PWS - On-Site COVID 19 Screening Testing Final.pdf

FEDERAL EMERGENCY MANAGEMENT AGENCY (FEMA) 1

PERFORMANCE WORK STATEMENT 3

COVID 19 Rapid Field Testing 5

BACKGROUND: Enabling a rapid response health and welfare capability for federal staff 8 during emergency events is a mission-critical requirement. The Federal Emergency Management 9 Agency (FEMA) leads the nation in preventing, preparing for, responding to, and recovering 10 from the adverse effects emergencies and disasters create, by supporting our communities' 11 ability to withstand adversity, strengthening our resilience and response systems, and enhancing 12 readiness. FEMA provides resources to their federal partners to enable effective response to 13 emergencies and catastrophic events, which overwhelm the capacity of state and local 14 emergency systems. 15 SCOPE OF WORK/SPECIFICATIONS: FEMA intends to acquire commercial services to 17 provide equipment and personnel to conduct rapid antigen COVID-19 Testing of Federal 18 Responders, their partners, and any other individual designated to receive these tests by the 19 government. Testing must be conducted within a 50-mile radius of 3005 Chamblee Tucker 20 Road, Atlanta, GA. 30341 and must provide multiple locations, not to exceed the 50-mile radius. 21 Tests must be conducted within a 24-hour notice. Requesting the Vendor to provide to the 22 government the number of locations available to include the physical addresses of each location. 23 This requirement is inclusive of the United States and its outlying areas, as defined in FAR 25

2.101 to be determined based on damaged area and availability. While certain tests and 26 capabilities are described below, the government reserves the right to introduce new 27 technologies and testing capabilities for the vendor to administer, as they come online. The 28 government expects that the contractor shall keep up to date on new and emerging testing 29 capabilities and be prepared to utilize them if required by the government. 30 The contractor shall provide all the resources necessary to carry out these requirements, such as 32 (but not limited to) personnel, administration, PPE, diagnostic testing, vital sign measurement, 33 and biomedical waste collection. The contractor shall provide near real time results in 15 to 45 34 minutes and convey those results to the individuals being tested in a manner that ensures privacy 35 standards are maintained (hard copy preferred). The contractor must have a CLIA waiver in 36 order to perform the requested lab tests. The contractor shall process a volume of 150-200 37 personnel at a minimum per day for screening. 38 The contractor shall provide this capability based on State and local Public Health requirements. 40 The government reserves the right to expand the requirement to include concurrent operations at 41 multiple facilities. The contractor shall provide confirmatory reverse transcriptase-polymerase 42 chain reaction (RT- PCR) testing where positives are identified from the initial screening and/or 43 where false positives are suspected (e.g., antigen or isothermal amplification testing). 44 The contractor shall provide adequate environmental controls (e.g. HVAC and humidity control) 46 for all required equipment, storage, and use. The contractor shall be responsible for the disposal 47 of any biomedical waste generated during the testing process, as per local, state, and federal 48 regulations. 49 The contractor shall provide the government with a detailed narrative that outlines specifically 51 how they intend to meet the requirements listed in this PWS, the sequence of instituting said 52 requirements, and a timeline acceptable to the government of when each of these capabilities 53 will be fully activated. The contractor shall abide by all local, state, and federal safety protocols, 54 legal requirements, and information security requirements. The contractor shall provide in the 55 PWS specific actions they will take to ensure privacy, protected personally identifiable 56 information (PII) pursuant to the Privacy Act of 1974, and protected health information (PHI), as 57 appropriate per the Health Insurance Portability and Accountability Act (HIPAA), as applicable. 58 The contractor shall provide COVID-19 diagnostic testing and associated services as a managed 60 service, to include on-site screening, testing, and results tracking, on a routine basis at DHS 61 designated locations. The contractor shall provide managed services with FDA approved or FDA 62 EUA test kits or using government furnished test kits. Specific requirements will be stated at the 63 order level. 64 Services shall include: 66

• Provisioning of all personnel, equipment, supplies, facilities, tools, materials, supervision and 68 other items and services necessary to conduct testing and provide results. This includes a 69 requirement to provide Personal Protective Equipment (PPE) for medical personnel 70 administering tests, in accordance with Centers for Disease Control and Prevention (CDC) 71 and Occupational Safety and Health Administration (OSHA) guidelines for “Preferred PPE.” 72

• FDA approved or emergency authorized use COVID-19 antigen test that detects for the 73 presence of the SARS-CoV-2 virus with an accuracy rate aligned to best technology and 74 current industry practice 75

