View Other Versions: 1174255_02
General Buy Information
| Buy #: | 1174255_01 | |
|---|---|---|
| Solicitation #: | 70FA50WX04705Y2024T | |
| Buy Description: | FEMA Vehicle Enhancement Support - HEMP | |
| Category: | K -- MODIFICATION OF EQUIPMENT | |
| Sub Category: | K023 -- MODIFICATION OF EQUIPMENT- GROUND EFFECT VEHICLES, MOTOR VEHICLES, TRAILERS, AND CYCLES | |
| NAICS: | 541990 -- All Other Professional, Scientific, and Technical Services | |
| SAM Contract Opportunity: | No | |
| Set-Aside Requirement: | No Set-Aside Restriction | |
| Buyer: | DHS Federal Emergency Management Agency | |
| End Date: | 07/15/2024 | |
| End Time: | 11:00 ET | |
| Seller Question Deadline: | 7/11/2024 - 11:00 ET | |
| Delivery: | 30 Day(s) - Required (No. of calendar days after receipt of order (ARO) by which Buyer requires Seller to deliver) | |
| Repost Reason: |
REPOST TO OM NOSA
Please Note: Repost Reason is provided as a courtesy only. Sellers are responsible for reviewing and complying with all Buy Specifications regardless of Repost Reason. |
|
Line Item(s) Template - Optional
| You have the option of entering Bid information manually by clicking Start Bid or you can prepare your Bid in an Excel spreadsheet by clicking Download Template. Complete the template using the instructions provided in the spreadsheet and save the file to your computer. When complete, login to Unison Marketplace and click Start Bid. Proceed to the Line Items screen to upload the information. |
Line Item(s)
| Item No | Description | Qty | Unit |
|---|---|---|---|
| 001 | HEMP Hardening for 2023 Ford F550 4X4 Reg Chassis Flatbed (VIN 1FDUF5HT6PDA05939) IAW SOO | 1 | EA |
| 002 | HEMP Hardening for 2023 Ford F550 4X2 Reg Chassis Flatbed (VIN 1FDUF5GT4PEC07707) IAW SOO | 1 | EA |
| 003 | HEMP Hardening for 2023 Ford F550 4X2 Reg Chassis Flatbed (VIN 1FDUF5GT1PDA04313) IAW SOO | 1 | EA |
| 004 | HEMP Hardening for 2023 Ford F550 4X4 Reg Chassis Flatbed (VIN 1FDUF5HT3PDA04263) IAW SOO | 1 | EA |
| 005 | HEMP Hardening for 2023 Ford F550 4X4 Reg Chassis Flatbed (VIN 1FDUF5HT9REC97664) IAW SOO | 1 | EA |
| 006 | HEMP Hardening for 2023 Ford F550 4X4 Reg Chassis Flatbed (VIN TBD) IAW SOO | 1 | EA |
| 007 | HEMP Hardening for 2023 Ford F550 4X4 Reg Chassis Flatbed (VIN TBD) IAW SOO | 1 | EA |
Bidding Requirements
| Instructions |
|---|
|
Open Market bids are accepted in this solicitation; however, please refer to the specifications below, including 'Set-Aside Requirement' provision, for additional requirements.
|
|
The Government intends to select for award the one responsible quote which conforms to the Bidding Requirements and Buy Terms in the auction, proposes a price that is fair and reasonable, and provides the Lowest Priced, Technically Acceptable (LPTA) quote meeting the specifications of the requirement. If the lowest priced quote is not found to be Technically Acceptable, the government will evaluate the next lowest priced quote, and so on. Quotes determined to be incomplete, unreasonable, or unrealistic will not be considered for award.
|
|
The Buyer is allowing Sellers to submit bids that either meet or exceed the requested specification. Sellers MUST enter exactly what they are bidding (including make, model, and description) into the blank description field in order for the bid to be considered.
|
|
The Buyer is requiring that any rebid must be lower than the 'current bid price' by this amount. The reduction is based on the total order and must be satisfied within the rebid minimum.
