Partnering and Outreach PWS_.docx

U.S. DEPARTMENT OF HOMELAND SECURITY (DHS)

Immigration and Customs Enforcement (ICE) Enforcement and Removal Operations (ERO) Public Safety Partnership Division (PSP)

287(g) PROGRAM OUTREACH, TRAINING, AND SUPPORT SERVICES Performance Work Statement (PWS)

Table of Contents

PSP 287(g) Partnering and Outreach Services PWS Page | iii PSP//FOUO//Acquisition Sensitive

Performance Work Statement The U.S. Department of Homeland Security (DHS), Immigration and Customs Enforcement (ICE), Enforcement and Removal Operations (ERO), Public Safety Partnership Division (PSP), has a requirement for contractor support to provide outreach, training, communications, website hosting, database management, collaborative engagement tools, and professional liability insurance reimbursement support for the ICE 287(g) Program. These services will help ICE ERO inform, train, and support current and prospective state, local, and tribal law enforcement agency partners participating in, or seeking to participate in, the 287(g) Program.

1 PURPOSE

The purpose of this PWS is to obtain contractor support in order to provide ongoing outreach, training, and support for ICE 287(g) partners. This training and outreach would be a mix of virtual, web-based, and social media-based material to inform and advise all current and prospective 287(g) partner agencies on information related to the 287(g) program. This material would be delivered both on set schedules and as necessary to keep members updated on new guidance related to the program.

2 BACKGROUND

TheDHS, ICE, ERO is responsible for enforcing the nation’s immigration laws within the interior of the United States. In support of the Presidential declared emergency and expanding immigration operations nationwide, ICE relies on the Public Safety Partnership Division’s 287(g) Program to recruit and train civilian Law Enforcement Agencies (LEAs) nationwide to increase immigration arrests.

The 287(g) Program’s primary mission is to enhance the safety and security of our nation’s communities through partnering and collaborating with state, local, and tribal law enforcement agencies, also referred to as partners, to identify and remove criminal aliens through the delegation of specified immigration officer duties. ICE recognizes the importance of its relationships with law enforcement partners to carry out its critical mission to protect the homeland and public safety.

The 287(g) Program is ICE's primary outreach and communications component for state, local and tribal stakeholders. It is responsible for building and improving relationships, and coordinating activities with state, local, and tribal law enforcement agencies.

3 SCOPE

The Contractor will be required to provide comprehensive and ongoing outreach, training, and support for 287(g) partners. This training and outreach would be a mix of virtual, web-based, and social media-based material to inform and advise all current and prospective 287(g) partner agencies on information related to the 287(g) program. This material would be delivered both on set schedules and as necessary to keep members updated on new guidance related to the program.

4 TASK DESCRIPTIONS

4.1 Outreach, Training, and Communications

4.1.1 Task 1: Provide a Secure and Private 287(g) Website for Outreach to LEAs The Contractor shall provide outreach to all prospective LEAs with information about the ICE/ERO 287(g) partnership programs via secure/private webhosting and online training platforms. ICE/ERO will provide content to assist LEAs in navigating the procedures for signing up with 287(g). The Contractor shall provide data to ICE/ERO with reports on traffic generated from all portals within the hosted site(s).

Performance Standards:

· The 287(g) website is available and accessible by the LEAs.

Acceptable Quality Level (AQL) – 98% (AQL is calculated based on the platform uptime each month.)

· The 287(g) website is updated with approved content within one business day after request by the ICE/ERO Program Manager.

Acceptable Quality Level (AQL) – 100% (AQL is calculated based on the turnaround time after a request is submitted to the Contractor.)

4.1.2 Task 2: Deliver Virtual 287(g) Town Hall Events for Outreach to LEAs The Contractor shall facilitate virtual town hall events to answer questions from existing and prospective partner agencies related to 287(g) on a recurring monthly schedule. The Contractor shall include the virtual town hall statistics in the monthly report including the date and time, duration, content summary description, total number in attendance, and the LEAs represented.

Performance Standard:

· A monthly virtual 287(g) town-hall event occurred.

Acceptable Quality Level (AQL) – 100%

4.1.3 Task 3: Provide 287(g) Training Content and Maintain a Training Database The Contractor shall develop and maintain a training platform with information provided by ICE/ERO 287(g) to inform and guide existing and prospective LEA partners in procedures to sign up for partnership with ICE/ERO 287(g). The Contractor will provide LEAs with training material regarding forms, procedures, and policies. The Contractor will conduct partnering sessions on a regular timeline. The Contractor will maintain a database of training materials and relevant 287(g) communications. The Contractor shall communicate any proposed changes in information and delivery with ICE/ERO before dissemination to LEAs. The Contractor shall host ICE/ERO produced videos and tutorials for use by the LEA. ICE/ERO will provide approved 287(g) training content to the Contractor.

Performance Standards:

· The 287(g) training platform is available and accessible by the LEAs.

Acceptable Quality Level (AQL) – 98% (AQL is calculated based on the platform uptime each month.)

· The 287(g) training database is updated with approved content within one business day after request by the ICE/ERO task manager.

Acceptable Quality Level (AQL) – 100%. (AQL is calculated based on the date and time a request is submitted to the Contractor.)

4.1.4 Task 4: Establish and Maintain a Database of 287(g) LEAs The Contractor shall establish and maintain a nationwide database network of 287(g) LEAs. The database shall contain the contact (POC) information for the department’s leadership representatives who would be the POC for 287(g) related decisions and outreach.

Performance Standards:

· The 287(g) LEA contacts database is available and accurate.

Acceptable Quality Level (AQL) – 98% (AQL is calculated based on the database uptime and accuracy each month.)

· The 287(g) LEA contacts database is secure with no data breaches.

Acceptable Quality Level (AQL) – 100%

4.1.5 Task 5: Provide a Collaborative 287(g) Space

The Contractor will provide a collaborative 287(g) space that the LEA, ICE/ERO, and the vendor can access (blog, chat, or other feature) to allow LEAs to communicate information in real-time. The Contractor shall include relevant statistics in the monthly report to reflect the engagement activity of the collaborative space.

Performance Standards:

· The collaborative 287(g) space is available and moderated for real-time engagement and feedback during business hours.

Acceptable Quality Level (AQL) – 98% (AQL is calculated based on the platform’s uptime each month.)

· The collaborative 287(g) space is secure with no data breaches.

Acceptable Quality Level (AQL) – 100%

4.2 Professional Liability Insurance (PLI)

4.2.1 Task 1: Coordinate Professional Liability Insurance (PLI) Coverage and Reimbursement for LEO’s The Contractor shall coordinate with a subcontracted vendor (insurer) PLI policy coverage up to $500,000 for all credentialed law enforcement officers (LEOs) who are working on behalf of ICE/ERO 287(g) and choose to apply for such policy. The Contractor shall provide a PLI policy under a reimbursement option up to $250.00 per year per officer. (i.e. If an eligible LEO elects to obtain qualifying PLI coverage, the Government shall reimburse the allowable documented cost of such coverage, not to exceed $250.00 per officer per year, in accordance with the applicable CLIN, invoicing procedures, and supporting documentation requirements.) Existing local law enforcement insurance may be used only if it satisfies the PLI coverage requirements for credentialed LEOs performing ICE/ERO 287(g) duties, including required coverage limits, scope of covered activities, and geographic applicability. If the existing policy does not provide nationwide coverage, the Contractor should confirm with the insurer, the COR, and the government point of contact that the policy is sufficient or whether an additional policy, endorsement, or rider is required. Any covered LEO would need to self-renew yearly and provide proof of enrollment to receive subsequent reimbursement. Coordinate between the LEA and ICE to ensure all parties receive necessary insurance information. Obtain and organize relevant details from liability insurance companies. Provide final approval details (including months of coverage and start date) to the designated Contracting Officer’s Representative (COR) for DHS ICE and the local government POC. Consolidate PLI reimbursement via monthly invoice to ICE including support documents in accordance with ICE invoicing procedures.

Performance Standard:

Credentialed and active LEOs who apply for a PLI policy receive reimbursement up to $250 per officer per year within 30 days of a properly submitted application to the Contractor. Acceptable Quality Level (AQL) – 100%

5 KEY PERSONNEL

5.1 Project Manager

The Contractor shall provide a Project Manager to exercise technical direction and control of the performance outcomes required in accomplishing the requirements of this PWS.

5.2 Deputy Project Manager

The Contractor shall provide a Deputy Project Manager to assist the Project Manager and provide continuity of operations in exercising technical direction and control of the performance outcomes required in accomplishing the requirements of this PWS.

To maintain program continuity, the following Key Personnel Replacement Penalty Clause is incorporated.

Key Personnel Replacement Penalty Clause:

In the event that any Contractor-designated Key Personnel identified in the contract departs, is scheduled to depart or otherwise becomes unavailable to perform their assigned duties, the Contractor shall notify the Contracting Officer (CO) and Contracting Officer’s Representative (COR) in writing immediately upon knowing. The Contractor shall submit a qualified replacement candidate, along with the individual’s resume and qualifications, to the CO and COR for review and approval within thirty (30) calendar days of the personnel’s departure. Failure to find a qualified replacement within the required thirty (30) calendar days may result in a deduction of up to 5% of the total invoice amount of the month(s) in which the position remains vacant, as described in the QASP. This deduction shall be applied at the Government’s discretion based on the impact of the vacancy on contract performance. Repeated failures to timely replace Key Personnel may also result in adverse contractor performance evaluations, potential issuance of a Cure Notice, and/or other contractual remedies as deemed appropriate by the Government.

6 PERFORMANCE STANDARDS

Selective performance standards are included in Section 4 following the performance requirements.

The Government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

The Contractor’s success or failure to meet the Government’s performance standard thresholds will be documented in the Contractor Performance Assessment Reporting System (CPARS) for the associated performance period. If the Contractor repeatedly performs below Acceptable Quality Levels, the Contracting Officer may issue a Contract Discrepancy Report (CDR).

98%

Monthly Program Manager’s Report

Random inspection and customer feedback.

The 287(g) website is updated with approved content within one business day after request by the ICE/ERO Program Manager.

100%

100%

Monthly Program Manager’s Report

98%

Monthly Program Manager’s Report

The 287(g) training database is updated with approved content within one business day after request by the ICE/ERO task manager.

100%

4.1.4 Establish and Maintain a Database of 287(g) LEAs

Monthly Program Manager’s Report

The 287(g) LEA contacts database is secure with no data breaches.

100%

98%

Monthly Program Manager’s Report

The collaborative 287(g) space is secure with no data breaches.

100%

100%

Monthly Program Manager’s Report

6.1 Deliverable Acceptance Criteria

The Government will provide written acceptance and or rejection, comments and/or change requests, if any, within 30 days of each draft deliverable. If rejected, the Contractor shall make corrections as specified and resubmit the deliverable for review and approval within the agreed upon timeframe, or no later than 15 calendar days from notification of the rejected deliverable and at no additional cost to the Government.

If the Government comments or change requests, the Contractor shall make corrections as specified and resubmit the deliverable for review and approval within the agreed upon timeframe, or not later than 15 calendar days from the Government’s comments and/or change requests at no additional cost to the Government.

7 DELIVERABLES AND DELIVERY SCHEDULE

7.1 Standard Operating Procedures (SOP)

The Contractor shall submit Standard Operating Procedures to the COR within 30 days following contract award.

7.2 Quality Control Plan

The Contractor shall submit a Quality Control Plan to the COR within 30 days following contract award.

7.3 Monthly Program Manager’s Report

The Contractor shall submit a Monthly Program Manager’ by the 5th business day of each succeeding month. The report shall contain at a minimum; activity summary, major milestones, open action items, quality control results, risks and response to risks, and earned-value management information.

7.4 Quarterly Personnel Security Reconciliation Report

The contractor will provide, through the COR, a Quarterly Report (on a Microsoft Excel Spreadsheet) containing the names of contractor employees who are actively serving on their contract. The list shall include the Name, Position and SSN (Last Four) and should be derived from the system(s) used for contractor payroll/voucher processing to ensure accuracy. CORs will submit reports to PSD-Industrial-Security@ice.dhs.gov no later than the 10th day of each January, April, July and October.

8 GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

Government Furnished Information (GFI) consists of available deployed technology and IT systems data e.g. operational manuals etc. The Government does not anticipate providing any Government Furnished Equipment (GFE).

9 PLACE OF PERFORMANCE

The place of performance shall be at the contractor’s facility.

10 PERIOD OF PERFORMANCE

The period of performance includes one base year of 12 months and two possible one-year option periods. The base period shall commence upon task order award

11 SECURITY

Information provided during the performance of this contract is deemed unclassified. Contractors supporting this action shall be U.S. Citizens, and free of criminal convictions. A full background investigation (BI) and approval is required. The Contractor shall comply with the Customs and Border Protection administrative, physical and technical security controls to ensure that the Government’s security requirements are met. During the course of this agreement, the Contractor shall not use, disclose, or reproduce data, which bears a restrictive legend, other than as required in the performance of this agreement.

The contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OPR PSD through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the contractor.

The COR and OPR shall have the right to inspect the procedures, methods, and facilities utilized by the contractor in complying with the security requirements under this contract. Should the COR determine that the contractor is not complying with the security requirements of this contract, the contractor will be informed in writing by the Contracting Officer of the proper action to be taken to effect compliance with such requirements.

12 QUALITY ASSURANCE SURVEILLANCE PLAN

See attachment A – Quality Assurance Surveillance Plan (QASP)

13 SPECIAL CONSIDERATIONS

13.1 Travel

Travel shall be required to support performance activities such as meeting attendance and site visits in support of the contract. All travel requests must be pre-approved by the COR. The contractor shall be reimbursed for Government approved travel at the rates provided in the Joint Travel Regulations.

13.2 Non-Disclosure of Information

Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this task and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the task. Contractors may be requested to sign Non-Disclosure statements.

13.3 Points of Contact

The designated ICE/ERO 287(g) Program Manager will provide technical direction for the performance requirements of this contract. All contract questions and concerns shall be directed to the designated Contracting Officer’s Representative. The Contracting Officer is the only individual with the authority to modify this contract.

14 ADMINISTRATIVE, SECURITY, AND COMPLIANCE REQUIREMENTS

14.1 General Invoicing Requirements

The Contractor shall submit invoices in accordance with FAR 52.212-4(g) and the invoicing instructions outlined in the contract. All invoices must be submitted electronically through the Department of Homeland Security’s (DHS) financial system of record (e.g., IPP or other system as designated by the Contracting Officer) and must comply with DHS and U.S. Immigration and Customs Enforcement (ICE) invoicing policies.

14.1.1 Invoice Submission Frequency

Invoices shall be submitted monthly, no later than the fifth (5th) business day of the month following the month of performance, unless otherwise stated in the contract.

14.1.2 Invoice Format

Each invoice shall be itemized and detailed, and include the following information:

· Contractor’s name, address, and UEI (Unique Entity Identifier)

· Invoice number and date

· Contract number, task order/delivery order number (if applicable)

· Period of performance covered by the invoice

· Name and contact information for the Contractor’s point of contact

· Name and contact information for the COR

· A description of services performed

· Quantity of services or deliverables provided

· Unit prices (if applicable)

· Total amount billed for the period

· Cumulative amounts billed to date

· Applicable CLIN(s)/SLIN(s)

· Any applicable travel or ODC costs, supported by receipts and prior COR approval

· Payment terms (Net 30 unless otherwise specified)

· A certification that the services were delivered, performed in accordance with the contract, and are accurate and complete

14.1.3 Supporting Documentation

Each invoice must include supporting documentation sufficient to verify services rendered and billed. This includes, but is not limited to:

· Timesheets (if labor-hour or T&M): Signed and approved by the COR or designated government official, identifying labor categories, hours worked, and period covered.

· Deliverables Log: Summary of deliverables submitted during the billing period and their acceptance status.

· Status Report: Brief summary of activities performed and progress against milestones.

· Travel Receipts: Itemized and submitted in accordance with the Federal Travel Regulation (FTR), if travel was authorized.

· Other Direct Costs (ODCs): Receipts or documentation for any ODCs approved and incurred during the billing period.

14.1.4 COR Review and Certification

The Contracting Officer’s Representative (COR) is responsible for reviewing, validating, and certifying each invoice within five (5) business days of receipt. The COR will ensure:

· Services billed match those performed

· Costs are allowable, allocable, and reasonable

· All required supporting documentation is provided

If the COR identifies a discrepancy, the Contractor will be notified to correct and resubmit the invoice.

14.1.5 Unallowable Charges

The following are not allowable and shall not appear on any invoice:

· Charges for services not yet rendered.

· Costs not authorized under the contract.

· Duplicative charges.

· Costs without required documentation or COR pre-approval (e.g., unapproved travel).

· Overtime charges (unless pre-authorized in writing).

14.1.6 Invoice Dispute Resolution

In the event of an invoice dispute:

· The COR shall notify the Contractor in writing within 7 business days of invoice receipt.

· The Contractor shall submit a revised invoice within 5 business days of notification.

· Payment may be withheld pending correction of the invoice.

14.1.7 Final Invoice

The final invoice must be clearly labeled “Final Invoice” and must include:

· A certification that all services have been provided

· A reconciliation of all payments made and balance due (if any)

· Return of any government-furnished property (GFP), if applicable

14.1.8 Payment

Payment shall be made by the Government in accordance with the Prompt Payment Act (31 U.S.C. § 3901) and corresponding FAR regulations, typically within 30 calendar days after receipt of a proper invoice and COR certification.

14.2 Privacy Requirements for Contractor and Personnel

In addition to FAR 52.224-1 Privacy Act Notification (APR 1984), 52.224-2 Privacy Act (APR 1984), 52.224-3 Privacy Training – Alternate I (DEVIATION), and HSAR Clauses, the following instructions must be included in their entirety in all contracts.

14.2.1 Limiting Access to Privacy Act and Other Sensitive Information In accordance with FAR 52.224-1 Privacy Act Notification (APR 1984), and FAR 52.224-2 Privacy Act (APR 1984), if this contract requires contractor personnel to have access to information protected by the Privacy Act of 1974, the contractor is advised that the relevant DHS system of records notices (SORNs) applicable to this Privacy Act information may be found at https://www.dhs.gov/system-records-notices-sorns. Applicable SORNS of other agencies may be accessed through the agencies’ websites or by searching GovInfo, available at https://www.govinfo.gov that replaced the FDsys website in December 2018. SORNs may be updated at any time.

14.2.2 Prohibition on Performing Work Outside a Government Facility/Network/Equipment

The Contractor shall perform all tasks on authorized Government networks, using Government-furnished IT and other equipment and/or Workplace as a Service (WaaS) if WaaS is authorized by the statement of work. Government information shall remain within the confines of authorized Government networks at all times. Except where telework is specifically authorized within this contract, the Contractor shall perform all tasks described in this document at authorized Government facilities; the Contractor is prohibited from performing these tasks at or removing Government-furnished information to any other facility; and Government information shall remain within the confines of authorized Government facilities at all times. Contractors may only access classified materials on government furnished equipment in authorized government owned facilities regardless of telework authorizations.

14.2.3 Prior Approval Required to Hire Subcontractors

The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (Subcontractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any Subcontractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

14.2.4 Separation Checklist for Contractor Employees

Contractor shall complete a separation checklist before any employee or Subcontractor employee terminates working on the contract. The separation checklist must verify: (1) return of any Government-furnished equipment; (2) return or proper disposal of sensitive personally identifiable information (PII), in paper or electronic form, in the custody of the employee or Subcontractor employee including the sanitization of data on any computer systems or media as appropriate; and (3) termination of any technological access to the Contractor’s facilities or systems that would permit the terminated employee’s access to sensitive PII.

In the event of adverse job actions resulting in the dismissal of an employee or Subcontractor employee, the Contractor shall notify the Contracting Officer’s Representative (COR) within 24 hours. For normal separations, the Contractor shall submit the checklist on the last day of employment or work on the contract.

As requested, contractors shall assist the ICE Point of Contact (ICE/POC), Contracting Officer, or COR with completing ICE Form 50-005/Contractor Employee Separation Clearance Checklist by returning all Government-furnished property including but not limited to computer equipment, media, credentials and passports, smart cards, mobile devices, PIV cards, calling cards, and keys and terminating access to all user accounts and systems.

14.2.5 Contractor’s Commercial License Agreement and Government Electronic Information Rights

Except as stated in the Performance Work Statement and, where applicable, the Contractor’s Commercial License Agreement, the Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation and associated metadata created as part of this contract. All deliverables (including all data and records) under the contract are the property of the U.S. Government and are considered federal records, for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

14.2.6 Privacy Lead Requirements

If the contract involves an IT system build or substantial development or changes to an IT system that may require privacy documentation, the Contractor shall assign or procure a Privacy Lead, to be listed under the SOW or PWS’s required Contractor Personnel section. The Privacy Lead shall be responsible for providing adequate support to DHS to ensure DHS can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance. The Privacy Lead shall work with personnel from the program office, the ICE Privacy Unit, the Office of the Chief Information Officer, and the Records and Data Management Unit to ensure that the privacy documentation is kept on schedule, that the answers to questions in the PIA are thorough and complete, and that questions asked by the ICE Privacy Unit and other offices are answered in a timely fashion.

The Privacy Lead:

· Must have excellent writing skills, the ability to explain technology clearly for a non-technical audience, and the ability to synthesize information from a variety of sources.

· Must have excellent verbal communication and organizational skills.

· Must have experience writing PIAs. Ideally the candidate would have experience writing PIAs for DHS.

· Must be knowledgeable about the Privacy Act of 1974 and the E-Government Act of 2002.

· Must be able to work well with others.

If a Privacy Lead is already in place with the program office and the contract involves IT system builds or substantial changes that may require privacy documentation, the requirement for a separate Private Lead specifically assigned under this contract may be waived provided the Contractor agrees to have the existing Privacy Lead coordinate with and support the ICE Privacy POC to ensure privacy concerns are proactively reviewed and so ICE can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance if required. The Contractor shall work with personnel from the program office, the ICE Office of Information Governance and Privacy, and the Office of the Chief Information Officer to ensure that the privacy documentation is kept on schedule, that the answers to questions in any privacy documents are thorough and complete, that all records management requirements are met, and that questions asked by the ICE Privacy Unit and other offices are answered in a timely fashion.

14.2.7 General Cybersecurity Contract Requirements

In accordance with ITAR 4.5.3.1 – Compliance with DHS Security Policy Terms and Conditions, the following requirement should be incorporated into all acquisition documents for CUI REQUESTS:

Compliance with DHS Security Policy Terms and Conditions:

All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Program 4300A version 13.3 Feb. 13, 2023, and attachments.

In accordance with ITAR 4.5.3.4 and ITAR 4.5.4.4 – Security Review, the following clause should be incorporated into ALL acquisition documents:

Security Review Terms and Conditions:

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

In accordance with ITAR 4.5.3.7 – Supply Chain Risk Management, the following clause should be incorporated into ALL acquisition documents, but exclude services-only contracts:

Supply Chain Risk Management Terms and Conditions:

The Contractors supplying the Government hardware and software shall provide the manufacturer's name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number for all components comprising the hardware andsoftware. If subcontractors or subcomponents are used, the name, address, state, and/or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

i. How risks from the supply chain will be identified.

ii. What processes and security measures will be adopted to manage these risks to the system or system components; and

iii. How the risks and associated security measures will be updated and monitored.

The Supply Chain Risk Management Plan shall remain current through the life of the contract or period of performance. The Supply Chain Risk Management Plan shall be provided to the Contracting Officer Representative (COR/CO) 30 days post award.

The Contractor acknowledges the Government's requirement to assess the Contractors Supply Chain Risk posture. The Contractor understands and agrees that the Government retains the right to cancel or terminate the contract, if the Government determines that continuing the contract presents a risk to national security.

The Contractor shall disclose, and the Government will consider, relevant industry standard certifications, recognitions and awards, and acknowledgments.

The Contractor shall provide only new equipment unless otherwise expressly approved, in writing, by the CO. Contractors shall provide only Original Equipment Manufacturer (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts.

The Contractor shall be excused from using new OEM (i.e. "grey market, "previously used) components only with formal Government approval. Such components shall be procuredfrom their original source and have them shipped only from manufacturers authorized shipment points.

For software products, the contractor shall provide all OEM software updates to correct defects for the life of the product (i.e., until the “end of life"). Software updates and patches must be made available to the government for all products procured under this contract.

Contractors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill contract obligations with the Government.

All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lessor of the term of the contract, the period of performance, or one calendar year from the date the activity occurred.

These records must be readily available for inspection by any agent designated by the U.S. Government as having the authority to examine them.

This transit process shall minimize the number of times en route components undergo a change of custody and make use of tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government's request, shall be able to provide shipping status at any time during transit.

The Contractor is fully liable for all damage, deterioration, or losses incurred during shipping and handling, unless the damage, deterioration, or loss is due to the Government. The Contractor shall provide a packing slip which shall accompany each container or package with the information identifying the contract number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact. The contractor shall send a shipping notification to the intended government recipient or contracting officer. This shipping notification shall be sent electronically and will state the contract number, the order number, a description of the hardware/software being ship (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

3052.204-71 Contractor Employee Access (JULY 2023), and determine if Alternate is required:

· Alternate I (July 2023)

· Alternate II (July 2023) As prescribed in (HSAR) 48 CFR 3004.470-4(a), insert the following clause with appropriate alternates:

CONTRACTOR EMPLOYEE ACCESS (JULY 2023)

(a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government’s activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

(f) The Contractor shall include this…