SOW_Fourier-Transform Infrared (FTIR) Spectroscopy with Raman .pdf

U.S. Department of Homeland Security U.S. Customs and Border Protection

Statement of Work

For:

U.S. CUSTOMS AND BORDER PROTECTION

NON-INTRUSIVE INSPECTION SYSTEMS

Handheld Chemical Explosive and Narcotics Analyzer with Raman and Fourier-Transform Infrared (FTIR) Spectroscopy

PREPARED BY:

NII PROGRAM MANAGEMENT OFFICE (PMO)

Table of Contents

1 PURPOSE

1.1 Background and Scope

1.2 Period of Performance

1.3 Delivery

1.4 Shipping Instructions

1.5 Invoicing

1.6 Program Organization

2 APPLICABLE DOCUMENTS

2.1 Federal Regulations and Publications

2.2 DHS/CBP Documents

2.3 Order of Precedence

3 REQUIREMENTS

3.1 Requirements Definitions

3.2 General Requirements

3.2.1 Salient Characteristics for Brand Name or Equal:

3.3 System Support Requirements

3.3.1 Training

3.3.2 Ownership

3.3.3 Technical Manuals

3.3.4 System User's Manual

4 LIFE CYCLE SUSTAINMENT AND SUPPORT REQUIREMENTS

4.1 Warranty

5 INFORMATION TECHNOLOGY SECURITY

5.1 Basic Requirements

5.2 Security Authorization

5.3 Encryption Compliance Requirement

5.4 Security Review

5.5 DHS Security Policy Requirement

5.6 Product Assurance

5.7 Access to Unclassified Facilities, Information Technology (IT) Resources, and Sensitive Information

5.8 Personal Identity Verification (PIV) of Contractor Personnel

5.9 PIV Credential Compliance

5.10 CBP Contractor Handling PII Level

5.11 Security Requirements for Unclassified Information Technology Resources .. 22

5.12 Contractor Employee Access (JULY 2023)

5.13 3052.204-72 - Safeguarding Of Controlled Unclassified Information (July 2023)

5.14 Information Technology Security Awareness Training (JULY 2023)

5.15 DHS-CBP Enterprise Architecture Compliance

5.16 Supply Chain Risk Management Terms and Conditions:

5.17 Hardware and Software Requests

5.18 Supply-Chain Transport

5.19 1Pv6

5.20 Accessibility Requirements (Section 508 Compliance)

5.20.1 Section 508 Applicable EIT Accessibility

5.20.2 Section 508 Applicable Exceptions

5.20.3 Section 508 Compliance Requirements

5.21 3052.204-73 Notification and Credit Monitoring Requirements For Personally Identifiable Information Incidents (July 2023)

5.21.1 PII and SPII Notification Requirements

5.21.2 Credit Monitoring Requirements. The Contracting Officer may direct the Contractor to:

5.22 Interconnection Security Agreement Requirements

5.23 OCIO CISO Cyber-Supply Chain Risk Management (C-SCRM)

5.23.1 Original Equipment Manufacturer (OEM) End-use Information and Communications Technology (ICT) Product

5.23.2 Accounting of Components in ICT Products

5.23.3 Supply-Chain Transport

5.23.4 Changes to Ownership and Control

6 SPECIAL CONSIDERATIONS

6.1 Changes to the SOW

6.2 Travel

6.3 Points of Contact

6.3.1 Technical POC:

6.3.2 Contracting Officer:

6.3.3 Contracting Officer's Representative:

6.3.4 Budget (SAP Approver):

7 DATA ITEM DELIVERABLES (Data Item Description (DID))

8 APPENDICES

8.1 APPENDIX 1: DATA ITEM DELIVERABLES

Version Date Comments v1 09/11/2024 Original v2 11/19/2024 Comments from NIID v3 11/21/2014 Comments from ILD

Statement of Work

1 PURPOSE

The U.S. Customs and Border Protection (CBP), Non-Intrusive Inspection (NII PMO) Program intends to procure chemical and explosives detection devices with the Fourier Transform Infrared Spectroscopy (FTIR) and Raman spectroscopy capability along with a LowDoseID accessory. The purpose of this procurement is to provide CBP ports of entry (POE’s) and land border crossings with the capability to scan objects believed to be narcotics. It has been determined that these devices possess the capability to identifies a broad range of unknown chemicals and explosives in bulk amounts with higher purity levels quickly and safely.

