RNCC-15-50048_-_NGA_Policy_Academy_SOW_and_Clauses.pdf

STATEMENT OF WORK (SOW)

Policy Academy for Emergency Communications

1.0 GENERAL

This requirement is for the U.S. Department of Homeland Security (DHS), National Protection and Programs Directorate (NPPD), Office of Cybersecurity and Communications (CS&C), Office of Emergency Communications (OEC). The Contractor will execute a Policy Academy to address emerging issues within the Emergency Communications mission area.

1.1 BACKGROUND

Per 6 U.S.C. 194(g)(1) the term “interoperable communications” means the ability of emergency response providers and relevant Federal, State, and local government agencies to communicate with each other as necessary, through a dedicated public safety network utilizing information technology systems and radio communications systems, and to exchange voice, data, and video with one another on demand, in real time, as necessary.

Emergency Communications interoperability refers to the ability of public safety officials to share information via voice and data signals on demand, in real time, when needed, and as authorized. Response teams that include fire, police, and others continue to use incompatible communications equipment and/or systems, making interoperability one of the most critical issues facing public safety today. There are a variety of challenges to interoperability: some are technical, some financial, and some stem from human factors such as inadequate planning and lack of awareness of the real importance of interoperability.

Beyond these, however, lie policy, leadership, and governance issues that remain to be addressed.

The Office of Emergency Communications (OEC), within the Office of Cyber Security and Communications, partners with public safety personnel, at all levels of government, to lead the nationwide effort to improve emergency communications capabilities. The Policy and Planning Branch advises OEC and CS&C leadership through policy options, strategic planning initiatives, research projects, and targeted outreach activities to support identified mission priorities. The Policy and Planning Branch leads an integrated approach to policy development and analysis within OEC and is responsible for developing short, mid, and long range plans that impact the status of public safety communications capabilities across the country.

1.2 SCOPE

Per 6 USC 571 (c)(8), the Office of Emergency Communications (OEC) is charged with promoting “the development of standard operating procedures and best practices with respect to use of interoperable emergency communications capabilities for incident response, and facilitate the sharing of information on such best practices for achieving, maintaining, and enhancing interoperable communications capabilities for such response” The Contractor shall support the Office of Emergency Communications (OEC) in achieving that program mission by delivering a policy academy on Emergency Communications. A policy academy is a unique service that uses a highly interactive, team-based process for helping a select number of states develop and implement an action plan to address a complex public policy issue. Participating states receive guidance and technical assistance from contractor staff and faculty experts, as well as consultants from the private sector, research organizations, academia and the federal government. The strategies and policies developed by the selected states are intended to serve as catalyst for best practices to be implemented in all states. The Contractor is to provide direct technical assistance to individual governors' offices on a variety of emergency communications policy areas and provide association representation to a number of national policy committees and advisory boards.

1.3 OBJECTIVE

To obtain the Contractors assistance in designing and delivering a policy academy to help states develop interoperable emergency communications plans and systems.

The Contractor will support OEC in the following key areas:

• Build upon the goals and objectives described in the National Emergency

Communications Plan (NECP) to develop and enhance governance capacities at the state level for public safety emergency communications interoperability;

• Educate governors and their key policy staff on the critical importance of pursuing aggressive improvements to the state-level governance structures that inform and direct the deployment and utilization of emergency communications interoperability among public safety and emergency services agencies;

• Determine and report on the current status of emergency communications governance initiatives in the various states;

• Provide a forum for public policymakers to discuss interoperability in a less technical, more policy-oriented environment;

• Identify barriers to implementing statewide interoperability plans as well as strategies for eliminating them to help states achieve interoperability objectives;

• Participate with selected states in employing a planning process to address comprehensive statewide strategies to improve emergency communications and public safety interoperability;

• Disseminate outcomes from the policy academy to all states and the broader public safety wireless interoperability community;

1.4 APPLICABLE DOCUMENTS

1. 6 U.S.C. 571 - Office of Emergency Communications -http://www.gpo.gov/fdsys/granule/USCODE-2010-title6/USCODE-2010-title6-chap1-subchapXIII-sec571/content-detail.html

2. Middle Class Tax Relief and Job Creation Act of 2012 (the Spectrum Act) -http://www.gpo.gov/fdsys/pkg/PLAW-112publ96/pdf/PLAW-112publ96.pdf

3. Implementing Recommendations of the 9/11 Commission Act of 2007 (P. L. No. 110-53) https://www.nsa.gov/civil_liberties/_files/pl_110_53_sec_803_9_11_committee_act.pdf http://www.gpo.gov/fdsys/granule/USCODE-2010-title6/USCODE-2010-title6-chap1-subchapXIII-sec571/content-detail.html http://www.gpo.gov/fdsys/granule/USCODE-2010-title6/USCODE-2010-title6-chap1-subchapXIII-sec571/content-detail.html http://www.gpo.gov/fdsys/pkg/PLAW-112publ96/pdf/PLAW-112publ96.pdf https://www.nsa.gov/civil_liberties/_files/pl_110_53_sec_803_9_11_committee_act.pdf

4. Current and future versions of the Quadrennial Homeland Security Review -http://www.dhs.gov/quadrennial-homeland-security-review-qhsr

5. National Emergency Communications Plan -https://www.dhs.gov/xlibrary/assets/national_emergency_communications_plan.pdf

6. SAFECOM Grant Guidance -http://www.safecomprogram.gov/ecg/2013_safecom_guidance_feb_22_final.pdf

7. The First Responder Network (FirstNet) and Next-Generation Communications for Public Safety: Issues for Congress (march 2014) – http://fas.org/sgp/crs/homesec/R42543.pdf

8. National Incident Management System -http://www.fema.gov/pdf/emergency/nims/NIMS_core.pdf

9. National Response Framework - http://www.fema.gov/national-response-framework

10. Federal Emergency Management Agency. A Whole Community Approach to Emergency

Management: Principles, Themes, and Pathways for Action -https://www.fema.gov/media-library/assets/documents/23781

11. The National Preparedness Goal - http://www.fema.gov/media-library-data/20130726- 1828-25045-9470/national_preparedness_goal_2011.pdf

12. Congressional Research Service – Funding Emergency Communications: Technology and Policy Considerations, https://www.fas.org/sgp/crs/homesec/R41842.pdf

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 Host an Experts Roundtable

The Contractor will host a one-day experts’ roundtable, convening subject matter experts from the federal government, state government, academia, and the private sector to identify critical issues and resources related to emergency communications interoperability. The roundtable will focus on the current status of governance structures and highlight interoperability best practices. Further, it will serve to inform policy academy activities, goals, and objectives.

Drawing from information and insights gathered from the roundtable, as well as from the Contractors’ experience with previous interoperability projects, the Contractor will develop and distribute a planning document states can use to formulate strategies for overcoming barriers to interoperability. The guide will provide states criteria for how to design a planning process for implementation.

2.2 Issue a Request for Proposals Inviting States to Participate in the Policy Academy

The Contractor will develop and distribute a request for proposals from governors to participate in a statewide planning process for interoperability. Each state will create a project team composed of key state personnel involved in public safety communications interoperability. Team members will be designated by the governor.

http://www.dhs.gov/quadrennial-homeland-security-review-qhsr https://www.dhs.gov/xlibrary/assets/national_emergency_communications_plan.pdf http://www.safecomprogram.gov/ecg/2013_safecom_guidance_feb_22_final.pdf http://fas.org/sgp/crs/homesec/R42543.pdf http://www.fema.gov/pdf/emergency/nims/NIMS_core.pdf http://www.fema.gov/national-response-framework https://www.fema.gov/media-library/assets/documents/23781 http://www.fema.gov/media-library-data/20130726-1828-25045-9470/national_preparedness_goal_2011.pdf http://www.fema.gov/media-library-data/20130726-1828-25045-9470/national_preparedness_goal_2011.pdf https://www.fas.org/sgp/crs/homesec/R41842.pdf

The Contractor, in consultation with DHS OEC, will review proposals and select states based on jointly developed criteria. Selected states will receive sub-grants in the amount of $15,000 per state to carry out their planning efforts.

2.3 Host Two Policy Academy Meetings for Participating States

The Contractor will convene participating state teams for two meetings during which they will learn about best practices for improving system interoperability. The meetings will also provide them a forum for sharing lessons learned and discussing common challenges. During the meetings, teams will participate in a facilitated process to help them develop a plan for improving interoperability communications in their states. Expert faculty will attend the meetings to assist states with developing their plans.

2.4 Conduct Workshops in Each State and Provide Ongoing Technical Assistance

The Contractor will conduct one in-state workshop in each of the five participating states.

In addition, the Contractor, in consultation with the project interoperability resource group, will develop and implement a technical assistance plan to support state efforts to implement interoperable strategies. Technical assistance may include site visits and ongoing correspondence with state team members.

2.5 Develop a Report on Outcomes of the Policy Academy

The Contractor will develop a report highlighting the experiences of states engaged in the policy academy as well as best practices for developing interoperable communications plans. This report will be disseminated to governors’ offices, Chief Information Officers, Statewide Interoperability Coordinators, state agencies, SAFECOM, and the public safety wireless interoperability community.

Completed Deliverables Shall Include These Tasks:

• The contractor shall provide the OEC Policy and Planning Branch with program implementation tools (plans, trackers, analysis) necessary to ensure that the National Emergency Communications Plan (NECP) programmatic and statutory requirements are met (See 5.0 Deliverables).

• The contractor shall research, analyze, and disseminate relevant regulatory and statutory authorities that could affect state and national emergency communications and public safety communications capabilities, with a specific emphasis on governance structures.

• The contractor shall provide OEC implementation tools (examples include, but are not limited to, plans, trackers, and analysis) necessary to administer and manage this project.

• The contractor shall track, document, and report on emergency communications best practices (See 4.0 Deliverables).

• The contractor will develop detailed program/project management plans related to emergency communications planning projects.

2.6 Program Management Support

Based on the need for concerted program oversight, a comprehensive project management system must be created to include financial tracking, accomplishments tracking, and master scheduling of multiple tasks and teams so that OEC can provide oversight with the highest level of transparency, analysis, and reliability (See 5.0 Deliverables).

2.6.1 Tasks Shall Include

• The contractor shall develop meeting agenda for monthly program management, stakeholder meetings, and other ad hoc meetings (See 5.0 Deliverables).

• The contractor shall create and provide web content, as requested by the OEC program managers (See 5.0 Deliverables).

• The contractor shall track and/or prepare summary reports of financial and programmatic activities.

• The contractor will support the development of program management plans for accomplishing the specified goals, objectives, and tasks. These plans shall describe the administrative functions, technical approach, organizational resources, management controls and quality assurance monitoring that the contractor shall employ to meet the cost, performance and schedule requirements throughout the task order period of performance (See 5.0 Deliverables).

4.0 POST AWARD CONFERENCE

The Contractor shall attend a Post Award Conference with the CO and COR no later than eight

(8) business days after date of award. The purpose of the Post Award Conference, which will be chaired by the CO, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at a Government’s facility.

5.0 DELIVERABLES

The following deliverables are required under this task order:

SOW Task Title Due

All Monthly Status Report 10th business day of the month

2.1; 2.2 Analysis of relevant regulatory, legal, and policy statements, documents, and updates

Ongoing effort

2.1; 2.2; 2.3; 2.5 Program briefing materials 5 business days before briefing

2.1; 2.2; 2.3; 2.5 Program analysis reports Ongoing effort

2.1; 2.2; Best Practices Documentation Ongoing effort

2.1; 2.2 Fact Sheets/Public Service Offerings

30-120 calendar days after initial assignment

2.1; 2.2; Policy Documents Draft due 10 business days after assignment

2.2 Programmatic Guidance Draft due 10 business days

after assignment

2.1; 2.2 Email inquiry responses Draft due 5 business days after receipt

2.1; 2.2 Internal and External Web Content

30-60 calendar days after initial assignment

2.1; 2.2; 2.3; 2.4 Meeting agenda 2 business days before meeting

2.1; 2.2; 2.3; 2.5 Minutes from Meetings 2 business days after meeting

2.1; 2.2; Responses to ad hoc requests for information or analysis

Draft is due 5 business days after receipt

2.1; 2.2 Monitoring and tracking system 30-180 calendar days after initial assignment

2.2 Program management assistance

tools, templates, and handbook

30-180 calendar days after initial assignment

2.1; 2.2 Respond to stakeholder assistance requests

Initial contact within 2 business days of receipt

2.1; 2.2 Response to OEC Policy federal program staff

Initial response within 2 days of inquiry

2.1; 2.2 Coordinate with Emergency Communications SMEs

Ongoing effort

2.1; 2.2 Conference Planning, including site research and determination of requirements, development of conference materials, conference on-site support services, and after action documentation.

30-60 calendar days after assigned

2.1; 2.2; 2.3; 2.5 P&P deliverable tracking 30-360 calendar days after award

5.0 Post Award Conference Not Later than (8) business

days after Date of Award

(DOA)

6.1 STANDARD DELIVERABLES DISTRIBUTION and REPORT REQUIREMENTS

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows Operating System (OS) and Microsoft Office Suites).

• 1 copy of the transmittal letter without the deliverable to the CO

• 1 copy of the transmittal letter and one (1) soft copy of the deliverables to the COR

All deliverables shall meet professional standards to include no spelling and grammatical errors and adhere to the requirements outlined in the SOW.

7.0 OTHER APPLICABLE CONDITIONS

7.1 SECURITY

Contract employees may not access sensitive Government information or Government IT systems. Limited access to Government buildings is allowable. This limited access is to allow Contractors to attend briefings, non-recurring meetings and begin work. No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable EOD decision or suitability determination by the Security Office.

All services provided will be in accordance with DHS Management Directive 4300.1 as implemented by DHS 4300A and/or 4300B Policies and Handbooks. Access to DHS IT Systems is governed by DHS 4300A, Sensitive Systems Policy, and DHS 4300 A, DHS National Security System Handbook.

7.2 Security Requirements

This contract does not involve access to information classified “Confidential,” “Secret,” or “Top Secret.”

7.3 Access to Unclassified Facilities, Information Technology Resources, and Sensitive Information

The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive but Unclassified (For Official Use Only) Information, describes how contractors must handle sensitive but unclassified information. DHS MD 4300.1 Information Technology Systems Security and the DHS Sensitive Systems Handbook prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering contractors specifically for all Task Orders that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the contractor except as specified in the task order.

7.4 Security Review

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer, the Office of the Inspector General, authorized COR, and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

7.5 Interconnection Security Agreements

Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements.

7.6 Contractor Employee Access

(a) Sensitive Information, as used in this Chapter, means any information, the loss, misuse, disclosure, or unauthorized access to or modification of which could adversely affect the national or homeland security interest, or the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

(b) “Information Technology Resources” include, but are not limited to, computer equipment, networking equipment, telecommunications equipment, cabling, network drives, computer drives, network software, computer software, software programs, intranet sites, and internet sites.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer.

Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the contractor to prohibit individuals from working on the contract if the government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, and insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to sensitive information. Therefore, the Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the Contracting Officer. For those contractor employees authorized access to sensitive information, the contractor shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

(f) The Contractor shall include the substance of this clause in all subcontracts at any tier where the subcontractor may have access to Government facilities, sensitive information, or resources.

(g) Before receiving access to IT resources under this contract the individual must receive a security briefing, which the COR will arrange, and complete any nondisclosure agreement furnished by DHS.

(h) The contractor shall have access only to those areas of DHS information technology resources explicitly stated in this contract or approved by the COR in writing as necessary for performance of the work under this contract. Any attempts by contractor personnel to gain access to any information technology resources not expressly authorized by the statement of work, other terms and conditions in this contract, or as approved in writing by the COR, is strictly prohibited.

In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

(i) Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the contractor performs business for the DHS Component. It is not a right, a guarantee of access, a condition of the contract, or Government Furnished Equipment

(GFE).

(j) Contractor access will be terminated for unauthorized use. The contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

(k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department’s Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

(1) The individual must be a legal permanent resident of the U.S. or a citizen of Ireland, Israel, the Republic of the Philippines, or any nation on the Allied Nations List maintained by the Department of State;

(2) There must be a compelling reason for using this individual as opposed to a U.S. citizen; and

(3) The waiver must be in the best interest of the Government.

(l) Contractors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the contracting officer.

8.0 PERIOD OF PERFORMANCE

The period of performance for this contract is one year from the date of award.

9.0 PLACE OF PERFORMANCE

Work will primarily be performed at the Contractors facilities, with allowances for some work to be performed at the Government facility. The current Government work site is 4601 North Fairfax Drive Arlington, VA 22201.

10. TRAVEL

Travel is required to support participation in meetings, conference activities, program reviews, and site visits. The Contractor shall request authorization from the COR at least two weeks prior to the commencement of Contractor travel. The Government will not reimburse local travel [within a fifty (50) mile radius of the assigned worksite].

11. OTHER DIRECT COST

All material required for performance under this task order that are not Government-furnished, are to be acquired by the Contractor as authorized by the CO and COR. Ownership of supplies acquired by the Contractor with Government funds, for performance of this task order, shall vest with the Government. The Contractor shall include a detailed description of all proposed other direct costs (ODCs) to the CO and COR for this task order.

12. GOVERNMENT FURNISHED RESOURCES

The Government will provide Government-Furnished Equipment (GFE) if the mission requires, the Contractor requests, and the COR concurs. Upon completion of this task order, the Contractor shall furnish a complete inventory of all GFE remaining in their possession. The Program Office will furnish disposition instructions on all property furnished or purchased under this SOW.

Government-Furnished Information (GFI) (examples include, but are not limited to, software, manuals, drawings, and test data) will be provided at Contractor’s request or when the mission requires. The list shall include description (title, data, and author), quantities and license numbers. Upon completion of this task order, the Contractor shall furnish a complete inventory or all GFI remaining in their possession. The Program Office will furnish disposition instructions on all property furnished or purchased under this SOW.

13. GOVERNMENT ACCEPTANCE/REJECTION PERIOD

The Government Task Lead will review draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance within the guidelines/requirements of the task order and will inform the COR/ACOR of its acceptability.

The Contractor shall ensure the accuracy and completeness of all deliverables in accordance with referenced policy, regulations, laws, and directives. Reports and presentations shall be concise and clearly written. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and “padding”, or excessive length if a page limit is imposed, shall be considered deficiencies and will be subject to correction by the Contractor at no additional cost to the Government. Unless otherwise indicated, the Government will require 20 business days to review and comment on deliverables. If the deliverable does not meet the noted criteria, the Government will return it.

A rejected deliverable will be handled in the following manner:

• After notification that the deliverable did not meet the acceptance criteria the Contractor shall resubmit updated/corrected version 10 business days after receipt of government comments

• Upon the Contractor’s re-submission, the Government will reapply the same acceptance criteria. If the deliverable does not meet it a second time, the Government might consider the Contractor as having deficient performance with respect to the task.

14. INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

All Contractor employees using Department automated systems or processing Department sensitive data shall be required to receive Security Awareness Training. This training will be provided by the appropriate component agency of DHS. Contractors involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the Department, shall receive periodic training at least annually in security awareness and accepted security practices and systems rules of behavior.

Department Contractors, with significant security responsibilities, shall receive specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Department information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer (ISSO).

15. EMPLOYEE CONDUCT

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security.

16. REMOVING EMPLOYEES FOR MISCONDUCT OR SECURITY REASONS

The Government may, at its sole discretion (via the Contracting Officer), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons.

Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

17. TERMINATIONS/RESIGNATIONS

The contractor will notify the SSO/OSASM and COR of all terminations/resignations of contractor personnel assigned to this contract five (5) working days before the last day of employment. In the event this notification is not possible, the SSO/OSASM and COR should be notified immediately. The contractor shall return to the SSO/OSASM all DHS-issued identification cards and building passes that have either expired or have been collected from terminated employees. If an identification card or building pass is not available to be returned, a report shall be submitted to the SSO/OSASM and COR, referencing the pass or card number, name of individual to whom it was issued and the last known location and disposition of the pass or card.

18. PRIVACY REQUIREMENTS

(a) Required Security and Privacy Training for Contractors

Contractor shall provide training for all employees and subcontractors that have access to Sensitive Personally Identifiable Information (SPII) as well as the creation, use, dissemination and / or destruction of SPII, at the outset of the subcontractor’s /employee’s work on the contract and every year thereafter. Said training would include procedures on how to properly handle SPII, to include security requirements for transporting or transmitting SPII information, requirements for reporting a suspected breach or loss of SPII within one hour, and supporting privacy compliance and breach management activities. The Contractor must submit an e-mail notification to the NPPD Contracting Officer Representative (COR) that all the contractor’s employees have received privacy training prior to the beginning of the contract.

The Federal Information Security Management Act (FISMA) requires all individuals accessing NPPD information, regardless of their employment status, be they Federal or contractor employees, to take the annual Information Security and Records Management Training annually. Both courses (Information Security and Records Management) can be obtained via government provided CD. Contractor shall maintain copies of certificates as a record of compliance. The Contractor must submit an annual e-mail notification to the NPPD COR that the required Information Security, Records Management, and Privacy training has been completed for all the contractor’s employees.

The privacy training can be obtained via government-provided CD or through the Homeland Security Information Network at https://share.dhs.gov/nppdprivacy101training/. DHS has also published a guidebook defining SPII and setting standards for SPII handling and protection. The DHS Handbook for Safeguarding SPII is a 30-page public document on the DHS Privacy Office website.

Link:

http://www.dhs.gov/sites/default/files/publications/privacy/Guidance/handbookforsafegua rdingsensitivePII_march_2012_webversion.pdf

(b) Suspected loss or compromise of SPII [Breach]

(1) Contractor must report the suspected loss or compromise of SPII by its employees or subcontractors to the DHS Help Desk at 1-800-250-7911 within one (1) hour of the initial discovery.

(2) The Contractor must develop and include in its Security Plan an internal system by which its employees and subcontractors are trained to identify and report potential loss or compromise of SPII.

(3) The Contractor must provide a written report to NPPD COR and NPPD Office of Privacy at NPPDPrivacy@hq.dhs.gov within 24 hours of the suspected loss or compromise of SPII containing the following information:

https://share.dhs.gov/nppdprivacy101training/ http://www.dhs.gov/sites/default/files/publications/privacy/Guidance/handbookforsafeguardingsensitivePII_march_2012_webversion.pdf http://www.dhs.gov/sites/default/files/publications/privacy/Guidance/handbookforsafeguardingsensitivePII_march_2012_webversion.pdf mailto:NPPDPrivacy@hq.dhs.gov

a. Narrative, detailed description of the events surrounding the suspected loss/compromise.

b. Date, time, and location of the incident.

c. Type of information lost or compromised.

d. Contractor’s assessment of the likelihood that the information was compromised or lost and the reasons behind the assessment.

e. Names of person(s) involved, including victim, Contractor employee/subcontractor and any witnesses.

f. Cause of the incident and whether the company’s security plan was followed or not, and which specific provisions were not followed.

g. Actions that have been or will be taken to minimize damage and/or mitigate further compromise.

h. Recommendations to prevent similar situations in the future, including whether the security plan needs to be modified in any way and whether additional training may be required.

(4) Notwithstanding any other remedies available to NPPD, the contractor will indemnify the NPPD against all liability (including costs and fees) for any damages arising out of violations of this clause.

(5) The Contractor must cooperate with NPPD or other government agency inquiries into the suspected loss or compromise of SPII to facilitate activities outlined in the Department of Homeland Security (DHS) Privacy Incident Handling Guide (PIHG) and Office of Management and Budget M-07-16, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” May 22, 2007.

The DHS PIHG is a 88-page public document on the DHS Privacy Office website.

Link: http://www.dhs.gov/xlibrary/assets/privacy/privacy_guide_pihg.pdf.

(6) At the government’s discretion, Contractor employees or subcontractor employees may be identified as no longer eligible to access SPII or to work on that contract based on their actions related to the loss or compromise of SPII.

(7) In the event that a SPII breach occurs as a result of the violation of a term of this contract by the Contractor or its employees, the Contractor shall, as directed by the contracting officer and at no cost to the Government, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected individuals for a period not to exceed 12 months from discovery of the breach. Should the Government elect to provide and/or procure notification or identity protection services in response to a breach, the Contractor will be responsible for reimbursing the Government for those expenses.

Definitions.

“Breach” (may be used interchangeably with “Privacy Incident’) as used in this clause means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where http://www.dhs.gov/xlibrary/assets/privacy/privacy_guide_pihg.pdf persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, in usable form whether physical or electronic.

“Personally Identifiable Information (PII)” as used in this clause means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States.

Examples of PII include: name, date of birth, mailing address, telephone number, Social Security Number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), Internet protocol addresses, biometric identifiers (e.g., fingerprints), photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Personally Identifiable Information (Sensitive PII)” as used in this clause is a subset of Personally Identifiable Information, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Complete social security numbers (SSN), alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered Sensitive PII even if they are not coupled with additional PII. Additional examples include any groupings of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Criminal history

(5) Medical information

(6) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other Personally Identifiable Information may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains Personally Identifiable Information but it is not sensitive.

If there is a section that lists “Reference Documents,” the following language should be provided.

The Contractor shall be responsible for collecting, maintaining, and adhering to the content within the documents below which shall always be read as “as amended” or “latest edition” including all referenced documents. This list is not considered all-inclusive, therefore other applicable reference or compliance documents may apply to the performance of this contract.

• Office of Management and Budget M-07-16, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” May 22, 2007

• DHS Handbook for Safeguarding Sensitive Personally Identifiable Information, Updated March 2012

• DHS Privacy Incident Handling Guide, Version 3.0, January 26, 2012

(c) Requirements to Support Completion of Privacy Compliance Documents

(1) The Contractor agrees to support the completion of the Privacy Threshold Analysis (PTA) document when it is required. PTAs are triggered by the creation, modification, upgrade, or disposition of an IT system, and must be renewed at least every three years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide adequate support to complete the PIA in a timely manner, and shall ensure that project management plans and schedules include the PTA, PIA, and SORN (to the extent required) as milestones. Additional information on the privacy compliance process at DHS, including PTAs, PIAs, and SORNs, is located on the DHS Privacy Office website (www.dhs.gov/privacy) under “Privacy Compliance Process & Templates.” DHS Privacy Policy Guidance Memorandum 2008-02 sets forth when a PIA will be required at DHS, and the Privacy Impact Assessment Guidance and Template outline the requirements and format for the PIA.

(d) Key Personnel

(1) The Privacy Lead shall be responsible for providing adequate support to DHS to ensure DHS can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance. The Privacy Leads shall work with personnel from the program office, the NPPD Office of Privacy Office, the Office of the Chief Information Officer, and the Records Management Branch to ensure that the privacy documentation are kept on schedule, that the answers to questions in the PIA are thorough and complete, and that questions asked by the NPPD Office of Privacy and other offices are answered in a timely fashion.

• Candidate must have excellent writing skills, the ability to explain technology clearly for a non-technical audience, and to synthesize information together from a variety of sources.

• Candidate must have excellent verbal communication and organizational skills.

http://www.dhs.gov/privacy

• Candidate must have experience writing PIAs. Ideally the candidate would have experience writing PIAs for DHS.

• Candidate must be knowledgeable about the Privacy Act of 1974 and the E-Government Act of 2002.

• Candidate must be able to work well with others.

(e) Reference Documents

(1) The Contractor shall be responsible for collecting, maintaining, and adhering to the content within the documents below, which shall always be read as “as amended” or “latest edition” including all referenced documents. This list is not considered all-inclusive, therefore other applicable reference or compliance documents may apply to the performance of this contract.

• DHS Instruction 047-01-001 Privacy Policy and Compliance

• DHS Privacy Impact Assessment Guidance

• DHS Privacy Policy Guidance Memorandum 2011-02 Roles and

Responsibilities for Shared IT Services

• DHS Privacy Policy Guidance Memorandum 2008-02, DHS Policy

Regarding Privacy Impact Assessments, December 30, 2008

• DHS System of Records Notices Official Guidance, April 2008

19. RE-DISTRIBUTION RIGHTS

All Contractor developed processes and procedures and other forms of intellectual property developed during this contract shall be Government property.

All documentation and electronic data and information collected by the Contractor and generated in support of this contract shall be Government property, and shall be returned to the Government at the end of the performance period or when specified in the task order.

20. PROTECTION OF INFORMATION

Contractor access to proprietary information is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with DHS MD 11042.1, Safeguarding Sensitive but Unclassified (For Official Use Only) Information. The Contractor shall ensure that all Contractor personnel having access to business or procurement sensitive information sign a non-disclosure agreement (DHS Form 11000-6).

21. SECTION 508 COMPLIANCE

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

22. SECTION 508 APPLICABLE EIT ACCESSIBILITY STANDARDS

36 CFR 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required

1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using

TTY.

23. SECTION 508 APPLICABLE EXCEPTIONS

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

24. SECTION 508 COMPLIANCE REQUIREMENTS

36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response…