TRAIN SOW_CLEAN.docx

U.S. Immigration and Customs Enforcement (ICE) IHSC TRAINING AFFILIATE PORTAL Statement of Work (SOW) Office of the Chief Information Officer (OCIO) August 2024 Washington, DC

PROCUREMENT SENSITIVE. THIS DOCUMENT IS CONFIDENTIAL AND INTENDED SOLELY FOR THE USE AND INFORMATION OF THE COMPANY TO WHOM IT IS ADDRESSED.

Table of Contents

STATEMENT OF WORK (SOW) Comment by Cantey, Tifphany: Recommend use of a cover page and table of contents

IHSC TRAINING AFFILIATE PORTAL

1 GENERAL

The Immigration and Customs Enforcement Health Service Corps (IHSC) provides or arranges health care services for noncitizens detained by the U.S. Immigration and customs Enforcement (ICE). As ICE’s medical authority, IHSC provides health care delivery and oversight to noncitizens in ICE custody who may be housed in service processing centers (SPC), Contract Detention Facilities (CDF), or state, county, or local inter-governmental service agreement (IGSA) correctional facilities located throughout the continental United States.

1.1 Background

IHSC has a multi-sector, multidisciplinary workforce of more than 1400 employees, including U.S. Public Health Service (PHS) commissioned officers, federal civil servants, and contract staff. The IHSC provides on-site direct patient care to ICE noncitizens at 16 detention facilities throughout the country and manages the provision of off-site medical care for noncitizens housed in approximately 160 additional non-IHSC-staffed facilities. IHSC is the only health care entity within ICE, and it is comprised of over 20 different health disciplines. It is essential for these disciplines to be able to access a wide variety of training, including those that offer continuing education (CE) to maintain licensure and stay up to date with best practices. IHSC is not an accredited provider of CE and fiscal constraints have created delays in sending staff to receive professional training. Lack of efficient competency training can potentially have a negative impact on the delivery of care to noncitizens and threaten staff retention. Comment by Houston, Jorielle B: should this be 19? Comment by Moulder, Lauren: I think we are down to 16 with facility closures, but check me if I’m wrong! Comment by Houston, Jorielle B: Ok. sounds good.

Recruiting and retaining competent and satisfied employees is a goal of IHSC. Therefore, establishing a platform to provide CE and opportunities for knowledge and capacity building on health care topics can be used as a recruitment and retention strategy for hiring and retaining highly competent IHSC personnel. Also, the establishment of a CE platform will serve as an incentive for employees and reward them for their dedication and commitment to the mission.

IHSC is committed to investing in workforce development and recognizes that such strategic investments are critical to accomplishing its mission. The ability to provide CE training will significantly enhance the knowledge and skill sets of IHSC health care professionals while also ensuring that IHSC aligns with the required national detention standards and that PHS Officers meet PHS CE requirements. IHSC has limited funding to support staff for external training opportunities to secure CE. The ability for staff to access a learning management system that is always available via any device has allowed IHSC staff to complete over 3,400 trainings in the last fiscal year. Comment by Moulder, Lauren [2]: Is this still accurate since IHSC has been utilizing TRAIN? Comment by Houston, Jorielle B: I believe we have some cost data we can incorporate here. Comment by Houston, Jorielle B: I revised this to be more accurate and include some quantitative data.

Although numerous platforms offer CE, joint training platforms are most effective because they bring together agencies and organizations in the public health, health care, and preparedness sectors to disseminate, track, and share trainings for the health workforce on a single national online learning management system (LMS) platform. Joint training platforms are built to support the overall healthcare workforce on both the state and federal levels.

1.2 Scope

The Contractor shall provide IHSC with the following requirements:

· Develop an IHSC subscription-based affiliate portal,

· Develop a centralized, searchable catalog of distance learning for public health professionals, including courses that offer CE,

· Track learner progress and attendance with extensive reporting capabilities,

· Utilize course evaluation tools to assess learner improvements and feedback,

· Extensive communication and management tools,

· Access to ongoing technical support,

· Options for flexible storage and bandwidth, and

· Development of up to six (6) eLearn trainings annually (i.e., Sharable Content Object Reference Model (SCORM) courses).

The pricing shall be a firm fixed price based on the services that are offered with a standard training affiliate platform. IHSC will have full access to the training platform as an affiliate each contract renewal year.

1.3 Objective

The subscription-based training platform shall allow the IHSC affiliate administrator to create course-learning plans, competency plans, and course catalogs with listings of mandatory training for all IHSC staff. This function shall provide IHSC leadership with a training tracking method and ensure that staff are aware of and in compliance with IHSC-specific training requirements. Furthermore, the training platform shall provide IHSC personnel access to >5,000 training courses including >2,000 CE courses while also offering and tracking training for external personnel resources such as ready reserve staff and PHS Officers detailed to IHSC from Readiness and Deployment Branch (RDB) or other federal agencies.

2 SPECIFIC REQUIREMENTS/TASKS

The below tasks are related to the implementation of the training learning network at IHSC.

2.1 TASK ONE. Develop an IHSC subscription-based affiliate portal.

2.1.1 The Contractor will provide electronic services on the date agreed to by the Contractor and the ordering activity. The Contractor will develop a state government health department-level IHSC training standard affiliate portal and ensure that it is operational within three weeks of finalizing a launching date with the IHSC affiliate administrator (Deliverable 1). The operational function shall include grouping and other tasks that are required during initial installation as directed by IHSC.

2.1.2 The subscription-based training affiliate portal will be available for use by all IHSC employees via the web, accessible while not connected to the VPN, and will be administered via the web across the IHSC medical community.

2.1.3 There will be no limit to the number of users.

2.1.4 The Contractor will provide branding of the IHSC subscription-based training affiliate portal including but not limited to the placement of the IHSC affiliate logo, affiliate header, login page, portal colors, layout, registration page, group structuring, and organization of content within two weeks of launching the system (Deliverable 2). Comment by Moulder, Lauren: Do we need to provide a customization checklist? The checklist that was previously utilized was specific to TRAIN. Comment by Cantey, Tifphany: How is the customization checklist specific to TRAIN? Is there a way to make it a general checklist? Comment by Cantey, Tifphany: I reviewed the Customization attachment. Let’s discuss further on next call

2.1.5 Before beginning any scheduled installation, the Contractor’s service representative will review and agree to the specific tasks outlined below. Additionally, the Contractor will work with the ordering activity to ensure that the Contractor is capable of meeting at least the minimum DHS/ICE security requirements for federal information systems.

2.1.6 The Contractor will provide normal commercial installation, operation, maintenance, and engineering training on the system. The Contractor will also provide a two-day training course for all essential IHSC staff that will be working with or managing the IHSC training portal, if necessary. Training shall focus on reporting, data input, and user creation. All training will be conducted within one month of portal completion (Deliverable 3).

2.2 TASK TWO. Develop a centralized, searchable catalog of distance learning for public health professionals, including courses that offer CE.

2.2.1 Learners will have the ability to access courses from other affiliates, including other nationally recognized course providers, offered in the form of web-based learning, on-site learning, and satellite broadcasts for little to no cost. Courses will be organized in a centralized, searchable catalog (Deliverable 4).

2.2.2 The catalog will include opportunities for the various healthcare disciplines to obtain CE.

2.2.3 The platform will enable learners to schedule training, maintain a personal learning record of courses they have scheduled, and maintain a transcript of courses they have completed.

2.2.4 The platform will develop, deliver, modify, and list courses in conjunction with course content development tools, such as Adobe Captivate and Articulate Storyline 360 which publish SCORM courses directly to the platform.

2.2.5 The platform will have the ability to post courses (online and onsite) visible to all learners or a specific discipline group.

2.2.6 Administrators will have the ability to create and assign training plans and blended learning series.

2.3 TASK THREE. Track learner progress and attendance with extensive reporting capabilities.

2.3.1 The platform will administer and track learner participation (in progress, completed, completed and verified, and withdrawn) with the ability to assign due dates and track completion dates.

2.3.1.1 The platform will track learner progress and attendance – for a designated group of learners (e.g., program or agency staff) across courses on the network.

2.3.1.2 Course providers or designated individuals will have the ability to track individual learner progress and attendance.

2.3.2 The platform will provide reports that can track the training status of specific facilities, disciplines, regions, and staff in supervisory/non-supervisory roles.

2.3.3 The platform will provide reports displaying account setup across IHSC and utilization, such as how often staff are signing in, what types of courses they are taking, and the number of CE completed.

2.4 TASK FOUR. Utilize course evaluation tools to assess learner improvements and feedback.

2.4.1 The platform will have the ability to create, assign, and manage pre/post-test assessments and course evaluation tools to evaluate learner improvements before and upon completion of the course and to obtain learner feedback about the course.

2.5 TASK FIVE. Extensive communication and management tools.

2.5.1 The platform will not integrate with an internal or other platform or system that IHSC may be operating to obtain personal information.

2.5.2 IHSC staff will be able to access the portal via the web and administrators will be able to administer via the web while not connected to VPN.

2.5.3 IHSC staff will be able to communicate with platform learners through targeted announcements.

2.5.4 The platform will have the ability to link training registration to the Outlook calendar.

2.5.5 IHSC staff will have the ability to manage platform learners through designated subgroups (discipline, DAD, supervisory/nonsupervisory, facility).

2.5.6 The platform will have the ability to assign administrator roles to users, including partner agencies.

2.5.6.1 There will be no limit on the number of administrators. Comment by Houston, Jorielle B: We should add that there will be no limit to the number of users. Should that go under 2.1.2?

2.5.7 The Contractor will include membership to the learning management system affiliate consortium, which is a forum to share training resources, collaborate on workforce development efforts, and learn training best practices.

2.6 TASK SIX. Access to ongoing technical support.

2.6.1 The platform will allow IHSC to participate in an affiliate network of states, the Centers for Disease Control and Prevention (CDC), and the Veterans Health Administration (VHA) that can singly or collectively fund efforts to add new features and functionality to the platform.

2.6.2 The platform will have access to ongoing technical support 24/7.

2.7 TASK SEVEN. Options for flexible storage and bandwidth.

2.7.1 The Contractor shall provide additional content storage space, support, and management.

2.7.1.1 On a semi-annual basis, the Contractor shall review additional content storage space requirements with IHSC, recommending any updates to bandwidth and storage space needs for the subsequent period of performance.

2.7.1.2 The Contractor will provide a monthly bandwidth report to IHSC (Deliverable 5).

2.8 TASK EIGHT. Development of eLearn Trainings.

2.8.1 The Contractor shall provide support in developing approximately 6 learning products (courses, videos, widgets, podcasts, job-aids, or other products the vendor might want to suggest to IHSC) and related materials based on sound instructional design methodology, adult learning theory, and innovative application of instructional technology in accordance with ICE Section 508 guidelines, responsive design guidance, IHSC subject matter experts and/or content developers, and IHSC guidance. Products shall be designed to collect learner assessment and evaluation data, to include metrics such as those that measure learner satisfaction, learner knowledge, learner skills attainment, learner performance on the job, or instructor performance or other appropriate assessment and evaluation tools to be determined in collaboration with IHSC.

2.8.1.1 Develop and/or promote the use of SMART learning objectives and tools to assess achievement of learning outcomes and to evaluate learner and instructor satisfaction with courses and educational sessions.

2.8.1.2 Provide consultation on learning design, competency alignment, and curriculum development to program staff.

2.8.1.3 Provide consultation on instructional design to program staff and content developers.

2.8.1.4 Apply principles of instructional systems design to conduct analysis, design, development and evaluation tasks required for training products and services, including e-learning and classroom-based training design.

2.8.1.5 Follow instructional design project planning guidance and style guides from program staff for all educational materials developed for IHSC.

2.8.1.6 Conform and adapt the product design and delivery approach to fully utilize applicable learning management systems, using SCORM (Shareable Content Object Reference Model), HTML5, Experience API, and future programming features as appropriate.

2.8.1.7 Products and other materials shall be accurate and clear, written in plain language and with a style suitable for the intended audience. For any e-learning products that are developed, the two approved authoring tools currently used at IHSC are Adobe Captivate and Articulate Storyline 360. However, IHSC programs and contractors can undertake efforts to seek agency approval of new authoring tools, if so desired.

2.8.1.8 Ensure timelines for projects are met and deliverables are received in accordance with the project plan.

2.8.1.9 IHSC program content developers about progress, challenges, and needs to accomplish tasks.

2.8.1.10 Consult the IHSC program content developers, health educators, and instructional designers when appropriate to determine functionality needs, requirements development and documentation, system architecture and design, software development and prototyping, optimal responsive design, product testing and implementation.

2.8.1.11 The contractor shall submit final deliverables in a format approved by IHSC that will allow for changes to later be made by IHSC as necessary.

3 CONTRACTOR PERSONNEL

3.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW.

3.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all contract support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

3.3 Key Personnel

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement. Note: The Government may designate additional Contractor personnel as Key at the time of award.

3.3.1 Project Manager

The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this SOW. The Project Manager shall be a single point of contact for the Contracting Officer and the COR. The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. The Project Manager is further designated as Key by the Government. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak, and understand English. Additionally, the Contractor shall not replace the Project Manager without prior approval from the Contracting Officer.

3.3.1.1 The Project Manager shall be available to the COR via telephone between the hours of 7:30 am and 4:30 pm EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within 48 hours of notification.

Employee Identification

3.4.1 Contractor employees visiting the Department of Homeland Security Headquarter Office shall be escorted and wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

3.4.2 Contractor employees visiting or working on-site at the Department of Homeland Security Headquarter Office shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

3.5 Employee Conduct

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security.

3.6 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Contracting Officer*), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

4 OTHER APPLICABLE CONDITIONS

4.1 Security

Contractor access to classified information is not currently required under this SOW. However, the Government at a later date may require all Contractor personnel to have Secret clearances. Accordingly, all Contractor employees provided for this requirement must be eligible for a Secret Clearance.

4.2 Period of Performance

The period of performance for this contract is a one-year base period with four one-year option periods as follows:

Base Period [April 1, 2025 through March 31, 2026] Option Period One [April 1, 2026 through March 31, 2027] Option Period Two [April 1, 2027 through March 31, 2028] Option Period Three [April 1, 2028 through March 31, 2029] Option Period Four [April 1, 2029 through March 31, 2030]

4.3 Place of Performance

The primary place of performance will be a combination of online training and the Department of Homeland Security at 500 12th Street, Washington, DC 20536.

4.4 Hours of Operation

Contractor employees shall generally perform all work between the hours of 7:30 am and 4:30 pm EST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this SOW.

4.5 Travel

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

4.6 Post Award Conference

The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 20 business days after the date of award (Deliverable 6). The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at the Government’s facility, located at 500 12th Street, Washington, DC 20536 or via teleconference.

4.7 Project Plan

The Contractor shall provide a draft Project Plan with proposal submission for review. The draft Project Plan will be discussed at the Post Award Conference. The Contractor shall provide a final Project Plan to the COR not later than 10 business days after the Post Award Conference (Deliverable 7).

4.8 General Report Requirements

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows XP and Microsoft Office Applications).

4.9 Protection of Information

Contractor access to IHSC employee training information protected under the Privacy Act is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

5 SECTION 508 COMPLIANCE

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

5.1 Section 508 Requirements for Technology Products

Section 508 applicability to Information and Communications Technology (ICT): Subscription based training affiliate portal Applicable Exception: N/A Authorization #: N/A Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components (including but not limited to Internet or Intranet website; Electronic surveys; Electronic reports; Electronic training materials): All requirements in E205 apply, including all WCAG 2.0 Level A and AA Success Criteria apply as specified in E205 Applicable 508 requirements for software features and components (including but not limited to Web, desktop, server, mobile client applications): All requirements in Chapter 5 apply, including all WCAG 2.0 Level A and AA Success Criteria, 502 Interoperability with Assistive Technology, 503 Application, 504 Authoring Tools Applicable 508 requirements for hardware features and components: Does not apply Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply

5.2 Section 508 Requirements for Technology Products

Section 508 applicability to Information and Communications Technology (ICT): Training and technical support Applicable Exception: N/A Authorization #: N/A Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components (including but not limited to Electronic training materials; Other): All requirements in E205 apply, including all WCAG 2.0 Level A and AA Success Criteria apply as specified in E205 Applicable 508 requirements for software features and components (including but not limited to Web, desktop, server, mobile client applications): All requirements in Chapter 5 apply, including all WCAG 2.0 Level A and AA Success Criteria, 502 Interoperability with Assistive Technology, 503 Application, 504 Authoring Tools Applicable 508 requirements for hardware features and components: Does not apply Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply

5.3 Section 508 Requirements for Technology Services

1. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item's level of Section 508 conformance prior to the services being performed.

2. When providing maintenance upgrades, substitutions, and replacements to ICT, the contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed upgrades, substitutions and replacements prior to acceptance. The ACR should be created using the on the Voluntary Product Accessibility Template Version 2.2 508 (or successor versions). The template can be located at https://www.itic.org/policy/accessibility/vpat

3. When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

4. When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

5. When developing or modifying ICT deliverables that contain the ability to automatically generate electronic documents and forms in Microsoft Office and Adobe formats, or when the capability is provided to enable end users to design and author web based electronic content (i.e. surveys, dashboards, charts, data visualizations, etc.), the Contractor shall demonstrate the ability to ensure these outputs conform to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria). The Contractor shall demonstrate conformance by conducting testing and reporting test results based on representative sample outputs. For outputs produced as Microsoft Office and Adobe PDF file formats, the Contractor shall use the test methods published under “Accessibility Tests for Documents”, which are published at https://www.dhs.gov/compliance-test-processes. For outputs produced as web based electronic content, the Contractor shall use the DHS Trusted Tester for Web Methodology Version 5.0, or successor versions. This methodology is published at https://www.dhs.gov/trusted-tester.

6. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the accessibility requirements in this work statement.

5.4 Section 508 Deliverables

1. Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions.

2. Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

3. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

4. Other Section 508 Documentation: The following documentation shall be provided upon request for ICT items offered through this contract:

· Documentation of features provided to help achieve accessibility and usability for people with disabilities.

· Documentation on how to configure and install the ICT Item to support accessibility.

· Documentation of core functions that cannot be accessed by persons with disabilities.

· Documentation of remediation plans to address non-conformance to the Section 508 standards.

6 ACRONYMS

COR – Contracting Officer’s Representative DHS - Department of Homeland Security CE - Continuing Education

7 GOVERNMENT FURNISHED RESOURCES

The Government will not furnish any resources to the Contractor in support of this contract.

The Contractor shall use Government furnished facilities, property, equipment and supplies only for the performance of work under this contract and shall be responsible for returning all Government furnished facilities, property, and equipment in good working condition, subject to normal wear and tear.

The Government will provide all necessary information, data and documents to the Contractor for work required under this contract.

The Contractor shall use Government furnished information, data and documents only for the performance of work under this contract and shall be responsible for returning all Government furnished information, data and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data and documents to outside parties without the prior and explicit consent of the Contracting Officer.

8 CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in SOW 2.0 and SOW 6.0.

9 GOVERNMENT ACCEPTANCE PERIOD

The COR will review deliverables prior to acceptance and provide the Contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying it that the deliverable has been accepted.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

The COR will have 10 business days to review deliverables and make comments. The Contractor shall have 10 business days to make corrections and redeliver.

All other review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan. The Contractor shall be responsible for timely delivery to Government personnel in the agreed-upon review chain, at each stage of the review. The Contractor shall work with personnel reviewing the deliverables to ensure that the established schedule is maintained.

10 DELIVERABLES

The Contractor shall consider items in BOLD as having mandatory due dates.

DISTRIBUTION Comment by Cantey, Tifphany: Consider delivery to Project Leads if you previously had delays in receiving deliverables by way of your post award COR

COR, Contracting Officer, Government Project Leads

APPENDIX A. General Cybersecurity Contract Requirements

A.1 In accordance with ITAR 4.5.3.1 – Compliance with DHS Security Policy Terms and Conditions.

Compliance with DHS Security Policy Terms and Conditions:

All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Policy and DHS DHS Policy Directive 4300A.

A.2 In accordance with ITAR 4.5.3.4 and ITAR 4.5.4.4 – Security Review

Security Review Terms and Conditions The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

A.3 In accordance with ITAR 4.5.3.7 – Supply Chain Risk Management

Supply Chain Risk Management Terms and Conditions The Contractors supplying the Government hardware and software shall provide the manufacturer's name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state, and/or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

(i) How risks from the supply chain will be identified;

(ii) What processes and security measures will be adopted to manage these risks to the system or system components; and

(iii) How the risks and associated security measures will be updated and monitored.

The Supply Chain Risk Management Plan shall remain current through the life of the contract or period of performance. The Supply Chain Risk Management Plan shall be provided to the Contracting Officer Representative (COR/CO) 30 days post award.

The Contractor acknowledges the Government's requirement to assess the Contractors Supply Chain Risk posture. The Contractor understands and agrees that the Government retains the right to cancel or terminate the contract, if the Government determines that continuing the contract presents a risk to national security.

The Contractor shall disclose, and the Government will consider, relevant industry standard certifications, recognitions and awards, and acknowledgments.

The Contractor shall provide only new equipment unless otherwise expressly approved, in writing, by the CO. Contractors shall provide only Original Equipment Manufacturer (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts.

The Contractor shall be excused from using new OEM (i.e. "grey market, "previously used) components only with formal Government approval. Such components shall be procured from their original source and have them shipped only from manufacturers authorized shipment points.

For software products, the contractor shall provide all OEM software updates to correct defects for the life of the product (i.e., until the “end of life"). Software updates and patches must be made available to the government for all products procured under this contract.

Contractors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill contract obligations with the Government.

All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lessor of the term of the contract, the period of performance, or one calendar year from the date the activity occurred.

These records must be readily available for inspection by any agent designated by the U.S. Government as having the authority to examine them.

This transit process shall minimize the number of times en route components undergo a change of custody and make use of tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government's request, shall be able to provide shipping status at any time during transit.

The Contractor is fully liable for all damage, deterioration, or losses incurred during shipping and handling, unless the damage, deterioration, or loss is due to the Government. The Contractor shall provide a packing slip which shall accompany each container or package with the information identifying the contract number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact. The contractor shall send a shipping notification to the intended government recipient or contracting officer. This shipping notification shall be sent electronically and will state the contract number, the order number, a description of the hardware/software being ship (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

A.4 In accordance with White House Digital Government BYODTK – Privacy Expectations

Privacy Expectations Government contractor employees do not have a right, nor should they have an expectation, of privacy while using Government provided devices at any time, including accessing the Internet and using e-mail and voice communications. To the extent that employees wish that their private activities remain private, they should avoid using the Government provided device for limited personal use. By acceptance of the government provided device, employees imply their consent to disclosing and/or monitoring of device usage, including the contents of any files or information maintained or passed -through that device. Comment by Moulder, Lauren: Should this be included only if deemed a CUI Request?

Is TRAIN considered ATO? Comment by Klueter, David: This should be included in all procurements. Contractors need to know that anything they do with GFE can be monitored.

A.5 In accordance with HSAR Class Deviation 15-01, REV 1, SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)

3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7)…