OCFO RMC_Corrective Action SOO.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

August 2026 1

Federal Emergency Management Agency

STATEMENT OF OBJECTIVE (SOO) FOR:

OCFO Financial Management Division, Corrective Action and Audit Remediation Support Services

Janine Bennett, Contracting Officer

PROCUREMENT SENSITIVE INFORMATION

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

DEPARTMENT OF HOMELAND SECURITY (DHS)

DHS Statement of Objectives (SOO)

Learn more at fema.gov August 2026 2

Statement of Objectives (SOO) For Corrective Action Implementation and Audit Remediation Support

Purpose

The purpose of this effort is to obtain contractor support services to assist the FEMA Office of the Chief Financial Officer (OCFO) Financial Management Division (FMD), Risk Management and Compliance (RMC) Branch, with corrective action implementation and remediation of identified internal control deficiencies, audit findings, Mission Action Plans, Plans of Action and Milestones, and related financial, operational, IT, risk, and compliance issues.

The contractor shall support FEMA in strengthening its internal control environment, addressing financial and operational control deficiencies, improving audit readiness, supporting corrective action implementation, and documenting remediation efforts in accordance with applicable federal requirements, including OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, and DHS and FEMA policies. The objective of this requirement is focused on corrective action implementation and remediation support after deficiencies, findings, risks, and/or compliance issues have been identified through audits, assessments, monitoring, management reviews, and/or other oversight activities. This support is to assist the FMD, but other FEMA Offices and Programs may utilize these services to meet the intent of the objective.

Note: Routine internal control assessment, recurring compliance monitoring, baseline control testing, and A- 123 testing activities are outside the primary scope of this requirement and are expected to be addressed through a separate Internal Control and Compliance Support Services requirement. This separation is intended to preserve clarity of roles, reduce overlap between assessment and remediation activities, and ensure objectivity in FEMA’s internal control and compliance environment.

Scope The scope of this effort is to provide technical, analytical, program management, documentation, reporting, and advisory support to help FEMA plan, implement, monitor, and document remediation activities.

Support may span FEMA’s financial management, disaster assistance, grants, insurance-related, property, human capital, information technology, and mission support processes, but only where corrective action implementation or remediation support is required for previously identified deficiencies, findings, or risks.

This effort includes coordination across OCFO, FEMA program offices, process owners, system owners, and other stakeholders to support timely, effective, and sustainable remediation of identified deficiencies and audit findings in alignment with OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, federal financial management requirements, DHS policy, and FEMA guidance.

Learn more at fema.gov August 2026 3

Period of Performance The period of performance for this statement of objectives is one 12-month base period with four 12-month option periods for a total of five years if all options are exercised at the discretion of the government.

Place of Performance The primary place of performance will be the Contractor’s facilities or at FEMA Headquarters—500 C Street SW, Washington, DC 20024, or at 430 Market St. Winchester, Virginia.

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulation. The Contractor shall be responsible for obtaining COR approval (email is acceptable) for all reimbursable travel in advance of each travel event.

The Contractor will not be reimbursed for local travel to and from FEMA Headquarters, Winchester, VA, or within the National Capital Region (NCR).

The Contractor is authorized to telework at the discretion of the Contract Officer Representative (COR).

Background FEMA plays a critical role in the nation’s emergency management framework by coordinating federal preparedness, response, recovery, and mitigation efforts before, during, and after disasters. FEMA’s mission is delivered through a large and complex operating environment that includes more than 21,000 employees, coordination with state, local, tribal, and territorial partners. FEMA also administers high-volume, high-impact programs, including disaster assistance, grants, and insurance-related activities, while also managing substantial disaster obligations and long-term recovery funding.

The FEMA Office of the Chief Financial Officer manages and oversees FEMA’s fiscal resources in accordance with applicable laws, policies, and guidance. Within OCFO, the Financial Management Division oversees FEMA’s financial controls, operations, policy, and financial statement activities. The RMC Branch develops FEMA’s internal controls program, manages the annual financial statement audit, performs OMB Circular A-123 transaction and IT general control testing, and works with FEMA offices and programs to remediate identified deficiencies.

FEMA’s emergency management mission creates a fiscal environment characterized by significant transaction volume, disaster-driven surge requirements, long-term recovery obligations, interagency coordination, compliance requirements, and heightened public stewardship expectations. Sustained remediation support is needed to help FEMA address internal control deficiencies, audit findings, corrective action plans, Mission Action Plans, IT-related Plans of Action and Milestones, and related financial, operational, and compliance risks while maintaining alignment with OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, federal financial management requirements.

Learn more at fema.gov August 2026 4

Performance of Objectives Outcome-oriented support for non-personnel services is needed to assist FEMA OCFO RMC in strengthening FEMA’s internal control environment and remediating internal control deficiencies, audit findings, corrective action plans, Mission Action Plans, Plans of Action and Milestones, and related financial, operational, IT, and compliance risks.

The contractor’s approach shall support FEMA’s compliance with applicable federal financial management, internal control, audit, payment integrity, and IT control requirements, including the DHS Financial Accountability Act, Chief Financial Officers Act, Federal Financial Management Improvement Act, Federal Managers’ Financial Integrity Act, OMB Circular A-123, Payment Integrity Information Act of 2019, NIST Special Publication 800-53, Federal Information System Controls Audit Manual, GAO Standards for Internal Control in the Federal Government, and other applicable DHS and FEMA policy, guidance, laws, and regulations.

The contractor shall provide qualified personnel with expertise in federal financial management, accounting, internal controls, audit remediation, IT controls, financial systems, data quality, and related compliance requirements. The contractor shall be capable of supplementing FEMA staff throughout the fiscal year, including during audit cycles, reporting periods, remediation milestones, and other high-priority periods requiring sustained or ad hoc support.

The contractor shall propose a solution that achieves the following objectives:

1. Corrective Action and Remediation Planning

FEMA requires timely, actionable, and sustainable remediation plans for identified internal control deficiencies, audit findings, Mission Action Plans, and IT-related Plans of Action and Milestones. The contractor’s solution should improve FEMA’s ability to define root causes, milestones, risks, dependencies, responsible parties, critical path activities, performance measures, resource considerations, and measurable remediation outcomes.

The solution should also incorporate lessons learned from prior audits, assessments, and remediation activities.

2. Remediation of Business Process and Internal Control Findings

FEMA requires support to remediate business process findings, internal control deficiencies, material weaknesses, significant deficiencies, reportable conditions, and other control issues. The contractor’s solution should strengthen control design, improve business processes, support internal controls over financial reporting and operations, reduce recurrence of findings, and support alignment with GAO Standards for Internal Control in the Federal Government.

3. Remediation of IT Control Findings and System-Related Risks

FEMA requires support to remediate IT control findings and system-related risks affecting financial reporting, operational controls, data quality, security, system interfaces, and compliance. The contractor’s solution should support improvements to IT general controls, application controls, system-related control documentation, financial system controls, and IT-related remediation plans in alignment with applicable federal, DHS, and FEMA requirements.

4. Business Process, Reporting, and Data Quality Improvements

FEMA requires process improvement support to strengthen financial management, reporting, data quality, reconciliation, and compliance-related controls. The contractor’s solution should support improvements to

Learn more at fema.gov August 2026 5 business processes, control design, financial systems conformance, DATA Act-related controls, and other reporting or data quality requirements applicable to FEMA’s financial management environment.

5. Testing, Verification, and Validation of Remediation Efforts

FEMA requires support, as authorized by the Government, to determine whether remediation actions address identified deficiencies, are appropriately designed, operate as intended, and are ready for management review or audit follow-up. The contractor’s solution should provide a risk-based approach to testing, verification, validation, evidence review, and reporting of remediation results, including identification of remaining risks and potential mitigation options.

Testing, verification, and validation under this requirement is focused on determining whether corrective actions and remediation activities have addressed previously identified deficiencies, findings, or risks. This requirement is not intended to perform routine A-123 assessment testing or recurring internal control monitoring covered under a separate internal control and compliance support requirement.

6. Reporting, Tools, and Management Insight

FEMA requires timely and actionable information on remediation status, risk areas, recurring issues, aging items, dependencies, impediments, and progress against corrective action milestones. The contractor’s solution should improve management visibility through effective use of project plans, tracking tools, dashboards, status reporting, executive briefings, decision documents, and other management reporting products.

7. Technical Assistance and Stakeholder Coordination

FEMA requires technical assistance and coordination across OCFO, program offices, process owners, system owners, and other stakeholders to advance remediation activities and align efforts with FEMA and DHS timelines. The contractor’s solution should improve communication, accountability, issue resolution, milestone monitoring, and integration of remediation activities across FEMA, including support for ad hoc IT and non-IT internal control requests.

8. Adaptability to New Requirements

FEMA requires remediation support that can adapt to new or changing requirements issued through laws, regulations, executive direction, OMB guidance, DHS policy, FEMA guidance, audit recommendations, or other governing bodies. The contractor’s solution should help FEMA assess the impact of new requirements on internal controls, remediation priorities, documentation, reporting, and compliance activities.

9. Sustainable Improvements and Knowledge Transfer

FEMA requires remediation support that promotes sustainable improvements beyond the period of contractor performance. The contractor’s solution should include approaches for guidance, training, templates, standard operating procedures, resource materials, user support, and knowledge transfer to support consistent remediation practices and long-term control effectiveness.

Learn more at fema.gov August 2026 6

Performance Expectations The contractor shall propose an approach that supports timely, accurate, and high-quality remediation support throughout the fiscal year and audit cycle. The proposed approach should address how the contractor will meet FEMA and DHS deadlines, support time-sensitive audit and remediation milestones, respond to ad hoc internal control requests, maintain quality control over deliverables, minimize rework, identify risks and dependencies, and provide actionable reporting and recommendations to support FEMA management.

Operating Constraints Flexibility is required to support this requirement due to FEMA’s evolving emergency management mission, disaster-driven surge requirements, complex financial management environment, ongoing remediation priorities, and changing audit and compliance needs.

FEMA is modernizing its core financial, procurement, and asset management systems, with the transition anticipated in early FY 2027. The contractor shall account for this transition in its remediation support approach, including potential impacts to internal controls, business process documentation, data quality, reporting, system-related corrective actions, stakeholder coordination, and continuity of remediation activities.

The contractor shall perform work only within the scope of the applicable requirement. The Government may maintain separate requirements for internal control assessment and compliance support and for corrective action and audit remediation support. The contractor shall identify any actual, potential, or perceived overlap, independence concern, or organizational conflict of interest that may arise between assessment, testing, remediation, and validation activities and shall notify the Contracting Officer (CO), Contracting Officer Representative (COR), and FEMA Program Manager in accordance with contract requirements.

The contractor shall perform all work in accordance with applicable federal laws, regulations, standards, DHS policy, FEMA guidance, and contract requirements, including OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, and applicable federal financial management requirements.

The scope of work excludes acquisition support, source selection activities, and inherently governmental functions. The contractor shall not access source selection sensitive information; perform acquisition strategic planning, requirements development, acquisition portfolio management, or evaluation support; or otherwise influence the outcome of any current or future procurement.

The contractor shall not influence, determine, approve, or direct FEMA budget allocations, funding decisions, or budget alignments. FEMA retains responsibility for all management decisions, including approval of corrective actions, acceptance of risk, operation of controls, management assertions, and final determination of remediation status.

Applicable Documents or References The contractor shall perform work in accordance with applicable laws, regulations, standards, policies, and guidance, including but not limited to:

OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control

Learn more at fema.gov August 2026 7

GAO, Standards for Internal Control in the Federal Government

Federal Managers’ Financial Integrity Act

Chief Financial Officers Act

Federal Financial Management Improvement Act

DHS Financial Accountability Act

Payment Integrity Information Act of 2019

Federal Information System Controls Audit Manual

NIST Special Publication 800-53, as applicable

Additional materials required to perform the work will be provided to the contractor after award, as appropriate and subject to applicable access, security, privacy, and information protection requirements. These materials may include, but are not limited to, applicable Department and Agency governing documents, financial management policies, guidance, templates, procedures, and other reference materials.

Learn more at fema.gov August 2026 8

Appendix D: Information Sharing The tasks outlined in this contract require access to the FEMADEX system; however, they do not require access to the PII or SPII contained within FEMADEX.. The FEMADEX Privacy Threshold Analysis (PTA) is currently expired and in process of being renewed. The deliverables within this scope of work do not extend beyond MS suites and Enterprise Business Enablement. There will be no access of PII/SPII beyond first name, last name, email addresses of FEMA employees from Outlook. In addition, once a solution is planned/developed within FEMADex the Program Office will work with FEMA Privacy to have the Privacy Threshold Analysis (PTA) completed.

The information sharing outlined in this contract is authorized by the following Privacy Impact Assessments for

FEMADEX:

• FEMADex PIA in development

• DHS/FEMA/PIA-013 Grant Management Programs

• DHS/ALL/PIA-015 DHS Web Portals

• DHS/FEMA/PIA-040 Deployment Tracking System

• DHS/FEMA/PIA-052 Grants Management Modernization

• DHS/ALL/PIA-014 Personal Identity Verification Management

• DHS/ALL/PIA-038 Integrated Security Management System

• DHS/ALL/PIA-043 Talent Acquisition

• DHS/ALL/PIA-050 Trusted Identity Exchange

• DHS/ALL/PIA-053 DHS Financial Management Systems

• DHS/FEMA/PIA-049 Individual Assistance Program

• DHS/ALL/PIA-006 DHS General Contacts List

• DHS/FEMA/PIA-011 National Flood Insurance Program

• DHS/FEMA/PIA-026 Operational Data Store (ODS) and Enterprise Data Warehouse (EDW),

• DHS/FEMA/PIA-048 National Flood Insurance Program Direct Servicing Agent System

Interim coverage is provided through the above PIAs that cover the source systems. Once the system is closer to production, PRIV expects that FEMA will draft and submit a new PIA for the FEMADex Program. No SORN coverage is required as information is not retrieved by a unique identifier.

To accomplish the tasks outlined in this contract, FEMA will provide the contractor access to PII of first name, last name, email addresses, and work phone numbers of FEMA employees via Global Address List (GAL) and Enterprise Business Enablement (formerly Microsoft Office 365) applications by way of FEMA laptop use. The information sharing is authorized by Routine Use F of the following Systems of Records Notices: DHS/ALL-014 Department of Homeland Security Personnel Contact Information, March 16, 2018 83 FR 11780, DHS/ALL-004 General Information Technology Access Account Records System (GITAARS), November 27, 2012, 77 FR 70792, DHS/ALL-002 Department of Homeland Security (DHS) Mailing and Other Lists System, November 25, 2008, 73 FR 71659.

The information sharing is also covered by the following Privacy Impact Assessments: DHS/ALL/PIA-015 Web Portal and DHS/ALL/PIA-059 Employee Collaboration Tool.

Need to Know

Learn more at fema.gov August 2026 9

The Contractor will limit access to the PII provided by FEMA under this contract only to the Contractor’s authorized personnel who need to know the information to accomplish the tasks outlined in this contract.

Prohibition on Computer Matching

The Contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(a)(8), will occur for the purpose of establishing in or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

Return or Destruction of Data when no longer needed

If at any time during the term of this contract any part of FEMA PII, in any form, that the Contractor obtains from FEMA ceases to be required by the Contractor for the performance of the contract, or upon the termination of the contract, whichever occurs first, the Contractor shall, within fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request destroy, un-install and/or remove all copies of such PII in the Contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.

Learn more at fema.gov August 2026 10

Appendix E: 52.224-1 Privacy Act Notification

Privacy Act Notification (APR 1984)

The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of1974, Public Law93-579, December 31,1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3

Learn more at fema.gov August 2026 11

Appendix F: 52.224-2 Privacy Act

Privacy Act (APR 1984)

(a) The Contractor agrees to-

(1) Comply with the Privacy Act of1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies-

(i) The systems of records; and

(ii) The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act;

and

(3) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

(c)

(1) "Operation of a system of records," as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(2) "Record," as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(3) "System of records on individuals," as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

Learn more at fema.gov August 2026 12

Appendix G: H-1 HSAR DEV 15-01B Information Technology Security and Privacy Training JULY 2023)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Security Training Requirements.

(1) All users of Federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of Homeland Security (DHS) requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing sensitive information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year.

The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

(2) The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than

Learn more at fema.gov August 2026 13 thirty (30) days after contract award for each employee. The DHS Rules of Behavior will be reviewed annually, and the COR will provide notification when a review is required.

Learn more at fema.gov August 2026 14

HSAR 3052.240-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED

INFORMATION (HSAR DEVIATION 25-12) (Effective November 3, 2025)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti- Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

Learn more at fema.gov August 2026 15

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual;

and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

Learn more at fema.gov August 2026 16

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

https://www.dhs.gov/dhs-security-and-training-requirements-contractors

Learn more at fema.gov August 2026 17

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training- requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department.

Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email.

Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules

Learn more at fema.gov August 2026 18

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may

Learn more at fema.gov August 2026 19 apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

Learn more at fema.gov August 2026 20

HSAR 3052.240-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED

INFORMATION ALT I (JULY 2023) (HSAR DEVIATION 25-12) (Effective November 3, 2025)

(h) Authority to Operate. The Contractor shall not collect, process, store, or transmit CUI within a Federal information system until an ATO has been granted by the Component or Headquarters CIO, or designee. Once the ATO has been granted by the Government, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. Unless otherwise specified in the ATO letter, the ATO is valid for 3 years. An ATO is granted at the sole discretion of the Government and can be revoked at any time. Contractor receipt of an ATO does not create any contractual right of access or entitlement. The Government's grant of an ATO does not alleviate the Contractor's responsibility to ensure the information system controls are implemented and operating effectively.

(1) Complete the Security Authorization process. The Security Authorization (SA) process shall proceed according to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems (Version 13.3, February 13, 2023), or any successor publication; and the Security Authorization Process Guide, including templates.

These policies and templates are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(i) Security Authorization Package. The SA package shall be developed using the government-provided Security Requirements Traceability Matrix and SA templates. The SA package consists of the following:

Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). The Contractor shall submit a signed copy of the SA package, validated by an independent third party, to the COR for review and approval by the Component or Headquarters CIO, or designee, at least 30 days prior to the date of operation of the information system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of modified documents.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the information system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800–53, Security and Privacy Controls for Information Systems and Organizations, or successor publication, accessible at https://csrc.nist.gov/publications/sp. The Contractor shall address all deficiencies before submitting the SA package to the COR for review.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the Contractor shall renew the ATO every 3 years.

The Contractor is required to update its SA package as part of the ATO renewal process for review and verification of security controls. Review and verification of security controls is independent of the system production date and may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place. The updated SA package shall be submitted for review and approval by the Component or Headquarters CIO, or designee, at least 90 days before the ATO expiration date. The Contractor shall update its SA package by one of the following methods:

(i) Updating the SA package in the DHS Information Assurance Compliance System; or

(ii) Submitting the updated SA package directly to the COR.

Learn more at fema.gov August 2026 21

(3) Security Review. The Government may elect to conduct periodic reviews to ensure that the security requirements contained in the contract are being implemented and enforced. The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in security review activities.