered Information System users, processes acting on behalf of users, or devices, and authenticating and verifying the identities of such users, processes, or devices, using multifactor authentication or HSPD-12 compliant authentication methods where required;

6.4.1.9 Establishing an operational incident handling capability for Covered Information Systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities, and tracking, documenting, and reporting incidents to appropriate officials and authorities within Contractor’s organization and the DOJ;

6.4.1.10 Performing periodic and timely maintenance on Covered Information Systems, and providing effective controls on tools, techniques, mechanisms, and personnel used to conduct such maintenance;

6.4.1.11 Protecting Covered Information System media containing DOJ Information, including paper, digital and electronic media; limiting access to DOJ Information to authorized users; and sanitizing or destroying Covered Information System media containing DOJ Information before disposal, release or reuse of such media;

6.4.1.12 Limiting physical access to Covered Information Systems, equipment, and physical facilities housing such Covered Information Systems to authorized U.S. citizens unless a waiver has been granted by the Contracting Officer (“CO”), and protecting the physical facilities and support infrastructure for such Information Systems;

6.4.1.13 Screening individuals prior to authorizing access to Covered Information Systems to ensure compliance with DOJ Security standards;

6.4.1.14 Assessing the risk to DOJ Information in Covered Information Systems periodically, including scanning for vulnerabilities and remediating such vulnerabilities in accordance with DOJ policy and ensuring the timely removal of assets no longer supported by the Contractor;

6.4.1.15 Assessing the security controls of Covered Information Systems periodically to determine if the controls are effective in their application, developing and implementing plans of action designed to correct deficiencies and eliminate or reduce vulnerabilities in such Information Systems, and monitoring security controls on an ongoing basis to ensure the continued effectiveness of the controls;

6.4.1.16 Monitoring, controlling, and protecting information transmitted or received by

Covered Information Systems at the external boundaries and key internal boundaries of such Information Systems, and employing architectural designs, software development techniques, and systems engineering principles that promote effective security; and

6.4.1.17 Identifying, reporting, and correcting Covered Information System security flaws in a timely manner, providing protection from malicious code at appropriate locations, monitoring security alerts and advisories and taking appropriate action in response.

6.4.2 Contractor shall not process, store, or transmit DOJ Information using a Covered Information System without first obtaining an Authority to Operate (“ATO”) for each Covered Information System. The ATO shall be signed by the Authorizing Official for the DOJ component responsible for maintaining the security, confidentiality, integrity, and availability of the DOJ Information under this contract. The DOJ standards and requirements for obtaining an ATO may be found at DOJ Order 2640.2, as amended.

(For Cloud Computing Systems, see 6.5 below.)

6.4.3 Contractor shall ensure that no Non-U.S. citizen accesses or assists in the development, operation, management, or maintenance of any DOJ Information System, unless a waiver has been granted by the by the DOJ Component Head (or his or her designee) responsible for the DOJ Information System, the DOJ Chief Information Officer, and the DOJ Security Officer.

6.4.4 When requested by the DOJ CO or COR, or other DOJ official as described below, in connection with DOJ’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of DOJ Information, Contractor shall provide DOJ, including the Office of Inspector General (“OIG”) and Federal law enforcement components, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor’s facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by DOJ or agents acting on behalf of DOJ, and such access shall be provided within 72 hours of the request. Additionally, Contractor shall cooperate with DOJ’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of DOJ Information.

6.4.5 The use of Contractor-owned laptops or other portable digital or electronic media to process or store DOJ Information covered by this clause is prohibited until Contractor provides a letter to the DOJ CO, and obtains the CO’s approval, certifying compliance with the following requirements:

6.4.5.1 Media must be encrypted using a NIST FIPS 140-2 approved product;

6.4.5.2 Contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date;

6.4.5.3 Where applicable, media must utilize antivirus software and a host-based firewall mechanism;

6.4.5.4 Contractor must log all computer-readable data extracts from databases holding DOJ

Information and verify that each extract including such data has been erased within 90 days of extraction or that its use is still required. All DOJ Information is sensitive information unless specifically designated as non-sensitive by the DOJ; and,

6.4.5.5 A Rules of Behavior (“ROB”) form must be signed by users. These rules must address, at a minimum, authorized and official use, prohibition against unauthorized users and use, and the protection of DOJ Information. The form also must notify the user that he or she has no reasonable expectation of privacy regarding any communications transmitted through or data stored on Contractor-owned laptops or other portable digital or electronic media.

6.4.6 Contractor-owned removable media containing DOJ Information shall not be removed from DOJ facilities without prior approval of the DOJ CO or COR.

6.4.7 When no longer needed, all media must be processed (sanitized, degaussed, or destroyed) in accordance with DOJ security requirements.

6.4.8 Contractor must keep an accurate inventory of digital or electronic media used in the performance of DOJ contracts.

6.4.9 Contractor must remove all DOJ Information from Contractor media and return all such information to the DOJ within 15 days of the expiration or termination of the contract, unless otherwise extended by the CO, or waived (in part or whole) by the CO, and all such information shall be returned to the DOJ in a format and form acceptable to the DOJ. The removal and return of all DOJ Information must be accomplished in accordance with DOJ IT Security Standard requirements, and an official of the Contractor shall provide a written certification certifying the removal and return of all such information to the CO within 15 days of the removal and return of all DOJ Information.

