NNMS_RFP_05112023.pdf

RFP 70T01023R7663N001

TABLE OF CONTENTS

SECTION I – PRICE/COSTS

SECTION II – STATEMENT OF WORK

SECTION III – TSA REQUIREMENTS

SECTION IV – TSA ADMINISTRATION

SECTION V – CONTRACT CLAUSES

SECTION VI – SOLICITATION PROVISIONS

SECTION VII – INSTRUCTIONS TO OFFERORS

SECTION VIII – EVALUATION METHODOLOGY

SECTION IX – LIST OF ATTACHMENTS

SECTION I – PRICE/COSTS

CONTRACT TYPE

The contract for the Nationwide Network of Medical Services (NNMS) will consist of Firm Fixed Price (FFP) CLINs.

CONTRACT PRICING

TABLE FOR BASE PERIOD

PRICING - BASE PERIOD POP: 12-Months

CLIN Supplies/Services TYPE QTY Unit Type Unit Price Total Price

0001 Authority To Operate (ATO) (SOW Appendix 1) and Transition-In (Three Months) (SOW Sec. 10) FFP 1 Job

0002 OPTIONAL - USA Staffing Integration (SOW Sec. 15)** FFP 1 Job

Total $

** This Optional CLIN may be exercised any time during the contract period of performance pending TSA’s need.

TABLE FOR OPTION PERIOD 1

PRICING – OPTION PERIOD 1 - POP: 12-Months

1001 TSO Medical Evaluations (Option Period 1)

1001AA TSO Medical Evaluations FFP 20,000 Each

1001AB OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

1001AC OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

1001AD OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

1001AE OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

1001AF OPTIONAL - TSO Medical Evaluations FFP 2,358 Each

1002 FAMS Medical Evaluations (Option Period 1)

1002AA FAMS Medical Evaluations FFP 2,000 Each

1002AB OPTIONAL - FAMS Medical Evaluations FFP 541 Each

1003 TSS-EDCH Medical Evaluations (Option Period 1)

1003AA TSS-EDCH Medical Evaluations FFP 27 Each

1003AB OPTIONAL - TSS-EDCH Medical Evaluations FFP 27 Each

1004 TSS-E Medical Evaluations (Option Period 1)

1004AA TSS-E Medical Evaluations FFP 20 Each

1004AB OPTIONAL - TSS-E Medical Evaluations FFP 17 Each

1005 Criminal Investigator Medical Evaluations (Option Period 1)

1005AA Criminal Investigator Medical Evaluations FFP 5 Each

1005AB OPTIONAL - Criminal Investigator Medical Evaluations FFP 5 Each

1006 Mobile Medical and Drug Testing Evaluation Unit

1006AA Mobile Medical and Drug Testing Evaluation Unit FFP 12 Each

1006AB OPTIONAL - Mobile Medical and Drug Testing Evaluation Unit FFP 12 Each

1007 Program Management & Quality Control FFP 12 Month

1008 System Sustainment and ATO Re-validation (O&M) FFP 12 Month

TABLE FOR OPTION PERIOD 2

PRICING – OPTION PERIOD 2 - POP: 12-Months

2001 TSO Medical Evaluations (Option Period 2)

2001AA TSO Medical Evaluations FFP 20,000 Each

2001AB OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

2001AC OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

2001AD OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

2001AE OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

2001AF OPTIONAL - TSO Medical Evaluations FFP 2,358 Each

2002 FAMS Medical Evaluations (Option Period 2)

2002AA FAMS Medical Evaluations FFP 2,000 Each

2002AB OPTIONAL - FAMS Medical Evaluations FFP 541 Each

2003 TSS-EDCH Medical Evaluations (Option Period 2)

2003AA TSS-EDCH Medical Evaluations FFP 27 Each

2003AB OPTIONAL - TSS-EDCH Medical Evaluations FFP 27 Each

2004 TSS-E Medical Evaluations (Option Period 2)

2004AA TSS-E Medical Evaluations FFP 20 Each

2004AB OPTIONAL - TSS-E Medical Evaluations FFP 17 Each

2005 Criminal Investigator Medical Evaluations (Option Period 2)

2005AA Criminal Investigator Medical Evaluations FFP 5 Each

2005AB OPTIONAL - Criminal Investigator Medical Evaluations FFP 5 Each

2006 Mobile Medical and Drug Testing Evaluation Unit (Option Period 2)

2006AA Mobile Medical and Drug Testing Evaluation Unit FFP 12 Each

2006AB OPTIONAL - Mobile Medical and Drug Testing Evaluation Unit FFP 12 Each

2007 Program Management & Quality Control FFP 12 Month

2008 System Sustainment and ATO Re-validation (O&M) FFP 12 Month

TABLE FOR OPTION PERIOD 3

PRICING – OPTION PERIOD 3 - POP: 12-Months

3001 TSO Medical Evaluations (Option Period 3)

3001AA TSO Medical Evaluations FFP 20,000 Each

3001AB OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

3001AC OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

3001AD OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

3001AD OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

3001AF OPTIONAL - TSO Medical Evaluations FFP 2,358 Each

3002 FAMS Medical Evaluations (Option Period 3)

3002AA FAMS Medical Evaluations FFP 2,000 Each

3002AB OPTIONAL - FAMS Medical Evaluations FFP 541 Each

3003 TSS-EDCH Medical Evaluations (Option Period 3)

3003AA TSS-EDCH Medical Evaluations FFP 27 Each

3003AB OPTIONAL - TSS-EDCH Medical Evaluations FFP 27 Each

3004 TSS-E Medical Evaluations (Option Period 3)

3004AA TSS-E Medical Evaluations FFP 20 Each

3004AB OPTIONAL - TSS-E Medical Evaluations FFP 17 Each

3005 Criminal Investigator Medical Evaluations (Option Period 3)

3005AA Criminal Investigator Medical Evaluations FFP 5 Each

3005AB OPTIONAL - Criminal Investigator Medical Evaluations FFP 5 Each

3006 Mobile Medical and Drug Testing Evaluation Unit (Option Period 3)

3006AA Mobile Medical and Drug Testing Evaluation Unit FFP 12 Each

3006AB OPTIONAL - Mobile Medical and Drug Testing Evaluation Unit FFP 12 Each

3007 Program Management & Quality Control FFP 12 Month

3008 System Sustainment and ATO Re-validation (O&M) FFP 12 Month

TABLE FOR OPTION PERIOD 4

PRICING – OPTION PERIOD 4 - POP: 12-Months

4001 TSO Medical Evaluations (Option Period 4)

4001AA TSO Medical Evaluations FFP 20,000 Each

4001AB OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

4001AC OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

4001AD OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

4001AE OPTIONAL - TSO Medical Evaluations FFP 5,000 Each

4001AF OPTIONAL - TSO Medical Evaluations FFP 2,358 Each

4002 FAMS Medical Evaluations (Option Period 4)

4002AA FAMS Medical Evaluations FFP 2,000 Each

4002AB OPTIONAL - FAMS Medical Evaluations FFP 541 Each

4003 TSS-EDCH Medical Evaluations (Option Period 4)

4003AA TSS-EDCH Medical Evaluations FFP 27 Each

4003AB OPTIONAL - TSS-EDCH Medical Evaluations FFP 27 Each

4004 TSS-E Medical Evaluations (Option Period 4)

4004AA TSS-E Medical Evaluations FFP 20 Each

4004AB OPTIONAL - TSS-E Medical Evaluations FFP 17 Each

4005 Criminal Investigator Medical Evaluations (Option Period 4)

4005AA Criminal Investigator Medical Evaluations FFP 5 Each

4005AB OPTIONAL - Criminal Investigator Medical Evaluations FFP 5 Each

4006 Mobile Medical and Drug Testing Evaluation Unit (Option Period 4)

4006AA Mobile Medical and Drug Testing Evaluation Unit FFP 12 Each

4006AB OPTIONAL - Mobile Medical and Drug Testing Evaluation Unit FFP 12 Each

4007 Program Management & Quality Control FFP 12 Month

4008 System Sustainment and ATO Re-validation (O&M) FFP 12 Month

Note: OPTIONAL CLINs for TSO Medical Evaluations, FAMS Medical Evaluations, TSS-EDCH Medical Evaluations, TSS-E Medical Evaluations, Criminal Investigator Medical Evaluations, and Mobile Medical and Drug Testing Evaluation Unit can be ordered by the Government in any stated quantity from 1 up to the quantity stated for those related OPTIONAL CLINs in Section I – Price/Costs.

SECTION II – STATEMENT OF WORK

(See Attachment 2 – Statement of Work)

(Remainder of page intentionally left blank)

SECTION III – TSA REQUIREMENTS

1. TSA-RQMTS; CONTRACTOR PERSONNEL ACCESS TO TSA FACILITIES,

INFORMATION AND/OR SYSTEMS (SEP 2020)

A. All Contractor personnel requiring access to TSA facilities, information systems, and/or information will be subject to the security procedures set forth in this contract.

B. All contractor employees seeking to provide services to TSA under a TSA contract are subject to a fitness determination to assess whether their initial employment or continued employment on a TSA contract protects or promotes the efficiency of the agency. TSA, by and through the Law Enforcement/Federal Air Marshal Service’s, Personnel Security Section (PerSec), will allow a contractor employee to commence work on a TSA contract only if a review of the contractor employee’s preliminary background check is favorable. Contractor employees with unfavorable preliminary background checks will not be allowed to work on a TSA contract.

C. A fitness determination involves the following three phases:

1. Phase 1: Enter On Duty Fitness Determination: a review of a contractor employee’s consumer credit report, criminal history records, and submitted security forms to determine, to the extent possible, if the contractor employee has bad debt and/or criminal offenses and/or falsification issues that would prohibit employment as a TSA contractor. This determination may include verification of citizenship for contractor employees born outside of the United States. A favorable Enter On Duty Suitability Determination is not a final fitness determination; rather, it is a preliminary review of external data sources that allows the contractor employee to commence work prior to the required background investigation being completed. When a contractor employee is deemed eligible to commence work on a TSA contract, TSA PerSec will notify the appropriate Contracting Officer’s Representative (COR) of the favorable determination. Similar notifications will be sent when a contractor employee has not passed the preliminary background check and has been deemed unsuitable.

2. Phase 2: Background Investigation: Once the contractor employee commences work on a TSA contract, TSA PerSec will process all submitted security forms to determine whether the contractor has previously been the subject of a federal background investigation sufficient in scope to meet TSA minimum investigative requirements. Contractor employees who have a federal investigation sufficient in scope will immediately be processed for final fitness adjudication. Those contractor employees who do not have a previous federal background investigation sufficient in scope will be scheduled for the appropriate level background investigation through the submission of their security forms to the Office of Personnel Management (OPM).

3. Phase 3: Final Fitness Adjudication: TSA PerSec will complete the final fitness determination after receipt, review, and adjudication of the completed OPM background investigation. The final fitness determination is an assessment made by TSA PerSec to determine whether there is reasonable expectation that the continued employment of the TSA contractor will or will not protect or promote the efficiency of the agency. An unfavorable final fitness determination will result in a notification to the COR that the contractor employee has been deemed unfit for continued contract employment and that he/she shall be removed from the TSA contract.

D. The period of performance may begin 60 days after contract award to allow for the Enter On Duty

Fitness Determination. A contract modification shall be executed to revise the period of performance once the determination process is completed. For Fixed price awards, in the event of staggered completed determinations the parties may negotiate fixed monthly rates so that performance can begin with partial staff.

E. Whenever personal identity verification (PIV) cards are required for issuance or re-issuance to contractor personnel for authorized access to Government facilities, under the guidance of the Contracting Officer’s Representative (COR), the Contractor is responsible for making all arrangements for affected Contractor personnel to report in-person at the nearest Government issuing facility to initiate and complete procedures for PIV card issuance. The Government will not be able to provide PIV card issuance at any other locations than those officially designated as available. PIV card issuing facilities that are available for the completion of this requirement for TSA contractors are as listed by the TSA Personnel Security Section, and the COR will advise the Contractor about Government PIV card issuing facility locations that are nearby the contractor’s location(s) of performance that will be potentially available for card issuance when required.

F. Computer Access Agreement. All Contractor employees (users, managers, and operators of the TSA network) must sign TSA Form 1403, Computer Access Agreement. A copy of which shall be provided to the TSA contracting officer’s representative for retention for the duration of the contract.

G. Personnel Security.

1. Privileged access users are individuals who have access to an information technology (IT) system with privileges of Administrator or above and have access to sensitive network infrastructure data. Privileged access users will be appropriately screened on entry into the privileged access position and the initial screening shall be refreshed every two years.

2. Individuals terminating voluntarily or involuntarily from a Contractor performing under contract at TSA must have an exit briefing, conducted by a supervisory or management-level employee of the Contractor in order to identify and explain their post-employment responsibilities to the TSA.

3. Records of exit interviews will be signed and maintained by the Contractor as part of the individual employment record for a period of not less than two years following the termination of the individual’s employment.

Failure of any Contractor personnel to pass a background investigation, without timely substitution that meets the contracts requirements, may be grounds for termination of the contract.

H. Non-Disclosure Agreements.

1. All TSA contractor employees and consultants must execute a DHS Form 11000-6, Sensitive but Unclassified Information Non-Disclosure Agreement (NDA) upon initial assignment to TSA and before being provided access to TSA “sensitive and/or mission critical information.” The original NDA will be provided to the TSA contracting officer’s representative for retention for the duration of the contract.

2. The Contractor, and those operating on its behalf, shall adhere to the requirements of the non-disclosure agreement unless otherwise authorized in writing by the Contracting Officer.

All Contractor personnel with TSA IT accounts requiring unescorted access to TSA facilities, information systems, or information will be required to complete Workplace Violence Prevention training available through the TSA Online Learning Center. The course, entitled “Preventing Workplace Violence at TSA” shall be completed within 60 days of onboarding.

2. TSA-RQMTS; SECURITY REQUIREMENTS FOR HANDLING PERSONALLY

IDENTIFIABLE INFORMATION AND PRIVACY INCIDENT REPONSE (SEP 2020)

A. Definitions.

1. “Breach” (may be used interchangeably with “Privacy Incident’) as used in this term means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, in usable form whether physical or electronic.

2. “Personally Identifiable Information (PII)” as used in this term means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include: name, date of birth, mailing address, telephone number, Social Security Number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), Internet protocol addresses, biometric identifiers (e.g., fingerprints), photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

3. “Sensitive Personally Identifiable Information (Sensitive PII)” as used in this term is a subset of Personally Identifiable Information, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Complete social security numbers (SSN), alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered Sensitive PII even if they are not coupled with additional PII. Additional examples include any groupings of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

a. Driver’s license number, passport number, or truncated SSN (such as last 4 digits)

b. Date of birth (month, day, and year)

c. Citizenship or immigration status

d. Financial information such as account numbers or Electronic Funds Transfer Information

e. Medical Information

f. System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other Personally Identifiable information may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number.

In contrast, a business card or public telephone directory of agency employees contains Personally Identifiable Information but it is not sensitive.

B. Systems Access. Work to be performed under this contract requires the handling of Sensitive PII. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The contractor shall provide the Government access to, and information regarding the contractor’s systems, when requested by the

Government, as part of its responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent validation testing of controls, system penetration testing by the Government, Federal Information Security Management Act (FISMA) data reviews, and access by agency Inspectors General for its reviews.

C. Systems Security.

1. In performing its duties related to management, operation, and/or access of systems containing Sensitive PII under this contract, the contractor, its employees and subcontractors shall comply with applicable security requirements described in the most current versions of DHS Sensitive System Publication 4300A and TSA Information Assurance (IA) Handbook or any replacement publication and rules of conduct as described in TSA Management Directive (MD) 3700.4.

2. All Contractor-operated systems that input, store, process, output, and/or transmit SPII shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis. The Contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted with at least Advanced Encryption Standard (AES)-256 or higher in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities. The Government may elect to perform continuous monitoring and IT security scanning of Contractor systems from Government tools and infrastructure.

3. Use of contractor-owned laptops or other media storage devices to process or store PII is prohibited under this contract until the contractor provides, and the contracting officer in coordination with CISO approves, written certification by the contractor that the following requirements are met:

a. Laptops employ encryption with at least AES-256 or higher using a NIST Federal Information

Processing Standard (FIPS) 140-2 or successor approved product;

b. The contractor has developed and implemented a process to ensure that security and other applications software are kept current;

c. Mobile computing devices utilize anti-viral software and a host-based firewall mechanism;

d. When no longer needed, all removable media and laptop hard drives shall be processed (i.e., sanitized, degaussed, or destroyed) in accordance with DHS and TSA security and disposition requirements.

e. The contractor shall maintain an accurate inventory of devices used in the performance of this contract;

f. Contractor employee training requirements are covered in FAR 52.224-3.

g. All Sensitive PII obtained under this contract shall be removed from contractor-owned information technology assets upon termination or expiration of contractor work. Removal must be accomplished in accordance with DHS Sensitive System Publication 4300A and TSA Information Assurance Handbook, which the contracting officer will provide upon request.

Certification of data removal or data disposition will be performed by the contractor’s Project Manager and written notification confirming certification will be delivered to the contracting officer within 15 days of termination/expiration of contractor work.

D. Data Security.

1. Contractor shall limit access to the data covered by this term to those employees and subcontractors who require the information in order to perform their official duties under this contract.

2. The contractor, contractor employees, and subcontractors must physically secure Sensitive PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. When Sensitive PII is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed through means that will make the Sensitive PII irretrievable. The contractor shall only use Sensitive PII obtained under this contract for purposes of the contract, and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer.

At expiration or termination of this contract, the contractor shall turn over all Sensitive PII obtained under the contract that is in its possession to the Government.

3. The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain Sensitive PII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

E. Breach Response. The contractor agrees that in the event of any actual or suspected breach of SPII (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), it shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the Contracting Officer’s Representative (COR), and the TSA Director of Privacy Policy & Compliance (TSAprivacy@tsa.dhs.gov<mailto:TSAprivacy@tsa.dhs.gov>). The contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government parties. The report of a breach shall not, by itself, be interpreted as evidence that the contractor failed to provide adequate safeguards for SPII.

Award fee contracts:

1. For any portions of this contract that involve an award fee, the contractor may be awarded no award fee for any evaluation period in which there is a breach of privacy or security, including any loss of sensitive data or equipment containing sensitive data. Lost award fee due to a breach of privacy or security may not be allocated to future evaluation periods.

2. For any portions of this contract that involve an award fee, to ensure that the final award fee evaluation at contract completion reflects any breach of privacy or security in an interim period, the overall award fee pool shall be reduced by the amount of the fee available for the period in which the breach occurred if a zero fee determination was made because of a breach of privacy or security.

