PR20147033-TowerInfrastructureModernizationHardwareBuy-SOW-DRAFT.docx

U.S. Customs and Border Protection (CBP) Office of Information and Technology (OIT) Enterprise Infrastructure and Operations Directorate (EIOD) Network Architecture & Engineering Division (NAED) Network Equipment Buy

Statement of Work (SOW)

For Tower Infrastructure Modernization Hardware Buy

2014-7033

BACKGROUND

The Office of Information and Technology (OIT) is responsible for the procurement, installation, and management of data communications systems for the Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP). The Tower Infrastructure Modernization (TIM) solution is integrating into the Production environment the streaming video of Integrated Fixed Towers (IFT) cameras in the Tucson Sector Command-and-Control Centers (C2CENs).

The current infrastructure includes the following hardware and software: IBM Power servers, x86 servers, IBM Aspera High-Speed Transfer Servers (HSTS), Maximo Visual Inspection (MVI), Equitus Video Sentinel (EVS) Software, Milestone software, Red Hat, CBP Modular Google Environment (MAGE) and a searchable metadata repository.

SCOPE

The acquisition and delivery of equivalent or better TIM server equipment, licensing, and maintenance compatible or better than the items specified in the Bill of Materials (BOM) is required to provide CBP TIM solution to the remaining C2CENs in the Tucson Sector to include Ajo, San Miguel and Casa Grande Arizona. The Contractor shall propose technologies and a complete integration services to deliver equivalent infrastructure/data equipment and parts to that outlined in the BOM. The Contractor is responsible for performing necessary ancillary services to deliver, install, configure , integrate and operate the requested HW/SW infrastructure.

APPLICABLE DOCUMENTS

The Federal Acquisitions Regulations (FAR): http:// www.acquisition.gov/FAR/ Section 508 of the Rehabilitation Act: http://www.section508.gov/ Homeland Security Acquisition Regulation (HSAR): https://www.acquisition.gov/hsar Code of Federal Regulations (CFR): https://www.ecfr.gov/ Federal Information Security Modernization Act of 2014 (FISMA 2014) National Institute of Standards and Technology (NIST) Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Recommended Security Controls for Federal Information Systems CBP Information Security Policies and Procedures Handbook DHS IT Security Policies (NIST800-47) & (CBP 1400-05C): https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook

SPECIFIC TASKS

The Contractor shall complete the following tasks as required to comply with this SOW.

Program Management

Program management will be required under this scope of work and to be included in vendor proposal.

· Conduct kick-off meeting

· Provide weekly status reporting

· Manage contractor staff

· Provide updated deliverable documents as sites are productionized

Ancillary Services

1.

2.

3.

4.

4.1.

4.2.

4.2.1. Integrate with the TIM infrastructure deployed in Douglas, Nogales and Sonoita.

4.2.2. Install and Integrate new hardware into on-prem servers in C2CENS at Ajo, Casa Grande and San Miguel, AZ.

4.2.3. Connect new equipment into the CBP environment per example depicted below.

4.2.4. Install, configure and maintain software that CBP will provide as government furnished property (GFP), including:

· IBM Aspera Endpoint 5 Gbps Install License

· IBM Aspera Enterprise 10 Gbps Install License

· IBM Maximo Application Suite per AppPoint

· Trend Micro Antivirus

4.2.4.1. Objectives:

· Stream live video to provide continuous monitoring of real-time tower video with video analytics using open-source AI models that are trained to auto-detect video images of events being recorded.

· Configure server software to transport large video files from the CBP TUS C2CENs to CBP MAGE Cloud environment.

· Provide managed services include maintenance, upgrade, and patching of all systems components deployed.

· Full integration of 50 towers with up to 100 cameras across 6 sites in the Tucson Sector.

DELIVERABLES AND DELIVERY SCHEDULE

Equipment

The Contractor shall deliver the new equipment and related software per the award.

All equipment shall be delivered to the various addresses specified below within 90 days of award. The maintenance Period of Performance (PoP) for any associated hardware and software maintenance shall be one (1) year from delivery date.

Schedule for Ancillary Services Schedule for “fully configured and operational (in production) all hardware and software

Production enablement at each of the sites are sequential but are contingent on the project progress as well as on site/personnel schedules and may be adjusted by the government as needed.

