04_CIRI BOA SOW_Phase XI_2026.pdf

RFI: 70RSAT26RFI000023

Distribution is authorized to U.S. government agencies only. Contains information that may be exempt from public release under the

Freedom of Information Act. Before this SOW is released to the public, approval is required by the Department of Homeland Security Science and Technology Directorate.

Statement of Work (SOW) Department of Homeland Security (DHS)

Center of Excellence (COE) Basic Ordering Agreement (BOA) Critical Infrastructure Resilience Institute (CIRI)

I. Background

The Homeland Security Act (HSA) of 2002, as amended, mandated that Department of Homeland Security (DHS) Science and Technology Directorate (S&T) designate university-based centers for the purpose of establishing a coordinated, university-based system to enhance our nation’s homeland security. DHS established its Centers of Excellence (COEs) program to fulfill this mission. The COEs conduct research, analysis, and educational programs to enhance homeland security capabilities. The HSA also identified that S&T could use grants, cooperative agreements, or contracts. The initial suite of COEs were funded as grants. Since then, S&T has utilized the cooperative agreement instrument (allows substantial federal involvement) for COE base funding. In addition, the DHS S&T Office of University Programs (OUP) established COE Basic Ordering Agreements (BOAs) in July 2010 to allow for contract funding to the COEs, where appropriate. These two mechanisms support the OUP mission to maximize DHS’s return on investment in university-based research and education.

Traditionally, federal funding for basic and applied research and educational programs by universities is through the use of assistance instruments (grants/cooperative agreements), as the fundamental purpose of the work to be performed by the recipient is in the furtherance of the public good. OUP funds grants and cooperative agreements to the COEs to establish fundamental research and education programs in specific multidisciplinary subject matter areas.

DHS S&T expects the universities that comprise the COEs to become self-sufficient over time and to obtain additional sources of funding beyond S&T OUP’s investment in order to support more directed research. Interest in the work of the COEs has increased, particularly among other DHS components.

Other S&T Divisions and DHS components frequently need to access the capabilities created by the COEs at the lead or partner universities for directed research, analysis, and related technical services, both unclassified and classified. It should be noted, however, research that is more directed and research involving classified information cannot be performed under S&T’s grants and cooperative agreements, as the appropriate funding instrument would be a contract. Also, our customers have identified emerging needs that require a timely response (e.g., research on the effects on the U.S. of emerging threat groups and countering violent extremism) that could be more quickly addressed through issuance of a task order under a Basic Ordering Agreement (BOA).

II. Scope of Work

Based on the success of the current BOA vehicles, DHS S&T, OUP intends to issue a BOA to University of Illinois for Critical Infrastructure Resilience Institute (CIRI). Mission: to conduct research and education and deliver results that enhances the resiliency of the nation’s critical infrastructures and the businesses and public entities that own and operate those assets and

Distribution is authorized to U.S. government agencies only. Contains information that may be exempt from public release under the

Freedom of Information Act. Before this SOW is released to the public, approval is required by the Department of Homeland Security systems. With an emphasis on outputs-oriented research, education and workforce development, and early and continuous engagement with end users and homeland security practitioners, CIRI will explore the organizational, policy, business, and technical dimensions of critical infrastructure’s dependence on cyber assets. CIRI will examine how computer hardware and software both contribute to and threaten resiliency and how industry makes decisions about cyber assets which contribute to resilience.

A significant focus of CIRI will be on transitioning research outputs for use by DHS operational components, other homeland security end users, policy makers, decision makers across all levels of industry and government, and community leaders.

The new five-year BOA will be awarded to accommodate additional DHS requirements for COE research, analysis, and technical services. The BOA will be issued for a five-year period, ending in 2031. OUP estimates the value of the task orders issued under this BOA to range from $0.25 - $9 million, and $1-$3 million annually depending on the task orders awarded. We based this estimate on the following:

1. The historical funding of projects as assistance supplements.

2. As the COEs mature and build up their capabilities/tools, DHS S&T’s customers will seek to use those capabilities and tools more.

3. Use of a procurement action in lieu of obtaining assistance authority will allow more

DHS S&T customers to utilize the capacity developed at the COEs.

In support of this research mission, potential projects will focus on:

• organizational, policy, business, and technical aspects of critical infrastructure resiliency;

• interactions of the many different elements of critical infrastructure and the interdependencies between and amongst the many different infrastructure sectors;

• dependency of critical infrastructure sectors on key technologies such as information and communications technology; and

• dynamic interplay of the different stages of the life-cycle of resilience (prepare, protect, mitigate, respond, recover).

Research themes include:

o Understanding Resilient Critical Infrastructure Systems - What are the characteristics of resilient infrastructure systems and how do entities within those systems determine how much risk is acceptable, and perceive opportunities for sharing or reducing potential catastrophic risks?

How are infrastructure sectors demonstrating risk reduction and resilience?

What are the best methods to measure resilience?

How do we know if infrastructures are resilient?

Distribution is authorized to U.S. government agencies only. Contains information that may be exempt from public release under the

Freedom of Information Act. Before this SOW is released to the public, approval is required by the Department of Homeland Security

Which specific critical infrastructure systems have demonstrated success in recovering quickly from a past catastrophic incident? What made them resilient?

