ORR DPO Doctrine TSS IDIQ - Draft SOW - July 15 2024.pdf

DRAFT

Federal Emergency Management Agency

Office of Response and Recovery

Doctrine and Policy Office (DPO)

Doctrine Technical Support Services

Indefinite Delivery Indefinite Quantity (IDIQ)

Statement of Work (SOW)

1. BACKGROUND

The primary mission of the Federal Emergency Management Agency (FEMA) is Helping people before, during and after disasters. The range of FEMA’s incident management and incident support responsibilities is broad, far-reaching, and often complex and challenging. Consequently, FEMA has a need for doctrine to enable the standardization of disaster operations across disasters to better serve State, Local, Tribal and Territorial (SLTT) partners and survivors.

FEMA’s Office of Response and Recovery (ORR) provides guidance and oversight to coordinate and deliver support to disaster survivors and SLTT governments to save lives, reduce suffering, protect property, and recover from all hazards. The ORR Doctrine Section: (1) supports the framework, standards, and process guidelines for doctrine development that includes stakeholders in every

FEMA Headquarters component, ORR directorate and regional components; (2) utilizes a hierarchical structure to define different levels of doctrine; (3) conducts comprehensive reviews and revisions of doctrinal documents, identifies gaps, and coordinates the development of new documents; (4) coordinates with all ORR program offices and regional components to ensure that doctrine being developed is consistent across FEMA and supports, or does not conflict, with existing doctrine or emerging concepts; and (5) provides analysis and evaluation, work group facilitation and document development support to all five ORR Directorates (Response, Recovery, Field Operations, Field

Leadership, and Logistics Management) to help address current, emerging and legacy doctrine requirements.

2. AUTHORITIES AND FOUNDATIONAL DOCUMENTS

Each product shall be developed in accordance with the following documents:

• Robert T. Stafford Disaster Relief and Emergency Assistance Act (Public Law 93-288, as amended, 42 U.S.C. 5121-5207)

• Title 44 of the Code of Federal Regulations (CFR), Emergency Management and

Assistance

• Homeland Security Act (Public Law 107-296, as amended, 6 U.S.C. §§ 101 et seq.)

• Homeland Security Presidential Directive 5 (HSPD-5), 2003

• Post-Katrina Emergency Management Reform Act of 2006 (Public Law 109-295), October 4, 2006

• Sandy Recovery Improvement Act (SRIA) of 2013 (Public Law 113-2), January 29, 2013

• Disaster Recovery Reform Act of 2018 (Public Law 115-254), October 5, 2018

• Presidential Policy Directive 8 (PPD-8), “National Preparedness,” March 30, 2011

• Presidential Policy Directive 44 (PPD-44), “Enhancing Domestic Incident Response,”

November 2016

• National Security Strategy, 2022

• National Preparedness Goal, September 2015

• National Preparedness System, November 2011

• National Response Framework (NRF), October 2019

• National Disaster Recovery Framework, June 2016

• National Incident Management System (NIMS), October 2017

• FEMA Publication 1, November 2019

• Ready FEMA Framework, March 2023

• FEMA Administrator Strategic Plan 2022-2026

• Incident Management and Support Keystone, January 2011

• Training, Education, and Professional Development Keystone, July 2023

• Response and Recovery FIOP, March 2023

3. SCOPE

The purpose of this contract is to obtain comprehensive doctrine support services for ORR. Support shall be provided to ORR personnel at FEMA headquarters, regional, and field offices. The scope includes, but is not limited to, research and analysis, facilitation, document development and revision, graphics creation, and technical writing and editing, communications and outreach.

4. REQUIREMENTS AND CORRESPONDING TASKS

Doctrine support often includes bundles of individual tasks and activities. There are a wide range of potential types of requirements and corresponding tasks for this contract. Required deliverables will be defined at the Call Order level, after the contract is awarded. To complete these tasks, travel may be required by the Contractor, when applicable.