|
|
Buyer intends to issue award using a purchase order or delivery order. Bids from Sellers unable to accept purchase orders or delivery orders will not be considered for award.
|
|
There is no Set-Aside restriction for this Buy.
|
|
Buyers and Sellers agree to conduct this transaction through Unison Marketplace in compliance with the Unison Marketplace Terms of Use. Failure to comply with the below terms and conditions may result in offer being determined as non-responsive.
|
|
Interested offerors must submit any questions concerning the solicitation at the earliest time possible to enable the buyer to respond. Questions can be submitted by using the 'Questions & Responses' link. Questions not received within a reasonable time prior to close of the solicitation may not be considered.
|
|
Unless otherwise specified in the Buy Terms, below, Bid must be good for 30 calendar days after close of Buy and shipping must be free on board (FOB) destination CONUS (Continental U.S.)
|
|
The Buyer is requiring interested Sellers submit Bids with pricing inclusive of all Line Items.
|
Buy Terms
| Name | Description |
|---|---|
| Pricing Instructions | Unless the Buyer indicates otherwise within a particular line item description, each Seller shall include in its online Bid individual pricing for all required line items in order to be considered for award (i.e., Do not use the Included in another line item function when pricing each line item). If a line item cannot be separately priced, you must notify the buyer through the Unison Submit a Question feature regarding which line item(s) should be included in which other line item(s) and request reposting. Failure to comply with this term may result in the Bid being determined to be non-responsive. |
| Equipment Condition | New Equipment ONLY; NO remanufactured or "gray market" items. All items must be covered by the manufacturer's warranty. |
| Offer Period | Bid MUST be good for 30 calendar days after close of Buy. |
| Shipping Condition | Shipping must be free on board (FOB) destination CONUS (Continental U.S.), which means that the seller must deliver the goods on its conveyance at the destination specified by the buyer, and the seller is responsible for the cost of shipping and risk of loss prior to actual delivery at the specified destination. |
| SAM Requirement | This solicitation requires registration with the System for Award Management (SAM) at the time an offer or quotation is submitted, excluding the exceptions outlined in FAR 4.1102(a). Registration information can be found at www.sam.gov. |
| Delivery Requirement | No partial shipments are permitted unless specifically authorized at the time of award. |
| Delivery of Order | Delivery must be made within 30 days or less after receipt of order (ARO). The offeror must provide within its offer the number of days - not to exceed 30 - required to make delivery after it receives a purchase order from the buyer. Unless otherwise noted. |
| Commercial Items Terms and Conditions | The selected Offeror must comply with the following commercial item terms and conditions, which are incorporated herein by reference: FAR 52.212-1, Instructions to Offerors - Commercial Items, applies to this acquisition; FAR 52.212-3, Offeror Representations and Certifications - Commercial Items - the selected offeror must submit a completed copy of the listed representations and certifications; FAR 52.212-4, Contract Terms and Conditions - Commercial Items; FAR 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Items, paragraph (a) and the following clauses in paragraph (b): 52.222-21, 52.222-26, 52.222-35, 52.222-36, 52.222-37, 52.225-13, 52.232-34. The full text of the referenced FAR clauses may be accessed electronically at https://www.acquisition.gov/far/. |
| Commercial Items Terms and Conditions Continued | FAR 52.212-4, Contract Terms and Conditions - Commercial Items; FAR 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Items, paragraph (a) and the following clauses in paragraph (b): 52.222-21, 52.222-26, 52.222-35, 52.222-36, 52.222-37, 52.225-13, 52.232-34. The full text of the referenced FAR clauses may be accessed electronically at http://www.acqnet.gov/far. |
| Q&A Instructions | Q&A -Please submit all questions by using the 'Submit a Question' button. This buy will then be reposted with Q&A based on the questions that come in (if applicable). |
| Supplemental Bid Information | In addition to providing pricing at www.unisonmarketplace.com for this solicitation, each Offeror must provide any required, NON-PRICING responses (e.g. technical proposal, representations and certifications, etc.) so that they are received no later than the closing date and time for this solicitation. Submissions can be sent to marketplacesupport@unisonglobal.com. |
| For Exact Match Only Commodity Buys | For Exact Match Only Commodity Buys- NO SUBSTITUTIONS, EXACT MATCH ONLY. The vendor may not substitute any item/service listed on this order without prior written approval from the DHS/CBP Contracting Officer. No other individual is authorized, either verbally or in writing to change part numbers, manufacturer, quantity, delivery dates, or any other specifications of this RFQ. Items/services that do not conform to descriptions and part numbers found in this RFQ will be rejected at the time of delivery causing a return at the vendor's expense. |
| For Exact Match Services Buys Only | For Exact Match Services Buys Only- In order for a sellers bid to be 'responsive' and considered for award, the seller is REQUIRED to document exactly how they intend to meet the requirements of the SOW. They shall document statement detailing the service for evaluation. Failure to do this may be cause for termination. This information is REQUIRED in order for a sellers bid to be deemed 'responsive' and to be considered for award. |
| For Buys other than Exact Match | For all buys other than Exact Match Sellers MUST document what they are bidding for evaluation for award. Sellers must include, extended specs and/or manufacturer name and part numbers (if applicable). Failure to do this may be cause for termination. This information is REQUIRED in order for a sellers bid to be deemed 'responsive' and to be considered for award. FAR 52.211-6. |
