PHC - New Housing Construction

SOLICITATION:  70FBR920R0000007

1.    Background

On October 24, 2018, Super Typhoon Yutu, the strongest typhoon to impact the Commonwealth of Northern Marianas Islands (CNMI) on record caused catastrophic damage to the islands of Saipan and Tinian. Super Typhoon Yutu caused three deaths, downed power poles and damaged vehicles, schools, hotels, businesses, airports and hundreds of homes on both islands.  

The U.S. President signed a Disaster Declaration on October 26, 2018, making funds available to the Federal Emergency Management Agency (FEMA), to provide disaster assistance to eligible applicants on Rota, Saipan and Tinian.  Approved assistance included Stafford Act Section 408 authorizing the Individuals and Households Program.  Additionally, pursuant to Stafford Act Section 408 and 44 C.F.R. 206.117(b)(4), Permanent Housing Construction (PHC) was also authorized for FEMA-DR-4404-MP.  Accordingly, the Office of Response and Recovery (ORR), Recovery Directorate is seeking to replace eligible applicant’s housing affected by the disaster through the PHC program.  

2. General Scope of Work

The purpose of this procurement is to acquire construction services to construct eligible PHC applicants’ dwellings for FEMA-DR-4404-MP in accordance with applicable Federal, State, and Local laws, building codes and standards.  The contractor shall utilize the architectural and engineering (A&E) drawings listed as Attachments 08(a) thru 08(d).  A&E drawings are designed for a 1, 2, and 3- bedroom home under the PHC New Construction requirement.  The A&E drawings are intended for cast-in-place units (CIP); however, the Government will consider concrete masonry (2-cell Kerf block) units (CMU) as an alternative.  Should the Government determine that CMU is the more viable option rather than CIP, the Government will make that determination prior to award. 

PHC shall be performed by a licensed contractor with the appropriate authorization(s) to work in the CNMI and more specifically Saipan and Tinian.  The contractor shall provide all supervision, materials, permits, licenses, equipment and labor categories necessary to perform new construction as determined via this statement of work and attached documents.  In accordance with FAR clause 52.225-1, the contractor is required to adhere to the Buy American Act (BAA) using BAA compliant construction materials, of average quality for the lowest price (“builder grade”), for the prescribed International Building Code (IBC) level determined for the PHC New Construction Program.  The contractor is required to employ at a minimum 30% local labor, to the greatest extent practicable.  

1. Tasks
   1. 1. The contractor shall utilize the A&E drawings to develop a technical proposal for Option 1) CIP, or if necessary, Option 2) CMU (as applicable).  Both options are for the construction of a 1, 2, and 3-bedroom homes located in Saipan and Tinian.  The contractor shall not deviate from the government provided drawings without approved revisions.

PERMANENT HOUSING NEW CONSTRUCTION (PHC)

STATEMENT OF WORK (SOW) TASK ORDER:  70FBR920F00000XXX

1. 1. 1. The contractor shall obtain all required permits and comply with all applicable CNMI and/or EHP laws and building codes (as applicable).  The Government anticipates that the contractor will perform new construction on 20 homes with an option.  For this task order, the Government is providing an initial batch of 20 PHC homes.  The Government expects the contractor to complete each work order according to the agreed upon site specific timeline beginning from the date of issuance of the notice to proceed.    
      2. Each home to be constructed will have an associated work order and architectural/engineering drawings for the home authorized for construction at that particular site. The contractor shall conduct site visits to develop a site plan to include all utilities as part of the price proposal, work plan and timeline for completion for each site.
      3. Construction Standards:  The contractor shall ensure compliance with 2018 IBC standards.  The contractor shall be responsible for presenting to the FEMA Contracting Officer (CO) detailed cost estimates for construction utilizing CIP construction and any instance that may require CMU construction.  Also, a separate submittal to include site plans/drawings (if needed) containing required approvals from appropriate authorities in order to meet the required minimum standards referenced herein.  The contractor shall assess utilities as designated in the the attached drawings and based on the Specifications.  The contractor shall utilize preexisting sanitary (sewer) systems, and only in the event a septic tank needs repair, replacement or installation; the contractor shall submit a Request for Information to the FEMA COR for FEMA’s review and approval prior to any actions by the contractor.
      4. The PHC new construction program is subject to CNMI regulations including, but not limited to, CMC Title 155-10.1, Building Safety Code Rules and Regulations. Title 155 -10.1 stipulates procedures and requirements enforced by the Department of Public Works (DPW) related to the safe operation of buildings.  DPW reviews and approves housing and commercial applications for permits prior to construction.  Permit applications require plans that are signed and sealed by CNMI professionals.  The Government furnished A&E plans developed by US Army Corps of Engineers (USACE) for FEMA are exempt from being sealed because they are Government prepared and are developed for Government use, so long as they are not modified.
      5. The contractor shall follow the attached specification, the drawings and this statement of work.  If there are any discrepancies between the specifications, drawings and/or statement of work; the contractor shall submit a request for information to the FEMA COR for clarification.

Specifically, CMC Title 155-10.1 addresses the following: 

• • New construction and modification of existing buildings
  • Permit process and fees (initial application)
  • Rough in inspections/re-inspections (and associated fees)
  • Final inspection and Issuance of Certificates of Occupancy (CoO)
  • Adoption of Tropical Energy Code
  • http://www.cnmilaw.org/pdf/admincode/T155/T155-10.1.pdf

Other pertinent CNMI Regulations include:

• • Title 65 – Division of Environmental Quality
  • Chapter 30 - Earthmoving and Erosion Control
  • Chapter 120 - Wastewater Treatment and Disposal Rules and Regulations
  • Title 15 – Coastal Resources Management
  • Chapter            10        -           Coastal            Resource         Management   Rules   and      Regulation

Environmental/Historical preservation requirements

Pertinent Federal Regulations and codes include:

1. • International Building Code (FEMA has herein provided project specific IBC guidance that exceeds local requirements for high wind and flooding hazards)
   • Seismic Zone 4
   • 2010 ADA Standards for Accessible Design
   • 40 C.F.R. Part 122 National Pollutant Discharge System (stormwater permits)
   • Floodplain Management
2. Contractor Furnished Items & Services:
   1. The contractor shall furnish all management resources, labor, materials, equipment, tools and any other items necessary to perform all operations.
   2. The contractor shall meet all logistical and administrative requirements for acquiring, mobilizing, and sustaining necessary laborers, including laborers in skilled trades.  The contractor must obtain all required building materials, vehicles, specialized equipment, and provide a fully qualified Project Manager who shall be responsible for the performance of work. The name of the person designated as the Project Manager, in addition to an alternate Project Manager shall be designated in writing and provided to the CO. The Project Manager shall have full authority to act for the contractor. The Project Manager shall be on-site in Saipan, MP during normal work hours and available for contingencies requiring work beyond normal work hours (as instructed by the FEMA COR and/or CO. The designated Project Manager shall have written and verbal communications skills in English, and it is encouraged that the Project Manager position have Chamorro as a secondary language; however, this is not a requirement.  The CO shall have the right to determine whether the proposed contractor key personnel have the education, technical and lingual capabilities to meet the requirements outlined for this requirement to include attachments.  The CO reserves the right to remove any contractor staff who has been deem unacceptable to the Government upon written notification.

PERMANENT HOUSING NEW CONSTRUCTION (PHC) 

STATEMENT OF WORK (SOW) TASK ORDER:  70FBR920F00000XXX

1. Special Requirements:
   • The contractor shall establish its base of operations and management team on Saipan, MP to ensure close coordination with FEMA.
   • The contractor shall participate in at least one (1) weekly coordination meetings with the FEMA COR and/or CO.  Other FEMA personnel may be invited on an as needed basis. 
   • Upon completion of construction of a PHC home, the contractor shall ensure the following before requesting final certification of occupancy: site is clear of all debris, hazards and machinery; all disturbed earth from construction activities has been remediated (fill and grade) to existing grade; the interior is clean from construction materials/activities; and the home is load tested and ready for occupancy before requesting the final certification of occupancy from the CNMI permitting office. 
   • In the event construction items have not conformed to the contract requirements, the contractor and FEMA COR will develop a punch list to work from in order to meet the contract requirement.  
   • When directed by FEMA CO/COR, the contractor shall include construction of any accessibility features and accessible routes in accordance with the Americans with

Disabilities Act Accessibility Guidelines (ADAAG) (http://www.statereview.com/adaag.htm) and the Housing and Urban Development’s (HUD) Design Details for Accessible Disaster Relief Housing.

• • The contractor shall be responsible for procuring, transporting, storing, securing and disposing of all construction-related materials used in the construction of the PHC homes. 
  • As applicable, the contractor shall only use a licensed architect or engineering contractor authorized to work in the CNMI for specific task designated for this labor category.  There may be additional labor regulations in the CNMI legislative code which the contractor is responsible to comply as required. The contractor shall state these codes within their project plan.
  • The contractor shall comply with inspection requirements mandated by the CNMI building department which verifies the PHC home is being constructed in compliance with required permits.
  • The contractor shall set up a construction schedule and management plan based on local weather conditions forecasted for each month of the task order.
  • The contractor shall be responsible for Quality Control, Construction/Project Management, production schedule, site security and safety once initial projects begin.
  • The contractor shall allow FEMA or its contractors/agents on the work site for the purposes of technical monitoring and quality assurance.  
  • The contractor shall work with the local authorities to obtain permits and for utility identification.
  • The contractor shall ensure all construction materials meet U.S. construction standards and are procured in compliance with the Buy American Act and all other applicable laws and regulations. The contractor shall submit their plan to meet these construction standards by submitting the information with their Project Plan.
  • The contractor shall be responsible for obtaining all required bonds and permits for all phases of construction to include: demolition, debris removal, disposal of materials, site preparation and construction.  Contractor must provide copies to the FEMA COR once obtained. 
  • Contractor shall comply with any Federal, State or Local laws, regulations or other requirements to test for asbestos or lead (if needed) and complete any required abatement and associated debris removal.
  • The contractor shall coordinate the installation of essential utility repairs with CNMI Commonwealth Utility Company (CUC) to prevent impacting the delivery schedule.
  • Unexploded Ordnance: If any item is discovered that may be an unexploded ordinance, the contractor must stop work, immediately alert the FEMA COR, and await further instructions from the FEMA COR.  The FEMA COR will contact the appropriate agencies for handling.
  • The contractor shall comply with any Environment and Historical Preservation (EHP) requirements dictated by CNMI or FEMA. This may include, but is not limited to, a requirement allowing a Government contracted Archeologist to be present on site during any ground disturbance activities associated with debris removal, foundation or utility work, and work in Archeological Sensitive Areas. Contractors must take appropriate action based on specific guidance provided by the Archeologist to protect/preserve artifacts as necessary.
  • The Contractor shall submit the permit request within 60 days of NTP for each property.
  • Once construction is completed and the permit closed, FEMA will conduct a quality assurance inspection review and take possession of the keys from the contractor in order to return keys to applicant.  If there are items identified requiring remediation, FEMA and the contractor shall develop an on-site list (punch list) of items requiring remediation at no additional cost to the Government.  This list shall be submitted to the FEMA COR for work remediation.
  • Any resulting task order will be inclusive of clauses specific to construction and in accordance with FAR Part 36.
  • The FEMA Contracting Officer is the only person who is authorized to make changes to any resulting contract/task order.  Changes to a contract/task order will be in writing via a modification.

6. Definitions

New Construction – as authorized by the Robert T. Stafford Disaster Relief and Emergency Assistance Act (Stafford Act), Section 408(c)(4), and implemented in 44 C.F.R. § 206.117. FEMA may provide permanent and semi-permanent housing construction which must be consistent with minimal local building codes and standards where they exist, or minimal acceptable construction industry standards in the area, including reasonable hazard mitigation measures including storm shutters on all windows, and Federal environmental laws and regulations.  Dwellings will be of average quality, size and capacity, taking into consideration the needs of the occupant. PHC New Construction must comply with 2018 IBC standards.

7. Period of Performance

The period of performance (POP) for this task order is 180 calendar days from the Notice to

Proceed.  The Notice to Proceed will be issued after receipt of performance and payment bonds

have been reviewed and accepted by the contracting officer.  The contractor shall participate in a kick‐off meeting no later than 48 hours after task order award, or within a time specified by the FEMA COR.  

8. Areas of Operation

The contractor shall be tasked with performing this activity as directed by the government; nominally in or around multiple areas in Saipan and Tinian to be determined by the government’s need. The contractor shall provide FEMA a schedule identifying where construction is planned no less than 48 hours prior to commencement of preliminary site inspections and construction.

9. Experience / Skills

The contractor shall provide personnel with all necessary expertise in construction, and architectural/engineering as needed. The contractor shall identify shortfalls in skilled labor and provide immediate strategies to the FEMA COR for mitigation.

The contractor shall conduct preliminary background checks on all staff assigned to the task order and receive favorable results. This process will increase the likelihood of personnel submitted for FEMA’s background investigation receiving approval.

10.   Project Execution

The contractor shall execute the permanent housing new construction mission per the aforementioned purpose and scope, issued work orders, and approved Project Management Plan (identified in Section 13 below).  The contractor shall start work within 48 hours after receipt of the Notice to Proceed (NTP).  The contractor shall notify the FEMA COR as soon as practicable if there are unforeseen interruptions due to weather, hazardous conditions, safety issues, or other circumstances.  If there is a potential delay in the schedule, the contractor shall notify the FEMA COR immediately of identification of a delay of any kind.  All services listed in the Statement of Work shall be provided in compliance with applicable Federal, CNMI, and local laws and regulations. The contractor shall deliver a biweekly (every two weeks) labor report to the FEMA COR to include (but not limited to) items identified in Section 13, Deliverable.  Contractor shall submit a work order proposal packet (ASIR packet example will be provided at the kick off meeting), within 72 hours of issuance of the work order.

11.    Deliverables and Deliverable Schedule

Deliverables

Performance Requirement

Timeframe

Method of Surveillance

Deliverable 1

Kick-off Meeting

48 hours after Task Order award.

To be scheduled by the FEMA CO/COR.

Deliverable 2

Provide complete progress schedules for the 20 new construction sites using Microsoft Project that will be furnished to the COR/CO 24 hours after award. 

Updated as needed.

100% Review/Inspection – FEMA COR will review each progress schedule for completeness and based on the terms of the statement of work.

Deliverable 3

Provide detailed daily status reports to the FEMA COR.  

Every day by

07:30 am local

CNMI time 

100% Inspection – FEMA COR will review each product for completeness & accuracy.

Deliverable 4

Labor Report

Biweekly

100% Inspection - FEMA COR will review each product for completeness & accuracy.

Deliverable 5

Provide daily construction schedule 

Daily

100% Inspection – FEMA COR will review each product for execution, performance and accuracy.

Deliverable 6

Provide a Quality Control Plan (QCP) to the government.  At a minimum, the QCP shall include the requirement, performance objective, daily performance standard, deficiency correction methods/ timeline, monitoring, document control, invoicing, materials and workmanship, testing and inspections, and work completeness.

Within 48 hours after the contract award.

100% Inspection – FEMA COR will review each product for execution and completeness.

Slump testing for each truck.

Cylinder testing for each house.

Deliverable 7

Project Management / Work

Plan - Project Management / Work Plan shall include at a minimum: activities, tasks and timelines, communications plan, process improvement, and risk management for project completion for the period of performance. 

Within 48 hours

of the task order award

100% Inspection – FEMA COR will review each product for completeness & accuracy.

12.    Operational Day

Unless otherwise specified by the Contracting Officer, all work required to be performed will be during the normal operational day. Operational days are ten (10) hours per day, six (6) days per week excluding Federal Holidays or as determined by the CO and/or FEMA COR. 

Contractor shall meet the timelines and operational requirements of the contract. The contractor shall report all barriers to their performance of the contract immediately in writing to the FEMA COR, for which the FEMA COR will give affirmation or other feedback to the contractor in writing. Any approved deviation from operational standards shall be noted on the contractor’s daily reports and not counted against the contractor’s performance. The Government will attempt to provide the contractor with advanced notice of any changes to the schedule in writing.

The contractor shall provide professional, courteous, and timely services, activities, and management to ensure that all work identified in the government furnished individual work orders and objectives are completed per task order. This includes incorporating customer service into operations, where appropriate, as well as employing a flexible and transparent performance management system that includes performance measures of contractor staff, subcontractors, and other representatives. The contractor shall provide background checks as identified herein, for all Employees working on this mission to the FEMA COR. The contractor shall badge all Employees working on this mission. The contractor’s identification (ID) badge shall include: company name, identification number, individual’s name and company phone number.  The contractor issued badge shall not include the words “FEMA or FEMA Contractor” or any governmental logo that gives the impression that the person is a government employee or is otherwise an agent of the government. The contractor’s personnel (including temporary or sub-contractors) shall wear an ID badge provided by the contractor. The contractor provided ID badges shall always be visible when performing work.

Finally, the contractor shall provide insightful, accurate, and timely written reporting to FEMA on all issues that could reflect unfavorably on this mission in writing to the FEMA COR as soon as practicable.

13. Accident Prevention

The contractor shall comply with all OSHA, Federal, and CNMI safety requirements while performing work under this contract:

1. The contractor will be responsible for signage, lighting, and barricading the immediate work area.
2. All vehicles operated by the contractor shall obey all traffic signs and laws while operating on the compound.
3. Unexploded Ordinance: If any item is discovered that may be an unexploded ordnance, stop work and immediately alert the FEMA COR. The FEMA COR will contact the appropriate agencies and provide further instructions to the contractor.
4. Fire Prevention: The prevention of fire is imperative during construction projects. The contractor is responsible for enforcing fire safety in all work areas.
5. The contractor shall have serviceable fire extinguishers readily available at all active construction sites. Extinguishers shall be supplied by the contractor.
6. Smoking is prohibited inside buildings and within 15 meters (50 feet) of flammable and combustible liquids.
7. Burning of trash and rubbish at the construction site is strictly prohibited.
8. All tar pots/kettles must be approved by the CNMI fire department prior to use.
9. The contractor shall not use gasoline or diesel fuel for cleaning parts or surfaces. Flammable liquids shall be stored at least 15 meters (50 feet) from flame and heat sources.
10. Electrical extension cords may be used on a temporary basis to provide tools and equipment. Do not overload extension cords. Frayed or spliced extension cords are prohibited.
11. The contractor must report all fires to the fire department immediately. Upon discovery of a fire, yell, “Fire! Fire! Fire!” and evacuate the area. Attempt to extinguish the fire only if it is safe to do so.  Go to the nearest phone and notify the fire department. Contractor must also notify the FEMA COR after notification to the fire department.
12. FEMA reserves the right to conduct a safety inspection at any construction site at any time.

14. Invoicing

1. The contractor shall submit one invoice every 30 calendar days from date of contract award. The invoice should include any progress / completion schedule payment for construction (25%, 50%, 75% and 100%).
2. Each invoice shall include all costs incurred during the invoice period to include: direct costs, Other Direct Costs (ODCs), indirect costs, etc.
3. All individual ODC charges shall include actual receipts.  All other billable services relating to construction shall include signed work orders as backup documentation. All payment requests shall have the appropriate back up documentation and be tied to a deliverable during the period invoiced.
4. Labor-related invoices and reports shall include a breakdown of personnel between staff deployed to the field and individuals working on the task order from the mainland or other location.

1. The contractor shall invoice for progress payments as stipulated, by the exact amount of work completed at the time the invoice is due to FEMA. The contractor Quality Control (QC) shall certify the completion of work by a signature on the FEMA Repair Details sheet (Provided at the kickoff) and present this documentation to FEMA for Quality Assurance (QA) certification.
2. The contractor’s final invoice shall be labeled, “Final,” and shall be submitted to FEMA within 30 calendar days of contract work completion.
3. In addition to traditional invoicing submitting procedures (FEMA-Invoice Inbox with email attachments), the contractor shall submit each invoice with back up documentation to the

FEMA COR.

In accordance with FAR Part 32.905(b)(1), an adequate invoice shall contain the following accurate and complete information:

1. 1. Task Title
   2. Name and Address of the contractor
   3. Invoice Date and Invoice Number
   4. Contract Number or other authorization for supplies delivered or services performed (including order number and contract line item number).
   5. Task Order Number
   6. Description, quantity, unit of measure, unit price, and extended price of supplies delivered, or services performed.
   7. Shipping and payment terms (e.g. shipment number and date of shipment, discount for prompt payment terms).
   8. Name and address of contractor official to whom payment is being sent (must be the same as that in the contract or in a proper notice of assignment).
   9. Name (where practicable), title, phone number, and mailing address of person to notify in the event of a defective invoice.
   10. Any other information or documentation required by the contract (e.g. evidence of shipment).
   11. See contract clauses for further invoicing instruction.

The contractor shall email an electronic copy of the invoice for the previous month’s activity to the following FEMA Finance Center (FFC) email address FEMA-Finance-VendorPayments@fema.dhs.gov for payment processing.  The contractor shall copy the COR on this email.  FFC will date/clock stamp the invoice and forward to the COR for final approval.

If email is unavailable, then the contractor shall mail the invoice to the following FEMA Finance Center address: FEMA Finance Center

P. O. Box 9001

Winchester, Virginia 22604

FFC will not process nor pay any invoice without the following attributes or supporting documentation:

1. 1. The invoice identifies the period for which the services were rendered.
   2. The billed goods or services are identified by unit or milestone and reconcile to what was contracted for.

The contractor will be paid the net invoice payment within 30 days after submission of a proper invoice to the FEMA Finance Center. 

The contractor shall notify the FEMA COR by e-mail whenever the cost of services reaches 75% of the dollar amount funded.  For example, if funding provided to the contractor is $100K, once $75K has been expended, the contractor shall immediately notify the FEMA COR.

15. Security Considerations (DATA)

The contractor shall maintain, transmit, retain in the strictest confidence, and prevent the unauthorized duplication, use, and disclosure of information.  The contractor shall provide information only to HSPD-12 cleared employees, contractors, and subcontractors having a need to know such information in the performance of their duties for this project.

Information made available to the contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without the written agreement of the Contracting Officer.

If public information is provided to the contractor for use in performance or administration of this effort, the contractor, except with the written permission of the Contracting Officer, may not use such information for any other purpose.  If the contractor is uncertain about the availability or proposed use of information provided, the contractor will consult with the COR regarding use of that.

The contractor agrees to assume responsibility for protecting the confidentiality and privacy of Government records which are not public information.  The contractor agrees to comply with and protect information in accordance with the Privacy Act of 1974, 5 U.S.C. § 552a. Each employee or subcontractor of the contractor to whom information is made available or disclosed shall use the information provided only for a purpose and to the extent authorized herein.  Penalties for non-approved release of privacy data shall be subject to penalties described in accordance with the Privacy Act of 1974, 5 U.S.C. § 552a.

Performance of this effort may require the contractor to access and use data and information proprietary to a Government agency or Government contractor which is of such a nature that its dissemination or use, other than in performance of this effort, would be adverse to the interests of the Government and/or others.

The contractor and its personnel shall not divulge, or release data or information developed or obtained in performance of this effort, unless made public by the Government, except to the extent authorized in writing by Government personnel, or upon written approval of the Contracting Officer.  The contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of this effort.  Nothing

herein shall preclude the use of any data independently acquired by the contractor without such limitations or prohibit an agreement at no cost to the Government between the contractor and the data owner that provides for greater rights to the contractor.   

All deliverables, source code, reports, and data received, processed, evaluated, loaded, and/or created as a result of this contract shall remain the sole property of the Government unless specific exception is granted by the Contracting Officer.

16. Employment Eligibility Verification (e-verify)

Executive Order 12989 mandates the electronic verification of all employees working on any federal contract.  The contractor shall agree that each employee working on this contract will successfully pass the DHS Employment Eligibility Verification (E-Verify) program, which is operated by the Department of Homeland Security in partnership with the Social Security Administration to establish work authorization.

The contractor shall ensure that each employee working on this contract has a Social Security Card issued and approved by the Social Security Administration.  The contractor shall be responsible to the Government for acts and omissions of its own employees and for any subcontractor(s) and their employees. 

Subject to existing law, regulations, and/or other provisions of this contract, illegal or undocumented aliens will not be employed by the contractor or for this contract.  The contractor shall ensure that this provision is expressly incorporated into any and all subcontracts or subordinate agreements issued in support of this contract.

17. Personnel Security Requirements

The Contracting Officer, in coordination with FEMA’s Personnel Security Division (PSD), shall ensure that all solicitations and contracts comply with the following Federal Acquisition Regulations and Homeland Security Acquisition Regulations by including the requisite clauses, as applicable:

• 48 C.F.R. § 4.1303 (clause at 48 C.F.R. § 52.204-9)
• 48 C.F.R. § 3004.470-3 (clauses at 48 C.F.R. § 3052.204-70 and 48 C.F.R. § 3052.204-

71)]

BACKGROUND INVESTIGATIONS

All contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed.  FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.  

Low Risk without Information System Access

Contractor personnel occupying positions or performing functions with a Low Risk designation and who do not require access to DHS or FEMA information systems shall undergo a National Agency Check with Inquiries (NACI) and a credit check and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Low Risk with Information System Access

Contractor personnel occupying positions or performing functions with a Low Risk designation and who require access to DHS or FEMA information systems shall undergo a Moderate-Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Moderate Risk

Contractor personnel occupying positions or performing functions with a Moderate Risk designation shall undergo a Moderate-Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.  

High Risk

Contractor personnel occupying positions or performing functions with a High Risk designation shall undergo a Background Investigation (BI) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.  

 

Background Investigation Process

To initiate the request to process contractor personnel, the contractor shall provide the FEMA COR with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 121-3-1-6, “Contract Fitness/Security Screening Request.”  The FEMA COR shall ensure that all other applicable sections of the FEMA Form 121-3-1-6 are complete prior to submitting the form to FEMA PSD for processing.  The contractor shall also provide the FEMA COR with a completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if: 

• the investigation was completed within the last five years, 
• the investigation meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract, 
• the contractor personnel have not had a break in employment since the prior favorable adjudication, and 
• FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a re-investigation.  

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication.  The COR will, in turn, notify the contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.  

      

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email to the contractor personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the Office of Personnel Management’s Electronic Questionnaires for Investigation Processing (e-QIP) system and instructions for submitting the necessary information:

• Standard Form 85P, “Questionnaire for Public Trust Positions Optional Form 306, “Declaration for Federal Employment”
• SF 87, “Fingerprint Card” (2 copies) 
• DHS Form 11000-6, “Non-Disclosure Agreement”
• DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports

Pursuant to the Fair Credit Reporting Act”

FEMA PSD will only accept complete packages consisting of all the above documents and the Standard Form 85P, which must be completed electronically through the Office of Personnel Management’s e-QIP system.  The contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern.  In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the prime contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract.  Neither the Prime Contractor nor the contractor personnel have any right to such a grant of temporary eligibility.  The grant of such temporary eligibility shall not be considered as assurances that the contactor personnel will remain eligible to perform work under this contract upon completion of, and final adjudication of, the full background investigation.  

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action.  In any instance where the final adjudication results in an unfavorable determination, FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable.  The COR will then forward that information to the contractor.  Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract.  Unfavorable adjudications are final and not subject to review or appeal.

 

Continued Eligibility and Re-investigation

Eligibility determinations based on a NACI, MBI or BI are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation (NACI, MBI, or BI, as required) to perform work under this contract shall be ineligible to perform work under this contract upon the expiration of the background investigation unless and until the contractor personnel have undergone a re-investigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

 

Exclusion by Contracting Officer

The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the contractor to exclude from working on this contract any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency.

 

FACILITY ACCESS  

 

The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity

Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 1213-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.  

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.  

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and receive approval from FEMA PSD.  Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.  

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat. 

The contractor shall notify the FEMA COR of all personnel terminations/resignations within five calendar days of occurrence. The contractor must account for all forms of Governmentprovided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) and must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.
• Upon completion of a contractor employee’s employment.
• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the contractor to civil and criminal liability.

18. Safeguarding of Sensitive Information (March 2015)

 

1. Applicability.  This clause applies to the contractor, its subcontractors, and contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

1. Definitions.  As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name.  The definition of PII is not anchored to any single category of information or technology.  Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified.  In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information.  Examples of PII include, but are not limited to:  name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

  

“Sensitive Information” is defined in HSAR clause 3052.204-71, contractor Employee Access, as any information, which if lost, misused,disclosed, or, without authorization is accessed, or modified, could adversely affect the nationalor homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense,homeland security or foreign policy.  This definition includes the following categories of information:  

1. Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee); 

1. Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);  

1. Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the nationalor homeland security interest; and 

1. Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.  Some forms of PII are sensitive as stand-alone elements.  Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan.  Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

  

1. Truncated SSN (such as last 4 digits)
2. Date of birth (month, day, and year)
3. Citizenship or immigration status
4. Ethnic or religious affiliation
5. Sexual orientation
6. Criminal History
7. Medical Information
8. System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number.  In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.  

(c) Authorities.  The contractor shall follow all current versions of Government policies and guidance accessible athttp://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

1. DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official

Use Only) Information

1. DHS Sensitive Systems Policy Directive 4300A
2. DHS 4300A Sensitive Systems Handbook and Attachments
3. DHS Security Authorization Process Guide
4. DHS Handbook for Safeguarding Sensitive Personally Identifiable Information
5. DHS Instruction Handbook 121-01-007Department of Homeland Security Personnel

Suitability and Security Program

1. DHS Information Security Performance Plan (current fiscal year)
2. DHS Privacy Incident Handling Guidance 
3. Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html (10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html 

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html 

(d) Handling of Sensitive Information.  Contractor compliance with this clause, as well as the policies and procedures described below, is required.  

1. Department of Homeland Security (DHS) policies and procedures on contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions.  MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information.  DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation.  Examples of sensitive information that  are categorized by statute or regulation are PCII, SSI, etc.  The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources.  The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form.  DHS Instruction Handbook 121-01-007, Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.  

1. The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the contractor except as specified in the contract.

1. All contractor employees with access to sensitive information shall execute DHS Form 110006, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information.  The contractor shall maintain signed copies of the NDA for all employees as a record of compliance.  The contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form. 

1. The contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII.  It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

(e) Authority to Operate.  The contractor shall not input, store, process, output, and/or transmit sensitive information within a contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or Component Privacy Officer.  Unless otherwise specified in the ATO letter, the ATO is valid for three (3) years.  The contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.  

1. Complete the Security Authorization process.  The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.  

1. 1. Security Authorization Process Documentation.  SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates.  SA documentation consists of the following:  Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter.  Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).  During the development of SA documentation, the contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior  to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package.  Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document.  The Government’s acceptance of the ATO does not alleviate the contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

1. 1. Independent Assessment.  Contractors shall have an independent third party validate the security and privacy controls in place for the system(s).  The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations.  The contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

1. 1. Support the completion of the Privacy Threshold Analysis (PTA) as needed.  As part of the SA process, the contractor may be required to support the Government in the completion of the PTA.  The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years.  Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required.  The contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones.  Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the contractor’s system, and providing timely review of relevant compliance documents for factual accuracy.  Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacycompliance.

1. Renewal of ATO.  Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years.  The contractor is required to update its SA package as part of the ATO renewal process.  The contractor shall update its SA package by one of the following methods: (1) Updating the SA documentation in the DHS automated information assurance tool for acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls; or (2) Submitting an updated SA package directly to the COR for approval by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls.  The 90-day review process is independent of the system production date and therefore it is important that the contractor build the review into project schedules.  The reviews may include onsite visits that involve physical or logical inspection of the contractor environment to ensure controls are in place.  

1. Security Review.  The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced.  The contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the contractor’s facilities, installations, operations, documentation,  databases and personnel used in the performance of this contract.  The contractor shall, through the Contracting Officer and COR, contact the Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to the DHS.  Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of Government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

1. Continuous Monitoring.  All contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis.  The contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created.  The data shall be encrypted in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities.  The Government may elect to perform continuous monitoring and IT security scanning of contractor systems from Government tools and infrastructure.

1. Revocation of ATO.  In the event of a sensitive information incident, the Government may suspend or revoke an existing ATO (either in part or in whole).  If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the contractor to take additional security measures to secure sensitive information.  These measures may include restricting access to sensitive information on the contractor IT system under this contract.  Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

1. Federal Reporting Requirements.  Contractors operating information systems on behalf of the Government or operating systems containing sensitive information shall comply with Federal reporting requirements.  Annual and quarterly data collection will be coordinated by the Government.  contractors shall provide the COR with requested information within three (3) business days of receipt of the request.  Reporting requirements are determined by the Government and are defined in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication.  The contractor shall provide the Government with all information to fully satisfy Federal reporting requirements for contractor systems.

(f) Sensitive Information Incident Reporting Requirements.   

1. All known or suspected sensitive information incidents shall be reported to the Headquarters or Component Security Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting requirements.  When notifying the Headquarters or Component SOC, the contractor shall also notify the Contracting Officer, COR, Headquarters or Component Privacy Officer, and US-CERT using the contact information identified in the contract.  If the incident is reported by phone or the Contracting  Officer’s email address is not immediately available, the contractor shall contact the Contracting Officer immediately after reporting the incident to the Headquarters or Component SOC.  The contractor shall not include any sensitive information in the subject or body of any e-mail. To transmit sensitive information, the contractor shall use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption methods to protect sensitive information in attachments to email.  Passwords shall not be communicated in the same email as the attachment.  A sensitive information incident shall not, by itself, be interpreted as evidence that the contractor has failed to provide adequate information security safeguards for sensitive information, or has otherwise failed to meet the requirements of the contract.  

1. If a sensitive information incident involves PII or SPII, in addition to the reporting requirements in 4300A Sensitive Systems Handbook Incident Response and Reporting, contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

1. 1. Data Universal Numbering System (DUNS); 
   2. Contract numbers affected unless all contracts by the company are affected;
   3. Facility CAGE code if the location of the event is different than the prime contractor location;
   4. Point of contact (POC) if different than the POC recorded in the System for Award

Management (address, position, telephone, email);

1. 1. Contracting Officer POC (address, telephone, email);
   2. Contract clearance level;
   3. Name of subcontractor and CAGE code if this was an incident on a subcontractor network;
   4. Government programs, platforms or systems involved;
   5. Location(s) of incident;
   6. Date and time the incident was discovered;
   7. Server names where sensitive information resided at the time of the incident, both at the contractor and subcontractor level;
   8. Description of the Government PII and/or SPII contained within the system;
   9. Number of people potentially affected, and the estimate or actual number of records exposed and/or contained within the system; and (xiv) Any additional information relevant to the incident.

(g) Sensitive Information Incident Response Requirements.

1. All determinations related to sensitive information incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made in writing by the Contracting Officer in consultation with Headquarters or the Component CIO and Headquarters or Component Privacy Officer.