Installation Addresses

Below are the three existing sites where the TIM solution is deployed.

Douglas Border Patrol Station Attention LPO & Delivery POC: Beatrice Harnett 1608 N. Kings Hwy Douglas, AZ 85607 Phone 520-805-8016

Sonoita Border Patrol Station Attention: LPO & Delivery POC’s: Mary McDermott-Brock & Andrea Culp 3225 Highway 82 Sonoita, AZ 85637 Phone 520-455-4242

Nogales Border Patrol Station Attention LPO & Delivery POC’s: Javier Serrano, Micah Riley 1500 W. La Quinta Road Nogales, AZ 85621

The shipping addresses for the NEW equipment for each respective site are listed below. Reflect CONUS shipment pricing.

The Purchase Order (PO) number must be reflected on the shipping label and clearly delineated on the packing slip(s).

Ajo Border Patrol Station (AJO006A) OIT/FSD POC: FTS Michael Hillier and AM Andrea Culp 850 N Hwy 85 Why, AZ 85321

San Miguel Forward Operating Base (SEL007A) OIT/FSD POC: FTS Frank Presnar and AM Andrea Culp FR 19, Mile Post 2 Sells, AZ 85634

Casa Grande Border Patrol Station OIT/FSD POC: FTS Michael Hillier and AM Andrea Culp 396 N Camino Mercado Casa Grande, AZ 85222

5.4 Delivery Confirmation and Packing Slips

The Contractor shall provide an electronic delivery confirmation to the Contracting Officer’s Representative (COR) identified in this SOW at the time of shipment. The confirmation should match the attached BOM to allow the COR to identify which items have been delivered and shall include the information identifying the contract number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number as stated in Supply Chain Risk Management Plan. See Section 9.5.2). That Contractor shall meet with the COR monthly and provide updates on equipment deliveries and estimated delivery schedules. Not complying with this format could result in a delay in invoice processing.

5.5 Documents

The Contractor shall provide updated versions of the documents listed in Section 6 for the Ajo, Casa Grande and San Miguel sites once each site is fully configured. One copy of the data shall be delivered in paper form and one copy in electronic form. The electronic form shall be in Microsoft Word format or Adobe Acrobat. The documents are deliverables under the contract and shall be provided at the time of delivery:

GOVERNMENT FURNISHED INFORMATION

The Government anticipates providing the documents listed below as Government-furnished information. Information below corresponds to current infrastructure. Contractor shall submit representative information that would correspond to their solution.

· Site Delivery Tasks

· Project Management Assumptions

Validate the hardware arrival and support preparation of the hardware during racking and stacking.

Secure the IP range and allocate the IP range among P10 and x86 servers. Submit tickets to add these IP addresses to the DNS

Work with the network team to enable traffic between AJO/CAG/TUC and MAGE

Work with the network team to enable traffic between FAA network and the C2CENs

Submit firewall requests to enable traffic between FAA Milestone and CBP Milestone servers

Secure firewall implementation by the CBP and FAA network team

Work with FTO network switch configuration team to implement network design created by the network team

Work with the Windows and RHEL team to deploy the OS on the x86 Servers.

Create the VIOs

Configure external storage device

Create the necessary PowerVM partitions (23 partitions)

Deploy the base OS on all the 23 PowerVM partitions

Validate the configuration

Hand over the P10 server to the RHEL team to install necessary CBP related agents and to add the VMs to LDAP.

Request and secure admin access to the Milestone Windows Server to deploy

Deploy CBP Milestone software

Configure CBP Milestone to connect to FAA Milestone

Deploy HSTE

Configure HSTE

Update HSTS Configuration in MAGE for C2CEN

Perform Unit Test

Create UAT Document

Perform UAT

Deploy Equitus Video Sentinel / SSE

Deploy Equitus Video Sentinel / DLE

Configure SSE/DLE with Video streams from Milestone

Unit test SSE/DLE

Perform End to End testing of the solution

Request and secure access to the PowerVM servers through LDAP accounts

Secure sample videos to develop models

Develop and Update Items of Interest Model

Validate the Model

Distribute and deploy the Model

Project Management Assumptions

a. This estimate assumes a continuous work effort from commencement to completion. If certain activities of the work need to be adjusted to meet accelerated or decelerated delivery schedules cost impacts may require adjustments.