| 52.204-23 PROHIBITION ON CONTRACTING FOR HARDWARE, SOFTWARE, AND SERVICES (DEVIATION 20-05) | (a) Definitions. As used in this clause— “Covered article” means any hardware, software, or service that– (1) Is developed or provided by a covered entity; (2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or (3) Contains components using any hardware or software developed in whole or in part by a covered entity. “Covered entity” means– (1) Kaspersky Lab; (2) Any successor entity to Kaspersky Lab; (3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or (4) Any entity of which Kaspersky Lab has a majority ownership. (b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits Government use of any covered article. The Contractor is prohibited from— (1) Providing any covered article that the Government will use on or after October 1, 2018; and (2) Using any covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract. (c) Reporting requirement. (1) In the event the Contractor identifies covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report, in writing, via email, to the Contracting Officer, Contracting Officer’s Representative, and the Enterprise Security Operations Center (SOC) at NDAA_Incidents@hq.dhs.gov, with required information in the body of the email. In the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Enterprise SOC, Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) and Contracting Officer’s Representative(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil. (2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause: (i) Within 1 business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended. (ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts that will be incorporated to prevent future use or submission of covered articles. (c) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items. (End of clause) |
| 52.204–24, REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SVCS OR EQUIP | 52.204–24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment. As prescribed in 4.2105(a), insert the following provision: Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020) The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it ‘‘does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument’’ in the provision at 52.204–26, Covered Telecommunications Equipment or Services—Representation, or in paragraph (v) of the provision at 52.212–3, Offeror Representations and Certifications– Commercial Items. (a) Definitions. As used in this provision – Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204–25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115–232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to— (i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or (ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles. (2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115–232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to— (i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or (ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles. (c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https:// www.sam.gov) for entities excluded from receiving federal awards for ‘‘covered telecommunications equipment or services.’’ (d) Representations. The Offeror represents that— (1) It [ ] will, [ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds ‘‘will’’ in paragraph (d)(1) of this section; and (2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that— It [ ] does, [ ] does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds ‘‘does’’ in paragraph (d)(2) of this section. (e) Disclosures. (1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded ‘‘will’’ in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer: (i) For covered equipment— (A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known); (B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and (C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision. (ii) For covered services— (A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or (B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision. (2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded ‘‘does’’ in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer: (i) For covered equipment— (A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known); (B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and (C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision. (ii) For covered services— (A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or (B) If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision. |
| 52.204-25 PROHIBITION ON CONTRACTING FOR CERTAIN TELECOMMUNICATIONS AND VIDEO SURVEILLANCE DEVIATION | (a) Definitions. As used in this clause— “Backhaul” means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet). “Covered foreign country” means The People’s Republic of China. “Covered telecommunications equipment or services” means– (1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities); (2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities); (3) Telecommunications or video surveillance services provided by such entities or using such equipment; or (4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country. “Critical technology” means– (1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations; (2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled- (i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or (ii) For reasons relating to regional stability or surreptitious listening; (3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities); (4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material); (5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or (6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817). “Interconnection arrangements” means arrangements governing the physical connection of two or more networks to allow the use of another’s network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources. “Reasonable inquiry” means an inquiry designed to uncover any information in the entity’s possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit. “Roaming” means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high. “Substantial or essential component” means any component necessary for the proper function or performance of a piece of equipment, system, or service. (b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115–232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. (2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115–232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. (c) Exceptions. This