• A HIPAA and Privacy Act compliant, secure portal for information collection and 76 notification of results. Scripts of engagement between the vendor and responder must be 77 provided in advance to ensure meeting FEMA privacy requirements 78

• Access to licensed physician(s) who can answer any questions by test takers about the test 79 results and help determine next steps in care 80

• A capability to provide a phone call notification when the virus is detected, with prompt 81 access to a licensed health professional 82

• An anonymized aggregate report with the total number of participants tested and the total 83 number of participants who tested positive for the virus versus negative for the virus 84

• Any other pertinent reports required by the government as directed by the Contracting 85 Officer (CO) or Contracting Officer’s Representative (COR) 86

• The capability to provide Individual results report in electronic fashion, downloadable by the 87 identified employee 88

• Access to individual results and reports with customizable access restriction to ensure 89 compliance with privacy and information security requirements 90

• The ability to enable contact tracing, meeting CDC guidance and state and local reporting 91 requirements 92

ADDITIONAL REQUIREMENTS: COVID-19 diagnostic testing acquired through this 93 vehicle must be carried out in compliance with 5 C.F.R Part 339, the Rehabilitation Act, 29 94 U.S.C. § 701 et seq., and Americans with Disabilities Act (ADA), 42 U.S.C. §§ 12102 et seq. 95 Components may only carry out such testing after a determination has been made that their 96 planned testing program complies with the Fourth Amendment, Rehabilitation Act, the ADA, 5 97 C.F.R. Part 339, and any other applicable law. In carrying out COVID-19 diagnostic testing 98 Components must ensure compliance with its collective bargaining requirements. 99 Any information collected and disclosed pursuant to COVID-19 diagnostic testing acquired 101 through this IDIQ must be collected and disclosed in compliance with, as applicable, the Privacy 102 Act of 1974, as amended, 5 U.S.C. § 552a, the CARES Act, HIPAA (when otherwise applicable) 103 and any other applicable law. 104 Privacy Act compliance requires that information collected and disclosed pursuant to COVID-19 106 diagnostic testing acquired through this IDIQ be covered by an applicable system or records 107 notice (SORN) prior to such collection and disclosure. Components shall coordinate with their 108 Component Privacy Office and legal counsel in planning testing in order to ensure that a SORN 109 governs the population to be tested and the information to be collected and disclosed. 110

DELIVERABLES: 112

• As described in Scope/Specifications sections above 113

• Itemized Invoice every thirty (30) days during the period of performance 114

PERIOD OF PERFORMANCE: Three Months from date of award, with one three-month 116 Option period. The implementation date should be as soon as practicable. 117

GOVERNMENT FURNISHED PROPERTY: In some cases, the Government will provide 118 testing kits and if needed the proper medical machinery to diagnose tests. 119 CONTRACTOR FURNISHED PROPERTY: All the required materials to support the 121 implementation of the PWS. 122

REPORTING REQUIREMENTS: The contractor shall report on all activities supported as 124 directed by the COR and provide an itemized Invoice every thirty (30) days during the period of 125 performance. 126

SECURITY AND SECURITY TRAINING: All personnel require access to information up to 127 the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure 128 contractor employees receive a favorably adjudicated public trust suitability prior to entry on 129 duty (EOD). All individuals will be U.S. citizens. The contractor shall follow the standards 130 established within DHS and FEMA policy. 131

Security Training. Certificate of training is required for all cleared contractor employees who are 132 working with classified or unclassified information. All certificates must be sent to the assigned 133

FEMA Contracting Officer Representative (COR), before the contractor or subcontractor is 134 granted access to classified or unclassified information but no later than 30 calendar days after 135 awarded contract. Send certificates of completion for Unauthorized Disclosure, OPSEC, and 136 Insider Threat to the FEMA COR no later than 30 calendar days after awarded contract. New 137 employees entering the contract must receive the briefing within ten (10) business days of 138 joining the contract. 139

Unauthorized Disclosure of Classified or Unclassified Information. Contractors and 140 subcontractors who are working on this contract shall receive Unauthorized Disclosure of 141 Classified or Unclassified Information training. Access to the training can be obtained at 142 https://securityawareness.usalearning.gov/disclosure/index.html 143

OPSEC Training. Contractors and subcontractors who are working on this contract shall receive 144 the OPSEC Awareness Brief. Access to the briefing can be obtained at 145 https://securityawareness.usalearning.gov/opsec/ 146