b. This project will focus initially on 100 simultaneous video streams from the data source for processing, the resulting metadata and keyframes will be sent to CBP’s Google Cloud

(ModulAr GCP Environment or MAGE).

c. The contractor will make all efforts to staff and start the project in alignment with SOW requirements.

d. Any materials provided will be delivered in a MS-Office template format or one agreed by the government during kick-off.

deliverable review cycle is contemplated for each deliverable.

e. Prior to the start of the engagement, CBP will validate the background information (BI Clearance) for the personnel submitted by contractor team.

f. An integrated project schedule will be created that includes activities from both the contractor and CBP.

g. BI cleared contractor personnel will have keyboard access to all the servers required for the implementation of this solution.

h. As contractor will deploy the solution on CBP/MAGE, contractor will have access to the CBP/MAGE environment as well as access to the CBP/MAGE team for any questions and support related to the CBP/MAGE environment and deployment.

i. Any software required to develop taining material including but not limited to screen capture software (eg: Camtasia, Camtasia Recorder) will be provided by CBP.

j. CBP will make available to the stakeholders, subject matter experts, including network, data center infrastructure personnel and border patrol field agents deemed necessary for the discovery, deployment and operation of the solution.

k. The timely delivery of the project depends on all participants fulfilling their assigned tasks on schedule. Thus, the mutually agreed on delivery schedule can only be met when all participants including CBP keep their deliverable on schedule.

l. CBP/MAGE team will promptly resolve issues in their area of responsibility identified during the project.

m. CBP network team will collaborate with contractor team to identify and allow ports and protocols to required for the operation of the solution.

n. CBP team is responsible for backing up /restoring all servers in operation for this project.

Video Source Assumptions

a. The video feeds originate from a reliable microwave feed to a data repository or server.

b. A definitive set of the required AI/ML models, related items of interest to train, will be provided by CBP.

c. A Maximo Visual Inspection (MVI) environment, along with the hardware, software and storage is available to create, update AI/ML models required for in this engagement. The

MVI environment is available 90% of the time.

d. Within 60 days from the start of the project, real life video from the southern border is available to train and create AI/ML models to be used by the Equitus Video Sentinel (EVS).

Hardware Assumptions

a. To minimize time to production and maximizing ROI, some on-premise servers in the

C2CENs can be utilized for implementation. CBP and contractor will agree to the designated servers utilized for this project during the Discovery Workshop Phase, prior to prototype development and implementation.

b. The project schedule depends on having the selected servers connected and accessible to

CBP network. Delays in completing this causes delays in the implementation schedule.

c. Selected servers will have the necessary computing resources needed to install the Aspera and Video AI Model software.

d. Operating system scans and remediation is a responsibility of the project team.

e. contractor expects all resources required to fullfil the services such as the hardware, storage, network, infrastructure, software etc provided by CBP.

f. All hardware, storage, rack, software, including OS, and other peripherals required to deploy contractor Aspera software will be provided by CBP. CBP will stand up and configure these servers with OS and storage.

g. The Production and Non Production environments for the Equitus Video Sentinel will be deployed on P10 servers and CBP MAGE.

h. Contractor will have access to one copy of Milestone software license for development purposes provided by CBP.

i. CBP will make available a non production video management system, such as Milestone

Video Management System for Equitus Video Sentinel to integrate in the non production environment.

Environment Assumptions

a. Designated CBP locations hosting server hardware have sufficient space, power, networking, cooling, and other infrastructure. to host the solution and other Video

Management Components.

b. All instantiations of the Aspera, Equitus Video Sentinel and video management software will be hosted using the same standard system specifications (OS, Disks, CPU Type, Memory, etc) across all hosting sites (operations sites) for system portability across locations.

c. CBP approved cloud hosting will be provided with the capability to provision the required virtual machines for hosting the Aspera receiver and video management.

d. All issues related to the CBP environment including but not limited to, MAGE, CBP Network, firewall etc will be resolved to avoid delays to the project.

e. All other infrastructure, including, Milestone VMS, video feed from the cameras etc. that this solution interfaces will be accessible from the CBP network where this solution will be deployed.

f. Single sign-on/PIV Card sign-on or integration with CBP enterprise directory will not be implemented in this offering.