6.4.10 DOJ, at its discretion, may suspend Contractor’s access to any DOJ Information, or terminate the contract, when DOJ suspects that Contractor has failed to comply with any security requirement, or in the event of an Information System Security Incident (see paragraph 6.4.11), where the Department determines that either event gives cause for such action. The suspension of access to DOJ Information may last until such time as DOJ, in its sole discretion, determines that the situation giving rise to such action has been corrected or no longer exists. Contractor understands that any suspension or termination in accordance with this provision shall be at no cost to the DOJ, and that upon request by the CO, Contractor must immediately return all DOJ Information to DOJ, as well as any media upon which DOJ Information resides, at Contractor’s expense.

6.4.11 All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident will be made by DOJ senior officials or the DOJ Core Management Team at DOJ’s discretion.

6.5 Cloud Computing

6.5.1 Cloud Computing means an Information System having the essential characteristics described in NIST SP 800-145, The NIST Definition of Cloud Computing. For the sake of this provision and clause, Cloud Computing includes Software as a Service, Platform as a Service, and Infrastructure as a Service, and deployment in a Private Cloud, Community Cloud, Public Cloud, or Hybrid Cloud.

6.5.2 Contractor may not utilize the Cloud system of any CSP unless:

6.5.2.1 The Cloud system and CSP have been evaluated and approved by a 3PAO certified under FedRAMP and Contractor has provided the most current Security Assessment Report (“SAR”) to the DOJ CO for consideration as part of Contractor’s overall System Security Plan, and any subsequent SARs within 30 calendar days of issuance, and has received an ATO from the Authorizing Official for the DOJ component responsible for maintaining the security confidentiality, integrity, and availability of the DOJ Information under contract; or,

6.5.2.2 If not certified under FedRAMP, the Cloud System and CSP have received an ATO signed by the Authorizing Official for the DOJ component responsible for maintaining the security, confidentiality, integrity, and availability of the DOJ Information under the contract.

6.5.3 Contractor must ensure that the CSP allows DOJ to access and retrieve any DOJ

Information processed, stored or transmitted in a Cloud system under this Contract within a reasonable time of any such request, but in no event less than 48 hours from the request. To ensure that the DOJ can fully and appropriately search and retrieve DOJ Information from the Cloud system, access shall include any schemas, meta-data, and other associated data artifacts.

6.6 Information System Security Breach or Incident

6.6.1 Definitions

6.6.1.1 Confirmed Security Breach (hereinafter, “Confirmed Breach”) means any confirmed unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any DOJ Information accessed by, retrievable from, processed by, stored on, or transmitted within, to or from any such system.

6.6.1.2 Potential Security Breach (hereinafter, “Potential Breach”) means any suspected, but unconfirmed, Covered Information System Security Breach.

6.6.1.3 Security Incident means any Confirmed or Potential Covered Information System Security Breach.

6.6.2 Confirmed Breach. Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the DOJ CO and the CO's Representative (“COR”). If the Confirmed Breach occurs outside of regular business hours and/or neither the DOJ CO nor the COR can be reached, Contractor must call DOJ-CERT at 1-866-US4-CERT (1-866-874-2378) immediately (and in no event later than within 1 hour of discovery of the Confirmed Breach) and shall notify the CO and COR as soon as practicable.

6.6.3 Potential Breach.

6.6.3.1 Contractor shall report any Potential Breach within 72 hours of detection to the DOJ CO and the COR, unless Contractor has (a) completed its investigation of the Potential Breach in accordance with its own internal policies and procedures for identification, investigation and mitigation of Security Incidents and (b) determined that there has been no Confirmed Breach.

6.6.3.2 If Contractor has not made a determination within 72 hours of detection of the

Potential Breach whether a Confirmed Breach has occurred, Contractor shall report the Potential Breach to the DOJ CO and COR within one-hour (e.g., 73 hours from detection of the Potential Breach). If the time by which to report the Potential Breach occurs outside of regular business hours and/or neither the DOJ CO nor the COR can be reached, Contractor must call the DOJ Computer Emergency Readiness Team (DOJ-CERT) at 1-866-US4-CERT (1-866-874-2378) within one-hour (e.g., 73 hours from detection of the Potential Breach) and contact the DOJ CO and COR as soon as practicable.

6.6.4 Any report submitted in accordance with paragraphs 6.6.2 and 6.6.3 above shall identify (1) both the Information Systems and DOJ Information involved or at risk, including the type, amount, and level of sensitivity of the DOJ Information and, if the DOJ Information contains PII, the estimated number of unique instances of PII, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the US-CERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by the DOJ. Contractor shall continue to provide written updates to the DOJ CO regarding the status of the Security Incident at least every three (3) calendar days until informed otherwise by the DOJ CO.

6.6.5 All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident will be made by DOJ senior officials or the DOJ Core Management Team at DOJ’s discretion.

6.6.6 Upon notification of a Security Incident in accordance with this section, Contractor must provide to DOJ full access to any affected or potentially affected facility and/or Information System, including access by the DOJ OIG and Federal law enforcement organizations, and undertake any and all response actions DOJ determines are required to ensure the protection of DOJ Information, including providing all requested images, log files, and event information to facilitate rapid resolution of any Security Incident.

6.6.7 DOJ, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third-party contractors or firms to aid in response activities related to any Security Incident. Additionally, DOJ, at its sole discretion, may require Contractor to retain, at Contractor’s expense, a Third-Party Assessing

Organization (3PAO), acceptable to DOJ, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

Response activities related to any Security Incident undertaken by DOJ, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of DOJ, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource allocations required for all such response activities related to any Security Incident, including the cost of any penetration testing.

6.7 Personally Identifiable Information Notification Requirement

6.7.1 Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information (“PII”) was, or is reasonably determined by DOJ to have been, compromised. Any notification shall be coordinated with the DOJ CO and shall not proceed until the DOJ has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, DOJ.