F. Personally Identifiable Information Notification Requirement.

1. The contractor shall have in place procedures and the capability to promptly notify any individual whose Sensitive PII was, or is reasonably believed to have been, breached, as determined appropriate by the Government. The method and content of any notification by the contractor shall be coordinated with, and subject to the prior approval of the Government, based upon a risk-based analysis conducted by the Government in accordance with DHS Privacy Incident Handling Guidance. Notification shall not proceed unless the Government has determined that: (i) notification is appropriate; and (ii) would not impede a law enforcement investigation or jeopardize national security.

Subject to Government analysis of the breach and the terms of its instructions to the contractor regarding any resulting breach notification, a method of notification may include letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by the Government. At minimum, a notification should include: (i) a brief description of how the breach occurred; (ii) a description of the types of personal information involved in the breach; (iii) a statement as to whether the information was encrypted or protected by other means;

(iv) steps an individual may take to protect themselves; (v) what the agency is doing, if anything, to investigate the breach, to mitigate losses, and to protect against any further breaches; and (vi) point of contact information identifying who affected individuals may contact for further information.

2. In the event that a PII breach occurs as a result of the violation of a term of this contract by the contractor or its employees, the contractor shall, as directed by the contracting officer and at no cost to the Government, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected individuals for a period not less than18 months from discovery of the breach. Should the Government elect to provide and/or procure notification or identity protection services in response to a breach, the contractor will be responsible for reimbursing the Government for those expenses.

G. Pass-Through of Security Requirements to Subcontractors. The contractor agrees to incorporate the substance of this term, its terms and requirements, in all subcontracts under this contract, and to require written subcontractor acknowledgement of same. Violation by a subcontractor of any provision set forth in this term will be attributed to the contractor.

3. TSA RQMTS: REQUIREMENTS FOR HANDLING SENSITIVE SECURITY

INFORMATION (SSI) (JUN 2021)

Pursuant to 49 U.S.C. § 114(r), Sensitive Security Information and Nondisclosure of Security Activities, Sensitive Security Information (SSI) is a category of sensitive but unclassified (SBU) information that must be protected because it is information that, if publicly released, would be detrimental to the security of transportation. Under 49 Code of Federal Regulations Section 1520.5(a), the SSI Regulation also provides additional reasons for protecting information as SSI beyond the condition that the release of the information would be detrimental to the security of transportation. TSA, however, primarily uses the criterion of “detrimental to the security of transportation” when determining whether information is SSI.

Title 49 of the Code of Federal Regulations, Part 1520 defines the scope, categorization, handling requirements and disposition of information deemed SSI (http://ecfr.gpoaccess.gov/). Persons authorized to access specific SSI (i.e., covered persons) include those contracted to DHS or TSA with a need-to-know basis for specific information in the course of fulfilling their TSA contractual obligations. TSA may deliver SSI materials to the Contractor. Also, materials created by the Contractor may require SSI designation and protection, and the Contractor has the responsibility to identify such materials to TSA as possible SSI. For guidance while working on TSA and DHS matters, see the TSA SSI Application Guide, 2011_04_01 for identifying the type of information covered by the regulation.

http://ecfr.gpoaccess.gov/

For purposes of this requirement, the term “Contractor” shall include an individual or other legal entity who performs work for or on behalf of TSA or DHS under a contract, interagency agreement, or other transaction agreement. Such contracts include, but are not limited to, contracts between any non-Federal entity and/or TSA or DHS and subcontracts, joint venture agreements, and teaming agreements between any non-Federal entity and another non-Federal entity to perform work related to the primary contract with the TSA or DHS.

While SSI is not classified national security information subject to the handling requirements governing classified information, it is subject to certain legal disclosure limitations. To ensure regulatory compliance, the Contractor shall be subject to the following requirements and include this entire requirement as flow-down in subcontracts, etc.:

A. Handling and Safeguarding. The TSA Contractor shall safeguard and handle any SSI in accordance with the policies and procedures outlined in 49 C.F.R. Part 1520, as well as the DHS and TSA policies and procedures for handling and safeguarding SSI. These safeguarding procedures shall include SSI recognition, identification and marking of materials that possibly contain SSI, including Contractor-created materials, as well as following restrictions on disclosure, storage, handling, sharing, dissemination and destruction of SSI. The Contractor, without exception, shall place this requirement in all subcontracts, joint venture agreements, and teaming agreements related to the performance of this contract.

B. Non-Disclosure Agreements (NDAs). DHS Form 11000-6, NDAs are required to be signed by all

Contractor personnel when access to SSI is necessary for performance of the contract. By signing the NDA, the recipient certifies in writing that they will take the necessary steps to prevent the unauthorized disclosure and use of information.