PERIOD OF PERFORMANCE

The Period of Performance is one year after date of award.

SECURITY

This work will be UNCLASSIFIED to include any background investigation requirements. The Contractor shall comply with the CBP administrative, physical and technical security controls to ensure that the Government’s security requirements are met. The Contractor shall not use, disclose, or reproduce data other than as required in the performance of orders placed against this Task Order. All Contractor employees shall be required to wear CBP identification badges at all times when working in Government facilities.

Notwithstanding any other clause concerning data, all data produced, recorded, transferred, or manipulated under this SOW shall remain the exclusive property of the Government. The Government shall retain exclusive right and domain over any by-product, document, or data produced under this SOW, or any other use of the data produced under this SOW. These documents and data shall be confidential and shall not be disclosed to any third party without prior written permission of CBP.

8.1 CONTRACTOR PRE-SCREENING

1. Contractors requiring recurring access to Government facilities or access to sensitive but unclassified information and/or logical access to Information Technology (IT) resources shall verify minimal fitness requirements for all persons/candidates designated for employment under any Department of Security (DHS) contract by pre-screening the person /candidate prior to submitting the name for consideration to work on the contract. Pre-screening the candidate ensures that minimum fitness requirement are considered and mitigates the burden of DHS having to conduct background investigations on objectionable candidates. The Contractor shall submit only those candidates that have not had a felony conviction within the past 36 months, illegal drug use within the past 12 months from the date of submission of their name as a candidate to perform work under this contract. Contractors are required to flow this requirement down to subcontractors. Pre-screening involves contractors and subcontractors reviewing:

a. Felony convictions within the past 36 months. An acceptable means of obtaining information on felony convictions is from public records, free of charge, or from the National Crime Information Center (NCIC).

b. Illegal drug use within the past 12 months. An acceptable means of obtaining information related to drug use is through employee self certification, by public records check; or if the contractor or subcontractor already has drug testing in place. There is no requirement for contractors and/or subcontractors to initiate a drug testing program if they do not have one already in place.

c. Misconduct such as criminal activity on the job relating to fraud or theft within the past 12 months. An acceptable means of obtaining information related to misconduct is through employee self certification, by public records check, or other reference checks conducted in the normal course of business.

2. Pre-screening shall be conducted within 15 business days after contract award. This requirement shall be placed in all subcontracts if the subcontractor requires routine physical access, access to sensitive but unclassified information, and/or logical access to IT resources. Failure to comply with the pre-screening requirement will result in the Contracting Officer taking the appropriate remedy.

3. Definition: Logical Access means providing an authorized user the ability to access one or more computer system resources such as a workstation, network, application, or database through automated tools. A logical access control system (LACS) requires validation of an individual identity through some mechanism such as a personal identification number (PIN), card, username and password, biometric, or other token. The system has the capability to assign different access privileges to different persons depending on their roles and responsibilities in an organization.

8.2 Handling Personally Identifiable Information (PII)

The contractor is responsible for complying with the Privacy Act, CBP, and DHS privacy policies and procedures when handling PII. This includes reporting loss, theft, or unauthorized access to sensitive PII within one hour of discovery and reviewing contractor applicable policies at least annually. When a Contractor, on behalf of CBP, handles Sensitive PII data, stores and transmits, the Contractors shall Accredit (ATO) their information system to the (HHM) FIPS level.

8.3 Background Investigation (BI)

A background investigation (BI) is required for performance under this effort. Contractor employees shall not begin working until the BI is approved by CBP, Security Programs Division. Exceptions to this requirement will be handled on a case-by-case basis, and access to facilities, systems, data, etc. will be limited until the individual is cleared. All personnel employed by the Contractor for performance under this Task Order shall currently possess a favorable background investigation.

Executive Order 13467 allows for the acceptance of “suitability reciprocity” to contract personnel who are component employees within DHS.