Doctrine Development and Revision

4.1 The Contractor shall support the development, evaluation, and revision of doctrine across the

FEMA ORR enterprise and categorize doctrine deliverables and related tasks in accordance with the table below:

Doctrine Deliverables:

Category Characteristics

Estimated Level of

Effort to Develop

Each Document

Projected # of

Documents

Required

Annually

Keystone

Describes a mission that applies to multiple groups doing the same activities independently – bringing them under the same

Senior Consultant: 326

Consultant: 326

Analyst: 654

Technical Editor: 40

Writer: 654 tenants, principles, and concepts.

Total: 2,000 hrs

Time: 1 year

Manual

Describes how to perform a mission covered by a keystone.

Describes how to execute the tenants, principles, and concepts discussed in the keystones.

Senior Consultant: 200

Consultant: 326

Analyst: 326

Technical Editor: 40

Writer: 808

Total: 1,700 hrs

Time: 9 months

Guide

A narrowly focused manual that provides more “how to” information. Requires a manual above it; however, not every manual requires a guide.

Senior Consultant: 200

Consultant: 326

Analyst: 326

Writer: 808

Total: 1,700 hrs

Time: 9 months

Handbook/ Desk

Reference

A portable reference guide of a compilation of procedures.

Requires a manual above it.

Senior Consultant: 100

Consultant: 200

Analyst: 200

Writer: 460

Total: 1,000 hrs

Time: 6 months

Standard

Operating

Procedures

(SOP)

Identifies specific actions and methods for performing single functions. Includes things like lists, timelines, and tasks. Provides “how to” directions. Can be developed independently of other documents.

Senior Consultant: 40

Consultant: 100

Analyst: 120

Writer: 200

Total: 500 hrs

Time: 3 months

Category 1

Revision (full update)

Revision involves significant changes to 50%-100% of the document resulting from:

• Significant change in doctrine, regulation, or policy.

• New doctrine, regulation, or policy.

• Internal changes that have significant impacts to incident management and support personnel

Senior Consultant: 326

Consultant: 326

Analyst: 654

Writer: 654

Total: 2,000 hrs

Time: 1 year 4

Category 2

Revision

(administrative or discrete update)

Revision involves changes to

10%-50% of the document resulting from:

• Error or omission in existing doctrine.

• Change in technology, practice, or method.

• Two-year cycle completed for doctrinal half-life

Senior Consultant: 40

Consultant: 80

Analyst: 160

Writer: 200

Total: 520 hrs

Reports to inform doctrine development priorities

Research and analysis or other reports based on emerging concepts that help to focus priorities and scope future doctrine products.

Each product will be developed with the understanding that it must explain the concepts clearly and concisely in order to facilitate decision-making and frame next steps.

Development timeline could be between 2 weeks to 60 days

• Up to 4 scoping meetings would be needed to shape thinking around the concept.

Summary briefing slides could accompany final white paper deliverable to succinctly communicate results of analysis

Senior Consultant: 40 hours

Consultant: 100 hours

Analyst: 120 hours

Technical Editor: 40 hours

Writer: 200 hours

Total: 500 hrs

Category 1

Facilitated event, discussion, Summit, Focus

Groups, Webinars, Workshops, and/or other collaborative platforms outside of standard

Doctrine Working

Groups to inform doctrine development or priorities (Duration in Hours)

Short (2-4 weeks) timeline from initial tasking through event execution:

• In person, virtual or hybrid event could include one to three sessions over one to three consecutive hours or days;

• A facilitation plan, briefing deck, or handouts designed specifically for the event could be required

• Senior-level facilitators and note-takers could be needed to support

Senior Consultant: 10 hours

Consultant: 8 hours

Analyst: 1 hour

Technical Editor: 4

Writer: 4 hours

Total: 27 hrs

Time: 2 days concurrent break-out sessions throughout event

A final deliverable such as a Key

Summary could be required

Category 2

Facilitated event, discussion, Summit, Focus

Groups, Webinars, Workshops, and/or other collaborative platforms outside of standard

Doctrine Working

Groups to inform doctrine development or priorities (Duration one or more days)

Potentially require one or more facilitators to lead simultaneous breakout sessions where 10-30 stakeholders come together to examine challenges, gather information and recommendations from key stakeholders, identify gaps and key issues, generate creative solutions, and shape recommendations and courses of action.

Short (2-4 weeks) timeline from initial tasking through event execution:

• In person, virtual or hybrid event could include one to three sessions over one to three consecutive hours or days;

• A facilitation plan, briefing deck, or handouts designed specifically for the event could be required

• Senior-level facilitators and note-takers could be needed to support concurrent break-out sessions throughout event

A final deliverable such as a Key

Summary could be required

Senior Consultant: 100 hours

Consultant: 80 hours

Analyst: 95 hours

Technical Editor: 40

Writer: 40 hours

Total: 355 hrs

Time: 2.5 months

Doctrine Development and Revision (continued)

4.2 The Contractor shall provide the following support for doctrine development: research and analysis, facilitation, document development and revision, graphics creation, technical writing and editing, and communication and outreach.

4.3 The Contractor shall provide technical support for technical writing, concurrence, and publication of ORR doctrine and facilitate doctrine meetings.

4.4 The Contractor shall provide technical support to ensure that doctrine developed meets the following specifications:

4.4.1 All doctrine shall be developed in accordance with applicable formatting documents, including Government Printing Office (GPO) and DHS and FEMA style and writing guidance.

4.4.2 All doctrine shall be developed in accordance with FEMA Directive 112-12, Development of ORR Doctrine and Policy (ORR-DP-006), CFR 44, NIMS, NRF, NDRF, Stafford Act and other applicable guidance relevant to FEMA’s authorities and foundational documents.

4.4.3 All doctrine shall be based on research and analysis conducted by the Contractor and validated by FEMA ORR.

4.5 The Contractor shall implement the ORR prescribed plan for version control of documents.

4.6 The Contractor shall provide technical support for the comment adjudication process by consolidating inputs from all stakeholders into a single comment matrix and incorporating approved changes into doctrine documents during the review and concurrence process.

4.7 The Contractor shall provide technical support to execute a communication and outreach strategy for published doctrine by developing video products, publications, brochures, infographics, webinars, fact sheets, messaging, and related products as needed to communicate key messages for FEMA programs. This information will be shared on FEMA websites and SharePoint sites and with internal and external shareholders under the supervision of FEMA project leads.

Research and Analysis for Doctrine Development

4.8 The Contractor shall provide technical support to analyze redundancies and gaps in published and planned doctrine as needed.

4.9 The Contractor shall provide technical support to determine if there is a need for additional or revised doctrine as needed.

4.10 During the doctrine assessment and development process, the Contractor shall incorporate documented lessons learned, best practices, and insights from exercises, real world operations and training.

Required Plans, Draft Doctrine, and Related Products for Doctrine Development

4.11 The Contractor shall provide a project management plan at the beginning of each project, which outlines personnel roles and responsibilities, timelines for delivery, available resources, and communication materials and job aids required to be developed.

4.12 The Contractor shall provide a written meeting summary to FEMA after every meeting, to include a summary of main points, a list of deliverables, and next steps and develop calendar invites, as directed by FEMA.

4.13 During the doctrine development and revision process, the Contractor shall develop an initial outline, an annotated outline, a preliminary draft, a targeted review draft, a final draft, and the published doctrine in accordance with FEMA Directive 112-12 and the timelines specified in the project management plan.

4.14 At the beginning of the period of performance for the base year of the contract and thereafter annually as required, the Contractor shall provide FEMA with a plan for how they will implement version control for documents.

4.15 At the beginning of the period of performance for the base year of the contract and thereafter annually as required, the Contractor shall provide FEMA with a plan for how they will ensure all approved adjudicated comments are incorporated in the comment matrix and all approved changes are incorporated in the doctrine document during the review and concurrence process.

4.16 The Contractor shall provide FEMA with a communication and outreach plan to communicate key messages about the doctrine document to FEMA programs after publication.

4.17 The Contractor shall maintain a repository of all finalized doctrine including graphics, outreach materials, drafts and briefings.

Technical Editing and Graphic Support for Doctrine Development

4.18 The Contractor shall provide technical editing and graphics support for doctrine development to include editing, formatting, graphic design, executive briefing development, written summary development, communications and outreach materials, and 508 compliance review (in accordance with Section 508 of the Americans with Disabilities Act).

4.19 The Contractor shall provide technical editing for doctrine documents to improve clarity, coherence, consistency, and correctness.

4.20 The Contractor shall provide technical support to design doctrine maps, align doctrine across the FEMA ORR directorates, and develop doctrine map infographics and job aids.

4.21 The Contractor shall provide all final text and graphics doctrine files to FEMA when the project is completed.

Facilitation of Doctrine Meetings and Related Events

4.22 The Contractor shall facilitate doctrine meetings, workshops, webinars, and related events as necessary to inform doctrine development including planning, production, and execution of the event and delivery of final report.

5 PERFORMANCE STANDARDS OF SERVICES

Quality Assurance and Quality Control for Doctrine: The quality of doctrine impacts FEMA ORR’s credibility. As a result, the requirements listed below (5.1 and 5.2) is important and will be the key consideration for how the Contractor will be evaluated for contract performance.

5.1 At the beginning of the period of performance for the base year of the contract and thereafter annually as required, the Contractor shall provide FEMA with a plan for how they will produce and maintain high quality doctrine documents that meet all doctrine quality standards and have minimal to no errors related to quality control and quality assurance.

5.2 The Contractor shall implement rigorous quality assurance and quality control procedures, throughout the period of performance of the contract, to ensure all documents submitted to

FEMA meet all doctrine quality standards and have minimal to no errors related to quality control and quality assurance.

6 OPERATING CONSTRAINTS

Workload: The requirements listed in Section 4 (Requirements and Corresponding Tasks) may need to occur concurrently (non-sequentially).

Access: Activities listed in Section 4 (Requirements and Corresponding Tasks) may require FEMA badging, FEMA contractor email addresses, and FEMA laptops that are FEMA intranet site accessible.

7 DELIVERABLE & GENERAL DOCUMENT REQUIREMENTS:

A project management plan will be required for all assignments. Other specific deliverable descriptions and due dates will be detailed in each task order.

Unless otherwise specified, the Contractor must be able to provide written documents in electronic format (i.e., source and pdf formats). Electronic copies provided must be compatible with Microsoft Project, Word, Visio, Publisher, Excel, Access, PowerPoint, and other software applications. The Contractor must be able to accept and send document files electronically.

For deliverables, the Contractor shall ensure that all reports are written in clear, concise English without typographical or grammatical errors. The Contractor shall meet all of the report writing guidelines in the United States Government Printing Office Style Manual and the Department of

Homeland Security style and writing guidelines.

Any and all electronic and information technology (EIT) procured through this effort must meet the applicable accessibility standards at 36 CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at: http://www.section508.gov .

All information relating to the items to be delivered or services to be performed under this contract may not be disclosed by any means without prior approval of the CO. Dissemination of public disclosures includes but is not limited to permitting access of such information by foreign national or by any other person, entity, and publication of technical or scientific papers, advertising, or any other proposed public release. The Contractor shall provide adequate physical protection to such information so as to preclude access by any person or entity did not authorize such access by the Government.

8 GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

The government will provide doctrine documents not publicly available and government laptops as needed and approved by FEMA ORR. The possessor of the government laptop must be properly credentialed by DHS/FEMA in accordance with the Background Investigations and

Security sections below.

9 CONTRACTOR-FURNISHED EQUIPMENT AND INFORMATION

The Contractor shall provide personnel with workspace, equipment, computers, software, office supplies and related service necessary to perform assigned tasks for work performed at the

Contractor and Government facilities.

http://www.section508.gov/

10 MEETING FACILITIES

If a FEMA or other Government space cannot be located for working group meetings, alternative meeting space (conference rooms) shall be provided by the Contractor and made available to

FEMA HQ Staff at no additional charge to the Government. Contractor facilities must be easily accessible by mass transit from the FEMA Headquarters and able accommodate up to 30 individuals.

• PLACE OF PERFORMANCE: Performance shall primarily take place at the contractor’s facility or FEMA HQ. The place of performance may vary dependent upon the tasks defined at the Call Order level. The Contractor shall support FEMA operations in the CONUS.

• The place of performance will include contractor offices and various governmental and disaster support locations to be determined at the Call Order level. Government work locations include but are not limited to the following: FEMA Headquarters (400 C and

500 C Street SW, Washington, DC 20472), Emergency Management Institute (16825 S.

Seton Ave., Emmitsburg, MD 21727), and Mount Weather Emergency Operations Center and Contractor Headquarters.

• The Contractor shall be required to attend frequent meetings and planning sessions for coordination and planning purposes. Meetings shall be virtual and in-person. The

Contractor will need to work directly with FEMA HQ staff.

11 CONTRACT TYPE/PERIOD OF PERFORMANCE

FEMA ORR anticipates the award of a single Indefinite Delivery-Indefinite Quantity (IDIQ) contract with a one-year Base Period and (4) four one-year Option Periods as a result of this solicitation. Task orders will contain hybrid Firm-Fixed-Price (FFP) and Labor Hours CLINs.

12 CONTRACTOR PERSONNEL

12.1 Qualified Personnel and Labor Categories - It is the responsibility of the Contractor to propose qualified Contractor personnel to perform all requirements and tasks specified in the SOW.

Qualified personnel should have significant experience in doctrine technical support services.

Necessary support personnel may include, but are not limited to, the following labor categories:

I. Project Manager Description: Responsible for the overall management of the specific task order(s) and ensuring that the technical/financial solutions and schedules in the specific task orders are implemented in a timely manner. Organizes, directs, and coordinates the planning and production of all activities associated with assigned task order projects. Demonstrates competent writing and oral communication skills. Ensures quality products and services are delivered.

Historically the Experience & Education requirements for this labor category is: Minimum

Experience: Fifteen (15) years of relevant experience. Minimum Education: Master’s degree in a relative field required. Master’s degree may be waived with four (4) years additional experience and bachelor’s degree.

II. Program Manager Description: Responsible for day-to-day management of specific contract support, involving multiple projects and groups of personnel at multiple locations. Demonstrates written and oral communication skills. Establishes corporate management structure to direct effective contract support activities.

Experience: Fifteen (12) years of relevant experience. Minimum Education: Master’s degree in a relative field required. Master’s degree may be waived with four (4) years additional experience and a Bachelor’s degree.

III. Facilitator Description: Description: Prepares for and conducts formal classroom and/or instructor-assisted synchronous training, workshops, and seminars.

Experience: Ten (10) years of Experience. Minimum Education: Bachelor’s degree; A Master's degree is preferred but not required.

IV. Senior Consultant Description: The Senior Consultant shall serve as a senior leader with experience in project and task management. The Senior Consultant ensures successful task completion within the scheduled timeframe in accordance with the established scope of work, to include both the technical and financial solutions. The Senior Consultant shall organize, direct, and coordinate the planning and production of all activities associated with assigned tasks. The Senior Consultant shall advise, direct and coordinate projects that require practical experience, theoretical understanding, and technical knowledge in emergency management and/or actual experience in FEMA operations and disaster assistance programs. The Senior Consultant shall be the single point of contact for the CO or COR, and if someone will act in their absence, the CO/COR should be made aware. The Senior

Consultant is further designated as Key by the Government. During any absence of the Senior

Consultant, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Senior Consultant and all designated alternates shall be able to read, write, speak and understand English. Additionally, the Contractor shall not replace the Senior Consultant without prior approval from the Contracting Officer.

Experience: Minimum of 12 years of relevant experience with experience in writing emergency management documents. Minimum Education: Bachelor’s Degree in relevant field.

V. Consultant Description: The Consultant is a team member contributing to consulting staff client assignments within specified guidelines. The Consultant shall perform tasks that require practical experience, theoretical understanding, and technical knowledge in emergency management and/or actual experience in FEMA operations and disaster assistance programs. The Consultant shall understand the overall purpose of task assignment, identify discussion topics, and develop agendas and concepts of operations for working groups and facilitate meetings. The Consultant is further designated as Key by the Government.

Experience: Minimum of five years of relevant experience Minimum Education: Bachelor’s Degree in relevant field.

VI. Analyst Description: The Analyst is a senior expert with extensive knowledge and experience in developing and applying analytic methodologies and principles. The Analyst leads the application of analytic techniques and helps define project objectives and strategic direction. The Analyst is responsible for providing leadership and vision to client and project teams around the methodology. The Analyst resolves complex problems, which require an in-depth knowledge of analytic methodologies and principles. The Analyst shall perform research and analysis that require practical experience, theoretical understanding, and technical knowledge in emergency management and/or actual experience in FEMA operations and disaster assistance programs. The Analyst is further designated as Key by the Government.

Experience: Minimum of five years of relevant experience Minimum Education: Bachelor’s Degree in relevant field

VII. Writer Description: The Writer works with consultants and analysts to research, write, edit, and proofread data for use in documents or sections of documents such as manuals, procedures, specifications, special reports, and any other customer deliverables and documents. The Writer shall interpret and write information for documents in an easily understandable language. The Writer shall write original drafting of management operations and business documentation requiring an understanding of the basic concepts, practices and vocabulary relevant to the subject matter. The Writer ensures documentation is accurate, complete, meets editorial and client specifications, and adheres to standards for quality, graphics, coverage, format, and style.

Historically the Experience & Education requirements for this labor category is: Minimum

Experience: At least five years of experience as a technical writer of specifications, standards, and technical manuals. Minimum Education: Bachelor’s Degree; Knowledge of client style guidelines, protocols, and procedures are required. One additional year of relevant experience can be substituted for each year of education shortfall.

VIII. Technical Editor Description: The Technical Editor shall provide technical editing to ensure that documents meet GPO standards. The Technical Editor shall review, rewrite, and edit a variety of documents including manuals, guides, and procedures. The Technical Editor shall review documents for errors in grammar, punctuation, syntax, and spelling. The Technical Editor shall check documents for style, readability, and ensure graphics accurately reflect the associated text.

Experience: Five years of relevant experience Minimum Education: Bachelor’s Degree in relevant field.

12.2 Contractor Employee Conduct and Identification:

12.2.1 Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level, and badge expiration date.

Visiting Contractor employees shall comply with all Government escort rules and requirements. All

Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

12.2.2 Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

12.2.3 Employee Conduct

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at

Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the

Department of Homeland Security. The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security.

12.2.4 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Contracting Officer*), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

13 TRAVEL

Government-directed travel will not be required under this contract.

14 Protection of Information

Privacy: To accomplish the tasks outlined in this contract, FEMA will share with the Contractor the following PII data elements: FEMA email addresses. The Contractor will only have access to Microsoft

Outlook as well as the FEMA Intranet.

This information sharing is authorized by The Homeland Security Act of 2002, 6 U.S.C. 313, 314, 317, 320, 321a, and 711; Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended, 42 U.S.C. 5144, 5149, 5170b, 5192, and 5197; and Routine Use F of the DHS/ALL-004

General Information Technology Access Account Records System (GITAARS) November 27, 2012, 77

FR 70792March 16, 2018, 83 FR 11780 PIA DHS/ALL-015 Web Portal, PIA DHS/ALL-059 Employee

Collaboration Tool, Routine Use F of the DHS/ALL 016 Correspondence Records September 26, 2018 83 FR 48645.

To accomplish the tasks outlined in this contract, the contractor will have access to a variety of personally identifiable information (PII), dependent on the contractor’s assigned personnel role. The http://www.gpo.gov/fdsys/pkg/FR-2012-11-27/html/2012-28675.htm http://www.gpo.gov/fdsys/pkg/FR-2012-11-27/html/2012-28675.htm https://www.regulations.gov/document?D=DHS-2018-0029-0001 contractor will limit access to the PII provided by FEMA under this contract only to the contractor’s authorized personnel who need to know the information to accomplish the tasks assigned.

If at any time during the term of this contract any part of FEMA PII, in any form, that the contractor obtains from FEMA ceases to be required by the contractor for the performance of the contract, or upon termination of the contract, whichever occurs first, the contractor shall, within fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request destroy, un-install and/or remove all copies of such PII in the contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.

