SOO - FIMA Acquisition Support Services.pdf

Federal Emergency Management Agency (FEMA) Resilience Federal Insurance & Mitigation Administration (FIMA), Grants Programs Directorate and National Preparedness Directorate

Acquisition Support Services Blanket Purchase Agreement Statement of Objectives (SOO) Mar 2023

Acquisition Support Services Blanket Purchase Agreement Statement of Objectives (SOO)

Contents

I Purpose

II Background

III Scope

IV Objectives

V Assumptions and Constraints

VI Period of Performance

VII Deliverables and Delivery Schedule

VIII Technical Clauses

I Purpose The Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), Resilience, Federal Insurance and Mitigation Administration (FIMA), Grants Programs Directorate (GRANTS) and the National Preparedness Directorate (NPD) require acquisition management services to support and enhance its procurement related activities, capabilities, and operations.

This requirement will support the acquisition lifecycle and will include identifying acquisition best practices to achieve greater efficiency in planning and procuring products and services. The overarching objectives for the Resilience Acquisition Management Support Services are to:

• Develop Resilience procurement operations to integrate and link strategic acquisition planning to program needs and desired outcomes;

• Provide innovative acquisition strategies and improve acquisition management for more efficient and effective program operations;

• Advance Resilience Contracting Officer’s Representative (COR) capabilities and expertise to support business operations and strategic acquisition planning and develop strategies and standard operating procedures to improve procurement quality and efficiency.

II Background

The Resilience organization includes FIMA, GRANTS and NPD.

FIMA is comprised of (7) Directorates to include the Federal Insurance Directorate (FID), the Integration/Front Office (IO), the Fund Management Directorate (FMD), the Risk Management Directorate (RMD), the Office of the Flood Insurance Advocate (OFIA), the Mitigation Directorate (MIT), and the Office of Environmental Planning and Historic Preservation (OEHP).

The Grants Programs Directorate includes the Office of Communications, Culture, Analytics and Training, the Office of Enterprise Grant Services, the Office of Grant Administration and the Office of Resource Management & Business Administration. The National Preparedness Directorate is comprised of the Individual and Community Preparedness Division, the National Exercise Division, the National Integration Center, the National Preparedness Assessment Division, the National Training and Education Division and the Technological Hazards Division.

Federal Insurance Directorate (FID)

FID functions to align and simplify National Flood Insurance Program (NFIP) deliverables for NFIP policyholders. FID is comprised of the following organizational components:

1. Insurance Acquisition and Technology Division

2. Product Delivery Division

3. Policyholder Services Division

4. Front Office

Mitigation Directorate (MIT)

MIT reduces community vulnerability to disasters and their effects and promoting individual and community safety and resilience. MIT is comprised of the following organizational components:

1. Floodplain Management Division

2. Hazard Mitigation Assistance Division

3. Insurance and Mitigation Readiness Division

Risk Management Directorate (RMD)

RMD delivers quality risk data, modeling and programs that increase the public's awareness of risk across the range of natural hazards and leads to actions that reduce risk to life and property. RMD is comprised of the following organizational components:

1. Front Office

2. Communications and Management

3. Engineering and Modeling

4. Planning, Safety, and Building Sciences

Office of the Flood Insurance Advocate (OFIA)

OFIA advocates for the fair treatment of policyholders under the National Flood Insurance Program (NFIP) and property owners by providing education and guidance on all aspects of the NFIP, identifying trends affecting the public, and making recommendations for program improvements to FEMA leadership.

Fund Management Directorate (FMD)

FMD’s mission is to reduce needless disaster suffering by providing expert customer center support services and data-driven analysis to ensure sound stewardship of resources and results-driven customer service that ensures FIMA’s success. FMD ensures FIMA has the right people and resources in the right place at the right time and will continue to provide stewardship over budgetary, human resources and financial expertise to achieve FIMA’s mission and support the front-line. Hiring and retaining customer-focused talent and providing transparency into our resource management process is critical to the success and progress of our mission. FMD is comprised of the following organizational components:

1. Front Office

2. Resources and Services

3. Budget Division

4. Reinsurance Division

5. Finance Division

FIMA Office of Integration (IO)

IO provides Executive leadership, direction, program/project management, and performance metrics to all FIMA programs. IO is comprised of the following organizational components:

1. Action Branch

2. Strategy Branch

IO also chairs FIMA’s MS SharePoint Community of Practice (CoP). The CoP serves as a steering committee and advisor for FIMA MS SharePoint needs and support.

The Office of Environmental and Historic Preservation (OEHP)

OEHP is responsible for integrating environmental, historic and cultural resources in all FEMA programs and activities, and for coordinating environmental and historic preservation activities with FEMA’s 10 Regional Environmental Officers. OEHP is comprised of the following organizational components:

1. Readiness Branch

2. Policy Branch

3. Integration and Technologies Branch

The Grants Program Directorate (GRANTS)

Grants mission is to deliver and support grant programs that help the Nation before, during and after disasters in order to make the country more resilient. The Grants Directorate is comprised of the following organizational components:

1. Office of Communications, Culture, Analytics and Training

2. Office of Enterprise Grant Services

3. Office of Grant Administration

4. Office of Resource Management & Business Administration

The National Preparedness Directorate (NPD)

National Preparedness mission is to deliver integrated preparedness solutions to help people before, during and after disasters. The National Preparedness Directorate is comprised of the following organizational components:

1. Individual and Community Preparedness Division

2. National Exercise Division

3. National Integration Center

4. National Preparedness Assessment Division

5. National Training and Education Division

6. Technological Hazards Division

III Scope

The scope of this Blanket Purchase Agreement is to provide enterprise-wide acquisition management support services for the Resilience organization. This includes lifecycle acquisition management support for the procurement of goods and services in support of Resilience and performance-based management support for Contracting Officer Representatives (CORs). The Contractor shall provide all personnel and supervision necessary to provide efficient and cost-effective acquisition management support services to achieve the objectives set forth herein. It should be noted that this support is limited in scope to only acquisition related functions which are the responsibility of the Resilience organization to include FIMA, Grants and National Preparedness. This includes pre/post award acquisition management support for Resilience portfolio of contracts. Resilience portfolio includes acquisitions categorized under all three DHS level 1, 2, and 3 programs as defined in DHS Directive 102-01-001, as well as acquisitions below these thresholds.

IV Objectives

Objective 1: Acquisition Investment Review and Approval Support. The Contractor shall support existing and the establishment of new Resilience investment review support for Acquisition Programs (Level 1, 2 and 3) inclusive of the Acquisition Life Cycle Framework (ALF), Acquisition Review Process (ARP), and Acquisition Review Board (ARB) approval as applicable for each level in accordance with DHS Directive 102-01-001. In this capacity the contractor shall:

1. Provide expert knowledge on the templates and technical support on required

Acquisition Lifecycle Framework (ALF) documentation to ensure programs are working in alignment with the DHS ALF and DHS Acquisition Directive.

2. Assist FIMA acquisition programs in preparation for Acquisition Decision Events

(ADEs) before the FEMA and DHS Acquisition Review Boards (ARBs) by providing acquisition business management assistance and consultation services.

3. Support the development and preparation of FIMA Level 1, 2, and 3 Acquisition

Programs briefings and program status updates to FEMA and FIMA leadership.

Objective 2: Acquisition Management Strategic Planning Support. The Contractor shall support Resilience acquisition efforts by building, facilitating, maintaining, and strengthening linkages between strategic acquisition planning, program needs, and desired outcomes to improve the overall maturity of program and acquisition functions. In this capacity, the Contractor shall:

1. Support strategic acquisition planning to identify Resilience acquisition requirements, risks and opportunities align to future contract investments with FEMA/Resilience mission and business strategic goals. Support planning efforts to forecast, prioritize and identify annual procurement goals for Resilience Spend Plan Development.

2. Align acquisition planning to OCPO PALT and FEMA review and approve acquisition documentation deadlines and ensure acquisition milestones and project plans are developed in a timely manner.

3. Conduct assessments on Resilience acquisition procedures to identify strengths, weaknesses and gaps. Provide results and recommendations on process improvements between Resilience and FEMA Mission Support to include integration of analytics and the use of data driven decisions in acquisition planning.

4. Develop a Resilience Leadership engagement strategy to align leadership with effective strategic and business planning with a focus on a total program management approach to acquisitions. Provide support to and guidance to Resilience Acquisitions community on FAR and GAO best practices. Enhance Resilience’s overall procurement approach.

Objective 3: Acquisition Management Pre/Post Award Contract Support. The Contractor shall support the Resilience acquisition lifecycle management activities. The Contractor shall provide all necessary pre/post award acquisition management support for a full range of goods and services needed to successfully carry out the Resilience mission. This includes, but is not limited to procurement for professional services, administrative support services, Architect and Engineering (A&E) services, Information Technology (IT) services and systems, and other products/supplies. In this capacity, the Contractor shall:

1. Engage with Resilience program offices to identify current programs and project future program requirements. Determine appropriate contract types, performance metrics, incentives and deliverables. Conduct comprehensive Market research to recommend solutions and optimal acquisition approach with consideration of FEMA socioeconomic goals. Manage logistics with internal and external stakeholders for market research efforts. Prepare market research reports, conduct small business analysis, draft pre-solicitation announcements.

2. Prepare acquisition documents that are consistent with all DHS and FEMA/OCPO templates and SOPs. Acquisition documents development and preparation support includes, but is not limited to, planning, drafting, reviewing, and coordinating efforts related to obtaining OCPO, OCIO, OSCO, Privacy Officer, and OCAO approval of procurement package documents.

Procurement package content and structure shall be in accordance with the latest FAR, DHS, and FEMA acquisition regulations, guidance and templates to include ((Statement of Work (SOW), Statement of Objectives (SOO) and Performance Work Statement (PWS)).

3. Acquisition Plans. Support Resilience acquisitions planning and the development and preparation of acquisition plans. Acquisition planning support shall include providing recommendations on appropriate contract type and working with Resilience to ensure that technical, business, management and other considerations are adequately addressed as prescribed by Federal Acquisition Regulation (FAR) Part 7 and the DHS Acquisition Planning Guide.

4. Assist and support Resilience efforts in Source Selection/Evaluation Plans, Evaluation Factors and Criteria, Independent Government Cost Estimates (IGCEs), Justification documentation for Other than Full and Open Competition/Limited Source Justification/Brand Name Justification/Exception to Fair Opportunity, as applicable, Determinations and Findings (D&Fs) and the Quality Assurance Surveillance Plans (QASP).

5. Provide administrative support for acquisition management related activities to include meeting planning, logistics, facilitation of conference calls and webinars using current technology to virtually share information while taking/distributing meeting notes. Provide competitive sourcing support, including Office of Management and Budget (OMB) Circular A-76 studies, strategic sourcing studies, privatization studies, public-private partnerships, and Federal Activities Inventory Reform (FAIR) Act studies Provide acquisition management surge support in response to disasters.

Objective 4: Performance Based COR Support Services. The Contractor shall support the Resilience CORs throughout the acquisition lifecycle to increase their efficiency and effectiveness.

In this capacity, the Contractor shall provide administrative support and guidance to Resilience CORs related to contract technical monitoring and administration.

1. Develop and enhance standard operating procedures (SOPs) for Resilience CORs and program staff to mature acquisition processes to align with OCPO/SOPs and tools. Establish a Resilience COR workgroup and forum for sharing best practices, identifying collaborate opportunities, mentoring with the development of presentation materials to increase the effectiveness of all staff involved in the acquisition lifecycle.

2. Provide cost/financial analysis support to Resilience CORs to ensure invoices accurately reflect the costs of services rendered. Provide administrative and cost analysis support to facilitate the close-out activities of contracts and task/delivery orders.

3. Develop and utilize innovative techniques to facilitate tracking and reporting of contract deliverables, delivery schedules and periods of performance.

4. Support planning and coordinating contract performance reviews with Resilience CORs to ensure timely reporting in Contractor Performance Assessment Reporting System (CPARS).

Objective 5: Technical Evaluation Team (TET)/Panel Facilitation. The Contractor shall provide TET facilitation support to ensure proposal evaluation is conducted in accordance with the applicable source selection evaluation factors and award criteria. The Contractor shall ensure technical evaluation reports are concise, fully supported, accurate, and submitted in a timely manner. In this capacity, the Contractor shall:

1. Provide customized guidance and coaching to Resilience source selection team members to facilitate proposal evaluation and describe the procedures through which a successful Offeror will be selected.

2. Provide expert assistance in facilitating proposal evaluations, including source selection meeting facilitation, capturing of meeting minutes, key decisions, questions, insights, and actions;

coupled with a solid familiarity of the procurement. This excludes providing advisory services and serving in the capacity of a technical evaluator. The Contractor may advise on processes and best practices for a technical evaluation but will not advise on the merits of a proposal.

V Assumptions and Constraints

All activities must align with DHS/FEMA strategic goals and constraints.

All activities must maintain data interoperability and consistency of operations across Resilience and with other Resilience stakeholders where appropriate and feasible.

The Contractors support must adhere to and comply with, where applicable, important federal mandates and business drivers, including, but not limited to: the Government Paperwork Elimination Act; the Government Information Security Reform Act; the Clinger-Cohen Act; the Government Performance and Results Act; the Federal Records Act; the Computer Security Act;

the Freedom of Information Act; the Disabilities Act; Section 508 of the Rehabilitation Act; the Disaster Mitigation Act of 2000; the National Flood Insurance Reform Act of 1994;the Stafford Act; the Flood Disaster Protection Act of 1973, the Housing and Urban Development Act of 1969;

the Privacy Act of 1974, as amended, the E-Government Act of 2002, as appropriate, as well as other laws and regulations specific to FEMA.

The work performed shall be in conformance with applicable Government regulations and policies including the FAR, the HSAR, the HSAM, and other agency supplemental regulations, processes and procedures. Procurement package content and structure shall be in accordance with the latest FAR, DHS, and FEMA acquisition regulations, guidance and templates.

The Contractor must adhere to the policies and procedures pursuant to the FEMA Office of the Chief Financial Officer (OCFO) Conference Planners Reference Guide and DHS Travel Policy Section 7.10 – Conferences for conference planning, approval and documentation of conference-related activities and expenses. The Contractor’s support must comply with all statutes and demonstrate working knowledge of applicable regulations, policies, guidelines, and specifications that affect FIMA/FEMA/DHS.

The Contractor’s support must be flexible to accommodate a changing environment as the roles and mission of FIMA evolves. In addition, Contractor support may recommend changes to improve efficiency and effectiveness of FIMA's acquisition management initiatives. There will be limited space at the government work site (when made available at the task order level).

VI Period & Place of Performance

The anticipated period of performance shall include one (1) 12-month Base Period and four (4) 12-month Option Periods.

The primary performance location will be the DHS FEMA facility located at 400 C Street SW Washington, DC. The contractor may be requested/required to work at other DHS FEMA facilities in the Washington Metropolitan area, as well as offsite (contractor facility). Alternate performance locations must be approved by the Contracting Officer’s Representative (COR).

VII Deliverables and Delivery Schedule

I. BPA Deliverables:

Deliverable Description Due Date

Post Award Kickoff Meeting

The Contractor shall attend a Post Award Conference with the CO and the COR no later than three (3) business days after the date of award. The purpose of the Post Award Kickoff Meeting, which will be chaired by the CO, is to discuss the objectives of the resultant BPA and review the Contractor's BPA Management Plan/Technical Approach. The Post Award Conference will be held virtually.

Within three (3) business days after the BPA award date.

Monthly Status Report

The Contractor shall provide a monthly report which includes a listing of all authorized task orders, status of work, accomplishments, challenges, performance risks and the period of performance.

Monthly

II. Task Order Deliverables:

Task order deliverables, work products and schedule will be established at the task order level.

VIII Technical Clauses

I. RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

• includes FEMA records;

• does not include personal materials;

• applies to records created, received, or maintained by Contractors pursuant to their FEMA contract; and

• may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for

Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. FEMA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FEMA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity.

Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the SOW. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FEMA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the SOW. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and FEMA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FEMA policy.

8. The Contractor shall not create or maintain any records containing any non-public FEMA information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The FEMA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which FEMA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

II. 508 INFORMATION TECHNOLOGY CLAUSE

Section 508 Requirements

Section 508 Applicable EIT Accessibility Standards 36 CFR 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including, but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.23 Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non-end-user interfaces such as switches, circuits, etc. that are procured, developed or used by the Federal Government.

36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required

1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Section 508 Applicable Exceptions Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

Section 508 Compliance Requirements 36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards.

When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

III. DHS ENTERPRISE ARCHITECTURE COMPLIANCE

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the Contractor shall comply with the following Homeland Security Enterprise Architecture (HLS EA) requirements:

A. All developed solutions and requirements shall be compliant with the HLS/FEMA EA.

B. All IT hardware and/or software shall be compliant with the HLS/FEMA EA Technical Reference Model (TRM) Standards and Products Profile.

C. Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

D. Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01[1] and all data-related artifacts will be developed and validated according to DHS data management architectural guidelines.

E. Applicability of IPv6 to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant as defined in the USGv6 Profile (NIST Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

IV. SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

A. Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

B. Definitions. As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

https://www.dhs.gov/sites/default/files/publications/mgmt_directive_103_01_enterprise_data_management_policy.pdf

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

1. Protected Critical Infrastructure Information (PCII) as set out in the Critical

Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

2. Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

3. Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(a) Truncated SSN (such as last 4 digits)

(b) Date of birth (month, day, and year)

(c) Citizenship or immigration status

(d) Ethnic or religious affiliation

(e) Sexual orientation

(f) Criminal History

(g) Medical Information

(h) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

C. Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

1. DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for

Official Use Only) Information

2. DHS Sensitive Systems Policy Directive 4300A

3. DHS 4300A Sensitive Systems Handbook and Attachments

4. DHS Security Authorization Process Guide

5. DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

6. DHS Instruction Handbook 121-01-007 Department of Homeland Security

Personnel Suitability and Security Program

7. DHS Information Security Performance Plan (current fiscal year)

8. DHS Privacy Incident Handling Guidance

9. Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

10. National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

11. NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://csrc.nist.gov/groups/STM/cmvp/standards.html http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html

D. Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

1. Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

2. The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

3. All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

4. The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

5. Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.

(a) Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection

Security Agreement(s). During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

(b) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

6. Security Review. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and COR, contact the Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to the DHS. Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of Government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

http://www.dhs.gov/privacy-compliance http://www.dhs.gov/privacy-compliance

7. Continuous Monitoring. All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis. The Contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities. The Government may elect to perform continuous monitoring and IT security scanning of Contractor systems from Government tools and infrastructure.

8. Federal Reporting Requirements. Contractors operating information systems on behalf of the Government or operating systems containing sensitive information shall comply with Federal reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors shall provide the COR with requested information within three (3) business days of receipt of the request. Reporting requirements are determined by the Government and are defined in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The Contractor shall provide the Government with all information to fully satisfy Federal reporting requirements for Contractor systems.

E. Sensitive Information Incident Reporting Requirements.

1. All known or suspected sensitive information incidents shall be reported to the

Headquarters or Component Security Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting requirements. When notifying the Headquarters or Component SOC, the Contractor shall also notify the Contracting Officer, COR, Headquarters or Component Privacy Officer, and US- CERT using the contact information identified in the contract. If the incident is reported by phone or the Contracting Officer’s email address is not immediately available, the Contractor shall contact the Contracting Officer immediately after reporting the incident to the Headquarters or Component SOC. The Contractor shall not include any sensitive information in the subject or body of any e-mail. To transmit sensitive information, the Contractor shall use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption methods to protect sensitive information in attachments to email. Passwords shall not be communicated in the same email as the attachment. A sensitive information incident shall not, by itself, be interpreted as evidence that the Contractor has failed to provide adequate information security safeguards for sensitive information, or has otherwise failed to meet the requirements of the contract.

2. If a sensitive information incident involves PII or SPII, in addition to the reporting requirements in 4300A Sensitive Systems Handbook Incident Response and Reporting, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(a) Data Universal Numbering System (DUNS);

(b) Contract numbers affected unless all contracts by the company are affected;

(c) Facility CAGE code if the location of the event is different than the prime contractor location;

(d) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, email);

(e) Contracting Officer POC (address, telephone, email);

(f) Contract clearance level;

(g) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(h) Government programs, platforms or systems involved;

(i) Location(s) of incident;

(j) Date and time the incident was discovered;

(k)…