Information must be correct and reviewed by the designated CBP Security Official for completeness. Normally, information requests for a background investigation consists of SF-85P, “Questionnaire for Public Trust Positions” or SF-86, “Questionnaire for Sensitive Positions (For National Security)” TDF 67-32.4 “U.S. USCS Authorization for Release of Information”, FD-258, “Fingerprint Charts” and a Financial Statement. Failure of any contract personnel to successfully pass a background investigation shall be cause for the candidate’s immediate dismissal from the project and replacement by a similar and equally qualified candidate as determined and approved by the CO/COR. This policy also applies to any personnel hired as replacements during the term on the task order.

Currently, completion of background investigations is taking approximately six (6) months from initial acceptance of the package.

The Contractor shall notify the COR and CBP OIT Workforce Management Group (WMG), BI Coordinator of any changes in access requirements for its personnel no later than one day after any personnel changes occur. This includes name changes, resignations, terminations, and reassignments including those to another contract. The Contractor/Project Manager is responsible for the completion and timely submission to the COR of the CF-242 for all departing task order personnel.

In accordance with Customs Directive No. 51715-006, “Separation procedures for Contractor Employees (CF-242)”, the Contractor is responsible for ensuring that contract employees separating from the agency complete the relevant portions of the CF-242. This requirement covers all Contract employees who depart while the contract is still active (including resignations, terminations, etc.) or upon final completion of contract. Failure of a Contractor to properly comply with these requirements shall be documented and considered when completing Contractor Performance Reports.

8.4 Identification Badge

All Contractor employees shall be required to wear CBP Identification badges at all times when working in Government facilities.

8.5 Contractor Suitability

All Contractors’ shall have appropriately adjudicated suitability background investigations and shall be US citizens. If a non-US citizen has access to OIT assets, appropriate exceptions must be documented in accordance with DHS policy. Under normal conditions, only U.S. Citizens are allowed access to DHS systems and networks, however, at times there is a need to grant access to foreign nationals. Access for foreign nationals is normally a long-term commitment, and exceptions to appropriate policies are treated separately from standard exceptions and waivers. The approval chain for an exception to the U.S. Citizenship requirement flows through the Component Head, the Office of Security, and the Chief Information Officer.

SPECIAL CONSIDERATIONS

Inspection and Acceptance

The Government reserves the right to reject any deliverable based on defects with respect to completeness correctness, clarity, and consistencies. In the event of a rejection of any deliverable, the Contracting Officer (CO) will notify the contractor in writing within five (5) business days of the receipt of the deliverable of any deficiencies to be corrected. The contractor shall have five (5) business days to correct the deficiencies.

· Accuracy – all deliverables shall be accurate in presentation, content, and shall adhere to the guidelines set forth in this document. All documentation presented to the Government shall be complete, correct, clear, and consistent.

· Clarity – deliverables shall be clear and concise.

· Timeliness – deliverables shall be submitted on or before the due date specified in the Statement of Work or submitted in accordance with a later scheduled date that is mutually agreed upon by the Government and Contractor. A deliverable is considered timely if submitted on or before the date specified in the Statement of Work and if the Government provides any written notifications of deficiencies, the Contractor corrects the deficiencies within five (5) business days.

Delivery Order Administration

Invoice Instructions The Contractor shall submit one invoice for the hardware and software and a monthly invoice for professional services, containing the following:

The Contractor shall invoice CBP in accordance with the CBP invoicing clause, “Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP) (AUG 2022).”

Payment requests shall be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP). The IPP website address is: https://www.ipp.gov.

Completion of each site having properly installed and configured hardware and software and video feeds process at each site and transferred to GCP MAGE.

Prior to submitting the invoice in IPP, the Contractor shall submit a draft invoice to the COR for review. A courtesy e-mail notification upon invoice submission in IPP shall be sent by the Contractor to the following contacts:

Contracting Officer’s Representative (COR):

Jun Delarosa 7681 Boston Blvd.

Springfield, VA 20598 571-453-9291 Jun.Delarosa@cbp.dhs.gov

Project Manager:

Vaughn Gourdin 22001 Loudon County Pkwy Ashburn VA 20147 703-939-0784 vaughn.t.gourdin@cbp.dhs.gov

Changes to the Statement of Work

No changes to this SOW, or cost, shall be incurred without prior approval of the Contracting Officer (CO) and coordinated by the Contracting Officer’s Representative (COR). The CO is the only individual with the authority to amend this contract. Any changes or cost increases will not take effect unless the CO executes a written modification.