1.1 Background and Scope

CBP continues to seize an increasing number of opioids at the nation’s borders. Of significant concern is the spike in fentanyl seizures. Fentanyl is a synthetic opioid that is fifty times more powerful than heroin and poses a significant risk to CBP field personnel and the public. To combat this threat and many others, CBP implements a layered enforcement strategy that incorporates a broad range of tools and capabilities essential to the detection and interdiction of illicit materials smuggled into the United States.

The U.S. Customs and Border Protection, Office of Field Operations (OFO) seeks to purchase handheld analyzers with Raman and Fourier-Transform Infrared (FTIR) Spectroscopy technology with LowDoseID accessory for use at Ports of Entry (POE).

The detection equipment will be used by CBP Officers in non-intrusive testing and can identify a wide range of narcotics, controlled substances, and general organic materials.

The objective of this program is to rapidly and accurately identify and interdict contraband illegally arriving in the United States. The Raman/FTIR analyzer combined with LowDoseID provides improved detection capabilities of illicit drugs and chemicals with the addition of the surface enhanced Raman spectroscopy (SERS) H-kit and screener algorithm enhancements.

1.2 Period of Performance

This is a single award Blanket Purchase Agreement (BPA). The period of performance for this single award BPA is as follows:

Base Ordering Period: 04/30/2025 through 04/29/2026 BPA Ordering Period 1: 04/30/2026 through 04/29/2027

BPA Ordering Period 2: 04/30/2027 through 04/29/2028 BPA Ordering Period 3: 04/30/2028 through 04/29/2029 BPA Ordering Period 4: 04/30/2029 through 04/29/2030

The anticipated period of performance is twelve (12) months from the date of award with four (4) option years.

The effective period begins at award and ends at completion of the warranty period of the last handheld analyzer order during the last active order, or the last day of the ordering period, whichever is later.

CBP intends to procure one hundred and forty (140) handheld analyzers during the base year and a total not to exceed one-thousand and nine hundred (1900) handheld analyzers during the four (4) Option Years.

1.3 Delivery

Delivery of systems shall begin no later than Sixty (60) days from the date of execution of a Delivery Order. Coordination shall be made with the CBP shipping Point of Contact (POC listed in SOW Paragraph 1.4. prior to delivery. On site operational testing shall be conducted prior to acceptance of each system. The contractor shall provide updates to the delivery schedule on a monthly basis or if a significant deviation of more than 10% occurs.

1.4 Shipping Instructions

The Contractor shall include shipping and delivery to ILD F.O.B. Destination in the price of each unit. If applicable, the Contractor shall permanently disable all wireless connection capability within each system prior to delivery to the field.

Each system and the associated equipment and accessories shall be shipped together in the case as follows:

For Common Courier (FedEx, UPS, USPS):

U.S. Customs & Border Protection Mail Stop: 1220 Integrated Logistics Division 10720 Richmond Highway Lorton, VA 20598

For Freight Services:

U.S. Customs & Border Protection Integrated Logistics Division 10720 Richmond Highway

Lorton, VA 22079

CBP Point of Contact:

Ms. Emilie Anders U.S. Customs and Border Protection (CBP) Integrated Logistics Division (ILD) CBP ILD, Lorton, VA Office Phone: (571) 468-3312 Cell Phone: (571) 237-3910 Email: Emilie.M.Anders@cbp.dhs.gov

1.5 Invoicing

The Contractor shall submit an original invoice to the address designated in the contract to receive invoices. The invoice shall be simultaneously transmitted electronically to the COR at the e-mail address provided in section 6.3, and the Contractor shall invoice CBP per CBP invoicing clause, “Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP) (JAN 2016).”

Please ensure the following are included in all invoices:

• Contract number.

• Order Number (e.g., Task Order, Delivery Order, Purchase Order, etc.).

• Description of supplies or services provided for a specified time period.

• CLIN the supplies or services are charged under.

• Unit price and total amount of each item; and discount terms (if applicable).

• Company name, telephone number, taxpayer’s identification number, and complete

• mailing address to which payment will be mailed.

• Backup documentation showing the government has received the goods and/or services.

Payment requests shall be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b), "Payment documentation and process." The IPP website address is: https://www.ipp.gov.

A courtesy e-mail notification upon invoice submission in IPP shall be sent by the Contractor to the COR. Only the CO has the authority to represent the Government in cases where the delivery order requires a change in the terms and conditions, delivery schedule, scope of work and/or price of the products and/or services under this task order

1.6 Program Organization

This program is under the technical direction of the Contracting Officer’s Representative (COR) and the Project Manager (PM) assigned to, which is part of the CBP Office of Field Operations (OFO).

CBP will manage this program through the CBP NII PMO process for unit acquisition, delivery, and acceptance. CBP will coordinate with the Manufacturer to ensure successful unit deployment. The CBP Enterprise Service, Integrated Logistics Division (ILD) will manage the delivery, functional testing, acceptance warranty service support, and maintenance services. will perform pre-award capability testing of the handheld narcotics analyzer. The CBP Office of Training Development (OTD) will approve training material. will coordinate operator training.

2 APPLICABLE DOCUMENTS

Documents cited shall be referenced and used as called for in this Statement of Work Performance Specifications and attached Data Item Deliverables (DIDs).

2.1 Federal Regulations and Publications

• Code of Federal Regulations, 29 CFR 1910.120, Occupational Safety and Health

Standards (OSHA), 2012.

• Code of Federal Regulations, 10 CFR 20.1601 and 1602, Standards for

Protection against Radiation, 2012, (NRC).

• National Fire Protection Association (NFPA) 79, Electrical Standards for Industrial

Machinery, 2015.

• NFPA 70, Recommended Practice for Electrical Equipment Maintenance, 2014.

• Federal Information Security Modernization Act of 2014.

• National Institute of Standards and Technology publications.

• 36 CFR 1194.3, General Exceptions.

• American Society of Testing Materials (ASTM) standards ASTM E 592-99, ASTM

747-97, ASTM E 1025-9, and ASTM F 792-01.

• Office of Management and Budget (OMB) Circular A-130, Management of

Federal Information Resources.

• Computer Security Act of 1987 (40 U.S.C. 1441 et seq.).

• Government Information Security Reform Act of 2000.

• Federal Information Security Management Act of 2002.

• Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135).

• 49 CFR Part 1520, Policies and Procedures of Safeguarding and Control of Sensitive Security Information (SSI).

• MIL-STD-1472H, Department of Defense Design Criteria Standard, Human Engineering, 15 September, 2020.

2.2 DHS/CBP Documents

• DHS Sensitive Systems Policy Directive 4300A, Version 13.0.

• CBP Information Systems Security Policies and Procedures, HB 1400-05D, Version 7.0.

• DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But

Unclassified (For Official Use Only).

• DHS-CBP N.25, Standard Messaging Protocol, Version 1.5.0.6, 2010

• CBP Interface Control Document, Version 5, Jan 2013.

• CBP Port Radiation Inspection, Detection and Evaluation (PRIDE) 2.0 Interface

Control Document (ICD) version 5, 2015.

• CBP Training Development Standards, 2008.

• CBP Instructor-Led Training (ILT) Style Guide, 2009.

• CBP Instructor-Led Training (ILT) Process Guide, 2008

2.3 Order of Precedence

In the event of a conflict between the texts of this SOW and the references cited above, this SOW takes precedence. However, nothing in this SOW supersedes applicable federal and state safety laws.

3 REQUIREMENTS

The Contractor shall perform all tasks within this SOW. The Contractor shall abide by all applicable Federal regulations, national standards, and U.S. Department of Homeland Security (DHS) and CBP documents in performing all tasks. Requirements for this effort shall include the fabrication, integration, test, delivery, training, logistics, and on-demand support of Handheld Chemical Explosive and Narcotics Analyzers with Fourier- Transform Infrared (FTIR) and Raman Spectroscopy.

3.1 Requirements Definitions

• Threshold: The minimum level of operational performance that the Government is willing to accept is considered a threshold value.

• Objective: A level of performance that significantly improves mission performance, safety, or supportability beyond that of the threshold value, and represents the desired yield for system performance is considered an objective.

• Objective values are not required but can be defined to provide guidance to the Contractor with respect to areas where increased capability is of interest/value to the government. If Objectives are defined, the interval between the Objective and Threshold values for a given parameter is the government program manager’s (PM) trade-space.

• Single Requirement: Some requirements will have only a single parameter value and, when this is the case, these values are thresholds.

3.2 General Requirements

The Contractor shall perform the work necessary to develop, test and deliver the procured equipment. The Contractor shall also provide warranty, logistics, and on-demand services, including initial operator training, for support of these Handheld Chemical Explosive and Narcotics Analyzers with Fourier-Transform Infrared (FTIR) and Raman Spectroscopy. Each system shall meet the requirements defined in this Statement of Work/Performance Specification.

The Contractor shall deliver Handheld Chemical Explosive and Narcotics Analyzers with Fourier-Transform Infrared (FTIR) and Raman Spectroscopy capability, or equal, which meets or exceeds specifications described below:

The complete system, all sub-systems, and all components, parts, and attachments shall be new. Proposals incorporating reconditioned or used systems, in part or in full, will be regarded as non-responsive. The system shall be commercially available, and in commercial production as of the closing date of this solicitation. The system must be portable, readily deployable, and shall meet all the main and sub-system manufacturers published overall and sub- system performance specifications when distributed to the final sites of operation.

The system containing all listed sub-systems and major components shall be provided as part of the complete system and each shall meet their individually described detailed technical and performance specifications. The system and sub-systems will be purchased from a single Contractor. Thus, any Contractor not responding to all minimum requirements will be considered as non-responsive. No prototypes, one-of-a-kind, or two-of-a-kind systems will be considered.

3.2.1 Salient Characteristics for Brand Name or Equal:

• Raman/FTIR handheld analyzer:

o FTIR

(1) 4,000 cm-1 to 650 cm-1 spectral range;

(2) 4.0 cm-1 resolution;

(3) Diamond ATR crystal;

o Raman

(1) 250 cm-1 to 2875 cm-1 spectral range;

(2) 7-10.5 cm-1 resolution;

(3) Fiber optic probe o The Raman/FTIR handheld analyzer shall be powered by external AC adapter and by battery;

o The Raman/FTIR handheld analyzer shall have an operational temperature range of -4°F to 122°F (-20°C to 50°C);

o The Raman/FTIR handheld analyzer shall conform to Mil-STD-810G and IP67 durability standards;

o The Raman/FTIR handheld analyzer shall have dimensions no greater than 11” x 6” x 3” for portability purposes;

o The Raman/FTIR handheld analyzer shall have data download capability for both spectroscopic analysis and reach-back support;

o The Raman/FTIR handheld analyzer shall be capable of being operated while wearing level A protective equipment;

o The Raman/FTIR handheld analyzer shall have a weatherproof hard shell protective case that is black in color and includes a charging plug;

o The Raman/FTIR handheld analyzer shall include a second AC charging plug;

• LowDoseID Software/Hardware accessory o The LowDoseID software/hardware accessory shall provide the following enhanced detection capabilities to the FTIR/Raman analyzers:

Identification of Fentanyl, Heroin, and other high priority substances in low concentrations (≈1-10%);

The user shall have the ability to scan and identify lower dose substances while the LowDoseID accessory is connected to the analyzer;

Upon completing the analysis of lower dose substances, the LowDoseID Screener software shall display the results in a hierarchical manner. If one or more Alarm items are identified, then only those shall be displayed. If no Alarm items are identified, then the Warning or Clear items shall be displayed;

Provide the user with additional hazard information concerning the chemical once it has been identified. At a minimum, the additional information shall include chemical descriptions, common synonyms, protective gear required, first aid and fire information;

Allow the user to choose to conduct scans in Direct mode, Screener mode, or SERS (Type H) mode;

Users shall have the ability to identify low concentration chemicals in the Screener mode using the H-kit.

The Screener mode shall allow a user to determine whether a substance of interest is present;

Scan results shall indicate if a direct scan, screener scan, or a SERS (Type H) scan was performed. The exported scan report shall indicate the if a direct scan, screener scan, or a SERS (Type H) scan was performed;

The LowDoseID accessory combined with the FTIR/Raman analyzer shall weigh no more than five (5) pounds;

Each LowDoseID accessory shall include twenty (20) Type H kits consisting of twenty (20) SERS (Type H) sticks and twenty (20) 1.0ml vials of Methanol to be used as the solvent for SERS (Type H) low dosage extraction testing.

• Raman/FTIR Data system and software shall include:

o Software data acquisition, data processing, and interpretation, on the system;

o Internal libraries for common chemicals, toxic industrial chemicals, forensic drugs, drug precursors, white powders, pesticides, chemical weapons of mass destruction, explosives, and United Nations restricted chemicals;

o Internal libraries shall not be proprietary in nature and have the capability of accepting user defined updates;

o The FTIR/Raman software shall not be proprietary to the vendor and shall have the ability to be viewed by CBP support personnel (i.e. CBP Laboratories and Scientific Services (LSS)) for reach back support purposes.

• Reachback and support shall include:

o Not less than five (5) years of warranty and support to include library updates and software upgrades as needed.

o On site operational testing of each system shall be conducted prior to acceptance.

o All system documentation shall be provided in both electronic and hard copy.

3.3 System Support Requirements

3.3.1 Training Execution

The Contractor shall coordinate training venues, dates and times with the CBP point of contact listed in Section 6. Each system shall include a two (2) day training session that accommodate not less than twenty officers. Contractor training shall be provided by a certified trainer. Training shall be tailored to CBP operational environments and conducted on Government site. Training sessions shall include familiarization with the software, basic operation, interpretation of data and other software capabilities, and basic end-user maintenance and troubleshooting. Contractor travel costs to CBP training venues shall be included with the purchase of each system.

3.3.2 Maintenance Technician Training

At the Contractor’s expense, the Contractor shall develop and provide a Maintenance Technician Training curriculum, and deliver Maintenance Technician Training, to include classroom and hands- on instruction, an Instructor Guide, a Student Guide, an Operator’s Manual, a Service and Maintenance Manual, and on-the-job training aids.

Maintenance Technician Training shall cover all items contained in the Maintenance Technician/Service Manual. At the Contractor’s expense, training shall be performed at CBP’s NII Maintenance & Logistics Depot located in Lorton, Virginia. Training shall include two (2) Maintenance Technician Training classes for up to four (4) Electronic Technicians per class and provide basic operator and depot level electronic technician repair training pertinent to the equipment to perform corrective repair of subassembly and components and preventive maintenance.

3.3.3 Ownership

All training products (including developmental documents, notes, storyboards, etc.)

become the property of the United States Government upon delivery and acceptance by the government. All rights for use, modification, and repurposing of the training in whole or in part shall belong to the Government.

3.3.4 Technical Manuals

The Contractor shall provide a System User's Manual, Maintenance/Service Manual and Contractor Technical Documentation. The Contractor shall provide commercial-off-the-shelf manuals when feasible. Manuals shall be provided with each system with the option of electronic delivery upon request.

3.3.5 System User's Manual

A System User's Manual is required for each delivered unit. The System User's Manual shall contain a description of the system and its operation. System limitations, safety information and other important information shall be highlighted. The System User's Manual shall contain a detailed explanation of each task required during the operation of the system. All operator-level maintenance tasks shall be fully explained in the System User's Manual.

4 LIFE CYCLE SUSTAINMENT AND SUPPORT REQUIREMENTS

The following identifies the life cycle sustainment and support requirements for the System.

4.1 Warranty

• The Contractor shall provide warranties for each new delivered chemical analyzer with Raman/FTIR Spectroscopy System along with the materials library and software [updates] for a minimum of five (5) years. Warranty for each system shall begin on the date of operational acceptance.

• The Contractor warranty shall include service, support, hardware, software upgrades needed for sustainment and repair.

• Products returned to the Contractor shall be tracked and follow the Turn Around Time requirement. The Contractor shall cover all shipping costs when shipping back to the ILD Lorton Repair Depot

• The contract shall provide the latest software and library updates, user guides, end user troubleshooting guides and training decks during the warranty period.

• Warranty repairs shall cover labor, parts, components, devices, packing, handling, shipping, and other costs.

4.2 TURNAROUND TIME (TAT)

Turnaround Time (TAT) is defined as the time, in days, from when the individual serialized piece of equipment repair is approved by the COR to when the equipment is received back to the Government. The Contractor shall provide all the required maintenance and repair services within the required Turn-Around Time (TAT), which is inclusive of logistics time, diagnostic time, fault isolation, waiting or administrative downtime, and corrective maintenance downtime. TAT is defined as the time, in calendar days, from when the individual serialized piece of equipment is received by the Contractor to when the equipment is received and accepted back by the Government.

The TAT for each serialized equipment shall be no more than twenty (20) calendar days.

The TAT for each serialized equipment shall be calculated by using the following:

The Contractor shall meet or exceed these performance standards while complying with all applicable State and Federal regulations. The Contractor shall notify the Government of any circumstances that would result in longer turn arounds times for the induvial serialized piece of equipment.

Work Completion Form (WCF)

The WCF is a unique form to a specific maintenance event. The WCF shall include the WO number assigned by the Government; a description of the maintenance action performed; identify the failure cause or part if any; a list of replaced parts by part/serial number; usage data or scan count since last maintenance activity. The Contractor shall forward the completed WCF and preventive maintenance documentation (if applicable) to the ILD Maintenance Dispatch Center within 48 hours of maintenance action completion. The Contractor shall provide one (1) copy of the completed WCF to the site supervisor and forward one (1) copy to the ILD Maintenance Dispatch Center upon completion of each required site visit.

5 INFORMATION TECHNOLOGY SECURITY

The Contractor shall provide administration support to the government to manage the information-based systems, hardware, firmware, software, applications, and peripheral equipment. These administration tasks shall consist of activities to maintain the integrity of the system architecture, security, and assist users with access to the system. The Contractor shall also provide support to the Government to implement system security patches, software/firmware updates, and scanning when required.

5.1 Basic Requirements

The Contractor shall adhere to all DHS and CBP IT security policies listed in the applicable documents section, including the guidelines and policies stated in the DHS Sensitive Systems Policy Directive 4300A, chapters 4 and 5, or any subsequent, replacement or revised publication. This policy mandates DHS organizational elements, including Contractors, follow guidelines outlined in the DHS 4300A Policy Directive (Version 13.3, February 13, 2023), Information Technology Security Program, Version 13, with attachments or any subsequent, replacement or revised publication.

DHS Directive 4300A, Section 3.2., Basic Requirements outlines the management, operational and technical baseline security requirements (BLSR) for DHS Components to ensure confidentiality, integrity, availability, authenticity, and non-repudiation of sensitive information systems. The 4300A policy directive provides greater detail of the BLSRs, including the roles and responsibilities associated with each.

CBP will provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS 4300A Policy Directive (Version 13.3, February 13, 2023), paragraph 4.1.1.d. During all systems development life cycle (SDLC) phases of CBP systems, CBP personnel will develop documentation and provide any required information for all levels of classification in support of the certification/accreditation process. In addition, all security certification/accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

The contractor shall provide systems that conform to the following requirements:

Legacy air gapped non-integrated systems shall:

• The operating system software shall be upgradeable, as only approved applications may be used on CBP workstations

• Wi-Fi shall not be used and be disabled.

• All operating systems must use the requisite DHS Security Technical

Implementation Guides (STIGs) for hardening configurations

• All systems shall use required encryption for data at rest

• All vendor contractors shall not remove image data from systems nor store said data on contractor networks

• Ground-truthing or tuning of systems will be performed only on CBP systems and not on contractor networks unless specifically authorized.

Integrated networked systems shall follow the above requirements and additionally:

• If systems are using WiFi, the design must be explicitly reviewed and approved by the CBP ENTSD organization

• Other wireless connectivity may be approved by ENTSD

• Systems must be patched and maintained according to DHS patching standards (within 30 days usually)

• Username/Password authentication is not allowed

• PIV authentication is required for the systems

• Must integrate with CBP identify management lifecycle systems

• Account Level operator 2 should not be able to create or delete accounts

• Administrator accounts should not be able to perform user level functions or have direct access to perform actions within user accounts

• Auditing should integrate with enterprise audit log repository (SPLUNK)

5.2 Security Authorization

A Security Authorization of any infrastructure directly in support of the DHS information system shall be performed by the Contractor as a general support system (GSS) prior to DHS occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results. The Security Authorization shall be performed in accordance with the DHS Security Policy and the controls provided by the hosting provider shall be equal to or stronger than the Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, Section 3, security categorization of the DHS information system.

At the beginning of the contract, and annually thereafter, the Contractor shall provide the results of an independent assessment and verification of security controls in the Contractor’s format. The independent assessment and verification shall apply the same standards that DHS applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the Contracting Officer Representative (COR) for entry into the DHS Plan of Action and Milestone (POA&M) Management Process. The Contractor shall use the DHS POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS POA&M Management Process. Contractor procedures shall be subject to periodic, unannounced assessments by DHS officials. The physical aspects associated with Contractor activities shall also be subject to such assessments.

On a periodic basis, the DHS, and its Components, including the DHS Office of Inspector General, may choose to evaluate any or all of the security controls implemented by the Contractor under these clauses. Evaluation could include but is not limited to vulnerability scanning. The DHS and its Components reserve the right to conduct audits at their discretion. With ten working days’ notice, at the request of the Government, the Contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein DHS information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of DHS, including those initiated by the Office of the Inspector General.

The government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by DHS in the event of a security incident.

5.3 Encryption Compliance Requirement

• Systems requiring encryption shall comply with National Security Agency (NSA)

Type 2 or Type 1 encryption.

• Only cryptographic modules that are FIPS 197 (AES 256) compliant and have received FIPS 140-2 validation at the level appropriate to their intended use may be used in systems requiring encryption.

• Public Key Infrastructure (PKI) (see paragraph 5.5.2.l of the Department of Homeland Security (DHS) Sensitive Systems Policy Directive 4300A).

5.4 Security Review

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS including the organization of the DHS Office of the Chief Information Officer, Office of Inspector General, the CBP Chief Information Security Officer, authorized COR, and other Government oversight organizations, access to the Contractor’s and subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of Government oversight organizations external to the DHS. The Contractor shall provide access to the extent necessary for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

5.5 DHS Security Policy Requirement

All hardware, software, and services provided under this must be compliant with DHS 4300A DHS Sensitive System Policy, Section 4.8, and the DHS 4300A Policy Directive (Version 13.3, February 13, 2023), Section 4.8.

Enterprise Security Architecture

The contractor shall utilize and adhere to the DHS Enterprise Security Architecture in accordance with applicable laws and DHS policies to the satisfaction of the DHS COR.

Areas of consideration could include:

• Use of multi-tier design (separating web, application, and data base) with policy enforcement between tiers

• Compliance to DHS Identity Credential and Access Management (ICAM)

• Security reporting to DHS central control points (i.e., the DHS Enterprise Security

Operations Center (ESOC) and integration into DHS Security Incident Response

• Integration into DHS Change Management (for example, the Infrastructure

Change Control Board (ICCB) process)

• Performance of activities per continuous monitoring requirements

5.6 Product Assurance

Information Assurance (IA) is considered a requirement for all systems used to input, process, store, display, or transmit sensitive or national security information. IA is achieved through the acquisition and appropriate implementation of evaluated or validated commercial-off-the-shelf (COTS) IA and IA-enabled Information Technology (IT) products. These products provide for the availability of systems. The products also ensure the integrity and confidentiality of information and the authentication and nonrepudiation of parties in electronic transactions.

Strong preference is given to the acquisition of COTS IA and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting sensitive information) that have been evaluated and validated by authorized commercial laboratories or by the National Institute of Standards and Technology (NIST), as appropriate, in accordance with the following:

• The NIST Federal Information Processing Standards (FIPS) validation program

• The National Security Agency (NSA) /NIST National Information Assurance

Partnership (NIAP) Evaluation and Validation Program

• The International Common Criteria for Information Security Technology

Evaluation Mutual Recognition Agreement

5.7 Access to Unclassified Facilities, Information Technology (IT) Resources, and Sensitive Information

IT resources and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD)

11042.1 Safeguarding Sensitive but Unclassified (For Official Use Only) Information paragraph 6, describes how Contractors must handle sensitive but unclassified information. DHS 4300A Policy Directive (Version 13.3, February 13, 2023) and MD 4300A Information Technology Security Program, Chapter 4, prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering Contractors specifically for all Task Orders that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the Contractor except as specified in the task order.

Contractors who require access to the DHS network, such as when conducting remote maintenance, require a background investigation in accordance with DHS 4300A Policy Directive (Version 13.3, February 13, 2023), paragraph 4.1.1.d.

5.8 Personal Identity Verification (PIV) of Contractor Personnel The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors, paragraph 3, Office of Management and Budget (OMB) guidance M-05-24, Appendix A, chapters 3 and 4, and Federal Information Processing Standards Publication (FIPS PUB) Number 201-2, Personnel Identity Verification of Federal Employees and Contractors, Section 2.

The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have routine physical access to a federally controlled facility or routine access to a federally controlled information system.

5.9 PIV Credential Compliance

Procurements for products, systems, services, hardware, or software involving controlled facility or information system shall be PIV-enabled by accepting Homeland Security Presidential Directive HSPD-12 PIV credentials as a method of identity verification and authentication.

Procurements for software products or software developments shall be compliant by PIV by accepting PIV credentials as the common means of authentication for access for federal employees and Contractors.

PIV-enabled information systems must demonstrate that they can correctly work with PIV credentials by responding to the cryptographic challenge in the authentication protocol before granting access.

If a system is identified to be non-compliant with HSPD-12 for PIV credential enablement, the Contractor shall create a remediation plan for achieving HSPD-12 compliance. This shall be reviewed, evaluated, and approved by the CISO.

5.10 CBP Contractor Handling PII Level

“When a contractor, on the behalf of CBP, handles Sensitive PII data, stores and transmits, the contractor will accredit Authorized to Operate (ATO) this information system to the (HHM) Confidentiality, Integrity and Availability FIPS level”

5.11 Security Requirements for Unclassified Information Technology Resources The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission.

The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

Within 30 days after contract award, the Contractor shall submit for approval its IT Security Plan in the Contractor’s format, which shall be consistent with and further detail the approach contained in the officer’s proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

The Contractor’s IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 USC 1441 et seq.),sections 5 and 6; the Federal Information Security Management Act (44 USC 3554 (b)) of 2014; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130, Appendix III, A.3.b (2).

The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

Examples of tasks that require security provisions include—

Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the Contractor’s copy be corrupted; and

Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

At the expiration of the contract, the Contractor shall return all sensitive DHS information and IT resources provided to the Contractor during the contract, and certify that all non-public DHS information has been purged from any Contractor- owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

Within 6 months after contract award, the Contractor shall submit written proof, in the Contractor’s format, of IT Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A, Section 3.9, or any replacement publication, which the Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The Contractor shall comply with the approved accreditation documentation.

5.12 Contractor Employee Access (JULY 2023)

HSAR Clause 3052.204-71, Contractor Employee Access

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation

Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

Information Systems Vulnerability Information (ISVI) means:

Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks;

applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

Examples of stand-alone PII that are particularly sensitive include:

Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

• Truncated SSN (such as last 4 digits);

• Date of birth (month, day, and year);

• Citizenship or immigration status;

• Ethnic or religious affiliation;

• Sexual orientation;

• Criminal history;

• Medical information; and

• System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required.