Queue Management Support SOW DRAFT.pdf

U.S. Department of Homeland Security/Federal Emergency Management Agency

Department of Homeland Security

Federal Emergency Management Agency (FEMA)

Recovery Technology Programs Division

Statement of Work v1.2

Disaster Recovery Center (DRC) Queue Management Software

(DRAFT)

Rev. October 13, 2020

1.0 Introduction

This Performance Work Statement is issued by the U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), and the Recovery Technology Programs Division

(RTPD). FEMA, under the authority of section 408 of the Robert T. Stafford Disaster Relief and

Emergency Assistance Act, 42 U.S.C. §5174, and Title 44 of the Code Federal Regulations (CFR), prepares for and responds to both natural and manmade disasters. The Disaster Recovery Center (DRC) unit requires a technological solution to implement a comprehensive Queue Management System (QMS) to streamline traffic in DRCs and to help modernize DRC operations in response to the COVID-19 pandemic.

2.0 Purpose

The purpose of this requirement is to deliver, implement, and sustain Queue Management System

(QMS) software which includes the ability to streamline traffic in the DRCs. FEMA requires the ability for disaster survivors to schedule appointments and check into a DRC without having to wait in the facility or stand in long lines. Because of the COVID-19 pandemic, and in anticipation of future ones, the DRCs must provide modern QMS technologies to help maintain social distancing, provide online options for survivors to check in, wait, and interface with agents, and ultimately eliminate over-crowding and maintain maximum occupancies of facilities.

3.0 Scope

FEMA requires a survey software system which includes, but is not limited to, the ability to check-in and schedule appointments for disaster survivors to meet with FEMA personnel at the DRCs. The software shall meet FEMA IT Security Requirements and be 508 Compliant (see Appendix III for further information) and include the ability to be approved on the DHS/FEMA Technical Reference

Model (TRM) for approved software and/or hardware. Although not required, DHS and FEMA-approved software will be considered. The QMS shall improve the survivor customer service experience.

FEMA requires the ability to support at least 100 locations which will allow up to 100 simultaneous users at a time to make appointments and check in. In the event of a large-scale disaster, FEMA requires the ability to increase the number of locations and simultaneous users.

3.1 End-to-End Requirements

At a minimum, the QMS software must include the following overall requirements:

• Provide a software-based application with a customizable queue management option installed on a computer, tablet, phone, or accessed via web browser.

• The ability to set capacity and availability (walk-ins and/or reservations).

• The ability for survivors to be assigned to specific locations upon registering, to include:

o The specific DRC to visit o Specific FEMA-partnered organizations (SBA, for example) to visit o IA Program Personnel where survivors can receive instructions specific to their case.

• Provide equitable survivor queue assignment regardless of processing methods.

• Provide efficient view, filter, search, and sort capabilities.

• Allow user login from multiple devices simultaneously.

• Only allow updates from one device at a time.

• Provide software syncs in real-time.

https://ea.dhs.gov/mobius/homepage https://ea.dhs.gov/mobius/homepage

• Allow for the customization and editing of notifications by DRC staff.

• Provide a capability for adding links to FEMA websites, social media, or calendar of events for survivors to access disaster-specific information.

• Provide a reporting capability for DRC Coordination to monitor and understand trends in survivor traffic and wait times.

• Provide Customer Service phone support in the event of software issues.

• Configured to provide multi-language customization.

3.2 Pre-Registration Requirements

At a minimum, the QMS software must include the following pre-registration requirements:

• The ability to schedule appointments and check into a DRC without having to wait in the facility.

• The ability for survivors to cancel a scheduled appointment.

• Provide the ability for survivors to edit information submitted when scheduling an appointment.

• The ability for survivors to add themselves to a waitlist via a reception desk or website.

• The ability for survivors to schedule appointments via text message. (Example text: “ADD

{DRC name} {survivor name}" to phone number).

3.3 In Queue Requirements

At a minimum, the QMS software must include the following in queue requirements:

• Include an interface for adding survivors to the queue.

• Provide confirmations to survivors when added to queue via the following methods: Text, E-mail, and Automated Phone Voice Message.

• Provide next-in-line notifications/alerts to survivors via the following methods: Text, E-mail, and

Automated Phone Message.

• Provide predictive wait estimates.

3.4 After Assistance Requirements

At a minimum, the QMS software must include the following after assistance requirements:

• Provide follow-up notifications after a survivor has been assisted, for example, a request to complete a survey.

3.5 Training

FEMA desires relevant training to occur within two weeks of notice. In coordination with the FEMA

COR and PM, the Contractor shall:

• Provide training for the initial roll out of the QMS software solution and conduct Train-The-

Trainer sessions.

• Provide training that shall cover all requirements outlined in Section 3 of the SOW and be sufficient for FEMA personnel to set up and configure the QMS for active and new DRCs without assistance from the contractor.

3.6 Operations and Maintenance

The Contractor shall provide maintenance support, troubleshooting, repair and diagnosis, data backup and recovery, software upgrades (bug fixes, improvements, and enhancements) and patches for the proposed solution. Maintenance support shall be available to FEMA Program Manager (PM), COR, and the FEMA end users to assist them in accessing the system, general questions, and submitting tickets for issues. The Contractor shall provide point-of-contact information (name, phone, email address) for all maintenance-related issues at least seven (7) business days prior to the installation or set up being complete.

At a minimum, the Contactor shall provide maintenance support during standard business hours (8:00

AM CT to 5:00 PM CT), Monday through Friday. The Contractor shall include in their proposal what days/hours of support are included and the process for submitting maintenance issues during and after support hours with severity levels and expected turnaround times.

4.0 Period of Performance

The period of performance shall be for one (1) base period plus four (4) option periods. The base period will be 12 months from the date of award. The subsequent option periods will be for 12 months and will be exercised at the discretion of FEMA.

Appendix I – Government Furnished Equipment (GFE)

FEMA Government Property (Laptops, PIV Badges, etc.) will be provided to contractors, in accordance with FAR 45.102(b), under the following conditions:

• Providing the property is in the Government’s best interest due to directives established by the

Information Technology Security Branch (ITSB) for cyber security management.

• The overall benefit to the acquisition significantly outweighs the increased cost of administration, including ultimate property disposal.

• Providing the property does not substantially increase the Government’s assumption of risk.

• Government requirements cannot otherwise be met.

The contractor shall pick up the FEMA laptops and badges from a FEMA facility. The equipment and components shall be returned to the Contracting Officer’s Representative (COR) at the designated location at the contractor’s expense. All of the security controls for GFE must be adhered to by the contractor to fulfill the requirements of the contract.

The contractor shall login with the FEMA laptop and connect to the FEMA network at least once every two (2) weeks for a minimum of four (4) hours to ensure the download of appropriate patches.

Therefore, the contractor shall bring their laptop to a FEMA office every two (2) weeks and attach it directly to the FEMA Local Area Network (LAN) or log in remotely and connect to the FEMA Virtual

Private Network (VPN) once every two (2) weeks. If a contractor employee logs in remotely, they shall use a high-speed internet connection and leave the laptop logged in for a minimum of four (4) hours to allow all patches and updates to properly load as downloads will not occur properly via a dial-up connection.

If this mandatory requirement is not adhered to, then the contractor employees shall travel to the local/nearest FEMA office to reset their credentials.

Any Government equipment provided for FEMA’s contract shall be used exclusively for FEMA business and are subject to FEMA and DHS rules of behavior regarding access and use of DHS sensitive information technology resources. Government equipment shall not be used for contractor or personal business outside of the work required for FEMA.

Appendix II – Records Management Compliance

A. Applicability

This clause applies to all contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. Includes FEMA records.

2. Does not include personal materials.

3. Applies to records created, received, or maintained by contractors pursuant to their FEMA contract.

4. May include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as

National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR

Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of

44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, contractor shall maintain all records created for

Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. FEMA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FEMA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity.

Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, contractor must report to FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The contractor shall not remove material from

Government facilities or systems, or facilities or systems operated or maintained on the

Government’s behalf, without the express written permission of the Head of the Contracting

Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FEMA control or the contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the SOO.

Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The contractor (and any sub-contractor) is required to abide by Government and FEMA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FEMA policy.

8. The contractor shall not create or maintain any records containing any non-public FEMA information that are not specifically tied to or authorized by the contract.

9. The contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The FEMA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which FEMA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take FEMA-provided records management training. The contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

[Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

D. Flowdown of requirements to subcontractors

1. The contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this SOO, and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the contractor.

Appendix III – DHS Enterprise Architecture Compliance

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures.

Specifically, the contractor shall comply with the following Homeland Security Enterprise Architecture

(HLS EA) requirements:

(a) All developed solutions and requirements shall be compliant with the HLS/FEMA EA.

(b) All IT hardware and/or software shall be compliant with the HLS/FEMA EA Technical Reference

Model (TRM) Standards and Products Profile.

(c) Description information for all information assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture

Information Repository.

(d) Development of information assets, information exchanges and data standards will comply with the

DHS Data Management Policy MD 103-01[1] and all data-related artifacts will be developed, validated, managed, stored and tagged according to DHS data management architectural guidelines.

(e) Applicability of IPv6 to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per

OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant as defined in the USGv6 Profile (NIST Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

[1] Department of Homeland Security (DHS) Directives System, Enterprise Data Management Policy, 2008.

https://www.dhs.gov/sites/default/files/publications/mgmt_directive_103_01_enterprise_data_management_policy.pdf https://www.dhs.gov/sites/default/files/publications/mgmt_directive_103_01_enterprise_data_management_policy.pdf

Appendix IV - Accessibility Requirements (Section 508)

Section 508 Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-

220) (codified at 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities.

Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendix A, C & D, and available at https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and

Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible

Systems and Technology Program, dated November 20, 2018, or any successor publication.

Section 508 Requirements for Technology Products

Section 508 applicability to Information and Communications Technology (ICT): DRC QMS

Software

Applicable Exception: N/A Authorization #: N/A

Applicable Functional Performance Criteria: Does not apply

Applicable 508 requirements for electronic content features and components (including but not limited to Internet or Intranet website; Electronic forms): All requirements in E205 apply, including all WCAG 2.0 Level A and AA Success Criteria apply as specified in E205

Applicable 508 requirements for software features and components: Does not apply

Applicable 508 requirements for hardware features and components: Does not apply

Applicable 508 requirements for support services and documentation: All requirements in

Chapter 6 apply

Section 508 Deliverables

Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract

(including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report

(ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf https://www.itic.org/policy/accessibility/vpat

Appendix V - Security Compliance, Maintenance, and System Documentation

At the direction of FEMA COR, the Contractor shall ensure that all applications remain in full compliance with all security, operations, legal, and regulatory requirements. The contractor shall support the remediation of security vulnerabilities identified though the vulnerability scanning processes as outlined by FEMA and support the security Authorization to Operate (ATO) process with documentation and materials as needed for each system and maintain a repository for training as well as supporting data where applicable. The current vulnerability scanning tools utilized by FEMA include

Fortify for custom source code, AppDetective for databases, and WebInspect for web applications. For systems that may be hosted on the FEMA Enterprise Network (FEN), this would also include Nessus for the operating system.

Privacy Documentation Requirements

To accomplish the tasks outlined, FEMA and/or the survivor may share with the contractor the following PII data elements when submitting information in the QMS: Name, Phone Number, and

Email.

The information sharing outlined in this task order is authorized by the following System of Records

Notice(s) and Routine Use(s): DHS/FEMA-008 Disaster Recover Assistance Files, Routine Use F, DHS/ALL-004 General Information Technology Access Account Records System, Routine Use F, DHS/ALL-021 Department of Homeland Security Contractors and Consultants, Routine Use F, and

DHS/ALL-023 Department of Homeland Security Personnel Security Management, Routine Use F.

Routine Use F allows FEMA to disclose/allow access to user login information from FEMA systems

“To contractors and their agents, grantees, experts, consultants, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for DHS, when necessary to accomplish an agency function related to this system of records. Individuals provided information under this routine use are subject to the same Privacy Act requirements and limitations on disclosure as are applicable to DHS officers and employees.”

Contractor access to information protected under the Privacy Act may be required under this

SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

Contractor access to proprietary information may be required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with

DHS MD 11042.1, Safeguarding Sensitive but Unclassified (For Official Use Only) Information. The

Contractor shall ensure that all Contractor personnel having access to business or procurement sensitive information sign a non-disclosure agreement (DHS Form 11000-6).

The contractor shall assist with and/or consult with the Contracting Officer Representative (COR), Program Manager (PM), and/or System Owner (SO) to ensure the appropriate Privacy Act Threshold

Analysis (PTA), Privacy Impact Analysis (PIA), and system documentation are submitted and approved by FEMA and DHS Privacy organizations prior to the collection of Personally Identifiable Information

(PII) related information associated with the services and/or technology included in this solicitation.

The contractor will limit access to the PII, and proprietary information provided by FEMA under this contract only to the contractor’s authorized personnel who need to know the information to accomplish the tasks outlined in this contract.

The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), will occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

If at any time during the term of this contract any part of FEMA PII or proprietary information, in any form, that the contractor obtains from FEMA ceases to be required by the contractor for the performance of the contract, or upon termination of the contract, whichever occurs first, the contractor shall, within fourteen (14) calendar days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at

FEMA’s written request destroy, un-install and/or remove all copies of such PII in the contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.

All deliverables and data received, processed, evaluated, loaded, and/or created as a result of this contract shall remain the sole property of the Government unless specific exception is granted by the

CO.

Appendix VII – Security

Background Investigations

All contractor personnel who require access to DHS or FEMA information systems, routine access to

DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally

Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security

Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

Low Risk without Information System Access

Contractor personnel occupying positions or performing functions with a low risk designation and who do not require access to DHS or FEMA information systems shall undergo a Tier 1 (T1) background investigation which is equivalent to the previously identified National Agency Check with Inquiries

(NACI). Either of these investigations must be supported by a separate credit check and must receive a favorable adjudication thereof from FEMA PSD prior to holder performing work under this contract. A favorably adjudicated NACI & C will remain acceptable for the purpose of reciprocity where a T1 investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Low Risk with Information System Access

Contractor personnel occupying positions or performing functions with a moderate risk designation shall undergo a Tier 2 Suitability (T2S) background investigation which is equivalent to the previously identified Moderate Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated MBI will remain acceptable for the purpose of reciprocity where a T2S investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Moderate Risk

Contractor personnel occupying positions or performing functions with a moderate risk designation shall undergo a Tier 2 Suitability (T2S) background investigation which is equivalent to the previously identified Moderate Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated MBI will remain acceptable for the purpose of reciprocity where a T2S investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

High Risk

Contractor personnel occupying positions or performing functions with a high-risk designation shall undergo a Tier 4 (T4) background investigation which is equivalent to the previously identified

Background Investigation (BI), and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated BI will remain acceptable for the purpose of reciprocity where a T4 investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Background Investigation Process

Contractors performing on this contract must be United States Citizens. Contractor applicants must also be 18 years of age or older to allow for the conduct of certain security related queries.

To initiate the request to process contractor personnel, the contractor shall provide the FEMA

Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 121-3-1-6, “Contract Fitness/Security Screening

Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 121-3-1-6 are complete prior to submitting the form to FEMA PSD for processing. The contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

• the investigation was completed within the last five years;

• it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract;

• the contractor personnel have not had a break in employment since the prior favorable adjudication; and,

• FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email to the contractor personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the Office of Personnel Management’s Electronic Questionnaires for

Investigation Processing (e-QIP) system and instructions for submitting the necessary information:

• Standard Form 85P, “Questionnaire for Public Trust Positions”

• Optional Form 306, “Declaration for Federal Employment”

• SF 87, “Fingerprint Card” (2 copies)

• DHS Form 11000-6, “Non-Disclosure Agreement”

• DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

Applicants born outside the United States will be required to provide proof of citizenship in the form of a Certificate of Naturalization (Form N550 or N570), an unexpired U.S. Passport, or State Department issued Consular Report of Birth Abroad (CRBA) (FS-240)

FEMA PSD will only accept complete packages consisting of all the above document and Standard

Form 85P, which must be completed electronically through the Office of Personnel Management’s e-

QIP system. The contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Residency requirements apply to the background investigation process. Persons subject to investigation and final adjudication for fitness or suitability must have lived within the United States for no less than 3 of the last 5 years as defined in the DHS Instruction 121-01-007-01, The Department of Homeland

Security, Personnel Security, Suitability and Fitness Program (June 14, 2016). DHS has determined this to be the amount of time required to be the sufficient minimum investigative period for the purpose of performing a suitability or fitness adjudication. Both, OPM and OMB require a final adjudicative decision to support the issuance of the HSPD-12 compliant PIV Card that contractors are issued by

FEMA Physical Security.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

Continued Eligibility and Reinvestigation

Eligibility determinations based on a T1, T2S, or T4 (or the equivalent OPM investigation) are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

Exclusion by Contracting Officer

The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the contractor be excluded from working on this contract. Any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency may be removed.

Facility Access

The contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification

Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA

Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and an OF306, Declaration for Federal Employment, and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas

(i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security

Officer has determined to be a potential security threat.

Separation from Contract

The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The contractor must account for all forms of Government-provided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a contractor employee’s employment.

• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the contractor to civil and criminal liability.

Security Training

SECURITY: All personnel require access to information up to the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure contractor employees receive a favorably adjudicated public trust suitability prior to entry on duty (EOD). All individuals will be U.S. citizens.

The contractor shall follow the standards established within DHS and FEMA policy.

Unauthorized Disclosure of Classified or Unclassified Information

Contractors and subcontractors who are working on this contract shall receive Unauthorized Disclosure of Classified or Unclassified Information training.

Access to the training can be obtained at:

https://securityawareness.usalearning.gov/unauthorizedrefresher/index.htm

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

OPSEC Training

Contractors and subcontractors who are working on this contract shall receive the OPSEC Awareness

Brief.

Access to the briefing can be obtained at http://cdsetrain.dtic.mil/opsec

Insider Threat Training

Insider Threat training for contractors can be found at: http://cdsetrain.dtic.mil/itawareness/index.htm.

Certificate of training is required for all cleared contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer

Representative, before the contractor or subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

For Official Use Only (FOUO) Information

In accordance with DHS Management Directive 11042.1 contractors, consultants and others to whom access is granted will abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities.

The contractor shall:

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only”

(FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer-based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. Be aware that divulging information without proper authority could result in administrative or disciplinary action.

https://securityawareness.usalearning.gov/unauthorizedrefresher/index.htm http://cdsetrain.dtic.mil/opsec http://cdsetrain.dtic.mil/itawareness/index.htm

Contractors and consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified Information

Non Disclosure Agreement (NDA), as a condition of access to such information. Other individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an NDA as determined by the applicable program manager. Execution of the

NDA shall be effective upon date of the DHS Policy and not applied retroactively.

Unauthorized Disclosure of Classified or Unclassified Information

Contractors and subcontractors who are working on this contract shall receive the Unauthorized

Disclosure of Classified or Unclassified Information training.

Access to the training can be obtained at:

Appendix VIII – HSAR Class Deviation 15-01: Safeguarding of Sensitive Information (March

2015)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees

(hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause –

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available – in any medium and from any source – that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy

Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure

Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal

Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of

Homeland Security (including the PCII Program Manager or his/her designee);

Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of

Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(2) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(3) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such

PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien

Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official Use

Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel

Suitability and Security Program http://www.dhs.gov/dhs-security-and-training-requirements-contractors

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for

Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and

Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and

Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only)

Information…