Performance Work Statement (PWS) - LCMS-5.8.25.pdf

Performance Work Statement Learning Content Management System National Preparedness Division (NPD) 5/8/2025 Attachment A

FEMA Learning Content Management System Performance Work Statement vX.X Page i

Table of Contents

Performance Work Statement ...................................................................................................................... I

3/19/2025 ................................................................................................................................. I

Attachment A ............................................................................................................................... I

Table of Contents ......................................................................................................................... i

1.0 General

2.0 Contractor Tasks

3.0 Schedule of Deliverables

4.0 Section 508 Requirements

5.0 Security, Privacy, Safety, Proprietary Data, and Records Management

6.0 Enterprise Architecture Compliance

7.0 GOVERNMENT DEFINITIONS

8.0 MANAGEMENT RESPONSIBILITIES

v1.0 Page 1

1.0 General

1.1 Background

The National Disaster & Emergency Management University (NDEMU) will be comprised of three specialized schools supporting different emergency management career paths and specialized communities: the Emergency Management Institute; School of Disaster Leadership; and School of National Resilience. NDEMU develops and provides training, empowering States, local governments, tribes, territories, private sector entities, and the general public to prepare for and respond to disasters.

NDEMU maintains a large curriculum of courses and currently uses a Learning Content Management System (LCMS) is to develop, share, and manage the eLearning training. The current system is a cloud-based solution allowing collaborative course development. The system includes content authoring, rapid development, and content import capabilities. Course content is shared and reused in multiple courses which maintains consistency across the curriculum and expedites the revision process. Subject Matter Experts can log into the system to provide review comments. Once the materials have been finalized, NDEMU uses the system to export courses out into a variety of end products including Instructor Guides, Student Manuals (MS Word), PowerPoint visuals, SCORM, and

HTML.

1.2 Scope

The intention of this requirement is the acquisition of continued use of a Learning Content Management System (LCMS) and services to support the U.S. Department of Homeland Security (DHS)/Federal Emergency Management Agency (FEMA)/Protection and National Preparedness (PNP)/National Preparedness Directorate (NPD). The contractor shall provide all products and services as identified in this performance work statement. The objective of this procurement is to obtain reliable, efficient and effective services by applying a sound management and technical approach that will provide the best value and meet the objectives described in this work statement.

1.3 Contractor Personnel

1.3.1 Qualified Personnel.

The contractor shall provide qualified personnel to perform all requirements specified in this PWS.

All contractor employees supporting this contract shall be citizens of the United States (international exceptions must receive a favorable DHS suitability determination prior to hiring action). The contractor shall provide a Project Manager who holds a certification and 3+ years of prior v1.0 Page 2 experience. Prior to assignment to the contract, the contractor shall submit a current résumé for all management and other key personnel if different from those personnel identified in the proposal.

Any replacement of key personnel shall be subject to the Contracting Officer’s approval in accordance with the clause HSAR 3052.215-70, Key Personnel or Facilities.

1.3.2 Contractor Certifications and Specific Experience Requirements.

Contractor employees shall possess the education, experience, and skills necessary to complete the requirements with or without certifications. Certifications provide credence to skills possessed and are desired, but do not automatically indicate a person’s ability to perform the given tasks. The contractor shall provide personnel that have the appropriate experience and skill level for the position assigned.

1.3.3 Contractor Identification.

Contractor personnel working on-site at Government facilities shall wear a Government issued identification badge. All contractor personnel shall identify themselves as contractors when their status is not readily apparent and display the Government issued badge in plain view above the waist at all times.

1.3.4 Visitors.

Contractor-authorized personnel visiting Government facilities must coordinate their visit with the Contracting Officer’s Representative (COR) to obtain appropriate visitor access to the government site to be visited. Visiting personnel will be issued a temporary visitor badge that must be worn at all times while on government property. Visiting contractor personnel shall comply with all Government escort rules and requirements.

1.3.5 Contractor Personnel Conduct.

Contractor’s employees shall comply with applicable Government regulations, policies and procedures (e.g., fire, safety, emergency response, sanitation, environmental protection, security, “off limits” areas, wearing of parts of military uniforms, possession of drugs and possession of weapons) when visiting or working at Government facilities.

v1.0 Page 3

1.3.6 Removing Contractor Personnel for Misconduct or Security Reasons.

The Government may, at its sole discretion, direct the contractor to remove any contractor employee from government facilities for misconduct or security reasons. Removal does not relieve the contractor of the responsibility to continue providing the services required under any task order awarded. The COR will provide the contractor with a written explanation to support any request to remove any employee.

1.4 Period of Performance (POP)

The period of performance shall be as listed below. The total performance period inclusive of options is five years.

Phase-In Period 1 Month

Base period: 11 Months

Option 1: 12 Months

Option 2: 12 Months

Option 3: 12 Months

Option 4: 12 Months

1.4.1 Phase-In

The first month of the contract POP will be the phase-in period. The Contractor shall provide phase-in duties as described below. The Contractor is expected to be at full performance at the completion of the phase-in period:

Kick-Off Meeting

Complete Training Requirements - Appropriate contracting staff will complete training requirements as described in this document.

Begin assisting the Government with the Authority To Operate (ATO) process as defined in this document. This includes the development and submission of the draft Security Authorization (SA) documentation within 30 days of the start of the contract and all other requirements included in that section.

Stand-up stage environment, configure system, and provide access for up to 10 initial users (admins/developers) in an effort to prepare the system prior to going live. The stage will be used in the future to test new releases and for bug fixes.

v1.0 Page 4

Provide training for system users including Administrators, Content Developers, and Reviewers

Develop custom export templates that include branding logo and colors at a minimum.

Set up the Production Environment and integrate with existing Learning Management Solution allowing for Dynamic Delivery of content.

Content Import – Review existing course materials provided by the Government and develop (if one doesn’t already exist) method to import existing content into the system (ensuring that it may be edited directly within the new system).

1.4.2 Phase-out/Contract Closeout

The contractor shall establish and implement plans for an orderly phase-out of the contracted operations at the termination of this contract. The contractor shall submit a Phase-out Plan to the Contracting Officer (CO) and COR for evaluation 60 days prior to the last day of the contract. The contractor's phase-out procedures shall not disrupt or adversely impact the day-to-day conduct of Government business.

1.5 Place of Performance

The services provided under this contract are hosted in an internet cloud environment and performance of services is not limited to a physical location.

1.6 Kick-Off Meeting

The Contractor shall attend a Kick-Off Meeting with the Contracting Officer and the COR at a date to be determined. The purpose of the Kick-Off Meeting, which will be chaired by the CO, is to discuss technical and contracting objectives of this contract and review the Contractor’s draft project management plan. The Kick-Off Meeting will be held at the Government’s facility and/or via a conference call.

1.7 Progress Meetings

The Project Manager shall be available telephonically to discuss progress, exchange information and resolve emergent technical problems and issues with the COR.

v1.0 Page 5

1.8 General Report Requirements

The contractor shall provide all written reports in electronic format using applications that are compatible with FEMA Standard Workstation (Windows and Microsoft Office Applications). In accordance with the Paperwork Reduction Act of 1980 (44 U.S.C. § 3501) contractor and the Government will make every effort to reduce forms and reports in support of FEMA training.

1.9 General Information

Workmanship. All workmanship shall meet or exceed the standards specified herein and shall be accomplished in conformance with approved and accepted standards of the industry, Federal, State and local standards.

v1.0 Page 6

2.0 Contractor Tasks

The contractor shall provide a LCMS system, licenses, project management, hosting, and generalized support as described below.

2.1 LCMS System and Capabilities

The LCMS shall include, but not be limited to the following features:

2.1.1 Content Creation and Authoring Tools:

Ability to add and edit basic course materials, including text, images, audio, and video.

Interactive content creation, including tabs, slideshows, buttons, links, clickable images, interactive videos, scenarios, branching, user directed content, and fully customizable interactions.

Questions and assessments elements that may be used as knowledge checks, pre-course assessments, and post-course assessments.

Easy to use What You See Is What You Get (WYSIWYG) editor for all components.

Ability to structure learning content into a hierarchical structure (example: Modules, Lessons, Pages) that can easily be reorganized.

Support for multiple languages and translations.

Support custom content tags allowing content to be viewed/exported if it has a specific tag applied.

2.1.2 Collaborative Capabilities:

Role-based permissions for authors, reviewers, and administrators.

Version control and content history tracking.

Ability to revert to previous versions of a page and entire course project.

Content review and approval workflows with comment tracking.

Real-time co-authoring and task assignment capabilities.

Content Sharing and Reusability:

o Ability to create reusable learning objects centered around a single Learning Objective and shared among projects.

o Media library and storage allowing holding media versions, metadata, alt text, and the ability to modify/replace the image across the system.

v1.0 Page 7 o Ability to reuse content (reusable learning objects and media) across multiple courses changing once to affect all locations.

Team-based development capabilities

Lockable content so that it may be used/viewed, but not edited.

2.1.3 User Centered Content Creation Abilities:

Content generated in the system is student focused including ability to create:

Adaptive learning pathways and branching scenarios.

Integrated feedback mechanisms and knowledge checks.

Granular student tracking mechanisms, including time spent on each activity and completion rates.

Test-out options.

Post-course assessments.

2.1.4 Export Capabilities:

A single course may be exported into multiple formats without the need to recreate content.

Export to HTML5, SCORM 1.2, SCORM 2004, xAPI (Tin Can), and cmi5.

Document based exports: Microsoft Word (docx) and Adobe PDF.

Dynamic delivery and integration with Learning Management Systems (LMS) and other third-party platforms. Dynamic delivery should allow a live link from the LCMS to the LMS so that content edits are immediately available upon publishing. Courses should maintain full tracking ability.

Analytics and Reporting:

o Learner progress tracking and assessment analytics.

o Content performance reports.

o Course Development reports.

o User Access Records

Ability to export content with specific chosen tags.

Supports custom publishing profiles to make exports efficient.

Export multiple courses simultaneously.

v1.0 Page 8

2.1.5 User Management:

Role-based and project based access/permissions.

Admin role with the ability to add and remove other users.

Assign developers and reviewers to specific courses.

Customizable developer roles (add/remove capabilities).

User Access Records

2.1.6 Artificial Intelligence (AI) Integration:

Support integration with AI technologies, including but not limited to APIs, to enhance system functionality and enable AI-driven features.

The system shall allow for modular AI enhancements, ensuring flexibility to adopt emerging AI technologies without significant system overhauls.

Leverage AI for generating course content

AI capabilities including at least one of the following: scenario generation, conversational learner assistance, personalized learning paths, adaptive content, and/or intelligent student assessment/feedback.

2.1.7 Miscellaneous:

Integration with the ServiceNow platform ensuring bidirectional data exchange. Integration must comply with ServiceNow’s best practices and ensure secure, real-time or near real time synchronization.

Customizable themes and templates for both web-based and document based exports.

o Allow branding and logo creation.

Support multiple partitions allowing for segregated content development as needed.

Single Sign-On (SSO) and multi-factor authentication.

Compliance with WCAG 2.1 accessibility standards for both authoring tool and exported products.

Delivery of eLearning content for up to 10,000 concurrent users and 3 million+ users/year.

Ongoing technical support and bug fixes.

2.2 Licenses

Administrative Licenses (5 minimum) v1.0 Page 9 o Option to purchase 5 additional administrative licenses.

Developer Licenses (70 minimum) o Options to purchase additional 50 Developer Licenses in increments of 10 (Quantity of 5).

Reviewer Licenses (Unlimited)

Licenses may be reassigned as needed as frequently as necessary. Program may perform reassignment without need to contact contractor.

2.3 Project Management and Support

Dedicated project manager to oversee implementation.

Biweekly Status Meetings and Reports.

Issues tracking, testing, and ticketing system to raise/address support issues.

Development of project plans and timelines.

Risk management and issue resolution processes.

Initial set up assistance to include migration of all existing course materials from current system (dominKnow One) LCMS.

o Migration shall include the movement of all materials and assets related to courses with full editability in the new system.

2.4 Hosting Services (Optional)

The LCMS must be FedRAMP authorized Software as a Service (SaaS) or hosted in a FedRAMP authorized Infrastructure as a Service (IaaS)/Platform as a Service (PaaS) environment.

The LCMS shall comply with DHS Sensitive Systems Policy Directive 4300A, and its attachments.

The contractor shall provide Information System Continuous Monitoring (ISCM) and Continuous Diagnostics and Mitigation (CDM) data as described in the most recent Fiscal Year DHS Information Security Performance Plan.

The contractor shall implement role-based access control, encryption, and backups to ensure protection of retained data.

The contractor shall retain data in accordance with the following requirements:

v1.0 Page 10 o Curriculum content and related files—Five years after the date on which a course is retired or superseded.

o Audit logs—Online for at least 90 days and preserved for a period of three years to allow audit information to be placed online for analysis with reasonable ease.

o User information—Three years to support audit information analysis.

The contractor shall provide LCMS upgrades as they are available to ensure the LCMS software is always current.

The contractor shall provide a minimum of 24 hour notice for system downtime in support of routine maintenance. The contractor will provide notice within one hour of a system casualty and provide regular updates of when the system is expected to return to partial and full operation.

2.5 Generalized Support Hours (200 Hours Minimum)

Product enhancements and customization requested by customer.

Access to knowledge base and community forums.

Training sessions for content creators and administrators.

Option to purchase additional support hours in 10-hour increments (Quantity of 70 for a total of 700 optional hours).

v1.0 Page 11

3.0 Schedule of Deliverables

Task Deliverable Timeline

Provide LCMS Kick-Off Meeting 7 CDAA

Complete Training Requirements

30 CDAA

Authority to Operate (ATO) Documentation and Related Activities

30 CDAA

Stage Environment Setup 15 CDAA

Initial LCMS Training Sessions (Admin, Developers, Reviewers)

30 CDAA

Custom Templates Including Branding Logo and Colors

45 CDAA

Production Environment Setup (Including Dynamic Delivery)

45 CDAA

Import Existing Content into Production

45 CDAA

Phase-Out Plan 60 Days prior to contract end

Phase-Out: Custom Content, and Contract Close Out

7 Days prior to contract end

Provide Licenses Delivery of Required Licenses

Administrative Licenses (5 minimum)

Developer Licenses (70 minimum)

Reviewer Licenses (Unlimited)

15 CDAA

Optional Administrative Licenses: 5

As requested v1.0 Page 12

Task Deliverable Timeline

Optional Developer Licenses:

(Increments of 10 up to 50)

As Requested

Provide Project Management Project management Support Duration of Project

Bi-weekly Status Updates (1 hour)

Every 2 Weeks

Hosting (Optional) Hosting in a FedRAMP Authorized Environment

Aligned with system setup milestones

Generalized Support Hours Support Hours for Enhancements, Customizations, and Training

Duration of Project (as needed)

Optional Support Hours (Increments of 10 up to 700)

As requested v1.0 Page 13

4.0 Section 508 Requirements

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

4.1 Section 508 Requirements for Technology Products

Section 508 applicability to Information and Communications Technology (ICT): Learning Content Management System

Applicable Exception: N/A Authorization #: N/A

Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components (including but not limited to Electronic document templates; Electronic reports; Electronic training materials;

Multimedia (video/audio)): All requirements in E205 apply, including all WCAG 2.0 Level A and AA Success Criteria apply as specified in E205

Applicable 508 requirements for software features and components (including but not limited to Web, desktop, server, mobile client applications; Electronic content and software authoring tools and platforms) v1.0 Page 14

Applicable 508 requirements for hardware features and components: Does not apply

Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply

4.2 Section 508 Requirements for Technology Services

1. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item's level of Section 508 conformance prior to the services being performed.

2. When providing Platform as a Service (PaaS) or Software as a Service (SaaS), the contractor shall ensure services conform to the applicable Section 508 standards (including the requirements in Chapter 5 for software and WCAG Level A and AA Level 2.0 success criteria for web and software. When the requirements in Chapter 5 do not address one or more software functions, the Contractor shall ensure conformance to the Functional Performance Criteria specified in Chapter 3.) The agency reserves the right to request an Accessibility Conformance Report (ACR) for PaaS and SaaS offerings. The ACR should be created using the Voluntary Product Accessibility Template Version 2.2 508 (or later). The template can be located at https://www.itic.org/policy/accessibility/vpat

3. When providing cloud hosting services (Infrastructure as a Service, Platform as a Service, Software as a Service, etc.) the Contractor shall ensure user administrative screens, dashboards and portals used to configure, and monitor cloud services conform to the Section 508 standards.

4. The Contractor shall ensure cloud hosting services shall not reduce the level of Section 508 conformance for ICT migrated by DHS to the cloud hosting environment.

5. When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

6. When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

7. When developing or modifying web based and electronic content components, except for electronic documents and non-fillable forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria) by conducting testing using the DHS Trusted Tester for Web Methodology Version 5.0 or successor versions, and shall ensure testing is conducted by individuals who are certified by DHS on version 5.0 or successor versions (e.g. “DHS Certified Trusted Testers”). The Contractor shall provide the v1.0 Page 15

Trusted Tester Certification IDs to DHS upon request. Information on the DHS Trusted Tester for Web Methodology Version 5.0, related test tools, test reporting, training, and tester certification requirements is published at https://www.dhs.gov/trusted-tester.

8. When developing or modifying electronic documents and forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable to the applicable Section 508 standards (including WCAG Level A and AA Level 2.0 Success Criteria) by conducting testing using the test methods published under “Accessibility Tests for Documents” at https://www.dhs.gov/compliance-test-processes.

9. When developing or modifying ICT deliverables that contain the ability to automatically generate electronic documents and forms in Microsoft Office and Adobe formats, or when the capability is provided to enable end users to design and author web based electronic content (i.e. surveys, dashboards, charts, data visualizations, etc.), the Contractor shall demonstrate the ability to ensure these outputs conform to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria). The Contractor shall demonstrate conformance by conducting testing and reporting test results based on representative sample outputs. For outputs produced as Microsoft Office and Adobe PDF file formats, the Contractor shall use the test methods published under “Accessibility Tests for Documents”, which are published at https://www.dhs.gov/compliance-test-processes. For outputs produced as web based electronic content, the Contractor shall use the DHS Trusted Tester for Web Methodology Version 5.0, or successor versions. This methodology is published at https://www.dhs.gov/trusted-tester

10. When developing or modifying software functions of ICT, the Contractor shall demonstrate conformance to the applicable Section 508 standards (including the requirements in Chapter 5 and WCAG 2.0 Level A and AA Success Criteria). When the requirements in Chapter 5 do not address one or more software functions, the Contractor shall demonstrate conformance to the Functional Performance Criteria specified in Chapter 3. The Contractor shall use a test process capable of validating conformance to all applicable Section 508 standards for software functionality delivered pursuant to this contract. The Contractor may utilize the DHS Trusted Tester Methodology for Web and Software Version 4.0 as a component of the overall test process used. This version of the test process provides partial test coverage of the Section 508 standards that apply to software. If the Contractor uses this test process, the Contractor shall address the test coverage gaps through additional test procedures.

Information on the DHS Trusted Tester Methodology for Web and Software Version 4.0, including coverage against the applicable Section 508 standards for software as well as gaps that need to be addressed through other test methods, related test tools, and training is published at https://www.dhs.gov/trusted-tester.

11. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the accessibility requirements in this work statement.

v1.0 Page 16

4.3 Section 508 Deliverables

1. Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the

Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions.

2. Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

3. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

4. Other Section 508 Documentation: The following documentation shall be provided upon request for ICT items offered through this contract:

o Documentation of features provided to help achieve accessibility and usability for people with disabilities.

o Documentation on how to configure and install the ICT Item to support accessibility.

o Documentation of core functions that cannot be accessed by persons with disabilities.

o Documentation of remediation plans to address non-conformance to the Section 508 standards v1.0 Page 17

5.0 Security, Privacy, Safety, Proprietary Data, and Records

Management

5.1 Security Clearance:

Unclassified

5.2 Privacy Act.

This agreement may require the contractor personnel to safeguard data in accordance with the Privacy Act (5 USC 522a). Contractor personnel shall safeguard any documents containing Personally Identifiable Information (PII) or Sensitive PII.

5.2.1 Safeguarding of Controlled Unclassified Information

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls. Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security

(including the Revised Procedural Manual “Safeguarding Information Designated as

Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical v1.0 Page 18

Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security

Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6

CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland

Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of

Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security

(including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security

Information (SSI)” and, within the Transportation Security Administration, TSA MD

2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of

Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity

Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of

Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of v1.0 Page 19

Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information;

interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under

Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the

Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and v1.0 Page 20 certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and

Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

i. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration

Numbers (A-numbers), financial account numbers, and biometric identifiers.

ii. Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

A. Truncated SSN (such as last 4 digits);

B. Date of birth (month, day, and year);

C. Citizenship or immigration status;

D. Ethnic or religious affiliation;

E. Sexual orientation;

F. Criminal history;

G. Medical information; and v1.0 Page 21

H. System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

iii. Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual. Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form. Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency. Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information. Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology. Information

Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity; (2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and v1.0 Page 22 proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information. Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect

CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected v1.0 Page 23 incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A

Information Technology System Security Program, Sensitive Systems. If the

Component SOC is not available, the Contractor shall report to the DHS

Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors.

Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise

SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS

140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic- �module validationprogram/validated-modules.

When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email.

The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email.

v1.0 Page 24

Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the

Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A

Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime

Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level; (vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network; (viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the

Contractor and subcontractor level;

v1.0 Page 25

(xii) Description of the government PII or SPII contained within the system;

and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data.

The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest. (5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and

Information.

Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or v1.0 Page 26 destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for

Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements.

Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

(g) Subcontracts.

The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

Security Training Requirements.

(1) All users of Federal information systems are required by Title 5, Code of Federal

Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of Homeland Security (DHS) requires that

Contractor employees take an annual Information Technology Security Awareness Training course before accessing sensitive information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor v1.0 Page 27 employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs- �security and-training-requirements-contractors. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than

October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

(2) The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of

Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the

DHS Rules of Behavior before accessing DHS systems and sensitive information. The

Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the

Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than thirty…