RFQ No. 70FB8026Q00000056 Attachment 1 Statement of Work.pdf

Department of Homeland Security (DHS)

June 2021 1

Federal Emergency Management Agency

STATEMENT OF WORK (SOW) FOR:

Region IX Emergency Medical Membership Access

PROCUREMENT SENSITIVE INFORMATION

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

DEPARTMENT OF HOMELAND SECURITY (DHS)

DHS Statement of Work (SOW)

Learn more at fema.gov June 2021 2

1.0 GENERAL

• 1.1 Background

FEMA Region IX’s Area of Response (AOR) includes the Pacific Basin, specifically Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands (CNMI). FEMA employees regularly proceed on official travel to this AOR to provide support and assistance.

In the event of an emergency, FEMA employees from various locations throughout the United States may be deployed to this region. Due to the geographic isolation of the Pacific Islands and territories, obtaining timely medical services, medical advice, or medical coordination from a traveler’s Continental United States-based insurance company or medical provider may not be possible. Therefore, FEMA requires access to a third-party medical and security assistance services provider to support FEMA employees, or other members FEMA declares to be on a work-related assignment on behalf of FEMA, while on official travel within the Pacific Islands and/or territories, excluding Hawaii.

• 1.2 Scope

The Contractor shall act as a third-party provider to coordinate access to quality health care, medical assistance, travel assistance, and security assistance services for FEMA employees, or any member FEMA has declared to be on a work-related assignment on behalf of FEMA, while on official travel within the Pacific Islands and/or territories, excluding Hawaii.

The Contractor shall provide all resources necessary to coordinate services for up to 215 employees per membership year. The average trip length is expected to be 30 days and shall not exceed 120 days.

The Contractor shall coordinate applicable third-party services, as needed, including medical services and travel services described in this SOW.

• 1.3 Objective

The objective of this requirement is to provide FEMA with corporate medical membership access to a third-party assistance provider capable of coordinating medical, evacuation, repatriation, travel, and related emergency assistance services for eligible FEMA personnel traveling on official duty within the Pacific Islands and/or territories, excluding Hawaii.

2.0 SPECIFIC REQUIREMENTS/TASKS

• 2.1 Corporate Medical Membership Services

Learn more at fema.gov June 2021 3

The Contractor shall provide corporate medical membership access for eligible FEMA employees and any member FEMA has declared to be on a work-related assignment on behalf of FEMA while on official travel within the Pacific Islands and/or territories, excluding Hawaii.

The Contractor shall provide membership services 24 hours per day, seven days per week during the period of performance.

• 2.2 Eligibility Verification

The Contractor shall contact the designated FEMA Region IX Medical Assistance Authorizing Person (AP) to verify FEMA employee or member eligibility before any billable services are rendered.

The Contractor shall verify the FEMA employee or member using the individual’s name and the last four digits of the individual’s Social Security number, or another FEMA-approved verification method if provided by the Government.

• 2.3 Medical Consultation and Case Assessment

The Contractor shall consult with the treating physician or medical provider to determine the patient’s medical condition.

The Contractor shall assess available options and determine the recommended course of action based on the patient’s medical condition, available local medical capabilities, and the need for additional services.

• 2.4 Authorization for Billable Services

The Contractor shall advise the AP of recommended services and obtain financial authorization before performing or arranging any billable service.

The Contractor shall provide a best estimated cost of services to the AP before billable services are performed or arranged. The Contractor shall continue to update the AP on the employee’s status and the need for any additional services or changes in estimated costs.

• 2.5 Medical Evacuation and Repatriation Support

The Contractor shall recommend medical evacuation when the patient has a serious medical condition and local facilities are inadequate to provide the necessary level of care.

The Contractor shall recommend repatriation when the patient requires follow-up medical care in the patient’s home country and will need medical assistance for the trip home.

When evacuation or repatriation is recommended, the Contractor shall provide the following information to the AP:

• Destination of the nearest appropriate care facility

• Mode of transportation required

• Medical team and equipment required to safely transport the patient

Learn more at fema.gov June 2021 4

• Recommended timing of the evacuation or repatriation

• Estimated cost

• 2.6 Medical Services

The Contractor shall arrange third-party medical services, as needed and authorized, which may include but not limited to:

• Emergency evacuation

• Medically supervised repatriation

• Companion ticket

• Additional travel and accommodation arrangements after medical evacuation

• Repatriation of mortal remains

• Return home of minor children

• Medical monitoring

• Inpatient admission and identification of receiving physician

• Dispatch of medication and medical supplies

The Contractor shall also provide or coordinate the following services at no additional fee when included under the membership:

• Emergency and routine medical advice

• Pre-trip information on travel health issues

• Medical and dental referrals

• Outpatient referrals

• Outpatient case management

• Insurance claims assistance

• Outpatient medical expense guarantee and payment, upon approval

• Inpatient medical expense guarantee, cost review, and payment

• 2.7 Travel Services

The Contractor shall arrange third-party travel services, as needed and authorized, which may include but not limited to:

• Ground transportation and accommodations for accompanying family members

• Emergency personal cash advances

The Contractor shall also provide or coordinate the following services at no additional fee when included under the membership:

• Legal referrals

• Emergency message transmission

• Translations and interpreters over the phone

• Lost document advice

Learn more at fema.gov June 2021 5

• 2.8 Evacuation and Repatriation Arrangements

As arrangements are made, the Contractor shall:

• Assist with the patient’s official documents, including passport, exit documents, exit taxes, and related documentation, as applicable

• Notify the AP of the complete evacuation or repatriation schedule

• Provide routine updates to the AP throughout the case

• Keep the AP fully informed of the status and progress of events

• Notify the AP of any changes to the recommended course of action or estimated cost

• 2.9 Communication with Authorizing Persons

The AP is the FEMA representative identified to act on behalf of FEMA in the event of a medical or security emergency involving an eligible employee or member on official travel.

The Contractor shall be able to contact at least one designated AP at all times. The Contractor shall contact an AP for financial authorization before performing or arranging any billable service in order to avoid unauthorized commitments and potential violations of appropriations law.

The AP may initiate emergency services by contacting the Contractor. The Contractor may contact the AP for advice on how FEMA would like a case handled and may provide relevant details of the situation and questions requiring AP input.

3.0 Primary Point of Contact

The Contractor shall provide a primary point of contact responsible for performance under this SOW. The Contractor’s primary point of contact shall serve as the primary interface with the Contracting Officer, Contracting Officer’s Representative (COR), and designated APs.

4.0 OTHER APPLICABLE CONDITIONS

• 4.1 Period of Performance

The period of performance for this contract shall be a one-year base period with four one-year option periods. The total period of performance, if all options are exercised, shall not exceed five years from the date of award.

• 4.2 Place of Performance

Learn more at fema.gov June 2021 6

The primary place of performance shall be the Contractor’s facilities. Services shall support eligible FEMA employees and members on official travel within the Pacific Islands and/or territories, excluding Hawaii.

• 4.3 Hours of Operation

The Contractor shall provide access to membership services 24 hours per day, seven days per week during the period of performance.

• 4.4 Post-Award Conference

The Contractor shall attend a post-award conference with the Contracting Officer and COR no later than 10 business days after the date of award, unless otherwise directed by the Contracting Officer. The purpose of the post-award conference is to discuss technical and contracting objectives, review points of contact, confirm AP procedures, and address membership activation requirements.

• 4.5 General Report Requirements

The Contractor shall provide all written reports and invoices in electronic format compatible with FEMA systems and standard Microsoft Office applications, unless otherwise directed by the Contracting Officer or COR.

• 4.6 Protection of Information

Contractor access to information protected under the Privacy Act may be required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with applicable law, Government policy, and regulation.

The Contractor shall use any Government-furnished information only for performance under this contract. The Contractor shall not release Government-furnished information to outside parties without prior written approval from the Contracting Officer.

5.0 GOVERNMENT FURNISHED RESOURCES

The Government will provide the following information to the Contractor for work required under this contract:

• Signed Subscriber’s Declaration, if applicable

• List of designated APs and contact information

• Information necessary to verify FEMA employee or member eligibility

• Other membership renewal or activation information, as required

The Contractor shall use Government-furnished information only for performance under this contract. The Contractor shall not release Government-furnished information to outside parties without the prior written consent of the Contracting Officer.

Learn more at fema.gov June 2021 7

6.0 CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all facilities, materials, equipment, systems, personnel, and services necessary to fulfill the requirements of this contract, except for Government-furnished resources specified in this SOW.

7.0 GOVERNMENT ACCEPTANCE PERIOD

The COR will review deliverables prior to acceptance and provide the Contractor with written or electronic notice of acceptance or non-acceptance.

If a deliverable is not accepted, the COR will provide the Contractor with the reasons for non-acceptance. The Contractor shall correct deficiencies and resubmit the deliverable within the timeframe specified by the COR or Contracting Officer.

The COR will have 10 business days to review deliverables and provide comments, unless otherwise specified. The Contractor shall have 10 business days to make corrections and resubmit, unless otherwise directed by the Contracting Officer or COR.

8.0 DELIVERABLES

The Contractor shall provide the following deliverables and events in accordance with the requirements of this SOW.

Item SOW Reference Deliverable/Event Due By Distribution

1 3.0 Contractor Primary Point of Contact Information

No later than 5 business days after award, unless otherwise directed by the Contracting Officer

CO, COR, APs

2 4.4 Post-Award Conference

No later than 10 business days after award, unless otherwise directed by the Contracting Officer

CO, COR,

Contractor

3 2.1, 4.3 Corporate Medical Membership Access Available 24 hours per day, seven days per week during the period of performance

Eligible FEMA employees and members

Learn more at fema.gov June 2021 8

Item SOW Reference Deliverable/Event Due By Distribution

4 2.2, 5.0 Eligibility Verification with AP Before any billable services are rendered AP

5 2.3 Determination of Patient’s Medical Condition As needed, upon case initiation AP

6 2.3, 2.4 Recommended Course of Action

As needed, upon case assessment and before any billable services are performed or arranged

AP

7 2.4, 2.5 Estimated Cost of Services Before any billable services are performed or arranged, and updated as costs change

AP

8 2.4, 2.9 Financial Authorization Request Before any billable services are performed or arranged AP

9 2.5

Evacuation or Repatriation Recommendation Information, including destination, mode of transportation, required medical team and equipment, recommended timing, and estimated cost

As needed, before evacuation or repatriation services are arranged

AP

10 2.6 Arrangement of Authorized Medical Services As needed, following AP authorization AP

11 2.7 Arrangement of Authorized Travel Services As needed, following AP authorization AP

12 2.8 Assistance with Patient Official Documents As needed, during evacuation or repatriation arrangements AP

13 2.8 Complete Evacuation or Repatriation Schedule

As soon as available after arrangements are made AP

14 2.8, 2.9 Case Status Updates

As needed throughout the case and upon any change to employee status, recommended course of action, or estimated cost

AP, COR upon request

15 4.5 Written Reports

Upon request and in electronic format compatible with FEMA systems and standard Microsoft Office applications

COR, CO, AP as applicable

9.0 GOVERNMENT RESPONSIBILITIES

The Government shall:

Learn more at fema.gov June 2021 9

• Provide a signed Subscriber’s Declaration to the Contractor upon renewal of membership, if applicable

• Pay the membership fee at the time of renewal in accordance with contract terms

• Provide contact information for designated APs

• Ensure at least one of the designated APs is available to the Contractor to verify FEMA employees or members in need of Contractor services

• Reimburse the Contractor for AP-approved third-party provided services in accordance with contract terms and the Prompt Payment Act

• Provide information necessary to support eligibility verification and contract performance

10.0 Miscellaneous

FAR 52.224-3 PRIVACY TRAINING – ALTERNATE I (SEE FAR CLASS DEVIATION 17-03, REVISION 1)

(a) Definition. As used in this clause, personally identifiable information means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A–130, Managing Federal Information as a Strategic Resource).

(b) The Contractor shall ensure that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who—

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of an agency; or

(3) Design, develop, maintain, or operate a system of records (see also FAR subpart 24.1 and 39.105).

(c) The contracting agency will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract. Contractor employees shall satisfy this requirement by completing Privacy at DHS: Protecting Personal Information accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Training shall be completed within 30 days of contract award and be completed on an annual basis thereafter not later than October 31st of each year.

(d) The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.

(e) The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

(f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will—

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

(3) Design, develop, maintain, or operate a system of records.

HSAR 3052.240-71 CONTRACTOR EMPLOYEE ACCESS (JULY 2023) (HSAR DEVIATION 25-12) (Effective November 3, 2025)

a. Controlled Unclassified Information (CUI) is any information the Government creates or possesse s, or an entity creates or possesses for or on behalf of the Government (other than

Learn more at fema.gov June 2021 10 classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

1. Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

2. Protected Critical Infrastructure Information (PCII) as set out in the Critical

Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

3. Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of

Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

4. Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

5. Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

6. International Agreement Information means information the Department of Homeland

Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

7. Information Systems Vulnerability Information (ISVI) means:

Learn more at fema.gov June 2021 11

i. Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

ii. Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

8. Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

9. Personnel Security Information means information that could result in physical risk to

Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

10. Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

11. Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

i. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

ii. Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII

Learn more at fema.gov June 2021 12 may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

A. Truncated SSN (such as last 4 digits);

B. Date of birth (month, day, and year);

C. Citizenship or immigration status;

D. Ethnic or religious affiliation;

E. Sexual orientation;

F. Criminal history;

G. Medical information; and H. System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

iii. Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted indivi dual.

b. Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

c. Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer.

Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

d. The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

e. Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government’s activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

Learn more at fema.gov June 2021 13

f. The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

HSAR 3052.240-71 CONTRACTOR EMPLOYEE ACCESS ALT I (HSAR DEVIATION 25-12) (Effective November 3, 2025)

(g) Before receiving access to information resources under this contract, the individual must complete a security briefing; additional training for specific categories of CUI, if identified in the contract; and any nondisclosure agreement furnished by DHS. The Contracting Officer's Representative (COR) will arrange the security briefing and any additional training required for specific categories of CUI.

(h) The Contractor shall have access only to those areas of DHS information resources explicitly stated in this contract or approved by the COR in writing as necessary for performance of the work under this contract. Any attempts by Contractor personnel to gain access to any information resources not expressly authorized by the terms and conditions in this contract, or as approved in writing by the COR, are strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

(i) Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Contractor performs business for DHS. It is not a right, a guarantee of access, a condition of the contract, or government-furnished equipment (GFE).

(j) Contractor access will be terminated for unauthorized use. The Contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

(k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management, or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department's Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

(1) There must be a compelling reason for using this individual as opposed to a U.S. citizen; and

(2) The waiver must be in the best interest of the Government.

(l) Contractors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

HSAR 3052.240-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (HSAR DEVIATION 25-12) (Effective November 3, 2025)

a. Definitions. As used in this clause— Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the

Learn more at fema.gov June 2021 14 agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

1. Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

2. Protected Critical Infrastructure Information (PCII) as set out in the Critical

Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

3. Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of

Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

4. Homeland Security Agreement Information means information the Department of

Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

5. Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

6. International Agreement Information means information the Department of Homeland

Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any

Learn more at fema.gov June 2021 15 element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

7. Information Systems Vulnerability Information (ISVI) means:

i. Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

ii. Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

8. Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

9. Personnel Security Information means information that could result in physical risk to

Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

10. Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

11. Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

Learn more at fema.gov June 2021 16

i. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

ii. Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also c onsist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

A. Truncated SSN (such as last 4 digits);

B. Date of birth (month, day, and year) C. Citizenship or immigration status;

D. Ethnic or religious affiliation;

E. Sexual orientation;

F. Criminal history;

G. Medical information; and H. System authentication information, such as mother’s birth name, account

iii. Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted indivi dual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

1. Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

2. Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

Learn more at fema.gov June 2021 17

1. Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

2. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; an

3. Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

b. Handling of Controlled Unclassified Information.

1. Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

2. The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

3. The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions.

It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

4. Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

c. Incident Reporting Requirements.

1. Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training- requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors

Learn more at fema.gov June 2021 18

2. All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

3. CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

4. An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

5. If an incident involves PII or SPII, in addition to the incident reporting guidelines in

Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

i.Unique Entity Identifier (UEI);

ii.Contract numbers affected unless all contracts by the company are affected;

iii. Facility CAGE code if the location of the event is different than the prime Contractor location

iv. Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

v.Contracting Officer POC (address, telephone, and email);

vi.Contract clearance level;

vii. Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

viii.Government programs, platforms, or systems involved;

ix.Location(s) of incident;

x.Date and time the incident was discovered;

xi. Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

xii.Description of the government PII or SPII contained within the system; and xiii.Any additional information relevant to the incident.

d. Incident Response Requirements.

1. All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules

Learn more at fema.gov June 2021 19

2. The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

3. Incident response activities determined to be required by the Government may include, but are not limited to, the following:

i.Inspections;

ii.Investigations;

iii.Forensic reviews;

iv.Data analyses and processing; and v.Revocation of the Authority to Operate (ATO), if applicable.

4. The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

5. The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

e. Certificate of Sanitization of Government and Government-Activity-Related Files and

Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

f. Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

g. Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

HSAR 3052.240-73 NOTIFICATION AND CREDIT MONITORING REQUIREMENTS FOR PERSONALLY

IDENTIFIABLE INFORMATION INCIDENTS (HSAR DEVIATION 25-12) (Effective November 3, 2025)

a. Definitions. Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other

Learn more at fema.gov June 2021 20 information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether informati on is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

1. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

2. Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

i.Truncated SSN (such as last 4 digits);

ii.Date of birth (month, day, and year);

iii.Citizenship or immigration status;

iv.Ethnic or religious affiliation;

v.Sexual orientation;

vi.Criminal history;

vii.Medical information; and viii.System authentication information, such as mother’s birth name, account

3. Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

b. PII and SPII Notification Requirements.

1. No later than 5 business days after being directed by the Contracting…