C. Request for Access to SSI materials. Pursuant to 49 C.F.R. § 1520.9(a)(3), the Contractor must contact SSI@tsa.dhs.gov for guidance on handling requests to access to SSI (before using SSI materials) for any other purpose besides activities falling within the scope of the contract by other persons, including requests from experts, consultants, and legal counsel (“requesters”) hired by the Contractor. The Contractor shall include the Contracting Officer (CO) and Contracting Officer Representative (COR) as a carbon copy “cc” recipient of its contact to SSI@tsa.dhs.gov . The TSA SSI Office must first make a determination as to whether the requesters are a “covered person” with a “need to know” under 49 C.F.R. §§ 1520.7 and 1520.11. Special request processing and handling requirements apply to Contractor employees who may be foreign nationals. The Contractor must clearly identify any employees who are not US citizens who are otherwise requested to have access to SSI; the requirements of TSA Management Directive 2810.3 “Management of Foreign Access to Sensitive Information” apply.

D. Training and Certification. All Contractor personnel who are covered persons with a need-to-know basis must complete the TSA-mandated SSI Awareness Training course prior to accessing SSI, and on an annual basis for the duration of the contract or for the duration of the requester’s need for access to SSI, whichever is later. Contractor personnel must also review and adhere to the SSI Quick Reference Guide for DHS Employees and Contractors. The Contractor shall certify to the Contracting Officer annually that all covered persons have completed the mandated SSI training, that all SSI policies and procedures have been followed, and that those individuals with access understand their responsibilities to protect the information.

E. Breach. In accordance with 49 C.F.R. § 1520.9(c), the Contractor agrees that in the event of any actual or suspected breach of SSI (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the mailto:SSI@tsa.dhs.gov mailto:SSI@tsa.dhs.gov https://ishare.tsa.dhs.gov/Offices/LawEnforcementFAMS/SecuritySvcAssessments/SSIBranch/Quick%20Reference%20Guides/SSI%20Quick%20Reference%20Guide%20for%20DHS%20Employees%20and%20Contractors.pdf

Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer and the COR. The Contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government officials.

In the event that an SSI breach occurs as a result of the violation of a term of this contract by the Contractor or its employees, or the Contractor’s covered persons, the Contractor shall, as directed by the Contracting Officer and at no cost to the Government, without delay correct or mitigate the violation.

For unauthorized disclosure of SSI, the Contractor and Contractor's employees and Contractor’s covered persons may also be subject to civil penalties and other consequences as set forth in 49 CFR § 1520.17.

4. TSA-RQMTS: SECTION 504 COMPLIANCE (SEP 2020)

The Contractor/Provider shall comply fully with Section 504 of the Rehabilitation Act of 1973, as amended, which prohibits discrimination against qualified individuals with disabilities. No otherwise qualified individual with a disability shall, solely by reason of his or her disability, be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any program or activity for which the Contractor/Provider is awarded a contract and/or receives Federal financial assistance from the Transportation Security Administration. This includes, but is not limited to, providing reasonable accommodations and effective communication to persons with disabilities and ensuring physical accessibility to all participants. The Contractor/Provider shall ensure this requirement flows to all affected subcontracts.

5. TSA-RQMTS: PERFORMANCE STANDARDS (SEP 2020)

The Contractor/Provider shall comply fully with Section 504 of the Rehabilitation Act of 1973, as amended, which prohibits discrimination against qualified individuals with disabilities. No otherwise qualified individual with a disability shall, solely by reason of his or her disability, be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any program or activity for which the Contractor/Provider is awarded a contract and/or receives Federal financial assistance from the Transportation Security Administration. This includes, but is not limited to, providing reasonable accommodations and effective communication to persons with disabilities and ensuring physical accessibility to all participants. The Contractor/Provider shall ensure this requirement flows to all affected subcontracts.

Adherence to Standards. The Contractor shall adhere to the same professional and ethical standards of conduct required of Government personnel. See TSA Management Directive (MD) 1100.73-5, Employee Responsibilities and Code of Conduct. Contractor employees performing work under this contract shall not:

-Solicit new business (on-site at government spaces, or while on work during periods paid by Government) while performing work under the contract;

-Conduct business other than that which is covered by this contract during periods paid by the Government;

-Conduct business not directly related to this contract while on Government premises;

-Use Government computer systems or networks, Government property or materials, and/or Government facilities for company or personal business;

-Recruit while on Government premises or otherwise act to disrupt official Government business while on Government premises.

-Discuss with unauthorized persons any information obtained during the performance of work under this contract.

-Engage in harassment. See TSA MD 1100-73.3 Anti-Harassment Program.

Reporting Matters.

Illegal, and Unethical, or Inappropriate Conduct. The Contractor, and its employees shall immediately report to the Contracting Officer and/or Contracting Officer’s Representative, any illegal, or unethical, or inappropriate conduct observed, noticed, or discovered while on Government premises or during periods paid by the Government under this contract, without regard as to the source of such conduct (except that any matter involving only contractor employees, apart from any Government requirements or the specific requirements of this contract, is deemed to be strictly the concern of the Contractor). The Contractor shall immediately report to the Government all actual or suspected violations of Government information, personnel, or physical security requirements. The Contractor shall fully comply with all of the reporting requirements that are expressed for specified circumstances and issues identified in discrete Federal Acquisition Regulation or Homeland Security Acquisition Regulation terms in force under this contract.

Emergency Situations While on Government Premises. Contractor employees shall immediately report any emergency situations they may witness (any circumstance where actual or potential loss of life, serious injury, or critical damage to property, or other serious incidents, such as fires, or workplace violence, terrorist activities, or other criminal behavior is occurring) per standing TSA procedures while they are performing under contract in government facilities.

CONTRACTOR’S RESPONSIBILITY FOR ASSIGNED SPACE, EQUIPMENT, AND SUPPLIES

If, due to the fault or neglect of the Contractor, his agents, or employees, damages are caused to any Government property, equipment, stock or supplies, during the performance of this contract, the Contractor shall be responsible for such loss or damage and the Government, at its option, may either require the Contractor to replace all property or to reimburse the Government for the full value of the lost or damaged property. The Contractor is responsible for maintaining all assigned space(s) in a clean and orderly fashion during the course of this contract. All telephones are for conducting official Government business only.

PERSONAL SERVICES

“Personal services” are those in which contractor personnel would appear to be, in effect, Government employees via the direct supervision and oversight by Government employees. No personal services shall be performed under this contract. No Contractor employee will be directly supervised by a Government employee. All individual Contractor employee assignments, and daily work direction, shall be given by the applicable employee supervisor of the Contractor. If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

The Contractor shall not perform any inherently Governmental actions as defined by FAR 7.500. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government Contractors in connection with this contract, the Contractor employee shall state that they have no authority to in any way change any contract and that if the other Contractor believes this communication to be a direction to change their contract, they should notify the Contracting Officer for that contract and not carry out the direction until a clarification has been issued by the Contracting Officer.

The Contractor shall ensure that all of its employees working on this contract are informed of the substance of this term.

6. TSA-RQMTS: CONTRACTOR PERFORMANCE ASSESSMENT REPORTING SYSTEM

(CPARS) (SEP 2020)

In accordance with FAR 42.15, the Transportation Security Administration (TSA) is required to report the contractor’s performance under contract. The TSA reporting thresholds, in accordance with the Department of Homeland Security’s (DHS) FAR class deviation, is $1,000,000 for contracts and orders for services, and $500,000 for contracts and orders for supplies.

In order to support thorough and timely Contractor Performance Assessment Reporting System (CPARS) reports, the contractor shall provide a self-assessment of their performance within 10 days after the end of the base period and within 10 days after the end of any exercised option period(s) of the contract. The contractor shall provide a detailed narrative for each of the relevant evaluation areas (Quality, Schedule, Cost Control, Management, Utilization of Small Business, and Regulatory Compliance). The contractor may also provide their own self-assessment rating (Exceptional, Very Good, Satisfactory, Marginal or Unsatisfactory) per FAR Table 42-1 for each area for Government consideration.

The following are elements to be addressed in each area in order to support the narrative and any self-rating:

• Quality: Requirements; conformance to specifications; workmanship; accurate reports/data.

• Schedule: Milestones; delivery schedules; administrative requirements; schedule variance.

• Cost Control: Causes and contractor-proposed solutions for cost overruns/underruns; contractor adherence to total estimated cost; billings current, accurate, and complete. (Not required to be addressed for Fixed Price type contracts unless specifically required elsewhere in the contract)

• Management: Contractor oriented toward customer; interaction between contractor and Government; adequacy of the contractor’s accounting, billing, estimating systems and management of Government Furnished Property (GFP); effort devoted to managing subcontractors; risk management practices; supporting key personnel; replace key personnel as necessary.

• Utilization of Small Business: Small business participation goals stated in contractor/order;

achievement on each individual goal stated within contract/order or subcontracting plan including good faith efforts if goal was not achieved.

• Regulatory Compliance: Contractor complied with contract clause requirements; complied with reporting requirements; complied with Quality Assurance Surveillance Plan (QASP); complied with specifications, reporting into databases as required under the contract, and reporting requirements in response to the solicitation provisions and clauses effective under the contract, or other requirements.

The contractor should utilize the Guidance for the Contractor Performance Assessment Reporting System (CPARS) located on the CPARS website, https://www.cpars.gov/, to assist in preparation of the self-evaluation. The contractor shall submit their self-evaluation, preferably via email, as a MS Word or other Office compatible document to the Contracting Officer and Contracting Officer’s Representative (COR) identified in the contract within the time period identified above. Standard USPS mail may also be utilized, if required. The TSA may consider the contractor’s self-assessment, along with all available relevant data and information, when completing the contractor’s past performance evaluation for each specific performance period. Submission of a contractor’s self-evaluation is considered information regarding the contractor’s performance and may not represent the final CPARS rating. Submission of this contractor self-assessment to the Government does not otherwise alter, change, or diminish any rights of the Government as expressed under Federal Acquisition Regulation Part 42 concerning the use of past performance information about any contractual vehicle.