Insider Threat Training. Insider Threat training for contractors can be found at: 147 https://securityawareness.usalearning.gov/itawareness/index.htm# 148

For Official Use Only (FOUO) Information. In accordance with DHS Management Directive 149

11042.1 contractors, consultants and others to whom access is granted will abide by 11042.1; 150 DHS policy regarding the identification and safeguarding of sensitive but unclassified 151 information originated within DHS. It also applies to other sensitive but unclassified information 152 received by DHS from other government and non-governmental activities. 153

The contractor shall: 154

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only” 155 (FOUO) information as outlined in this directive. 156

2. Participate in formal classroom or computer-based training sessions presented to 157 communicate the requirements for safeguarding FOUO and other sensitive but unclassified 158 information. 159

3. Be aware that divulging information without proper authority could result in 160 administrative or disciplinary action. 161

Contractors and consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified 162 Information Non¬ Disclosure Agreement (NDA), as a condition of access to such information. 163 Other individuals not assigned to or contractually obligated to DHS, but to whom access to 164 information will be granted, may be requested to execute an NDA as determined by the 165 applicable program manager. Execution of the NDA shall be effective upon date of the DHS 166 Policy and not applied retroactively. 167

INFORMATION SHARING: 168

The FEMA contractor shall only collect or maintain information from and about FEMA employees 169 only. To accomplish the tasks outlined in this contract, FEMA may only share with or allow access 170 to by the contractor the following PII data elements: 171 Identification number/Account number 173 Name 174 Date of birth (DOB) 175 Gender 176 Mailing address 177 Email address 178 Occupation (Optional) 179 Testing Kits 180 Testing Results 181

The information sharing outlined in this contract is authorized by the following System of 183 Records Notice(s) and Routine Use(s): DHS/ALL-047 Records Related to DHS Personnel, 184 Long-Term Trainees, Contractors, and Visitors During a Declared Public Health Emergency 185 System of Records, Routine use G. 186

The contractor shall limit access to the PII provided by FEMA under this contract only to the 187 contractor’s authorized personnel who need to know the information to accomplish the tasks 188 outlined in this contract. 189

The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), 190 will occur for the purpose of establishing or verifying eligibility or compliance as it relates to 191 cash or in-kind assistance or payments under federal benefit programs. 192

If at any time during the term of this contract any part of FEMA PII, in any form, that the 193 contractor obtains from FEMA ceases to be required by the contractor for the performance of the 194 contract, or upon termination of the contract, whichever occurs first, the contractor shall, within 195 fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at 196 FEMA’s written request destroy, un-install and/or remove all copies of such PII in the 197 contractor’s possession or control, and certify in writing to FEMA that such tasks have been 198 completed. 199

SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015) 201

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor 203 employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert 204 the substance of this clause in all subcontracts. 205

(b) Definitions. As used in this clause— 207

“Personally Identifiable Information (PII)” means information that can be used to distinguish 209 or trace an individual's identity, such as name, social security number, or biometric records, 210 either alone, or when combined with other personal or identifying information that is linked or 211 linkable to a specific individual, such as date and place of birth, or mother’s maiden name. 212 The definition of PII is not anchored to any single category of information or technology. 213 Rather, it requires a case-by-case assessment of the specific risk that an individual can be 214 identified. In performing this assessment, it is important for an agency to recognize that non-215 personally identifiable information can become personally identifiable information whenever 216 additional information is made publicly available—in any medium and from any source—217 that, combined with other available information, could be used to identify an individual. 218

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, 220 date of birth, mailing address, telephone number, Social Security number (SSN), email 221 address, zip code, account numbers, certificate/license numbers, vehicle identifiers including 222 license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric 223 identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other 224 unique identifying number or characteristic, and any information where it is reasonably 225 foreseeable that the information will be linked with other information to identify the 226 individual. 227

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee 229 Access, as any information, which if lost, misused, disclosed, or, without authorization is 230 accessed, or modified, could adversely affect the national or homeland security interest, the 231 conduct of Federal programs, or the privacy to which individuals are entitled under section 232 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically 233 authorized under criteria established by an Executive Order or an Act of Congress to be kept 234 secret in the interest of national defense, homeland security or foreign policy. This definition 235 includes the following categories of information: 236

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure 238 Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 239 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of 240 Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as 241 amended, and any supplementary guidance officially communicated by an authorized official 242 of the Department of Homeland Security (including the PCII Program Manager or his/her 243 designee); 244

Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, 246 Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as 247 amended, and any supplementary guidance officially communicated by an authorized 248 official of the Department of Homeland Security (including the Assistant Secretary for the 249 Transportation Security Administration or his/her designee); 250

(2) Information designated as “For Official Use Only,” which is unclassified information of a 252 sensitive nature and the unauthorized disclosure of which could adversely impact a person’s 253 privacy or welfare, the conduct of Federal programs, or other programs or operations essential 254 to the national or homeland security interest; and 255

(3) Any information that is designated “sensitive” or subject to other controls, safeguards 257 or protections in accordance with subsequently adopted homeland security information 258 handling procedures. 259 “Sensitive Information Incident” is an incident that includes the known, potential, or 261 suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized 262 acquisition, or unauthorized access or attempted access of any Government system, 263 Contractor system, or sensitive information. 264 “Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, 265 compromised or disclosed without authorization, could result in substantial harm, 266 embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive 267 as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), 268 driver’s license or state identification number, Alien Registration Numbers (A-number), 269 financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. 270 Additional examples include any groupings of information that contain an individual’s name 271 or other unique identifier plus one or more of the following elements: 272

(1) Truncated SSN (such as last 4 digits) 274

(2) Date of birth (month, day, and year) 275

(3) Citizenship or immigration status 276

(4) Ethnic or religious affiliation 277

(5) Sexual orientation 278

(6) Criminal History 279

(7) Medical Information 280

(8) System authentication information such as mother’s maiden name, account passwords 281 or personal identification numbers (PIN) 282

Other PII may be “sensitive” depending on its context, such as a list of employees and their 284 performance ratings or an unlisted home address or phone number. In contrast, a business 285 card or public telephone directory of agency employees contains PII but is not sensitive. 286

(c) Authorities. The Contractor shall follow all current versions of Government policies and 288 guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-289 contractors, or available upon request from the Contracting Officer, including but not 290 http://www.dhs.gov/dhs-security-and-training-requirements-contractors limited to: 291

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for 293 Official Use Only) Information 294

(2) DHS Sensitive Systems Policy Directive 4300A 295

(3) DHS 4300A Sensitive Systems Handbook and Attachments 296

(4) DHS Security Authorization Process Guide 297

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information 298

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security 299 Personnel Suitability and Security Program 300

(7) DHS Information Security Performance Plan (current fiscal year) 301

(8) DHS Privacy Incident Handling Guidance 302

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for 303 Cryptographic Modules accessible at 304 http://csrc.nist.gov/groups/STM/cmvp/standards.html 305

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 306 Security and Privacy Controls for Federal Information Systems and Organizations accessible 307 at http://csrc.nist.gov/publications/PubsSPs.html 308

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible 309 at http://csrc.nist.gov/publications/PubsSPs.html 310

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as 312 the policies and procedures described below, is required. 313

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel 315 security requirements are set forth in various Management Directives (MDs), Directives, and 316 Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) 317 Information describes how Contractors must handle sensitive but unclassified information. 318 DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified 319 information that is not otherwise categorized by statute or regulation. Examples of sensitive 320 information that are categorized by statute or regulation are PCII, SSI, etc. The DHS 321 Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook 322 provide the policies and procedures on security for Information Technology (IT) resources. 323 The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides 324 guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction 325 Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security 326 Program establishes procedures, program responsibilities, minimum standards, and reporting 327 protocols for the DHS Personnel Suitability and Security Program. 328

(2) The Contractor shall not use or redistribute any sensitive information processed, 330 stored, and/or transmitted by the Contractor except as specified in the contract. 331

(3) All Contractor employees with access to sensitive information shall execute DHS Form 333 http://csrc.nist.gov/groups/STM/cmvp/standards.html http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html

11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition 334 of access to such information. The Contractor shall maintain signed copies of the NDA for 335 all employees as a record of compliance. The Contractor shall provide copies of the signed 336 NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after 337 execution of the form. 338

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to 340 support financial or other administrative functions shall not maintain SPII. It is acceptable 341 to maintain in these systems the names, titles and contact information for the COR or other 342 Government personnel associated with the administration of the contract, as needed. 343

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or 345 transmit sensitive information within a Contractor IT system without an Authority to 346 Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation 347 with the Headquarters or Component Privacy Officer. Unless otherwise specified in the 348 ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current 349 Government policies, procedures, and guidance for the Security Authorization (SA) process 350 as defined below. 351

(1) Complete the Security Authorization process. The SA process shall proceed according to 353 the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any 354 successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), 355 or any successor publication, and the Security Authorization Process Guide including 356 templates. 357

