07_USDA Special Events and Conference Support PWS_v4.docx

US Department of Agriculture (USDA)

Performance Work Statement (PWS)

Contents

Project Title United States Department of Agriculture (USDA) Special Events and Conference Support Services

General Information

1.0 Background and Purpose

1.1 Background

The United States Department of Agriculture (USDA) provides leadership on food, agriculture, natural resources, rural development, nutrition, related issues based on sound public policy, and the best available science, and efficient management.

USDA expands economic opportunity through innovation, helping rural America to thrive; promotes agriculture production sustainability that better nourishes Americans while also helping feed others throughout the world; and preserves and conserves our Nation's natural resources through restored forests, improved watersheds, and healthy private working lands.

USDA is comprised of Departmental Management (DM) offices, Mission Areas (MA) and Agencies with employees located throughout the Continental United States (CONUS) and Outside CONUS (OCONUS). USDA Departmental Administration (DA) provides centralized operational support, policy guidance, and administrative oversight for all USDA agencies and offices. DA ensures that USDA’s workforce, financial operations, IT infrastructure, and procurement processes run efficiently and in compliance with federal regulations.

DA Key Areas of Focus include:

· Procurement & Contracting: Manages USDA acquisitions, vendor engagement, and small business contracting opportunities

· Human Resources & Workforce Management: Oversees hiring, diversity initiatives, and employee benefits across USDA

· Information Technology & Cybersecurity: Supports USDA’s IT modernization, cloud computing, and data security

· Facilities & Property Management: Maintains USDA offices, leases, and sustainability initiatives

· Civil Rights & Equal Employment Compliance: Ensures fair hiring practices and workplace diversity at USDA

· Enterprise Risk Management & Financial Oversight: Monitors USDA’s financial policies, internal controls, and fraud prevention efforts

More information about DA to include its mission, vision, and core values can be found here - https://ingovcon.com/the-govcon-guide-to-federal-agencies/usda-departmental-administration-da-a-guide-for-new-government-contractors/

1.2 Purpose

The primary purpose of this commercial services contract is to establish a nation-wide, multiple award Blanket Purchase Agreement (BPA) to acquire turn-key event production support services for special events and conferences hosted by the Department in accordance with Federal Acquisition Regulation (FAR) 8.405-3, for the services described in this Performance Work Statement (PWS). This BPA will utilize Contractor on ramping utilizing original solicitation requirement and off ramping in accordance with FAR 52.249-2, Termination for the Convenience of the Government when required under this contract. A minimum of two awards is anticipated. However, the Government reserves the right to make additional awards, as necessary.

For Call Orders issued under this BPA, the vendor shall be responsible for designing and coordinating the decor/scenic elements, the production gear needed, the on-site management of vendors or subcontractors, liaising between the USDA, the National Park Service, and other federal and non-federal partners, the guest flow and experience, the registration, credentialing, and press operation, and a program’s run of show.

Services provided under this BPA shall utilize agile program management methodologies including industry-recognized best practices recognized under the Project Management Institute (PMI) framework and the Program Management Improvement Accountability Act (PMIAA). Services provided by the Contractor(s) under this BPA shall be secured by issuance of a Call Order (Call). BPA Calls shall be placed In Accordance With (IAW) the ordering procedures outlined and governed by the FAR 8.405-3 (for BPA’s established in Federal Supply Schedules). USDA estimates, but does not guarantee, that the volume of the purchases through this BPA may be up to $9.9M per year or approximately $49.5 million over the life of the BPA. There is no required minimum guarantee, or maximum ceiling to perform the requirements of PWS.

Contractors must make clear their ability to meet the Government’s “Definition of Done” in their proposal. Upon award, the Contractor shall provide all management, supervision, labor, supplies, licenses, certifications, materials, transportation, equipment (except as otherwise specified herein), and plan, schedule, and coordinate, as necessary, to ensure the effective performance of services in accordance with the Terms and Conditions of this BPA.

This PWS outlines the general services provided by contractors under the Special Event and Conference Support Services BPA. Specific details of task assignments, deliverables, documentation, applicable government/department standards, and other supporting information, will be provided at the Call Order level.

1.3 Special Events and Conferences Scope

Under the direction of the USDA Contracting Officer’s Representative (COR) and other key Government stakeholders, the Contractors on this schedule can provide a wide range of event planning support, including:

· Event and project management

· Site selection and facility reservations

· Audiovisual and Information Technology (IT) support

· Promotion and marketing

· On-site registration support

· Coordination with third-party participants

· No-cost contracting: Some task orders can be structured as "no-cost contracts" for the Government. In this case, the Contractor covers all costs in exchange for collecting registration, sponsorship, or exhibition fees

1.4 Period of Performance

The anticipated BPA period of performance for the requirements of this PWS is one (1) base period of one (1) year with four (4) one (1) year option periods. Below is a projected summary:

Base Period: One Year (12 months) from time of award Option Period 1: 12 months from the end of the base period Option Period 2: 12 months from the end of Option Period 1 Option Period 3: 12 months from the end of Option Period 2 Option Period 4: 12 months from the end of Option Period 3

1.5 Place of Performance

The BPA will be a nation-wide BPA. After the BPA is established, the place of performance will then be established at the individual Call level.

2.0 Definitions

Contractor Requirements

3.0 Technical Requirements / Tasks

This is for non-personal services meaning the personnel rendering the services are not subject to the supervision and control usually prevailing in relationships between the Government and its employees.

The primary objective is to obtain turn-key event production support services for special events and conferences. In performance of duties of this BPA, the Contractor shall ensure that all activities and tasks are conducted with professionalism and in accordance with the requirements established in this PWS. All other terms and conditions of the BPA apply this requirement.

Upon BPA award, the Contractor shall coordinate and host an “orientation meeting” with the BPA COR either in-person or by virtual means such as Microsoft Teams as agreed upon between COR and Contractor. The meeting shall be attended by the Contractor and all relevant key personnel to discuss the implementation of the Contractor’s proposal and to ensure an understanding of the requirement. The COR and the Contractor shall collaborate on the planning of the overall project to include the approach, methodology, and prior work performed relevant to this BPA. The Contractor shall prepare and provide the meeting agenda one day in advance and identify primary Contractor points of contact, project overview, and a high-level schedule of deliverables. Deliverable format will be identified in each Call Order solicitation.

In performance of the task area duties of this BPA, the Contractor shall provide all necessary staffing supplies and ancillary services (except for those to be furnished by the Government as may be specified elsewhere in the contract) to perform the work required by the BPA as set forth below.

3.1 Task 1 – Kickoff Meeting

Within five (5) days of a Call Order award, the Contractor shall coordinate and host a Kickoff Meeting (this is different than the BPA orientation meeting) either in-person or by virtual means such as Microsoft Teams as agreed upon between the Call COR and Contractor. The Contractor shall provide the meeting agenda one day in advance and identify primary Contractor points of contact, project overview, and a high-level schedule of deliverables. The meeting shall be attended by the Contractor and all relevant key personnel to discuss the implementation of the Contractor’s proposal and to ensure an understanding of the requirement. The Contractor shall prepare the Kickoff Meeting Agenda. The COR and the Contractor shall collaborate on the planning of the overall project to include the approach, methodology, and prior work performed relevant to the Call Order. The project initiation includes onboarding of support Contractor personnel, and review and update of project management plans and schedules for the effort.

Key activities include, but are not limited to:

1. Onboarding Contractor personnel (i.e., initiation of the background investigation process, signing disclosure statements, assignment of escorts, review of the performance plan, etc.).

1. The Contractor shall provide a Quality Control Plan (QCP) for each Call based on the performance standards, which focuses on the quality, quantity, timeliness, etc. of the performance outputs to be delivered by the Contractor, but not on the steps required or procedures used to provide the services. Due at Kickoff Meeting.

1. The Contractor shall collaborate with the Call COR on the process for drafting, reviewing, finalizing, and delivering reports, meeting notes, and presentations as required.

1. The Contractor shall prepare and submit a transition in/out plan to the Call COR that enables the smooth transition of performance on the work requirements from one Contractor to another (or to the Government) which includes but is not limited to the hiring of new personnel. Additionally, the transition plan shall include milestones, risk analysis, mitigation strategies, and any other factor needed to ensure the work is properly transitioned from one Contractor to the next. Due at Kickoff Meeting.

1. The Contractor shall prepare and provide Kickoff meeting minutes not later than (NLT) five (5) business days of meeting.

3.2 Task 2 - General Project Management

For each Call Order, the Contractor shall provide logistical and service support for special events, conferences, meetings, seminars, and workshops held in the United States and/or overseas which shall include the following.

3.2.1 Project Management

The Contractor shall designate a team lead responsible for Project Management (PM) duties necessary to perform the requirements of each Call made under this BPA. The Contractor shall:

1. Provide a project management plan within fifteen (15) business days of award and final within one (1) month in a format agreed upon by the Call COR and PM and organized by task, that contains details about how the work is going to be performed, including methods, work breakdown structures (WBS), timelines (project schedules), and milestones. Task dependencies on the Government may be provided at this time

2. Develop an Event Master Plan within fifteen (15) days of award which includes comprehensive operations & production plans that match the Contractor’s vision for guest, speaker, and VIP experiences

3. Serve as the primary liaison between the Contractor’s team and all event stakeholders

4. Ensure all personnel have appropriate training and equipment and resources to provide the required support

5. Oversee on-site management team and associated staffing

6. Ensure that all deliverables for all tasks are complete, accurate, delivered according to established schedules to the Government for review, comment, and acceptance, and comply with all applicable federal regulations

7. Facilitate a collaborative communication process to meet the goals and expectations of the customer agency

8. Proactively identify and resolve issues and bottlenecks that may impact project timelines

9. Provide timely and accurate progress updates to project stakeholders

10. Coordinate and participate in a BPA Call Order kickoff meeting between the Contractor and the Call COR.

11. Provide final event report No Later Than (NLT) 45 after event completion

12. Prepare and submit a Monthly Status Report (MSR) with the monthly invoice NLT the fifth business day of each new month for previous month

13. Prepare and submit a lessons learned report annually within 30 days after the end of the calendar year

14. Manage pre-production operations, including a coordinated schedule of planning meetings to cover operational responsibilities, creative design, show execution & other components as requested

15. Facilitate travel management support where and when applicable

3.2.2 On-Site Management Team

The vendor shall provide an on-site management team to manage and conduct necessary support requirements in each of the following areas:

· Project Oversight

· Experienced team of production and operations professionals, including a dedicated project manager overseeing all event operations

· Operations Team

· Operations Director, Operations Managers, and Press Team

· Technical Team

· Technical Director, along with Audio, Lighting, and Video Technicians

· Production Crew

· Crew Lead and Scenic Team

3.2.3 Audio and Visual Production

The vendor shall provide support services for each of the following areas:

· Management of all event production components provided

· Coordination of production schedule for load-in & load-out

· Coordination and exactions of rigging, labor, heavy equipment, insurance requirements, etc.

3.2.4 Event Security and Grounds Support

· The Contractor shall provide event and overnight security personnel, where applicable, for the event location throughout the event as outlined in each Call Order solicitation

· The Contractor shall provide event site trash collection, removal, and final disposition support during the event

3.2.5 Management and Space Allocation

The vendor shall provide support services for each of the following areas:

· Serve as the primary point of contact for all purposes regarding event management, production, and space allocation

· Develop space allocation maps and site diagrams

· Coordination on power, internet and special equipment availability, as needed

3.2.6 Principal Management

The vendor shall provide support services for each of the following areas:

· Principal operations include the logistical coordination of keynote speakers, hos leadership, special guest attendees, and other individuals who require an elevated level of operational support. This includes security, security management, or technical requirements to support their participation in an event

· The Contractor shall serve as an extension of the customer agency’s team to act as the main point of contact for principal operations. Principal operations teams may consist of lead, press lead, site operations manager, guest operations manager, production manager. Specialty leads will need to support areas such as executive protection, volunteer management, merchandise sales, photography, videography, etc.

Note: The Contractor shall pay all upfront charges (e.g., the Contractor will be responsible for funding the reservation of conference space, equipment rentals, and/or third-party service agreements after the required approvals have been obtained.

3.3 Task 3 – Communications Support

The Contractor shall design and execute the full range of comprehensive communication efforts targeted to specific audiences in support of agency outreach which shall include the following.

3.3.1 Event Branding/Messaging

· Coordination of LED screens and branding installations placed in the vendor areas such as the National Mall or other indoor/outdoor event space identified in each Call Order which could highlight the USDA and the intended objective of the special event or conference

· Creating custom-fabricated pieces to be utilized on stage, around tents and entrances, and on USDA building(s) to add elevated branding to events, conferences, and associated performances

· Branding shall be designed to highlight sponsors and vendors for each event, policy initiatives, etc.

· Management of the design and fabrication of custom branding installations

· Coordination of the creative process for all décor installations throughout the venue

· Consultation on creative concepts and best practices

· Vendor sourcing, schedule coordination, and installation oversight

3.3.2 Press Operations

· Oversight of the technical and operational requirements associated with press coverage of the event.

· Coordination of photography & videography teams

· Assisting in the identification and analysis of media markets and outlets

· Under the direction of the USDA COR and other key Government stakeholders, vetting of registered press lists to optimize coverage if desired

3.3.3 Materials Development

· Writing and editorial services, including:

· Writing, proofreading, revising, copy editing, technical editing, and expert-level editing in support of the development and production of high-quality speeches, talking points, fact sheets, publications, and special event or conference materials required by USDA

· Conducting thorough research, analyzing audiences, adapting a speaker's voice and message to target audiences, structuring content for oral delivery, and collaborating with stakeholders to develop supporting materials

· Assisting speakers with the delivery of a speech or presentation, offering guidance on pacing, body language, and vocal variety

· Integrating visual aids or PowerPoint presentations to supplement the presentation or speech

Note: All materials/deliverables developed under this task area will become the property of the U.S. Government upon delivery, acceptance, and no later than at the conclusion of each Call Order.

3.4 Task 4 – Transition In/Out

The Contractor shall prepare and present a transition-in plan and a transition-out plan at the kickoff meeting that describes how the Contractor shall prepare for and transition into and out of the current services when the contract begins and ends. The COR will provide information on whether services will transition to the Government or a new contract award to ensure that the Contractor plans appropriately. The team leader shall execute the transition-in plan during the transition period, which will be thirty (30) days in duration. The transition-out plan must be completed 60 days prior to the end of the contract and executed during the last thirty (30) days of the contract. The Contractor shall demonstrate collaboration, cooperation, and communication throughout the transition-in process, prioritizing the stability, functioning, and success of the Government.

Onboarding and knowledge transfer are necessary activities to ensure continuity of the program delivery for the Government and to prepare the incoming Contractor for full performance. During transition in, the focus is on knowledge transfer to understand the existing and expected environments.

Government onboarding may begin immediately upon Call Order award. The Government onboarding process with expected timeframes is included within Attachment A – Onboarding Process. Incoming contract resources may begin interacting with the Government and incumbent personnel for knowledge transfer upon receipt of the Security Initial Determination (SID).

Incumbent Contractors may continue to work under an existing Security Initial Determination SID while they are undergoing the onboarding process for receiving a new SID under their new contract number. Onboarding packages need to be submitted as soon as possible, with an initial turn-around target of four (4) business days after each Contractor personnel receives the packet from Government personnel.

Due to the large volume of current and expected onboarding requests, the estimated average time to complete the onboarding process is at least six (6) to eight (8) weeks. The timeframe to obtain a SID varies based on several factors. No other Government personnel are privy to reasoning behind an unfavorable SID from Homeland Security Division (HSD).

Key transition activities include, but are not limited to:

1. Identification of all services to be transferred in or out, and actions that shall be taken to make these transfers

2. Describe how knowledge shall be transferred to new personnel, including identification of where knowledge resides.

3. A repository of all reports, testing results, technical and business requirement documentation, etc.

4. Issuance and return of Government Furnished Equipment (GFE)

5. Identification of the status of ongoing efforts

6. Coordination and communication efforts to ensure an effective transition both in and out

7. Describe the transition of for all working applications

3.5 Task 5 – Ad Hoc Support Services

The delivery of services under this BPA is not limited to the current environment. There is the potential that in addition to the work related to this requirement, additional support services may be needed. If additional support is required, the Contractor shall provide support for optional additional projects, if needed. The Contractor shall provide the following additional support services:

Performance Objectives Key activities include, but are not limited to:

1. Providing reliable surge support as needed

0. Surge work shall be approved by the CO prior to commencement of work via a funded modification

4.0 Deliverable / Schedule

For active Call Orders, the Contractor shall be expected to submit the key deliverables outlined in the table below. After the BPA is established, specific deliverables will be identified in the Request for Quotation (RFQ) for each Call Order.

Table 1 (Key Deliverables)

See Section 3.2.1.1

See Section 3.2.1.2

See Section 3.2.1.11

See Section 3.2.1.12

See Section 3.2.1.12

See Section 3.2.1.13

4.1 Delivery Method

Electronic copies of deliverables shall be delivered using Adobe PDF format or Microsoft Office Suite 2007 or higher (e.g., MS Word, MS Excel, MS PowerPoint, MS Project, or MS Access format), unless otherwise specified by the COR. Electronic submission shall be made via email, unless otherwise agreed to by the COR.

4.2 Inspection and Acceptance

The Government will perform Inspection and Quality Assurance in accordance with the contract Quality Assurance Surveillance Plan (QASP). This is not the same as the Contractor’s QCP. The Government has the right to perform periodic surveillance of the Contractor to ensure that the Contractor’s work products and Quality Control processes are in compliance with the contract requirements. The Government and the Contractor will coordinate Government surveillance in a manner that will not unduly delay or disrupt the Contractor’s performance of the contract.

The COR will have ten (10) business days to review draft deliverables and make comments. The Contractor will have ten (10) business days to make corrections. Upon receipt of the final deliverables, the COR will have five (5) business days for final review prior to acceptance or providing documented reasons for non-acceptance. Should the Government fail to complete the review within the review period the deliverable will become acceptable by default.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor shall have five (5) business days to correct the rejected deliverable and return it per delivery instructions.

5.0 Government Furnished

When required, the Government will provide the Contractor with the following:

· Access to Government computers with appropriate VPN access capability and standard office software (Microsoft 365)

· Desk space with typical office space amenities

· Government email address

· USDA LincPass (HSPD-12 PIV card) contingent upon the Contractor personnel passing background requirements. This PIV card will be used in the Government furnished computer to access the USDA network to perform contract requirements

6.0 Travel

Travel may be required for the individual(s) providing support. Travel (within fifty (50) miles of the Contractor’s facilities) shall not be reimbursed. COR approval is required prior to the Contractor holding meetings with Government staff. The COR reserves the right to approve the number of Contractor staff traveling. A separate CLIN shall be proposed for anticipated travel. Travel will be reimbursed in accordance with the Federal Travel Regulation (FTR).

7.0 Contractor’s Key Personnel

The Contractor shall designate an overall BPA Program Manager and one of its staff as key personnel for each Call awarded, specifically an onsite team lead, to perform overall management duties of its personnel. The team leader shall have extensive knowledge and competence in event production support services.

Prior to the replacement of any individual designated as Key Personnel by the Client, the Contractor shall notify the CO fifteen (15) business days in advance of the off-boarding or within two (2) business days of the individual notifying the Contractor of their resignation from the organization – providing the Government with sufficient notice to process off-boarding requirements, submit written justification for the replacement and provide the name and qualification of any proposed substitute. All proposed substitutes shall possess qualifications equal to or superior to those of the Key Personnel as described below.

Key personnel shall have a minimum of 7-10 years of experience in even production support services.

The team leader shall be available to the COR and CO via telephone between the core hours of 9:00 a.m. to 3:00 p.m. CTZ Mondays through Fridays and shall respond to a request for discussion or resolutions of technical problems within twenty-four (24) hour notification.

8.0 Security Requirements

After the BPA is established, the CO and COR will ensure that personnel security screening requirements for Contractor employees are included in all solicitations and Call Orders issued by USDA where applicable. Security requirements at the Call Order Level may include, but are not limited to the below.

8.1 General Procedures

Personnel employed by the Contractor or any representative of, or agent of the Contractor, entering a Government facility shall conform to the facility security requirements. The Contractor shall provide all information required for background checks to meet facility access requirements as performed by the facility security office. Contractor personnel shall comply with all personal identity verification requirements as directed by the USDA Security office. Each person accessing the site will be required to provide personal details, (full name, date of birth (DOB), social security number (SSN), Government issued identification) and will undergo a routine background check, such as a National Agency Check with Inquiries (NACI) , which may include a criminal and credit check.

Details required for the check should be submitted to the security office NLT five (5) days prior to the visit. Results of this check may return earlier. However, it should not be planned to have results earlier than five (5) days. If, while on site the contractor/vendor will have access to sensitive information, they must complete a National Disclosure Agreement (NDA), along with the required training. This training will most likely be completed by reviewing a series of slides or other training delivery methods covering the topics of the definition of controlled unclassified information (CUI), access, handling, distribution, storage, and destruction of CUI. Each person will acknowledge receiving and understanding the training on the NDA. The process should not exceed two (2) hours. Acknowledgement and completion of the NDA will be turned in with the form required for the background check. Results will be returned through the CO or COR. Contractors need to follow Title 41, Code of Federal Regulations, Part 102-74, Subpart C Rules, and Regulation Governing Conduct on Federal Property.

Additional security requirements may be imposed when the Federal Government raises the Homeland Security Alert Level. Additional directions will be provided if the situation occurs.

The Contractor shall safeguard all USDA equipment, information and property provided for Contractor use. At the close of each work period, USDA facilities, equipment, and materials shall be secured.

8.2 Information Security Incidents

An Information Security Incident is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government systems or information, including, but not limited to, Sensitive Information.

8.2.1 Information Security Incident Reporting Requirements

All Information Security Incidents must be reported in accordance with the requirements below, even if it is believed the Incident may be limited, small, or insignificant.

a) The Contractor must report all Information Security Incidents immediately, but NLT 30 minutes after becoming aware of the Incident.

b) Copy the COR if possible, or if COR email is not immediately available; contact the COR immediately after reporting the incident.

c) Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

8.2.2 Information Security Incident Response Requirements

a) All determinations related to Information Security Incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) must be made by authorized USDA officials.

b) The Contractor must provide full access and cooperation for all activities (determined by the authorized Government official to be required) to ensure an effective Incident Response, including providing all requested images, log files, and event information to facilitate rapid resolution of Information Security Incidents.

c) Incident Response activities determined to be required may include, but are not limited to inspections, investigations, forensic reviews, data analyses & processing, and final determinations of responsibility for the Incident and/or liability for any additional Response activities.

d) USDA, at its sole discretion, may obtain the assistance of Federal agencies and/or third-party firms to aid in Incident Response activities.

8.3 Information Types

The term Information is synonymous with Data, regardless of format or medium. Personally Identifiable Information (PII) is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of Sensitive Information. All requirements for Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII.

8.3.1 Sensitive Information

Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government’s interests. Sensitive Information is subject to stricter handling requirements because of the increased risk if the data is compromised. Some categories of Sensitive Information include Financial, Medical/Health, Legal, Strategic, Security, Intellectual Property & Business, Human Resources, Personally Identifiable Information (PII), and Sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

8.3.2 Personally Identifiable Information (PII)

PII, as defined in OMB Memorandum M-07-16, refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important to recognize that non-PII can become PII whenever additional information [that is publicly available] — in any medium and from any source — is or can be combined to identify an individual. As an example, PII includes a name and an address because it uniquely identifies an individual but alone may not constitute Sensitive PII.

8.3.3 Sensitive PII

Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling because of the increased risk to an individual or associates if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Social Security numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), is also considered Sensitive PII. In addition, the context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or complaint.

8.4 Compliance with Security IT Policies

Information systems and system services provided by the Contractor must comply with the current USDA IT security and privacy policies, specifically the 3500 – 3599 Cyber Security Department regulations - https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories.

The Contractor is required to comply with current federal regulations and guidance found in the Federal Information Security Modernization act of 2014 (FISMA); Privacy Act of 1974; E-Government Act of 2002, Section 208; National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and the 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise Patch Management Technologies; Office of Management and Budget (OMB) memoranda; USDA Information Security Program policies and other relevant Federal laws and regulations with which USDA must comply.

House Resolution 83-15 “Consolidated and Further Continuing Appropriations Act, 2015” requires that USDA demonstrate each project/investment is “being managed in accordance with applicable lifecycle management policies and guidance.” This mandates that USDA development projects are required to follow the Agency’s System Development Lifecycle (SDLC). All projects listed in Farm Service Agency Farm Programs IT plan for expenditure can expect to be audited for compliance. Audits may occur at any time after the plan for expenditure is submitted to Congress.

The Contractor must protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational client software are exposed. If new vulnerabilities are identified after the acceptance of COTS software, the vendor shall review and remediate the vulnerabilities and present the results for Government approval within the timeframes documented in USDA IT security policies.

8.5 Security Assessment and Authorization

a) This contract requires the Contractor to develop, deploy, and/or use information systems to access and/or store Government information, including Sensitive Information. The Contractor must cooperate and support the Government in the development of required documentation and artifacts.

b) All information systems that input, store, process, and/or output Government information must be provided with an Authority to Operate (ATO) signed by the authorizing official as identified by the Chief Information Officer (CIO). The Contractor must adhere to current policies, procedures, and guidance for security Assessment and Authorization (A&A) activities.

8.6 Federal Reporting Requirements

Contractors operating information systems must comply with Federal Information Security Modernization Act (FISMA) reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors must provide the Government with the requested information based on the timeframes provided with each request. Reporting requirements are determined by the Office of Management and Budget (OMB) and may change each reporting period. The Contractor must provide the Government with all information to fully satisfy FISMA reporting requirements for Contractor systems.

8.7 Processing, Storing, Transmitting Government Data to Non-Government System The Contractor or other external organizations must develop, provide, implement, and maintain an IT System Security Plan for any system that includes acquisition, transmission or analysis of data owned by the Government with significant replacement cost should the Contractor’s and other external organization’s copy be corrupted. This plan must describe the processes and procedures that must be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan must describe those parts of the contract to which this clause applies. The Contractor or other external organization’s IT System Security Plan must be compliant with applicable Federal laws that include, but are not limited to: (e.g., the Clinger-Cohen Act of 1996 and the Federal Information Security Management Act of 2002). The IT System Security Plan must meet IT security requirements in accordance with Government policies and procedures that include but are not limited to: National Institute of Standards and Technology (NIST) SP 800-53 Guidelines.

The Contractor and other external organizations must ensure that the appropriate security banners are displayed on all Government systems (both public and private) operated by the Contractors and other external organizations prior to allowing anyone access to the system.

8.8 Personnel

8.8.1 Personnel Security

The following Background Investigation Requirements apply to this contract. Contractor personnel must be able to obtain a favorable suitability decision in accordance with 5 CFR part 731. The duties of this contract range from low-risk to high-risk positions and, as such, Contractor personnel will be required to submit all required documentation necessary for the agency to provide a favorable preliminary decision on suitability. This decision is required prior to commencing work on the contract. Contractor personnel who receive an unfavorable suitability decision must be immediately removed from consideration for work on the contract.

The Contractor is accountable for selecting personnel capable of receiving favorable suitability determinations; consequences for advancing personnel not able to pass Government background checks may include providing invoice credits effectively reimbursing the Government for background check expenses. Performance delays or detrimental project outcomes due to not onboarding or removal of staff will be directly attributed to the vendor and documented.

8.8.2 HSPD-12 - Credentials

Contractor personnel must complete necessary requirements to obtain HSPD-12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD-12 credentials is grounds for removal/suspension of Contractor personnel from the contract.

8.8.3 Conduct and Removal

While performing the work under this contract, Contractor Agents must comply with applicable contract terms, State and Federal rules, regulations, policies, and requests regarding personal and professional conduct; and otherwise conduct themselves in a businesslike and professional manner. If USDA determines in good faith that a particular Contractor Agent is not conducting himself or herself in accordance with the terms of the Contract, USDA may provide Contractor with notice and documentation regarding its concerns.

Upon receipt of such notice, the Contractor must promptly investigate the matter and at USDA‘s election, take appropriate action that may include removing the Contractor Agent from performing and work under the contract and replacing the Contractor Agent with a similarly qualified individual acceptable to USDA as soon as reasonably practicable or as otherwise agreed to by USDA.

9.0 Data Rights

9.1 Data Collected, Generated or Managed

The Contractor shall be responsible for properly protecting all information used, gathered, or developed because of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor's other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

The Contractor will cooperate with federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of USDA information. Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements and rendering other assistance as deemed necessary.

All work performed under this task will be the exclusive property of the Government free from restrictions or claims of intellectual property of the Contractor.

9.2 Privacy Act

The Contractor Agrees To –

Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

· The systems of records; and

· The design, development, or operation work that the Contractor is to perform;

· Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

· Include this clause, including this paragraph, in all subcontracts awarded under this contract, which require the design, development, or operation of such a system of records.

· In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

· Definitions of the clause:

· “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

· “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

9.3 Confidentiality and Non-Disclosure

Any USDA proprietary information, data, and/or equipment that the Contractor has been granted access by USDA to perform work under this order, will be returned to the USDA when no longer required to perform work under this order. The public release of USDA proprietary information must be authorized in writing by the CO.

The component parts of this effort and reports are expected to contain highly sensitive information that may act as a guide for hostile entities to cause harm to the Department’s critical infrastructure. Any such information made available in any format shall be used only for the purpose of carrying out the provisions of this agreement. Such information shall not be divulged or made known in any manner to any person.

The Contractor shall immediately notify the Contractor Program Manager, the Contractor on-site Manager, the COR, the Government Technical Program Manager (TPM) and the CO upon discovery of any inadvertent disclosures of information.

The Contractor shall not retain any information regarding vulnerabilities, to include summaries, the actual vulnerability report, etc., at the end of the task order. All information arising from this task, both hard copy and electronic, shall be returned to the COR and Government TPM at task completion.

The component parts of this effort and reports are expected to contain highly sensitive information that may act as a guide for hostile entities to cause harm to the Department’s critical infrastructure.