Only the CO has the authority to represent the Government in cases where the delivery order requires a change in the Terms and Conditions, delivery schedule, scope of work, and/or price of the products, and/or services under this delivery order.

Travel

Travel to support deployment, training, and upgrades (NTE Amount)

0. All Contractor travel required by the Government will be reimbursed to the contractor in accordance with the Federal Travel Regulations (FTR). Local travel will not be reimbursed. The contract will include a NTE travel amount that cannot be exceeded without contract modification. The contractor exceeds this travel ceiling at its own risk.

0. The contractor shall be responsible for obtaining COR approval in writing at least 10 days prior to travel for all reimbursable travel in advance of each travel event.

0. Requests must identify:

2. The name of the traveler(s)

2. Destination(s) including itinerary

2. Purpose of the travel

2. Estimated cost breakdown (airfare, lodging, per diem, rental car, etc.)

0. Monthly financial statement provided in Microsoft Excel format and searchable .pdf, as requested

Unique Standards

CBP Requirements

CBP Enterprise Architecture Compliance

The Offeror shall ensure that the design conforms to the Department of Homeland Security (DHS) and Customs and Border Protection (CBP) Enterprise Architecture (EA), the DHS and CBP Technical Reference Models (TRM), and all DHS and CBP policies and guidelines (such as the CBP Information Technology Enterprise Principles and the DHS Service Oriented Architecture - Technical Framework, as promulgated by the DHS and CBP Chief Information Officers (CIO), Chief Technology Officers (CTO) and Chief Architects (CA).

The Offeror shall conform to the Federal Enterprise Architecture (FEA) model and the DHS and CBP versions of the FEA model, as described in their respective EAs. All models will be submitted using Business Process Modeling Notation (BPMN 1.1 or BPMN 2.0 when available) and the CBP Architectural Modeling Standards. Universal Modeling Language (UML2) may be used for infrastructure only. Data semantics shall be in conformance with the National Information Exchange Model (NIEM). Development solutions will also ensure compliance with the current version of the DHS and CBP target architectures.

Where possible, the Offeror shall use DHS/CBP approved products, standards, services, and profiles, as reflected by the hardware, software, application, and infrastructure components of the DHS/CBP TRM/standards profile. If new hardware, software, or infrastructure components are required to develop, test, or implement the program, these products will be coordinated through the DHS and CBP formal Technology Insertion (TI) process (to include a trade study with no less than four alternatives, one of which reflecting the status quo and another reflecting multi-agency collaboration). The DHS/CBP TRM/standards profile will be updated as TIs are resolved.

All developed solutions shall be compliant with the Homeland Security (HLS) EA.

All IT hardware and software shall be compliant with the HLS EA.

Compliance with the HLS EA shall be derived from and aligned through the CBP EA.

Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval, and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

Development of data assets, information exchanges, and data standards will comply with the DHS Data Management Policy MD 103-01. All data-related artifacts will be developed and validated according to DHS Data Management Architectural Guidelines.

Applicability of Internet Protocol version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS EA (per OMB Memorandum M-05-22, August 2, 2005), regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant, as defined in the USGv6 Profile (NIST Special Publication 500-267) and the corresponding declarations of conformance, defined in the USGv6 Test Program.

Personal Identifiable Information (PII)

When a contractor, on behalf of CBP, handles Sensitive PII data, stores and transmits, the contractor will Accredit (ATO) this information system to the Handheld Module (HHM) FIPS level.

ISO Requirements

ISO Terms and Conditions for Sensitive but Unclassified Requests

DHS Security Policy Requirement

All hardware, software, and services provided under this delivery order must be compliant with DHS Information Security Systems Program 4300A Directive version 13.3, Feb 13, 2023.

Encryption Compliance Requirement

The following terms and conditions should be included in all acquisition documents.

1. FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

2. National Security Agency (NSA) Type 2 or Type 1 encryption.

3. Public Key Infrastructure (PKI) (please see DHS 4300A Policy Directive (Version 13.3, February 13, 2023) attachment U).

Security Review Requirement The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer (OCIO), the Office of the Inspector General (OIG), authorized Contracting Officer’s Representative (COR), and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer (CISO) to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

Supply Chain Risk Management Requirement Supply Chain risks result from adversarial exploitation of the organizations, people, activities, information, resources, or facilities that provide hardware, software, or services. These risks can result in a loss of confidentiality, integrity, or availability of information or information systems. A compromise to even minor system components can lead to adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

Supply Chain Risk Management The Contractors supplying the Government hardware and software shall provide the manufacture’s name, address, state and/or domain of registration, and the Unique Entity ID (UEI) number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state and/or domain of registration and UEI number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

1. How risks from the supply chain will be identified

2. What processes and security measures will be adopted to manage these risks to the system or system components

3. How the risks and associated security measures will be updated and monitored

The Supply Chain Risk Management Plan shall remain current through the life of the contract or period of performance. The Supply Chain Risk Management Plan shall be provided to the Contracting Officer Representative (COR) 30 days post award.

The Contractor acknowledges the Government's requirement to assess the Contractors Supply Chain Risk posture. The Contractor understands and agrees that the Government retains the right to cancel or terminate the contract, if the Government determines that continuing the contract presents an unacceptable risk to national security.

The Contractor shall disclose, and the Government will consider, relevant industry standards certifications, recognitions and awards, and acknowledgments.

The Contractor shall provide only new equipment unless otherwise expressly approved, in writing, by the CO. Contractors shall only provide Original Equipment Manufacturers (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts.

The Contractor shall be excused from using new OEM (i.e. “Grey Market”) components only with formal Government approval. Such components shall be procured from their original genuine source and have the components shipped only from manufacturers authorized shipment points.

For software products, the contractor shall provide all OEM software updates to correct defects for the life of the product (i.e. until the “end-of-life.”). Software updates and patches must be made available to the government for all products procured under this contract.

Contractors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill contract obligations with the Government.

All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lessor of the term of the contract, the period of performance, or one calendar year from the date the activity occurred.

These records must be readily available for inspection by any agent designated by the U.S. Government as having the authority to examine them.

This transit process shall minimize the number of times en route components undergo a change of custody and make use of tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government’s request, shall be able to provide shipping status at any time during transit.

The Contractor is fully liable for all damage, deterioration, or losses incurred during shipment and handling, unless the damage, deterioration, or loss is due to the Government. The Contractor shall provide a packing slip which shall accompany each container or package with the information identifying the contract number, the order number, a description of the hardware/software enclosed (manufacturer name, model number, serial number), and the customer Point of Contact (POC). The contractor shall send a shipping notification to the intended government recipient or Contracting Officer. This shipping notification shall be sent electronically and will state the contract number, the order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date, and identifying (tracking) number.

Cyber Supply Chain Risk Management

1. Definitions

0. Component: a unit defined by the supplier that connects to and functions as part of the product. For software products, a component is a unit of software defined by a supplier at the time the component is built, packaged, or delivered. For hardware, a component is one hardware unit designed to connect to and function as part of a larger product.

0. End-of-Life (EOL): means that an ICT product has reached the final stage of the product life cycle in which that version of the ICT product will no longer be supported nor manufactured (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

0. End-of-Support (EOS): means that an ICT product will no longer be supported (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

0. Information and Communications Technology (ICT): encompasses the capture, storage, retrieval, processing, display, representation, presentation, organization, management, security, transfer, and interchange of data and information; includes all categories of ubiquitous technology used for the gathering, storing, transmitting, retrieving, or processing of information (e.g., microelectronics, printed circuit boards, computing systems, software, signal processors, mobile telephony, satellite communications, and networks).

0. Product: part of the equipment (hardware, software and materials) for which usability is to be specified or evaluated.

1. Original Equipment Manufacturer (OEM) End-use Information and Communications Technology (ICT) Product

1. The contractor shall provide new equipment unless otherwise formally approved by the Government, in writing. The contractor shall provide only Original Manufacturer (OEM) end-use products to the Government. In the event that a shipped OEM product, or part or component of that product, fails, all replacements must be new (i.e., non-refurbished, not previously used) OEM.

1. The contractor may provide previously-used OEM products only with written Government approval. Such parts shall be procured from their original source and shipped only from the manufacturer’s authorized shipment points.

1. Accounting of Components in ICT Products

2. The contractor shall provide and maintain a list of components for each product used in performance of the contract, including through subcontracts or other arrangements. This list for each product shall provide the component manufacturer’s name, address, state, and/or domain of registration, and, where applicable, the Unique Entity Identifier (UEI) number, for all components comprising the ICT products.

2. The contractor shall notify the Government when a new contractor/subcontractor/service provider is introduced to the ICT provided on this contract, or when suppliers of components or products are changed. If a software component used in the performance of the contract is updated with a new build or release, the contractor must update the list provided in accordance with (i) above to reflect the new version of the software. This includes software builds to integrate an updated component or dependency.

2. For software products, the contractor shall provide all OEM software updates, and patches to correct defects, for the life of the product [i.e., until the “End of Life” (EoL) or “End of Support” (EoS)]. Software updates and patches shall be made available to the government for all products procured under this Contract, and replaced when End of Support (EoS) is reached.

2. A contractor using team members in performance of the contract (e.g., subcontractors or other service providers) shall ensure that the standards for the accounting of components in this subsection are met by team members.

1. Supply-Chain Transport

3. The contractor shall use formal, documented and accountable transit, storage, and delivery procedures (i.e., the possession of the end-use product to be delivered is documented at all times from initial shipping point to final destination, and every transfer of the product from one custodian to another is fully documented and accountable) for all information and communication technology (ICT) shipments to fulfill this contract.

3. The contractor shall maintain all records pertaining to the transit, storage, and delivery of ICT deliverables under this contract through at least 6 months after acceptance, and make available for inspection upon request of the Government.

3. The contractor shall make use of tamper-proof or tamper-evident packaging for all shipments.

3. The contractor shall provide a packing slip for each container or package with the information identifying the contract or order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact.

3. The contractor shall provide a shipping notification to the intended government recipient; with a copy transmitted to the Contracting Officer, or other designated representative. This shipping notification shall be provided electronically and identify the contract or order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

1. Changes to Ownership and Control The Contractor shall immediately notify the Contracting Officer and Contracting Officer’s Representative regarding any significant changes to corporate ownership or control from contract award through final delivery or the end of the period of performance. A significant change would be one in which a change occurs in the individuals or entities who, directly or indirectly, either (1) exercises substantial control over an entity, or (2) owns or controls at least 25 percent of the ownership interests of an entity.

Personal Identification Verification (PIV) Credential Compliance Requirement Procurements for products, systems, services, hardware, or software involving controlled facility or information system shall be PIV-enabled by accepting HSPD-12 PIV credentials as a method of identity verification and authentication.

Procurements for software products or software developments shall be compliant by PIV by accepting PIV credentials as the common means of authentication for access for federal employees and contractors.

PIV-enabled information systems must demonstrate that they can correctly work with PIV credentials by responding to the cryptographic challenge in the authentication protocol before granting access.

If a system is identified to be non-compliant with HSPD-12 for PIV credential enablement, a remediation plan for achieving HSPD-12 compliance shall be required for review, evaluation, and approval by the CISO.

OAST / Section 508 Requirement

Section 508 Requirements Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

Section 508 Requirements for Technology Products

Section 508 applicability to Information and Communications Technology (ICT): Network Equipment Applicable Exception: N/A Authorization #: N/A Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components: Does not apply.

Applicable 508 requirements for software features and components Does not apply.

Applicable 508 requirements for hardware features and components (including but not limited to Servers; Other): All requirements in Chapter 4 apply.

Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply.

Section 508 Requirements for Technology Services

1. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item's level of Section 508 conformance prior to the services being performed.

2. When providing maintenance upgrades, substitutions, and replacements to ICT, the contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed upgrades, substitutions and replacements prior to acceptance. The ACR should be created using the on the Voluntary Product Accessibility Template Version 2.2 508 (or successor versions). The template can be located at https://www.itic.org/policy/accessibility/vpat

3. When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

Section 508 Deliverables

1. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards.