USAID Acquisition Regulation (AIDAR): Security and Information Technology Requirements, 19754-19760 [2024-05748]
Download as PDF
<![CDATA[
19754
Federal Register / Vol. 89, No. 55 / Wednesday, March 20, 2024 / Rules and Regulations
APPENDIX C TO PART 4—ALPHABETICAL INDEX OF DISABILITIES—Continued
Diagnostic
code No.
*
*
*
BILLING CODE 8320–01–P
AGENCY FOR INTERNATIONAL
DEVELOPMENT
48 CFR Chapter 7
RIN 0412–AA87
USAID Acquisition Regulation
(AIDAR): Security and Information
Technology Requirements
U.S. Agency for International
Development.
ACTION: Final rule.
AGENCY:
This final rule amends the
U.S. Agency for International
Development (USAID) Acquisition
Regulation (AIDAR) to incorporate a
revised definition of ‘‘information
technology’’ (IT) and new contract
clauses relating to information security,
cybersecurity, and IT resources. The
purpose of these revisions is to provide
increased oversight of contractor
acquisition and use of IT resources.
DATES: This final rule is effective May
20, 2024.
FOR FURTHER INFORMATION CONTACT:
Jasen Andersen, Procurement Analyst,
USAID M/OAA/P, at 202–286–3116 or
policymailbox@usaid.gov for
clarification of content or information
pertaining to status or publication
schedules. All communications
regarding this rule must cite RIN No.
0412–AA87.
SUPPLEMENTARY INFORMATION:
SUMMARY:
khammond on DSKJM1Z7X2PROD with RULES
A. Background
USAID published a proposed rule on
March 21, 2019 (84 FR 10469) to amend
the AIDAR to implement various
requirements related to information
security and IT resources that support
the operations and assets of the agency,
including those managed by contractors.
These new requirements will strengthen
protections of agency information
systems and facilities. The public
comment period closed on May 20,
2019.
B. Discussion and Analysis
USAID updated the final rule to
incorporate feedback from public
comments, streamline requirements by
15:46 Mar 19, 2024
Jkt 262001
*
removing duplicative or unnecessary
elements from the rule, and maintain
consistency with the Federal
Acquisition Regulation (FAR). USAID
received four public comments in
response to the proposed rule. USAID
assessed the public comments in the
development of the final rule. The full
text of the comments is available at the
Federal Rulemaking Portal,
www.regulations.gov. A summary of the
comments, USAID’s responses, and
changes made to the rule as a result are
as follows:
[FR Doc. 2024–05138 Filed 3–19–24; 8:45 am]
VerDate Sep<11>2014
*
(1) Summary of Significant Changes
The following significant changes
from the proposed rule are made in the
final rule, organized below using the
section titles from the proposed rule:
(i) AIDAR Part 739, Acquisition of
Information Technology. No changes
were made to the definition of
‘‘information technology’’ as a result of
the public comments received. Minor
administrative changes were made to
revise AIDAR Part 739 to add a section
regarding the scope of the part, as well
as the prescriptions for the applicable
contract clauses included in this final
rule.
(ii) AIDAR 752.204–72 Homeland
Security Presidential Directive–12
(HSPD–12) and Personal Identity
Verification (PIV). Several changes were
made to this clause as a result of the
public comments received. In response
to a commenter’s concerns that the
proposed rule limited access to only
U.S. citizens and resident aliens, USAID
revised the clause to clarify that various
types of credentials are available to
different types of users—including nonU.S. citizens—who require physical
access to USAID facilities and/or logical
access to USAID information systems.
Similarly, revisions also update the
forms of identity source documents that
must be presented to the Enrollment
Office personnel, based on the
credential type, as well as applicability
of any security background
investigation. To avoid confusion
generated by the reference to the PIV
credential, which may only be issued to
U.S. citizens and resident aliens, USAID
reverted the title of the clause back to
its prior name, ‘‘Access to USAID
Facilities and USAID’s Information
Systems.’’ The revisions also provide
clarity regarding the contents of the
PO 00000
Frm 00026
Fmt 4700
Sfmt 4700
*
*
monthly staffing report required by the
clause. Finally, a new Subpart 704.13
was created to house the prescription
for this clause, with this prescription
moved from AIDAR 704.404 to AIDAR
704.1303.
(iii) AIDAR 752.204–XX USAIDFinanced Third-Party Websites. The
public comments led to several
revisions in this clause. One commenter
highlighted that the clause did not
differentiate appropriately between a
contractor’s website used to implement
a project versus a Federal agency’s
website maintained by a contractor on
behalf of the agency. In its subsequent
analysis, USAID further determined that
‘‘third-party website,’’ as defined in
OMB Memorandum No. M–10–23
(‘‘Guidance for Agency Use of ThirdParty Websites and Applications’’), was
not the correct terminology for this
clause. While the contract funds the
website, the contractor does not operate
the website on the agency’s behalf.
Instead, the final rule now defines a
new term and establishes applicability
of the clause to ‘‘project websites.’’ As
further explained in this new definition,
there are multiple differentiators that
distinguish a ‘‘project website’’ from a
‘‘Federal agency website’’ under OMB
Memorandum No. M–23–10 (‘‘The
Registration and Use of .gov Domains in
the Federal Government’’)—where it is
hosted, who is responsible for all
operations and management, whether
the website is operated on behalf of
USAID, and whether the website
provides official communications,
information, or services from USAID.
USAID renamed the clause to ‘‘USAIDFinanced Project Websites’’ to reflect
this change in terminology. In addition,
based on public comments, USAID
removed certain requirements from the
clause, such as the notification to and
approval from the Contracting Officer’s
Representative and the USAID
Legislative and Public Affairs (LPA)
division, or the authorization of USAID
to conduct periodic vulnerability scans.
Instead, the contractor is solely
responsible for all project website
content, operations, management,
information security, and disposition.
Other requirements were removed from
the clause because they are covered by
other standard contract requirements—
for example, USAID branding/marking
requirements were removed from this
E:\FR\FM\20MRR1.SGM
20MRR1
khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 89, No. 55 / Wednesday, March 20, 2024 / Rules and Regulations
clause, as they are typically addressed
in a branding/marking plan required
elsewhere in the contract.
(iv) AIDAR 752.239–XX Limitation on
Acquisition of Information Technology
and AIDAR 752.239–XX Use of
Information Technology Approval. As a
result of the public comments received,
these two overlapping clauses from the
proposed rule were combined into a
single AIDAR 752.239–70 (‘‘Information
Technology Authorization’’) clause in
the final rule. USAID believes this
provides better clarity and promotes
consistency in the IT approval process.
No change was made to the definition
of ‘‘information technology’’ used in
this clause. Instead, the revisions focus
on clarifying procedures that a
contractor must follow in seeking
approval of any IT not specified in the
schedule of the contract. The revised
clause provides more details regarding
the contents of any approval request. In
addition, the revised clause allows
written approval, removing the burden
of requiring a contract modification to
indicate approval of additional IT by the
Contracting Officer.
(v) AIDAR 752.239–XX Software
License. Based on the public comments
received, USAID re-evaluated the need
for this clause. As noted in some of the
public comments, this clause presents
challenges due to the commercial nature
of the transaction between the
contractor and the software vendor, as
well as concerns regarding privity of
contract, if the U.S. Government
imposes additional ‘‘addendum’’
requirements. After consideration of the
public comments and further analysis—
including assessing which elements of
this clause may be addressed elsewhere
in the FAR, such as in the contract cost
principles in FAR Part 31—USAID
determined that this clause is no longer
needed and removed it from the final
rule. While this ‘‘Software License’’
clause is no longer part of this rule,
USAID reminds contractors that
software acquisitions must adhere to
other applicable contractual
requirements, including the IT approval
requirements outlined in the revised
AIDAR 752.239–70 (‘‘Information
Technology Authorization’’) clause.
(vi) AIDAR 752.239–XX Information
and Communication Technology
Accessibility. Revisions were made to
this clause to clarify the requirements
and applicability of Section 508 of the
Rehabilitation Act of 1973, as amended,
to information and communication
technology (ICT) supplies and services.
One significant change is the removal of
the full list of Section 508 accessibility
standards. Instead, the clause notes that
the specific applicable standards must
VerDate Sep<11>2014
15:46 Mar 19, 2024
Jkt 262001
be identified elsewhere in the contract
(e.g., in Section C), in alignment with
FAR Subpart 39.1. USAID also revised
the clause to incorporate procedures to
enable the Government to determine
whether delivered supplies or services
conform to Section 508 accessibility
standards. In order to ensure full
compliance of all ICT supplies and
services delivered under a contract with
Section 508 requirements, USAID added
a flow-down requirement to apply the
clause to subcontractors.
(vii) AIDAR 752.239–XX Skills and
Certification Requirements for Privacy
and Security Staff. Based on the public
comments received, USAID re-evaluated
the need for this clause. After further
assessment, USAID removed this clause
from the final rule. In alignment with
the ‘‘National Cyber Workforce and
Education Strategy’’ issued by the Office
of the National Cyber Director in July
2023, USAID will use a skills-based
approach rather than relying solely on
educational qualifications and industryrecognized certifications.
(viii) Clause prescriptions.
Throughout the final rule, the
prescriptions for each clause have been
revised to ensure clarity in the
instructions, as well as alignment with
the AIDAR text where the topic is
addressed.
(2) Summary of and Response to Public
Comments
USAID reviewed the public comments
in the development of the final rule. A
discussion of the comments is provided
as follows:
(i) Definition of ‘‘Information
Technology’’ and Applicability of the
Rule
Comment: Three commenters
submitted comments regarding the
definition of ‘‘information technology’’
(IT) and the applicability of the IT
authorization requirements in two
clauses in the proposed rule
(‘‘Limitation on Acquisition of
Information Technology’’ and ‘‘Use of
Information Technology Approval’’).
These commenters indicated the
definition of IT was confusing and that
Contracting Officers may interpret the
definition differently, resulting in
inconsistent application of the rule and
delays in contract performance. These
commenters questioned whether all
technology acquisitions—such as
computers, laptops, printers, other
commercial products and services, and
commercially available off-the-shelf
(COTS) items procured by a
contractor—are within the scope of
these IT authorization requirements.
These commenters suggested that this
PO 00000
Frm 00027
Fmt 4700
Sfmt 4700
19755
rule should only apply to USAID
infrastructure only, such as computer
systems that interface directly with
USAID internal IT systems.
Response: This rule uses the
definition of ‘‘information technology’’
issued by the Office of Management and
Budget (OMB) in OMB Memorandum
M–15–14 (‘‘Management and Oversight
of Federal Information Technology’’),
pursuant to the Federal Information
Technology Acquisition Reform Act
(FITARA). USAID continues to use this
definition in the final rule in order to
maintain consistency with OMB
guidance and FITARA implementation
principles.
To simplify the rule and promote
consistency in its application, USAID
has combined the prior two clauses
(‘‘Limitation on Acquisition of
Information Technology’’ and ‘‘Use of
Information Technology Approval’’)
from the proposed rule into a single
AIDAR 752.239–70 (‘‘Information
Technology Authorization’’) clause in
the final rule.
OMB’s FITARA definition of IT
adopted by USAID for this rule applies
to any services or equipment ‘‘used by
an agency,’’ which—as further defined
in the clause—includes ‘‘if used by the
agency directly or if used by a
contractor under a contract with the
agency . . .’’ This clause applies to all
such IT, including hardware (e.g.,
computers, laptops, desktops, tablets,
printers, etc.), infrastructure equipment
(e.g, networking equipment, routers,
switches, firewalls, etc.), software
including software as a service (SaaS),
cloud services, artificial intelligence
(AI) and emerging information
technologies, and other commercial
items and COTS technology. The
applicability of this clause and the
definition of ‘‘information technology’’
do not solely depend on whether the
items directly interface with USAID
internal IT systems or connect to the
Agency’s infrastructure.
To further assist Contracting Officers
in the consistent application of this rule,
USAID provides direction and guidance
to Agency staff, such as in Automated
Directives System (ADS) Chapter 509
available at https://www.usaid.gov/
about-us/agency-policy/series-500/509,
that is consistent with OMB resources
and FITARA.
(ii) IT Procurements for Counterparts
Comment: One commenter indicated
support for the proposed rule and its
importance in fulfilling the Agency’s
responsibility to govern the
organization’s technology infrastructure,
but questioned whether it was within
the FITARA statutory authority to apply
E:\FR\FM\20MRR1.SGM
20MRR1
19756
Federal Register / Vol. 89, No. 55 / Wednesday, March 20, 2024 / Rules and Regulations
khammond on DSKJM1Z7X2PROD with RULES
the rule’s approval requirements to IT
that do not become part of the Agency’s
technology infrastructure. As an
example, the commenter cited
procurements of IT for international
development work with third parties
(e.g., procurements of IT for host
country counterparts).
Response: USAID acknowledges the
support for the rule and agrees this rule
is an important measure to promote the
Agency’s oversight and stewardship of
IT resources. USAID also agrees there
are certain IT acquisitions by a
contractor that may not be subject to the
IT approval requirements established in
the AIDAR 752.239–70 (‘‘Information
Technology Authorization’’) clause. For
example, IT procured by a contractor
that is provided directly and
immediately to a host country
counterpart does not fall into this
FITARA definition of IT because it does
not meet this IT definition’s qualifier of
‘‘used by an agency.’’ Examples of IT
procured for a host country counterpart
could include a health information
management system purchased for a
host country ministry of health or
computers procured for a host country
educational institution. However, if
USAID or the contractor first ‘‘uses’’ the
services or equipment before
transferring it to a host country
counterpart, the items are then
considered to be ‘‘used by an agency,’’
as defined in the FITARA definition,
and therefore subject to the IT approval
requirements established in the AIDAR
752.239–70 (‘‘Information Technology
Authorization’’) clause. For example, if
a contractor uses a health survey tool for
any period of time that is required as
part of its performance of the contract,
and then transfers the tool to the host
country government, that tool is
considered to be IT as defined in this
FITARA definition. Because the scope
of FITARA does apply beyond the
Agency’s technology infrastructure, no
changes were made to the language in
the rule.
(iii) IT ‘‘Incidental to a Contract’’
Comment: Two commenters raised
concerns that the definition of
‘‘information technology’’ is not clear
regarding equipment acquired by a
contractor that is ‘‘incidental to a
contract.’’ One of these commenters
suggesting this ‘‘incidental’’ exception
should be deleted to avoid confusion.
Response: OMB’s FITARA definition
of IT specifically notes that the term
‘‘information technology’’ does not
include any equipment that is acquired
by a contractor incidental to a contract
that does not require use of the
equipment. Examples of ‘‘incidental’’ IT
VerDate Sep<11>2014
15:46 Mar 19, 2024
Jkt 262001
could include a contractor’s corporate
human resources systems, financial
management systems, or email
management systems, as the contractor
acquired them to assist in managing its
own resources assigned to a U.S.
Government contract. USAID believes
this ‘‘incidental’’ exclusion is a critical
element of the definition of IT in order
to maintain consistency with OMB
guidance and FITARA implementation
principles. As such, no changes were
made to this language in the rule.
(iv) USAID Resources and Timing for IT
Authorizations
Comment: For the ‘‘Limitation on
Acquisition of Information Technology’’
and ‘‘Use of Information Technology
Approval’’ clauses in the proposed rule,
two commenters expressed concerns
regarding the availability of USAID
resources to carry out the necessary
approval processes in an efficient
manner. The commenters indicated that
this authorization process may lead to
delays and significant hindrances to the
implementation of development work
by contractors, if approval is required to
‘‘purchase of every piece of IT
hardware.’’
Response: USAID’s Bureau For
Management, Office of the Chief
Information Officer (M/CIO) has
sufficient resources to efficiently fulfill
the IT approval requirements of this
rule, now reflected in a single AIDAR
752.239–70 (‘‘Information Technology
Authorization’’) clause in the final rule.
Comment: One commenter suggested
that contractor’s notification to the
Contracting Officer’s Representative
(COR)—rather than an approval from
USAID—would be more appropriate for
IT procurements included in the
offeror’s proposal and/or prime contract.
Response: Under FITARA, the CIO is
required to review and approve all IT
acquisitions. No changes are made to
these requirements.
(v) USAID’s IT Regulatory and Policy
Framework
Comment: Two commenters
questioned if this rule replaces the
procedures of USAID’s ADS Chapter
548, or if any procedures from ADS
Chapter 548 should be included in this
new rule.
Response: USAID’s policies
previously detailed in ADS Chapter 548
are obsolete and no longer applicable.
These policies were archived in May
2019.
Comment: Two commenters
questioned whether the proposed rule
would apply to IT procurements
conducted by recipients under USAID
grants and cooperative agreements.
PO 00000
Frm 00028
Fmt 4700
Sfmt 4700
Response: The content of this rule
only applies to acquisition awards (e.g.,
contracts); this rule does not apply to
federal assistance awards (e.g., grants
and cooperative agreements). ADS
Chapter 509, available at https://
www.usaid.gov/about-us/agency-policy/
series-500/509, contains further
clarification on the distinction between
acquisition and assistance for IT
procurements.
(vi) Software License Clause
Comment: Two commenters provided
comments on the AIDAR 752.239–XX
‘‘Software License’’ clause from the
proposed rule, noting potential
challenges and confusion in complying
with this clause, particularly for
commercial items and commercially
available off-the-shelf (COTS) items.
Response: USAID concurs with the
concerns noted in these comments and
has removed this clause from the final
rule.
(vii) USAID-Financed Project Websites
Clause
Comment: One commenter provided
several comments regarding the
requirements and process for the
proposed rule’s ‘‘USAID-Financed
Third-Party Websites’’ clause,
highlighting that the clause did not
distinguish appropriately between a
contractor’s website used to implement
a project versus a Federal agency’s
website. The commenter also
questioned the need for notification by
the contractor to the Contracting
Officer’s Representative (COR) for
USAID’s Bureau for Legislative and
Public Affairs (LPA) evaluation and
approval, as well as the requirement for
contractors to authorize USAID to
conduct periodic vulnerability scans.
Response: USAID agrees with several
of the commenter’s concerns. The
proposed rule did not adequately define
the type of website subject to
requirements of this clause. The final
rule contains several revisions to this
clause, most notably clarifying that it
applies to a ‘‘project website’’ funded by
USAID, which is now defined in the
final rule. This definition of ‘‘project
website’’ is distinct from a ‘‘third-party
website’’ and also provides a
differentiation from websites within the
Federal Government domain (i.e.,
‘‘.gov’’), in accordance with guidance
established in OMB Memorandum No.
M–23–10. The clause in this final rule
has been renamed to ‘‘USAID-Financed
Project websites’’ to reflect this change
in terminology. The final rule also
removes the COR/LPA notification and
approval requirements. As the
contractor is solely responsible for all
E:\FR\FM\20MRR1.SGM
20MRR1
Federal Register / Vol. 89, No. 55 / Wednesday, March 20, 2024 / Rules and Regulations
security safeguards for the website, the
final rule removes the requirement for
contractors to authorize USAID to
conduct periodic vulnerability scans.
Comment: One commenter questioned
whether this rule affects existing project
websites funded by USAID.
Response: This AIDAR 752.239–72
(‘‘USAID-Financed Project websites’’)
clause applies to any project website
developed, launched or maintained
under a prime contract that contains
this clause.
khammond on DSKJM1Z7X2PROD with RULES
(viii) Skills and Certification
Requirements Clause
Comment: For the ‘‘Skills and
Certification Requirements for Privacy
and Security Staff’’ clause, one
commenter suggested that the Certified
Information Systems Security
Professional (CISSP) certification
process is unclear and requested
clarification regarding the definition of
‘‘significant information security
responsibilities.’’
Response: USAID has removed this
clause from the final rule to maintain
consistency with the FAR and the
National Cyber Workforce and
Education Strategy issued by the Office
of the National Cyber Director, which
support using a skills-based approach
rather than relying solely on educational
qualifications and industry-recognized
certifications.
(ix) Access to USAID Facilities and
USAID’s Information Systems Clause
Comment: One commenter suggested
that the proposed personal identity
verification (PIV) clause unnecessarily
restricts physical and logical access only
to U.S. citizens and resident aliens,
prohibiting access to cooperating
country nationals (CCNs) and third
country nationals (TCNs).
Response: PIV cards may only be
issued to U.S. citizens and resident
aliens; non-U.S. citizens are not
authorized to receive PIV cards. Instead,
USAID issues PIV-Alternative (PIV–A)
cards to eligible CCNs and TCNs who
require physical or logical access, as
described further in ADS Chapter 542,
available at https://www.usaid.gov/
about-us/agency-policy/series-500/542.
USAID revised the clause to clarify that
various types of credentials are available
to different types of users who require
physical access to USAID facilities and/
or logical access to USAID information
systems.
Comment: One commenter expressed
a concern that non-U.S. citizens may not
possess a U.S. Federal or State
Government-issued picture ID for
purposes of the identity source
documentation required for obtaining
VerDate Sep<11>2014
15:46 Mar 19, 2024
Jkt 262001
credentials. One commenter noted the
rule does not specify how to identify the
appropriate Enrollment Office to work
with and physically present the identity
source documents.
Response: In the credentialing
process, two forms of identity source
documents must be presented to the
Enrollment Office personnel. The
Federal or State Government-issued
picture ID is required to obtain a PIV
card, which is available to U.S. citizens
only. For non-U.S. citizens, the
contractor may contact the COR to
request a list of acceptable forms of
documentation, as this information
varies by location. USAID updated the
clause to clarify this information.
Comment: One commenter requested
additional information regarding the
requirement for documentation of
security background investigations.
Response: Homeland Security
Presidential Directive–12 (HSPD–12)
requires that agencies complete
background investigations on all
employees and contractors when issuing
credentials. ADS Chapter 542, available
at https://www.usaid.gov/about-us/
agency-policy/series-500/542, contains
additional details regarding USAID’s
procedures related to background
investigations in the credentialing
process. USAID revised the clause to
clarify that documentation of a security
background investigation must be
submitted as part of the credentialing
process, when applicable.
Comment: One commenter suggested
that USAID harmonize access
requirements for those contractors with
CCN and TCN staff versus the
requirements for USAID’s CCN and TCN
personal services contractors.
Response: The same physical and
logical access requirements apply to
both contractor employees and
individuals issued personal services
contracts. As personal services contracts
with individuals (issued under
Appendices D and J of the AIDAR) are
not within the scope of this rule, no
changes were made to the rule.
(x) Outside the Scope of This Rule
Comment: One commenter noted that
the rule does not specify what the COR
will do with the list of individuals
reported by the contractor to the COR
each month under paragraph (d) of this
AIDAR 752.204–72 clause.
Response: The COR’s responsibilities
regarding the staffing list will be
addressed in internal Agency policy. As
such, no changes were made to the rule.
Comment: One commenter questioned
if the proposed rule impacted the use of
USAID systems such as Development
Experience Clearinghouse (DEC),
PO 00000
Frm 00029
Fmt 4700
Sfmt 4700
19757
Development Data Library (DDL), and
TrainNet.
Response: This rule does not affect
the use of DEC, DDL, or TrainNet. This
comment is outside the scope of this
rule.
Comment: One commenter noted that
the language of the proposed rule
seemed clear, but suggested the
development of a supplemental
‘‘decision guide’’ to facilitate the
interpretation of the rule’s IT approval
requirements.
Response: The commenter’s
suggestion is outside the scope of the
rule.
C. Regulatory Considerations and
Determinations
(1) Executive Orders 12866, 13563, and
14094
This final rule was drafted in
accordance with Executive Order (E.O.)
12866, as amended by E.O. 13563 and
E.O. 14094. OMB has determined that
this rule is not a ‘‘significant regulatory
action,’’ as defined in section 3(f) of E.O.
12866, as amended, and is therefore not
subject to review by OMB.
(2) Expected Cost Impact on the Public
There are no costs to the public
associated with this rulemaking.
(3) Regulatory Flexibility Act
The rule does not have a significant
economic impact on a substantial
number of small entities within the
meaning of the Regulatory Flexibility
Act, 5 U.S.C. 601, et seq. Therefore, a
Regulatory Flexibility Analysis has not
been performed.
(4) Paperwork Reduction Act
This rule contains information
collection requirements that were
detailed in the proposed rule and have
been submitted to the Office of
Management and Budget (OMB) under
the Paperwork Reduction Act (44 U.S.C.
chapter 35). This information collection
requirement has been assigned OMB
Control Number 0412–0603, entitled
‘‘Information Collection under AIDAR
Clause 752.204–72, Access to USAID
Facilities and USAID’s Information
Systems.’’ No comments were received
on the information collection outlined
in the proposed rule.
List of Subjects in 48 CFR Parts 704,
739, and 752
Government procurement.
For the reasons discussed in the
preamble, USAID amends 48 CFR parts
704, 739, and 752 as set forth below:
E:\FR\FM\20MRR1.SGM
20MRR1
19758
Federal Register / Vol. 89, No. 55 / Wednesday, March 20, 2024 / Rules and Regulations
PART 704—ADMINISTRATIVE
MATTERS
1. The authority citation for 48 CFR
part 704 continues to read as follows:
■
Authority: Sec. 621, Pub. L. 87–195, 75
Stat. 445, (22 U.S.C. 2381) as amended; E.O.
12163, Sept. 29, 1979, 44 FR 56673; 3 CFR,
1979 Comp., p. 435.
§ 704.404
[Amended]
2. Amend § 704.404 by removing and
reserving paragraph (b).
■ 3. Add Subpart 704.13 to read as
follows:
■
Subpart 704.13—Personal Identity
Verification
Sec.
704.1303
Contract clause.
§ 704.1303
Contract clause.
When contract performance requires
the contractor—including its employees,
volunteers, or subcontractor employees
at any tier—to have routine physical
access to USAID-controlled facilities or
logical access to USAID’s information
systems, the contracting officer must
insert the clause found at FAR 52.204–
9 and AIDAR 752.204–72 (‘‘Access to
USAID Facilities and USAID’s
Information Systems’’) in the
solicitation and contract.
■ 4. Add part 739 to read as follows:
Subpart 739.1—General.
PART 739—ACQUISITION OF
INFORMATION TECHNOLOGY
Sec.
739.000
739.001
739.002
§ 739.106
Scope of part.
[Reserved]
Definitions.
Subpart 739.1—General.
739.106 Contract clauses.
Authority: Sec. 621, Pub. L. 87–195, 75
Stat. 445 (22 U.S.C. 2381), as amended; E.O.
12163, Sept. 29, 1979, 44 FR 56673; and 3
CFR, 1979 Comp., p. 435.
khammond on DSKJM1Z7X2PROD with RULES
§ 739.000
Scope of part.
This part prescribes acquisition
policies and procedures for use in
acquiring—
(a) Information technology, as defined
in this part, consistent with the Federal
Information Technology Acquisition
Reform Act (FITARA).
(b) Information and communication
technology (ICT), as defined in FAR
2.101.
§ 739.001
[Reserved]
§ 739.002
Definitions.
subsystem(s) of equipment, that are
used in the automatic acquisition,
storage, analysis, evaluation,
manipulation, management, movement,
control, display, switching, interchange,
transmission, or reception of data or
information by the agency; where
(2) Such services or equipment are
‘‘used by an agency’’ if used by the
agency directly or if used by a
contractor under a contract with the
agency that requires either use of the
services or equipment or requires use of
the services or equipment to a
significant extent in the performance of
a service or the furnishing of a product.
(3) The term ‘‘information
technology’’ includes computers,
ancillary equipment (including imaging
peripherals, input, output, and storage
devices necessary for security and
surveillance), peripheral equipment
designed to be controlled by the central
processing unit of a computer, software,
firmware and similar procedures,
services (including provisioned services
such as cloud computing and support
services that support any point of the
lifecycle of the equipment or service),
and related resources.
(4) The term ‘‘information
technology’’ does not include any
equipment that is acquired by a
contractor incidental to a contract that
does not require use of the equipment.
Contract clauses.
(a) [Reserved]
(b) Contracting officers must insert the
clause at 752.239–70, Information
Technology Authorization, in all
solicitations and contracts.
(c) Contracting officers must insert the
clause at 752.239–71, Information and
Communication Technology
Accessibility, in solicitations and
contracts that include acquisition of
information and communication
technology (ICT) supplies and/or
services for use by Federal employees or
members of the public.
(d) Contracting officers must insert
the clause at 752.239–72, USAIDFinanced Project websites, in
solicitations and contracts fully or
partially funded with program funds.
PART 752—SOLICITATION
PROVISIONS AND CONTRACT
CLAUSES
5. The authority citation for part 752
continues to read as follows:
■
As used in this part—
Information Technology (IT) means
(1) Any services or equipment, or
interconnected system(s) or
VerDate Sep<11>2014
15:46 Mar 19, 2024
Jkt 262001
Authority: Sec. 621, Pub. L. 87–195, 75
Stat. 445, (22 U.S.C. 2381) as amended; E.O.
12163, Sept. 29, 1979, 44 FR 56673; 3 CFR,
1979 Comp., p. 435.
PO 00000
Frm 00030
Fmt 4700
Sfmt 4700
6. Revise § 752.204–72 to read as
follows:
■
§ 752.204–72 Access to USAID Facilities
and USAID’s Information Systems.
As prescribed in AIDAR 704.1303,
insert the following clause in Section I
of solicitations and contracts:
Access to USAID Facilities and
USAID’s Information Systems (May
2024)
(a) The Contractor must ensure that
individuals engaged in the performance of
this award as employees or volunteers of the
Contractor, or as subcontractors or
subcontractor employees at any tier, comply
with all applicable personal identity
verification (PIV) and Homeland Security
Presidential Directive–12 (HSPD–12)
procedures, including those summarized
below, and any subsequent USAID or
Government-wide procedures and policies
related to PIV or HSPD–12.
(b) An individual engaged in the
performance of this award may obtain access
to USAID facilities or logical access to
USAID’s information systems only when and
to the extent necessary to carry out this
award. USAID issues various types of
credentials to users who require physical
access to Agency facilities and/or logical
access to Agency information systems, in
accordance with USAID’s Automated
Directives System (ADS) 542, available at
https://www.usaid.gov/about-us/agencypolicy/series-500/542.
(c) (1) No later than five (5) business days
after award, unless the Contracting Officer
authorizes a longer time period, the
Contractor must provide to the Contracting
Officer’s Representative a complete list of
individuals that require access to USAID
facilities or information systems under this
contract.
(2) Before an individual may obtain a
USAID credential (new or replacement)
authorizing the individual routine access to
USAID facilities, or logical access to USAID’s
information systems, the individual must
physically present two forms of identity
source documents in original form to the
Enrollment Office personnel when
undergoing processing. To obtain a PIV card,
one identity source document must be a valid
Federal or State Government-issued picture
ID from the I–9 list available at https://
www.uscis.gov/i-9-central/form-i-9acceptable-documents. For other types of
credentials the Contractor can obtain the list
of acceptable forms from the Contracting
Officer’s Representative. Submission of these
documents, as well as documentation of any
applicable security background investigation,
is mandatory in order for the individual to
receive a credential granting facilities and/or
logical access.
(d) (1) No later than the 5th day of each
month, the Contractor must provide the
Contracting Officer’s Representative with the
following:
(i) a list of individuals with access who
were separated in the past sixty (60) calendar
days, and
E:\FR\FM\20MRR1.SGM
20MRR1
Federal Register / Vol. 89, No. 55 / Wednesday, March 20, 2024 / Rules and Regulations
(ii) a list of individuals hired in the past
sixty (60) calendar days who require access
under this contract.
(2) This information must be submitted
even if no separations or hiring occurred
during the past sixty (60) calendar days.
(3) Failure to comply with the
requirements in paragraph (d)(1) may result
in the suspension of all facilities and/or
logical access associated with this contract.
(e) The Contractor must ensure that
individuals do not share logical access to
USAID information systems and sensitive
information.
(f) USAID may suspend or terminate the
access to any systems and/or facilities in the
event of any violation, abuse, or misuse. The
suspension or termination may last until the
situation has been corrected or no longer
exists.
(g) The Contractor must notify the
Contracting Officer’s Representative and the
USAID Service Desk (CIO-HELPDESK@
usaid.gov or 202–712–1234) at least five (5)
business days prior to the removal of any
individuals with credentials from the
contract. For unplanned terminations, the
Contractor must immediately notify the
Contracting Officer’s Representative and the
USAID Service Desk. Unless otherwise
instructed by the Contracting Officer, the
Contractor must return all credentials and
remote authentication tokens to the
Contracting Officer’s Representative prior to
departure of the individual or upon
completion or termination of the contract,
whichever occurs first.
(h) The Contractor must insert this clause,
including this paragraph (h), in any
subcontracts that require the subcontractor or
a subcontractor employee to have routine
physical access to USAID facilities or logical
access to USAID’s information systems. The
Contractor is responsible for providing the
Contracting Officer’s Representative with the
information required under paragraphs (c)(1)
and (d)(1) of this clause for any applicable
subcontractor or subcontractor employee.
(End of clause)
■ 7. Add section 752.239–70 to read as
follows:
752.239–70 Information Technology
Authorization.
As prescribed in AIDAR 739.106(b),
insert the following clause in Section I
of solicitations and contracts:
khammond on DSKJM1Z7X2PROD with RULES
Information Technology Authorization
(May 2024)
(d) Definitions. As used in this contract:
Information Technology means
(1) Any services or equipment, or
interconnected system(s) or subsystem(s) of
equipment, that are used in the automatic
acquisition, storage, analysis, evaluation,
manipulation, management, movement,
control, display, switching, interchange,
transmission, or reception of data or
information by the agency; where
(2) such services or equipment are ‘‘used
by an agency’’ if used by the agency directly
or if used by a contractor under a contract
with the agency that requires either use of the
VerDate Sep<11>2014
15:46 Mar 19, 2024
Jkt 262001
services or equipment or requires use of the
services or equipment to a significant extent
in the performance of a service or the
furnishing of a product.
(3) The term ‘‘information technology’’
includes computers, ancillary equipment
(including imaging peripherals, input,
output, and storage devices necessary for
security and surveillance), peripheral
equipment designed to be controlled by the
central processing unit of a computer,
software, firmware and similar procedures,
services (including provisioned services such
as cloud computing and support services that
support any point of the lifecycle of the
equipment or service), and related resources.
(4) The term ‘‘information technology’’
does not include any equipment that is
acquired by a contractor incidental to a
contract that does not require use of the
equipment.
(b) Approval Requirements. The Federal
Information Technology Acquisition Reform
Act (FITARA) requires Agency Chief
Information Officer (CIO) review and
approval of acquisitions of information
technology and information technology
services. Any information technology
specified in the Schedule of this contract has
already been approved by the CIO. The
Contractor must not acquire any additional
information technology without the prior
written approval of the Contracting Officer as
specified in this clause.
(c) Request for Approval Procedure.
(1) If the Contractor determines that any
information technology not specified in the
Schedule will be necessary in the
performance of the contract, the Contractor
must request prior written approval from the
Contracting Officer, including the
Contracting Officer’s Representative and the
Office of the CIO (ITAuthorization@
usaid.gov) on the request.
(2) In the request, the Contractor must
provide an itemized description of the
information technology to be procured. For
equipment (including hardware and
software), the Contractor must include any
applicable brand names, model/version
numbers, quantities, and estimated unit and
total cost information. For services, the
Contractor must provide a detailed
description of the services, name(s) of the
service provider(s), and estimated cost
information.
(3) The Contracting Officer will approve or
deny in writing the Contractor’s request. If
granted, the Contracting Officer will specify
in writing the information technology
approved by the CIO for purchase.
(d) Subcontracts. The Contractor must
insert the substance of this clause, including
this paragraph (d), in all subcontracts. The
Contractor is responsible for requesting any
approval required under paragraphs (b) and
(c) of this clause for any applicable
subcontractor information technology
acquisition.
(End of clause)
8. Add § 752.239–71 to read as
follows:
■
PO 00000
Frm 00031
Fmt 4700
Sfmt 4700
19759
§ 752.239–71 Information and
Communication Technology Accessibility.
As prescribed in AIDAR 739.106(c),
insert the following clause in Section I
of solicitations and contracts:
Information and Communication
Technology Accessibility (May 2024)
(a) Section 508 of the Rehabilitation Act of
1973, as amended (29 U.S.C. 794d) requires
(1) Federal agencies to offer access to
information and communication technology
(ICT) to individuals with disabilities who are
Federal employees or members of the public
seeking information or services, and (2) that
this access be comparable to that which is
offered to Federal employees or members of
the public who are not individuals with
disabilities. Standards for complying with
this law are prescribed by the Architectural
and Transportation Barriers Compliance
Board (‘‘Access Board’’) in 36 CFR part 1194,
are viewable at https://www.accessboard.gov/ict/.
(b) Except as indicated elsewhere in the
contract, all ICT supplies, services,
information, documentation, and
deliverables developed, acquired,
maintained, or delivered under this contract
must meet the applicable Section 508
accessibility standards at 36 CFR part 1194,
as amended by the Access Board.
(c) The Section 508 accessibility standards
applicable to this contract are identified in
Section C or other applicable sections of this
contract.
(d) The Contractor must, upon written
request from the Contracting Officer, or if so
designated, the Contracting Officer’s
Representative, provide the information
necessary to assist the Government in
determining that the ICT supplies or services
conform to Section 508 accessibility
standards.
(e) If it is determined by the Government
that any ICT supplies or services delivered by
the Contractor do not conform to the required
accessibility standards, remediation of the
supplies or services to the level of
conformance specified in the contract will be
the responsibility of the Contractor at its own
expense.
(f) The Contractor must insert this clause
in all subcontracts that involve the
acquisition of ICT supplies and/or services.
The Contractor is responsible for the
submission of any information as required
under paragraph (e) of this clause.
(End of clause)
■ 9. Add § 752.239–72 to read as
follows:
§ 752.239–72
Websites.
USAID-Financed Project
As prescribed in AIDAR 739.106(d),
insert the following clause in Section I
of solicitations and contracts:
USAID-Financed Project Websites (May
2024)
(a) Definitions. As used in this contract:
Project Website means a website that is:
(1) funded under this contract;
E:\FR\FM\20MRR1.SGM
20MRR1
khammond on DSKJM1Z7X2PROD with RULES
19760
Federal Register / Vol. 89, No. 55 / Wednesday, March 20, 2024 / Rules and Regulations
(2) hosted outside of a Federal Government
domain (i.e., ‘‘.gov’’);
(3) operated exclusively by the Contractor,
who is responsible for all website content,
operations and management, information
security, and disposition of the website;
(4) not operated by or on behalf of USAID;
and
(5) does not provide official USAID
communications, information, or services.
(b) Requirements. The Contractor must
adhere to the following requirements when
developing, launching, or maintaining a
Project website:
(1) Domain name. The domain name of the
website must not contain the term ‘‘USAID’’.
The domain name must be registered in the
Contractor’s business name with the relevant
domain registrar on the relevant domain
name registry.
(2) Information to be collected. In the
website, the Contractor may collect only the
amount of information necessary to complete
the specific business need. The Contractor
must not collect or store privacy information
that is unnecessary for the website to operate,
or is prohibited by statute, regulation, or
Executive Order.
(3) Disclaimer. The website must be
marked on the index page of the site and
every major entry point to the website with
a disclaimer that states: ‘‘The information
provided on this website is not official U.S.
Government information and does not
represent the views or positions of the U.S.
Agency for International Development or the
U.S. Government.’’
(4) Accessibility. To comply with the
requirements of the Section 508 of the
Rehabilitation Act, as amended (29 U.S.C.
794d), the Contractor must ensure the
website meets all applicable accessibility
standards (‘‘Web-based intranet and internet
information and applications’’) at 36 CFR
part 1194, Appendix D.
(5) Information security: The Contractor is
solely responsible for the information
security of the website. This includes
incident response activities as well as all
security safeguards, including adequate
protection from unauthorized access,
alteration, disclosure, or misuse of
information collected, processed, stored,
transmitted, or published on the website. The
Contractor must minimize and mitigate
security risks, promote the integrity and
availability of website information, and use
state-of-the-art: system/software
management; engineering and development;
event logging; and secure-coding practices
that are equal to or better than USAID
standards and information security best
practices. Rigorous security safeguards,
including but not limited to, virus protection;
network intrusion detection and prevention
programs; and vulnerability management
systems must be implemented and critical
security issues must be resolved within 30
calendar days.
(c) Disposition. At least 120 days prior to
the contract end date, unless otherwise
approved by the Contracting Officer, the
Contractor must submit for the Contracting
Officer’s approval a disposition plan that
addresses how any Project website funded
under this contract will be transitioned to
another entity or decommissioned and
archived. If the website will be transitioned
to another entity, the disposition plan must
provide details on the Contractor’s proposed
approach for the transfer of associated
electronic records, technical documentation
regarding the website’s development and
maintenance, and event logs. Prior to the end
of the contract, the Contractor must comply
with the disposition plan approved by the
Contracting Officer.
(d) Subcontracts. The Contractor must
insert this clause in all subcontracts that
involve the development, launch, or
maintenance of a Project website. The
Contractor is responsible for the submission
of any information as required under
paragraphs (b) and (c) of this clause.
(End of clause)
Jami J. Rodgers,
Chief Acquisition Officer.
[FR Doc. 2024–05748 Filed 3–19–24; 8:45 am]
BILLING CODE 6116–01–P
DEPARTMENT OF COMMERCE
National Oceanic and Atmospheric
Administration
50 CFR Part 648
[Docket No. 240315–0081]
RIN 0648–BM55
Fisheries of the Northeastern United
States; Mid-Atlantic Blueline Tilefish
and Golden Tilefish Fisheries; 2024
Specifications
National Marine Fisheries
Service (NMFS), National Oceanic and
Atmospheric Administration (NOAA),
Commerce.
ACTION: Final rule.
AGENCY:
This final rule implements
status quo harvest limits for the 2024
golden tilefish and blueline tilefish
fisheries north of the North Carolina/
Virginia border, shifts the recreational
season for blueline tilefish to May 15
through November 14, and modifies
regulations to reflect the January 1 start
date of the golden tilefish fishing year.
The action is necessary to establish
allowable harvest levels and other
management measures to prevent
overfishing while allowing optimum
yield, consistent with the Magnuson-
SUMMARY:
Stevens Fishery Conservation and
Management Act and the Tilefish
Fishery Management Plan.
DATES:
This rule is effective April 19,
2024.
Copies of the supporting
documents for this action are available
from Dr. Christopher M. Moore,
Executive Director, Mid-Atlantic
Fishery Management Council, 800 North
State Street, Suite 201, Dover, DE 19901.
These documents are also accessible via
the internet at https://www.mafmc.org.
ADDRESSES:
FOR FURTHER INFORMATION CONTACT:
Douglas Potts, douglas.potts@noaa.gov,
978–281–9241.
SUPPLEMENTARY INFORMATION:
Background
The Mid-Atlantic Fishery
Management Council (the Council)
manages the golden tilefish and blueline
tilefish fisheries north of the North
Carolina/Virginia border under the
Tilefish Fishery Management Plan
(FMP), which outlines the Council’s
process for establishing annual
specifications. The Tilefish FMP
requires the Council to recommend the
acceptable biological catch (ABC),
annual catch limit (ACL), annual catch
target (ACT), total allowable landings
(TAL), and other management measures
for the commercial and recreational
sectors of the fisheries. Detailed
information about the development of
these specifications was provided in the
specifications proposed rule (88 FR
77944, November 14, 2023). That
information is not repeated here.
Specifications
The 2024 specifications for blueline
tilefish and golden tilefish are detailed
in tables 1 and 2. The regulations at 50
CFR 648.293(b)(2) specify that
commercial landings of blueline tilefish
in excess of the commercial ACL will be
deducted from the commercial ACL the
following year. NMFS closed the 2023
commercial blueline tilefish fishery on
September 5, 2023 (88 FR 60597),
because 100 percent of the commercial
TAL was projected to have been caught.
Total commercial blueline tilefish
landings in 2023 were 31,339 pounds
(lb) (14,215 kilograms (kg)), which
exceeded the 2023 commercial ACL by
4,470 lb (2,028 kg). Therefore, that
amount is deducted from the 2024
commercial ACL.
TABLE 1—BLUELINE TILEFISH 2024 SPECIFICATIONS
ABC—North of NC/VA line .............................................................................................................................................
Recreational ACL/ACT ...................................................................................................................................................
VerDate Sep<11>2014
15:46 Mar 19, 2024
Jkt 262001
PO 00000
Frm 00032
Fmt 4700
Sfmt 4700
E:\FR\FM\20MRR1.SGM
20MRR1
100,520 lb (45.6 mt).
73,380 lb (33.3 mt).
]]>Agencies
[Federal Register Volume 89, Number 55 (Wednesday, March 20, 2024)]
[Rules and Regulations]
[Pages 19754-19760]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-05748]
=======================================================================
-----------------------------------------------------------------------
AGENCY FOR INTERNATIONAL DEVELOPMENT
48 CFR Chapter 7
RIN 0412-AA87
USAID Acquisition Regulation (AIDAR): Security and Information
Technology Requirements
AGENCY: U.S. Agency for International Development.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This final rule amends the U.S. Agency for International
Development (USAID) Acquisition Regulation (AIDAR) to incorporate a
revised definition of ``information technology'' (IT) and new contract
clauses relating to information security, cybersecurity, and IT
resources. The purpose of these revisions is to provide increased
oversight of contractor acquisition and use of IT resources.
DATES: This final rule is effective May 20, 2024.
FOR FURTHER INFORMATION CONTACT: Jasen Andersen, Procurement Analyst,
USAID M/OAA/P, at 202-286-3116 or [email protected] for
clarification of content or information pertaining to status or
publication schedules. All communications regarding this rule must cite
RIN No. 0412-AA87.
SUPPLEMENTARY INFORMATION:
A. Background
USAID published a proposed rule on March 21, 2019 (84 FR 10469) to
amend the AIDAR to implement various requirements related to
information security and IT resources that support the operations and
assets of the agency, including those managed by contractors. These new
requirements will strengthen protections of agency information systems
and facilities. The public comment period closed on May 20, 2019.
B. Discussion and Analysis
USAID updated the final rule to incorporate feedback from public
comments, streamline requirements by removing duplicative or
unnecessary elements from the rule, and maintain consistency with the
Federal Acquisition Regulation (FAR). USAID received four public
comments in response to the proposed rule. USAID assessed the public
comments in the development of the final rule. The full text of the
comments is available at the Federal Rulemaking Portal,
www.regulations.gov. A summary of the comments, USAID's responses, and
changes made to the rule as a result are as follows:
(1) Summary of Significant Changes
The following significant changes from the proposed rule are made
in the final rule, organized below using the section titles from the
proposed rule:
(i) AIDAR Part 739, Acquisition of Information Technology. No
changes were made to the definition of ``information technology'' as a
result of the public comments received. Minor administrative changes
were made to revise AIDAR Part 739 to add a section regarding the scope
of the part, as well as the prescriptions for the applicable contract
clauses included in this final rule.
(ii) AIDAR 752.204-72 Homeland Security Presidential Directive-12
(HSPD-12) and Personal Identity Verification (PIV). Several changes
were made to this clause as a result of the public comments received.
In response to a commenter's concerns that the proposed rule limited
access to only U.S. citizens and resident aliens, USAID revised the
clause to clarify that various types of credentials are available to
different types of users--including non-U.S. citizens--who require
physical access to USAID facilities and/or logical access to USAID
information systems. Similarly, revisions also update the forms of
identity source documents that must be presented to the Enrollment
Office personnel, based on the credential type, as well as
applicability of any security background investigation. To avoid
confusion generated by the reference to the PIV credential, which may
only be issued to U.S. citizens and resident aliens, USAID reverted the
title of the clause back to its prior name, ``Access to USAID
Facilities and USAID's Information Systems.'' The revisions also
provide clarity regarding the contents of the monthly staffing report
required by the clause. Finally, a new Subpart 704.13 was created to
house the prescription for this clause, with this prescription moved
from AIDAR 704.404 to AIDAR 704.1303.
(iii) AIDAR 752.204-XX USAID-Financed Third-Party Websites. The
public comments led to several revisions in this clause. One commenter
highlighted that the clause did not differentiate appropriately between
a contractor's website used to implement a project versus a Federal
agency's website maintained by a contractor on behalf of the agency. In
its subsequent analysis, USAID further determined that ``third-party
website,'' as defined in OMB Memorandum No. M-10-23 (``Guidance for
Agency Use of Third-Party Websites and Applications''), was not the
correct terminology for this clause. While the contract funds the
website, the contractor does not operate the website on the agency's
behalf. Instead, the final rule now defines a new term and establishes
applicability of the clause to ``project websites.'' As further
explained in this new definition, there are multiple differentiators
that distinguish a ``project website'' from a ``Federal agency
website'' under OMB Memorandum No. M-23-10 (``The Registration and Use
of .gov Domains in the Federal Government'')--where it is hosted, who
is responsible for all operations and management, whether the website
is operated on behalf of USAID, and whether the website provides
official communications, information, or services from USAID. USAID
renamed the clause to ``USAID-Financed Project Websites'' to reflect
this change in terminology. In addition, based on public comments,
USAID removed certain requirements from the clause, such as the
notification to and approval from the Contracting Officer's
Representative and the USAID Legislative and Public Affairs (LPA)
division, or the authorization of USAID to conduct periodic
vulnerability scans. Instead, the contractor is solely responsible for
all project website content, operations, management, information
security, and disposition. Other requirements were removed from the
clause because they are covered by other standard contract
requirements--for example, USAID branding/marking requirements were
removed from this
[[Page 19755]]
clause, as they are typically addressed in a branding/marking plan
required elsewhere in the contract.
(iv) AIDAR 752.239-XX Limitation on Acquisition of Information
Technology and AIDAR 752.239-XX Use of Information Technology Approval.
As a result of the public comments received, these two overlapping
clauses from the proposed rule were combined into a single AIDAR
752.239-70 (``Information Technology Authorization'') clause in the
final rule. USAID believes this provides better clarity and promotes
consistency in the IT approval process. No change was made to the
definition of ``information technology'' used in this clause. Instead,
the revisions focus on clarifying procedures that a contractor must
follow in seeking approval of any IT not specified in the schedule of
the contract. The revised clause provides more details regarding the
contents of any approval request. In addition, the revised clause
allows written approval, removing the burden of requiring a contract
modification to indicate approval of additional IT by the Contracting
Officer.
(v) AIDAR 752.239-XX Software License. Based on the public comments
received, USAID re-evaluated the need for this clause. As noted in some
of the public comments, this clause presents challenges due to the
commercial nature of the transaction between the contractor and the
software vendor, as well as concerns regarding privity of contract, if
the U.S. Government imposes additional ``addendum'' requirements. After
consideration of the public comments and further analysis--including
assessing which elements of this clause may be addressed elsewhere in
the FAR, such as in the contract cost principles in FAR Part 31--USAID
determined that this clause is no longer needed and removed it from the
final rule. While this ``Software License'' clause is no longer part of
this rule, USAID reminds contractors that software acquisitions must
adhere to other applicable contractual requirements, including the IT
approval requirements outlined in the revised AIDAR 752.239-70
(``Information Technology Authorization'') clause.
(vi) AIDAR 752.239-XX Information and Communication Technology
Accessibility. Revisions were made to this clause to clarify the
requirements and applicability of Section 508 of the Rehabilitation Act
of 1973, as amended, to information and communication technology (ICT)
supplies and services. One significant change is the removal of the
full list of Section 508 accessibility standards. Instead, the clause
notes that the specific applicable standards must be identified
elsewhere in the contract (e.g., in Section C), in alignment with FAR
Subpart 39.1. USAID also revised the clause to incorporate procedures
to enable the Government to determine whether delivered supplies or
services conform to Section 508 accessibility standards. In order to
ensure full compliance of all ICT supplies and services delivered under
a contract with Section 508 requirements, USAID added a flow-down
requirement to apply the clause to subcontractors.
(vii) AIDAR 752.239-XX Skills and Certification Requirements for
Privacy and Security Staff. Based on the public comments received,
USAID re-evaluated the need for this clause. After further assessment,
USAID removed this clause from the final rule. In alignment with the
``National Cyber Workforce and Education Strategy'' issued by the
Office of the National Cyber Director in July 2023, USAID will use a
skills-based approach rather than relying solely on educational
qualifications and industry-recognized certifications.
(viii) Clause prescriptions. Throughout the final rule, the
prescriptions for each clause have been revised to ensure clarity in
the instructions, as well as alignment with the AIDAR text where the
topic is addressed.
(2) Summary of and Response to Public Comments
USAID reviewed the public comments in the development of the final
rule. A discussion of the comments is provided as follows:
(i) Definition of ``Information Technology'' and Applicability of the
Rule
Comment: Three commenters submitted comments regarding the
definition of ``information technology'' (IT) and the applicability of
the IT authorization requirements in two clauses in the proposed rule
(``Limitation on Acquisition of Information Technology'' and ``Use of
Information Technology Approval''). These commenters indicated the
definition of IT was confusing and that Contracting Officers may
interpret the definition differently, resulting in inconsistent
application of the rule and delays in contract performance. These
commenters questioned whether all technology acquisitions--such as
computers, laptops, printers, other commercial products and services,
and commercially available off-the-shelf (COTS) items procured by a
contractor--are within the scope of these IT authorization
requirements. These commenters suggested that this rule should only
apply to USAID infrastructure only, such as computer systems that
interface directly with USAID internal IT systems.
Response: This rule uses the definition of ``information
technology'' issued by the Office of Management and Budget (OMB) in OMB
Memorandum M-15-14 (``Management and Oversight of Federal Information
Technology''), pursuant to the Federal Information Technology
Acquisition Reform Act (FITARA). USAID continues to use this definition
in the final rule in order to maintain consistency with OMB guidance
and FITARA implementation principles.
To simplify the rule and promote consistency in its application,
USAID has combined the prior two clauses (``Limitation on Acquisition
of Information Technology'' and ``Use of Information Technology
Approval'') from the proposed rule into a single AIDAR 752.239-70
(``Information Technology Authorization'') clause in the final rule.
OMB's FITARA definition of IT adopted by USAID for this rule
applies to any services or equipment ``used by an agency,'' which--as
further defined in the clause--includes ``if used by the agency
directly or if used by a contractor under a contract with the agency .
. .'' This clause applies to all such IT, including hardware (e.g.,
computers, laptops, desktops, tablets, printers, etc.), infrastructure
equipment (e.g, networking equipment, routers, switches, firewalls,
etc.), software including software as a service (SaaS), cloud services,
artificial intelligence (AI) and emerging information technologies, and
other commercial items and COTS technology. The applicability of this
clause and the definition of ``information technology'' do not solely
depend on whether the items directly interface with USAID internal IT
systems or connect to the Agency's infrastructure.
To further assist Contracting Officers in the consistent
application of this rule, USAID provides direction and guidance to
Agency staff, such as in Automated Directives System (ADS) Chapter 509
available at https://www.usaid.gov/about-us/agency-policy/series-500/509, that is consistent with OMB resources and FITARA.
(ii) IT Procurements for Counterparts
Comment: One commenter indicated support for the proposed rule and
its importance in fulfilling the Agency's responsibility to govern the
organization's technology infrastructure, but questioned whether it was
within the FITARA statutory authority to apply
[[Page 19756]]
the rule's approval requirements to IT that do not become part of the
Agency's technology infrastructure. As an example, the commenter cited
procurements of IT for international development work with third
parties (e.g., procurements of IT for host country counterparts).
Response: USAID acknowledges the support for the rule and agrees
this rule is an important measure to promote the Agency's oversight and
stewardship of IT resources. USAID also agrees there are certain IT
acquisitions by a contractor that may not be subject to the IT approval
requirements established in the AIDAR 752.239-70 (``Information
Technology Authorization'') clause. For example, IT procured by a
contractor that is provided directly and immediately to a host country
counterpart does not fall into this FITARA definition of IT because it
does not meet this IT definition's qualifier of ``used by an agency.''
Examples of IT procured for a host country counterpart could include a
health information management system purchased for a host country
ministry of health or computers procured for a host country educational
institution. However, if USAID or the contractor first ``uses'' the
services or equipment before transferring it to a host country
counterpart, the items are then considered to be ``used by an agency,''
as defined in the FITARA definition, and therefore subject to the IT
approval requirements established in the AIDAR 752.239-70
(``Information Technology Authorization'') clause. For example, if a
contractor uses a health survey tool for any period of time that is
required as part of its performance of the contract, and then transfers
the tool to the host country government, that tool is considered to be
IT as defined in this FITARA definition. Because the scope of FITARA
does apply beyond the Agency's technology infrastructure, no changes
were made to the language in the rule.
(iii) IT ``Incidental to a Contract''
Comment: Two commenters raised concerns that the definition of
``information technology'' is not clear regarding equipment acquired by
a contractor that is ``incidental to a contract.'' One of these
commenters suggesting this ``incidental'' exception should be deleted
to avoid confusion.
Response: OMB's FITARA definition of IT specifically notes that the
term ``information technology'' does not include any equipment that is
acquired by a contractor incidental to a contract that does not require
use of the equipment. Examples of ``incidental'' IT could include a
contractor's corporate human resources systems, financial management
systems, or email management systems, as the contractor acquired them
to assist in managing its own resources assigned to a U.S. Government
contract. USAID believes this ``incidental'' exclusion is a critical
element of the definition of IT in order to maintain consistency with
OMB guidance and FITARA implementation principles. As such, no changes
were made to this language in the rule.
(iv) USAID Resources and Timing for IT Authorizations
Comment: For the ``Limitation on Acquisition of Information
Technology'' and ``Use of Information Technology Approval'' clauses in
the proposed rule, two commenters expressed concerns regarding the
availability of USAID resources to carry out the necessary approval
processes in an efficient manner. The commenters indicated that this
authorization process may lead to delays and significant hindrances to
the implementation of development work by contractors, if approval is
required to ``purchase of every piece of IT hardware.''
Response: USAID's Bureau For Management, Office of the Chief
Information Officer (M/CIO) has sufficient resources to efficiently
fulfill the IT approval requirements of this rule, now reflected in a
single AIDAR 752.239-70 (``Information Technology Authorization'')
clause in the final rule.
Comment: One commenter suggested that contractor's notification to
the Contracting Officer's Representative (COR)--rather than an approval
from USAID--would be more appropriate for IT procurements included in
the offeror's proposal and/or prime contract.
Response: Under FITARA, the CIO is required to review and approve
all IT acquisitions. No changes are made to these requirements.
(v) USAID's IT Regulatory and Policy Framework
Comment: Two commenters questioned if this rule replaces the
procedures of USAID's ADS Chapter 548, or if any procedures from ADS
Chapter 548 should be included in this new rule.
Response: USAID's policies previously detailed in ADS Chapter 548
are obsolete and no longer applicable. These policies were archived in
May 2019.
Comment: Two commenters questioned whether the proposed rule would
apply to IT procurements conducted by recipients under USAID grants and
cooperative agreements.
Response: The content of this rule only applies to acquisition
awards (e.g., contracts); this rule does not apply to federal
assistance awards (e.g., grants and cooperative agreements). ADS
Chapter 509, available at https://www.usaid.gov/about-us/agency-policy/series-500/509, contains further clarification on the distinction
between acquisition and assistance for IT procurements.
(vi) Software License Clause
Comment: Two commenters provided comments on the AIDAR 752.239-XX
``Software License'' clause from the proposed rule, noting potential
challenges and confusion in complying with this clause, particularly
for commercial items and commercially available off-the-shelf (COTS)
items.
Response: USAID concurs with the concerns noted in these comments
and has removed this clause from the final rule.
(vii) USAID-Financed Project Websites Clause
Comment: One commenter provided several comments regarding the
requirements and process for the proposed rule's ``USAID-Financed
Third-Party Websites'' clause, highlighting that the clause did not
distinguish appropriately between a contractor's website used to
implement a project versus a Federal agency's website. The commenter
also questioned the need for notification by the contractor to the
Contracting Officer's Representative (COR) for USAID's Bureau for
Legislative and Public Affairs (LPA) evaluation and approval, as well
as the requirement for contractors to authorize USAID to conduct
periodic vulnerability scans.
Response: USAID agrees with several of the commenter's concerns.
The proposed rule did not adequately define the type of website subject
to requirements of this clause. The final rule contains several
revisions to this clause, most notably clarifying that it applies to a
``project website'' funded by USAID, which is now defined in the final
rule. This definition of ``project website'' is distinct from a
``third-party website'' and also provides a differentiation from
websites within the Federal Government domain (i.e., ``.gov''), in
accordance with guidance established in OMB Memorandum No. M-23-10. The
clause in this final rule has been renamed to ``USAID-Financed Project
websites'' to reflect this change in terminology. The final rule also
removes the COR/LPA notification and approval requirements. As the
contractor is solely responsible for all
[[Page 19757]]
security safeguards for the website, the final rule removes the
requirement for contractors to authorize USAID to conduct periodic
vulnerability scans.
Comment: One commenter questioned whether this rule affects
existing project websites funded by USAID.
Response: This AIDAR 752.239-72 (``USAID-Financed Project
websites'') clause applies to any project website developed, launched
or maintained under a prime contract that contains this clause.
(viii) Skills and Certification Requirements Clause
Comment: For the ``Skills and Certification Requirements for
Privacy and Security Staff'' clause, one commenter suggested that the
Certified Information Systems Security Professional (CISSP)
certification process is unclear and requested clarification regarding
the definition of ``significant information security
responsibilities.''
Response: USAID has removed this clause from the final rule to
maintain consistency with the FAR and the National Cyber Workforce and
Education Strategy issued by the Office of the National Cyber Director,
which support using a skills-based approach rather than relying solely
on educational qualifications and industry-recognized certifications.
(ix) Access to USAID Facilities and USAID's Information Systems Clause
Comment: One commenter suggested that the proposed personal
identity verification (PIV) clause unnecessarily restricts physical and
logical access only to U.S. citizens and resident aliens, prohibiting
access to cooperating country nationals (CCNs) and third country
nationals (TCNs).
Response: PIV cards may only be issued to U.S. citizens and
resident aliens; non-U.S. citizens are not authorized to receive PIV
cards. Instead, USAID issues PIV-Alternative (PIV-A) cards to eligible
CCNs and TCNs who require physical or logical access, as described
further in ADS Chapter 542, available at https://www.usaid.gov/about-us/agency-policy/series-500/542. USAID revised the clause to clarify
that various types of credentials are available to different types of
users who require physical access to USAID facilities and/or logical
access to USAID information systems.
Comment: One commenter expressed a concern that non-U.S. citizens
may not possess a U.S. Federal or State Government-issued picture ID
for purposes of the identity source documentation required for
obtaining credentials. One commenter noted the rule does not specify
how to identify the appropriate Enrollment Office to work with and
physically present the identity source documents.
Response: In the credentialing process, two forms of identity
source documents must be presented to the Enrollment Office personnel.
The Federal or State Government-issued picture ID is required to obtain
a PIV card, which is available to U.S. citizens only. For non-U.S.
citizens, the contractor may contact the COR to request a list of
acceptable forms of documentation, as this information varies by
location. USAID updated the clause to clarify this information.
Comment: One commenter requested additional information regarding
the requirement for documentation of security background
investigations.
Response: Homeland Security Presidential Directive-12 (HSPD-12)
requires that agencies complete background investigations on all
employees and contractors when issuing credentials. ADS Chapter 542,
available at https://www.usaid.gov/about-us/agency-policy/series-500/542, contains additional details regarding USAID's procedures related
to background investigations in the credentialing process. USAID
revised the clause to clarify that documentation of a security
background investigation must be submitted as part of the credentialing
process, when applicable.
Comment: One commenter suggested that USAID harmonize access
requirements for those contractors with CCN and TCN staff versus the
requirements for USAID's CCN and TCN personal services contractors.
Response: The same physical and logical access requirements apply
to both contractor employees and individuals issued personal services
contracts. As personal services contracts with individuals (issued
under Appendices D and J of the AIDAR) are not within the scope of this
rule, no changes were made to the rule.
(x) Outside the Scope of This Rule
Comment: One commenter noted that the rule does not specify what
the COR will do with the list of individuals reported by the contractor
to the COR each month under paragraph (d) of this AIDAR 752.204-72
clause.
Response: The COR's responsibilities regarding the staffing list
will be addressed in internal Agency policy. As such, no changes were
made to the rule.
Comment: One commenter questioned if the proposed rule impacted the
use of USAID systems such as Development Experience Clearinghouse
(DEC), Development Data Library (DDL), and TrainNet.
Response: This rule does not affect the use of DEC, DDL, or
TrainNet. This comment is outside the scope of this rule.
Comment: One commenter noted that the language of the proposed rule
seemed clear, but suggested the development of a supplemental
``decision guide'' to facilitate the interpretation of the rule's IT
approval requirements.
Response: The commenter's suggestion is outside the scope of the
rule.
C. Regulatory Considerations and Determinations
(1) Executive Orders 12866, 13563, and 14094
This final rule was drafted in accordance with Executive Order
(E.O.) 12866, as amended by E.O. 13563 and E.O. 14094. OMB has
determined that this rule is not a ``significant regulatory action,''
as defined in section 3(f) of E.O. 12866, as amended, and is therefore
not subject to review by OMB.
(2) Expected Cost Impact on the Public
There are no costs to the public associated with this rulemaking.
(3) Regulatory Flexibility Act
The rule does not have a significant economic impact on a
substantial number of small entities within the meaning of the
Regulatory Flexibility Act, 5 U.S.C. 601, et seq. Therefore, a
Regulatory Flexibility Analysis has not been performed.
(4) Paperwork Reduction Act
This rule contains information collection requirements that were
detailed in the proposed rule and have been submitted to the Office of
Management and Budget (OMB) under the Paperwork Reduction Act (44
U.S.C. chapter 35). This information collection requirement has been
assigned OMB Control Number 0412-0603, entitled ``Information
Collection under AIDAR Clause 752.204-72, Access to USAID Facilities
and USAID's Information Systems.'' No comments were received on the
information collection outlined in the proposed rule.
List of Subjects in 48 CFR Parts 704, 739, and 752
Government procurement.
For the reasons discussed in the preamble, USAID amends 48 CFR
parts 704, 739, and 752 as set forth below:
[[Page 19758]]
PART 704--ADMINISTRATIVE MATTERS
0
1. The authority citation for 48 CFR part 704 continues to read as
follows:
Authority: Sec. 621, Pub. L. 87-195, 75 Stat. 445, (22 U.S.C.
2381) as amended; E.O. 12163, Sept. 29, 1979, 44 FR 56673; 3 CFR,
1979 Comp., p. 435.
Sec. 704.404 [Amended]
0
2. Amend Sec. 704.404 by removing and reserving paragraph (b).
0
3. Add Subpart 704.13 to read as follows:
Subpart 704.13--Personal Identity Verification
Sec.
704.1303 Contract clause.
Sec. 704.1303 Contract clause.
When contract performance requires the contractor--including its
employees, volunteers, or subcontractor employees at any tier--to have
routine physical access to USAID-controlled facilities or logical
access to USAID's information systems, the contracting officer must
insert the clause found at FAR 52.204-9 and AIDAR 752.204-72 (``Access
to USAID Facilities and USAID's Information Systems'') in the
solicitation and contract.
0
4. Add part 739 to read as follows:
PART 739--ACQUISITION OF INFORMATION TECHNOLOGY
Sec.
739.000 Scope of part.
739.001 [Reserved]
739.002 Definitions.
Subpart 739.1--General.
739.106 Contract clauses.
Authority: Sec. 621, Pub. L. 87-195, 75 Stat. 445 (22 U.S.C.
2381), as amended; E.O. 12163, Sept. 29, 1979, 44 FR 56673; and 3
CFR, 1979 Comp., p. 435.
Sec. 739.000 Scope of part.
This part prescribes acquisition policies and procedures for use in
acquiring--
(a) Information technology, as defined in this part, consistent
with the Federal Information Technology Acquisition Reform Act
(FITARA).
(b) Information and communication technology (ICT), as defined in
FAR 2.101.
Sec. 739.001 [Reserved]
Sec. 739.002 Definitions.
As used in this part--
Information Technology (IT) means
(1) Any services or equipment, or interconnected system(s) or
subsystem(s) of equipment, that are used in the automatic acquisition,
storage, analysis, evaluation, manipulation, management, movement,
control, display, switching, interchange, transmission, or reception of
data or information by the agency; where
(2) Such services or equipment are ``used by an agency'' if used by
the agency directly or if used by a contractor under a contract with
the agency that requires either use of the services or equipment or
requires use of the services or equipment to a significant extent in
the performance of a service or the furnishing of a product.
(3) The term ``information technology'' includes computers,
ancillary equipment (including imaging peripherals, input, output, and
storage devices necessary for security and surveillance), peripheral
equipment designed to be controlled by the central processing unit of a
computer, software, firmware and similar procedures, services
(including provisioned services such as cloud computing and support
services that support any point of the lifecycle of the equipment or
service), and related resources.
(4) The term ``information technology'' does not include any
equipment that is acquired by a contractor incidental to a contract
that does not require use of the equipment.
Subpart 739.1--General.
Sec. 739.106 Contract clauses.
(a) [Reserved]
(b) Contracting officers must insert the clause at 752.239-70,
Information Technology Authorization, in all solicitations and
contracts.
(c) Contracting officers must insert the clause at 752.239-71,
Information and Communication Technology Accessibility, in
solicitations and contracts that include acquisition of information and
communication technology (ICT) supplies and/or services for use by
Federal employees or members of the public.
(d) Contracting officers must insert the clause at 752.239-72,
USAID-Financed Project websites, in solicitations and contracts fully
or partially funded with program funds.
PART 752--SOLICITATION PROVISIONS AND CONTRACT CLAUSES
0
5. The authority citation for part 752 continues to read as follows:
Authority: Sec. 621, Pub. L. 87-195, 75 Stat. 445, (22 U.S.C.
2381) as amended; E.O. 12163, Sept. 29, 1979, 44 FR 56673; 3 CFR,
1979 Comp., p. 435.
0
6. Revise Sec. 752.204-72 to read as follows:
Sec. 752.204-72 Access to USAID Facilities and USAID's Information
Systems.
As prescribed in AIDAR 704.1303, insert the following clause in
Section I of solicitations and contracts:
Access to USAID Facilities and USAID's Information Systems (May 2024)
(a) The Contractor must ensure that individuals engaged in the
performance of this award as employees or volunteers of the
Contractor, or as subcontractors or subcontractor employees at any
tier, comply with all applicable personal identity verification
(PIV) and Homeland Security Presidential Directive-12 (HSPD-12)
procedures, including those summarized below, and any subsequent
USAID or Government-wide procedures and policies related to PIV or
HSPD-12.
(b) An individual engaged in the performance of this award may
obtain access to USAID facilities or logical access to USAID's
information systems only when and to the extent necessary to carry
out this award. USAID issues various types of credentials to users
who require physical access to Agency facilities and/or logical
access to Agency information systems, in accordance with USAID's
Automated Directives System (ADS) 542, available at https://www.usaid.gov/about-us/agency-policy/series-500/542.
(c) (1) No later than five (5) business days after award, unless
the Contracting Officer authorizes a longer time period, the
Contractor must provide to the Contracting Officer's Representative
a complete list of individuals that require access to USAID
facilities or information systems under this contract.
(2) Before an individual may obtain a USAID credential (new or
replacement) authorizing the individual routine access to USAID
facilities, or logical access to USAID's information systems, the
individual must physically present two forms of identity source
documents in original form to the Enrollment Office personnel when
undergoing processing. To obtain a PIV card, one identity source
document must be a valid Federal or State Government-issued picture
ID from the I-9 list available at https://www.uscis.gov/i-9-central/form-i-9-acceptable-documents. For other types of credentials the
Contractor can obtain the list of acceptable forms from the
Contracting Officer's Representative. Submission of these documents,
as well as documentation of any applicable security background
investigation, is mandatory in order for the individual to receive a
credential granting facilities and/or logical access.
(d) (1) No later than the 5th day of each month, the Contractor
must provide the Contracting Officer's Representative with the
following:
(i) a list of individuals with access who were separated in the
past sixty (60) calendar days, and
[[Page 19759]]
(ii) a list of individuals hired in the past sixty (60) calendar
days who require access under this contract.
(2) This information must be submitted even if no separations or
hiring occurred during the past sixty (60) calendar days.
(3) Failure to comply with the requirements in paragraph (d)(1)
may result in the suspension of all facilities and/or logical access
associated with this contract.
(e) The Contractor must ensure that individuals do not share
logical access to USAID information systems and sensitive
information.
(f) USAID may suspend or terminate the access to any systems
and/or facilities in the event of any violation, abuse, or misuse.
The suspension or termination may last until the situation has been
corrected or no longer exists.
(g) The Contractor must notify the Contracting Officer's
Representative and the USAID Service Desk ([email protected] or
202-712-1234) at least five (5) business days prior to the removal
of any individuals with credentials from the contract. For unplanned
terminations, the Contractor must immediately notify the Contracting
Officer's Representative and the USAID Service Desk. Unless
otherwise instructed by the Contracting Officer, the Contractor must
return all credentials and remote authentication tokens to the
Contracting Officer's Representative prior to departure of the
individual or upon completion or termination of the contract,
whichever occurs first.
(h) The Contractor must insert this clause, including this
paragraph (h), in any subcontracts that require the subcontractor or
a subcontractor employee to have routine physical access to USAID
facilities or logical access to USAID's information systems. The
Contractor is responsible for providing the Contracting Officer's
Representative with the information required under paragraphs (c)(1)
and (d)(1) of this clause for any applicable subcontractor or
subcontractor employee.
(End of clause)
0
7. Add section 752.239-70 to read as follows:
752.239-70 Information Technology Authorization.
As prescribed in AIDAR 739.106(b), insert the following clause in
Section I of solicitations and contracts:
Information Technology Authorization (May 2024)
(d) Definitions. As used in this contract:
Information Technology means
(1) Any services or equipment, or interconnected system(s) or
subsystem(s) of equipment, that are used in the automatic
acquisition, storage, analysis, evaluation, manipulation,
management, movement, control, display, switching, interchange,
transmission, or reception of data or information by the agency;
where
(2) such services or equipment are ``used by an agency'' if used
by the agency directly or if used by a contractor under a contract
with the agency that requires either use of the services or
equipment or requires use of the services or equipment to a
significant extent in the performance of a service or the furnishing
of a product.
(3) The term ``information technology'' includes computers,
ancillary equipment (including imaging peripherals, input, output,
and storage devices necessary for security and surveillance),
peripheral equipment designed to be controlled by the central
processing unit of a computer, software, firmware and similar
procedures, services (including provisioned services such as cloud
computing and support services that support any point of the
lifecycle of the equipment or service), and related resources.
(4) The term ``information technology'' does not include any
equipment that is acquired by a contractor incidental to a contract
that does not require use of the equipment.
(b) Approval Requirements. The Federal Information Technology
Acquisition Reform Act (FITARA) requires Agency Chief Information
Officer (CIO) review and approval of acquisitions of information
technology and information technology services. Any information
technology specified in the Schedule of this contract has already
been approved by the CIO. The Contractor must not acquire any
additional information technology without the prior written approval
of the Contracting Officer as specified in this clause.
(c) Request for Approval Procedure.
(1) If the Contractor determines that any information technology
not specified in the Schedule will be necessary in the performance
of the contract, the Contractor must request prior written approval
from the Contracting Officer, including the Contracting Officer's
Representative and the Office of the CIO ([email protected])
on the request.
(2) In the request, the Contractor must provide an itemized
description of the information technology to be procured. For
equipment (including hardware and software), the Contractor must
include any applicable brand names, model/version numbers,
quantities, and estimated unit and total cost information. For
services, the Contractor must provide a detailed description of the
services, name(s) of the service provider(s), and estimated cost
information.
(3) The Contracting Officer will approve or deny in writing the
Contractor's request. If granted, the Contracting Officer will
specify in writing the information technology approved by the CIO
for purchase.
(d) Subcontracts. The Contractor must insert the substance of
this clause, including this paragraph (d), in all subcontracts. The
Contractor is responsible for requesting any approval required under
paragraphs (b) and (c) of this clause for any applicable
subcontractor information technology acquisition.
(End of clause)
0
8. Add Sec. 752.239-71 to read as follows:
Sec. 752.239-71 Information and Communication Technology
Accessibility.
As prescribed in AIDAR 739.106(c), insert the following clause in
Section I of solicitations and contracts:
Information and Communication Technology Accessibility (May 2024)
(a) Section 508 of the Rehabilitation Act of 1973, as amended
(29 U.S.C. 794d) requires (1) Federal agencies to offer access to
information and communication technology (ICT) to individuals with
disabilities who are Federal employees or members of the public
seeking information or services, and (2) that this access be
comparable to that which is offered to Federal employees or members
of the public who are not individuals with disabilities. Standards
for complying with this law are prescribed by the Architectural and
Transportation Barriers Compliance Board (``Access Board'') in 36
CFR part 1194, are viewable at https://www.access-board.gov/ict/.
(b) Except as indicated elsewhere in the contract, all ICT
supplies, services, information, documentation, and deliverables
developed, acquired, maintained, or delivered under this contract
must meet the applicable Section 508 accessibility standards at 36
CFR part 1194, as amended by the Access Board.
(c) The Section 508 accessibility standards applicable to this
contract are identified in Section C or other applicable sections of
this contract.
(d) The Contractor must, upon written request from the
Contracting Officer, or if so designated, the Contracting Officer's
Representative, provide the information necessary to assist the
Government in determining that the ICT supplies or services conform
to Section 508 accessibility standards.
(e) If it is determined by the Government that any ICT supplies
or services delivered by the Contractor do not conform to the
required accessibility standards, remediation of the supplies or
services to the level of conformance specified in the contract will
be the responsibility of the Contractor at its own expense.
(f) The Contractor must insert this clause in all subcontracts
that involve the acquisition of ICT supplies and/or services. The
Contractor is responsible for the submission of any information as
required under paragraph (e) of this clause.
(End of clause)
0
9. Add Sec. 752.239-72 to read as follows:
Sec. 752.239-72 USAID-Financed Project Websites.
As prescribed in AIDAR 739.106(d), insert the following clause in
Section I of solicitations and contracts:
USAID-Financed Project Websites (May 2024)
(a) Definitions. As used in this contract: Project Website means
a website that is:
(1) funded under this contract;
[[Page 19760]]
(2) hosted outside of a Federal Government domain (i.e.,
``.gov'');
(3) operated exclusively by the Contractor, who is responsible
for all website content, operations and management, information
security, and disposition of the website;
(4) not operated by or on behalf of USAID; and
(5) does not provide official USAID communications, information,
or services.
(b) Requirements. The Contractor must adhere to the following
requirements when developing, launching, or maintaining a Project
website:
(1) Domain name. The domain name of the website must not contain
the term ``USAID''. The domain name must be registered in the
Contractor's business name with the relevant domain registrar on the
relevant domain name registry.
(2) Information to be collected. In the website, the Contractor
may collect only the amount of information necessary to complete the
specific business need. The Contractor must not collect or store
privacy information that is unnecessary for the website to operate,
or is prohibited by statute, regulation, or Executive Order.
(3) Disclaimer. The website must be marked on the index page of
the site and every major entry point to the website with a
disclaimer that states: ``The information provided on this website
is not official U.S. Government information and does not represent
the views or positions of the U.S. Agency for International
Development or the U.S. Government.''
(4) Accessibility. To comply with the requirements of the
Section 508 of the Rehabilitation Act, as amended (29 U.S.C. 794d),
the Contractor must ensure the website meets all applicable
accessibility standards (``Web-based intranet and internet
information and applications'') at 36 CFR part 1194, Appendix D.
(5) Information security: The Contractor is solely responsible
for the information security of the website. This includes incident
response activities as well as all security safeguards, including
adequate protection from unauthorized access, alteration,
disclosure, or misuse of information collected, processed, stored,
transmitted, or published on the website. The Contractor must
minimize and mitigate security risks, promote the integrity and
availability of website information, and use state-of-the-art:
system/software management; engineering and development; event
logging; and secure-coding practices that are equal to or better
than USAID standards and information security best practices.
Rigorous security safeguards, including but not limited to, virus
protection; network intrusion detection and prevention programs; and
vulnerability management systems must be implemented and critical
security issues must be resolved within 30 calendar days.
(c) Disposition. At least 120 days prior to the contract end
date, unless otherwise approved by the Contracting Officer, the
Contractor must submit for the Contracting Officer's approval a
disposition plan that addresses how any Project website funded under
this contract will be transitioned to another entity or
decommissioned and archived. If the website will be transitioned to
another entity, the disposition plan must provide details on the
Contractor's proposed approach for the transfer of associated
electronic records, technical documentation regarding the website's
development and maintenance, and event logs. Prior to the end of the
contract, the Contractor must comply with the disposition plan
approved by the Contracting Officer.
(d) Subcontracts. The Contractor must insert this clause in all
subcontracts that involve the development, launch, or maintenance of
a Project website. The Contractor is responsible for the submission
of any information as required under paragraphs (b) and (c) of this
clause.
(End of clause)
Jami J. Rodgers,
Chief Acquisition Officer.
[FR Doc. 2024-05748 Filed 3-19-24; 8:45 am]
BILLING CODE 6116-01-P