(i) Security Authorization Process Documentation. SA documentation shall be 359 developed using the Government provided Requirements Traceability Matrix and 360 Government security documentation templates. SA documentation consists of the 361 following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration 362 Management Plan, Security Assessment Plan, Security Assessment Report, and 363 Authorization to Operate Letter. Additional documents that may be required include a 364 Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the 365 development of SA documentation, the Contractor shall submit a signed SA package, 366 validated by an independent third party, to the COR for acceptance by the Headquarters or 367 Component CIO, or designee, at least thirty (30) days prior to the date of operation of the 368 IT system. The Government is the final authority on the compliance of the SA package 369 and may limit the number of resubmissions of a modified SA package. Once the ATO has 370 been accepted by the Headquarters or Component CIO, or designee, the Contracting 371 Officer shall incorporate the ATO into the contract as a compliance document. The 372 Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to 373 ensure the IT system controls are implemented and operating effectively. 374

(ii) Independent Assessment. Contractors shall have an independent third party validate 376 the security and privacy controls in place for the system(s). The independent third party 377 shall review and analyze the SA package, and report on technical, operational, and 378 management level deficiencies as outlined in NIST Special Publication 800-53 Security 379 and Privacy Controls for Federal Information Systems and Organizations. The 380 Contractor shall address all deficiencies before submitting the SA package to the 381 Government for acceptance. 382

Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of 384 the SA process, the Contractor may be required to support the Government in the 385 completion of the PTA. The requirement to complete a PTA is triggered by the creation, 386 use, modification, upgrade, or disposition of a Contractor IT system that will store, 387 maintain and use PII, and must be renewed at least every three (3) years. Upon review of 388 the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) 389 and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are 390 required. The Contractor shall provide all support necessary to assist the Department in 391 completing the PIA in a timely manner and shall ensure that project management plans 392 and schedules include time for the completion of the PTA, PIA, and SORN (to the extent 393 required) as milestones. Support in this context includes responding timely to requests for 394 information from the Government about the use, access, storage, and maintenance of PII 395 on the Contractor’s system, and providing timely review of relevant compliance 396 documents for factual accuracy. Information on the DHS privacy compliance process, 397 including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-398 compliance. 399

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be 401 renewed every three (3) years. The Contractor is required to update its SA package as part 402 of the ATO renewal process. The Contractor shall update its SA package by one of the 403 following methods: 404

(1) Updating the SA documentation in the DHS automated information assurance tool for 405 acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the 406 ATO expiration date for review and verification of security controls; or (2) Submitting an 407 updated SA package directly to the COR for approval by the Headquarters or Component 408 CIO, or designee, at least 90 days before the ATO expiration date for review and verification 409 of security controls. The 90 day review process is independent of the system production date 410 and therefore it is important that the Contractor build the review into project schedules. The 411 reviews may include onsite visits that involve physical or logical inspection of the Contractor 412 environment to ensure controls are in place. 413

(3) Security Review. The Government may elect to conduct random periodic reviews to ensure 415 that the security requirements contained in this contract are being implemented and enforced. 416 The Contractor shall afford DHS, the Office of the Inspector General, and other Government 417 organizations access to the Contractor’s facilities, installations, operations, documentation, 418 databases and personnel used in the performance of this contract. The Contractor shall, 419 http://www.dhs.gov/privacy-compliance http://www.dhs.gov/privacy-compliance through the Contracting Officer and COR, contact the Headquarters or Component CIO, or 420 designee, to coordinate and participate in review and inspection activity by Government 421 organizations external to the DHS. Access shall be provided, to the extent necessary as 422 determined by the Government, for the Government to carry out a program of inspection, 423 investigation, and audit to safeguard against threats and hazards to the integrity, availability 424 and confidentiality of Government data or the function of computer systems used in 425 performance of this contract and to preserve evidence of computer crime. 426

(4) Continuous Monitoring. All Contractor-operated systems that input, store, process, output, 428 and/or transmit sensitive information shall meet or exceed the continuous monitoring 429 requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, 430 or successor publication. The plan is updated on an annual basis. The Contractor shall also 431 store monthly continuous monitoring data at its location for a period not less than one year 432 from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 433 Security Requirements for Cryptographic Modules and shall not be stored on systems that are 434 shared with other commercial or Government entities. The Government may elect to perform 435 continuous monitoring and IT security scanning of Contractor systems from Government 436 tools and infrastructure. 437

(5) Revocation of ATO. In the event of a sensitive information incident, the Government 439 may suspend or revoke an existing ATO (either in part or in whole). If an ATO is 440 suspended or revoked in accordance with this provision, the Contracting Officer may direct 441 the Contractor to take additional security measures to secure sensitive information. These 442 measures may include restricting access to sensitive information on the Contractor IT 443 system under this 444 contract. Restricting access may include disconnecting the system processing, storing, or 445 transmitting the sensitive information from the Internet or other networks or applying 446 additional security controls. 447

(6) Federal Reporting Requirements. Contractors operating information systems on behalf of 449 the Government or operating systems containing sensitive information shall comply with 450 Federal reporting requirements. Annual and quarterly data collection will be coordinated by 451 the Government. Contractors shall provide the COR with requested information within three 452

(3) business days of receipt of the request. Reporting requirements are determined by the 453 Government and are defined in the Fiscal Year 2014 DHS Information Security Performance 454 Plan, or successor publication. The Contractor shall provide the Government with all 455 information to fully satisfy Federal reporting requirements for Contractor systems. 456

(f) Sensitive Information Incident Reporting Requirements. 458

(1) All known or suspected sensitive information incidents shall be reported to the 460 Headquarters or Component Security Operations Center (SOC) within one hour of discovery 461 in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting 462 requirements. When notifying the Headquarters or Component SOC, the Contractor shall also 463 notify the Contracting Officer, COR, Headquarters or Component Privacy Officer, and US-464 CERT using the contact information identified in the contract. If the incident is reported by 465 phone or the Contracting Officer’s email address is not immediately available, the Contractor 466 shall contact the Contracting Officer immediately after reporting the incident to the 467 Headquarters or Component SOC. The Contractor shall not include any sensitive information 468 in the subject or body of any e-mail. To transmit sensitive information, the Contractor shall 469 use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption 470 methods to protect sensitive information in attachments to email. Passwords shall not be 471 communicated in the same email as the attachment. A sensitive information incident shall not, 472 by itself, be interpreted as evidence that the Contractor has failed to provide adequate 473 information security safeguards for sensitive information, or has otherwise failed to meet the 474 requirements of the contract. 475

(2) If a sensitive information incident involves PII or SPII, in addition to the reporting 477 requirements in 4300A Sensitive Systems Handbook Incident Response and Reporting, 478 Contractors shall also provide as many of the following data elements that are available at 479 the time the incident is reported, with any remaining data elements provided within 24 480 hours of submission of the initial incident report: 481

(i) Data Universal Numbering System (DUNS); 483

(ii) Contract numbers affected unless all contracts by the company are affected; 484

(iii) Facility CAGE code if the location of the event is different than the prime 485 contractor location; 486

(iv) Point of contact (POC) if different than the POC recorded in the System for 487 Award Management (address, position, telephone, email); 488

(v) Contracting Officer POC (address, telephone, email); 489

(vi) Contract clearance level; 490

(vii) Name of subcontractor and CAGE code if this was an incident on a 491 subcontractor network; 492

(viii) Government programs, platforms or systems involved; 493

(ix) Location(s) of incident; 494

(x) Date and time the incident was discovered; 495

(xi) Server names where sensitive information resided at the time of the incident, both at 496 the Contractor and subcontractor level; 497

(xii) Description of the Government PII and/or SPII contained within the system; 498

(xiii) Number of people potentially affected, and the estimate or actual number of 499 records exposed and/or contained within the system; and 500

(xiv) Any additional information relevant to the incident. 501

(g) Sensitive Information Incident Response Requirements. 503

(1) All determinations related to sensitive information incidents, including response 505 activities, notifications to affected individuals and/or Federal agencies, and related services 506 (e.g., credit monitoring) will be made in writing by the Contracting Officer in consultation 507 with the Headquarters or Component CIO and Headquarters or Component Privacy 508 Officer. 509

(2) The Contractor shall provide full access and cooperation for all activities determined by 511 the Government to be required to ensure an effective incident response, including providing 512 all requested images, log files, and event information to facilitate rapid resolution of 513 sensitive information incidents. 514

(3) Incident response activities determined to be required by the Government may include, 516 but are not limited to, the following: 517

(i) Inspections, 519

(ii) Investigations, 520

(iii) Forensic reviews, and 521

(iv) Data analyses and processing. 522

(4) The Government, at its sole discretion, may obtain the assistance from other Federal 524 agencies and/or third-party firms to aid in incident response activities. 525

(h) Additional PII and/or SPII Notification Requirements. 527

(1) The Contractor shall have in place procedures and the capability to notify any individual 529 whose PII resided in the Contractor IT system at the time of the sensitive information 530 incident not later than 5 business days after being directed to notify individuals, unless 531 otherwise approved by the Contracting Officer. The method and content of any 532 notification by the Contractor shall be coordinated with, and subject to prior written 533 approval by the Contracting 534 Officer, in consultation with the Headquarters or Component Privacy Officer, utilizing the 535 DHS Privacy Incident Handling Guidance. The Contractor shall not proceed with 536 notification unless the Contracting Officer, in consultation with the Headquarters or 537 Component Privacy Officer, has determined in writing that notification is appropriate. 538

(2) Subject to Government analysis of the incident and the terms of its instructions to the 540 Contractor regarding any resulting notification, the notification method may consist of letters 541 to affected individuals sent by first class mail, electronic means, or general public notice, as 542 approved by the Government. Notification may require the Contractor’s use of address 543 verification and/or address location services. At a minimum, the notification shall include: 544

(i) A brief description of the incident; 546

(ii) A description of the types of PII and SPII involved; 547

(iii) A statement as to whether the PII or SPII was encrypted or protected by other means; 548

(iv) Steps individuals may take to protect themselves; 549

(v) What the Contractor and/or the Government are doing to investigate the incident, 550 to mitigate the incident, and to protect against any future incidents; and 551

(vi) Information identifying who individuals may contact for additional information. 552

(i) Credit Monitoring Requirements. In the event that a sensitive information incident 554 involves PII or SPII, the Contractor may be required to, as directed by the Contracting 555 Officer: 556

(1) Provide notification to affected individuals as described above; and/or 558

(2) Provide credit monitoring services to individuals whose data was under the control of the 560 Contractor or resided in the Contractor IT system at the time of the sensitive information 561 incident for a period beginning the date of the incident and extending not less than 18 months 562 from the date the individual is notified. Credit monitoring services shall be provided from a 563 company with which the Contractor has no affiliation. At a minimum, credit monitoring 564 services shall include: 565

(i) Triple credit bureau monitoring; 567

(ii) Daily customer service; 568

(iii) Alerts provided to the individual for changes and fraud; and 569

(iv) Assistance to the individual with enrollment in the services and the use of fraud 570 alerts; and/or 571

(3) Establish a dedicated call center. Call center services shall include: 573

(i) A dedicated telephone number to contact customer service within a fixed period; 575

(ii) Information necessary for registrants/enrollees to access credit reports and 576 credit scores; 577

(iii) Weekly reports on call center volume, issue escalation (i.e., those calls that cannot 578 be handled by call center staff and must be resolved by call center management or DHS, 579 as appropriate), and other key metrics; 580

(iv) Escalation of calls that cannot be handled by call center staff to call center 581 management or DHS, as appropriate; 582

(v) Customized FAQs, approved in writing by the Contracting Officer in coordination 583 with the Headquarters or Component Chief Privacy Officer; and 584

(vi) Information for registrants to contact customer service representatives and 585 fraud resolution representatives for credit monitoring assistance. 586

(j) Certification of Sanitization of Government and Government-Activity-Related Files and 588 Information. As part of contract closeout, the Contractor shall submit the certification to the 589 COR and the Contracting Officer following the template provided in NIST Special 590 Publication 800-88 Guidelines for Media Sanitization. 591

INFORMATION TECHNOLOGY SECURITY AND PRIVACY TRAINING (MAR 593

2015) 594 Applicability. This clause applies to the Contractor, its subcontractors, and Contractor 596 employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the 597 substance of this clause in all subcontracts. 598 Security Training Requirements. 600 All users of Federal information systems are required by Title 5, Code of Federal Regulations, 602 Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually 603 or whenever system security changes occur, or when the user’s responsibilities change. The 604 Department of Homeland Security (DHS) requires that Contractor employees take an annual 605 Information Technology Security Awareness Training course before accessing sensitive 606 information under the contract. Unless otherwise specified, the training shall be completed 607 within thirty (30) days of contract award and be completed on an annual basis thereafter not 608 later 609 than October 31st of each year. Any new Contractor employees assigned to the contract shall 610 complete the training before accessing sensitive information under the contract. The training is 611 accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. The 612 Contractor shall maintain copies of training certificates for all Contractor and subcontractor 613 employees as a record of compliance. Unless otherwise specified, initial training certificates for 614 each Contractor and subcontractor employee shall be provided to the Contracting Officer’s 615 Representative (COR) not later than thirty (30) days after contract award. Subsequent training 616 certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail 617 notification not later than October 31st of each year. The e-mail notification shall state the 618 required training has been completed for all Contractor and subcontractor employees. 619 The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that 621 will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall 622 be signed before accessing DHS systems and sensitive information. The DHS Rules of 623 Behavior is a document that informs users of their responsibilities when accessing DHS systems 624 and holds users accountable for actions taken while accessing DHS systems and using DHS 625 Information Technology resources capable of inputting, storing, processing, outputting, and/or 626 transmitting sensitive information. The DHS Rules of Behavior is accessible at 627 http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise 628 specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. 629 Any new Contractor employees assigned to the contract shall also sign the DHS Rules of 630 Behavior before accessing DHS systems and sensitive information. The Contractor shall 631 maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor 632 employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail 633 copies of the signed DHS Rules of Behavior to the COR not later than thirty (30) days after 634 contract award for each employee. The DHS Rules of Behavior will be reviewed annually, and 635 the COR will provide notification when a review is required. 636 Privacy Training Requirements. All Contractor and subcontractor employees that will have 638 access to Personally Identifiable Information (PII) and/or Sensitive PII (SPII) are required to 639 take Privacy at DHS: Protecting Personal Information before accessing PII and/or SPII. The 640 training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-641 contractors. 642 Training shall be completed within thirty (30) days of contract award and be completed on an 644 annual basis thereafter not later than October 31st of each year. Any new Contractor employees 645 assigned to the contract shall also complete the training before accessing PII and/or SPII. The 646 Contractor shall maintain copies of training certificates for all Contractor and subcontractor 647 employees as a record of compliance. Initial training certificates for each Contractor and 648 subcontractor employee shall be provided to the COR not later than thirty (30) days after 649 contract award. Subsequent training certificates to satisfy the annual training requirement shall 650 be submitted to the COR via e-mail notification not later than October 31st of each year. The e- 651 mail notification shall state the required training has been completed for all Contractor and 652 subcontractor employees. 653

Records Management Obligations: 655

A. Applicability 656

This clause applies to all Contractors whose employees create, work with, or otherwise handle 657 Federal records, as defined in Section B, regardless of the medium in which the record exists. 658

B. Definitions 659

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of 660 form or characteristics, made or received by a Federal agency under Federal law or in connection 661 with the transaction of public business and preserved or appropriate for preservation by that 662 agency or its legitimate successor as evidence of the organization, functions, policies, decisions, 663 procedures, operations, or other activities of the United States Government or because of the 664 informational value of data in them. 665

The term Federal record: 666

1. includes FEMA records. 667

2. does not include personal materials. 668

3. applies to records created, received, or maintained by Contractors pursuant to their 669

FEMA contract. 670

4. may include deliverables and documentation associated with deliverables. 671

C. Requirements 673

1. Contractor shall comply with all applicable records management laws and 674 regulations, as well as National Archives and Records Administration (NARA) 675 records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 676 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those 677 policies associated with the safeguarding of records covered by the Privacy Act of 678 1974 (5 U.S.C. 552a). These policies include the preservation of all records, 679 regardless of form or characteristics, mode of transmission, or state of completion. 680

2. In accordance with 36 CFR 1222.32, all data created for Government use and 681 delivered to, or falling under the legal control of, the Government are Federal records 682 subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of 683 Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 684 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as 685 permitted by statute or regulation. 686

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for 687 Government use or created in the course of performing the contract and/or delivered 688 to, or under the legal control of the Government and must be managed in accordance 689 with Federal law. Electronic records and associated metadata must be accompanied 690 by sufficient technical documentation to permit understanding and use of the records 691 and data. 692

4. FEMA and its contractors are responsible for preventing the alienation or 693 unauthorized destruction of records, including all forms of mutilation. Records may 694 not be removed from the legal custody of FEMA or destroyed except for in 695 accordance with the provisions of the agency records schedules and with the written 696 concurrence of the Head of the Contracting Activity. Willful and unlawful 697 destruction, damage or alienation of Federal records is subject to the fines and 698 penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental 699 removal, defacing, alteration, or destruction of records, Contractor must report to 700 FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230. 701

5. The Contractor shall immediately notify the appropriate Contracting Officer upon 702 discovery of any inadvertent or unauthorized disclosures of information, data, 703 documentary materials, records or equipment. Disclosure of non-public information is 704 limited to authorized personnel with a need-to-know as described in the SOW.