SOW_NTC-OT.pdf

Statement of Work

Table of Contents

1. BACKGROUND

2. SCOPE

3. SPECIFIC TASKS

Task 1: Tactical Targeting Support to NTC Task 2: Tactical Targeting Support to the Office of Trade

4. DELIVERABLES AND DELIVERY SCHEDULE

5. GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

6. PLACE OF PERFORMANCE

7. HOURS OF OPERATION

8. PERIOD OF PERFORMANCE AND HOLIDAYS

9. DOMESTIC AND INTERNATIONAL TRAVEL

10. SECURITY

11. CONTRACTOR PRE-SCREENING

Background Investigation (BI) Clearances Identification Badge Physical and IT Security Requirements Remote Access Handling Personally Identifiable Information (PII)

12. SPECIAL CONSIDERATIONS

Government Points of Contact

13. CONTRACTOR KEY PERSONNEL

Data Scientist Content Specialist

14. INSPECTION AND ACCEPTANCE

15. TRAVEL /OTHER DIRECT COSTS (ODCs)

Travel Costs Other Direct Cost

16. UNIQUE STANDARDS

Security Policy Requirement Section 508 Requirements for Technology Services Safeguarding of Sensitive Information (Mar 2015) Information Technology Security and Privacy Training (Mar 2015) Contractor Employee Access (Sep 2012)

18. HSAR 3052.204-70: SECURITY REQUIREMENTS FOR UNCLASSIFIED

INFORMATION TECHNOLOGY RESOURCES (JUN 2006)

1. BACKGROUND

The Department of Homeland Security (DHS), U.S. Customs and Border Protection, Office of Field Operations, National Targeting Center, Cargo Division proactively targets and coordinates examinations of high-risk cargo, provide high quality research to field units and implement new proactive methodologies. The National Targeting Center, Cargo Division (NTC-CD) was created with a mission to provide 24x7 tactical targeting and analytical support for CBP’s international and domestic anti-terrorism efforts in all modes of transportation, coordinate and facilitate information exchange, improve CBP’s control and facilitation of cargo, and conduct strategic targeting and analysis. NTC-CD employs a layered, risk-based strategy to push the zone of security outward, identifying potentially high-risk cargo while facilitating legitimate trade.

The Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP), Office of Trade (OT) is the trade policy, program development, and compliance measurement functions consolidating arm of CBP. OT provides uniformity and clarity for the development of CBP’s national strategy to facilitate legitimate trade and manage the design and implementation of results-driven strategic initiatives of trade compliance and enforcement. OT directs national enforcement responses through effective targeting of goods crossing the border as well as strict, swift punitive actions against companies participating in predatory trade practices. Through coordination with international partners and other U.S. government agencies, it directs the enforcement of intellectual property rights, the identification of risks to detect and prevent the importation of contaminated agricultural or food products, and the enforcement of free trade agreement eligibility.

2. SCOPE

The Contractor shall provide a broad range of intelligence and related data-driven risk management solutions to enable NTC-CD and CBP Office of Trade (OT) to conduct tactical targeting. Tactical targeting includes the following areas: understand the threat environment, increase situational awareness of supply chain, detect, interdict and disrupt illegal cross border activities, expand risk-segmentation through advanced technology and innovative business practices) and intelligence cycle (planning, collection, analysis, exploitation, analysis, production, and dissemination) across all CBP mission areas (border security, narcotics smuggling, counterterrorism, counterintelligence, counter proliferation, illicit trade, and other homeland security issues) and mission support services such as training and development, policy, strategic planning and doctrine, and other areas.

The Contractor shall provide direct support for CBP’s role in protecting U.S. national security, narcotic smuggling, illicit trade, counter proliferation through the formation of a unified approach.. The risk of having data sourced separately is that it becomes compiled in fragments.

The effort involved to structure and operationalized fragmented data into a meaningful way becomes the focus, rather than analysts focusing on the threat. By having access to a wide portfolio of data holdings and personnel who understand how to analyze and process the data in the manner necessary for CBP the Contractor must be able to apply CBP’s unique characteristics and assist with identifying the true threats and risks for CBP to address. The Contractor staff working on this effort alongside CBP Staff must be trained, mentored, and educated on changes within the risk mitigation, targeting, lead generation, open-source intelligence, network analysis, data analysis, all of which directly impacts CBP’s assessment of threats. For example, the Contractor shall have capability to provide business and shipping intelligence regarding networks involving foreign vessels, conducting research into financial assets related to anti-dumping duties, to providing critical global research and data used to substantiate CBP Withhold Release Orders against various items produced in the Xinjiang Uyghur Autonomous Region in support of the Uyghur Forced Labor Prevention Act (UFLPA).

The Contractor shall provide tactical targeting services that integrate public and private sector data sources through automated data-synthesis and analytical tools. These services are expected to provide insight that leads to action utilizing world-class real-time analytics, risk-assessment ratings, and integrate and synchronize with CBP predictive modelling capabilities. The contractor shall provide:

1. Access to open source and third-party data specifically from Westlaw, Reuters News, CLEAR, Graph, Sayari, Eikon, Panjiva, GDELT Open Corporates, as well as other relevant data which sources directly from shipping data, news, social media platforms, publications, global business data, patent data, company data, legal research, threat intelligence, continuous monitoring data, public records and adverse filings, all of which are relevant to the tactical targeting mission.

2. Data shall be domestic and internationally sourced.

3. Data science, data engineering, and analytics subject matter expertise to leverage data, technology, and advanced analytical techniques.

4. Data scientists shall be able to apply customized algorithms to the sourced data sets that will allow them to enter unique and customized data queries that will pull back only data results of interest.

5. The Contractor shall work with and build pre-built algorithms that can query the data for targeting and risk factors of interest to CBP.

6. There shall be the ability to change the algorithms as needed to meet specific targeting requirements on an ad hoc basis.

7. Capability for automated enrichment of CBP data holdings and network analysis to deliver information and insights at the speed of CBP’s tactical targeting activities

8. Management of a large volume of activities that align to CBP’s mission priorities in a fast-paced, high-pressure, detail-oriented working environment.

9. Delivery of high-quality information and reporting products both orally and in writing.

10. The Contractor shall provide a single point of access to licensed aggregated data from sources specified above; thus, eliminating the need for multiple log ins and the need to manually eliminate duplicate data and consolidate data from multiple sources before being able to assess and identify threats.

11. The Contractor shall combine data holdings, technology expertise, data specialization in targeting and trade enforcement to deliver high quality intelligence information to meet CBP’s mission objectives.

Contractor personnel providing these services must effectively work with CBP teams in an environment that demands effective working relationships and skilled communications.

3. SPECIFIC TASKS

Task 1: Tactical Targeting Support to NTC

The Contractor shall provide direct tactical targeting support to NTC. This includes all activities required to respond to Requests for Information (RFI) and deliver support to CBP partners.

Tactical targeting support must be actionable and contain data driven solutions. The Contractor shall provide meaningful insights from the wealth of open source data within the Contractor’s portfolio to provide an understanding of the threat environment for CBP mission areas, increase situational awareness of the trade supply chain trends in the air, maritime and land borders, enhance CBP detection, interdiction and disruption of illegal cross border activity, strengthen trade enforcement, expand risk segmentation through advanced technology, and innovative business practices.

The Contractor shall monitor designated businesses and importers and provide the NTC notifications of specific changes that may impact their risk assessment (such as changes in board of directors, sales, or acquisitions of other companies).

The Contractor shall provide a data pipeline that will take as names and addresses of consignees from CBP systems and append additional information derived from the contractor’s data sources.

The Contractor shall provide an understanding of shipping and trade business necessary to automate the identification of U.S. objectives in relation to vessels of interest. The data sharing will allow programmatic access to a wide variety of vessel information (to include vessel specifications, management, origin, and ownership information) as well as vessel movement history via Automated Identification System (AIS) records. Any discovered corporate entities associated with a vessel will be analyzed and automatically highlight the potential U.S. nexus of the vessels of interest. The Contractor shall incorporate AIS movement and anomaly detection their system to provide a centralized solution for the retrieval of data on a vessel.

The level of effort for this task is equivalent to two (2) Data Scientists and four (4) Content Specialists.

Task 2: Tactical Targeting Support to the Office of Trade

The Contractor shall provide direct tactical targeting support to the CBP Office of Trade (OT).

This includes all activities required to respond to Requests for Information (RFI) and deliver support to CBP partners. Tactical targeting support must be actionable and contain data driven solutions. The Contractor shall provide meaningful insights from the wealth of open source data within the Contractor’s portfolio to provide an understanding of the threat environment for CBP mission areas, increase situational awareness of the trade supply chain trends in the air, maritime and land borders, enhance CBP detection, interdiction and disruption of illegal cross border activity, strengthen trade enforcement, expand risk segmentation through advanced technology, and innovative business practices.

The Contractor shall monitor designated businesses and importers and provide the OT notifications of specific changes that may impact their risk assessment (such as changes in board of directors, sales, or acquisitions of other companies).

The Contractor shall provide a data pipeline that will take as names and addresses of consignees from CBP systems and append additional information derived from the contractor’s data sources.

The level of effort for this task is equivalent to two (2) Data Scientists and two (2) Content Specialists.

4. DELIVERABLES AND DELIVERY SCHEDULE

SOW Reference Title Delivery Schedule

3.1 Monthly Status report for NTC Monthly aligned to billing cycle

3.2 Monthly Status report for OT Monthly aligned to billing cycle

5. GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

The Government has determined that Government Furnished Equipment (GFE) is required and benefits the Government by allowing for flexibility, control, and speed of response.

• The Government will furnish the Contractor’s personnel with sufficient office space and basic office supplies.

• The Government will furnish the Contractor personnel with computers, software, and storage necessary to perform the work under this task order.

• All GFE and unused office supplies shall remain on site at the conclusion of this contract.

• The Contractor is responsible for keeping GFE (e.g., personal computers, printers, and other hardware and software) in a good and operational condition, maintaining the assigned areas in a clean and orderly condition, and providing accessibility at all times. The Contractor shall be liable for neglecting or abusing GFE.

6. PLACE OF PERFORMANCE

The Contractor must be capable of core operations in the Northern Virginia and Washington DC area. The Contractor shall be aware that all personnel must pass CBP background investigations before personnel shall be able to on board to work on site at CBP NTC or other CBP facility.

Remote telework may not be granted. Personnel may be required to work on site full-time.

7. HOURS OF OPERATION

The core business hours applicable to this task order should primarily fall between 0700-1700 ET hours.

8. PERIOD OF PERFORMANCE AND HOLIDAYS

The Period of Performance is September 27, 2022 to September 26, 2027.

Period of Performance Breakdown:

Base Period: September 27, 2022 – September 26, 2023 Option Period 1: September 27, 2023 – September 26, 2024 Option Period 2: September 27, 2024 – September 26, 2025 Option Period 3: September 27, 2025 – September 26, 2026 Option Period 4: September 27, 2026 – September 26, 2027

Federal Holidays:

New Year's Day Labor Day Martin Luther King's Birthday Columbus Day Presidents' Day Veterans Day Juneteenth National Independence Day Thanksgiving Day Memorial Day Christmas Day Independence Day Any other day designated by Federal statute, by Executive Order or by the President's proclamation.

9. DOMESTIC AND INTERNATIONAL TRAVEL

No contractor travel outside of the local commuting area will be performed as part of this SOW.

10. SECURITY

The Contractor shall comply with the CBP administrative, physical, and technical security controls to ensure that the Government’s security requirements are met. The Contractor shall not use, disclose, or reproduce data, which bears a restrictive legend, other than as required in the performance under this SOW.

11. CONTRACTOR PRE-SCREENING

Contractors requiring recurring access to Government facilities or access to sensitive but unclassified information and/or logical access to IT resources shall verify minimal suitability requirements, as described below, for all persons/candidates designated for employment under any CBP contract by pre-screening the person/candidate prior to submitting the name for consideration to work.

Pre-screening the candidate ensures that minimum suitability requirements are considered and mitigates the burden of DHS having to conduct background investigations on objectionable candidates. The Contractor shall submit only those candidates that have not had a felony conviction within the past 36 months or illegal drug use within the past 12 months from the date of submission of their name as a candidate to perform work under this contract. Candidates shall also be submitted for a financial background check. Contractors are required to flow this requirement down to subcontractors. Pre-screening involves Contractors and subcontractors reviewing:

1. Felony convictions within the past 36 months. An acceptable means of obtaining information on felony convictions is from public records, free of charge, or from the National Crime Information Center (NCIC).

2. Illegal drug use within the past 12 months. An acceptable means of obtaining information related to drug use is through employee self-certification, by public records check; or if the Contractor or subcontractor already has drug testing in place.

There is no requirement for Contractors and/or subcontracts to initiate a drug testing program if they do not have one already in place.

3. Misconduct such as criminal activity on the job relating to fraud or theft within the past 12 months. An acceptable means of obtaining information related to misconduct is through employee self-certification, by public records check, or other reference checks conducted in the normal course of business.

4. Financial irresponsibility related to tax liens and bankruptcy within the last 7-10 years. An acceptable means of obtaining information related to financial irresponsibility is through a financial background check.

Pre-screening shall be conducted within fifteen (15) business days after contract award. This requirement shall be placed in all subcontracts if the subcontractor requires routine physical access, access to sensitive but unclassified information, and/or logical access to IT resources.

Failure to comply with the pre-screening requirement will result in the Contracting Officer taking the appropriate remedy.

12. SECURITY REQUIREMENTS

i.Background Investigation (BI)

A background investigation (BI) is required for performance under this effort. Contractor employees shall not begin working until the BI is approved by CBP, Security Programs Division.

Exceptions to this requirement will be handled on a case-by-case basis, and access to facilities, systems, data, etc. will be limited until the individual is cleared. All personnel employed by the Contractor for the performance under this TO shall either currently possess or be able to favorably pass a background investigation. Should additional security clearance requirements beyond a CBP BI (e.g., Secret, Top Secret, etc.) are needed, a modification will be issued to add this requirement to the key personnel identified as needing such requirement. All personnel employed by the Contractor or responsible to the Contractor for work performed hereunder shall either currently possess or be able to favorably pass a full five (5) year background investigation (BI) required by CBP policies and procedures for employment prior to beginning work with CBP. This policy applies to any new personnel hired during the term of this contract.

Executive Order 13467 allows for the acceptance of “suitability reciprocity” to Contractor personnel who are component employees within DHS.

The Contractor shall submit within ten (10) working days after award: A list containing the full name, Social Security Number, and date of birth of those people who shall require background investigations by CBP and submit such information and documentation as may be required by the Government to have a BI performed.

Information must be correct and reviewed by the designated CBP Security Official for completeness. Normally, information requests for a background investigation consists of SF-85P, “Questionnaire for Pubic Trust Positions” or SF-86, “Questionnaire for Sensitive Positions (For National Security)” TDF 67-32.4 “U.S. USCS Authorization for Release of Information”, FD 258, “Fingerprint Charts” and a Financial Statement. Failure of any Contractor personnel to successfully pass a background investigation shall be cause for the candidate’s immediate dismissal from the project and replacement by a similar and equally qualified candidate as determined and approved by the CO/COR. This policy also applies to any personnel hired as replacements during the term on the contract order.

All background investigation forms must be accepted by CBP with verbal approval from a representative for CBP Office of Management Inspection and Integrity Assurance, Security Program Division (MIIA-SPD) before contract personnel can begin work under this order.

MIAA-SPD estimates these procedures will take approximately ten (10) days for the time they receive the packet. Currently, completion of background investigations is taking approximately six (6) months from initial acceptance of the package.

The Contractor shall notify the COR and CBP OIT Workforce Management Group (WMG), BI Coordinator of any changes in access requirements for its personnel no later than one day after any personnel changes occur. This includes name changes, resignations, terminations, and reassignments including those to another contract. The Contractor/Project Manager shall be responsible for the completion and timely submission to the COR of the CF-242 for all departing contract personnel. The Contractor shall provide OIT/WMG/BI Coordinator the following information on behalf of their contract personnel to telephone number (703-921-6237) or fax below information to 703-921-6780:

Full Name Social Security Number Effective Date Reason for change

In accordance with Customs Directive No. 51715-006, “Separation procedures for Contractor Employees (CF-242)”, the Contractor is responsible for ensuring that contract employees separating from the agency complete the relevant portions of the CF-242. This requirement covers all Contract employees who depart while the contract is still active (including resignations, terminations, etc.) or upon final completion of contract. Failure of a Contractor to properly comply with these requirements shall be documented and considered when completing Contractor Performance Reports.

ii.Clearances

A minimum of 25% of personnel assigned to support the NTC shall possess and maintain a Top Secret clearance with SCI determination through DHS. At the start of the contract, a minimum of one staff must possess and maintain a TS/SCI clearance recognized by DHS to effectively staff mission needs with the remaining staff determined suitable and in process to receive their

TS/SCI.

iii.Identification Badge

All Contractor employees shall be required to wear CBP Identification badges at all times when working in Government facilities.

iv.Physical and IT Security Requirements

The Contractor shall ensure that its employees follow the general procedures governing physical, environmental, and information security described in the various DHS CBP regulations identified in this clause. The Contractor shall ensure that its employees apply proper business practices in accordance with the specifications, directives, and manuals required for conducting work under this contract. Applicable Contractor personnel shall be responsible for physical security of work areas and CBP furnished equipment issued under this contract.

The CO/COR may require the Contractor to prohibit its employees from working on this contract if continued employment becomes detrimental to the public’s interest for any reason including, but not limited to carelessness, insubordination, incompetence, or security concerns.

Work under this contract may require access to sensitive information as defined under Homeland Security Acquisition Regulation (HSAR) Clause 3052.204-71, Contractor Employee Access, included in the solicitation/contract. The Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the CO.

The Contractor shall ensure that its employees who are authorized access to sensitive information, receive training pertaining to protection and disclosure of sensitive information. The training shall be conducted during and after contract performance. Upon completion of this contract, the Contractor shall return all sensitive information used in the performance of the contract to the CO/COR. The Contractor shall certify, in writing, that all sensitive and non-public information has been purged from any Contractor-owned system.

v.Remote Access

Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Contractor performs business for the DHS Component. It is not a right, a guarantee of access, a condition of the contract, or Government Furnished Equipment (GFE).

vi. Handling Personally Identifiable Information (PII)

The Contractor shall comply with the Privacy Act, CBP, and DHS privacy policies and procedures when handling PII. This includes reporting loss, theft, or unauthorized access to sensitive PII within one hour of discovery and reviewing Contractor applicable policies at least annually. When a Contractor, on behalf of CBP, handles Sensitive PII data, stores and transmits, the Contractor shall Accredit (ATO) this information system to the (HHM) FIPS level.

13. SPECIAL CONSIDERATIONS

Government Points of Contact

Notwithstanding the Contractor’s responsibility for management during performance the administration of this TO will require some coordination between the CBP and the Contractor.

The Contracting Officer (CO) will appoint a COR (Contracting Officer Representative) to assure orderly performance of the tasks and provide technical direction. The COR is:

NTC Cargo Division Program Manager:

Chief Watch Commander Mario Pinguli Phone: 571-468-7870 Marjon.Pinguli@cbp.dhs.gov

Watch Commander Christopher Stuart Phone: 571-468-1594 Christoher.Stuart@cbp.dhs.gov

Office of Trade Program Manager:

Kimberly Heindl, COR, PMP Phone: 202-430-3715 kimberly.heindl@cbp.dhs.gov

14. CONTRACTOR KEY PERSONNEL

The following personnel shall be designated as “Key”:

• Data Scientist

• Content Specialist

The Data Scientist shall perform as a subject matter expert and provide data scientist support.

The Government requires that the Data Scientist has the following qualification:

• Experience with intelligence analysis, methodologies and tactics, techniques, and procedures (TTP).

• Demonstrated experience implementing process efficiencies and improving program management effectiveness or a certification in process improvement (e.g. Lean Six Sigma certification, Lean Certification, Business Process Management (BPM), CMMI Certification or equivalent).

• Experience delivering mission capability support to law enforcement, IC, or military related partners at a tactical/operational level.

• Demonstrated experience supporting IT projects for the Government, including law enforcement, IC, or military related partners organizations.

• Demonstrated experience with data management.

• Experience solving problems with real world data through thesis research, internships, or work experience.

• Experience in a science, technology, engineering, or mathematics (STEM) related field.

• Ability to work in a diverse team environment and collaborate with subject matter experts.

Content Specialist

The Content Specialist shall perform as the team lead and subject matter expert and provide analytical support. The Government requires that the Content Specialist has the following qualification:

• Experience with intelligence analysis, methodologies and tactics, techniques, and procedures (TTP).

• Experience delivering mission capability support to law enforcement, IC, or military related partners at a tactical/operational level.

• Demonstrated experience supporting IT projects for the Government, including law enforcement, IC, or military related partners organizations.

• Demonstrated experience with data management.

• Experience delivering mission capability support to CBP or DHS organizations in tactical and strategic operations.

• Experience solving problems with real world data through thesis research, internships, or work experience.

• Ability to work in a diverse team environment and collaborate with subject matter experts.