7. TSA-RQMTS; CONTRACTOR EMPLOYEE TRAINING REQUIREMENTS (SEP 2020)

All Contractor personnel with TSA IT accounts requiring unescorted access to TSA facilities, information systems, or information will be required to complete Workplace Violence Prevention training available through the TSA Online Learning Center. The course, entitled “Preventing Workplace Violence at TSA” shall be completed within 60 days of onboarding.

The contractor shall provide fully trained and experienced personnel. Training of contractor personnel shall be performed by the contractor at its expense, except as directed by the Government through written authorization by the Contracting Officer to meet special requirements peculiar to the contract. The Contracting Officer’s Representative will identify any specified government training which the contractor’s employees with access to TSA IT accounts will be required to complete as a precursor to or coincident with their authorized access to or use of government space or facilities, equipment, information, or information systems as a necessary component of performance required under the contract. Contractor employees are responsible for providing required evidence of timely training completion when the Government assigns such training. Training includes attendance at seminars, symposia or user group conferences. Training will not be authorized for the purpose of keeping contractor personnel abreast of advances in the state-of-the-art or for training contractor employees on equipment, computer languages and computer operating systems that are available on the commercial market or required by a contract. This includes training to obtain or increase proficiency in word processing, spreadsheets, presentations, and electronic mail.

8. TSA-RQMTS; CONTINGENCY AND/OR CONTINUITY OF OPERATIONS SUPPORT OF

TRANSPORTATION SECURITY ADMINISTRATION OPERATIONS (SEP 2020)

A. Background. The Transportation Security Administration (TSA) is a component of the Department of Homeland Security (DHS) and is responsible for the security of the nation’s transportation system. This includes not only the security screening operations conducted for passenger air travel, but also security operations protecting air cargo and shipping, surface and other transportation modes including rail, and pipelines and other transportation infrastructure. To those ends, the TSA must be able to respond quickly to incidents, and increase and re-constitute its operational posture (“continuity of operations”) in response to threats and the possibility of actual attacks upon or disruption to government operations or national infrastructure. The TSA has an internal capacity to establish and operate Critical Incident Management Groups in response to a specific, TSA-only incident, or as a part of larger DHS operation due to orders from the DHS Secretary, or due to increased threat levels under the National Terrorism Advisory System, or federal operations up to and including responsibilities assigned under the National Response Framework. To these ends, the TSA must be able to count upon a correlated contractor capability to surge capacity in response to incidents or quickly re-constitute capability to recover from a catastrophe. Accordingly, TSA contractors must be prepared and able to provide surge capacity and to reconstitute operational capability to perform under contract as required in response to an emergency.

B. Definitions. The meaning of specific contingency or emergency-related terms herein proceeds from those definitions within the National Response Framework and are available from the National Response Framework Resource Center glossary at http://www.fema.gov/emergency/nrf/.

C. Force and effect of this requirement. Without regard to the extent that the Contractor’s actual responses in order to meet the requirements of this term may be necessitated by occurrences or conditions as described in the “Excusable Delays” paragraph of FAR 52.212-4, “Contract Terms and Conditions—Commercial Items” clause or those described in the FAR 52.249-14, “Excusable Delays” clause (or such related conditions as described in other clauses, such as the FAR 52.249-8 “Default (Fixed-Price Supply and Service),” 52.249-9 “Default (Fixed-Price Research and Development),” and/or FAR 52.249-10 (Fixed-Price Construction),” if included in the contract), the Contractor shall provide surge capacity, re-establish functions, and reconstitute capability and performance under this contract as quickly as possible in response to an incident and/or as ordered by the Contracting Officer.

D. Response functions and capabilities. The Contractor shall establish and maintain the following capabilities as a requirement of this contract.

1. Continuity of Operations (COOP) Plan. The Contractor shall establish a written continuity of operations plan in accordance with “Continuity Guidance Circular 1 (CCG1), Continuity Guidance for Non-Federal Agencies” of January 2009. In general, COOP plans must be designed in order to:

a) Minimize loss of life, injury, and property damage.

b) Mitigate the duration, severity, or pervasiveness of disruptions that do occur.

c) Achieve the timely and orderly resumption of essential functions and the return to normal operations.

d) Protect essential facilities, equipment, records, and assets.

e) Be executable with or without warning.

f) Meet the operational requirements of the TSA. Continuity plans need to be operational within minutes of activation, depending on the essential function or service, but certainly should be operational no later than 12 hours after activation.

g) Meet the sustainment needs of the TSA. An organization may need to plan for sustained continuity operations for up to 30 days or longer, depending on resources,…