The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), will occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

52.224-3 Privacy Training (JAN 2017).

(a) Definition. As used in this clause, "personally identifiable information" means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget

(OMB) Circular A-130, Managing Federal Information as a Strategic Resource).

(b) The Contracting agency will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract

(c)

(1) "Privacy training shall address the key elements necessary for ensuring the safeguarding of personally identifiable information or a system of records. The training shall be role-based, provide foundational as well as more advanced levels of training, and have measures in place to test the knowledge level of users. At a minimum, the privacy training shall cover-

(i) The provisions of the Privacy Act of 1974 ( 5 U.S.C. 552a), including penalties for violations of the Act;

(ii) The appropriate handling and safeguarding of personally identifiable information;

(iii) The authorized and official use of a system of records or any other personally identifiable information;

(iv) The restriction on the use of unauthorized equipment to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise access personally identifiable information;

(v) The prohibition against the unauthorized use of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information; and

(vi) The procedures to be followed in the event of a suspected or confirmed breach of a system of records or the unauthorized disclosure, access, handling, or use of personally identifiable http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 information (see OMB guidance for Preparing for and Responding to a Breach of Personally

Identifiable Information).

(2) Completion of an agency-developed or agency-conducted training course shall be deemed to satisfy these elements.

(d) The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.

(e) The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

(f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will-

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

(3) Design, develop, maintain, or operate a system of records.

(End of clause)

INFORMATION TECHNOLOGY SECURITY AWARENESS TRAINING (JULY 2023)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees

(hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Security Training Requirements.

(1) All users of Federal information systems are required by Title 5, Code of Federal Regulations, Part

930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The

Department of Homeland Security (DHS) requires that Contractor employees take an annual

Information Technology Security Awareness Training course before accessing sensitive information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all

Contractor and subcontractor employees.

(2) The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all

Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the

Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than thirty

(30) days after contract award for each employee. The DHS Rules of Behavior will be reviewed annually, and the COR will provide notification when a review is required.

(End of clause)

15 SECTION 508 COMPLIANCE

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L.

105-220) (codified at 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

1. All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT or that contain ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps.

A, C & D, and available at https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-

2017-title36-vol3-part1194.pdf. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards.

2. When developing or modifying ICT for the government, the contractor shall ensure the ICT fully conforms to the applicable Section 508 Standards. When modifying a commercially available or government-owned ICT, the contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

3. When developing or modifying ICT that are delivered in an electronic Microsoft Office or

Adobe PDF format, the contractor shall demonstrate conformance by providing Section 508 test results based on the Accessible Electronic Documents – Community of Practice (AED

COP) Harmonized Testing Guidance at https://www.dhs.gov/508-testing.

4. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the applicable revised Section 508 Standards for each ICT.

https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf https://www.dhs.gov/508-testing

5. Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the

Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS

Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated

November 20, 2018.

Instructions to Offerors

1. For each ICT Item that will be developed, modified, installed, configured, integrated, maintained, or hosted by the contractor pursuant to this contract, the offeror shall provide an acknowledgement of the Section 508 requirements and a detailed explanation of the

Offerors plan to ensure conformance with the requirements. The Offeror shall also describe the evaluation methods that will be used to validate for conformance to the Section 508

Standards.

Acceptance Criteria

1. Before accepting items that contain Information and Communications Technology (ICT) that are developed, modified, or configured according to this contract, the government reserves the right to require the contractor to provide the following:

o Accessibility test results based on the required test methods.

o Documentation of features provided to help achieve accessibility and usability for people with disabilities.

o Documentation of core functions that cannot be accessed by persons with disabilities.

o Documentation on how to configure and install the ICT Item to support accessibility.

o Demonstration of the ICT Item’s conformance to the applicable Section 508

Standards, (including the ability of the ICT Item to create electronic content – where applicable).

2. Before accepting ICT required under the contract, the government reserves the right to perform testing on required ICT items to validate the offeror’s Section 508 conformance claims. If the government determines that Section 508 conformance claims provided by the offeror represent a higher level of conformance than what is actually provided to the agency, the government shall, at its option, require the offeror to remediate the item to align with the offeror’s original Section 508 conformance claims prior to acceptance.

16 SECTION 504 COMPLIANCE

The Contractor/Provider shall comply fully with Section 504 of the Rehabilitation Act of 1973, as amended, which prohibits discrimination against qualified individuals with disabilities. No otherwise qualified individual with a disability shall, solely by reason of his or her disability, be excluded from participation in, be denied the benefits of, or subjected to discrimination under any program or activity for which the Contractor/Provider is awarded a contract and/or receives federal financial assistance from the Federal Emergency Management Agency. This includes, but is not limited to, providing reasonable accommodations and modifications to ensure effective communication access, physical access, and program access to all participants, including persons with disabilities. The

Contractor/Provider shall incorporate this language in any subcontracts related to the provision of the FEMA public-facing program or activity.

17 POST-AWARD CONFERENCE

The Contractor shall attend a Post-Award Conference with the Contracting Officer and the COR no later than five business days after the date of award. The purpose of the Post-Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract. The Post-Award Conference will be held at the Government’s facility, located at 500 C

Street SW Washington DC 20024, or via teleconference.

18 BACKGROUND INVESTIGATIONS:

All Contractor personnel who require access to DHS or FEMA information systems, routine access to

DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally

Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel

Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar Federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of Federal service.

Low Risk without Information System Access

Contractor personnel occupying positions or performing functions with a low-risk designation and who do not require access to DHS or FEMA information systems shall undergo a Tier 1 (T1) background investigation which is equivalent to the previously identified National Agency Check with

Inquiries (NACI). Either of these investigations must be supported by a separate credit check and must receive a favorable adjudication thereof from FEMA PSD prior to holder performing work under this contract. A favorably adjudicated NACI & C will remain acceptable for the purpose of reciprocity where a T1 investigation is required for a period of five years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Low Risk with Information System Access

Contractor personnel occupying positions or performing functions with a moderate risk designation shall undergo a Tier 2 Suitability (T2S) background investigation which is equivalent to the previously identified Moderate Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated MBI will remain acceptable for the purpose of reciprocity where a T2S investigation is required for a period of five years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Moderate Risk

Contractor personnel occupying positions or performing functions with a moderate risk designation shall undergo a Tier 2 Suitability (T2S) background investigation which is equivalent to the previously identified Moderate Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated MBI will remain acceptable for the purpose of reciprocity where a T2S investigation is required for a period of five years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

High Risk

Contractor personnel occupying positions or performing functions with a high-risk designation shall undergo a Tier 4 (T4) background investigation which is equivalent to the previously identified

Background Investigation (BI), and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated BI will remain acceptable for the purpose of reciprocity where a T4 investigation is required for a period of five years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Background Investigation Process

Contractors performing on this contract must be United States Citizens. Contractor applicants must also be 18 years of age or older to allow for the conduct of certain security related queries.

To initiate the request to process Contractor personnel, the Contractor shall provide the FEMA

Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 121-3-1-6, “Contract

Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 121-3-1-6 are complete prior to submitting the form to FEMA PSD for processing.

The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal

Employment,” forms for all Contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

• The investigation was completed within the last 2 years;

• It meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract;

• The Contractor personnel have not had a break in employment since the prior favorable adjudication; and,

• FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those Contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email to the

Contractor personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the Office of Personnel Management’s Electronic

Questionnaires for Investigation Processing (e-QIP) system and instructions for submitting the necessary information:

• Standard Form 85P, “Questionnaire for Public Trust Positions”

• Optional Form 306, “Declaration for Federal Employment”

• SF 87, “Fingerprint Card” (2 copies)

• DHS Form 11000-6, “Non-Disclosure Agreement”

• DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

Applicants born outside the United States will be required to provide proof of citizenship in the form of a Certificate of Naturalization (Form N550 or N570), an unexpired U.S. Passport, or State

Department issued Consular Report of Birth Abroad (CRBA) (FS-240)

FEMA PSD will only accept complete packages consisting of all of the above document and Standard

Form 85P, which must be completed electronically through the Office of Personnel…