clause does not prohibit contractors from providing— (1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or (2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles. (d) Reporting requirement. (1) In the event the Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report the information in paragraph (d)(2) of this clause in writing via email to the Contracting Officer, Contracting Officer’s Representative, and the Enterprise Security Operations Center (SOC) at NDAA_Incidents@hq.dhs.gov, with required information in the body of the email. In the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Enterprise SOC, Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) and Contracting Officer’s Representative(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil. (2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause (i) Within one business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; supplier unique entity identifier (if known); supplier Commercial and Government Entity (CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended. (ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services. (e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items. |
| 52.204-26 Covered Telecommunications Equipment or Services-Representation | As prescribed in 4.2105(c), insert the following provision: COVERED TELECOMMUNICATIONS EQUIPMENT OR SERVICES-REPRESENTATION (DEC 2019) (a) Definitions. As used in this provision, “covered telecommunications equipment or services” has the meaning provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (b) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for “covered telecommunications equipment or services”. (c) Representation. The Offeror represents that it □ does, □ does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument. |
| Equipment Condition (No Gray-Market Equipment) | New Equipment ONLY; NO remanufactured or "gray market" items. All items must be covered by the manufacturer's warranty. 1.) The Offeror shall provide only new equipment unless otherwise expressly approved, in writing, by the DHS Contracting Officer. Offerors shall provide only Original Equipment Manufacturer (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts. 2.) The Offeror shall be excused from using new OEM (i.e., "gray market”, "previously used”) components only with formal Government approval, in writing, from the DHS Contracting Officer. Such components shall be procured from their original source and shipped only from the manufacturer’s authorized shipment points. 3.) All equipment obtained by the Offeror on behalf of the Government will need to be provided to OIG OCIO for review to validate requirements and approved Contractors by DHS. |
| 52.204-9 Personal Identity Verification of Contractor Personnel | (a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201. (b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government: (1) When no longer needed for contract performance. (2) Upon completion of the Contractor employee’s employment. (3) Upon contract completion or termination. (c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements. (d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer. |
| 52.224-3 Privacy Training | (a) Definition. As used in this clause, "personally identifiable information" means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A-130, Managing Federal Information as a Strategic Resource). (b) The Contractor shall ensure that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who- (1) Have access to a system of records; (2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of an agency; or (3) Design, develop, maintain, or operate a system of records (see also FAR subpart 24.3 and 39.105). (c) (1) "Privacy training shall address the key elements necessary for ensuring the safeguarding of personally identifiable information or a system of records. The training shall be role-based, provide foundational as well as more advanced levels of training, and have measures in place to test the knowledge level of users. At a minimum, the privacy training shall cover- (i) The provisions of the Privacy Act of 1974 ( 5 U.S.C. 552a), including penalties for violations of the Act; (ii) The appropriate handling and safeguarding of personally identifiable information; (iii) The authorized and official use of a system of records or any other personally identifiable information; (iv) The restriction on the use of unauthorized equipment to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise access personally identifiable information; (v) The prohibition against the unauthorized use of a system of records or unauthorized disclosure, access, handling, or use of personally identifiable information; and (vi) The procedures to be followed in the event of a suspected or confirmed breach of a system of records or the unauthorized disclosure, access, handling, or use of personally identifiable information (see OMB guidance for Preparing for and Responding to a Breach of Personally Identifiable Information). (2) Completion of an agency-developed or agency-conducted training course shall be deemed to satisfy these elements. (d) The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer. (e) The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause. (f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will- (1) Have access to a system of records; (2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or (3) Design, develop, maintain, or operate a system of records. |
| 3052.204-71 Contractor Employee Access | (a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information: (1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008); (2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII's implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee; (3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”; (4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015; (5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department; (6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization; (7) Information Systems Vulnerability Information (ISVI) means: (i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or (ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system; (8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department; (9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting; (10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation; (11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual. (i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers. (ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements: (A) Truncated SSN (such as last 4 digits); (B) Date of birth (month, day, and year); (C) Citizenship or immigration status; (D) Ethnic or religious affiliation; (E) Sexual orientation; (F) Criminal history; (G) Medical information; and (H) System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs). (iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual. (b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology. (c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under departmental procedures. (d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns. (e) Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government's activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter. (f) The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources. (End of clause) Alternate I (JUL 2023) When the contract will require Contractor employees to have access to information resources, add the following paragraphs: (g) Before receiving access to information resources under this contract, the individual must complete a security briefing; additional training for specific categories of CUI, if identified in the contract; and any nondisclosure agreement furnished by DHS. The Contracting Officer's Representative (COR) will arrange the security briefing and any additional training required for specific categories of CUI. (h) The Contractor shall have access only to those areas of DHS information resources explicitly stated in this contract or approved by the COR in writing as necessary for performance of the work under this contract. Any attempts by Contractor personnel to gain access to any information resources not expressly authorized by the terms and conditions in this contract, or as approved in writing by the COR, are strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved. (i) Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Contractor performs business for DHS. It is not a right, a guarantee of access, a condition of the contract, or government-furnished equipment (GFE). (j) Contractor access will be terminated for unauthorized use. The Contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access. (k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management, or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department's Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted: (1) There must be a compelling reason for using this individual as opposed to a U.S. citizen; and (2) The waiver must be in the best interest of the Government. (l) Contractors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer. (End of clause) Alternate II (JUL 2023) When the Department has determined contract employee access to controlled unclassified information or Government facilities must be limited to U.S. citizens and lawful permanent residents, but the contract will not require access to information resources, add the following paragraphs: (g) Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I–551). Any exceptions must be approved by the Department's Chief Security Officer or designee. (h) Contractors shall identify in their proposals, the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer. |
| 3052.204-72 Safegarding of Controlled Unclassified Information | (a) Definitions. As used in this clause— Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls. Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information: (1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008); (2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Public Law 116–283), PCII's implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee; (3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”; (4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015; (5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department; (6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization; (7) Information Systems Vulnerability Information (ISVI) means: (i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or (ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system; (8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department; (9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting; (10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation; (11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual. (i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers. (ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements: (A) Truncated SSN (such as last 4 digits); (B) Date of birth (month, day, and year); (C) Citizenship or immigration status; (D) Ethnic or religious affiliation; (E) Sexual orientation; (F) Criminal history; (G) Medical information; and (H) System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs). (iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual. Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form. Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency. Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information. Incident means an occurrence that— (1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. Information Resources means information and related resources, such as personnel, equipment, funds, and information technology. Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide— (1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity; (2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and (3) Availability, which means ensuring timely and reliable access to and use of information. Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. (b) Handling of Controlled Unclassified Information. (1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. (2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract. (3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer's Representative (COR) or other government personnel associated with the administration of the contract, as needed. |
| 3052.204-72 Safegarding of Controlled Unclassified Information Con't | (4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings. (c) Incident Reporting Requirements. (1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC. (2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery. (3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140–2/140–3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projectscryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator. (4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract. (5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report: (i) Unique Entity Identifier (UEI); (ii) Contract numbers affected unless all contracts by the company are affected; (iii) Facility CAGE code if the location of the event is different than the prime Contractor location; (iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email); (v) Contracting Officer POC (address, telephone, and email); (vi) Contract clearance level; (vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network; (viii) Government programs, platforms, or systems involved; (ix) Location(s) of incident; (x) Date and time the incident was discovered; (xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level; (xii) Description of the government PII or SPII contained within the system; and (xiii) Any additional information relevant to the incident. (d) Incident Response Requirements. (1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer. (2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents. (3) Incident response activities determined to be required by the Government may include, but are not limited to, the following: (i) Inspections; (ii) Investigations; (iii) Forensic reviews; (iv) Data analyses and processing; and (v) Revocation of the Authority to Operate (ATO), if applicable. (4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest. (5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities. (e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G. (f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor's responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements. (g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI. |
| 3052.204-73 Notification and credit monitoring requirements for Personally Identifiable Information | (a) Definitions. Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual. (1) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers. (2) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements: (i) Truncated SSN (such as last 4 digits); (ii) Date of birth (month, day, and year); (iii) Citizenship or immigration status; (iv) Ethnic or religious affiliation; (v) Sexual orientation; (vi) Criminal history; (vii) Medical information; and (viii) System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs). (3) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual. (b) PII and SPII Notification Requirements. (1) No later than 5 business days after being directed by the Contracting Officer, or as otherwise required by applicable law, the Contractor shall notify any individual whose PII or SPII was either under the control of the Contractor or resided in an information system under control of the Contractor at the time the incident occurred. The method and content of any notification by the Contractor shall be coordinated with, and subject to prior written approval by, the Contracting Officer. The Contractor shall not proceed with notification unless directed in writing by the Contracting Officer. (2) All determinations by the Department related to notifications to affected individuals and/or Federal agencies and related services (e.g., credit monitoring) will be made in writing by the Contracting Officer. (3) Subject to government analysis of the incident and direction to the Contractor regarding any resulting notification, the notification method may consist of letters to affected individuals sent by first-class mail, electronic means, or general public notice, as approved by the Government. Notification may require the Contractor's use of address verification and/or address location services. At a minimum, the notification shall include: (i) A brief description of the incident; (ii) A description of the types of PII or SPII involved; (iii) A statement as to whether the PII or SPII was encrypted or protected by other means; (iv) Steps individuals may take to protect themselves; (v) What the Contractor and/or the Government are doing to investigate the incident, mitigate the incident, and protect against any future incidents; and (vi) Information identifying who individuals may contact for additional information. (c) Credit Monitoring Requirements. The Contracting Officer may direct the Contractor to: (1) Provide notification to affected individuals as described in paragraph (b). (2) Provide credit monitoring services to individuals whose PII or SPII was under the control of the Contractor or resided in the information system at the time of the incident for a period beginning the date of the incident and extending not less than 18 months from the date the individual is notified. Credit monitoring services shall be provided from a company with which the Contractor has no affiliation. At a minimum, credit monitoring services shall include: (i) Triple credit bureau monitoring; (ii) Daily customer service; (iii) Alerts provided to the individual for changes and fraud; and (iv) Assistance to the individual with enrollment in the services and the use of fraud alerts. (3) Establish a dedicated call center. Call center services shall include: (i) A dedicated telephone number to contact customer service within a fixed period; (ii) Information necessary for registrants/enrollees to access credit reports and credit scores; (iii) Weekly reports on call center volume, issue escalation (i.e., those calls that cannot be handled by call center staff and must be resolved by call center management or DHS, as appropriate), and other key metrics; (iv) Escalation of calls that cannot be handled by call center staff to call center management or DHS, as appropriate; (v) Customized Frequently Asked Questions, approved in writing by the Contracting Officer in coordination with the Component or Headquarters Privacy Officer; and (vi) Information for registrants to contact customer service representatives and fraud resolution representatives for credit monitoring assistance. |
Shipping Information
| City | State | Zip Code | Country |
|---|---|---|---|
| See Place of Performance | |||
Seller Attachment(s): Required
| Performance Work Statement IAW the Statement of Objectives |
Buy Attachment(s)
| No. | Document Name | Document Size | |
|---|---|---|---|
| 001 | Statement_of_Objectives.pdf | 429 KB |