Att2-SOW-Online Commun.pdf

SBAHQ-11-R-0002

- 1 -

Statement of Work

Online Communications Support Services

1. Background & Introduction:

The Small Business Administration (SBA) has been providing assistance to Americans to start, build, and grow businesses for nearly 60 years. The SBA is the one government agency with direct responsibility for assisting the nation’s 29 million small businesses. The current SBA.gov

Web site serves millions of users each year.

In 2010 and 2011, the SBA has taken strides to improve its overall approach to online media, strengthen its ability to provide enhanced information services, and to build a personalized and dynamic Web site. As such, SBA is currently improving its primary SBA.gov Web site to broaden the scope of online services it provides, and to make it more user-centric and focused on the needs of the small business and lender communities. The new site merges key elements of current SBA online media resources, in particular the SBA.gov and Business.gov Web sites.

The SBA requires a wide range of technical support, including strong strategic planning/thought leadership, technology management, product and content strategy, architecture and development, and operations and maintenance support for this new, dynamic SBA.gov Web site.

2. Scope:

This contract is anticipated to be an Indefinite Quantity/Indefinite Delivery (IDIQ) contract.

Areas of support are:

Strategic Planning/Thought Leadership. Assist the SBA to assess and incorporate features and applications that leverage the best technologies and improve SBA.gov’s abilities in operational areas such as accessibility, ease of use, functionality, citizen engagement and communications.

Product Management and Product Strategy. Assist the SBA in developing and maintaining mid- and long-term plans for continuous improvement of the SBA.gov Web site. Establish procedures for visioning, planning, and implementing multiple releases each year and assist

SBA staff in taking a product approach to the Web Management activity.

Content Development and Management. Assist the SBA to develop and maintain an ongoing

Content Strategy, a Content Plan, and to develop and publish content while ensuring quality control.

Web Design and Development. Assist the SBA to develop and implement new templates, tools, and features in accordance with the agency’s standards and online media strategy.

Update the user interface and navigation approach in response to user feedback. Develop and implement strong usability testing procedures and facilitate usability sessions at periodic intervals.

Social Media Management. Sustain and update social media capabilities with SBA channels in a manner that effectively conveys program content, fosters a community environment, encourages communication, and sustains a safe and productive engagement tool for SBA customers.

- 2 -

Technical Analyses and Documentation. Conduct market research, requirements analyses, and technical analyses, and develop and deliver technical documents. (What kind of technical documents. Describe deliverable, i.e., report of demographic use, etc.)

System Operations and Maintenance Support. Coordinate architecture creation. Provide system upgrade design and development. Assist the Program Office to develop and update realistic Concepts of Operation and objectives; update and extend these to support anticipated system releases. Manage system release schedule. Support and sustain system configurations and Configuration Management processes. Assist the SBA to procure, sustain, and manage services and applications required to support SBA online media capabilities. Assist in developing and sustaining a robust operating environment. Devise and implement comprehensive metrics for monitoring system operations and take action to ensure the portal operates effectively and reliably. Participate in operational and business process planning and ensure appropriate maintenance milestones are incorporated into the schedule. Develop and sustain robust reliability and availability standards. Develop and support comprehensive preventive and corrective maintenance procedures and ensure that such procedures are incorporated into all system-related plans and activities. Ensure the maintenance of strong system backup and Disaster Recovery plans and procedures. Closely coordinate activities with the SBA.gov hosting facility.

3. Technical Requirements:

The SBA needs strong, comprehensive technical support in a wide range of system areas, as described in the following paragraphs.

3.1 Strategic Planning

The SBA desires strong creative leadership and ingenuity to apply up to date Web and social media resources and applications to create and sustain a vibrant, relevant, active site.

Activities within this subtask include, but are not limited to:

Provide leadership to creatively update features and capabilities of SBA.gov that further the mission of the Small Business Administration.

Work closely with Web Design and Product Management to ensure that pertinent features and applications are incorporated into the Product Strategy.

Propose considered, creative ways to use emerging technologies to enhance SBA.gov, engage customers, and further the SBA’s mission. Assist the SBA to implement those that are approved.

Conduct appropriate market research, usability testing, and product testing to ensure that desired new features and applications are appropriate and cost effective for incorporation into SBA.gov and its social media strategy.

3.2 Product Management and Product Strategy

The Contractor shall develop and implement a comprehensive and dynamic Product

Strategy. Activities within this subtask include, but are not limited to:

Provide Product Management support, in accordance with established Business

Processes. Develop and maintain an ongoing Product Strategy. Devise product features.

Create data management processes. Develop testing strategies. Develop a comprehensive and effective release management process.

Create, collect, and maintain product and usage metrics. Use existing SBA applications where appropriate. Conduct user research; provide analysis of user responses from

- 3 -usability software and focus group studies. Incorporate findings into Product Strategy.

Suggest new performance metrics for measuring the effectiveness of Web and social media tools.

Manage to the implementation schedule and milestones. Provide strong project management skills to ensure successful launch of features and updates on time and within budget. Update the Program Project Schedule and Milestones to reflect program activities.

Support program management activities, such as Performance Evaluation, Risk

Management, and Change Management.

3.3 Content Development and Management

The Contractor shall support development and maintenance of content for SBA Web sites.

Activities within this subtask include, but are not limited to:

Provide Editorial Management support. Develop and maintain accurate roles and responsibilities for content staff. Develop and maintain a viable Content Strategy.

Remain current in Federal policies, including OMB requirements, and ensure all content is in accordance with current guidance. Develop, grow, and maintain Content

Partnerships, including researching partner agency sites and associated web material to identify pertinent content, tagging such content for incorporation into SBA portals, and maintaining good liaison with the agencies involved. Develop and maintain a rigorous content review and approval process.

Content Creation and Publishing. Develop and maintain an Editorial Calendar. Conduct research on the latest content creation and publication techniques. Prepare and maintain

Editing Guidelines and a viable Design Style Guide. Develop and maintain Channel

Editing Guidelines. Make creative use of gadgets, widgets, embedded video, and other techniques. Conduct training for content staff using Drupal CMS and make creative use of the tool to integrate with current and new features. Ensure appropriate metrics coding to capture pertinent system information.

Content Maintenance. Update and maintain content as required. Maintain an ongoing program of link checking and content audits. Assist the SBA in preparing Small

Business Paperwork Relief Act (SBPRA) updates for submission to OMB. Conduct ongoing Search Engine Optimization (SEO).

3.4 Web Design and Development

The Contractor shall establish creative and robust Web design processes. The SBA is committed to providing its users a responsive, user-friendly, integrated user interface that provides quick easy access to its online media resources. Assist the SBA in developing new approaches to technical and business challenges. Activities within this subtask include, but are not limited to:

Review, sustain, and update the user interface and navigation approach based on SBA requirements, user needs, technology capabilities, and Federal policies and regulations.

Review online media and system tools/features for their usefulness and support of SBA programs. Incorporate changes/updates to tools and features into the Web design process as appropriate.

Use rigorous project management procedures and skills to ensure the successful completion of design/development activities and the successful launch of new features and updates on time and within budget.

- 4 -

Conduct usability testing with customers and stakeholders. Develop scripts and work with the Program Office to establish usability groups. Conduct usability sessions and work with the Program Office to assess the results as part of ongoing Web development.

3.5 Social Media Management

The Contractor shall assist the SBA in developing effective social networking applications and approaches to foster a strong user community and encourage citizen engagement.

Activities within this subtask include, but are not limited to:

Ensure high standards using Social Media. Capitalize on the timeliness and interactive nature of social networking while ensuring responsible usage and protecting SBA from mishaps.

Maintain and upgrade Community pages as needed.

Develop and maintain moderator procedures and ensure proper moderation of site social networks. Develop and maintain Style Guides. Ensure proper management and control of advertising, possible use of intellectual property, and controls on the dissemination of content.

Develop and maintain a strong customer communications and Customer Relations

Management environment, using state of the art tools.

Develop and maintain metrics for measuring the success of social networking activities.

Provide Customer Support. Establish and maintain Customer Support guidelines and processes.

3.6 Technical Analyses and Documentation

The Contractor shall, in consonance with team planning and objectives, develop and deliver technical documents. Such documents may include, but are not necessarily limited to:

Executive Briefing materials to communicate project status, resource requirements, milestone information, project change requirements, and other information.

Develop and manage project management schedules and milestones.

Requirements Analyses to develop Technical Requirements in keeping with the SBA’s needs.

Conduct Market Research in consonance with development of Technical Requirements analyses.

Conduct application, process, and physical modeling as necessary to realize the

Architecture.

Define Technical Risks and incorporate into program Risk Management.

Identify and document test approaches to fully test functionality and capacity for design elements and system components.

Identify and document potential training requirements associated with implementation of Technical Requirements.

3.7 System Operations and Maintenance Support

The Contractor shall provide technical support and team leadership to devise and implement the Architecture. Devise and implement system upgrades and revisions. Ensure that preventive and corrective maintenance procedures are robust and comprehensive.

Responsibilities include, but are not limited to:

- 5 -

Oversee and coordinate ongoing system upgrade and enhancement, including development and maintenance of a comprehensive system release schedule.

Develop and maintain concepts of operation, mission objectives, architectural documents, plans, and other system documents, in accordance with the long-range

Product Strategy. Such documents include, but are not limited to:

Architecture Diagrams

Disaster Recovery Plan

Security Plan

Other plans and documents as required and approved by the Program Manager.

Develop and maintain appropriate Business Processes, and assist in establishing the organizational and procedural infrastructure to support those processes, including development of standard operating procedures, staffing requirements, and process definitions. Update and maintain the Program Plan and Schedule to reflect the Product

Strategy and appropriate Business Processes.

Web Site maintenance. Sustain the Web site and ensure appropriate updates and maintenance upgrades are incorporated. Ensure existing Social Networking applications and features are managed and moderated appropriately.

Support and sustain system configurations and support Configuration Management processes. Develop and update Concepts of Operation and mission objectives based on the analysis of usability tests and user feedback. Evaluate alternative products to meet online media objectives and make recommendations to the government.

Develop and maintain a library of comprehensive, accurate and up-to-date design documents. Record and maintain accurate physical and logical system configurations, establish and conduct a Configuration Management process.

Monitor and oversee technical progress against the Plan and Milestones and the Project

Schedule and advise the Program Manager and SBA Executives as to solutions, strategies, and approaches.

Develop system elements in support of the upgrade and enhancement release schedule.

Review proposed changes for technical, cost, and schedule risks and advise the PM.

Provide Technical Monitor inputs for contractor performance measurement.

Assist in reviewing proposed changes for technical, cost, and schedule risks and advise the Project Manager.

Procure, sustain, and manage software, services and applications.

Develop and maintain maintenance plans, schedules, and planning aids.

Monitor system parameters, response characteristics, and outputs to ensure operational and availability requirements are being met. Establish, where appropriate, testing and sampling procedures to ensure correct operation.

Establish, in consonance with architectural requirements and program plans, availability requirements for system components. Establish appropriate levels of service where necessary for IT maintenance support.

Document maintenance activities, problems, and actions taken to resolve problems.

Report problems in accordance with program guidelines.

- 6 -

3.8 System Security Requirements

Sensitive information includes: Sensitive but Unclassified (SBU) information; procurement sensitive information; For Official Use Only (FOUO) information; information generated by or in the possession of SBA that is commercially valuable, trade secret, market sensitive, proprietary, related to an SBA enforcement or examination matter, subject to privilege, protected by the Privacy Act (5 U.S.C. § 552a), or otherwise deemed sensitive, confidential or non-public by an SBA office head, and is not otherwise available to the public. This definition applies to sensitive information in any form, including documents, electronic mail, computer files, conversations, and audio or video recordings. Examples of sensitive information include corporate financial data provided to SBA that has not been made public;

SBA planned or contemplated courses of action regarding SBA examinations, investigations, and enforcement actions; and SBA personnel information covered by the Privacy Act, 5

U.S.C. § 552a.

Data contained within all SBA computer systems are governed by Agency record disclosure and privacy regulations (13 C.F.R. part 102), IT Security regulations as well as other regulations, and statutes and guidance, including the Privacy Act of 1974, as amended (5

U.S.C. § 552a). The contractor and its subcontractors will be held accountable for adherence to these statutes, regulations and guidance, as well as following SBA requirements described in this clause. Thus, anytime the term contractor is used, it shall be meant to include the contractor and all of its subcontractors working on this contract that have access to a federally-controlled facility and/or routine access to a federally-controlled information system

(including, but not limited to, computer systems, networks, or IT infrastructure).

The contractor, within 30 days of contract award, shall develop a Systems Security Plan

(SSP), which shall be updated at least annually. The SBA will provide a draft SSP, currently being prepared, for contractor review and inclusion of contractor-specific information.

The SSP will be reviewed by the COTR or designated technical point of contact. The SSP must establish administrative, technical, and physical security measures at the contractor’s computer facility to protect sensitive and personally identifiable information (PII) from unauthorized disclosure, alteration, or misuse; prevent unauthorized access to the contractor’s computer system; and protect the availability of data and services to SBA.

The contractor shall assist the SBA Team in obtaining and maintaining system Certification and Accreditation.

Of particular note is comprehensive knowledge of, and support to, Federal regulations regarding information technology system operation and security. Support for these regulations needs to flow through all aspects of the contractor’s approach. Of note, strong support is required for the following:

Rehabilitation Act Section 508 Accessibility. The Small Business Administration intends to use the new SBA.gov Web site be a showcase for application of accessibility provisions expressed in Section 508 and in the Americans with Disabilities Act (ADA). The contractor shall ensure that Section 508 provisions are incorporated wherever practicable within the

SBA.gov Web site, tested, and maintained up to date.

Paperwork Reduction Act and the Open Government Initiative. The PRA presents challenges as it is applied to the use of dynamic Web sites and social media to convey governmental content. In particular, how the PRA works in unison with the Open Government Initiative continues to be an area of growth for Federal Web sites. The Small Business Administration is committed to making sure that the updated SBA.gov fully embraces the principles of the

- 7 -

PRA and the requirements for an Open Government. The contractor’s support in interpreting the PRA and its provisions within the framework of the Open Government Initiative, and ensuring these are properly reflected within SBA.gov, is essential.

System Certification and Accreditation (C&A). The SBA requires that all SBA systems are properly certified and accredited in accordance with OMB Circular A-130. This process requires constant monitoring and interaction between the program office, the SBA’s Office of the Chief Information Officer, and SBA’s Security Office. The contractor shall provide strong support to ensure that the system and its upgrades are up to date as regards the requirements of the C&A process.

Capital Planning and OMB Circular 300. The SBA requires proactive support of the capital planning requirements as expressed in OMB’s Circular 300. The contractor shall ensure that the technical aspects of OMB 300 planning and management are incorporated into program planning and the system management cycle.

Cloud Computing. While the current architecture uses managed hosting, the SBA anticipates transitioning much of the Web site capabilities to cloud-based computing within the next two years. The contractor shall develop a comprehensive Plan of Action and Milestones

(POA&M) for moving SBA.gov capabilities into a cloud-based environment.

- 8 -

4. Deliverables

Contract Area Deliverable Delivery Requirement

Strategic Planning/Thought

Leadership

Online Media Strategic Plan

Completed draft documents delivered per approved POA&M

Comments incorporated and delivered within 2 days of receipt

OMB 300 Updates in accordance with

OMB schedule and requirements.

OMB 300 Updates

Technology Strategy

Product Management

Product Strategy

Requirements Analyses

Market Research and technical/ cost tradeoff analyses

Product Test Plans

Product Launch Plans

Web Design and

Development

Web Design Process Document

Web Architecture and Process

Flow

Web Style Guide

Usability Procedures and Plan

Content Management

Style Guides

Editorial Guides and Calendar

Content Audits

Content Governance Document

Social Media Management

Community Style Guides

Moderator Guidelines

Customer Support Guidelines

System Operations and

Maintenance Support

SBA.gov System Plan of Action and Milestones (POA&M)

Initial POA&M delivered 30 days after contract award. Updates as required, but at least monthly. Maintained up to date until contract end.

Completed draft documents delivered per approved POA&M

Comments incorporated and delivered within 2 days of receipt

Risk Management Plan

System Architecture

SBA.gov Business Processes

SBPRA Updates

Configuration Management Plan

System Upgrade and

Enhancement Schedule

Test Plans and Requirements

System Maintenance Plan

Testing Procedures

Security Clearance Form 1228 Not later than two weeks after issuance for each form.

- 9 -

5. Travel Requirements

No travel is anticipated under this contract. If travel is required, it must be pre-approved by the CO. Travel costs will be reimbursed as actual costs in accordance with Federal Travel

Regulations.

6. Place of Performance

Work will be performed at the contractor’s site.

7. Project Status and Reporting

Contractor shall provide monthly status reports on progress and expenditures to the COTR and the SBA.gov Project Manager.

8. Period of Performance and Type of Contract

Base period of performance is estimated to be 10 (ten) months from the date of contract award. Based on good performance and subject to availability of funds, four additional one year option periods may be exercised. The contract is anticipated to be an IDIQ contract. If a satisfactory set of steady-state activities can be established in the Strategic Plan, the SBA anticipates negotiating, in the ensuing option years, one or more task areas to be Firm Fixed

Price task orders.

NOT-TO-EXCEED AMOUNT

(a) The NOT-TO-EXCEED amount (that amount the contractor shall not exceed except at its own risk) shall be defined per task order. In addition, the Contractor shall immediately notify the COTR and the Contracting Officer , in writing via e-mail (to be provided at time of award)), when the Contractor has performed work totaling the not to exceed amount.

(b) The Contractor shall notify the Contracting officer in writing at least 10 days prior to the date when, in the Contractor’s best judgment, the work under the contract will reach the point at which the total amount payable by the Government, including any cost for termination for convenience, will approximate the total amount then allotted to the contract.

The notification will state (1) the estimate date when that point will be reached and (2) an estimate of additional funding, if any, needed to continue performance through the current period of performance or to a mutually agreed upon substitute date. The Government will not be obligated in any event to reimburse the Contractor in excess of the amount allotted to the contract regardless of anything to the contrary in any other clause or provision of this contract.

(c) If, solely by reason of failure of the Government to allot additional funds in amounts sufficient for timely performance of the contract, the Contractor incurs additional costs or is delayed in the performance of the work under this contract and if additional funds are allotted, an equitable adjustment will be made in the price or in the period of performance, or both. Failure to agree to any such equitable adjustment hereunder will be a dispute concerning a question of fact within the meaning of the clause entitled “Disputes” (FAR

52.233-1).

- 10 -

9. Government Furnished Property/Government Furnished

Equipment/Government Furnished Information

No GFP/GFE is anticipated.

Government Furnished Information will include program plans, transition plans, pertinent security documentation, the draft System Security Plan, schedules, and pertinent system content and database information. The Government will provide information, material and forms unique to the Government for supporting the task. All Government unique information related to this requirement, which is necessary for Contractor performance, will be made available to the Contractor. The COTR will be the point of contact for identification of any required information to be supplied by the Government.

Documentation - All existing documentation, relevant to this task accomplishment, will be made available to the Contractor. The Contractor shall be required to prepare documentation in accordance with defined guidelines provided by the Government.

10. Organizational Conflict of Interest

The term "organizational conflict of interest" means that the Contractor (which term hereinafter shall be deemed to include its chief executives, directors, any consultants, or subcontractors utilized under this contract other than a vendor selling incidental material) has interests which (i) may diminish its capacity to give impartial, technically sound, objective assistance and advice in performing this contract, (ii) may otherwise result in a biased work product under this contract, or (iii) may result in an unfair competitive advantage to itself or others.

1.1 The contractor’s attention is directed to FAR Subpart 9.5, Organizational Conflicts of Interest.

In the execution of certain contract tasks, it is anticipated that assigned contractor personnel will require access to confidential or proprietary business, technical and financial information belonging to the Government or other companies. The information may include but is not limited to pre-decisional budget and acquisition sensitive information, preparation of specifications or work statements, and evaluation services. After receipt thereof, the contractor and affected individuals shall treat such information as confidential and agree not to appropriate such information to its own use or to disclose such information to third parties unless specifically authorized by the contracting officer in writing.

The foregoing obligations, however, shall not apply to:

Information which, at the time of receipt by the contractor, is in the public domain;

Information which is published after receipt thereof by the contractor or otherwise becomes part of the public domain through no fault of the contractor;

Information which the contractor can demonstrate was in his possession at the time of receipt thereof and was not acquired directly or indirectly from the Government or other companies;

Information, which the contractor can demonstrate, was received by it from a third party that did not require the contractor to hold it in confidence.

The contractor shall obtain the written agreement, in a form satisfactory to the contracting officer, of each employee permitted access, whereby the employee agrees that he will not discuss, divulge or disclose any such information or data to any person or entity except those

- 11 -persons within the contractor's organization directly concerned with the performance of the contract.

The contractor agrees, if requested by the Government, to sign an agreement identical, in all material respects, to the provisions of this clause, with each company supplying information to the contractor under this contract, and to supply a copy of such agreement to the contracting officer. From time to time upon request of the contracting officer, the contractor shall supply the Government with reports itemizing information received as confidential, proprietary, pre-decisional budget information, or acquisition sensitive information, and setting forth the company or companies from which the contractor received such information.

The contractor agrees that upon request by the contracting officer it will execute a contracting officer approved agreement with any party whose facilities or proprietary data it is given access to or is furnished, restricting use and disclosure of the data or the information obtained from the facilities. Upon request by the contracting officer, contractor personnel shall also sign such an agreement.

1.2 If after award, the contractor discovers an organizational conflict of interest with respect to this contract, it shall make an immediate and full disclosure in writing to the Contracting

Officer. The disclosure shall include identification of the conflict, the manner in which it arose, and a description of the action the Contractor has taken or proposes to take to avoid, eliminate or neutralize the conflict. The Government may, however, terminate the contract.

1.3 In the event that the Contractor was aware of an organizational conflict of interest prior to award of this contract and did not disclose the conflict to the Contracting Officer or becomes aware of an organizational conflict of interest after award of this contract and does not disclose the conflict of interest within ten (10) working days of becoming aware of such conflict, the Government may terminate the contract and the contractor shall not be entitled to reimbursement of any cost incurred in performing this contract or payment of any fee there under. Further, such costs shall not be allocable or chargeable, directly or indirectly, to any other contract with the Government.

1.4 The rights and remedies of the Government provided in this clause shall not be exclusive and are in addition to any other rights and remedies of the Government provided by law or under this contract.

1.5 The Contractor agrees that during performance of the contract and for a period of three (3) years after the completion of performance of this contract, the Contractor, including all divisions thereof, and any affiliate of the Contractor, any joint venture involving the

Contractor, any entity into or with which it may subsequently merge or affiliate, or any other successor or assign of the contractor, shall not:

(a) Supply information or material received from this contract, to any firm participating in or having a known prospective interest in the subject matter areas for which the sensitive information described in paragraph (i) above was initially submitted, nor enter into any contractual relationship which would affect or appear to affect the equity and integrity of its recommendations.

(b) Furnish to the United States Government, either as a prime contractor or as a subcontractor, any component of any system for which the sensitive information

- 12 -described in paragraph (1) above was initially submitted, that it is not currently obligated to deliver for defense purposes.

11. Personal Conflicts of Interest

The term "personal conflict of interest" means that a contractor employee assigned to the contract has interests which (i) may diminish his/her capacity to give impartial, technically sound, objective assistance and advice in performing this contract, (ii) may otherwise result in a biased work product under this contract, or (iii) may result in an unfair competitive advantage.

1.1 A contractor employee shall not participate (i.e., recommend, influence, or decide) in any particular matters:

(a) that will have a direct and predictable effect on the financial interests of that employee, his/her spouse or minor child, or organization in which he/she serves as officer, director, trustee, general partner or employee;

(b) that will have a direct and predictable effect on the financial interests of or any person or organization with whom he/she is negotiating or has an arrangement concerning prospective employment

(c) may otherwise cause a reasonable person to question his/her impartiality.

1.2 The contractor shall obtain the financial disclosure agreement, similar in form/content of the

Office Government Ethics Form 450, for each employee assigned to the contract. The contractor shall also obtain financial disclosure agreements for all subcontractor employees assigned to the contract.

1.3 If after award, the contractor discovers an employee’s financial conflict of interest, with respect to this contract, it shall make an immediate and full disclosure in writing to the

Contracting Officer. The disclosure shall include identification of the conflict, the manner in which it arose, and a description of the action the Contractor has taken or proposes to take to avoid, eliminate or neutralize the conflict. The Government may, however, terminate the

1.4 In the event that the Contractor was aware of an employee’s financial conflict of interest prior to award of this contract and did not disclose the conflict to the Contracting Officer or becomes aware of an employee’s financial conflict of interest after award of this contract and does not disclose the conflict of interest within ten (10) working days of becoming aware of such conflict, the Government may terminate the contract and the contractor shall not be entitled to reimbursement of any cost incurred in performing this contract or payment of any fee there under. Further, such costs shall not be allocable or chargeable, directly or indirectly, to any other contract with the Government.

1.5 The rights and remedies of the Government provided in this clause shall not be exclusive and are in addition to any other rights and remedies of the Government provided by law or under this contract.

- 13 -

12. Security Requirements

12.1 Contractor Background Investigations

12.1.1 SBA designates all contractor positions requiring access to Automated Information

Systems and routine physical access to SBA facilities as Moderate Risk and requires a background investigation for all such contractor employees. SBA policy is to perform background investigations on personnel accessing sensitive data or

Personally Identifiable Information (PII) to perform their primary job functions. This applies to any of the following situations:

Contractor is working in an SBA facility;

Contractor will have access to an SBA AIS;

Contractor will be working for six months or more; or

Contractor will be working with sensitive data or PII that SBA has not made publicly available.

12.1.2 A Minimum Background Investigation is sufficient for any contractor staff member under the following circumstances:

The contractor staff member can show positive results of a recent MBI. That is:

o The MBI was successfully adjudicated within the last five years; or o The contractor has not had a break as a contractor from the federal government exceeding two years.

The contractor staff member can show positive results from a higher level investigation, such as a Limited Background Investigation or a Background

Investigation.

12.1.3 A complete Background Investigation is required for all contractor personnel who cannot who cannot meet the requirements described above. The Contracting Officer’s

Technical Representative (COTR) or designated staff may assign each contract labor category a higher security sensitivity rating, which will determine the type of

Background Investigation to be performed for that labor position.

12.1.4 The COTR will issue Form 1228 “Computer Access/Clearance Form” to the contractor point of contact immediately after contract award. The Contractor shall ensure that all proposed contractor employees complete and return the Form 1228, including any requested additional information (e.g., social security number, date and place of birth, position description) not later than two weeks after receipt.

12.1.5 The Office of Inspector General, Office of Investigations, will perform background investigations for any of the following contractors:

SBA requires an MBI or higher level investigation. Any background investigation received by a contractor prior to employment on an SBA contract must have been conducted by the Office of Personnel Management (OPM) (or contracting firm approved by OPM) and/or Defense Security Service (DSS). To be accepted by SBA, a contractor’s background investigation must be reviewed and approved by SBA's

OIG official to determine if the background investigation meets either OPM and/or

DSS standards.

The background investigation must also meet the requirements applicable to all other

SBA contractor personnel. Contractor will reimburse SBA the total cost for each

- 14 -background investigation. The FY 2010 cost is $591.00. This cost is subject to an increase by OPM each fiscal year. SBA’s Division of Procurement and Grants

Management will update you with the annual increases and will provide you with the procedures to follow to ensure the Agency is reimbursed for all costs incurred.

Background investigations are not required if the contractor is not working in an SBA facility, not accessing an SBA information system, working for six months or less and working with non-sensitive, non-personally identifiable data.

12.1.6 Investigation results will be reviewed by the OIG for adjudication. The COTR will be informed of any issues requiring additional action by the contractor.

12.2 AR Clause 52.204-9

Personal Identify Verification of Contractor Personnel (Sep 2007)

12.2.1 Contractor shall comply with Agency personal identity verification (PIV) procedures

(identified in the contract) that implement Homeland Security Presidential Directive-

12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and

Federal Information Processing Standards Publication (FIPS PUB) Number 201.

12.2.2 Contractor shall insert this clause in all subcontracts when the subcontractor is required to have physical access to a federally-controlled facility and/or access to a federally-controlled information system.

12.2.3 Pursuant to Federal Acquisition Regulation (FAR) clause 52.204-9, incorporated into this solicitation and the resulting contract, each contractor and subcontractor must comply with Agency Personal Identity Verification (PIV) procedures when the contractor and subcontractor will have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system

(including, but not limited to, computer systems, networks, or information technology infrastructure).

12.3 Protection of Sensitive and PII Data

Physical access to the contractor’s office areas that contain sensitive and PII SBA data, including SBA loan and any other data subsequently identified by SBA as sensitive or PII, must be controlled to prevent unauthorized personnel from acquiring access to this data.

Logon passwords, identifiers, and access procedures must be safeguarded from unauthorized use and disclosure. Contractor personnel must comply as follows:

12.3.1 The 1228 “Computer Access/Clearance Form” (available from the YES page) must be read and signed.

12.3.2 Passwords must be changed every 90 days.

12.3.3 The contractor shall notify the COTR as soon as it is known that a contractor will no longer be working on the contract. The contractor’s project manager must ensure that all personnel leaving this contract return all issued identification and any government property no later than the last day of their employment on the contract. Such identification and property must then be provided to the COTR within 24 hours.

- 15 -

12.3.4 The contractor must not release SBA data outside of its facility, either orally or in written form, without the express written consent of the SBA COTR. The contractor must refer all requests for SBA data to the assigned SBA COTR for action.

12.3.5 SBA reserves the right to inspect the contractor’s security measures, data handling procedures and other security safeguards to determine the security posture of the contractor facility. The contractor shall provide SBA access to the contractor’s and subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of this contract, with no additional cost to SBA.

Authorized SBA personnel include the Chief Information Security Officer (CISO), the Contracting Officer (CO), the COTR, the Office of Inspector General (OIG) and other personnel designated by the Chief Information Officer (CIO).

12.3.6 Weaknesses in physical, personnel, or computer security noted by SBA during routine inspections must be corrected within 15 days, unless otherwise agreed to by the CO. Quarterly updates of the status of the corrective actions must be in writing and forwarded through the COTR to the appropriate SBA official.

12.3.7 Contingency plans must be implemented and tested annually, at a minimum, to avoid loss of SBA data and to minimize, within the provisions of the contract, the impact of contingencies (environmental failures, fire, severe weather, natural disasters, etc.) on services provided to SBA. Contractors must develop and provide plans for responding to security incidents involving sensitive data and PII, and procedures for making any changes to the data processing environment. Documentation must be provided to the COTR within 30 days from the date of contract award. (See NIST

800 53, as revised.)

12.4 Information Handling and Disposition

12.4.1 Sensitive data and PII when distributed electronically must be protected against unauthorized disclosure and modification. At a minimum, draft and final documents must be encrypted.

12.4.2 The CO’s approval is required prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of sensitive information received under, generated under, or relating to this contract. The contractor support team will be required to abide by government and Agency guidance for protecting sensitive data and PII. Any such information made available in any format will be used only for the purpose of carrying out the provisions of this agreement.

12.4.3 Such information will not be divulged or made known in any manner to anyone outside the Agency or removed from approved work sites without approval from the

COTR or other authorized SBA personnel.

12.4.4 The contractor support team will immediately notify the COTR upon discovery of any inadvertent disclosures of information. The contractor will not disclose sensitive or proprietary information of, or in the possession of, SBA or any of its operating units, contractors, or business partners to unauthorized persons. The contractor will be subjected to any and all penalties imposed by law for unlawful disclosure of SBA information which may include termination of the contract.

- 16 -

12.4.5 Sensitive data and PII, and/or equipment will only be disclosed to authorized personnel with “a need-to-know” as described in the contract or order. The contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established prior to storing SBA data to ensure the security and confidentiality of this information. Data containing PII information is prohibited from being used as test data or stored in a non-production-processing environment for development/testing.

12.4.6 All contracts supporting SBA’s Information Systems shall require Internet Protocol

Version 6 (IPv6) compliant products are included in all new IT acquisitions using

Internet protocol.

12.5 Designation of a System Security Officer (SSO)

The contractor shall designate a management official responsible for fulfilling the responsibilities of an SSO who is knowledgeable in Automated Data Processing technology and computer security methodology. The SSO shall:

12.5.1 Ensure that an appropriate level of physical, operational, and technical security is maintained to protect the computing environment(s) and facility that process SBA information and the information is processed in accordance with SBA policy. This must include implementing controls described in an SBA approved System Security

Plan and ensuring vulnerability scanning is routinely conducted for all devices supporting Agency operations. Scanning should also be conducted by the contractor’s external auditors as a part of the scope of the SAS 70 Type II evaluation.

12.5.2 Assist SBA’s CISO in the investigation of information technology security breaches that affect processing at the contractor’s facility.

12.5.3 Implement, at the direction of SBA’s CISO, SBA AIS security policies, procedures, and standards that affect systems that process SBA information at the contractor’s facility.

12.5.4 Support SBA’s CISO in maintaining the system security plan and in conducting periodic information security audits and internal control reviews. Reviews will be scheduled and conducted at least every three years, and additionally, as required by changes in the system, data, and operating environment.

12.5.5 Recommend security enhancements and improvements where appropriate.

12.5.6 Ensure the timely correction or remediation of discrepancies found during the periodic information security audits and internal control reviews.

12.5.7 Ensure that an accurate inventory list of all networking devices and licensed software products is maintained.

12.5.8 Ensure that security patches and updates are applied to SBA-owned, contractor operated computing devices in a timely fashion.

12.5.9 Notify SBA of all incidents immediately after they are discovered. Detailed follow-up reports must be submitted to the CISO describing the incidents,

- 17 -successful/unsuccessful network penetrations, root or user account compromises, denial of service attacks, Web site defacing attacks, malicious code, viruses, probes and scans, etc.

12.5.10 Ensure that all contractors with access to SBA data complete the annual

Computer Security Awareness Training (CSAT) and report status of completion to

SBA for tracking. New contractors must complete the CSAT within 45 days from starting to work as an SBA contractor.

12.5.11 Provide SBA with a copy of the facility’s Statement of Auditing Standard 70

(SAS-70) in accordance with federal guidelines over hosted applications as outlined in NIST 800-53, Recommended Security Controls for Federal Information Systems and Organizations and provisions of OMB Bulletin 07-04, Audit Requirements for

Federal Financial Statements. The SAS-70 is a “Report on the Processing of

Transactions by Service Organizations” where professional standards are set up to audit and assess internal controls of that specific service organization. In this instance, the specific organization would be the outsourcing facility that hosts and/or processes data belonging to SBA. The SAS-70 serves as SBA’s verification that the facility has satisfactory controls and safeguards in place to protect Agency data housed at a third party service provider.

12.5.12 Ensure that all employees granted access to one or more of SBA’s information systems review the system’s rules of behavior which is a group of standards detailing permissible actions while using the system.

12.6 System Security Regulations

12.6.1 The contractor agrees to comply with the IT systems security and/or privacy specifications in accordance with SBA guidelines; the Computer Security Act of

1987; and Office of Management and Budget (OMB) Circular A-130, Appendix III, “Security of Federal Automated Information Systems”. The Contractor agrees to cooperate with, and participate in, the conduct of Computer System Certification and

Accreditation (C&A) activities, as outlined in OMB Circular A-130, performed by the Small Business Administration to ensure the security of SBA sensitive data.

12.6.2 The contractor further agrees to include this provision in any subcontract awarded pursuant to this task order. Failure to comply with these requirements will constitute cause for termination.

12.6.3 The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of the SOW. The contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment.

12.7 SBA Information Technology Security Program Requirements

The following Federal laws, OMB/NIST/SBA Policies and Guidelines are applicable to operating or hosting all SBA systems and comprise SBA’s Information Security Program.

- 18 -

SBA Standard Operating Procedure (SOP) 90 47 2, Automated Information Systems Security

Program

SBA Standard Operating Procedure (SOP) 90 49, Appropriate Use of SBA’s Automated

Information Systems

Standard Operating Procedure (SOP) 90 50, Breach Notification Response Plan

SBA Procedural Notice 9000-1709: Protecting End User Files Containing Sensitive and

Personally Identifiable Information

SBA Information Notice 9000-1241: New Internet Monitor (November 22, 2000)

SBA Information Notice 9000-1227: Computer Security Reminder, (September 21, 2000)

SBA Information Notice 9000-1205: E-Mail Passwords (April 13, 2000)

SBA Procedural Notice 9000-1383: Managing Security Alerts and Vendor Patches (October 22, 2000)

SBA Procedural Notice 9000-1388: Information Technology System Interconnection

Requirements (November 19, 2002)

SBA Procedural Notice 9000-1391: Storage Media Handling and Disposal (November 26, 2002)

SBA Procedural Notice 9000-1392: Information Technology - Maintaining System Security

Documentation (November 26, 2002)

SBA Procedural Notice 9000-1797 Computer Security Awareness and Training (May 14, 2009)

SBA Procedural Notice 9000-1397: Telecommuting Security Policy (December 27, 2002)

SBA Procedural Notice 9000-1400: Information Technology - Computer Security Rules of

Behavior (January 2, 2003)

SBA Procedural Notice 9000-1403: Automated Information System Support Separation of Duties

(January 7, 2003)

SBA Procedural Notice 9000-1405: Information Technology - Protection of Backup and

Recovery Media…