PCIO-24-00007 draft SOW LERG-CLONES v9.docx

PCIO-24-00007

DEPARTMENT OF HOMELAND SECURITY (DHS)

STATEMENT OF WORK (SOW)

FOR

LERG/CLONES DATA

1.0 GENERAL

This document describes the Statement of Work for the LERG/CLONES contract.

1.1 BACKGROUND

The Cybersecurity & Infrastructure Security Agency’s (CISA) mission is to lead the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. CISA includes the Integrated Operations Division (IOD) which prepares, plans, and manages CISA operations and the delivery of CISA capabilities and services to support the defense and security of our nation’s infrastructure.

1.2 SCOPE

CISA IOD prepares telecommunications analytic products to plan for, respond to, and assist in the recovery before, during, and after man-made and natural disasters. The CISA Operational Analysis (OA) team are charged with maintaining the means to respond while providing telecommunications critical infrastructure analyses. The OA section maintains a suite of automated tools and data for telecommunications and communications critical infrastructure. CISA Analysts personnel are primarily responsible for the telecommunication and communications analyses and distribution of reports derived from the data layers within the LERGS/CLONES database. To accomplish this mission the teams require comprehensive data on traditional circuit-switched networks, called the Public Switched Telephone Network (PSTN), which mainly supports voice services.

1.3 OBJECTIVE

The objective of this contract is to obtain the LERG/CLONES telecommunications data which provides insight to the current telecom landscape. CISA IOD requires the most up-to-date LERG/CLONES data to injest into our analytic capabilities.

2.0 SPECIFIC REQUIREMENTS/TASKS

The datasets shall include the current local exchange network within the North American Numbering Plan (NANP) and shall identify the reported planned changes in the network. The data shall be designed to be used for routing of calls by service providers (wireless, wireline, inter and intra exchange, etc.). It shall support functions such as networking, planning, engineering, and numbering administration. The datasets shall also use the LERG™/CLONES to create, update and maintain all valid Common Language® Location Identifier (CLLI™) codes. CLLI™ codes are unique 11-character standardized geographic identifiers used worldwide to identify and describe three types of locations and entities placed at each:

· Network sites/entities, including network locations such as central office buildings, business and commercial offices, microwave radio structures, and earth stations,

· Network support sites, including locations such as international boundaries or crossing points, end points, fiber nodes, cable and facility junctions, manholes, poles and repeaters, and;

· Customer’s sites, including customer locations and associated circuit terminations, facilities or equipment for eah specific customer.

· The datasets shall include, but are not limited to:

· Operating Company Numbers, Company Names, Routing Contacts

· Country Code Assignments

· NPA Information (i.e., Area Codes)

· LATA Codes By Region

· Destination Codes (i.e. NPA NXX and Thousands-Blocks)

· Oddball NXXs (e.g. 911, 976)

· Switching Entity Record detail (e.g. Equipment Type, V&H Coordinates)

· Rate Center details (e.g. V&H Coordinates) and Localities (including county and postal codes)

· Switch Homing Arrangements (tandem and other switch-to-switch interconnections)

· Operator Access Tandem Codes (ATCs)

· Location Routing Numbers (LRNs)

2.1 TASK ONE

Local Exchange Routing Guide dataset will be delivered at the beginning of each Federal Fiscal quarter on either CD-ROM/DVD shipped to COR or Emailed to COR for download quarterly.

2.2 TASK TWO

Central Location On-Line Entry System (CLONES) will be delivered by 10th business day of each month on either CD-ROM/DVD shipped to COR or Emailed to COR for download monthly.

3.0 GOVERNMENT ACCEPTANCE PERIOD

The COR will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying it that the deliverable has been accepted.

3.1 The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

3.2 The COR will have 30 business days to review deliverables and make comments. The Contractor shall have 30 business days to make corrections and redeliver.

3.3 All other review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan. The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review. The Contractor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

4.0 DELIVERABLES

The Contractor shall consider items in BOLD as having mandatory due dates. Items in italics are deliverables or events that must be reviewed and/or approved by the COR prior to proceeding to next deliverable or event in this SOW.

DISTRIBUTION

5.0 CONTRACTOR PERSONNEL

5.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW.

5.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all contract support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

6.0 OTHER APPLICABLE CONDITIONS

Identification of Non-Disclosure Requirements: Access to proprietary data is a fundamental requirement for execution of this task. However, when access to proprietary information is necessary to perform work, the Contractor shall be required to sign a Non-Disclosure Agreement with the contractor.

Intellectual Property Rights: All derivative works become the property of the Government. The contractor retains all intellectual rights to the data contained on the data discs or downloads.

Accountable Property: This contract does not have nor will it be used to purchase any accountable property.

6.1 PERIOD OF PERFORMANCE

The period of performance is from September 28th, 2024 to September 27th, 2028. The base year is from September 28th, 2024 through September 27th, 2025. Below is the base year and option year periods:

Period of Performance

6.2 PLACE OF PERFORMANCE

The primary place of performance will be the Contractor’s facilities.

6.3 HOURS OF OPERATION

Contractor employees shall generally perform all work between the hours of 0800 and 1600 EST, Monday through Friday (except Federal holidays).

6.4 TRAVEL

Contractor travel shall not be required for this requirement.

6.5 POST AWARD CONFERENCE

Post Award Conference shall not be required for this requirement. The contractor will deliver the data within 15 days once awarded.

6.6 PROJECT PLAN

Project Plan shall not be required for this requirement.

6.7 BUSINESS CONTINUITY PLAN

Business Continuity Plan shall not be required for this requirement.

6.8 PROGRESS REPORTS

Progress Reports shall not be required for this requirement.

6.9 INTELLECTUAL PROPERTY

The Intellectual Property matter of LERG/CLONES is determined by the contractor.

7.0 GOVERNMENT TERMS & DEFINITIONS

7.1 COR - Contracting Officer’s Representative

7.2 DHS - Department of Homeland Security

7.3 CISA - Cybersecurity & Infrastructure Security Agency

7.4 IOD - Integrated Operations Division

8.0 GOVERNMENT FURNISHED RESOURCES

The Government will not furnish any resources to the Contractor in support of this contract.

9.0 CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in SOW 8.0.

10.0 INVOICES AND PAYMENT PROVISIONS

Invoices shall be prepared per Section VII, Contract Clauses; Paragraph A. entitled “FAR CLAUSES INCORPORATED BY REFERENCE,” FAR Clause 52.232-25 Prompt Payment. In addition to invoice preparation as required by the FAR, the Contractor’s invoice shall include the following information:

1) Cover sheet identifying DHS;

2) Task Order Number;

3) Modification Number, if any;

4) UEI Number;

5) Month services provided

6) CLIN and Accounting Classifications

7) Contract Line Item Number (CLIN) and description for each billed item.

8) Any additional backup information as required by this contract.

9) ATTN: CISA/IOD

The contractor shall submit invoices monthly. The Contractor shall submit the invoice electronically to the address below:

E-mail: CISAInvoice.Consolidation@ice.dhs.gov

Simultaneously the Contractor shall provide an electronic copy of the invoice to the following individuals at the addresses below:

The contractor shall submit invoices to the email addresses above. Additionally, the contractor shall prepare and submit a sufficient and procurement regulatory compliant invoice and receiving report for technical certification of inspection/acceptance of services and approval for payment. The contractor shall attach back up information to the invoices and receiving reports substantiating all costs for services performed. The receiving agency’s written or electronic acceptance by the COR and date of acceptance shall be included as part of the backup documentation.

If the invoice is submitted without all required back up documentation, the invoice shall be rejected. The Government reserves the right to have all invoices and backup documentation reviewed by the Contracting Officer prior to payment approval.

11.0 RECORDS MANAGEMENT OBLIGATIONS

Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

CISA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of CISA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to CISA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to CISA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the contract. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and CISA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with CISA policy.

The Contractor shall not create or maintain any records containing any non-public CISA information that are not specifically tied to or authorized by the contract.

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

CISA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which CISA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

Training All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take CISA-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

Flowdown of requirements to subcontractors The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract, and require written subcontractor acknowledgment of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

13.0 SECURITY

Contractor access to classified information is not required under this SOW.

13.1 PROTECTION OF INFORMATION

The Government will provide all necessary information, data and documents to the Contractor for work required under this contract.

REFERENCES:

DHS Management Directive 140-01, “Information Technology System Security Program, Sensitive Systems”

· DHS 4300A Policy Directive (Version 13.3, February 13, 2023).

· DHS National Security Systems Policy Directive 4300B, Version 10.1, November 21, 2018 for NSS Collateral (Unclass, Secret or Top Secret Collateral).

· DHS Sensitive Compartmented Information (SCI) Systems 4300C Instruction Manual, Version 2.1, March 24, 2017 for TS SCI/C-LAN.

1. DHS and CISA ENTERPRISE ARCHITECTURE COMPLIANCE All solutions and services shall meet DHS and CISA Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security Enterprise (HLS) Architecture (EA) requirements:

· All developed solutions and requirements shall be compliant with the HLS EA.

· All IT hardware and software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

· Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the CISA Chief Data Officer for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

· Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01 and CISA’s Enterprise Data Management Program Policy and all data-related artifacts will be developed and validated according to DHS and CISA data management architectural guidelines.

· Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

2. DHS GEOSPATIAL INFORMATION SYSTEM TERMS AND CONDITIONS

All implementations including geospatial data, information, and services shall comply with the policies and requirements set forth in the DHS Geospatial Information Infrastructure (GII), including (but not limited to) the following:

- All data built to the GII, whether adopted or developed, shall be submitted to the government for review and insertion into the DHS Data Reference Model.

- All software built to the GII, whether adopted or developed, shall be submitted to the government for review and insertion into the DHS Technical Reference Model.

3. EPEAT AND ENERGY STAR LANGUAGE

All hardware procured directly or in support of this action must meet applicable and appropriate Electronic Product Environmental Assessment Tool (EPEAT) and ENERGY Star standards.

4. DHS CYBER-SUPPLY CHAIN RISK MANAGEMENT (C-SCRM) TERMS & CONDITIONS

a. Definitions

i. Component: a unit defined by the supplier that connects to and functions as part of the product. For software products, a component is a unit of software defined by a supplier at the time the component is built, packaged, or delivered. For hardware, a component is one hardware unit designed to connect to and function as part of a larger product.

ii. End-of-Life (EOL): means that an ICT product has reached the final stage of the product life cycle in which that version of the ICT product will no longer be supported nor manufactured (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

iii. End-of-Support (EOS): means that an ICT product will no longer be supported (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

iv. Information and Communications Technology (ICT): encompasses the capture, storage, retrieval, processing, display, representation, presentation, organization, management, security, transfer, and interchange of data and information; includes all categories of ubiquitous technology used for the gathering, storing, transmitting, retrieving, or processing of information (e.g., microelectronics, printed circuit boards, computing systems, software, signal processors, mobile telephony, satellite communications, and networks).

v. Product: part of the equipment (hardware, software and materials) for which usability is to be specified or evaluated.

b. Original Equipment Manufacturer (OEM) End-use Information and Communications Technology (ICT) Product

i. The contractor shall provide new equipment unless otherwise formally approved by the Government, in writing. The contractor shall provide only Original Manufacturer (OEM) end-use products to the Government. In the event that a shipped OEM product, or part or component of that product, fails, all replacements must be new (i.e., non-refurbished, not previously used) OEM.

ii. The contractor may provide previously-used OEM products only with written Government approval. Such parts shall be procured from their original source and shipped only from the manufacturer's authorized shipment points.

c. Accounting of Components in ICT Products

i. The contractor shall provide and maintain a list of components for each product used in performance of the contract, including through subcontracts or other arrangements. This list for each product shall provide the component manufacturer's name, address, state, and/or domain of registration, and, where applicable, the Unique Entity Identifier (UEI) number, for all components comprising the ICT products.

ii. The contractor shall notify the Government when a new contractor/subcontractor/service provider is introduced to the ICT provided on this contract, or when suppliers of components or products are changed. If a software component used in the performance of the contract is updated with a new build or release, the contractor must update the list provided in accordance with (i) above to reflect the new version of the software. This includes software builds to integrate an updated component or dependency.

iii. For software products, the contractor shall provide all OEM software updates, and patches to correct defects, for the life of the product [i.e., until the "End of Life" (EoL) or "End of Support" (EoS)]. Software updates and patches shall be made available to the government for all products procured under this Contract, and replaced when End of Support (EoS) is reached.

iv. A contractor using team members in performance of the contract (e.g., subcontractors or other service providers) shall ensure that the standards for the accounting of components in this subsection are met by team members.

d. Supply-Chain Transport

i. The contractor shall use formal, documented and accountable transit, storage, and delivery procedures (i.e., the possession of the end-use product to be delivered is documented at all times from initial shipping point to final destination, and every transfer of the product from one custodian to another is fully documented and accountable) for all information and communication technology (ICT) shipments to fulfill this contract.

ii. The contractor shall maintain all records pertaining to the transit, storage, and delivery of ICT deliverables under this contract through at least 6 months after acceptance, and make available for inspection upon request of the Government.

iii. The contractor shall make use of tamper-proof or tamper-evident packaging for all shipments.

iv. The contractor shall provide a packing slip for each container or package with the information identifying the contract or order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact.

v. The contractor shall provide a shipping notification to the intended government recipient; with a copy transmitted to the Contracting Officer, or other designated representative. This shipping notification shall be provided electronically and identify the contract or order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

e. Changes to Ownership and Control

The Contractor shall immediately notify the Contracting Officer and Contracting Officer's Representative regarding any significant changes to corporate ownership or control from contract award through final delivery or the end of the period of performance. A significant change would be one in which a change occurs in the individuals or entities who, directly or indirectly, either (1) exercises substantial control over an entity, or (2) owns or controls at least 25 percent of the ownership interests of an entity.

5. SECTION 508 REQUIREMENTS

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

5.1 Section 508 Requirements for Technology Products (include in the SOW, PWS, or SOO) Section 508 applicability to Information and Communications Technology (ICT): LERG/CLONES Applicable Exception: N/A Authorization #: N/A Applicable Functional Performance Criteria: Does not apply Applicable 508 requirements for electronic content features and components (including but not limited to Other): Does not apply Applicable 508 requirements for software features and components: Does not apply Applicable 508 requirements for hardware features and components: Does not apply Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply

5.2 Section 508 Deliverables (include in the SOW, PWS, or SOO) Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

6. THE HOMELAND SECURITY PRESIDENTIAL DIRECTIVE 12 (HSPD-12)

- The Homeland Security Presidential Directive 12 (HSPD-12) requires the use of the Personal Identity Verification (PIV) credentials as the common means of authentication for access to DHS facilities, networks, and information systems. Personal Identity Verification (PIV) credentials shall be used as the primary means of logical authentication for DHS sensitive systems. The Contractor must use his or her federal issued Personal Identity Verification (PIV) credentials to access DHS resources to include IT applications and physical facility.

- The DHS Security Office shall be notified of all terminations/resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer Representative (COR) all DHS issued Personal Identity Verification (PIV) credentials/identification cards and building passes that have either expired or have been collected from terminated employees. If a PIV credential/identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the PIV credential, pass or card number, name of individual to who it was issued and the last known location and disposition of the PIV credential, pass or card."

7. ARTIFICIAL INTELLIGENCE/MACHINE LEARNING REQUIREMENTS

Definitions: Artificial Intelligence (AI) includes the following: (1) Any artificial system that performs tasks under varying and unpredictable circumstances without significant human oversight, or that can learn from experience and improve performance when exposed to data sets. (2) An artificial system developed in computer software, physical hardware, or other context that solves tasks requiring human-like perception, cognition, planning, learning, communication, or physical action. (3) An artificial system designed to think or act like a human, including cognitive architectures and neural networks. (4) A set of techniques, including machine learning, that is designed to approximate a cognitive task. (5) An artificial system designed to act rationally, including an intelligent software agent or embodied robot that achieves goals using perception, planning, reasoning, learning, communicating, decision making, and acting.

Requirements:

The 2019 National Defense Authorization Act (NDAA) and Executive Order (EO) 13960 require that AI used in the Federal Government foster public trust and confidence while protecting privacy, civil rights, civil liberties, and American values. All federal employees, contractors, and subcontractors, when designing, developing, acquiring, and/or using AI for or within DHS, will adhere to the following 9 principles.

1. Lawful and respectful of our Nation's values: Agencies shall design, develop, acquire, and use AI in a manner that exhibits due respect for our Nation's values and is consistent with the Constitution and all other applicable laws and policies, including those addressing privacy, civil rights, and civil liberties.

2. Purposeful and performance-driven: Agencies shall seek opportunities for designing, developing, acquiring, and using AI, where the benefits of doing so significantly outweigh the risks, and the risks can be assessed and managed.

3. Accurate, reliable, and effective: Agencies shall ensure that their application of AI is consistent with the use cases for which that AI was trained, and such use is accurate, reliable, and effective.

4. Safe, secure, and resilient: Agencies shall ensure the safety, security, and resiliency of their AI applications, including resilience when confronted with systematic vulnerabilities, adversarial manipulation, and other malicious exploitation.

5. Understandable: Agencies shall ensure that the operations and outcomes of their AI applications are sufficiently understandable by subject matter experts, users, and others, as appropriate.

6. Responsible and traceable: Agencies shall ensure that human roles and responsibilities are clearly defined, understood, and appropriately assigned for the design, development, acquisition, and use of AI. Agencies shall ensure that AI is used in a manner consistent with these Principles and the purposes for which each use of AI is intended. The design, development, acquisition, and use of AI, as well as relevant inputs and outputs of particular AI applications, should be well documented and traceable, as appropriate and to the extent practicable.

7. Regularly monitored: Agencies shall ensure that their AI applications are regularly tested against these Principles. Mechanisms should be maintained to supersede, disengage, or deactivate existing applications of AI that demonstrate performance or outcomes that are inconsistent with their intended use or this order.

8. Transparent: Agencies shall be transparent in disclosing relevant information regarding their use of AI to appropriate stakeholders, including the Congress and the public, to the extent practicable and in accordance with applicable laws and policies, including with respect to the protection of privacy and of sensitive law enforcement, national security, and other protected information.

9. Accountable: Agencies shall be accountable for implementing and enforcing appropriate safeguards for the proper use and functioning of their applications of AI, and shall monitor, audit, and document compliance with those safeguards. Agencies shall provide appropriate training to all agency personnel responsible for the design, development, acquisition, and use of AI.

Updated 7/10/2024