PWS Translation Services and Small Scale Event Logistics DRAFT.docx

Attachment 1 Performance Work Statement (PWS) Translation Services and Small-Scale Event Logistics

I. PURPOSE OF THE CONTRACT

The purpose of this contract is to provide the Office of Refugee Resettlement (ORR) Refugee Program (RP) with support to translate documents into common resettled refugee languages and to provide on-site interpretation event space rental for small-scale events with stakeholders or refugees in locations throughout the United States (U.S).

A listing of refugee populations by country of origin and number of arrivals by resettlement state/city can be accessed at the following link: Admissions & Arrivals — Refugee Processing Center (wrapsnet.org) The contractor is encouraged to review the common countries of origin to learn about what languages might be required for document translation and interpretation services.

II. BACKGROUND AND NEED

The Administration for Children and Families (ACF), Office of Refugee Resettlement (ORR) supports the resettlement and integration of refugees, asylees, Cuban and Haitian Entrants, certain humanitarian parolees, and foreign-born trafficking victims (hereafter “refugees”) once they arrive in U.S. communities. ORR provides funding to state governments and national and local non-profit agencies to provide integration support services for refugees for up to five years after their arrival in the U.S. ORR Refugee Program is committed to engaging with its client population throughout the U.S. to ensure that their diverse voices and needs are equitably represented in ORR’s decision-making about programs and services. To do this, ORR Refugee Program seeks a contractor to complete the tasks in this PWS.

III. GOALS AND OBJECTIVES

The goal of this contract is to support ORR/RP with three primary functions:

1. Translation of documents into common resettled refugee languages

2. On-site interpretation and event space rental for small-scale events in the U.S. Illustrative examples of small-scale ORR events include:

a. Listening sessions with resettled refugees, with interpretation (2 hours per session)

b. Emergency preparedness training in English for resettled refugees, led by ORR and Federal Emergency Management Agency (FEMA) (one full day)

ORR anticipates approximately 14 small-scale events (seven with no more than 50 people; seven with no more 100 people) per year. These events will not occur at the same time. Event cities will be identified by ORR at least 30 days in advance. ORR will direct the contractor to partner with a known organization within the refugee resettlement network to secure event space.

3. Provision of meeting space and minimal logistical support for ORR engagements with resettlement organizations (up to one full day; no more than 100 people in attendance). Up to two such events per year.

a. No refugee participants: no interpretation or translation required.

IV. GENERAL REQUIREMENTS

The Contractor shall furnish necessary personnel and other resources needed to support the implementation of this contract. Task Areas will include:

1) Project Management

2) Document Translation

3) Small-Scale Event Logistics

· Task 3A: Event Space

· Task 3B: In-Person Interpreters

· Task 3C: Travel for Interpreters

· Task 3D: Transportation Support for Event Participants

· Task 3E: Compensation for Refugee Community Leaders and Event Participants

4) Reporting

5) Full Performance/Transition Out

Given the small size and short duration of these events, marketing, participant outreach, and event signage is not required.

TASKS

Task 1: Project Management

The Contractor shall provide the technical and functional activities at the contract level needed for the project management of this PWS. The Contractor shall provide productivity and management methods such as quality assurance, risk management, work breakdown structure, and human engineering at the contract level. The Contractor shall provide administrative, clerical, documentation, training, reporting and related functions.

Subtask 1.1

Based on feedback received from ORR during the kickoff meeting, the Contractor shall prepare Implementation Plan describing the technical approach, organizational resources, and management controls to meet the cost, performance, and schedule requirements of this contract. The Implementation Plan shall propose timeframes for specific tasks to be performed, as described in Tasks 2 and 3 of this PWS. The Contractor shall submit the Draft Implementation plan within 7 business days after award, and the Final Implementation Plan within 7 business days after draft is approved. The Contractor will submit updates to the Implementation Plan as needed during the period of performance. The Implementation Plan shall account for reasonable flexibility in the number and size of events (small versus large), as directed by ORR.

Subtask 1.2

At the kickoff meeting, the Contractor shall meet with the COR and other ORR staff to obtain relevant background information, review the PWS and Implementation Plan, and identify any potential challenges. Meeting time and location (e.g., remote) will be determined by ORR and the Contractor immediately after award. The Contractor will present a written summary of the meeting within 10 calendar days.

Task 2: Document Translation

Subtask 2.1

The Contractor shall provide ORR with document translation services for common resettled refugee languages. The Contractor shall translate written materials to include facts sheets and other guides to support ORR’s provider network and clients. ORR estimates that a total of 100 documents will need to be translated each year in various languages. Most documents will be 5-10 pages in length and each language will count as one document.

Subtask 2.2

The Contractor shall ensure that all final, translated documents submitted to ORR are 508 compliant and translated in a manner that ensures understanding by the intended population.

Task 3: Small-Scale Event Logistics

Task 3A: Event Space For each event, the Contractor shall secure an event space that is accessible to the invitees (e.g., where certain refugee communities reside). ORR will direct the contractor to secure event space frequented by refugees, such as churches, mosques, refugee resettlement agencies, ethnic-based community centers, or known organizations within the resettlement ecosystem. The event space should accommodate 50 -100 people, depending on the event type as directed by ORR. For smaller events, like trainings for up to 50 people, the event space shall be rented for the whole day (8 hours). For larger events, like listening sessions of up to 100 people, the space shall be rented for half a day (4 hours). The event space should provide for a gathering space sufficient for the overall group as well as smaller, separate areas to accommodate smaller groups, like a child’s play area, a mothers’ nursing room, and religious observances, like prayer times. Event spaces should prioritize access to public transit and centralized locations where refugees reside.

Subtask 3A.1

The Contractor shall ensure that all furnishings (such as tables and chairs) and technology (such as audio/visual equipment) needed for events are included in the event space rental cost. The Contractor shall also provide child-friendly toys/games and prayer mats upon request during the planning phase and will ensure that the event space location/organization has appropriate liability insurance in place.

Task 3B: In-Person Interpretation

The Contractor shall provide interpreters for onsite events with refugees. The Contractor should plan for two interpreters for seven small events (up to 50 participants) and 10 interpreters for seven large events (up to 100 participants). Events will not occur at the same time.

Subtask 3B.1

The Contractor shall hire interpreters who are proficient in English and fluently speak, read, and write resettled refugee languages. Given the range of languages and event locations across the U.S., the Contractor is encouraged to hire contracted/temporary interpreters who reside in the same geographic area where the event is taking place. When this is not possible, the Contractor may travel interpreters to the event location per Task 3C.

Subtask 3B.2

The Contractor shall ensure that all staff complete background checks prior to employment. Interpreter staff will interact with refugee families, including young children.

Staff, interpreters, and volunteers who are physically present on site and/or will have access to PII must achieve a Homeland Security Presidential Directive (HSPD-12) Personal Identity Verification (PIV) Credential Tier 2 (Minimum Background Investigation—MBI) Moderate Risk Public Trust (this encompasses the FBI fingerprint check of national and state criminal history repositories) and Child Abuse and Neglect (CA/N) checks in the staff's state(s) of U.S. residence for the last 5 years. Please note, this requirement encompasses more people than UC Policy Guide Section 4.3.3, Field Guidance 22 and Field Guidance 23. The Contractor must follow the requirements established in the PWS. Comment by Harris, Keyshana (ACF): Add as attachments or links:

field-guidance-22_interpreters-at-ucp-sites_10.26.2021-v2.pdf (hhs.gov) fg-23-volunteers-with-uc-program.pdf (hhs.gov)

Background and CA/N checks will be conducted by the Contractor. ORR will ensure receipt of background checks for ICF staff. U.S. Department of Health and Human Services (HHS) will process HSPD-12 PIV background investigations for all Contractor staff and the ORR Contracting Officer’s Representative (COR) shall provide instructions for completing this process. All costs shall be borne by HHS; however, the Contractor will be responsible for maintaining and tracking all applicant submissions, coordinating with the HHS EQIP coordinator, and ensuring compliance with the PWS, ORR Policy and Field Guidance and HSPD-12 requirements. The Contractor must be able to provide a list of all the status of all background checks upon request from the COR. The Contractor must maintain a roster of active, demobilized, and terminated employees. This list must be made available to the COR upon request. Comment by Harris, Keyshana (ACF): ?

The Contractor must establish an on-site vetting team that is responsible for running the background check process for employees and for coordinating with ORR. The Contractor shall provide accommodations for employees to complete background check requirements. This must include lab space with an appropriate ratio of laptops/computers, printers and scanners, and onsite fingerprinting capabilities (both digital and paper). Applicants must complete the 306 and 86C documents and provide fingerprints as a part of their onboarding process within 14 days. Once those steps have been completed, the contract vetting team must notify ORR that the client record should be forwarded to Personnel Security Coordinator (PSC) to initiate an e-QIP. The e-QIP must be returned to PSC within 5 days of notification to submit. The Contractor will also be responsible for timely responses from all staff submissions of documents including fingerprints, completed forms, and participate in interviews with investigators, as applicable. Contractors must ensure the employees whose names they submit have a reasonable chance for access approval. In some cases, employees with existing background investigations commensurate with sensitivity designations will expedite performance.

This requirement applies to all personnel supporting ORR programs. The Contractor is responsible for the custody and control of all forms of HSPD-12 Credentials issued by HHS to Contractor employees. The Contractor must notify the Program Manager within 24 hours when a Contractor employee no longer requires agency access due to transfer, completion of a project, retirement, removal from work on the contract, or termination of employment. This change must be reflected in the staff roster the Contractor is required to maintain. The Contractor shall also ensure that Contractor employees comply with HHS requirements concerning the renewal, loss, theft, or damage of an ID card. Failure to comply with the requirements for custody and control of HHS issued ID cards may result in a delay in withholding final payment or contract termination, based on the potential for serious harm caused by inappropriate access to HHS facilities, sensitive information, information systems or other HHS resources.

Medical and mental health professionals (e.g., doctors, nurses, nurse practitioners, psychiatrists, licensed clinicians) who provide services on site but are not employed by the Contractor do not need to complete background investigations. Such professionals must, however, have up to date applicable state licensure requirements.

Staff, interpreters, and volunteers who have not completed their Tier 2 Background Check and CA/N checks must be supervised at all times of staff who have completed Tier 2 background and CA/N checks. The Contractor must have a line-of-sight supervision plan for staff that are not cleared to work with children unsupervised. The Contractor must track which staff have not completed the required background checks and have visibly identifiable means of indicating individuals who are not cleared to work with children unsupervised.

Subtask 3B.3

The Contractor shall be able to support interpretation services for refugees with communication disorders or special needs, including but not limited to, sign language. ORR will direct the Contractor when this support is needed, based on feedback received during the planning phase from partnering organizations. ORR estimates this need being minimal (up to three events per year).

Subtask 3B.4

The Contractor shall provide up to 100 simultaneous translation devices necessary to facilitate onsite interpretation. The Contractor can purchase a set of affordable devices from any retail platform. The cost of the devices shall not exceed the amount authorized on this contract.

Task 3C: Travel

The Contractor shall coordinate and fund travel for interpreters and other staff required for in-person events. Travel for the contractor shall be commensurate with the Federal Travel Regulations. The travel shall not exceed the amount authorized on the contract. The contractor shall be responsible for tracking approved travel costs.

Task 3D: Transportation Support for Event Participants

The Contractor shall provide monetary support for transportation to refugee event participants in the form of ride share coupons, transit passes, or gas cards, depending on the form of support recommended by ORR’s local resettlement partners. The Contractor shall ensure transportation support for all anticipated event participants, estimated to be 1,050 refugees for 14 events. Providing transportation access to refugee participants ensures that ORR is using best practices to equitably engage with its population.[footnoteRef:1] [1: Engaging People with Lived Experience to Improve Federal Research, Policy, and Practice | ASPE (hhs.gov);

What Does it Look Like to Equitably Engage People with Lived Experience? | ASPE (hhs.gov)]

Task 3E: Monetary Support for Refugee Community Leaders and Event Participants

The Contractor shall provide monetary support to ORR-designated refugee community leaders and event participants. In partnership with state or local resettlement staff, ORR will identify refugee community leaders to assist in the planning, and coordination of hospitality needs for the event to ensure it is conducted in a culturally appropriate manner. Refugee community leaders play a key role in helping identify event participants[footnoteRef:2] and provide their time and serve as an invaluable cultural liaison to the government, which is required to implement a successful community event. The Contractor shall provide refugee community leaders with adequate monetary support for their time assisting with a smaller community event (seven events; on average, one leader) and for assisting with a larger community event (seven events; on average, two leaders). [2: Strategies to Equitably Identify People with Lived Experience | ASPE (hhs.gov) (See PDF, Strategies for National and State Groups to Equitably Identify People with Lived Experience) ]

Event participants are defined as members of the refugee community who were intentionally recruited to participate in the event by ORR’s state or local partners. The Contractor shall provide individual event participants (1,050, total participants for the contract year) adequate monetary support to alleviate barriers that would prevent them from fully participating in the event and to acknowledge them for taking the time to share their lived experience with ORR.[footnoteRef:3] ( [3: What Does it Look Like to Equitably Engage People with Lived Experience? | ASPE (hhs.gov) (See embedded PDF titled, Equitable Engagements, page 3)]

Subtask 3E.1

The Contractor shall distribute monetary support to refugee community leaders in coordination with ORR during the planning phase of the event and shall distribute compensation to event participants in-person.

Task 4: Reporting

The Contractor will provide monthly and ad-hoc written reports on the status of the tasks completed under this PWS. The Contractor will also communicate with ORR weekly, through regular informal briefings (in writing), and other forms of communication. The Contractor shall meet monthly with the COR and ORR Program staff and provide a progress report. The Contractor shall report on the implementation plan goals, objectives and outcomes on a quarterly basis and adjust as necessary to meet the project specifications.

Task 5: Full Performance/Transition In/Out

The Contractor shall be fully staffed and prepared to begin full performance under the requirements of this PWS within 30 days upon award. Comment by Brooks, Aleshia (ACF): Is this realistic? What's the security/tier level for this requirement? Comment by Johnson, Harmony (ACF): Frank- Defer to you on the rest of the comments from here below. ORR program office didn’t draft this language. Comment by Johns, Frank (ACF): Based on what Ive seen so far, it would be a tier 2 but I would need to confer with Mirian or Jung on that. I'm not sure who would make that determination otherwise. Comment by Harris, Keyshana (ACF): Follow up with Frank

The transition-out-plan shall facilitate the accomplishment of a seamless transition from the incumbent to the incoming Contractor/government personnel at the expiration of the contract. The Contractor shall provide a transition out plan with their quote for the last 90 calendar days of performance prior to expiration of the contract. The Contractor shall identify how it will coordinate with the incoming contractor or government personnel to transfer knowledge regarding the following:

· Project management processes

· Points of contact

· Location of technical and project management documentation

· Status of ongoing technical initiatives

· Appropriate Contractor to Contractor coordination to ensure a seamless transition.

· Transition of Key Personnel

· Identify schedules and milestones

· Identify actions required of the Government

Establish and maintain effective communication with the incoming Contractor/Government personnel for the 30 day period of the transition via status meetings.

V. PERIOD OF PERFORMANCE

The anticipated period of performance is one (1) 12-month base period with two (2) 12-month optional periods.

VI. PLACE OF PERFORMANCE

The event location shall be provided by the COR thirty (30) days prior to the start of an event. Events have the potential to be held anywhere in the U.S. If a wage determination is needed for all the tasks on the contract, the wage determination will be incorporated into the contract via a contract modification.

VII. STAFFING QUALIFICATIONS

The Contractor shall submit a Key Personnel Staffing Plan within 20 business days after award. Comment by Harris, Keyshana (ACF): Add separate note/ guidelines about key personnel substitutes or changing of key personnel

IE: Contractor shall not replace, nor remove key personnel from their role within the first XXX calendar days

Key Personnel Selection of all new and replacement key staff is subject to the COR's written approval. Key staff is defined as the Project Manager, Translation and Interpretation Lead, and Event Logistics Lead.

Project Manager: The Project Manager shall maintain an expertise in social work, refugee resettlement, immigrant support, and/or non-profit operations. Specifically, the Project Manager shall have a bachelor’s degree or higher in a related field and at least five years of relevant experience. The Project Manager shall be the Contractor's primary point of contact for COR and shall oversee staffing, management, and reporting. Guided by the COR-approved Event Logistics Implementation Plan, the Project Manager will direct work priorities to maintain a professionally managed program. The Project Manager shall conduct reviews of all staff, timely performance of tasks and deliverables, collaboration with ORR and its stakeholders, and training needs of onsite event interpretation staff.

Translation and Interpretation Lead: The Translation and Interpretation Lead shall have expertise in the recruitment and hiring of interpreters as well as coordinating the translation of documents. The Translation and Interpretation Lead shall have excellent written and oral communication skills and shall maintain the level of professionalism needed to work with governmental and non-governmental entities. The Translation and Interpretation Lead shall have a bachelor’s degree and a minimum of five years of direct work experience in language and cultural services support or other relevant work.

Event Logistics Lead: The Event Logistics Lead shall provide overall logistics support and manage event coordination in partnership with ORR. The Event Logistics Lead shall have expertise in multifaceted projects. The Event Logistics Lead shall have excellent written and oral communication skills and shall maintain the level of professionalism needed to work with governmental and non-governmental entities. The Event Logistics Lead shall have a bachelor’s degree and a minimum of five years of direct work experience in coordinating event logistics or other relevant work.

VIII. DELIVERABLES/EVENTS

Final Implementation Plan Subtask 1.1

Kickoff Meeting Comment by Harris, Keyshana (ACF): Add separate section and details about the kickoff meeting

IE: Within 7 days of task order award, the Contractor shall coordinate with the COR to schedule the kick-off meeting. Meeting coordination including a draft agenda and suggested list of questions that will….

IT Security Requirements

IX. GOVERNMENT FURNISHED EQUIPMENT (GFE)/INFORMATION (GFI)

Contractor staff will not be provided government furnished equipment. The contractor shall be expected to provide all equipment and property for this requirement.

The contractor will not be provided government furnished information.

X. FEDERAL HOLIDAYS

Unless required under the terms of the contract or authorized by the Contracting Officer, the Contractor shall not work at any government facility, nor should any deliveries under this contract be made to any government facility, on any of the following holidays:

· New Year's Day - 1 January

· Martin Luther King, Jr.'s Birthday - 3rd Monday in January

· President's Day - 3rd Monday in February

· Memorial Day - Last Monday in May

· Juneteenth National Independence Day – 19 June

· Independence Day - 4 July

· Labor Day - 1st Monday in September

· Columbus Day - 2nd Monday in October

· Veteran's Day - 11 November

· Thanksgiving Day - 4th Thursday in November

· Christmas Day - 25 December

· Any other day designated by Federal Statute, Executive Order, or a Presidential Proclamation

If the Federal Holiday falls on a Saturday, the day will be observed the Friday before the Federal Holiday. If the Federal Holiday falls on a Sunday, the day will be observed the Monday following the Federal Holiday.

In addition to the days designated as holidays, the Government observes the following days:

· Any other day designated by Federal Statute

· Any other day designated by Executive Order

· Presidential Inauguration Day

It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the contract. In the event the Contractor’s personnel work during the holiday, they may be reimbursed by the Contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time

Hours of Operation: The contractor is responsible for conducting business, between the hours of 8:00 am and 5 pm, Monday thru Friday except on Federal holidays or similar Government directed facility closings. The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

XI. IT SECURITY REQUIREMENTS Comment by Brooks, Aleshia (ACF): Has FITARA looked at and approved this? Comment by Johns, Frank (ACF): I have reach out to Dave Warunek for more clarity on this. Comment by Harris, Keyshana (ACF): Follow up with Frank; FITARA package was provided

1. IT Security Requirements

1.1. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information as required to perform their work. Access is contingent upon positive adjudication of background check.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the ACF mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network, or operated by the Contractor on behalf of ACF regardless of location.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors(Confidentiality, Integrity, and Availability) of the information or information system. The contractor shall work with the ACF security team to categorize information or information systems. The categorization can change at any time throughout the lifecycle of the system. The contractor shall ensure proper controls are implemented based on the categorization.

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed.

Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately.

b. disclosed to authorized personnel on a Need-To-Know basis.

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to ACF control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800- 88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by ACF or collected by the contractor on behalf of ACF shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any ACF records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and ACF policies. Unauthorized disclosure of information will be subject to the HHS/ACF sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records).

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Websites and Digital Services. All new and existing public-facing government websites shall comply with the Integrated Digital Experience Act (IDEA).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to always assume HTTPS to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms, and other agency documents, if applicable, to comply with contract deliverables as appropriate.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and ACF-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR prior to implementation of the solution.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the ACF non- disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – When applicable, the Contractor shall assist the ACF Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the ACF SOP or designee with completing a PIA for the system or information within 30 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the ACF SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/ACF Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete HHS/ACF Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role- Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. Comment by Harris, Keyshana (ACF): Security form

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior. Comment by Harris, Keyshana (ACF): Will the COR provide copies of the Rules of Behavior to the contractor? Or, should it be included in the PWS as an attachment

Provide document as an attachment Comment by Johns, Frank (ACF): attachment

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual ACF Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response

Federal Information Security Management Act FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The Contractor (and/or any subcontractor) shall comply with ACF’s Incident Response Policy dated July 10, 2018, including any subsequent updates. Comment by Harris, Keyshana (ACF): Spell out – Federal Information Security Management Act?

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident.

2) Notify affected individuals only as instructed by the Contracting Officer or designated representative.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the ACF Incident Response Team (IRT), COR, CO, ACF SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic as defined in ACF’s Incident Response Policy.

4) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

E. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e- mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, can access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within 3 days of the effective date of this contract. Any revisions to the roster because of staffing changes shall be submitted within 24 hours of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

F. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

The Contractor (and/or any subcontractor) and its employees shall comply with computing and security standards including:

· Federal Information Security Management Act (FISMA) as part of the e-government Act of 2002

· Homeland Security Presidential Directive (HSPD)-12,

· Policy for a Common Identification Standard for Federal Employees and Contractors.

· Office of Management and Budget (OMB) Memorandum (M)05-24; and

· Federal Information Processing Standards Publication (FIPS PUB) Number 201,

· FAR Subpart 4.13 (https://acquisition.gov/sites/default/files/current/far/compiled_html/subpart_4.13.html),

· FAR Subpart 52.204-9 (https://www.acquisition.gov/?q=browsefar), and

· HHS HSPD-12 policy

The Contractor shall refer to the HHS-OCIO Policy for Information Systems Security and Privacy, dated July 7, 2011. The Contractor shall become familiar with the HHS Departmental Information Security Policies, which may be found at https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/index.html .

The HHS Cybersecurity Program develops policies, procedures, and guidance to serve as a foundation for the HHS information security program. These documents implement relevant Federal laws, regulations, standards, and guidelines that provide a basis for the information security program at the Department. The Contractor must become familiar with HHS Cybersecurity Program guidelines as presented at https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security- privacy program/index.html

G. Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Solution Development Life Cycle (SDLC) processes, ACF Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the ACF SDLC framework and methodology.

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system Information System Security Officer (ISSO) within 48 hours before an employee stops working under this contract.

5) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or ACF policies.

6) The Contractor (and/or any subcontractor) shall perform and document the actions identified in the ACF Contractor Employee Separation Checklist when an employee terminates work under this contract within 3 days of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

H. Records Management and Retention Comment by Brooks, Aleshia (ACF): Is this the most current Records Management language? Comment by Johns, Frank (ACF): I have not been able to located any to the contrary.

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/ACF policies and shall not dispose of any records unless authorized by HHS/ACF.

If a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/ACF policies.

Security Requirements for Government owned contractor operated (GOCO) and Contractor owned and contractor operated (COCO) Resources

1) Federal Policies. The Contractor (and/or any subcontractor) shall comply with applicable federal laws that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P); Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Control Federal Information Systems and Organizations; Office of Management and Budget (OMB) Circular A- 130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

2) Government Access for Security Assessment. In addition to the Inspection Clause in the contract, the Contractor (and/or any subcontractor) shall afford the Government access to the Contractor’s facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment…