SOW Outbound Mail Ops.pdf

PROCUREMENT SENSITIVE INFORMATION:

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

DRAFT

Department of Homeland Security (DHS) Federal Emergency Management Agency (FEMA)

STATEMENT OF WORK

Outbound Mail Operations Support

May 20, 2020

1. BACKGROUND

The Federal Emergency Management Agency (FEMA), a component of the U.S.

Department of Homeland Security, is authorized pursuant to the Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended (42 U.S.C. Chapter 68), to assist individuals and households following Presidentially-declared disasters and emergencies. In cooperation with state governments, FEMA provides grant assistance to disaster victims in accordance with the Act. These programs receive extensive visibility from the highest levels of federal, state, and local governments and are continually reported on in the public media.

Disaster declarations and resulting assistance applications create a need to process large quantities of outbound applicant correspondence in a short timeframe. Privacy, accuracy, and timely delivery of services are required to ensure the needs of the disaster applicant are met through the most expedient means possible.

FEMA has determined the most efficient way to manage an outbound mail operation is through contractor support.

2. PURPOSE

This contract supports FEMA’s Individuals and Households Program (IHP) by providing readiness and surge resources for disaster applicants’ correspondence. The contractor shall establish mail operations with an adequate infrastructure and qualified, trained staff. The contractor shall be ready at the time of a declared disaster to begin processing outbound correspondence to applicants from designated geographical area(s) covered by each Presidential Declaration for Individual Assistance (IA).

Whenever possible, FEMA will seek to provide the contractor with early notice of impending disaster declarations and projected volumes, but due to the nature of disaster activity this may not always be feasible. Therefore, the contractor shall make all necessary preparations and maintain adequate infrastructure to meet all requirements as they are received.

The processing of outbound mail includes selecting and printing documents, inserting correspondence into envelopes, sealing envelopes, applying postage, pre-sorting outbound correspondence for optimal savings to the government, and inserting into the mail stream.

3. SCOPE

Outbound mail operations include printing, inserting, applying postage, and pre-sorting outbound correspondence addressed to disaster victims. Mailings will include correspondence to applicants containing sensitive personal information (#10 and #11 envelopes) and flat envelopes (9X12) containing both sensitive personally identifiable information (PII) and public information.

The contractor shall provide all management, personnel, services, supplies, equipment (except for Government Furnished Equipment described below), and facilities necessary to operate an outbound mail processing operation in accordance with the requirements of this SOW.

The contractor shall be responsible for meeting Service Levels as identified in this SOW [see Section 7, Performance Standards-Timeliness (Service Levels)]. Based on disaster activity, volume will vary greatly. Holidays and weekends are considered regular calendar production days to ensure that Service Levels are met.

The contractor shall perform phase-in activities that ensure their ability to assume full performance on or before the end of the phase-in period. The phase-in shall include actions to minimize disruption and start-up requirements. The phase-in actions shall include recruiting, hiring, training, security requirements, and any other special considerations.

The contractor is required to be fully operational, including facilities, equipment, information technology, training, personnel and requisite supplies within 90 calendar days from date of contract award. All contractor facilities and employees dedicated to FEMA contract obligations must be located within the continental United States

(CONUS).

Note: Phase-in activities and/or transition period is not applicable to incumbent contractor.

4. TYPE OF CONTRACT

The contract will be a firm-fixed price IDIQ contract with task orders awarded for baseline work in the base year and any option year(s) FEMA chooses to award.

Surge workloads beyond baseline levels will be awarded as separate task orders and will be made on a per image basis CLIN.

5. PERIOD OF PERFORMANCE

The period of performance for this contract will be a base period of nine months, consisting of a three-month transition period (90 calendar days), and a six-month full operations period, with four consecutive one-year options, exercised at FEMA’s discretion.

Note: Phase-in activities and/or transition period is not applicable to incumbent contractor.

6. CONTRACT REQUIREMENTS

The contractor shall:

Process outbound mail through a Multi-line Optical Character Reader (MLOCR) sorter with a Coding Accuracy Support System (CASS) and a Multi-Line Accuracy Support System (MASS) certification cycle that evaluates the ability of MLOCRs and encoding stations to process address information and applies an accurate delivery point barcode (DPBC) to the piece of mail.

Maintain a capability to process a minimum monthly volume of 500,000 images of outbound mail. Increase production to accommodate a monthly surge volume up to 16,500,000 images of outbound mail.

Provide plain white stock paper (8.5 x 11, 20lb weight), postage meter ink and all necessary items to print.

Accommodate site storage of all materials and equipment required to accomplish the requirements of this SOW.

Have the capability to process and track outbound accountable mail, as identified by the COR.

Ensure queue date identified on work in NEMIS Mail Utility queue is less than 48 hours of age unless otherwise approved or directed by the COR.

Print documents in compliance with industry standard for contrast and readability.

Print documents in duplex format (two-sided) to reduce paper consumption.

Prioritize and select correspondence to be printed and route to printer. Note: During periods of increased activity the COR may establish the outbound mail assignment.

Print all documents included on FEMA transmitted files, unless otherwise directed by the COR.

Insert printed letters into appropriate size envelopes using an automated inserter process. Any manual insert of printed letters must be approved by the COR in advance.

Add Applicant Guide and/or brochure to accompany 9069 letters and other documents if directed by the COR.

Pre-sort mail for optimal postage savings.

Apply correct postage to outbound mail based on letter weight if not using pre-printed envelopes with indicia.

Coordinate mail pickup or drop-off with USPS, UPS, DHL, FedEx, or other commercially viable sources, as required.

Monitor print jobs, ensuring all pages are printed and formatting is correct.

Monitor mail inserter, ensuring envelopes contain information for only one applicant and proper inserts have been included, when applicable.

Maintain a log of inventory received and used.

Store no less than 1,500,000 government-provided envelopes (#10 and/or #11) and

500,000 9x12 flat envelopes to support production requirements and to ensure readiness.

Provide production reports as outlined in Section 9 of this SOW.

Maintain hours of operation sufficient for accomplishing all requirements of this

SOW.

Within 30 minutes of identification, disruption/problems affecting the contractor’s ability to meet performance standards and any security issues including privacy breaches shall be reported by the contractor to the COR.

Deliverables

The contractor shall provide a phase-in plan within 14 calendar days of award, detailing the schedule and necessary activities to begin contract performance in accordance with contract requirements.

The contractor shall provide a phase-out plan within 14 calendar days of request by the COR, detailing the schedule and necessary activities to meet all contract requirements through the end of the period of performance and end contract performance in a satisfactory manner.

The contractor shall provide a Continuity of Operations Plan (COOP) within 30 calendar days of award. This plan shall include procedures to ensure that operational support is available, without interruption, to support 50 percent of all capacity requirements. The plan shall also address the actions and timeframe required to regain 100 percent of the capacity requirements of the SOW. Finally, the plan shall include a complete description of the alternative mail operations site and,

1) a detailed breakdown of costs to maintain and operate the COOP site and, 2) a detailed breakdown of costs unexpended at the closed original facility. The COOP Plan must be approved by the COR.

Within 30 calendar days of award, the contractor shall submit two copies of the updated Quality Control Plan (QCP) to the COR (draft plan to be submitted with proposal). The QCP shall outline the contractor’s plan to ensure achievement of the performance standards of the SOW, as provided in Section 7 of this SOW. The QCP shall address identifying and correcting deficiencies, scheduled delivery of services, technical performance, and staff training. The COR will review and accept the QCP or return it for revision or implementation.

The contractor shall implement and maintain the COR-approved QCP.

The contractor shall establish and maintain an inspection system that ensures compliance with the contractor’s QCP and maintain a local file of all QCP inspections. This file shall be available to the COR or designee at all times during the life of the contract.

Subsequent to award, any revisions to the QCP shall be submitted to the COR for review and approval.

6.1 Test Printing, High Priority Printing, Special Printing

Test printing – The contractor shall test print a limited number of documents (letters) prior to full production to check for margin, spacing and other potential formatting problems; e.g. newly created letters, revised letters, etc. FEMA will provide the contractor with the specific test letter: disaster number, program and letter code, and registration identification number(s) to be printed. The contractor shall print (and insert if requested), the documents and advise FEMA in writing of the results (and provide a scanned copy if requested). FEMA will require testing to be completed and a response provided within a specific time period depending on the urgency and/or circumstances. Response time frames are 2hr, 4hr, 24hr, and 48hrs. The contractor shall not mail any test letters. Upon notice from FEMA, the contractor shall shred all test letters. Response time frame begins when FEMA notifies the contractor in writing that letters are in the queue and ready for testing. Response time frame ends when the contractor notifies FEMA (COR) in writing, of the results.

High Priority Mailings – The contractor shall, from time to time, at the request of

FEMA provide for high priority mailings. High priority mailing requires the contractor to accelerate the service level for printing, inserting documents, as well as placing documents into the United States Postal Service (USPS) system. FEMA will advise the contractor in writing, no less than one day (24 hrs) prior to the need, with the estimated number of letters and the expected timeframe that they will be added to the queue for processing. The contractor shall ensure that the documents are placed in the mail system (includes printing, inserting, and releasing into USPS system) on the specified date or within 24hrs from notice that the letters are in queue. The contractor shall advise FEMA by written notice when the process is complete. The contractor must achieve required service levels for non-priority mailings at all times, including periods in which high priority mail is being processed.

Special Print Jobs - Periodically FEMA must ensure that certain letters are printed on a specific day and are subsequently released into the mail stream on a specific day. The contractor shall coordinate printing and mailing according to the COR directions. These letters may or may not be considered high priority printing projects as defined within this SOW. The volume of these letters can vary. The COR will provide the contractor with the specific print and mail date requirements.

Additionally, the COR may direct the contractor to delay printing some letters until authorized. At the time of authorization from the COR, the contractor shall include these letters in the regular daily printing.

Response time frames for test, high priority and special print jobs begin when FEMA notifies the contractor in writing that letters are in the queue and ready for printing.

Response time frame ends when contractor notifies FEMA in writing, of the test results or delivery of print job into the USPS mail system.

All contractor facilities and employees dedicated to the services under this Statement of Work (SOW) must be located within the continental United States (CONUS).

7. PERFORMANCE STANDARDS

The contractor shall perform all requirements outlined in this SOW and achieve the performance standards for each function of the operation as described below:

Timeliness (Service Levels)

All work waiting to be printed is less than 48 hours of age unless otherwise approved or directed by the COR.

Printed documents are correctly inserted and placed in the USPS system within 72 hours of NEMIS Mail Utility queue date.

Any service level may be temporarily extended by up to 48 hours with prior written approval from the COR.

Quality

The security of personally identifiable information (PII) is of the utmost importance to

FEMA. Thus, information contained in each envelope shall pertain to only one addressee 100 percent of the time.

Printed documents shall comply with industry standards for contrast and readability

99.9 percent of the time.

Appropriate inserts shall be included in the envelope greater than 99.5 percent of the time.

All outbound mail has correct postage (if not using pre-printed indicia envelopes), and mechanically and manually processed mail items comply with USPS weight, size, and rate standards greater than 99 percent of the time.

Record and page counts on the FEMA transmitted file balance with the print item and page counts from the vendor batch report greater than 98 percent of the time.

8. CONTRACT REQUIREMENTS

8.1 Contractor Resources

The contractor is required to furnish all facilities, equipment, personnel, supplies, computers (except for GFE), communications, and other resources to achieve the comprehensive mail operations requirements of this SOW.

8.2 Staffing

The contractor shall perform all recruiting, screening, hiring, and monitoring of staff under this contract.

The contractor shall provide supervisory/management personnel and quality assurance personnel required for effective management of the work.

The contractor shall train employees on processes, procedures, and performance standards identified in this SOW and any attachments hereto.

The contractor shall ensure personnel have met HSPD- 12 and NIST Pub 201 requirements prior to the employees having any access to a DHS information system or FEMA applicant information. See Attachment B for details.

The contractor shall comply with applicable Department of Labor (DOL) wage determinations and provide the FEMA CO with access to payroll records for required monitoring.

The contractor shall maintain an updated listing of all contractor personnel working under this contract and provide a copy to the COR upon staffing changes. This listing shall be provided to the COR and shall include personnel information, including but not limited to the following: the person’s full legal name, Social Security number, home address, contact phone, date of hire, date(s) of training completion, dates and results of security clearance(s). Reports should identify any personnel separated and reason for separation.

No later than two weeks prior to start of performance, the contractor shall provide to the COR a listing of all personnel who will require logistical access to FEMA's IT network for performance of work under this contract.

All contractor supervisors, managers, quality assurance personnel must speak, read, and write English fluently.

The contractor shall ensure that the personnel assigned to this contract have the ability to use the Government’s computerized database using a standard Microsoft Windows PC capable of performing functions such as opening and closing a mail utility, selecting records from the utility and navigating with a mouse and/or keyboard.

Contractor IT Personnel:

The contractor shall identify an on-site information technology (IT) system security officer responsible for ensuring client privacy and confidentiality.

The contractor shall identify a minimum of two contractor personnel as points of contact for FEMA IT. These personnel shall be responsible for working with FEMA IT personnel to resolve technical issues causing service disruptions.

8.3 Hardware, Software, Supplies and Data Services

The contractor shall:

Provide and maintain all necessary facilities, equipment, supplies and services to support all processes for outbound applicant correspondence services and any other requirements under this SOW (exception: any FEMA-provided GFE).

Provide and maintain printers compatible with FEMA’s current print format (Post

Script/mail utility software), including duplex printing on plain white stock paper.

Provide and maintain insert stations that handle standard #10/11 envelopes and

9X12 flat envelopes. Inserters must have the ability to read two of five barcodes and optical mark recognition (OMR) scan marks.

Provide workstation access for on-site FEMA representatives with the ability to access the NEMIS Mail Management software during site visits. The contractor shall estimate that FEMA representatives will make a minimum of 4 visits per year.

The contractor shall provide workspace and telephones at the contractor provided site. Provide access to facsimile machines with send-and-receive capability, equipment to perform copying and printing, access to shipping and receiving, and standard office supplies for government personnel to assist in the administration of the contract.

Contractor IT:

Provide a dedicated data connection exclusively for the purposes of achieving the requirements of this SOW, with a 5MB minimum with 20MB burst capability, 100MB recommended connection. The printing functions require sufficient memory and bandwidth. The contractor shall submit proposed Cisco VPN concentrator specifications to FEMA’s IT cyber security for approval.

Provide FEMA network account requests in a CSV (comma-separated values) or

XLS (Microsoft Excel spreadsheet) file with the following information in the specified column order: legal last name, legal first name, Social Security number (SSN), facility location, and security clearance. All fields must be provided before an account will be created. Account creation requests should be submitted to COR or other FEMA-designated representative.

Provide operations support to maintain equipment and software on the contractor-owned and/or contractor-leased systems.

8.4 Compliance with Laws, Regulations and Manuals

The contractor shall be responsible for having a good working knowledge and technical understanding of the following laws, regulations and manuals pertaining to Official Mail and the DHS/FEMA Mail Management Program. Knowledge of laws, regulations and mail management procedures are necessary to operate a professional Mail Center for FEMA. Contractor personnel shall be trained in mail regulations and general mail management information.

Title 39, U.S.C., Sections 3202-3209 Title 18, U.S.C., Section 1719, "Franking Privilege" Title 41 Code of Federal Regulations (CFR), Chapter 102, Part 102-192 Title 39 CFR, United States Postal Service, Chapter I, Sub-chapter E -

Restrictions on Private Carriage of Letters, Part 310 and 320 GSA Bulletin, FPMR B-65, Archives and Records, "Mail Preparation and

Economy" USPS Domestic Mail Manual USPS International Mail Manual Annual USPS letter, "Payment of Official Mail"

DHS MD 4300A

Upon request, the contractor shall provide to the COR copies of mail management manuals and Standard Operating Procedures (SOP) demonstrating contractor adherence and understanding of the above guidance in performing the requirements and functions of this SOW.

The contractor shall maintain a clean and safe working environment in full compliance with applicable Occupational Safety and Health Administration (OSHA) standards.

Section 504 Requirements The Contractor/Provider shall comply fully with Section 504 of the Rehabilitation Act of 1973, as amended, which prohibits discrimination against qualified individuals with disabilities. No otherwise qualified individual with a disability shall, solely by reason of his or her disability, be excluded from participation in, be denied the benefits of, or subjected to discrimination under any program or activity for which the Contractor/Provider is awarded a contract and/or receives federal financial assistance from the Federal Emergency Management Agency. This includes, but is not limited to, providing reasonable accommodations and modifications to ensure effective communication access, physical access, and program access to all participants, including persons with disabilities. The Contractor/Provider shall incorporate this language in any subcontracts related to the provision of the FEMA public-facing program or activity.

Section 508 Requirements Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) (codified at 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

1. All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT or that contain ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards.

2. When developing or modifying ICT for the government, the contractor shall ensure the ICT fully conforms to the applicable Section 508 Standards. When modifying a commercially available or government-owned ICT, the contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

3. When developing or modifying ICT that are delivered in an electronic Microsoft Office or Adobe PDF format, the contractor shall demonstrate conformance by providing Section 508 test results based on the Accessible Electronic Documents

– Community of Practice (AED COP) Harmonized Testing Guidance at https://www.dhs.gov/508-testing.

4. When developing or modifying software that generates electronic content (e.g., an authoring tool that is used to create html pages, reports, surveys, charts, dashboards, etc.), the contractor shall ensure software can be used to create electronic content that conforms to the Section 508 standards.

5. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the applicable revised Section 508 Standards for each ICT.

6. Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018.

Instructions to Contractor

1. For each ICT Item that will be developed, modified, installed, configured, integrated, maintained, or hosted by the contractor pursuant to this contract, the https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf https://www.dhs.gov/508-testing contractor shall provide an acknowledgement of the Section 508 requirements and a detailed explanation of the contractor’s plan to ensure conformance with the requirements. The contractor shall also describe the evaluation methods that will be used to validate for conformance to the Section 508 Standards.

Acceptance Criteria

1. Before accepting items that contain Information and Communications

Technology (ICT) that are developed, modified, or configured according to this contract, the government reserves the right to require the contractor to provide the following:

o Accessibility test results based on the required test methods.

o Documentation of features provided to help achieve accessibility and usability for people with disabilities.

o Documentation of core functions that cannot be accessed by persons with disabilities.

o Documentation on how to configure and install the ICT Item to support accessibility.

o Demonstration of the ICT Item’s conformance to the applicable Section

508 Standards, (including the ability of the ICT Item to create electronic content – where applicable).

2. Before accepting ICT required under the contract, the government reserves the right to perform testing on required ICT items to validate the contractor’s Section 508 conformance claims. If the government determines that Section 508 conformance claims provided by the contractor represent a higher level of conformance than what is actually provided to the agency, the government shall, at its option, require the contractor to remediate the item to align with the contractor’s original Section 508 conformance claims prior to acceptance.

9. REPORTING REQUIREMENTS

9.1 Daily Reporting

The reporting period is Sunday through Saturday. All contractor provided reports shall be due daily to the COR by 9:00 a.m. ET Monday - Saturday unless otherwise approved in writing by the COR. Reporting content is as follows:

Number of Reprints by letter type

• Daily

• Cumulative

Number of images printed for each document type

Number of items (letters) printed by document type

Number of images inserted and placed into USPS mail system by document type

Number of documents inserted and placed into USPS mail system by document type

Number of images printed but not mailed by document type

• Date of oldest document to be mailed

Number of documents printed but not mailed by document type

• Date of oldest document to be mailed

Number of documents mailed with requirement for accountable mail

Quality control variances and issues occurring during reporting period

• Compliance with industry standard for contrast and readability for printed materials

• Appropriate inserts included and information contained in the envelope is for only one applicant Sample Daily Report

Month Year SL Images Printed

SL Letters Printed

# of SL Letters Inserted

# of SL Letters Mailed

# of SL Letters to be Mailed

Date of oldest SL to be mailed

Total Images Printed

Friday, May 1, 2020 Saturday, May 2, 2020 Sunday, May 3, 2020 Monday, May 4, 2020 Tuesday, May 5, 2020 Wednesday, May 6, 2020 Thursday, May 7, 2020 Friday, May 8, 2020 Saturday, May 9, 2020 Sunday, May 10, 2020 Monday, May 11, 2020 Tuesday, May 12, 2020 Wednesday, May 13, 2020 Thursday, May 14, 2020 Friday, May 15, 2020 Saturday, May 16, 2020 Sunday, May 17, 2020 Monday, May 18, 2020 Tuesday, May 19, 2020 Wednesday, May 20, 2020 Thursday, May 21, 2020 Friday, May 22, 2020 Saturday, May 23, 2020 Sunday, May 24, 2020 Monday, May 25, 2020 Tuesday, May 26, 2020 Wednesday, May 27, 2020 Thursday, May 28, 2020 Friday, May 29, 2020 Saturday, May 30, 2020 Sunday, May 31, 2020 MTD Total 0 0 0 0 0 0

9.2 Weekly Reporting

Weekly reports shall be due to the COR by 9:00 a.m. ET Monday unless otherwise approved in writing by the COR. Reporting content is as follows:

Inventory of Government Furnished Supplies

• Balance of supplies on hand (i.e. envelopes 9X12 or #10 & #11, Applicant

Guide and /or brochure – English and Spanish)

• Supplies used (provide breakdown by item)

• Supplies received (provide breakdown by item)

Postage costs applied (if applicable)

• Weekly

• Cumulative for the month

9.3 Monthly Reporting

The reporting period is the entire calendar month. Contractor monthly reports are due to the COR on the 1st day of the following month by noon ET, unless otherwise approved in writing by the COR. Report content is as follows:

Postage costs (if applicable)

• Dates postage applied

• Total postage applied

• Total letters metered

• Postage rates applied

• Letters metered not in mail stream Production Report

• Include all categories required in the daily reports

9.4 Ad Hoc Reporting

The contractor shall provide ad hoc reports (not more than 10 per month) at the request of the COR to track contractor and program performance.

*Mail Utility dates are reflected in Greenwich Mean Time (GMT). Contractor shall ensure that all service levels and production reports reconcile to GMT.

10. FEMA’S RESPONSIBILITIES

FEMA’s designated COR will establish weekly meetings or conference calls with the contractor and/or its representatives to monitor performance and ensure specific work requirements are accomplished.

FEMA will perform periodic on-site quality/quantity checks with no prior notice to the contractor. These site visits will consist of personnel, physical and cyber security site surveys to ensure that the contractor is adhering to DHS/FEMA security requirements for handling and protecting sensitive information as well as programmatic service and quality reviews.

FEMA will monitor contractor operations to ensure physical access to FEMA servers and applicant information are restricted to authorized contractor personnel only.

FEMA will provide remote and onsite IT support, as required.

FEMA will provide a maximum of two subject matter experts to train contractor’s staff on use of FEMA’s software for a period of up to three days. After this, the contractor shall be responsible for training mail center staff at its own expense.

11. GOVERNMENT-FURNISHED SUPPLIES AND EQUIPMENT

FEMA will provide IT security awareness training to the contractor.

FEMA will furnish the following equipment, systems, and provisions:

Computers for connectivity to FEMA networks until which time contractor proposed and supplied hardware is approved by FEMA’s IT cyber security, Certification and Accreditation.

Data connections to the FEMA Network through the use of FEMA approved VPN client installed on GFE.

Postage on outbound mail. FEMA will monitor and prepay postage for outbound mail.

FEMA will provide 9X12 flat envelopes, and #10 and or #11 envelopes for print output with the proper DHS/FEMA branding and with pre-printed postage indicia, however it is the contractor’s responsibility to store and maintain minimum inventory to ensure readiness at all times (SOW Section 6).

Any equipment provided for FEMA’s contract will be used exclusively by the contractor at the location(s) proposed for contract performance.

12. DEFINITIONS

Ad Hoc Reports - are defined as those reports required when the situation makes it necessary or desirable, rather than being arranged in advance or being part of a general plan. Ad hoc does not mean correcting / clarifying data presented in routine reports.

COOP- Contingency of Operations Plan: A plan involving suitable backups, immediate actions and longer term measures for resuming production and responding to emergencies such as attacks, accidents, widespread employee illness in the work place or natural disasters. Contingency plans are part of business resumption planning.

IHP – Individuals and Households Program: Program through which FEMA provides disaster assistance to individuals and households affected by a federally declared disaster. FEMA, under the authority of section 408 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. §5174, and Title 44 of the Code Federal Regulations, may provide financial assistance and, if necessary, direct services to eligible individuals and households who, as a direct result of a major disaster, have necessary expenses and serious needs and are unable to meet such expenses or needs through other means.

Image: One printed side of one page of paper.

MLOCR- Multi-Line Optical Character Reader: A type of mail sorting machine that uses Optical Character Recognition (OCR) technology to determine how to route mail through the postal system. Performs address block location, character recognition, address look-up for the destination address; prints an ID Tag on the back of the mail piece; prints a POSTNET barcode on the front of the mail piece based on the address look-up.

NEMIS - National Emergency Management Information System: This FEMA-wide system of hardware, software, telecommunications, and applications provides the technology base for the collection and processing of information filed by individuals applying for federal disaster assistance.

RSC – Recovery Service Center: FEMA currently has three RSCs (formerly NPSCs, or National Processing Service Centers) located in Virginia, Maryland and Texas. The RSC is a centralized office established to consolidate the processing of disaster applications. Each RSC represents a combination of caller services, casework processing, and administrative functions.

SBA – Small Business Administration: A federal agency that assists homeowners, renters, and businesses with disaster loan assistance.

Surge Operations: Occurs whenever the baseline operations quantities are exceeded.

13. ATTACHMENTS

A. Mail Process Flow B. Contractor Personnel Security Requirements C. Physical Security Requirements D. Cyber Security Requirements

Attachment A DHS/FEMA Individual Assistance

Correspondence Recovery Service Center

Outbound Mail Process Flow

FEMA generates documents to be printed and routes to Mail Utility1 print queue

Contractor interfaces with Mail Utility software, selects documents to be printed and initiates print job

Printed documents folded and placed into envelope; applicable inserts also added if required

Through the use of an MLOCR sorter 2, envelopes will be sorted for USPS CASS3 & MASS4 discounting and postage applied if necessary

Metrics collected by MLOCR operator for management reporting

Pick-up by USPS or drop-off to USPS

Legend 1 Mail Utility – Program used by FEMA to process applicant letters 2 MLOCR: Multiple Line Optical Character Recognition Sorter – Sorts mail by zip-code through the use of optical character recognition for optimal postal savings 3 CASS / MASS: Program run by NCSC (National Customer Support Sender) that tests the accuracy of OCR/address look-up software.

ATTACHMENT B

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

SECURITY: All personnel require access to information up to the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure contractor employees’ receive a favorably adjudicated public trust suitability prior to entry on duty (EOD). All individuals will be U.S. citizens. The contractor shall follow the standards established within DHS and FEMA policy.

Unauthorized Disclosure of Classified or Unclassified Information:

All contractors and subcontractors are required to train on Unauthorized Disclosure of Classified or Unclassified Information to perform duties established by the Government during the performance period of and execution of this contract.

Access to the training can be obtained at:

https://securityawareness.usalearning.gov/unauthorizedrefresher/index.htm

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

OPSEC Training:

Contractors and Subcontractors who are working on this contract shall receive the OPSEC Awareness Brief.

Access to the briefing can be obtained at http://cdsetrain.dtic.mil/opsec Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

Insider Threat Training:

Insider Threat training for Contractors can be found at:

http://cdsetrain.dtic.mil/itawareness/index.htm.

Certificate of training is required for all cleared contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

For Official Use Only (FOUO) Information:

In accordance with DHS Management Directive 11042.1 contractors, consultants and others to whom access is granted shall abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within https://securityawareness.usalearning.gov/unauthorizedrefresher/index.htm http://cdsetrain.dtic.mil/opsec http://cdsetrain.dtic.mil/itawareness/index.htm

DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities.

The contractor shall:

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer-based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. Be aware that divulging information without proper authority could result in administrative or disciplinary action.

Contractors and Consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified Information Non Disclosure Agreement (NDA), as a condition of access to such information. Other individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an NDA as determined by the applicable program manager. Execution of the NDA shall be effective upon date of the DHS Policy and not applied retroactively.

Security Plan The contractor shall design, implement, and maintain a Security Plan that ensures its adherence to the security requirements of this SOW. The Security Plan must be approved by the Office of the Chief Security Officer prior to implementation. The contractor shall submit this Security Plan to the COR for approval within 30 days of award. During contract performance, the contractor shall submit a monthly report to the COR on the first day of each month detailing security issues and status, including any deviations from the Security Plan that occurred during the previous month.

In accordance with FAR 52.209-9, HSAR 3-52.204-70 (JUN 2006), HSAR 3052.204-71, and Homeland Security Presidential Directive 12 (HSPD-12), performance of this contract requires contractor personnel to undergo a Federal government background check as stipulated in HSPD-12 and NIST Publication 201, PIV I, before being allowed any access to a DHS information system, to mail, and/or to FEMA NEMIS Mail Management software. Security requirements are based on contractor personnel’s positions, functions, and access requirements.

Failure to comply with these requirements may delay the completion of background investigations and adjudications. Note that any delays in this process which are not caused by the Government do not relieve the contractor from performing under the terms of the contract. The Government shall not be responsible for any costs associated with HSPD-12 fingerprinting/eQIP security requirements listed herein, which includes but is not limited to the following costs: airfare, per diem, rental cars, lodging, police/sheriff department administrative fees, etc.

All contractor management, support, and clerical personnel assigned to the transition team must submit contract fitness security screening request form within 14 calendar days of award.

Employees and visitors of contractor shall not have access to applicant data or conduct FEMA work until they have received a favorable eQIP clearance from the FEMA Personnel Security Section.

The contractor shall provide FEMA with information on all contractor provided personnel, including but not limited to: full legal name, Social Security number, home address, contact phone, date of hire, dates and results of security background checks, date(s) of training completion, date of separation, and reason for separation.

The contractor shall immediately notify the FEMA COR in writing of any suspected fraudulent activity or wrongdoing on the part of its employee immediately. The contractor shall expediently remove any employee from the contractor’s premises when acts of wrongdoing or security breaches are suspected.

The contractor shall store mail documents in a locked facility (except for those being processed) and shall notify the COR, or designee, within 2 hours if any mail is lost or stolen. No mail or package shall be left unattended at any time.

The contractor shall notify the COR or his or her designee within 30 minutes, in the event of an emergency or unusual occurrence affecting the security interests of FEMA, and follow the requirements in the occupant emergency plan (including any HazMat procedures) for that facility.

MODERATE-RISK BACKGROUND INVESTIGATIONS

All contractor personnel serving as, or otherwise performing the functions listed in the Statement of Work and any other contractor personnel requiring access to DHS or FEMA information systems or routine access to DHS or FEMA facilities, must undergo a Moderate-Risk Background Investigation (MBI) and receive a favorable adjudication thereof from FEMA prior to performing work under this contract. Contractor personnel serving as, or otherwise performing the functions listed in the Statement of Work and any other contractor personnel requiring access to DHS or FEMA information systems or routine access to DHS or FEMA facilities, who already have a current, favorably adjudicated MBI (based on an investigation completed within the last five years) are eligible to perform work under this contract once FEMA has verified the current MBI.

Upon favorable adjudication of the MBI or verification of a current, favorably adjudicated MBI, FEMA’s Personnel Security Division will notify the COR of the names of the favorably adjudicated contractor personnel. The COR will, in turn, notify the contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract. Likewise, FEMA’s Personnel Security Division will provide the names of the contractor personnel whose adjudication was unfavorable to the COR, who will then forward that information to the contractor. Contractor personnel who receive unfavorable adjudications shall be ineligible to perform work under this contract.

Unfavorable adjudications are final and are not subject to review.

To initiate the process to obtain or validate contractor personnel’s MBI, the FEMA COR shall submit to FEMA’s Personnel Security Division a completed FEMA Form 121-3-1-6, “Contract Fitness/Security Screening Request,” for each of the contractor personnel.

The contractor shall provide the FEMA COR with all necessary information and comply with all necessary instructions to complete the FEMA Form 121-3-1-6 for each of the contractor personnel. Upon receipt of the completed FEMA Form 121-3-1-6, FEMA’s Personnel Security Division shall provide the contractor personnel the following documents, which the contractor personnel must complete and return in compliance with their accompanying instructions, which are incorporated into this contract by reference:

• Standard Form 85P, “Questionnaire for Public Trust Positions”

• Optional Form 306, “Declaration for Federal Employment”

• FD Form 258, “Fingerprint Card” (2 copies)

• DHS Form 11000-6, “Conditional Access to Sensitive But Unclassified

Information Non-Disclosure Agreement”

• DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer

Reports Pursuant to the Fair Credit Reporting Act”

FEMA will only accept complete packages consisting of all of the above documents, except for the Standard Form 85P, which must be completed electronically through the Office of Personnel Management’s e-QIP system.

FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of an MBI if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of the

MBI.

Eligibility determinations based on an MBI are valid for five years from the date the MBI is completed. Contractor personnel required to undergo an MBI to perform work under this contract shall be ineligible to perform work under this contract upon the expiration of five years from the date the last MBI was completed unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

FACILITY ACCESS

The contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121- 3-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes arrangements to obtain any necessary identity badges for contractor personnel. Contractor personnel working within any FEMA facility, who do not require access to DHS or FEMA IT systems, must be vetted through the submission of FD 258, “Fingerprint Card with favorable results must be escorted in accordance with FEMA Directive FD- 121-3 “Facility Access,” dated 01/28/2011.

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

The contractor shall notify the FEMA COR of all terminations/resignations within five (5) days of occurrence, and the FEMA COR shall promptly notify FEMA’s Personnel Security Division of the same. The contractor shall return to the FEMA COR all DHS- or FEMA-issued identification cards and building passes that have either expired or have been collected from terminated employees. If an identification card or building pass is not available to be returned, the contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

ATTACHMENT C

PHYSICAL SECURITY REQUIREMENTS

1. DOORS AND DOOR LOCKS: Doors are of 45 mm (1-3/4 in.) hardwood or hollow steel construction. Dutch or half doors are unacceptable. Removable hinge pins on door exteriors must be retained with set pins or spot welded, preventing their removal. All doors must be fitted with two lock sets. Doors with glass panes must have one lock set, key operated from the interior of the protected area. If a door is not set in a steel frame, one of the two locks must be a jimmy proof rim dead lock. Doors set in steel frames must be fitted with a mortise lock with a deadlock pin feature. One lock (the day lock) must be automatically locking on door closure; requiring reentry to the room with key or lock combination and allowing egress from the room by use of an inside thumb latch. The day lock on the main door must be automatically locking, with a minimum 19 mm (3/4 in.) dead bolt and inside thumb latch. Combinations or keys to day locks will be restricted to authorized personnel and combinations changed immediately on the termination or reassignment of an employee. Medeco™ high security locking device or equal is recommended.

2. OTHER ROOM ACCESS MEANS: Interstitial overhead areas which enable entry into a secure room from an unsecured room must be barricaded by the installation of a suitable partition in the interstitial space which prevents "up and over" access. Ventilation grills on doors and air circulation ducts which exceed 0.06 m2 (100

sq. in.) in areas must be reinforced to prevent their removal from outside the room.

Other possible access means such as dumbwaiter shafts, roof, or wall ventilator housings, trapdoors, etc., must be secured by appropriate means.

3. MOTION INTRUSION DETECTORS: An intrusion detection alarm system which…