RFP 70RDAD21R00000011- Cndtns of Dtntn.pdf

Combined Synopsis/Solicitation No. 70RDAD21R00000011

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation. Proposals are being requested and a written solicitation will not be issued.

(ii) The Request for Proposal (RFP) or Reference Number is: 70RDAD21R00000011

(iii) This RFQ and incorporated provisions and clauses are those in effect through Federal

Acquisition Circular (FAC) 2019-02.

(iv) This acquisition is set aside for 100% Total Small Businesses. The associated North American Industry Classification System (NAICS) code for this acquisition is 922140

- Correctional Institutions/Detention Centers.

(v) The Contract Line Item Numbers (CLINS), Description, Quantities, and Units of

Measure are:

See Schedule B Attachment (Schedule of CLINS and Statement of Work.).

(vi) The Contract shall provide for Conditions of Detention Subject Matter Experts for the Department of Homeland Security (DHS) Office for Civil Rights and Civil Liberties (CRCL). See SECTION II – STATEMENT OF WORK

(vii) The period of performance for this requirement is a base period of twelve months, and four, twelve-month option periods. The primary place of performance shall be the contractor’s office or place of residence. The Contractor shall also perform work onsite at locations to be determined by CRCL.

(viii) The provision at Federal Acquisition Regulation (FAR) 52.212-1, Instructions to

Offerors – Commercial applies to this acquisition. The following Addendum has been attached to this provision: See SECTION IX – INSTRUCTIONS, CONDITIONS AND NOTICES .

(ix) The provision at 52.212-2, Evaluation-Commercial Items applies to this acquisition.

The following factors shall be used to evaluate offers: See SECTION X –

EVALUATION CRITERIA FOR AWARD

(x) FAR 52.212-3 Offeror Representations and Certifications—Commercial Items

(FEB 2021). The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) website accessed through http://www.acquisition.gov.

(xi) The clause at 52.212-4, Contract Terms and Conditions—Commercial Items (OCT 2018) applies to this acquisition. The following addenda have been attached to this clause: None.

http://www.acquisition.gov/ http://www.acquisition.gov/

(xii) The provision at 52.212-5, Contract Terms and Conditions Required to Implement

Statutes or Executive Orders—Commercial Items (JUL 2021), applies to this acquisition. Additional FAR clauses applicable to this requirement are: See

SECTION VII – CONTRACT CLAUSES .

The following additional clauses are cited: See SECTION VII – CONTRACT

CLAUSES.

(xiii) Rating under the Defense Priorities and Allocations System (DPAS) – N/A.

(xiv) Questions concerning this RFP must be received via email to the point of contact noted under in paragraph “xvi”. SECTION IX – INSTRUCTIONS, CONDITIONS AND NOTICES for additional info.. A separate solicitation document is not available.

(xv) For more information regarding this RFQ please contact LaShonda Keith, Contracting Officer, (202) 447-5644 / LaShonda.Keith@hq.dhs.gov, and Nolan Brown, Contract Specialist, nolan.brown@hq.dhs.gov .

mailto:LaShonda.Keith@hq.dhs.gov mailto:nolan.brown@hq.dhs.gov

Schedule B Attachment PRICING TABLE

Base Period of Performance

CLIN 0001: Conditions of Detention Expert Services

Description Estimated Quantity Unit Unit Price Total Price

Conditions of Detention Expert Services 500 Hours

Total

CLIN 0002: Travel

Quantity Unit Unit Price Total Price

Travel (Not-to-Exceed (NTE)) $25,000

CLIN 0003: SURGE Support

Quantity Unit Unit Price Total Price

SURGE Conditions of Detention Expert Services (Optional Line Item)

250 Hours

CLIN 0004: SURGE Travel

Quantity Unit Unit Price Total Price

SURGE Travel (Optional Line Item) (Not-to-Exceed (NTE))

$25,000

Total Base Period Price:

Option Period 1

CLIN 1001: Conditions of Detention Expert Services

Quantity Unit Unit Price Total Price

CLIN 1002: Travel

Quantity Unit Unit Price Total Price

CLIN 1003: SURGE Support

Quantity Unit Unit Price Total Price

SURGE Conditions of Detention Expert Services (Optional Line Item)

CLIN 1004: SURGE Travel

Quantity Unit Unit Price Total Price

SURGE Travel (Optional Line Item) (Not-to-Exceed (NTE))

Total Option Period 1 Price:

Option Period 2

CLIN 2001: Conditions of Detention Expert Services

Quantity Unit Unit Price Total Price

CLIN 2002: Travel

Quantity Unit Unit Price Total Price

CLIN 2003: SURGE Support

Quantity Unit Unit Price Total Price

SURGE Conditions of Detention Expert Services (Optional Line Item)

CLIN 2004: SURGE Travel

Quantity Unit Unit Price Total Price

SURGE Travel (Optional Line Item) (Not-to-Exceed (NTE))

Total Option Period 2 Price:

Option Period 3

CLIN 3001: Conditions of Detention Expert Services

Quantity Unit Unit Price Total Price

CLIN 3002: Travel

Quantity Unit Unit Price Total Price

CLIN 3003: SURGE Support

Quantity Unit Unit Price Total Price

SURGE Conditions of Detention Expert Services (Optional Line Item)

CLIN 3004: SURGE Travel

Quantity Unit Unit Price Total Price

SURGE Travel (Optional Line Item) (Not-to-Exceed (NTE))

Total Option Period 3 Price:

Option Period 4

CLIN 4001: Conditions of Detention Expert Services

Quantity Unit Unit Price Total Price

CLIN 4002: Travel

Quantity Unit Unit Price Total Price

CLIN 4003: SURGE Support

Quantity Unit Unit Price Total Price

SURGE Conditions of Detention Expert Services (Optional Line Item)

CLIN 4004: SURGE Travel

Quantity Unit Unit Price Total Price

SURGE Travel (Optional Line Item) (Not-to-Exceed (NTE))

Total Option Period 4 Price:

Total Price:

Period Price

Base Period

Option Period 1

Option Period 2

Option Period 3

Option Period 4

Grand Total

SECTION I – SUPPLIES OR SERVICE/PRICES

TASK ORDER TYPE

The Government anticipates awarding a single, Time and Materials (T&M) type contract to provide Medical Doctor Subject Matter Expert (SME) Services to the U.S. Department of Homeland Security (DHS), Office for Civil Rights and Civil Liberties (CRCL).

PRICING

See Schedule B Attachment.

SECTION II – STATEMENT OF WORK

BACKGROUND

The U.S. Department of Homeland Security (DHS), Office for Civil Rights and Civil Liberties (CRCL), is responsible for investigating complaints filed pursuant to 6 U.S.C. § 345 and 42 U.S.C. § 2000-ee-1, alleging abuses of civil rights, civil liberties, and racial and ethnic profiling by DHS employees and officials, as well as contractors used by DHS Components. CRCL’s Compliance Branch is responsible for investigating these complaints. CRCL is also charged with overseeing compliance with constitutional, statutory, regulatory, policy, and other requirements relating to the civil rights and civil liberties of individuals affected by DHS programs and activities.

SCOPE

The purpose of this contract is to obtain program support services from a conditions of detention subject matter expert (SME) to assist CRCL perform its investigatory and oversight functions. The selected subject matter experts will primarily assist CRCL in conducting investigations examining conditions of detention in immigration detention facilities used by U.S.

Immigration and Customs Enforcement (ICE) and U.S. Customs and Border Protection (CBP), which will include preparing reports related to the investigations. CRCL cannot accurately predict the locations nor the number of facilities that may require onsite reviews because it depends on the complaints received. The expert may also be asked to assist CRCL with other CRCL matters related to conditions of detention, including reviews initiated by DHS leadership, consulting with substantive work groups, providing training, and other activities as requested.

Conditions of Detention SME services are required to evaluate complaints received pursuant to 6 U.S.C. § 345 and 42 U.S.C. § 2000-ee-1 and to oversee compliance with constitutional, statutory, regulatory, policy, and other requirements related to civil rights and civil liberties. The expert will provide assistance related to activities that arise within CRCL’s authority, including, but not limited to research, analysis, and/or development of system-wide standards, policies, procedures, and training. Services include, but are not limited to, conducting reviews of DHS facilities, providing training related to their areas of expertise, and other activities and projects related to conditions of detention concerns, as tasked by CRCL, such as participating in work groups, developing or presenting briefings, and preparation of documents.

In particular, the experts will also be required to prepare detailed reports regarding their observations and findings, as well as to provide recommendations based upon applicable correctional standards. CRCL cannot accurately predict the extent of the related activities required because it depends on the complaints received.

REQUIREMENTS/TASKS

The Contractor shall review, evaluate and report on conditions of detention issues and advise CRCL on how Department policies and practices impact various issues involving immigration detention facilities.

The Contractor personnel shall document their findings and recommendations in well written, comprehensive reports for each investigation or assignment. The Contractor personnel shall collaborate with CRCL as necessary to make edits to the written reports in order to fulfill CRCL’s needs, goals, and requirements.

The Contractor personnel shall provide CRCL with guidance on various violations of civil rights or civil liberties related to conditions of detention practices upon request, whether related to a CRCL investigation, or related to a broader CRCL issue or area of work. The Contractor personnel shall provide such guidance, whether planned or ad hoc, by telephone, email, formal report, or in person, as requested by CRCL. The guidance shall include, but not be limited to, discussions and assessments of individual cases, findings from onsite investigations, discussion of policies and practices, and any other relevant information that may arise during the course of an investigation or other aspects of CRCL’s oversight work.

CONTRACTOR PERSONNEL

Qualified Personnel

The Contractor shall provide qualified conditions of detention consultants to perform the requirements specified in this Statement of Work.

Minimum Requirements for a Conditions of Detention Subject Matter Expert

The Contractor shall have a Bachelor’s Degree in criminal justice or correctional management – or, in lieu of a Bachelor’s degree in criminal justice or correctional management, a Master’s degree or other graduate degree in a related field.

The Contractor shall have at least 10 years hands-on experience, including five years of management experience, in an adult detention setting.

The Contractor shall have experience investigating, auditing, or otherwise evaluating detention facilities for adherence to applicable correctional standards.

The Contractor shall be experienced in objectively critiquing the actions of other officers or officials in a detention setting.

The Contractor shall have experience serving as a subject matter expert providing advice, guidance, or testimony on conditions of detention issues in a detention setting.

The Contractor shall have experience formulating recommendations or other steps to address issues, violations, or concerns identified as part of an investigation or other type of inquiry.

The Contractor shall be familiar with and have experience applying the American

Correctional Association (ACA) Standards and other applicable standards.

The Contractor shall have knowledge and experience with the history, policies, and protocols of corrections standards in a detention setting and will be apprised of recent trends and developments in providing these services.

The Contractor shall have experience producing written reports that evaluate detention standards, systems, and actions present in detention facilities. This will include analysis of and application of standards and policy.

The Contractor shall demonstrate the ability to produce comprehensive reports that are well-written, clear, and cite relevant resources.

The Contractor shall demonstrate the ability to review large amounts of documentary evidence in short timeframes and provide oral briefings, written reports, and training under tight timelines.

The Contractor personnel must be able to travel to various locations nationwide to perform onsite investigations for several consecutive days and work efficiently and cooperatively under the direction of CRCL personnel.

4.3 Other Contractor features, but not required.

The following are contractor features above the minimum requirements of qualified personnel but are not required for SECTION II performance:

4.3.1 The Contractor has more than 20 years of hands-on experience working in an adult detention setting.

4.3.2 The Contractor has more than 10 years of experience managing a corrections program in an adult detention setting.

4.3.3 The Contractor has demonstrated experience in a variety of types of detention settings and with a variety of populations. The variety could include working with adults and children, working in prisons, jails, or another type of facility, or working with other special populations.

4.3.4 The Contractor has experience working in immigration detention facilities.

4.3.5 The Contractor has conducted and published research and analysis regarding system-wide issues related to corrections or detention.

4.3.6 The Contractor has worked directly with the ICE National Detention Standards (NDS), Performance Based National Detention Standards (PBNDS), or other related policies governing conditions of detention in immigration detention.

4.3.7 The Contractor has reviewed and evaluated conditions standards and services provided in an immigration detention facility.

SECTION III – DELIVERIES AND PERFORMANCE

PERIOD OF PERFORMANCE

The period of performance for work performed under this contract consists of a one-year base period of performance, and four (4) one-year optional periods of performance.

PLACE OF PERFORMANCE

The place of performance for work performed under this contract shall be at the Contractor’s site or Contractor’s remote location.

3 Hours of Operation Services will generally not be required on the following Federal holidays (or any other holidays declared by the Government); however, the Contractor may be required to provide services on these days in support of mission critical situations.

• New Year’s Day

• Martin Luther King’s Birthday

• Inauguration Day (Metropolitan DC only)

• President’s Day

• Memorial Day

• Juneteenth

• Independence Day

• Labor Day

• Columbus Day

• Veteran’s Day

• Thanksgiving Day

• Christmas Day

No work shall be performed by Contractor personnel on Government facilities on Federal holidays or other non-work says without prior written approval of the COR.

4 DELIVERABLES AND DELIVERY SCHEDULE

The Government will review all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with government policies, regulations, laws and directives. Written documents shall be concise and clearly written.

Final documentation deliverables shall be provided in hard and soft copy using MS Office applications. Daily, weekly and interim information deliverables and working-copy products may be provided by email or disk, as arranged with the COR.

The government will have ten (10) business days to accept or reject contract deliverables. If a deliverable is rejected and returned to the Contractor for revision, the Contractor shall provide the corrected deliverable within five (5) business days of notification of the request for revision.

All deliverables shall be submitted to the COR and assigned CRCL POC identified in this contract. A copy of the Monthly Performance Report shall be submitted to the COR and the Contracting Officer. The Contractor’s deliverables shall not contain any identifiable corporate markings.

ITEM DELIVERABLE / EVENT DUE BY

1 Post Award Meeting 5 business days of date of award.

2 Progress Reports 3 business days following request.

3 Draft Investigative Reports

COR CHECKPOINT Within 10 business days of receipt of assignment or completion of investigative work: Contractor shall submit draft to COR and assigned CRCL POC for review. The Contractor and CRCL will discuss the draft report to ensure its accuracy. CRCL will furnish comments and edits to Contractor who shall be responsible for making changes to the draft.

The COR must be copied on all assignment correspondence.

4 Oral Briefings and Ad Hoc Reports or Project-related work

COR CHECKPOINT Due date to be determined by COR and/or assigned CRCL POC and Contractor.

5 Edits to Reports and Documents 5 business days after receipt of government comments.

4.1.1 Government Acceptance Period

The COR and assigned CRCL POC will review deliverables prior to acceptance and provide the contractor with an e-mail that conveys acceptance or documented reasons for non-acceptance. The COR or assigned CRCL POC will have ten (10) business days to review deliverables and provide notification of acceptance or rejection.

4.1.2 Post Award Meeting

The Contractor shall participate in a Post Award Meeting with the Contracting Officer and the COR no later than five (5) business days after the date of award. The purpose of the Post Award Meeting is to discuss the contracting objectives of this contract. The Post Award Meeting will be held at the Government’s facility or via teleconference or conference call.

4.1.3 Kick-Off Meeting

The Contractor shall attend a Kick-Off meeting with the COR and members of the Program Office no later than 5 business days after the date of award. The purpose of the Kick-Off meeting, which will be chaired by the COR, is to discuss the technical objectives of this contract. The Kick-Off meeting will be held at the Government’s facility, located in Washington, DC or by conference call. The specifics of the meeting will be provided upon contract award.

4.1.4 Progress Reports

The Project Manager (Contractor) shall provide progress reports as needed to the COR via electronic mail. This report shall include a summary of all Contractor work performed, including an assessment of technical progress, written and analytical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

SECTION IV – CONTRACT ADMINISTRATION DATA

POST-AWARD CONFERENCE

The Contractor shall attend a Post Award Conference with the CO and COR no later than 5 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the CO, is to discuss contracting objectives of this task order. The Post Award Conference will be held at the Government’s facility, located in Washington, DC or by conference call. The specifics of the meeting will be provided upon task order award.

TASK ORDER KICK-OFF MEETING

The Contractor shall attend a Task Order Kick-Off meeting with the COR and members of the Program Office no later than 5 business days after the date of award. The purpose of the Task Order Kick-Off meeting, which will be chaired by the COR, is to discuss the technical objectives of this task order. The Task Order Kick-Off meeting will be held at the Government’s facility, located in Washington, DC or by conference call. The specifics of the meeting will be provided upon task order award.

CONTRACTING OFFICER

The Contracting Officer is the only individual who can legally commit or obligate the Government for the expenditure of public funds and authorize revisions of the terms and conditions of this task order.

The Contracting Officer shall authorize any such revision in writing.

The Contracting Officer is: Ms. LaShonda Keith Department of Homeland Security Office of Procurement Operations Telephone: (202) 447-5644 E-Mail: LaShonda.Keith@hq.dhs.gov

The Contract Specialist is: Mr. Nolan Brown Department of Homeland Security Office of Procurement Operations Phone: 202-447- E-mail: Nolan.Brown@hq.dhs.gov

CONTRACTING OFFICER’S REPRESENTATIVE (COR)

The COR for this task order is: TBD

Note: The COR’s contact information will be provided at task order award.

mailto:Nolan.Brown@hq.dhs.gov

SECTION V - INVOICE AND PAYMENT PROVISIONS

INVOICES

Invoices shall be prepared in accordance with FAR Clauses 52.212-4 Contract Terms and Conditions – Commercial Items.

The Contractor shall submit one invoice by the 5th day of each month.

The Contractor shall indicate the associated CLIN, dollar amount invoiced, and service completed. All invoices shall include the current amount billed along with a cumulative amount billed and remaining balance.

The Contractor shall submit the invoice electronically to the address below: E-mail: MGTInvoice.Consolidation@ice.dhs.gov

The Contractor shall simultaneously provide an electronic copy of the invoice to the following individuals at the addresses below:

a) ATTN: Office of Procurement Operations/Nolan Brown (Contract Specialist)

E-mail : Nolan Brown@hq.dhs.gov

b) ATTN: Office of Procurement Operations/LaShonda Keith (Contracting Officer)

E-mail : LaShonda.Keith@hq.dhs.gov

c) ATTN: Office for Civil Rights and Civil Liberties /TBD

(COR) E-mail : TBD mailto:MGTInvoice.Consolidation@ice.dhs.gov mailto:Nolan%20Brown@hq.dhs.gov mailto:Tanya.Hill@hq.dhs.gov

SECTION VI – SPECIAL CONTRACT REQUIREMENTS

CONTRACTOR PERSONNEL SECURITY CLEARANCE REQUIREMENT

All contractor and subcontractor personnel are required to complete a suitability/background investigation with the DHS Office of Security, Personnel Security Division.

The procedures outlined below shall be followed for the DHS Office of Security, Personnel Security Division (PSD) to process suitability/background investigations and suitability determinations, as required, in a timely and efficient manner.

Carefully read the security clauses in the contract. Compliance with the security clauses in the contract is not optional.

Contractor employees (to include applicants, temporaries, part-time and replacement employees) under the contract, requiring access to sensitive information, shall undergo a position-sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate suitability/background investigation to be conducted. All suitability/background investigations will be processed through the DHS Office of Security Office/PSD. Prospective Contractor employees shall submit the following completed forms to the DHS Office of Security Office/PSD. The Standard Form (SF) 85P will be completed electronically, through the Office of Personnel Management’s e-QIP SYSTEM. The completed forms must be given to the DHS Office of Security Office/PSD no less than thirty (30) days before the start date of the contract or thirty (30) days prior to entry on duty of any employees, whether a replacement, addition, subcontractor employee, or vendor:

a) Standard Form (SF) 85-P ― Questionnaire for Public Trust Positions

b) SF-85P Certification

c) SF-85P Authorization for Release of Information

d) FD Form 258 ― Fingerprint Card (2 copies)

e) DHS Form 11000-6 ― Conditional Access to Sensitive but Unclassified Information Non-

Disclosure Agreement

f) DHS Form 11000-9 ― Disclosure and Authorization Pertaining to Consumer Reports pursuant to the Fair Credit Reporting Act

Only complete packages will be accepted by the DHS Office of Security/PSD. Specific instructions on submission of packages will be provided upon award of the contract.

The DHS OCSO/PSD may, as it deems appropriate, authorize and grant a favorable Entry on Duty (EOD) decision based on preliminary checks. A favorable EOD decision allows a contractor employee to commence work temporarily prior to the completion of the full background investigation. The granting of a favorable EOD decision shall not be considered as assurance that a favorable fitness determination will follow. In addition, a favorable EOD or fitness determination shall in no way prevent, preclude, or bar DHS from withdrawing or terminating access to government facilities or information, at any time during the term of the contract. No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable EOD or fitness determination by the DHS OCSO/PSD. Limited access to Government buildings is allowable without an EOD decision if the Contractor is escorted by a Government employee and the purpose of the visit is to attend a limited number of required briefings or nonrecurring meetings in order to facilitate the transition of a contract The intent of this statement is to allow a minimum amount of meetings/transition attendances to prepare for a new contract.

The DHS OCSO/PSD shall be notified of all terminations/resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer’s Representative (COR) all DHS issued identification cards and building passes that have either expired or have been collected from terminated employees. If an identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the pass or card number, name of individual to whom it was issued and the last known location and disposition of the pass or card.

When sensitive Government information is processed on Department telecommunications and automated information systems, the Contractor shall provide for the administrative control of sensitive data being processed. Contractor personnel must have a favorable Entry on Duty or fitness determination by the DHS Office of the Chief Security Officer (OCSO), Personnel Security Division (PSD), to access this information.

Contractors who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

SECURITY OFFICE CONTACT

Office of Security/PSD Customer Service Support Washington, DC 20528

Telephone: (202) 447-5010

E-mailbox: officeofsecurity@hq.dhs.gov

3 Disclosure of Information

Information furnished under this contract may be subject to disclosure under the Freedom of Information Act (FOIA). Therefore, all items that are confidential to business, or contain trade secrets, proprietary, or personnel information must be clearly marked. Marking of items will not necessarily preclude disclosure when DHS or the Government determines disclosure is warranted by FOIA. However, if such items are not marked, all information contained within the submitted documents will be deemed to be releasable.

Any information made available to the Contractor by the Government must be used only for the purpose of carrying out the provisions of this contract and must not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract.

In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees.

Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 USC 641.

mailto:officeofsecurity@hq.dhs.gov

Notification of consulting teaching, speaking, and writing activities: Contractor employees shall notify the Contracting Officer’s Representative before engaging in consulting, teaching, speaking, or writing activities if:

The information conveyed through the activity draws substantially on knowledge or official data that are nonpublic information as defined in 5 C.F.R. § 2635.703(b);

the subject of the activity deals in significant part with work performed under the contract; or the subject of the activity deals in significant part with any ongoing or announced policy, program, or operation of the agency.

Notice shall be provided at least seven days prior to engaging in the activity. The scope of the notification is not intended to include work in the expert’s area of expertise that does not derive from work done for DHS.

Disclosures of Information in Litigation: Contractor employees shall comply with 6 C.F.R. Part 5, Subpart C, including 6 C.F.R. §§ 5.44 and 5.49. Those regulations generally prohibit contractor employees from testifying in connection with litigation based upon information acquired in the scope and performance of their official Department duties, except as authorized by the Department.

4 NON-PERSONAL SERVICES

The services required under the contract constitute professional support services, which are essential to the mission but not otherwise available within. The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage their employees and to guard against any actions that have the nature of personal services, or give the perception of personal services. If the Contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor’s further responsibility to notify the Contracting Officer immediately.

These services shall not be used to perform work of a policy/decision making or management nature. All decisions relative to programs supported by the Contractor will be the sole responsibility of the Government. Support services will not be ordered to circumvent personnel ceilings, pay limitations, or competitive employment procedures.

5 OTHER APPLICABLE CONDITIONS

5.1 Security

See INFORMATION TECHNOLOGY SECURITY AND PRIVACY TRAINING (MAR 2015)

See HSAR 3052.204-71 CONTRACTOR EMPLOYEE ACCESS – ALTERNATIVE I.

5.1.1 Personal Identification Verification (PIV) Credential Compliance

Authorities:

file://hqnas/SHARED/G-A/G-ACS/CAAT%20Team/TOOLBOX/TASK%20ORDER%20TOOLS/MASTER%20CATALOG%20Task%20Order.doc#Security

• HSPD-12 “Policies for a Common Identification Standard for Federal Employees and Contractors”

• OMB M-11-11 "Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors"

• OMB M-06-16 “Acquisition of Products and Services for Implementation of HSPD-12”

• NIST FIPS 201 “Personal Identity Verification (PIV) of Federal Employees and Contractors”

• NIST SP 800-63 “Electronic Authentication Guideline” OMB M-10-15 “FY 2010 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management” Procurements for products, systems, services, hardware, or software involving controlled facility or information system shall be PIV-enabled by accepting HSPD-12 PIV credentials as a method of identity verification and authentication

INFORMATION TECHNOLOGY SECURITY AND PRIVACY TRAINING (MAR 2015)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Security Training Requirements.

(1) All users of Federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of Homeland Security (DHS) requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing sensitive information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

(2) The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors.

Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail copies of the signed DHS Rules http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://www.dhs.gov/dhs-security-and-training-requirements-contractors of Behavior to the COR not later than thirty (30) days after contract award for each employee. The DHS Rules of Behavior will be reviewed annually and the COR will provide notification when a review is required.

(c) Privacy Training Requirements. All Contractor and subcontractor employees that will have access to Personally Identifiable Information (PII) and/or Sensitive PII (SPII) are required to take Privacy at DHS: Protecting Personal Information before accessing PII and/or SPII. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall also complete the training before accessing PII and/or SPII. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause— “Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN) Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive but Unclassified (for Official Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and

Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121- 01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

(3) All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or Component Privacy Officer. Unless otherwise specified in the ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

http://csrc.nist.gov/publications/PubsSPs.html

(1) Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.

1. Security Authorization Process Documentation. SA documentation shall be developed using the

Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

2. Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

3. Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA.

The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years.