2024-05748. USAID Acquisition Regulation (AIDAR): Security and Information Technology Requirements

AGENCY:

U.S. Agency for International Development.

ACTION:

Final rule.

SUMMARY:

This final rule amends the U.S. Agency for International Development (USAID) Acquisition Regulation (AIDAR) to incorporate a revised definition of “information technology” (IT) and new contract clauses relating to information security, cybersecurity, and IT resources. The purpose of these revisions is to provide increased oversight of contractor acquisition and use of IT resources.

DATES:

This final rule is effective May 20, 2024.

FOR FURTHER INFORMATION CONTACT:

Jasen Andersen, Procurement Analyst, USAID M/OAA/P, at 202–286–3116 or [e-mail] for clarification of content or information pertaining to status or publication schedules. All communications regarding this rule must cite RIN No. 0412–AA87.

SUPPLEMENTARY INFORMATION:

A. Background

USAID published a proposed rule on March 21, 2019 (84 FR 10469) to amend the AIDAR to implement various requirements related to information security and IT resources that support the operations and assets of the agency, including those managed by contractors. These new requirements will strengthen protections of agency information systems and facilities. The public comment period closed on May 20, 2019.

B. Discussion and Analysis

USAID updated the final rule to incorporate feedback from public comments, streamline requirements by removing duplicative or unnecessary elements from the rule, and maintain consistency with the Federal Acquisition Regulation (FAR). USAID received four public comments in response to the proposed rule. USAID assessed the public comments in the development of the final rule. The full text of the comments is available at the Federal Rulemaking Portal, www.regulations.gov. A summary of the comments, USAID's responses, and changes made to the rule as a result are as follows:

(1) Summary of Significant Changes

The following significant changes from the proposed rule are made in the final rule, organized below using the section titles from the proposed rule:

(i) AIDAR Part 739, Acquisition of Information Technology. No changes were made to the definition of “information technology” as a result of the public comments received. Minor administrative changes were made to revise AIDAR Part 739 to add a section regarding the scope of the part, as well as the prescriptions for the applicable contract clauses included in this final rule.

(ii) AIDAR 752.204–72 Homeland Security Presidential Directive–12 (HSPD–12) and Personal Identity Verification (PIV). Several changes were made to this clause as a result of the public comments received. In response to a commenter's concerns that the proposed rule limited access to only U.S. citizens and resident aliens, USAID revised the clause to clarify that various types of credentials are available to different types of users—including non-U.S. citizens—who require physical access to USAID facilities and/or logical access to USAID information systems. Similarly, revisions also update the forms of identity source documents that must be presented to the Enrollment Office personnel, based on the credential type, as well as applicability of any security background investigation. To avoid confusion generated by the reference to the PIV credential, which may only be issued to U.S. citizens and resident aliens, USAID reverted the title of the clause back to its prior name, “Access to USAID Facilities and USAID's Information Systems.” The revisions also provide clarity regarding the contents of the monthly staffing report required by the clause. Finally, a new Subpart 704.13 was created to house the prescription for this clause, with this prescription moved from AIDAR 704.404 to AIDAR 704.1303.

(iii) AIDAR 752.204–XX USAID-Financed Third-Party Websites. The public comments led to several revisions in this clause. One commenter highlighted that the clause did not differentiate appropriately between a contractor's website used to implement a project versus a Federal agency's website maintained by a contractor on behalf of the agency. In its subsequent analysis, USAID further determined that “third-party website,” as defined in OMB Memorandum No. M–10–23 (“Guidance for Agency Use of Third-Party Websites and Applications”), was not the correct terminology for this clause. While the contract funds the website, the contractor does not operate the website on the agency's behalf. Instead, the final rule now defines a new term and establishes applicability of the clause to “project websites.” As further explained in this new definition, there are multiple differentiators that distinguish a “project website” from a “Federal agency website” under OMB Memorandum No. M–23–10 (“The Registration and Use of .gov Domains in the Federal Government”)—where it is hosted, who is responsible for all operations and management, whether the website is operated on behalf of USAID, and whether the website provides official communications, information, or services from USAID. USAID renamed the clause to “USAID-Financed Project Websites” to reflect this change in terminology. In addition, based on public comments, USAID removed certain requirements from the clause, such as the notification to and approval from the Contracting Officer's Representative and the USAID Legislative and Public Affairs (LPA) division, or the authorization of USAID to conduct periodic vulnerability scans. Instead, the contractor is solely responsible for all project website content, operations, management, information security, and disposition. Other requirements were removed from the clause because they are covered by other standard contract requirements—for example, USAID branding/marking requirements were removed from this clause, as they are typically addressed in a branding/marking plan required elsewhere in the contract.

(iv) AIDAR 752.239–XX Limitation on Acquisition of Information Technology and AIDAR 752.239–XX Use of Information Technology Approval. As a result of the public comments received, these two overlapping clauses from the proposed rule were combined into a single AIDAR 752.239–70 (“Information Technology Authorization”) clause in the final rule. USAID believes this provides better clarity and promotes consistency in the IT approval process. No change was made to the definition of “information technology” used in this clause. Instead, the revisions focus on clarifying procedures that a contractor must follow in seeking approval of any IT not specified in the schedule of the contract. The revised clause provides more details regarding the contents of any approval request. In addition, the revised clause allows written approval, removing the burden of requiring a contract modification to indicate approval of additional IT by the Contracting Officer.

(v) AIDAR 752.239–XX Software License. Based on the public comments received, USAID re-evaluated the need for this clause. As noted in some of the public comments, this clause presents challenges due to the commercial nature of the transaction between the contractor and the software vendor, as well as concerns regarding privity of contract, if the U.S. Government imposes additional “addendum” requirements. After consideration of the public comments and further analysis—including assessing which elements of this clause may be addressed elsewhere in the FAR, such as in the contract cost principles in FAR Part 31—USAID determined that this clause is no longer needed and removed it from the final rule. While this “Software License” clause is no longer part of this rule, USAID reminds contractors that software acquisitions must adhere to other applicable contractual requirements, including the IT approval requirements outlined in the revised AIDAR 752.239–70 (“Information Technology Authorization”) clause.

(vi) AIDAR 752.239–XX Information and Communication Technology Accessibility. Revisions were made to this clause to clarify the requirements and applicability of Section 508 of the Rehabilitation Act of 1973, as amended, to information and communication technology (ICT) supplies and services. One significant change is the removal of the full list of Section 508 accessibility standards. Instead, the clause notes that the specific applicable standards must be identified elsewhere in the contract ( e.g., in Section C), in alignment with FAR Subpart 39.1. USAID also revised the clause to incorporate procedures to enable the Government to determine whether delivered supplies or services conform to Section 508 accessibility standards. In order to ensure full compliance of all ICT supplies and services delivered under a contract with Section 508 requirements, USAID added a flow-down requirement to apply the clause to subcontractors.

(vii) AIDAR 752.239–XX Skills and Certification Requirements for Privacy and Security Staff. Based on the public comments received, USAID re-evaluated the need for this clause. After further assessment, USAID removed this clause from the final rule. In alignment with the “National Cyber Workforce and Education Strategy” issued by the Office of the National Cyber Director in July 2023, USAID will use a skills-based approach rather than relying solely on educational qualifications and industry-recognized certifications.

(viii) Clause prescriptions. Throughout the final rule, the prescriptions for each clause have been revised to ensure clarity in the instructions, as well as alignment with the AIDAR text where the topic is addressed.

(2) Summary of and Response to Public Comments

USAID reviewed the public comments in the development of the final rule. A discussion of the comments is provided as follows:

(i) Definition of “Information Technology” and Applicability of the Rule

Comment: Three commenters submitted comments regarding the definition of “information technology” (IT) and the applicability of the IT authorization requirements in two clauses in the proposed rule (“Limitation on Acquisition of Information Technology” and “Use of Information Technology Approval”). These commenters indicated the definition of IT was confusing and that Contracting Officers may interpret the definition differently, resulting in inconsistent application of the rule and delays in contract performance. These commenters questioned whether all technology acquisitions—such as computers, laptops, printers, other commercial products and services, and commercially available off-the-shelf (COTS) items procured by a contractor—are within the scope of these IT authorization requirements. These commenters suggested that this rule should only apply to USAID infrastructure only, such as computer systems that interface directly with USAID internal IT systems.

Response: This rule uses the definition of “information technology” issued by the Office of Management and Budget (OMB) in OMB Memorandum M–15–14 (“Management and Oversight of Federal Information Technology”), pursuant to the Federal Information Technology Acquisition Reform Act (FITARA). USAID continues to use this definition in the final rule in order to maintain consistency with OMB guidance and FITARA implementation principles.

To simplify the rule and promote consistency in its application, USAID has combined the prior two clauses (“Limitation on Acquisition of Information Technology” and “Use of Information Technology Approval”) from the proposed rule into a single AIDAR 752.239–70 (“Information Technology Authorization”) clause in the final rule.

OMB's FITARA definition of IT adopted by USAID for this rule applies to any services or equipment “used by an agency,” which—as further defined in the clause—includes “if used by the agency directly or if used by a contractor under a contract with the agency . . .” This clause applies to all such IT, including hardware ( e.g., computers, laptops, desktops, tablets, printers, etc.), infrastructure equipment (e.g, networking equipment, routers, switches, firewalls, etc.), software including software as a service (SaaS), cloud services, artificial intelligence (AI) and emerging information technologies, and other commercial items and COTS technology. The applicability of this clause and the definition of “information technology” do not solely depend on whether the items directly interface with USAID internal IT systems or connect to the Agency's infrastructure.

To further assist Contracting Officers in the consistent application of this rule, USAID provides direction and guidance to Agency staff, such as in Automated Directives System (ADS) Chapter 509 available at https://www.usaid.gov/​about-us/​agency-policy/​series-500/​509, that is consistent with OMB resources and FITARA.

(ii) IT Procurements for Counterparts

Comment: One commenter indicated support for the proposed rule and its importance in fulfilling the Agency's responsibility to govern the organization's technology infrastructure, but questioned whether it was within the FITARA statutory authority to apply the rule's approval requirements to IT that do not become part of the Agency's technology infrastructure. As an example, the commenter cited procurements of IT for international development work with third parties ( e.g., procurements of IT for host country counterparts).

Response: USAID acknowledges the support for the rule and agrees this rule is an important measure to promote the Agency's oversight and stewardship of IT resources. USAID also agrees there are certain IT acquisitions by a contractor that may not be subject to the IT approval requirements established in the AIDAR 752.239–70 (“Information Technology Authorization”) clause. For example, IT procured by a contractor that is provided directly and immediately to a host country counterpart does not fall into this FITARA definition of IT because it does not meet this IT definition's qualifier of “used by an agency.” Examples of IT procured for a host country counterpart could include a health information management system purchased for a host country ministry of health or computers procured for a host country educational institution. However, if USAID or the contractor first “uses” the services or equipment before transferring it to a host country counterpart, the items are then considered to be “used by an agency,” as defined in the FITARA definition, and therefore subject to the IT approval requirements established in the AIDAR 752.239–70 (“Information Technology Authorization”) clause. For example, if a contractor uses a health survey tool for any period of time that is required as part of its performance of the contract, and then transfers the tool to the host country government, that tool is considered to be IT as defined in this FITARA definition. Because the scope of FITARA does apply beyond the Agency's technology infrastructure, no changes were made to the language in the rule.

(iii) IT “Incidental to a Contract”

Comment: Two commenters raised concerns that the definition of “information technology” is not clear regarding equipment acquired by a contractor that is “incidental to a contract.” One of these commenters suggesting this “incidental” exception should be deleted to avoid confusion.

Response: OMB's FITARA definition of IT specifically notes that the term “information technology” does not include any equipment that is acquired by a contractor incidental to a contract that does not require use of the equipment. Examples of “incidental” IT could include a contractor's corporate human resources systems, financial management systems, or email management systems, as the contractor acquired them to assist in managing its own resources assigned to a U.S. Government contract. USAID believes this “incidental” exclusion is a critical element of the definition of IT in order to maintain consistency with OMB guidance and FITARA implementation principles. As such, no changes were made to this language in the rule.

(iv) USAID Resources and Timing for IT Authorizations

Comment: For the “Limitation on Acquisition of Information Technology” and “Use of Information Technology Approval” clauses in the proposed rule, two commenters expressed concerns regarding the availability of USAID resources to carry out the necessary approval processes in an efficient manner. The commenters indicated that this authorization process may lead to delays and significant hindrances to the implementation of development work by contractors, if approval is required to “purchase of every piece of IT hardware.”

Response: USAID's Bureau For Management, Office of the Chief Information Officer (M/CIO) has sufficient resources to efficiently fulfill the IT approval requirements of this rule, now reflected in a single AIDAR 752.239–70 (“Information Technology Authorization”) clause in the final rule.

Comment: One commenter suggested that contractor's notification to the Contracting Officer's Representative (COR)—rather than an approval from USAID—would be more appropriate for IT procurements included in the offeror's proposal and/or prime contract.

Response: Under FITARA, the CIO is required to review and approve all IT acquisitions. No changes are made to these requirements.

(v) USAID's IT Regulatory and Policy Framework

Comment: Two commenters questioned if this rule replaces the procedures of USAID's ADS Chapter 548, or if any procedures from ADS Chapter 548 should be included in this new rule.

Response: USAID's policies previously detailed in ADS Chapter 548 are obsolete and no longer applicable. These policies were archived in May 2019.

Comment: Two commenters questioned whether the proposed rule would apply to IT procurements conducted by recipients under USAID grants and cooperative agreements.

Response: The content of this rule only applies to acquisition awards ( e.g., contracts); this rule does not apply to federal assistance awards ( e.g., grants and cooperative agreements). ADS Chapter 509, available at https://www.usaid.gov/​about-us/​agency-policy/​series-500/​509, contains further clarification on the distinction between acquisition and assistance for IT procurements.

(vi) Software License Clause

Comment: Two commenters provided comments on the AIDAR 752.239–XX “Software License” clause from the proposed rule, noting potential challenges and confusion in complying with this clause, particularly for commercial items and commercially available off-the-shelf (COTS) items.

Response: USAID concurs with the concerns noted in these comments and has removed this clause from the final rule.

(vii) USAID-Financed Project Websites Clause

Comment: One commenter provided several comments regarding the requirements and process for the proposed rule's “USAID-Financed Third-Party Websites” clause, highlighting that the clause did not distinguish appropriately between a contractor's website used to implement a project versus a Federal agency's website. The commenter also questioned the need for notification by the contractor to the Contracting Officer's Representative (COR) for USAID's Bureau for Legislative and Public Affairs (LPA) evaluation and approval, as well as the requirement for contractors to authorize USAID to conduct periodic vulnerability scans.

Response: USAID agrees with several of the commenter's concerns. The proposed rule did not adequately define the type of website subject to requirements of this clause. The final rule contains several revisions to this clause, most notably clarifying that it applies to a “project website” funded by USAID, which is now defined in the final rule. This definition of “project website” is distinct from a “third-party website” and also provides a differentiation from websites within the Federal Government domain ( i.e., “ .gov ”), in accordance with guidance established in OMB Memorandum No. M–23–10. The clause in this final rule has been renamed to “USAID-Financed Project websites” to reflect this change in terminology. The final rule also removes the COR/LPA notification and approval requirements. As the contractor is solely responsible for all security safeguards for the website, the final rule removes the requirement for contractors to authorize USAID to conduct periodic vulnerability scans.

Comment: One commenter questioned whether this rule affects existing project websites funded by USAID.

Response: This AIDAR 752.239–72 (“USAID-Financed Project websites”) clause applies to any project website developed, launched or maintained under a prime contract that contains this clause.

(viii) Skills and Certification Requirements Clause

Comment: For the “Skills and Certification Requirements for Privacy and Security Staff” clause, one commenter suggested that the Certified Information Systems Security Professional (CISSP) certification process is unclear and requested clarification regarding the definition of “significant information security responsibilities.”

Response: USAID has removed this clause from the final rule to maintain consistency with the FAR and the National Cyber Workforce and Education Strategy issued by the Office of the National Cyber Director, which support using a skills-based approach rather than relying solely on educational qualifications and industry-recognized certifications.

(ix) Access to USAID Facilities and USAID's Information Systems Clause

Comment: One commenter suggested that the proposed personal identity verification (PIV) clause unnecessarily restricts physical and logical access only to U.S. citizens and resident aliens, prohibiting access to cooperating country nationals (CCNs) and third country nationals (TCNs).

Response: PIV cards may only be issued to U.S. citizens and resident aliens; non-U.S. citizens are not authorized to receive PIV cards. Instead, USAID issues PIV-Alternative (PIV–A) cards to eligible CCNs and TCNs who require physical or logical access, as described further in ADS Chapter 542, available at https://www.usaid.gov/​about-us/​agency-policy/​series-500/​542. USAID revised the clause to clarify that various types of credentials are available to different types of users who require physical access to USAID facilities and/or logical access to USAID information systems.

Comment: One commenter expressed a concern that non-U.S. citizens may not possess a U.S. Federal or State Government-issued picture ID for purposes of the identity source documentation required for obtaining credentials. One commenter noted the rule does not specify how to identify the appropriate Enrollment Office to work with and physically present the identity source documents.

Response: In the credentialing process, two forms of identity source documents must be presented to the Enrollment Office personnel. The Federal or State Government-issued picture ID is required to obtain a PIV card, which is available to U.S. citizens only. For non-U.S. citizens, the contractor may contact the COR to request a list of acceptable forms of documentation, as this information varies by location. USAID updated the clause to clarify this information.

Comment: One commenter requested additional information regarding the requirement for documentation of security background investigations.

Response: Homeland Security Presidential Directive–12 (HSPD–12) requires that agencies complete background investigations on all employees and contractors when issuing credentials. ADS Chapter 542, available at https://www.usaid.gov/​about-us/​agency-policy/​series-500/​542, contains additional details regarding USAID's procedures related to background investigations in the credentialing process. USAID revised the clause to clarify that documentation of a security background investigation must be submitted as part of the credentialing process, when applicable.

Comment: One commenter suggested that USAID harmonize access requirements for those contractors with CCN and TCN staff versus the requirements for USAID's CCN and TCN personal services contractors.

Response: The same physical and logical access requirements apply to both contractor employees and individuals issued personal services contracts. As personal services contracts with individuals (issued under Appendices D and J of the AIDAR) are not within the scope of this rule, no changes were made to the rule.

(x) Outside the Scope of This Rule

Comment: One commenter noted that the rule does not specify what the COR will do with the list of individuals reported by the contractor to the COR each month under paragraph (d) of this AIDAR 752.204–72 clause.

Response: The COR's responsibilities regarding the staffing list will be addressed in internal Agency policy. As such, no changes were made to the rule.

Comment: One commenter questioned if the proposed rule impacted the use of USAID systems such as Development Experience Clearinghouse (DEC), Development Data Library (DDL), and TrainNet.

Response: This rule does not affect the use of DEC, DDL, or TrainNet. This comment is outside the scope of this rule.

Comment: One commenter noted that the language of the proposed rule seemed clear, but suggested the development of a supplemental “decision guide” to facilitate the interpretation of the rule's IT approval requirements.

Response: The commenter's suggestion is outside the scope of the rule.

C. Regulatory Considerations and Determinations

(1) Executive Orders 12866, 13563, and 14094

This final rule was drafted in accordance with Executive Order (E.O.) 12866, as amended by E.O. 13563 and E.O. 14094. OMB has determined that this rule is not a “significant regulatory action,” as defined in section 3(f) of E.O. 12866, as amended, and is therefore not subject to review by OMB.

(2) Expected Cost Impact on the Public

There are no costs to the public associated with this rulemaking.

(3) Regulatory Flexibility Act

The rule does not have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq. Therefore, a Regulatory Flexibility Analysis has not been performed.

(4) Paperwork Reduction Act

This rule contains information collection requirements that were detailed in the proposed rule and have been submitted to the Office of Management and Budget (OMB) under the Paperwork Reduction Act (44 U.S.C. chapter 35). This information collection requirement has been assigned OMB Control Number 0412–0603, entitled “Information Collection under AIDAR Clause 752.204–72, Access to USAID Facilities and USAID's Information Systems.” No comments were received on the information collection outlined in the proposed rule.

List of Subjects in 48 CFR Parts 704, 739, and 752

• Government procurement

For the reasons discussed in the preamble, USAID amends 48 CFR parts 704, 739, and 752 as set forth below:

PART 704—ADMINISTRATIVE MATTERS

1. The authority citation for 48 CFR part 704 continues to read as follows:

Authority: Sec. 621, Pub. L. 87–195, 75 Stat. 445, (22 U.S.C. 2381) as amended; E.O. 12163, Sept. 29, 1979, 44 FR 56673; 3 CFR, 1979 Comp., p. 435.

§ 704.404

[Amended]

2. Amend § 704.404 by removing and reserving paragraph (b).

3. Add Subpart 704.13 to read as follows:

Subpart 704.13—Personal Identity Verification

704.1303

Contract clause.

§ 704.1303

Contract clause.

When contract performance requires the contractor—including its employees, volunteers, or subcontractor employees at any tier—to have routine physical access to USAID-controlled facilities or logical access to USAID's information systems, the contracting officer must insert the clause found at FAR 52.204–9 and AIDAR 752.204–72 (“Access to USAID Facilities and USAID's Information Systems”) in the solicitation and contract.

4. Add part 739 to read as follows:

PART 739—ACQUISITION OF INFORMATION TECHNOLOGY

739.000

Scope of part.

739.001

[Reserved]

739.002

Definitions.

Subpart 739.1—General.

739.106

Contract clauses.

Authority: Sec. 621, Pub. L. 87–195, 75 Stat. 445 (22 U.S.C. 2381), as amended; E.O. 12163, Sept. 29, 1979, 44 FR 56673; and 3 CFR, 1979 Comp., p. 435.

§ 739.000

Scope of part.

This part prescribes acquisition policies and procedures for use in acquiring—

(a) Information technology, as defined in this part, consistent with the Federal Information Technology Acquisition Reform Act (FITARA).

(b) Information and communication technology (ICT), as defined in FAR 2.101.

§ 739.001

[Reserved]

§ 739.002

Definitions.

As used in this part—

Information Technology (IT) means

(1) Any services or equipment, or interconnected system(s) or subsystem(s) of equipment, that are used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency; where

(2) Such services or equipment are “used by an agency” if used by the agency directly or if used by a contractor under a contract with the agency that requires either use of the services or equipment or requires use of the services or equipment to a significant extent in the performance of a service or the furnishing of a product.

(3) The term “information technology” includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including provisioned services such as cloud computing and support services that support any point of the lifecycle of the equipment or service), and related resources.

(4) The term “information technology” does not include any equipment that is acquired by a contractor incidental to a contract that does not require use of the equipment.

Subpart 739.1—General.

§ 739.106

Contract clauses.

(a) [Reserved]

(b) Contracting officers must insert the clause at 752.239–70, Information Technology Authorization, in all solicitations and contracts.

(c) Contracting officers must insert the clause at 752.239–71, Information and Communication Technology Accessibility, in solicitations and contracts that include acquisition of information and communication technology (ICT) supplies and/or services for use by Federal employees or members of the public.

(d) Contracting officers must insert the clause at 752.239–72, USAID-Financed Project websites, in solicitations and contracts fully or partially funded with program funds.

PART 752—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

5. The authority citation for part 752 continues to read as follows:

Authority: Sec. 621, Pub. L. 87–195, 75 Stat. 445, (22 U.S.C. 2381) as amended; E.O. 12163, Sept. 29, 1979, 44 FR 56673; 3 CFR, 1979 Comp., p. 435.

6. Revise § 752.204–72 to read as follows:

§ 752.204–72

Access to USAID Facilities and USAID's Information Systems.

As prescribed in AIDAR 704.1303, insert the following clause in Section I of solicitations and contracts:

Access to USAID Facilities and USAID's Information Systems (May 2024)

(a) The Contractor must ensure that individuals engaged in the performance of this award as employees or volunteers of the Contractor, or as subcontractors or subcontractor employees at any tier, comply with all applicable personal identity verification (PIV) and Homeland Security Presidential Directive–12 (HSPD–12) procedures, including those summarized below, and any subsequent USAID or Government-wide procedures and policies related to PIV or HSPD–12.

(b) An individual engaged in the performance of this award may obtain access to USAID facilities or logical access to USAID's information systems only when and to the extent necessary to carry out this award. USAID issues various types of credentials to users who require physical access to Agency facilities and/or logical access to Agency information systems, in accordance with USAID's Automated Directives System (ADS) 542, available at https://www.usaid.gov/​about-us/​agency-policy/​series-500/​542.

(c) (1) No later than five (5) business days after award, unless the Contracting Officer authorizes a longer time period, the Contractor must provide to the Contracting Officer's Representative a complete list of individuals that require access to USAID facilities or information systems under this contract.

(2) Before an individual may obtain a USAID credential (new or replacement) authorizing the individual routine access to USAID facilities, or logical access to USAID's information systems, the individual must physically present two forms of identity source documents in original form to the Enrollment Office personnel when undergoing processing. To obtain a PIV card, one identity source document must be a valid Federal or State Government-issued picture ID from the I–9 list available at https://www.uscis.gov/​i-9-central/​form-i-9-acceptable-documents. For other types of credentials the Contractor can obtain the list of acceptable forms from the Contracting Officer's Representative. Submission of these documents, as well as documentation of any applicable security background investigation, is mandatory in order for the individual to receive a credential granting facilities and/or logical access.

(d) (1) No later than the 5th day of each month, the Contractor must provide the Contracting Officer's Representative with the following:

(i) a list of individuals with access who were separated in the past sixty (60) calendar days, and

(ii) a list of individuals hired in the past sixty (60) calendar days who require access under this contract.

(2) This information must be submitted even if no separations or hiring occurred during the past sixty (60) calendar days.

(3) Failure to comply with the requirements in paragraph (d)(1) may result in the suspension of all facilities and/or logical access associated with this contract.

(e) The Contractor must ensure that individuals do not share logical access to USAID information systems and sensitive information.

(f) USAID may suspend or terminate the access to any systems and/or facilities in the event of any violation, abuse, or misuse. The suspension or termination may last until the situation has been corrected or no longer exists.

(g) The Contractor must notify the Contracting Officer's Representative and the USAID Service Desk ( [e-mail] or 202–712–1234) at least five (5) business days prior to the removal of any individuals with credentials from the contract. For unplanned terminations, the Contractor must immediately notify the Contracting Officer's Representative and the USAID Service Desk. Unless otherwise instructed by the Contracting Officer, the Contractor must return all credentials and remote authentication tokens to the Contracting Officer's Representative prior to departure of the individual or upon completion or termination of the contract, whichever occurs first.

(h) The Contractor must insert this clause, including this paragraph (h), in any subcontracts that require the subcontractor or a subcontractor employee to have routine physical access to USAID facilities or logical access to USAID's information systems. The Contractor is responsible for providing the Contracting Officer's Representative with the information required under paragraphs (c)(1) and (d)(1) of this clause for any applicable subcontractor or subcontractor employee.

(End of clause)

7. Add section 752.239–70 to read as follows:

752.239–70

Information Technology Authorization.

As prescribed in AIDAR 739.106(b), insert the following clause in Section I of solicitations and contracts:

Information Technology Authorization (May 2024)

(d) Definitions. As used in this contract:

Information Technology means

(1) Any services or equipment, or interconnected system(s) or subsystem(s) of equipment, that are used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the agency; where

(2) such services or equipment are “used by an agency” if used by the agency directly or if used by a contractor under a contract with the agency that requires either use of the services or equipment or requires use of the services or equipment to a significant extent in the performance of a service or the furnishing of a product.

(3) The term “information technology” includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including provisioned services such as cloud computing and support services that support any point of the lifecycle of the equipment or service), and related resources.

(4) The term “information technology” does not include any equipment that is acquired by a contractor incidental to a contract that does not require use of the equipment.

(b) Approval Requirements. The Federal Information Technology Acquisition Reform Act (FITARA) requires Agency Chief Information Officer (CIO) review and approval of acquisitions of information technology and information technology services. Any information technology specified in the Schedule of this contract has already been approved by the CIO. The Contractor must not acquire any additional information technology without the prior written approval of the Contracting Officer as specified in this clause.

(c) Request for Approval Procedure.

(1) If the Contractor determines that any information technology not specified in the Schedule will be necessary in the performance of the contract, the Contractor must request prior written approval from the Contracting Officer, including the Contracting Officer's Representative and the Office of the CIO ( [e-mail]) on the request.

(2) In the request, the Contractor must provide an itemized description of the information technology to be procured. For equipment (including hardware and software), the Contractor must include any applicable brand names, model/version numbers, quantities, and estimated unit and total cost information. For services, the Contractor must provide a detailed description of the services, name(s) of the service provider(s), and estimated cost information.

(3) The Contracting Officer will approve or deny in writing the Contractor's request. If granted, the Contracting Officer will specify in writing the information technology approved by the CIO for purchase.

(d) Subcontracts. The Contractor must insert the substance of this clause, including this paragraph (d), in all subcontracts. The Contractor is responsible for requesting any approval required under paragraphs (b) and (c) of this clause for any applicable subcontractor information technology acquisition.

(End of clause)

8. Add § 752.239–71 to read as follows:

§ 752.239–71

Information and Communication Technology Accessibility.

As prescribed in AIDAR 739.106(c), insert the following clause in Section I of solicitations and contracts:

Information and Communication Technology Accessibility (May 2024)

(a) Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) requires (1) Federal agencies to offer access to information and communication technology (ICT) to individuals with disabilities who are Federal employees or members of the public seeking information or services, and (2) that this access be comparable to that which is offered to Federal employees or members of the public who are not individuals with disabilities. Standards for complying with this law are prescribed by the Architectural and Transportation Barriers Compliance Board (“Access Board”) in 36 CFR part 1194, are viewable at https://www.access-board.gov/​ict/​.

(b) Except as indicated elsewhere in the contract, all ICT supplies, services, information, documentation, and deliverables developed, acquired, maintained, or delivered under this contract must meet the applicable Section 508 accessibility standards at 36 CFR part 1194, as amended by the Access Board.

(c) The Section 508 accessibility standards applicable to this contract are identified in Section C or other applicable sections of this contract.

(d) The Contractor must, upon written request from the Contracting Officer, or if so designated, the Contracting Officer's Representative, provide the information necessary to assist the Government in determining that the ICT supplies or services conform to Section 508 accessibility standards.

(e) If it is determined by the Government that any ICT supplies or services delivered by the Contractor do not conform to the required accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(f) The Contractor must insert this clause in all subcontracts that involve the acquisition of ICT supplies and/or services. The Contractor is responsible for the submission of any information as required under paragraph (e) of this clause.

(End of clause)

9. Add § 752.239–72 to read as follows:

§ 752.239–72

USAID-Financed Project Websites.

As prescribed in AIDAR 739.106(d), insert the following clause in Section I of solicitations and contracts:

USAID-Financed Project Websites (May 2024)

(a) Definitions. As used in this contract: Project Website means a website that is:

(1) funded under this contract;

(2) hosted outside of a Federal Government domain ( i.e., “ .gov ”);

(3) operated exclusively by the Contractor, who is responsible for all website content, operations and management, information security, and disposition of the website;

(4) not operated by or on behalf of USAID; and

(5) does not provide official USAID communications, information, or services.

(b) Requirements. The Contractor must adhere to the following requirements when developing, launching, or maintaining a Project website:

(1) Domain name. The domain name of the website must not contain the term “USAID”. The domain name must be registered in the Contractor's business name with the relevant domain registrar on the relevant domain name registry.

(2) Information to be collected. In the website, the Contractor may collect only the amount of information necessary to complete the specific business need. The Contractor must not collect or store privacy information that is unnecessary for the website to operate, or is prohibited by statute, regulation, or Executive Order.

(3) Disclaimer. The website must be marked on the index page of the site and every major entry point to the website with a disclaimer that states: “The information provided on this website is not official U.S. Government information and does not represent the views or positions of the U.S. Agency for International Development or the U.S. Government.”

(4) Accessibility. To comply with the requirements of the Section 508 of the Rehabilitation Act, as amended (29 U.S.C. 794d), the Contractor must ensure the website meets all applicable accessibility standards (“Web-based intranet and internet information and applications”) at 36 CFR part 1194, Appendix D.

(5) Information security: The Contractor is solely responsible for the information security of the website. This includes incident response activities as well as all security safeguards, including adequate protection from unauthorized access, alteration, disclosure, or misuse of information collected, processed, stored, transmitted, or published on the website. The Contractor must minimize and mitigate security risks, promote the integrity and availability of website information, and use state-of-the-art: system/software management; engineering and development; event logging; and secure-coding practices that are equal to or better than USAID standards and information security best practices. Rigorous security safeguards, including but not limited to, virus protection; network intrusion detection and prevention programs; and vulnerability management systems must be implemented and critical security issues must be resolved within 30 calendar days.

(c) Disposition. At least 120 days prior to the contract end date, unless otherwise approved by the Contracting Officer, the Contractor must submit for the Contracting Officer's approval a disposition plan that addresses how any Project website funded under this contract will be transitioned to another entity or decommissioned and archived. If the website will be transitioned to another entity, the disposition plan must provide details on the Contractor's proposed approach for the transfer of associated electronic records, technical documentation regarding the website's development and maintenance, and event logs. Prior to the end of the contract, the Contractor must comply with the disposition plan approved by the Contracting Officer.

(d) Subcontracts. The Contractor must insert this clause in all subcontracts that involve the development, launch, or maintenance of a Project website. The Contractor is responsible for the submission of any information as required under paragraphs (b) and (c) of this clause.

(End of clause)

Jami J. Rodgers,

Chief Acquisition Officer.