15. INSPECTION AND ACCEPTANCE

The Government reserves the right to reject any deliverable based on defects with respect to completeness correctness, clarity, and consistencies. In the event of a rejection of any deliverable, the Contracting Officer will notify the Contractor in writing within five (5) business days of the receipt of the deliverable of any deficiencies to be corrected. The Contractor shall have five (5) business days to correct the deficiencies.

Accuracy – all deliverables shall be accurate in presentation, content, and shall adhere to the guidelines set forth in this document. All documentation presented to the Government shall be complete, correct, clear, and consistent.

Clarity – deliverables shall be clear and concise.

Timeliness – deliverables shall be submitted on or before the due date specified in the statement of work or submitted in accordance with a later scheduled dated mutually agreed upon by the Government and Contractor. A deliverable is considered timely if submitted on or before the date specified in the Statement of Work and, and if the Government provides any written notifications of deficiencies, the Contractor corrects the deficiencies within five (5) business days.

Monthly, the cognizant CBP COR and Contractor’s representative will meet at the CBP place of performance or via conference call to review work performance. Overall clarity and accuracy will determine acceptance of services. This is not intended to restrict or limit the Government’s review of Contractor performance and the Government, at its option, may perform additional tests and inspections, as it deems necessary.

16. TRAVEL /OTHER DIRECT COSTS (ODCs)

Travel Costs

No contractor travel outside of the local commuting area will be performed as part of this SOW.

Other Direct Cost

The Government will not reimburse local travel within a 50-mile radius from the Contractor’s primary place of performance. No additional other direct costs will be authorized.

17. UNIQUE STANDARDS

Security Policy Requirement

All hardware, software, and services provided under this TO must be compliant with DHS Sensitive Systems Policy Directive 4300A, Version 13.1, July 27, 2017, or most current version and the 'DHS 4300A Sensitive Systems Handbook, Version 12.0, November 15, 2015, or most current version.

Section 508 Requirements for Technology Services

1. When providing cloud hosting services (Infrastructure as a Service, Platform as a Service, Software as a Service, etc.) the Contractor shall ensure user administrative screens, dashboards and portals used to configure, and monitor cloud services conform to the Section 508 standards.

2. The Contractor shall ensure cloud hosting services shall not reduce the level of Section

508 conformance for ICT migrated by DHS to the cloud hosting environment.

3. When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

4. When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

5. When developing or modifying electronic documents and forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable to the applicable Section 508 standards (including WCAG Level A and AA Level 2.0 Success Criteria) by conducting testing using the test methods published under “Accessibility Tests for Documents” at https://www.dhs.gov/compliance-test-processes.

6. When developing or modifying ICT deliverables that contain the ability to automatically generate electronic documents and forms in Microsoft Office and Adobe formats, or when the capability is provided to enable end users to design and author web based electronic content (i.e. surveys, dashboards, charts, data visualizations, etc.), the Contractor shall demonstrate the ability to ensure these outputs conform to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria). The Contractor shall demonstrate conformance by conducting testing and reporting test results based on representative sample outputs. For outputs produced as Microsoft Office and Adobe PDF file formats, the Contractor shall use the test methods published under “Accessibility Tests for Documents”, which are published at https://www.dhs.gov/compliance-test-processes. For outputs produced as web based electronic content, the Contractor shall use the DHS Trusted Tester for Web Methodology Version 5.0, or successor versions. This methodology is published at https://www.dhs.gov/trusted-tester

Section 508 Deliverables

1. Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions

2. Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

3. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

Safeguarding of Sensitive Information (Mar 2015) https://www.dhs.gov/compliance-test-processes https://www.itic.org/policy/accessibility/vpat

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official Use Only) Information http://www.dhs.gov/dhs-security-and-training-requirements-contractors

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

(3) All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in http://csrc.nist.gov/publications/PubsSPs.html these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or Component Privacy Officer. Unless otherwise specified in the ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

(1) Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.

• Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter.

Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

• Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

• Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones.

Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy.

Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years. The Contractor is required to update its SA package as part of the ATO renewal process. The Contractor shall update its SA package by one of the following methods:

(1) Updating the SA documentation in the DHS automated information assurance tool for acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls; or (2) Submitting an updated SA package directly to the COR for approval by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls.

The 90 day review process is independent of the system production date and therefore it is important that the Contractor build the review into project schedules. The reviews may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place.

(3) Security Review. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced.

The Contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and COR, contact the Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to the DHS. Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of Government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

(4) Continuous Monitoring. All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis. The Contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities.