OTHER-PWS 240913.pdf

ATTACHMENT 1 – PERFORMANCE WORK STATEMENT (PWS)

U.S. Department of Health and Human Services (HHS)

Administration for Children and Families (ACF)

Office of Refugee Resettlement (ORR) Refugee Resettlement Network Support Services

30 August 2024

Part 1 General Information

1. General

This is a non-personal services contract to provide case management, interpretation, and translation support. The Government shall not exercise direct supervision or control over the providers performing the services herein. Such service providers shall be accountable solely to the Contractor, who, in turn, is responsible to the Government.

United States (U.S.) citizenship is not required for Contractor employees performing under this contract. Per statute, this contract can only be awarded to a non-profit organization.1

1.1 Description of Services/Introduction

Refugee resettlement network support services are required in support of ACF’s mission to support refugee2 resettlement and integration in multiple states. Refugee resettlement network support services include: 1. Furnish necessary personnel to support ACF, state and local governments, non-governmental organizations (NGOs), and non-profits (hereafter “partners”) in various services related to resettlement and integration; 2. Maintain clear lines of reporting and communication as needed for the efficient operation of the program; 3. Maintain a clear and independent supervisory structure within their organization for all personnel issues, including, among others, evaluation of job performance, designation of work responsibilities, work schedules, personal and sick leave, and professional development. The required activity is ACF, which is a division of HHS.

1.2 Background

ACF is committed to a world where children and families receive holistic and integrated services delivered with integrity and respect and support the goal of economic independence. As the second-largest operating division within HHS, ACF continues to look for innovative ways to meet the diverse needs of its target populations while also ensuring the stewardship of taxpayer funds.

1 INA 412(c) (8 USC 1522(c)) and INA 412(e) (8 USC 1522(e))

2 "Refugee” in this context includes all individuals who are eligible for ORR/RPB benefits and services.

ACF has identified a need for refugee resettlement network support services which will provide staff support services to meet the needs of the ORR Refugee Program Bureau (ORR/RPB) resettlement network. ACF and ACF-funded programs are required to provide meaningful access to make services accessible to limited-English proficient individuals. Title IV of the Civil Rights Act of 1964 prohibits discrimination based on race, color, or national origin. In 2000, Executive Order 13166, “Improving Access to Services for Persons with Limited English Proficiency,” extended protections under the class of “national origin” to language and “meaningful access” to government services.

Title V of the Rehabilitation Act of 1973, which applies to the Federal Government and federally funded organizations, also prohibits discrimination based on disability. In addition, ACF’s commitment to culturally responsive and trauma-informed care requires capable and qualified interpreters and supportive staff from shared cultural backgrounds.

1.3 Scope

The refugee resettlement network support services contract shall provide staff support services across task areas that are scalable to meet the needs of the ORR/RPB resettlement network. Task areas include:

• Task Area 1: Project Management

• Task Area 2: Case Management Support

• Task Area 3: Language Support

• Task Area 4: Reporting

The requirements outlined in this PWS shall be performed under this contract, as well as other requirements determined to be within the general scope of this PWS by the

Contracting Officer (CO) during the duration of this contract.

1.4 Goal and Objectives:

The goal of this contract is to provide staff support services across task areas that are scalable to meet the needs of the ORR/RPB resettlement network.

The objective of the contract is to provide refugee resettlement network support services for refugee resettlement and integration in multiple states around the U.S. These efforts augment ongoing and collaborative efforts supported by the federal government and supplemented by ORR/RPB partners.

1.5 General Information:

1.5.1 Quality Control Plan (QCP)

The Contractor shall develop, implement, and maintain a QCP to ensure services are performed in accordance with (IAW) this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor's QCP is how it assures that the work provided complies with the requirements of the contract.

The Contractor’s QCP shall be submitted to the CO and the COR appointed on the Contract for review within 10 business days after the date of Contract award.

(Deliverable A.001)

The Government will review and either notify the Contractor in writing of acceptance of the plan or return their comments to the Contractor within 10 business days. If the

Government provides comments, the Contractor shall then have three business days to submit a Final QCP for COR acceptance, which the COR will provide in writing. The Contractor shall submit any proposed changes to the accepted QCP through the COR to CO no later than 30 calendar days prior to the anticipated change and the Contractor must receive COR acceptance prior to implementing the proposed change(s).

At a minimum, an acceptable QCP must provide and/or address the following:

a. Provide a chart showing the organizational structure and lines of authority. The chart shall include the full names, titles, qualifications, and responsibilities of each member of the Contractor's Quality Control Team.

b. Describe how the Contractor will monitor work to ensure progress and eventual completion of all deliverables (e.g., timelines, deadlines, and goals), and how such information will be documented and preserved.

c. Describe how the Contractor will monitor work to ensure that performance complies with all specifications and requirements of the contract, including applicable provisions and clauses.

d. Describe how the Contractor will inventory and track maintenance of all

Government Provided Equipment / Materials issued and/or used by the Contractor in performance of the contract.

e. Describe how the Contractor will identify, investigate, and correct any non-conforming performance and prevent similar deficiencies in the future.

f. Describe how the Contractor will create, file, and save all Quality

Control related paper and electronic records, files, and documents for the duration of the contract plus an additional five years after the period of performance expiration.

1.5.1.1 The Contractor shall inform the COR of issues or potential issues that might affect contract performance within two working hours of identifying those issues. Verbal reports shall be followed up by written issue reports within three business days. (Deliverable A.002)

1.5.2 Quality Assurance

The Government will evaluate the Contractor’s performance under this contract

IAW the Refugee Resettlement Network Support Services Quality Assurance Surveillance Plan (QASP) This plan is primarily focused on what the Government must do to ensure that the Contractor has performed IAW the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the acceptable quality levels (performance thresholds).

1.5.3 Recognized Holidays

The following provides information on recognized holidays for the purpose of the PWS. If submittal of any documentation (e.g., deliverables, submittals, etc.)

deadlines fall on a holiday, the closest workday prior to the holiday will apply as the deadline for submittal.

1.5.3.1 U.S. Holidays

Work shall not be performed on U.S. holidays occurring during the normal workweek unless otherwise directed by the CO. When a U.S. holiday occurs on a Saturday or a Sunday, the holiday is observed on the preceding Friday or following Monday, respectively. The Contractor shall refer to the OPM website to see the observed dates for each holiday during a specific year.

U.S. Federal Holidays

New Year’s Day January 1st

Birthday of Martin Luther King, Jr. 3rd Monday in January

Washington’s Birthday 3rd Monday in February Memorial Day Last Monday in May

Juneteenth National Independence

Day

June 19th

Independence Day July 4th

Labor Day 1st Monday in September

Columbus Day 2nd Monday in October

Veterans Day November 11th

Thanksgiving Day 4th Thursday in November

Christmas Day December 25th

1.5.4 Operating Hours

The Government facility office hours, facility-operating hours, and the Contractor support hour requirements often coincide, however, they may differ as outlined in paragraphs 1.5.4.1 - 1.5.4.3 herein.

1.5.4.1 Government Facility Office Hours

The Government facility office hours and days will be specified by the COR and exclude the U.S. Holidays identified in paragraph 1.5.3.1 and when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

1.5.4.2 ORR/RBP Partner Facility Operating Hours

The operating hours and days of ORR/RFP partners’ facilities will be specified by the COR. The facilities may close due to local or national emergencies, administrative closings, or similar Government-directed facility closings and will be communicated by COR or CO to the Contractor in writing.

1.5.4.3 Contractor Support Hours

The Contractor shall provide support 40 hours per week for deployed staff and up to 40 hours per week for staff working remotely. Work will occur Monday – Friday except when approved by the COR. The Contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the ORR/RFP partner facility is not closed for the reasons in paragraph 1.5.4.2. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6 Contractor Project Plan:

The Contractor shall deliver a project plan outlining its approach to meet the requirements of this contract. The plan must address each specific task area in the

PWS and must demonstrate the Contractor’s ability to hire qualified personnel to meet all task requirements. (Deliverable A.003)

1.7 Place of Performance:

ORR/RPB funds, directly and indirectly, a network of hundreds of refugee resettlement providers and partners in 49 states. These partners provide case management and other services to resettled refugees who live independently in communities. The

Contractor shall be prepared to support partners in the 34 states listed in paragraph

5.2.1.1 or from remote locations, as directed by the COR.

Performance locations will have a designated workspace for Contractor personnel.

Assignment locations depend on requests, which are received on a rolling basis, as partners receive refugees and assess their capacity to support them with their existing staff.

1.8 Telecommuting:

The Government may permit telecommuting by Contractor employees when determined to be in the best interest of the Government in meeting work requirements. The Contractor must have an established program subject to review by the Government. All telecommuting agreements must be authorized and approved by the CO and include the date, time, and description of the tasks to be performed. A telework program may be enacted to ensure the

Government's mission-critical operations stay operational during times of National Emergency or incidents of National Significance. The COR must identify to the CO any tasks that are required to ensure continuity of critical services and at what level those services must be delivered. Telecommuting must be at no additional cost to the Government.

1.8 Security Requirements

1.8.1 Baseline Security Requirements Applicability. The requirements herein apply only if the entire contract or portion thereof, includes either or both of the following:

1.8.1.1 Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information as required to perform their work. Access is contingent upon positive adjudication of background check.

1.8.1.2 Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the ACF mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

1.8.2 Safeguarding Information and Information Systems: In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, dated

February 2004, including any subsequent updates, the Contractor (and/or any subcontractor) shall:

1.8.2.1 Protect government information and information systems in order to ensure:

a. Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information,

b. Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity, and

c. Availability, which means ensuring timely and reliable access to and use of information.

1.8.2.2 Provide security for any Contractor systems, and information contained therein, https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.199.pdf https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.199.pdf https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.199.pdf connected to an HHS network, or operated by the Contractor on behalf of ACF regardless of location.

1.8.2.3 Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

1.8.3 Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II, Revision 1: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, dated August 2008, including any subsequent updates, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall

Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system. The Contractor shall work with the ACF security team to categorize information or information systems. The categorization can change at any time throughout the lifecycle of the system. The

Contractor shall ensure proper controls are implemented based on the categorization.

1.8.4 Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.”

32 C.F.R. 2002.4(aa). All sensitive information that has been identified as CUI by a regulation or statute, handled by this Contract, shall be:

a. marked appropriately,

b. disclosed to authorized personnel on a Need-To-Know basis,

c. protected IAW NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations, Revision 5, dated September 2020, applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, Revision 2, dated February 2020, including any subsequent updates, if handled by internal contractor system, and

d. returned to ACF control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished IAW NIST SP 800-88, Guidelines for Media Sanitization, dated December 2014, including any subsequent updates.

1.8.5 Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive IAW OMB Memorandum M-06-16, Protection of Sensitive Agency Information, dated June 2006, including any subsequent updates, by securing it with a FIPS 140-2 or FIPS 140-3 validated solution IAW NIST FIPS 140-3 transition guidance.

1.8.6 Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any subcontractor) by ACF or collected by the Contractor on behalf of ACF shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any ACF records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected IAW HHS and ACF policies. Unauthorized disclosure of information will be subject to the

HHS/ACF sanction policies and/or subject to administrative action or criminal prosecution IAW federal laws and regulations such as but not limited to:

a. 18 U.S.C. 641 (Crimes and Criminal Procedure: Public Money, Property or Records),

b. 18 U.S.C. 1905 (Crimes and Criminal Procedure: Disclosure of Confidential Information Generally), and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Each Contractor (and/or any subcontractor) employee having access to non-public government information under this agreement shall complete the ACF non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this contract. (Deliverable A.004)

1.8.7 Standard for Encryption.

The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information (to be provided after award) to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 or FIPS 140-3 validated encryption solution IAW NIST FIPS 140-3 transition guidance.

c. Secure all devices (i.e., desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and ACF-specific encryption standard requirements. Maintain a complete and https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-16.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-16.pdf https://csrc.nist.gov/projects/fips-140-3-transition-effort https://csrc.nist.gov/projects/fips-140-3-transition-effort https://csrc.nist.gov/projects/fips-140-3-transition-effort current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2 or FIPS 140-3, as applicable. The Contractor shall provide a written copy of the validation documentation to the COR prior to implementation of the solution.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

1.8.8 Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA). When applicable, the Contractor shall assist the ACF Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the ACF SOP or designee with completing a PIA for the system or information within 30 calendar days after completion of the PTA and IAW HHS policy and OMB M-03-22, Guidance for Implementing the

Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the ACF SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

1.9 Training and Position Sensitivity

1.9.1 Mandatory Training for All Contractor Staff. All Contractor (and any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/ACF Contractor Information Security Awareness, Privacy, and Records Management training before performing any work under this contract. Thereafter, the employees shall complete HHS/ACF Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies. (Deliverable A.005) Training is available in one of two ways:

a. For Contractors who will obtain an ACF PIV card, access to the training will be made available once the PIV card and laptop are obtained.

b. For Contractors without a PIV card, access to the training will be made available once personnel have been cleared to work under the contract.

1.9.1.1 Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities IAW HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

1.9.2 Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract IAW HHS policy. For Contractors who have a PIV card with ACF, these records are stored in ACF’s Contact List System. For Contractors who do not have a PIV, a record should be maintained by the Contractor and sent to the CO and/or COR within 30 calendar days of the respective award. For all Contractors, training records must be updated annually thereafter or upon request of ACF.

1.9.3 Rules of Behavior.

1.9.3.1 The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior (ROB). The HHS ROB can be obtained from the CO and/or COR.

1.9.3.2 All Contractor employees performing on the contract must read and adhere to the ROB before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual ACF Information Security Awareness Training. As part of the ACF annual security requirement, assigned personnel must take the Cybersecurity Awareness and Privacy

101 training beginning the following fiscal year. (Deliverable A.005)

1.9.4 Incident Response

Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 35, Subchapter III) defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The Contractor (and/or any subcontractor) shall comply with ACF’s Incident Response

Policy dated July 10, 2018, including any subsequent updates. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1.9.4.1 Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident.

1.9.4.2 Notify affected individuals only as instructed by the CO or designated representative.

1.9.4.3 Report all suspected and confirmed information security and privacy incidents and breaches to the ACF Incident Response Team (IRT), COR, CO, ACF SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic as defined in ACF’s Incident Response Policy.

1.9.4.4 Provide full access and cooperate on all activities as determined by the

Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to Contractor facilities during a breach/incident investigation.

1.9.5. Position Sensitivity Designations

To perform the work specified herein, Contractor personnel will require access to proprietary, privacy protected and/or sensitive data, regular access to HHS-controlled facilities and/or access to HHS information systems. The Government anticipates the position sensitivity under this effort to be Level 5; but sensitivity levels cannot be ascertained definitively until after each Contract award. All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

1.9.5.1 Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e- mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor might develop, access, host, and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within three business days of the effective date of this contract. Any revisions to the roster because of staffing changes shall be submitted within 24 hours of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level. (Deliverable A.006)

1.9.6 Homeland Security Presidential Directive (HSPD)-12

To gain the required access and successful award, the Contractor shall comply with

Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors, and with the personal identity verification and investigation procedures contained in:

• HHS Information Security Program security requirements, outlined in the HHS

Information Security and Privacy Policy (IS2P) – copy can be obtained by emailing fisma@hhs.gov

• HHS Continued Implementation for the HSPD-12 Program, dated January 13,

• OPM Final Credentialing Standard, dated June 2008

• OMB M-05-24, dated August 5, 2005, Implementation of Homeland Security Presidential Directive (HSPD) 12, Policy for a Common Identification Standard for Federal Employees and Contractors

• Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, dated June 30, 2008

• 5 CFR Part 1400.201

The minimum Government investigation to receive an HSPD-12 PIV Credential is a Tier 1 National Agency Check with Inquiries (NACI), which consists of searches of records covering specific areas of a person’s background during the past five years. The minimum Government investigation to receive Elevated Privilege (any access beyond normal email or data entry) is a Tier 4 (Background Investigation High Risk Public Trust).

The Contractor must comply with the instructions and timeframes specified by the COR regarding the handling of the security requirements specified in this section. Typically , each employee must submit at a minimum: a completed OF-306; a current resume; and a completed HHS 828 form. Additional requirements may apply to Foreign National Applicants who will follow a slightly different level of initial checks. No Contractor may begin any work or obtain any access to HHS facilities, information, or information systems unless and until codified credentialing standards are met, and the Office of

Security and Strategic Information informs the COR initial security requirements are complete or HSPD-12 badges have been issued, whichever occurs first. Contractors should ensure that the employees whose names they submit have a reasonable chance for access approval. In some cases, employees with existing background investigations commensurate with sensitivity designations will expedite performance. Delays associated with rejections and consequent reinvestigations may not be excusable.

Investigations may delay performance, regardless of the outcome of the investigation.

The facts surrounding individual cases will determine whether a delay is excusable.

Typically, the Government investigates personnel at no cost to the Contractor, but the expense of multiple investigations for the same position is difficult to justify.

Consequently, multiple investigations for the same position may, at the CO’s discretion, justify reduction(s) in the contract price of no more than the cost of the extra investigation(s), i.e., within one year of established employment.

The requirements in this section are applicable to and shall be included in all subcontracts which require subcontractor personnel to have access to an information system, access to proprietary, privacy protected and/or sensitive data, other than occasional or intermittent access to an HHS-controlled facility, or any combination of these three.

The 2017 DOI/Bureau of Indian Affairs Self-Governance Negotiation Guide cites language to use for agreements with Sovereign Nations/Entities, Tribes, and Consortia to either comply with HSPD-12 or elect to not have access to federal information or information systems, either by hardcopy or electronic means.

Inquiries, including requests for forms and assistance, should be directed to the COR, listed in Section G of the contract. The Contractor shall provide a monthly status summary to the COR of all fingerprint/background checks in progress. (Deliverable A.007)

Within seven calendar days after final acceptance of the work specified herein, the Contractor shall return all identification badges, Government Furnished Equipment, Government Furnished Data and Government Furnished Property (GFE/GFD/GFP) if applicable, to the COR. Within seven calendar days after employee departure at any time during the contract, the Contractor shall return all identification badges, and GFE/GFD/GFP if applicable, to the COR.

1.9.6.1 Identification Card Custody and Control. The Contractor is responsible for the custody and control of all forms of HSPD-12 Credentials issued by HHS to Contractor employees, including all subcontractor employees. The Contractor shall immediately notify the COR when a Contractor or subcontractor employee no longer requires agency access due to transfer, completion of a project, retirement, removal from work on the contract, or termination of employment. Return all HHS HSPD-12 Credentials to the appropriate credentialing office.

The Contractor shall also ensure that Contractor or subcontractor employees comply with HHS requirements concerning the renewal, loss, theft, or damage of an ID card.

Failure to comply with the requirements for custody and control of HHS issued ID cards may result in a delay in withholding final payment or contract termination, based on the potential for serious harm caused by inappropriate access to HHS facilities, sensitive information, information systems or other HHS resources.

1.9.6.1.1 Renewal. A Contractor employee’s HHS issued ID card is valid for a maximum of five years and nine months or until the contract expiration date (including option periods), whichever occurs first. The renewal process should begin six weeks before the ID card expiration date by contacting the COR. If an ID card is not renewed before it expires, the Contractor employee will be required to sign-in daily for facility access and may have limited access to information systems and other resources.

Contractor ID card certificate(s) require yearly updates from the issuance date. The yearly updates should be coordinated between the Contractor and the COR. HHS reserves the right to impose annual expiration dates on HHS issued ID Cards at any time.

1.9.6.1.2 Lost/Stolen. Immediately upon detection that an ID card is lost or stolen, the Contractor or Contractor employee shall submit an Incident Report within 24 hours for all lost or stolen HHS Credential to the COR and the local security servicing organization. The Incident Report shall describe the circumstances of the loss or theft. If the loss or theft is reported by the Contractor to the local police, a copy of the police report shall be provided to the COR. The Contractor employee shall sign in daily for facility access and may have limited access to information systems and other resources until the replacement card is issued.

1.9.6.1.3 Replacement. A Credential will be replaced if it is damaged, contains incorrect data, or is lost or stolen for more than three calendar days, provided there is a continuing need for agency access to perform work under the contract.

1.9.6.1.4 Surrender Credentials/Access Cards, Government Equipment. HHS reserves the right to suspend or withdraw access at any time for any reason. Access will be restored upon the resolution of the issue(s). Upon notification that access to HHS facilities, proprietary, privacy protected and/or sensitive information, federally controlled information systems or other HHS resources is no longer required, the Contractor shall surrender the HHS issued Credentials, access card, keys, computer equipment, and other government property to the COR or directly to HHS at the address referenced above.

All GFE and PIVs must be returned on or before the last day of contract performance.

Failure to do so may result in permanent disbarment from HHS/ACF systems and facilities and may be subject to fines and penalties, as authorized by applicable Federal or State laws. If contract performance ends on a weekend, the COR will provide guidance for returning GFE and PIVs.

1.9.7 Security Requirements for GOCO and COCO Resources

1.9.7.1 Federal Policies. The Contractor (and/or any subcontractor) shall comply with applicable federal laws that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P); FISMA; National Institute of Standards and Technology

(NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

1.9.7.2 Government Access for Security Assessment.

In addition to the Inspection Clause in the contract, the Contractor (and/or any subcontractor) shall afford the Government access to the Contractor’s facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the confidentiality, integrity, and availability of federal data or to the protection of information systems operated on behalf of HHS, including but are not limited to:

a. At any tier handling or accessing information, consent to and allow the

Government, or an independent third party working at the Government’s direction, without notice at any time during a weekday during regular business hours Contractor local time, to access Contractor and subcontractor installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms), databases, and personnel which are used in performance of the contract. The Government includes but is not limited to the U.S. Department of Justice, U.S. Government

Accountability Office, and the HHS Office of the Inspector General (OIG). The purpose of the access is to facilitate performance inspections and reviews, security and compliance audits, and law enforcement investigations. For security audits, the audit may include but not be limited to such items as buffer overflows, open ports, unnecessary services, lack of user input filtering, cross site scripting vulnerabilities, structured query language (SQL) injection vulnerabilities, and any other known vulnerabilities.

b. At any tier handling or accessing protected information, fully cooperate with all audits, inspections, investigations, forensic analysis, or other reviews or requirements needed to carry out requirements presented in applicable law or policy. Beyond providing access, full cooperation also includes, but is not limited to, disclosure to investigators of information sufficient to identify the nature and extent of any criminal or fraudulent activity and the individuals responsible for that activity. It includes timely and complete production of requested data, metadata, information, and records relevant to any inspection, audit, investigation, or review, and making employees of the

Contractor available for interview by inspectors, auditors, and investigators upon request. Full cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture.

c. Segregate Government protected information and metadata on the handling of Government protected information from other information. Commingling of information is prohibited. Inspectors, auditors, and investigators will not be precluded from having access to the sought information if sought information is commingled with other information.

d. Cooperate with inspections, audits, investigations, and reviews.

1.9.7.3 End of Life Compliance:

The Contractor (and/or any subcontractor) must use Commercial off the Shelf (COTS) software or other software that is supported by the manufacturer. In addition, the COTS/other software need to be within one major version of the current version;

deviation from this requirement will only be allowed via the HHS waiver process

(approved by HHS CISO). The Contractor shall retire and/or upgrade all software/systems that have reached end-of life IAW HHS End-of-Life Operating Systems, Software, and Applications Policy.

1.9.7.4 Servers, Desktops, Laptops, and Other Computing Devices Required for Use by the Contractor:

The Contractor (and/or any subcontractor) shall ensure that all IT equipment (e.g., laptops, desktops, servers, routers, mobile devices, peripheral devices, etc.) used to process information on behalf of ACF are deployed and operated IAW approved security configurations and meet the following minimum requirements:

a. Encrypt equipment and sensitive information stored and/or processed by such equipment IAW ACF encryption standards,

b. Ensure end user devices do not store or process data outside of an IT system,

c. Maintain the latest operating system patch release and anti-virus software definitions within 14 calendar days for critical, 30 calendar days for high, 60 calendar days for medium, 90 calendar days for low from the release date of patch,

d. Validate the configuration settings after hardware and software installation, operation, maintenance, update, and patching and ensure changes in hardware and software do not alter the approved configuration settings, and

e. Automate configuration settings and configuration management IAW HHS security policies, including but not limited to:

• Configuring its systems to allow for periodic HHS vulnerability and security configuration assessment scanning, and

• Using Security Content Automation Protocol (SCAP)-validated tools with USGCB Scanner capabilities to scan its systems at least monthly and report the results of these scans to the CO and/or COR, Project Officer, and any other applicable designated POC.

1.10 Records Management Obligations

1.10.1 Applicability

All Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section 2 of this PWS, regardless of the medium in which the record exists.

1.10.2 Requirements

Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. Chapters 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974, as amended (5

U.S.C. § 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion. Electronic information system means an information system that contains and provides access to computerized Federal records and other information. (36 CFR 1236.2)

The following types of records management controls are needed to ensure that Federal records in electronic information systems can provide adequate and proper documentation of agency business for as long as the information is needed. Agencies must incorporate controls into the electronic information system or integrate them into a recordkeeping system that is external to the information system itself. (36 CFR 1236.10)

(a) Reliability: Controls to ensure a full and accurate representation of the transactions, activities, or facts to which they attest and can be depended upon during subsequent transactions or activities.

(b) Authenticity: Controls to protect against unauthorized addition, deletion, alteration, use, and concealment.

(c) Integrity: Controls, such as audit trails, to ensure records are complete and unaltered.

(d) Usability: Mechanisms to ensure records can be located, retrieved, presented, and interpreted.

(e) Content: Mechanisms to preserve the information contained within the record itself that was produced by the creator of the record.

(f) Context: Mechanisms to implement cross-references to related records that show the organizational, functional, and operational circumstances about the record, which will vary depending upon the business, legal, and regulatory requirements of the business activity.

(g) Structure: Controls to ensure the maintenance of the physical and logical format of the records and the relationships between the data elements.

1.10.3 Disposition: In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. Chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. § 552), as amended, and the Privacy Act of 1974 (5 U.S.C. § 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

1.10.4 Maintenance of Records: In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed IAW Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

1.10.4.1 The Contractor shall not create or maintain any records containing any non-public HHS or ACF information that are not specifically tied to or authorized by the contract.

1.10.4.2 The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

1.10.5 Alienation or Unauthorized Destruction of Records: ACF and its contractors are responsible for preventing the unlawful alienation, alteration, removal, or any accidental or unauthorized destruction of records, including all forms of mutilation.

Records may not be removed from the legal custody of ACF or destroyed except for IAW the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C.

§ 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report it to ACF immediately. The agency must report promptly to NARA IAW 36 CFR 1230.

1.10.6 Notification of Inadvertent or Unauthorized Disclosure of Information: The Contractor shall immediately notify the appropriate CO upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to ACF control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the CO or address prescribed in the contract. Destruction of records is EXPRESSLY PROHIBITED unless IAW Paragraphs 1.10.3 and 1.10.4.

1.10.7 Consent to Engage in Contractual Relationship with Disclosure of

Information: The Contractor shall obtain the CO's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to the contract. The Contractor (and any sub-contractor) is required to abide by

Government and HHS and ACF guidance for protecting sensitive, proprietary information, classified, and…