ODPPS_SOW.docx

Testing a probability-based online panel self-administration of the Consumer Expenditure Diary Survey I. Background The Consumer Expenditure (CE) Diary Survey at the Bureau of Labor Statistics (BLS) is currently fielded by using an in-person interview to place two copies of a one-week paper diary instrument that the respondent records expenditures in for two consecutive weeks. Interviewers place the diaries and train respondents on how to record the household’s daily expenditures. The interviewers also contact the respondents during the week to encourage the diary keeping task. In October 2019, the CE began a test of an online diary with the expectation of implementing the online diary into production in 2022 using the same in-person placement protocols as described above.

In-person interviews historically have higher response rates than other modes of data collection and depending on content can offer higher quality data. However, the main drawback to in-person interviewing is the higher cost compared to other modes of data collection.

Because the CE diary is already primarily self-reported, it lends itself to moving away from an in-person placement to being fully self-administered. This could lead to cost savings in the future; however, switching to a fully self-administered mode is not without risk. First, the response rates in self-administered modes tend to be lower than in-person modes. Also, there’s uncertainty surrounding the impact on quality of a fully self-administered diary without the aid of in-person training on diary-keeping procedures.

In order to explore the impact of a fully self-administered mode of the diary, we propose a test in an online probability panel. While results may not be fully comparable to a traditional address-based sample design, they will provide insight on some of the sampling and measurement error that might result from a fully self-administered mode.

A further benefit of testing a self-administered diary in an online probability panel (with recruitment from an address based sample with known probabilities) is to establish a platform that could allow for future experiments. These experiments could be more quickly designed and tested in an online panel with results feeding faster into production.

II. Objective A previously developed open-source online diary (developed using Angular JS, NGiNX, and Elasticsearch) shall be modified to reflect minor changes that were made in the CE’s large-scale feasibility test of online diaries (e.g. addition of fields to collect point of purchase information, layout of user settings, modification of username and password requirements, changes to select response options in fields). The updated diary shall be used to field an online test of a two-week Diary using an online probability panel with a sample size of 2,000 respondents divided across 3 consecutive months to meet the following research objectives of BLS:

1. Test the feasibility of administering a two-week online diary to a probability panel sample without the aid of an interviewer to assist in gaining cooperation and training the respondent on how to record expenditures.

2. Evaluate the response and cooperation rates for keeping a fully self-reported online diary, within the context of a probability based online panel.

3. Compare the sample composition of those that complete an online diary to that of the BLS CE diary production sample to determine the differences in representativeness for various population subgroups.

4. Identify any deviations in data quality from a self-administered online diary compared to CE diary production data.

The contractor shall be responsible for updating the open-source diary, developing a self-administered family questionnaire for collecting demographic and income information (as needed), administering the test in an online probability panel, and providing the resulting data tables (including paradata) based on specified output requirements to the BLS, including the assignment of given item codes to reported expenditures.

III. Government Furnished Items

1. Services. The Government will provide personnel required to answer questions about BLS data or procedures, review and provide feedback on deliverables.

2. Facilities. No facilities will be provided for this task order.

3. Equipment. No equipment will be provided for this task order.

4. Materials. The Government will provide all materials and information that are unique to the BLS or BLS programs. Examples include access to BLS data, interviewer training and materials, respondent materials (e.g. user guides, advance letters, and brochures), access to previous CE online diary instruments, and CE data requirements (See Attachment 1).

5. Software. The Government will provide current open-source online diary code and related documentation (see Attachment 2: Consumer Expenditure Diary System Overview for system architecture) IV. Tasks

1. Provide a Task Management Plan. Submit a Task Management Plan detailing the activity schedule including tasks and durations for each activity included in the project.

2. Modify Diary Instrument. Modify the code (developed using Angular JS, NGiNX, and Elasticsearch) for an existing online diary to incorporate the collection of additional fields and to reorganize some of the user layout and options. Allow for testing and feedback from BLS staff.

3. Develop Self-Administered Household Characteristics Questionnaire. With input from BLS staff, using the current CE Diary Survey Household Characteristics Questionnaire design as a guide, create a self-administered questionnaire to be administered to the respondent that collects information on the household, including member demographics and income, and typical spending. If the data are already available for the units to be sampled, then a cross-walk shall be provided between questions/response options from the respondent and the CE Diary questionnaire.

4. Respondent Materials. With input from BLS staff, develop and print (as needed) survey materials, to minimally include respondent notifications (e.g., notification letters, instructions for online diary access).

5. Develop test protocols. With input from BLS staff, develop contact strategies and protocols for the test, including recommended incentives.

6. Provide OMB materials. Provide inputs for the BLS submission of an OMB clearance package required to field the test. These include electronic copies of all materials provided to the respondent for the test (e.g., user guide, tutorials, screenshots, emails) and a written description of the test methods (and protocols). The OMB Clearance Package will be submitted in September 2021 and we estimate 9 months for OMB approval to field the test (June 2022).

7. Test in Online Probability Panel. Select representative sample in an online probability panel and administer the household characteristics questionnaire and online diary using the agreed upon protocols. The sample shall be divided into three months, with each month representing a fielding period (e.g., a participant that receives the online diary invitation in month x shall start the two week diary in month x).

8. Help Desk training and support. During the test, the contractor shall provide a help desk for users to contact with any issues concerning the use of the online diary. The help desk staff shall be trained to answer both technological questions about the diary and key survey concepts (e.g., what level of detail to include in reporting, where to report items).

9. Develop weights. Develop weights for each responding household so that the final completed sample is representative of the US population. Provide documentation on weights to allow for comparison to factors used in BLS production weighting.

10. Assign item codes. Assign an item code, defined by BLS, to each reported expenditure based on expenditure description and category collected from the online diary. As needed, BLS will provide a non-exhaustive list of example expenditure text by category for each item code. Historically, this list can provide an item code for roughly 70% of all reported expenditures through matching.

11. Attend Weekly Conference Calls. During the life of the project, calls with BLS will be conducted weekly, with the contractor providing an update on the design development, testing, and identifying any potential issues that have arisen.

12. Submit Final Report. Submit a final report describing the fielding of the test, including what protocols were used and the outcome of the responses and a summary of types of help desk calls received. The report shall include any recommendations for protocol changes based on the outcome and help desk calls.

13. Final Deliverables. Deliverables will include revised code and revised documentation for the online diary and household characteristics questionnaire (as needed), respondent materials (including online), monthly progress reports, data tables from the test and other associated household characteristics (when available) provided in CSV and/or SAS (including weights and associated para- and metadata) based on specified output requirements (including the assignment of given item codes to reported expenditures), and a final report.

V. Requirements:

1. Contractor shall be available for weekly status meetings with CE representatives to discuss progress and resolve technical issues.

2. Contractor shall submit all protocols, materials and instruments to CE for review and comment prior to the completion of diary and questionnaire development on a monthly basis.

VI. Deliverables/Milestones and Delivery Schedule

VII. Period of performance At least 17 months from contract award date.

VIII. Location of Performance All work shall be performed at the contractor’s site.

IX. Travel There will be no reimbursable travel for this requirement.

X. Confidentiality and Security Requirements The confidentiality and security provisions specified in the BPA under 5.a and additional IT requirements apply to this task. See Attachment 3.

XI. Inspection and Acceptance Designated staff of the BLS will make final inspection and acceptance of specified deliverables.

Attachment 1. CE Data Requirements I. Food and Drinks Away from Home

1. Purchase Date

2. Point of Purchase

3. Item Description

4. Cost

5. Meal Type

6. Alcohol Type

7. Alcohol Cost

II. Food and Drinks for Home Consumption

1. Purchase Date

2. Point of Purchase

3. Item Description

4. Cost

5. Packaging Type

6. Purchased for Someone Outside of the Household

III. Clothing, Shoes, Jewelry, and Accessories

1. Purchase Date

2. Point of Purchase

3. Item Description

4. Cost

5. Gender

6. Age

7. Purchased for Someone Outside of the Household

IV. All Other Products and Services

1. Purchase Date

2. Point of Purchase

3. Item Description

4. Cost

5. Purchased for Someone Outside of the Household

Attachment 2: Consumer Expenditure Diary System Overview The BLS CED web-based system is built using a three-tiered architecture pattern. The tiers are as follows:

1. Presentation Layer – this is the UI (User Interface) for the application. This runs in the end-user’s web browser either on a computer or mobile device.

2. Business Logic – this component coordinates all objects within the application. It handles processing data requests, invoking business rules\calculations, etc. This component runs on the Application\Web Server.

3. Data Layer – this component handles the storage and retrieval of the data required by the system. The data layer runs on the Database Server.

For each tier, the open source technologies are described below.

Presentation Technologies The presentation layer provides access to the system through the UI. This tier will consist of the following technologies:

· AngularJS is JavaScript framework used to build web applications. AngularJS makes use of the following underlying technologies:

· JavaScript

· HTML5

· CSS3

Business Logic Technologies

The middle tier is responsible for process service and data requests within the application. This is where the logic for the system lives and it will be comprised of RESTful Web Services. This tier is comprised of the following technologies:

· NGiNX – Application\Web Server to host Web Services

· Spring Boot – Framework for building RESTful Web Services

· Java – Object oriented programming language Data Layer (Database) Technologies

This tier is responsible for the efficient storage and retrieval of data within the system. This tier is comprised of the following technology:

· Elasticsearch - Document oriented database. Based on Lucene, Elasticsearch offers enterprise grade performance, is highly scalable, and highly available. In previous tests of the online diary, it was implemented on a three node cluster running on Ubuntu. Elasticsearch requires a minimum cluster size of 3 and can scale to thousands of nodes. These nodes not only distribute the data, but load balance data requests as well.

References AngularJS - https://angularjs.org/ NGiNX - https://nginx.org/en/ Spring Boot - http://projects.spring.io/spring-boot/ Java - https://www.java.com/en/ Elasticsearch - https://www.elastic.co/products/elasticsearch Attachment 3. Confidentiality & Security Provisions for CIPSEA protected data

1. Work under this contract will involve exposure to Bureau of Labor Statistics (BLS) data that were collected by the BLS under a pledge of confidentiality for exclusively statistical purposes. Statistical purposes are defined as the description, estimation, or analysis of the characteristics of groups without identifying the individuals or organizations that comprise such groups, and the development, implementation, or maintenance of methods, procedures, or information resources that support such purposes. The majority of data collected by BLS are provided on a voluntary basis by respondents who have agreed to provide the information for the statistical purpose(s) specified by the BLS. A violation of the confidence that respondents place in the BLS would endanger the ability of the BLS to carry out its duties. Therefore, the Contractor and its employees must handle any such data, that they may come into contact with as a result of contract work, in accordance with Section 512 of the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA) (Title 5 of Public Law 107-347) and other applicable Federal laws. Due to the possible exposure to data protected by law under CIPSEA, the BLS may, in accordance with this contract, designate Contractor employees as agents of the BLS. All such agents are subject to the fines and penalties under Section 513 of CIPSEA and any other fines and penalties that apply to the mishandling of confidential information. The “Confidential Information Protection” provisions of CIPSEA appear as Exhibit A of this contract.

2. For the purposes of this contract, "confidential information" may include any of the following:

a. Statutorily Protected Data. Data or information collected by the BLS, including its agents, under a pledge of confidentiality and/or data protected from public disclosure under CIPSEA, the Workforce Investment Act, the Trade Secrets Act, or other Federal laws.

b. Respondent Identifiable Information. Any representation of information that permits the identity of participants in BLS statistical programs to be reasonably inferred by either direct or indirect means. BLS-specific examples include but are not limited to survey sample composition, lists of reporters, names of respondents, and brand names, regardless of the source of such lists or names.

c. Personally Identifiable Information. Any representation of information about an individual, maintained by the BLS, that permits the identity of the individual to whom the information applies to be reasonably inferred by either direct of indirect means. BLS-specific examples include but are not limited to, education, financial transactions, and medical, criminal, or employment history, and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.

d. Principal Federal Economic Indicator (PFEI) Pre-release Information. Statistics and analyses produced by the BLS that have not yet been released to the public and have been designated by the Office of Management and Budget as Principal Federal Economic Indicators. Currently, the following BLS data series have been designated as PFEIs: the Consumer Price Index, Employment Situation, Employment Cost Index, Producer Price Indexes, Productivity and Costs, Real Earnings, and U.S. Import and Export Price Indexes.

e. Non-PFEI Pre-release Information. Statistics and analyses, not designated as PFEIs, that have not yet been released to the public, whether or not there is a set date and time of release before which they must not be divulged.

f. Restricted Access Information. Information describing the internal practices of the BLS that should be limited in access to individuals with a need-to-know. BLS-specific examples include but are not limited to system security documentation and vulnerability assessments, procurement-sensitive information, systems-specific operating procedures, and internal reports.

4. In performing work under this contract, the Contractor agrees that access to the confidential information will be restricted to authorized persons. For the purposes of this contract, "authorized persons" is defined as: authorized BLS personnel and individuals designated as agents of the BLS who are authorized access to the confidential information for the statistical purposes set out under this contract and who have signed a BLS Agent Agreement (Exhibit B) swearing to comply with CIPSEA and other applicable Federal laws in the handling of confidential BLS information.

The parties understand and agree to the following:

a. Authorized persons granted access to confidential information will not make use of the information for any purpose other than to carry out tasks specifically authorized under the contract.

b. Authorized persons will not seek to obtain access to confidential information that is not needed to carry out contract work.

c. The Contractor will promptly furnish to the BLS a list of Contractor employees who the Contractor believes require access to confidential BLS data in order to perform work on the contract. The BLS will consider such persons for designation as agents of the BLS. If the BLS deems it necessary to decline to approve any such employee as an agent, the Contractor may furnish the name of another Contractor employee to the BLS for consideration.

d. The BLS will furnish to the Contractor BLS Agent Agreements for all approved agents. The Contractor will forward all signed BLS Agent Agreements to the Contracting Officer’s Technical Representative (COTR) prior to such agents receiving access to the confidential information.

e. The Contractor will keep records on current Agent designations and will report such information promptly to the COTR upon request.

f. The Contractor will assure that all agents will comply with their obligations under the BLS Agent Agreement and under the contract.

5. Agents shall not be regarded as employees of the United States Government, the Department of Labor, or the BLS for any purpose. The parties further understand and agree to the following:

a. The Contractor shall notify the BLS promptly whenever an agent is no longer associated with the Contractor or when an agent no longer requires access to confidential information. The Contractor shall notify the BLS immediately whenever an agent’s access to confidential data may endanger the confidentiality of data.

b. BLS may, without advance notice, discontinue or suspend any BLS Agent Agreement or any agent’s access to its information at any time, within its own absolute discretion.

c. In the event of such suspension or discontinuance, the employing Contractor will propose a Contractor employee deemed suitable by the BLS as a replacement agent, where such employee’s services are needed to carry out the Contractor’s responsibilities under this contract.

d. No BLS Agent Agreement nor any discontinuance nor suspension thereof, nor any denial of access to information, will result in any payment of any kind nor any legal liability by the BLS, the Department of Labor, or the United States Government.

e. Discontinuance of any BLS Agent Agreement will not affect any obligation of the Contractor or the designated agent to safeguard confidential data or any intellectual property rights set forth in this contract or in any BLS Agent Agreement.

6. The Contractor agrees, in the performance of this contract, to screen employees and to use only those employees who have a demonstrated record of honesty, trustworthiness, integrity, and reliability as ascertained by the Contractor. All Contractor personnel selected to work under this contract shall be subject to any United States Office of Personnel Management (OPM) background investigation(s) deemed appropriate by BLS, including a National Agency Check and Inquiry (NACI) or higher level of investigation. BLS will pay all costs directly related to the background investigation(s). Contractor personnel may be required to complete forms and be fingerprinted for the OPM investigations. Such investigation(s) may be conducted at any time during the existence of the contract. If there are questions concerning the suitability (as defined in Title 5, Code of Federal Regulations, Part 731) of an individual following such background investigation(s), notification and an opportunity to respond will be provided to the individual. If the individual is found to be unsuitable, BLS reserves the right to require the Contractor to remove and/or replace said individual from his/her duties under the contract. Such removal and/or replacement shall not alter or affect the responsibility of the Contractor to meet the performance standards prescribed in this contract. In the absence of a written waiver by contract personnel, the provisions of the Privacy Act (5 U.S.C. 552a) may preclude discussion with the Contractor of the details of the background investigation(s) and/or BLS action.

7. All agents will perform activities subject to this contract under the control of the COTR or any other BLS official that the BLS designates.

8. All agents must agree, in writing, to comply with all provisions of law that affect information acquired by the BLS including, among other laws, the Trade Secrets Act, the Workforce Investment Act, and the Privacy Act. They must specifically swear (or affirm) to comply with the provisions of Section 512 of CIPSEA, as set forth in the BLS Agent Agreement attached as Exhibit B. Agents who improperly disclose confidential information may be subject to criminal sanctions.

9. The Contractor agrees not to divulge, publish, reproduce, or otherwise disclose, orally or in writing, confidential information, in whole or in part, to any individual other than authorized persons.

10. The Contractor agrees to notify the COTR immediately upon discovering any breach or suspected breach of security, or any disclosure of the confidential information. A breach is any opportunity for, or actual instance of, an unauthorized individual accessing sensitive information. Examples of breaches may include mailing respondent surveys to an incorrect address, the loss or theft of a computing device, email or fax transmittals of sensitive information sent to an unintended recipient, or any unauthorized advance release.

11. The Contractor agrees to notify the COTR immediately upon receipt of any legal, investigatory, or other demand for access to the confidential information in any form.

12. In the case that the contract involves the collection of data from respondents, the contractor agrees to notify the COTR immediately should any respondent require an agreement be signed prior to providing data to the BLS.

13. The Contractor agrees not to subcontract or transfer any work in the performance of the contract that would involve the exposure or disclosure of any confidential BLS information orally, in writing, or in any other form, in whole or in part, to the Subcontractors or access to such information by the subcontractor except with the prior written approval of the COTR. The Contractor agrees to include BLS confidentiality and security provisions as provided by the COTR in all subcontracts awarded to carry out work provided for in this contract. The Contractor agrees to consult with the COTR regarding whether subcontractor employees are required to be designated as agents. The Contractor agrees to send to the COTR, a copy of any approved subcontract upon execution.

14. The Contractor and all of its employees shall not release any reports or other outputs (including those oral or written and regardless of format) prepared using confidential information, unless cleared in advance by the COTR or other official designated by the BLS. Such clearance will be to assure that no such outputs involve the inappropriate release of confidential information. All parties, including Contractors and its employees, will be bound by the determinations of such BLS official.

15. If any contract employees must be issued BLS Local Area Network (LAN) IDs, then each such employee must agree to abide by BLS network “Rules of Behavior” prior to receiving an ID.

16. The Contractor agrees to cooperate with BLS in administering BLS-supplied confidentiality and security trainings to all agents designated under this contract. The Contractor agrees to ensure that all agents complete such training within thirty days of being assigned to BLS work and on an annual basis thereafter. The Contractor agrees to follow BLS instruction with regard to reporting on training completion and to provide reasonable evidence of training completion to the BLS upon request. The BLS may consider, but is not obligated to accept, alternate approaches to training delivery and reporting that the contractor may propose to meet this requirement.

17. The Contractor agrees to comply with Federal policies regarding the secure transmission of confidential information including both electronic and physical data transfers. The Contractor shall consult with the COTR to determine which data transfer methods are acceptable for the various types of confidential information that are involved in contract performance. Confidential electronic data transfers authorized by the COTR must utilize encryption technology that meets the standards established by the Federal Information Processing Standards Publication 140-2, “Security Requirements for Cryptographic Modules” (FIPS PUBS 140-2) and any subsequent revisions to these standards. Encrypted email transfers and encrypted portable media are acceptable means of transfer. Encrypted portable media may be delivered by a courier, a BLS employee, or an authorized individual of the recipient, or may be sent via a mail delivery service with tracking capability. In person pick up of an appropriately labeled paper copy, by an authorized individual of the recipient, is also permitted.

18. Upon termination or completion of the contract, or at an earlier time if required by the COTR, all source documents or other media provided to the Contractor by BLS that contain confidential information and any documents or other media created by the Contractor that contain confidential information must be returned to the COTR, or with the COTR’s permission, be destroyed. The Contractor shall ensure that all data that have been deleted cannot be retrieved and reconstructed. Hard copy media (for example, paper printouts, printer and facsimile ribbons, drums, and platens) and electronic or soft copy media (for example, bits and bytes contained in hard drives, random access memory, read-only memory, disks, memory devices, telephones, mobile computing devices, networking equipments) must be properly disposed, cleared, purged, or destroyed in accordance with Federal guidelines. The Contractor shall certify that unnecessary data processed during the performance of this contract was purged from all data storage components of the Contractor’s computer facilities. The Contractor will retain no output after such time as the contract is completed. If the COTR directs the Contractor to retain any data, the Contractor shall certify that any BLS data remaining in any storage component will be safeguarded to prevent unauthorized disclosures in accordance with the terms of this contract. The Contractor's failure to surrender or destroy such materials promptly or the Contractor's conversion of such materials to a use not authorized by the contract may be a violation of 18 U.S.C. Section 641.

19. The Contractor agrees not to attempt to link confidential BLS information with individually identifiable records from any BLS or non-BLS data set without the written approval of the COTR. The Contractor must show to the satisfaction of the BLS that they are able to legally extend to the BLS permission to access all such non-BLS data. Permission must be extended to BLS employees and agents to access the non-BLS data. All new data sets created from linking confidential BLS information with other data are protected by CIPSEA and must be handled in accordance with the provisions in this contract.

20. Contractor personnel shall be required to sign any individual agreements governing access to information that are required by other Federal agencies as a result of the disclosure of data to Contractor personnel pursuant to this contract.

21. Contractor personnel who have access to pre-release information are prohibited from releasing the data to anyone other than authorized employees of the BLS and authorized agents who require access to such data for the purposes of carrying out their responsibilities under this contract. They shall not gain financially from knowledge of the data. It would be a violation of this contract for Contractor personnel to do the either of the following:

a. Use knowledge of pre-release information to buy or sell stocks, mutual funds, bonds, or futures, or to make or divest themselves of other similar investments.

b. Disclose pre-release information to other persons, or advise or make recommendations to other persons based on knowledge of such data.

22. Privacy Act notification: The Contractor shall be required to design, develop, or operate system(s) of records on individuals, to accomplish an Agency function subject to the Privacy Act of 1974, Public Law 93579 (5 U.S.C., Section 552a) as amended (the Act), and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties (FAR 52.2241). The title(s) of the system(s) of records shall be listed on the respective task orders.

23. The Contractor agrees to:

a. comply with the Act and the Agency rules and regulations issued pursuant to the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

b. include the Privacy Act provisions contained in this contract in every solicitation and every subcontract, when the work statement in the proposed subcontract requires the design, development, or operation of a system of records on individuals that is subject to the Act.

24. Work under this contract will be performed at BLS facilities or other approved worksites. The Contractor must provide the COTR of a list of worksites for approval at the start of work provided for in this contract and subsequent task orders, and must notify the COTR in writing of any proposed changes (additions or deletions) to the list of worksites. The COTR shall indicate approval of the worksites in writing. All work provided for under this contract will be performed at those approved locations only. The Contractor agrees not to remove any electronic media or paper documents containing the confidential information from approved worksites. Exceptions to this provision shall be permitted only with prior, written approval of the COTR in accordance with BLS confidentiality and security policies.

25. In some cases, such as data collection activities, contract work may necessitate handling of confidential data away from secure worksites. Where the COTR has approved such work arrangements in writing, the contractor agrees to maintain all confidential information in a secure fashion. The Contractor shall provide the contract employees with instructions on maintaining the security of all confidential information. Such instructions are subject to the review and approval of the BLS COTR upon request.

26. BLS reserves the right to review and approve or disapprove all the security safeguards instituted to comply with the requirements of this contract. The Contractor agrees to maintain secure worksites within the approved facilities for performance of work under this contract. The confidential information shall be secured in a manner so that it cannot be viewed by, and it is not accessible to, persons who have not been designated as agents of the BLS and who have not signed a BLS Agent Agreement. The contractor agrees to maintain adequate documentation to demonstrate compliance with such requirements. BLS also reserves the right to make unannounced security inspections of the Contractor's facilities and approved worksites to determine compliance with the requirements. BLS data physically and/or electronically maintained at the Contractor’s worksites will be sufficiently segregated from any other confidential data the Contractor maintains in order to facilitate BLS inspections. No other obligations on the part of the Contractor may restrict BLS access to Contractor facilities where BLS confidential information is maintained. The Contractor may not put forth legal qualifications for, or in any way restrict, BLS access to these systems or facilities for the purpose of determining compliance with contract requirements.

27. If the Contractor fails to comply with the requirements contained in this contract, the Contractor shall be deemed to have failed to perform the provision of this contract.

ADDITIONAL INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

1. The Contractor shall maintain the confidentiality, integrity, and availability of all Bureau of Labor Statistics (BLS) data and systems and their associated hardware, software, and processing capabilities. The Contractor shall develop and implement a security program, and designate an Information Security Officer (ISO), to fulfill all security requirements under this contract. In general, the security program shall include the following activities:

a. Maintain the designated level of security compliance.

b. Develop, implement, and maintain security policies and procedures for security of facilities, computer systems, telecommunications/Internet connectivity, data, personnel, and system administration.

c. Enforce security controls on and during the system design, system testing, system implementation, system maintenance, and system disposal.

d. Control physical and logical access.

e. Correct or mitigate security defects and deficiencies.

f. Inform all subcontractors that the subcontractors are also required to meet the security requirements described herein.

g. Support Government-sponsored Security Compliance Reviews, security inspections, tests, assessments, audits, and evaluations.

2. Federal Security Requirements. The Federal Information Security Management Act (FISMA) of 2002 tasked the National Institute of Standards and Technology (NIST) with providing minimum security requirements for Federal information and information systems. NIST established the FISMA Implementation Project to produce related security standards and guidelines. Following guidelines in FIPS 199 and NIST Special Publication 800-60, BLS conducted a Security Categorization and mapped BLS information types to the Moderate Security Category. Based on this outcome, the Contractor shall implement the respective Moderate Baseline of security controls catalogued in NIST Special Publication 800-53, Annex 2, and the operating system settings recommended by the manufacturers of the commercial off-the-shelf (COTS) products selected for integration into any systems used to store, process or collect BLS data. These controls shall be subject to assessment and testing guidance provided in NIST Special Publication 800-53A.

In addition to NIST Special Publication 800-53 and NIST Special Publication 800-53A, the Contractor shall ensure that the security of any systems used to store, process, or collect BLS data comply with all applicable information security directives, acts, laws, regulations, standards, and guidelines required. The Contractor shall maintain and update a security program to comply with the latest available revisions, amendments, supplements, and/or versions of these Federal security requirements and in the documents they reference. The Contractor shall comply with security requirements for both a general support system (GSS) and major application (MA), as defined by OMB A-130, NIST Special Publication 800-18, and 800-53.

3. Security Requirement Assurance, Security Compliance Reviews, and Security Inspections.

The Contractor shall provide assurance in the form of evidence and convincing arguments that Federal security policies are being enforced. The Contractor shall provide evidence that the set of management, operational, and technical controls that together enforce security are operating as intended within the scope of Federal requirements. Evidence shall be in the form of documentation, interviews, and tests, as appropriate, and shall be provided at the request of the COTR.

The Government reserves the right to conduct Confidentiality and Security Compliance Reviews as deemed appropriate to ensure compliance with all security policies and directives. The Contractor and all subcontractors shall permit and support the Government’s Confidentiality and Security Compliance Reviews. BLS data physically and/or electronically maintained at the Contractor’s worksites will be sufficiently segregated from any other confidential data the Contractor maintains in order to facilitate BLS security inspections. No other obligations on the part of the Contractor may restrict BLS access to Contractor facilities where BLS confidential information is maintained. The Contractor may not put forth legal qualifications for, or in any way restrict, BLS access to these systems or facilities for the purpose of determining compliance with contract requirements.

The Contractor shall support security inspections conducted by Government auditors or other Government representatives, as designated by the COTR. The Contractor shall permit security inspections of its approved worksites, system configuration, and operating environment to ensure a secure operation and protection of Federal information processed by any system or operation supporting BLS data collection or processing.

The Government will have the right at any time to send representatives designated by the COTR into the Contractor's approved worksites for a security inspection of the facilities, installation, technical capabilities, documentation, records, databases, and operations, including security procedures, provided for the performance of any work under this contract; and the Contractor shall cooperate to support such security inspections. On the basis of such security inspections, the COTR may require specific measures in cases where the Contractor is found to be non-compliant with contract requirements. The Contractor shall implement such measures as soon as possible without additional cost to the Government. For Security Compliance Reviews and security inspections, the Contractor shall allow Government officials, auditors, or other Government representatives as designated by the COTR to review system logs and data files, conduct disclosure and privacy reviews, and review conformance with major information security concerns expressed in this contract. The Contractor, Contractor’s employees, and subcontractor’s employees shall respond to all questions and concerns arising from such monitoring and review of work. The Contractor shall prepare and submit requested documentation, as needed and upon request by Government officials, auditors, or other Government representatives. The Contractor shall correct defects and deficiencies uncovered and shall permit and support additional reviews as necessary to confirm actions taken to correct defects and deficiencies.

4. Application Security: Commercial Off-The-Shelf Security Software. The Contractor may use a combination of commercially available software and custom developed software. The commercially available software shall have been developed by major software vendors, be widely used, and be actively supported by the developer or other third parties. When selecting among competing commercial off-the-shelf (COTS) software products, the Contractor shall choose software and versions that are free from known security vulnerabilities. The chosen COTS software shall reflect the standard commercial practice of industry. The Contractor shall consult available security checklists or recommendation guides in selecting secure product configurations and parameter settings. The Contractor shall follow NIST Special Publication 800-36, Guide to Selecting Information Technology Security Products, and NIST Special Publication 800-35, Guide to Information Technology Security Services.

Any custom developed software shall be developed in compliance with the standards for major application development in NIST Special Publication 800-27, Engineering Principles for Information Technology Security. After assembling the COTS and custom software elements of the system, the Contractor shall undertake a thorough and methodical search for ways by which the security of the integrated system might be undermined. The Government has the right to perform a similar analysis. The Contractor shall remedy any vulnerability found from the Contractor’s review or the Government’s review in a timely manner.

5. Telecommunications. It is critical that security measures be taken to protect any telecommunication links. The Contractor shall configure its routers to restrict traffic through the routers to only that needed to perform the work in the contract.

6. Boundary Protection. The Contractor shall define a logical perimeter of any system involved in the storage, processing or collection of BLS data, which is roughly those devices and data paths under the Contractor’s direct control but having interfaces to or being accessible by devices or from data paths not under the Contractor’s direct control. The Contractor shall implement system protections to protect this logical perimeter as a first line of defense against malicious and inappropriate access. The Contractor shall follow NIST Special Publication 800-47, Security Guide for Interconnecting Information Technology Systems; NIST Special Publication 800-94, Guide to Intrusion Detection and Prevention Systems; and related standards.

7. Security Documentation. The Contractor shall develop and deliver all security documentation as required by NIST Special Publication 800-53 during the Base Period. Contingent upon Government exercise of option periods, the Contractor shall update the document during each exercised option period to reflect annual rollover and related system changes, in accordance with the required BLS delivery schedule. The Contractor shall update the document in the event of any major system changes, incident reports, newly discovered vulnerabilities, or weakness mitigations. The Contractor shall produce additional security documentation in line with NIST Special Publication 800-53 upon request by the COTR for no additional cost to the government.

Exhibit A

TITLE V--CONFIDENTIAL INFORMATION PROTECTION AND STATISTICAL EFFICIENCY

<< 44 USCA § 3501 NOTE >>

SEC. 501. SHORT TITLE.

This title may be cited as the "Confidential Information Protection and Statistical Efficiency Act of 2002".

SEC. 502. DEFINITIONS.

As used in this title:

(1) The term "agency" means any entity that falls within the definition of the term "executive agency" as defined in section 102 of title 31, United States Code, or "agency", as defined in section 3502 of title 44, United States Code.

(2) The term "agent" means an individual--

(A)(i) who is an employee of a private organization or a researcher affiliated with an institution of higher learning (including a person granted special sworn status by the Bureau of the Census under section 23(c) of title 13, United States Code), and with whom a contract or other agreement is executed, on a temporary basis, by an executive agency to perform exclusively statistical activities under the control and supervision of an officer or employee of that agency;

(ii) who is working under the authority of a government entity with which a contract or other agreement is executed by an executive agency to perform exclusively statistical activities under the control of an officer or employee of that agency;

(iii) who is a self-employed researcher, a consultant, a contractor, or an employee of a contractor, and with whom a contract or other agreement is executed by an executive agency to perform a statistical activity under the control of an officer or employee of that agency; or

(iv) who is a contractor or an employee of a contractor, and who is engaged by the agency to design or maintain the systems for handling or storage of data received under this title; and

(B) who agrees in writing to comply with all provisions of law that affect information acquired by that agency.

(3) The term "business data" means operating and financial data and information about businesses, tax-exempt organizations, and government entities.

(4) The term "identifiable form" means any representation of information that permits the identity of the respondent to whom the information applies to be reasonably inferred by either direct or indirect means.

(5) The term "nonstatistical purpose"--

(A) means the use of data in identifiable form for any purpose that is not a statistical purpose, including *2963 any administrative, regulatory, law enforcement, adjudicatory, or other purpose that affects the rights, privileges, or benefits of a particular identifiable respondent; and

(B) includes the disclosure under section 552 of title 5, United States Code (popularly known as the Freedom of Information Act) of data that are acquired for exclusively statistical purposes under a pledge of confidentiality.

(6) The term "respondent" means a person who, or organization that, is requested or required to supply information to an agency, is the subject of information requested or required to be supplied to an agency, or provides that information to an agency.

(7) The term "statistical activities"--

(A) means the collection,…