OCFO RMC Internal Control BPA - SOO_.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

May 2026 1

Federal Emergency Management Agency

STATEMENT OF OBJECTIVE (SOO) FOR:

OCFO Risk Management and Compliance Division, Internal Control and Compliance Support Services

Janine Bennett, Contracting Officer

PROCUREMENT SENSITIVE INFORMATION

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

DEPARTMENT OF HOMELAND SECURITY (DHS)

DHS Statement of Objectives (SOO)

Learn more at fema.gov August 2026 2

Statement of Objectives (SOO) for Internal Control and Compliance Support Services

Purpose The purpose of this effort is to obtain specialized contractor support services for the FEMA Office of the Chief Financial Officer (OCFO), Financial Management Division (FMD), Risk Management and Compliance (RMC) Branch, to assist with internal control assessment, compliance monitoring, control testing, risk analysis, insurance management controls, and financial management support.

The contractor shall support FEMA in maintaining and strengthening its internal control and compliance environment in alignment with applicable federal requirements, including OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, federal financial management requirements, IT control guidance, DHS policy, and FEMA guidance. The objective of this requirement is to evaluate, document, test, monitor, and report on internal controls and compliance activities to identify risks, deficiencies, control gaps, and compliance issues. The contractor may identify risks, control gaps, deficiencies, and recommend improvements through assessment, testing, monitoring, and/or analysis.

Note: Corrective action implementation, remediation execution, and closure support for identified deficiencies are outside the primary scope of this requirement and are expected to be addressed through a separate Corrective Action and Audit Remediation Support Services requirement. This separation is intended to preserve clarity of roles, reduce overlap between assessment and remediation activities, and ensure objectivity in FEMA’s internal control and compliance environment.

Scope The scope of this effort includes contractor support for internal control assessment, compliance monitoring, control documentation, control testing, risk assessment, data analysis, flood insurance controls, IT general control and application control testing, and general financial management support.

Support may span FEMA’s financial management, disaster assistance, grants, flood insurance, information technology, financial reporting, and mission support processes. The contractor shall provide technical, analytical, documentation, reporting, and advisory support to help FEMA evaluate control design, test control operating effectiveness, identify risks and control gaps, assess compliance requirements, and provide management insight.

The contractor may identify findings, risks, deficiencies, control gaps, and recommend improvements through assessment, testing, monitoring, or analysis.

Note: Corrective action implementation, remediation execution, and closure support for identified deficiencies are outside the primary scope of this requirement.

Learn more at fema.gov August 2026 3

Period of Performance The period of performance for this statement of objectives is one 12-month base period with four 12-month option periods for a total of five years if all options are exercised at the discretion of the government.

Place of Performance The primary place of performance will be the Contractor’s facilities or at FEMA Headquarters—500 C Street SW, Washington, DC 20024, or at 430 Market St. Winchester, Virginia.

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulation. The Contractor shall be responsible for obtaining COR approval (email is acceptable) for all reimbursable travel in advance of each travel event.

The Contractor will not be reimbursed for local travel to and from FEMA Headquarters, Winchester, VA, or within the National Capital Region (NCR).

The Contractor is authorized to telework at the discretion of the Contract Officer Representative (COR).

Background FEMA plays a critical role in the nation’s emergency management framework by coordinating federal preparedness, response, recovery, and mitigation efforts before, during, and after disasters. FEMA’s mission is delivered through a large and complex operating environment that includes more than 21,000 employees, coordination with state, local, tribal, and territorial partners. FEMA also administers high-volume, high-impact programs, including disaster assistance, grants, and insurance-related activities, while also managing substantial disaster obligations and long-term recovery funding.

The FEMA Office of the Chief Financial Officer manages and oversees FEMA’s fiscal resources in accordance with applicable laws, policies, and guidance. Within OCFO, the Financial Management Division oversees FEMA’s financial controls, operations, policy, and financial statement activities. The RMC Branch develops FEMA’s internal controls program, manages the annual financial statement audit, performs OMB Circular A-123 transaction and IT general control testing, and works with FEMA offices and programs to remediate identified deficiencies.

FEMA’s emergency management mission creates a fiscal environment characterized by significant transaction volume, disaster-driven surge requirements, long-term recovery obligations, interagency coordination, compliance requirements, and heightened public stewardship expectations. Contractor support is needed to assess, test, monitor, document, and report on internal controls and compliance activities while maintaining alignment with OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, federal financial management requirements.

Learn more at fema.gov August 2026 4

Performance Requirements The contractor shall provide outcome-oriented support to assist FEMA OCFO RMC in maintaining, assessing, testing, monitoring, and reporting on internal controls and compliance activities. The contractor’s work shall support FEMA’s ability to identify risks, evaluate control design and operating effectiveness, assess compliance requirements, improve management visibility, and support informed decision-making.

The contractor’s approach shall support FEMA’s compliance with applicable federal financial management, internal control, audit, payment integrity, and IT control requirements, including OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, Federal Managers’ Financial Integrity Act, Chief Financial Officers Act, Federal Financial Management Improvement Act, DHS Financial Accountability Act, Payment Integrity Information Act of 2019, Federal Information System Controls Audit Manual, NIST Special Publication 800-53, and other applicable DHS and FEMA policies, guidance, laws, and regulations.

IT control testing and flood insurance controls are identified separately due to the specialized technical, programmatic, financial reporting, data, stakeholder, and compliance considerations required for those areas.

The contractor shall propose a solution that achieves the following performance requirements:

1. OMB Circular A-123 Business Process Internal Control Support

FEMA requires support to maintain an effective internal control program that enables management to assess risk, document business processes and controls, evaluate control design and operating effectiveness, perform routine monitoring, and support internal control reporting requirements. The contractor’s solution should support reliable, consistent, and well-documented internal control assessment activities aligned with applicable federal standards and FEMA priorities.

2. A-123 IT General Control and Application Control Testing Support

FEMA requires support to plan, scope, assess, test, and report on IT general controls, application controls, system-generated reports, interface controls, and other system-related controls that support financial reporting, operations, compliance, and data integrity. The contractor’s solution should support risk-based A-123 ITGC assessment activities, including control documentation, stakeholder engagement, evidence review, design and operating effectiveness testing, issue identification, risk assessment, system-level reporting, and summary deficiency analysis.

Testing under this requirement is focused on internal control assessment, routine monitoring, test of design, test of operating effectiveness, ITGC testing, application control testing, and related compliance assessment activities. Testing performed under this requirement is intended to identify and assess risks, control gaps, deficiencies, and compliance issues. Implementing corrective actions is not included in this performance requirement.

3. Flood Insurance Controls and Compliance Support

FEMA requires support to assess, document, test, monitor, and report on flood insurance-related internal controls and financial reporting processes in alignment with OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, DHS guidance, and FEMA requirements. The contractor’s solution should

Pierce, Sarah I thought it would be helpful to call this out

Learn more at fema.gov August 2026 5 support activities such as baseline and routine monitoring, Test of Design (TOD), Test of Effectiveness (TOE), entity-level control assessments, service provider monitoring considerations, fraud risk assessment support, deficiency identification, and management reporting.

4. General Financial Management and Compliance Support

FEMA requires support to analyze financial management processes, assess data integrity, support compliance-related reporting, and provide management insight. The contractor’s solution should help FEMA evaluate financial management activities, identify risks and control gaps, support stakeholder engagement, and strengthen compliance with applicable financial management requirements.

5. Risk Identification and Management Insight

FEMA requires timely and actionable information on risks, control gaps, compliance issues, recurring trends, data concerns, and areas requiring management attention. The contractor’s solution should provide clear analysis, concise reporting, and practical recommendations that support OCFO and program office decision-making.

6. Documentation and Reporting Quality

FEMA requires complete, accurate, and supportable documentation of internal control and compliance activities.

The contractor’s solution should promote consistent documentation, clear reporting, traceable analysis, system-level results, deficiency analysis, and work products that require minimal Government-directed revisions.

7. Stakeholder Coordination and Communication

FEMA requires coordination across OCFO, program offices, process owners, system owners, information system security personnel, and other stakeholders to support internal control assessments, IT control testing, flood insurance controls, compliance activities, and financial management analysis. The contractor’s solution should support effective communication, timely issue resolution, and alignment with FEMA and DHS timelines.

8. Adaptability to Emerging Requirements

FEMA requires support that can adapt to new or changing requirements issued through laws, regulations, OMB guidance, DHS policy, FEMA guidance, audit recommendations, or other governing bodies. The contractor’s solution should help FEMA assess the impact of new requirements on internal controls, compliance activities, documentation, testing, and reporting.

9. Knowledge Transfer and Continuous Improvement

FEMA requires support that strengthens internal control and compliance practices over time. The contractor’s solution should include approaches for knowledge transfer, guidance, training materials, templates, frequently asked questions, lessons learned, stakeholder communications, and continuous improvement to promote consistency and sustainability across internal control, compliance, ITGC, and application control assessment activities.

Learn more at fema.gov August 2026 6

Performance Expectations

The contractor shall propose an approach that supports timely, accurate, and high-quality internal control and compliance support throughout the fiscal year and audit cycle. The proposed approach should address how the contractor will meet FEMA and DHS deadlines, support recurring and ad hoc internal control activities, maintain quality control over deliverables, minimize rework, identify risks and control gaps, provide actionable analysis and recommendations, and coordinate effectively with OCFO, program offices, system owners, process owners, and other stakeholders.

The contractor’s approach should also demonstrate the ability to support multiple concurrent priorities across the functional areas, including OMB Circular A-123 internal control support, IT control testing, insurance management controls and compliance, and general financial management support.

Operating Constraints Flexibility is required to support this requirement due to FEMA’s evolving emergency management mission, disaster-driven surge requirements, complex financial management environment, ongoing remediation priorities, and changing audit and compliance needs.

FEMA is modernizing its core financial, procurement, and asset management systems, with the transition anticipated in early FY 2027. The contractor shall account for this transition in its approach, including potential impacts to internal controls, business process documentation, data quality, reporting, system-related corrective actions, and stakeholder coordination.

The contractor shall perform work only within the scope of the applicable requirement. The Government may maintain separate requirements for internal control assessment and compliance support and for corrective action.. The contractor shall identify any actual, potential, or perceived overlap, independence concern, or organizational conflict of interest that may arise between assessment, testing, and validation activities and shall notify the Contracting Officer (CO), Contracting Officer Representative (COR), and FEMA Program Manager in accordance with contract requirements.

The contractor shall perform all work in accordance with applicable federal laws, regulations, standards, DHS policy, FEMA guidance, and contract requirements, including OMB Circular A-123, GAO Standards for Internal Control in the Federal Government, and applicable federal financial management requirements.

The scope of work excludes acquisition support, source selection activities, and inherently governmental functions. The contractor shall not access source selection sensitive information; perform acquisition strategic planning, requirements development, acquisition portfolio management, or evaluation support; or otherwise influence the outcome of any current or future procurement.

The contractor shall not influence, determine, approve, or direct FEMA budget allocations, funding decisions, or budget alignments. FEMA retains responsibility for all management decisions, including approval of corrective actions, acceptance of risk, operation of controls, management assertions, and final determinations.

Learn more at fema.gov August 2026 7

Applicable Documents or References The contractor shall perform work in accordance with applicable laws, regulations, standards, policies, and guidance, including but not limited to:

OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control

GAO, Standards for Internal Control in the Federal Government

Federal Managers’ Financial Integrity Act

Chief Financial Officers Act

Federal Financial Management Improvement Act

DHS Financial Accountability Act

Payment Integrity Information Act of 2019

Federal Information System Controls Audit Manual

NIST Special Publication 800-53, as applicable

Additional materials required to perform the work will be provided to the contractor after award, as appropriate and subject to applicable access, security, privacy, and information protection requirements. These materials may include, but are not limited to, applicable Department and Agency governing documents, financial management policies, guidance, templates, procedures, and other reference materials.

Learn more at fema.gov August 2026 8

Appendix D: Information Sharing The tasks outlined in this contract require access to the FEMADEX system; however, they do not require access to the PII or SPII contained within FEMADEX.. The FEMADEX Privacy Threshold Analysis (PTA) is currently expired and in process of being renewed. The deliverables within this scope of work do not extend beyond MS suites and Enterprise Business Enablement. There will be no access of PII/SPII beyond first name, last name, email addresses of FEMA employees from Outlook. In addition, once a solution is planned/developed within FEMADex the Program Office will work with FEMA Privacy to have the Privacy Threshold Analysis (PTA) completed.

The information sharing outlined in this contract is authorized by the following Privacy Impact Assessments for

FEMADEX:

• FEMADex PIA in development

• DHS/FEMA/PIA-013 Grant Management Programs

• DHS/ALL/PIA-015 DHS Web Portals

• DHS/FEMA/PIA-040 Deployment Tracking System

• DHS/FEMA/PIA-052 Grants Management Modernization

• DHS/ALL/PIA-014 Personal Identity Verification Management

• DHS/ALL/PIA-038 Integrated Security Management System

• DHS/ALL/PIA-043 Talent Acquisition

• DHS/ALL/PIA-050 Trusted Identity Exchange

• DHS/ALL/PIA-053 DHS Financial Management Systems

• DHS/FEMA/PIA-049 Individual Assistance Program

• DHS/ALL/PIA-006 DHS General Contacts List

• DHS/FEMA/PIA-011 National Flood Insurance Program

• DHS/FEMA/PIA-026 Operational Data Store (ODS) and Enterprise Data Warehouse (EDW),

• DHS/FEMA/PIA-048 National Flood Insurance Program Direct Servicing Agent System

Interim coverage is provided through the above PIAs that cover the source systems. Once the system is closer to production, PRIV expects that FEMA will draft and submit a new PIA for the FEMADex Program. No SORN coverage is required as information is not retrieved by a unique identifier.

To accomplish the tasks outlined in this contract, FEMA will provide the contractor access to PII of first name, last name, email addresses, and work phone numbers of FEMA employees via Global Address List (GAL) and Enterprise Business Enablement (formerly Microsoft Office 365) applications by way of FEMA laptop use. The information sharing is authorized by Routine Use F of the following Systems of Records Notices: DHS/ALL-014 Department of Homeland Security Personnel Contact Information, March 16, 2018 83 FR 11780, DHS/ALL-004 General Information Technology Access Account Records System (GITAARS), November 27, 2012, 77 FR 70792, DHS/ALL-002 Department of Homeland Security (DHS) Mailing and Other Lists System, November 25, 2008, 73 FR 71659.

The information sharing is also covered by the following Privacy Impact Assessments: DHS/ALL/PIA-015 Web Portal and DHS/ALL/PIA-059 Employee Collaboration Tool.

Need to Know

Learn more at fema.gov August 2026 9

The Contractor will limit access to the PII provided by FEMA under this contract only to the Contractor’s authorized personnel who need to know the information to accomplish the tasks outlined in this contract.

Prohibition on Computer Matching

The Contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(a)(8), will occur for the purpose of establishing in or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

Return or Destruction of Data when no longer needed

If at any time during the term of this contract any part of FEMA PII, in any form, that the Contractor obtains from FEMA ceases to be required by the Contractor for the performance of the contract, or upon the termination of the contract, whichever occurs first, the Contractor shall, within fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request destroy, un-install and/or remove all copies of such PII in the Contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.

Learn more at fema.gov August 2026 10

Appendix E: 52.224-1 Privacy Act Notification

Privacy Act Notification (APR 1984)

The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of1974, Public Law93-579, December 31,1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3

Learn more at fema.gov August 2026 11

Appendix F: 52.224-2 Privacy Act

Privacy Act (APR 1984)

(a) The Contractor agrees to-

(1) Comply with the Privacy Act of1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies-

(i) The systems of records; and

(ii) The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act;

and

(3) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

(c)

(1) "Operation of a system of records," as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(2) "Record," as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(3) "System of records on individuals," as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

Learn more at fema.gov August 2026 12

Appendix G: H-1 HSAR DEV 15-01B Information Technology Security and Privacy Training JULY 2023)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Security Training Requirements.

(1) All users of Federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of Homeland Security (DHS) requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing sensitive information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year.

The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

(2) The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than

Learn more at fema.gov August 2026 13 thirty (30) days after contract award for each employee. The DHS Rules of Behavior will be reviewed annually, and the COR will provide notification when a review is required.

Learn more at fema.gov August 2026 14

HSAR 3052.240-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED

INFORMATION (HSAR DEVIATION 25-12) (Effective November 3, 2025)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti- Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

Learn more at fema.gov August 2026 15

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual;

and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

Learn more at fema.gov August 2026 16

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

https://www.dhs.gov/dhs-security-and-training-requirements-contractors

Learn more at fema.gov August 2026 17

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training- requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department.

Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email.

Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules

Learn more at fema.gov August 2026 18

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may

Learn more at fema.gov August 2026 19 apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

Learn more at fema.gov August 2026 20

HSAR 3052.240-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED

INFORMATION ALT I (JULY 2023) (HSAR DEVIATION 25-12) (Effective November 3, 2025)

(h) Authority to Operate. The Contractor shall not collect, process, store, or transmit CUI within a Federal information system until an ATO has been granted by the Component or Headquarters CIO, or designee. Once the ATO has been granted by the Government, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. Unless otherwise specified in the ATO letter, the ATO is valid for 3 years. An ATO is granted at the sole discretion of the Government and can be revoked at any time. Contractor receipt of an ATO does not create any contractual right of access or entitlement. The Government's grant of an ATO does not alleviate the Contractor's responsibility to ensure the information system controls are implemented and operating effectively.

(1) Complete the Security Authorization process. The Security Authorization (SA) process shall proceed according to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems (Version 13.3, February 13, 2023), or any successor publication; and the Security Authorization Process Guide, including templates.

These policies and templates are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(i) Security Authorization Package. The SA package shall be developed using the government-provided Security Requirements Traceability Matrix and SA templates. The SA package consists of the following:

Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). The Contractor shall submit a signed copy of the SA package, validated by an independent third party, to the COR for review and approval by the Component or Headquarters CIO, or designee, at least 30 days prior to the date of operation of the information system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of modified documents.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the information system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800–53, Security and Privacy Controls for Information Systems and Organizations, or successor publication, accessible at https://csrc.nist.gov/publications/sp. The Contractor shall address all deficiencies before submitting the SA package to the COR for review.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the Contractor shall renew the ATO every 3 years.

The Contractor is required to update its SA package as part of the ATO renewal process for review and verification of security controls. Review and verification of security controls is independent of the system production date and may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place. The updated SA package shall be submitted for review and approval by the Component or Headquarters CIO, or designee, at least 90 days before the ATO expiration date. The Contractor shall update its SA package by one of the following methods:

(i) Updating the SA package in the DHS Information Assurance Compliance System; or

(ii) Submitting the updated SA package directly to the COR.

Learn more at fema.gov August 2026 21

(3) Security Review. The Government may elect to conduct periodic reviews to ensure that the security requirements contained in the contract are being implemented and enforced. The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in security review activities. The Contractor shall afford DHS, the Office of the Inspector General, other government organizations, and Contractors working in support of the Government access to the Contractor's facilities, installations, operations, documentation, databases, networks, systems, and personnel used in the performance of this contract.