What types of infrastructures are least and most resilient, and why? What characteristics allow them to be resilient? To what extent can such characteristics be applied to other infrastructures?

What metrics and methods are critical infrastructure sectors using to demonstrate risk reduction and resilience?

What are the impacts and specific considerations for infrastructure with the increase in accompanying cyber technology?

What is the scope of services, functions, or operations of the entities in the infrastructure sector(s) (e.g., regional, national, or international)?

What are critical linkages between cyber and physical infrastructures, and between these and local or regional communities’ ability to rebound from disasters?

What are potential failure points within infrastructure systems? DHS expects applicants to be familiar with what has already been done in modeling inter-sector linkages, be able to incorporate new research into existing models and studies, and to identify theoretical limitations, and practical constraints.

How are the DHS-relevant critical infrastructure sectors and local industries and businesses organized (e.g., ownership models, factors of production, number of entities in the industry, degree of concentration, upstream and downstream markets, profit margins, substitutes, financial conditions, labor, capital, operations and maintenance, etc.)?

How does persistent and repeated failure of infrastructures impact local industries, businesses and public services, and vice versa?

How do infrastructure owners and operators perceive their risk exposure and the current process for decision-making during times of uncertainty or an incident?

What are the similarities and differences between how public and private infrastructures operate? Do those differences require different solutions for promoting resilience?

How do SLTT entities support resilience activities so that when a catastrophic disruption occurs, infrastructure restoration efforts are coordinated and aligned with real-world needs? How are SLTT entities managing resources during a catastrophic incident and are those practices aligned with the needs of infrastructure owners and operators?

What are the scientific, technical and social barriers that may prevent infrastructure owners and operators from using available methods and tools to conduct cost-benefit analysis and identify their risks, etc.?

What challenges or obstacles (e.g., technical, financial, legal, organizational, structural) do these sectors, industries and businesses face that may limit, prevent or compromise their ability to mitigate against future vulnerabilities to and damages from catastrophic incidents? Are these challenges common across industries?

Where do these obstacles have additive or multiplicative effects?

How does having public-private partnerships in place prior to a catastrophic disruption affect the ability of infrastructures to be more resilient?

Where have large public-private partnerships (e.g., stadiums, Olympic venues, mass transit, water supply, power supply, etc.) been successful, and what general lessons, policies or practices gleaned from these successes could be implemented across the nation?

Distribution is authorized to U.S. government agencies only. Contains information that may be exempt from public release under the

Freedom of Information Act. Before this SOW is released to the public, approval is required by the Department of Homeland Security

Are there unique cultural, social or geographic factors that enhance or detract from developing successful public-private partnerships within defined communities?

Why do some communities show a “resistance to adopting resilience” while others readily adopt preparedness efforts and – perhaps – become more resilient?

Are there human-systems integration principles that can and should be considered and applied to the development of infrastructure resilience and/or critical infrastructure resilience partnerships, public or private?

How can infrastructure owners and operators play a more effective role in resilience-development activities underway at local, state, and regional levels?

What possible future trends or scenarios would incentivize industry, local businesses, the public sector and the community to establish partnerships and actively collaborate to build a more resilient community?

Which types of partnerships seem to be more prevalent or preferred by private sector versus public sector and why? What types of public-private partnership business models in the homeland security mission space are most successful and why?

What are the critical factors in ensuring successful partnerships? Are there key points in time or phases of partnership evolution where government could provide investment or otherwise stimulate and accelerate partnership effectiveness?

To what extent are public funds used in critical infrastructure public- private partnerships? For privately owned infrastructure, what examples exist for federal or SLTT funds being used to support the public/private partnership, or encouraging risk management by private sector owners and operators?

What conditions prevent public funds from supporting public/private partnership efforts? What benefits does the private sector gain from these partnerships?

What are examples of public-private partnerships in cyber-security, particularly as they affect other critical infrastructure sectors?

o The Application of Critical Infrastructure Research in the Real-World - How do existing programs to enhance resilience incorporate the decision-making framework of critical infrastructure systems, i.e., competitive environment, financial and legal constraints, into their programs? How do proposed solutions perform in real-world tests and evaluations?

How do you establish test and evaluation plans for models, technologies, and policies in real-world settings?

What the best methods for measuring outputs of these types of real- world tests and evaluations? How should these plans be scaled and who should be involved?

How can we evaluate the utility of proposed resilience programs in other similar infrastructure environments?

How are risk management strategies transferring risk to others in the larger infrastructure communities?

Distribution is authorized to U.S. government agencies only. Contains information that may be exempt from public release under the

Freedom of Information Act. Before this SOW is released to the public, approval is required by the Department of Homeland Security

How do established relationships between infrastructure entities and the local community (e.g., labor supply, provision of services, tax revenue, or legal agreements) affect the performance of different proposed incentives or technologies?

How are any unique cultural or social factors in the region inhibiting or enhancing resilience?

What baselines exist for the current resiliency of individual infrastructure owner/operators, businesses, and the communities in which they operate?

How do the proposed methods change existing baselines?

What are the trade-offs and/or synergies between national/regional/local public good and owner/operator concerns, and how are these being evaluated?

What are the most effective modes of communications and collaboration used by local industries, utilities, service providers, and state, regional or local governments before, during and after a catastrophic event?

o The Business Case for Infrastructure Resiliency – What are the business cases for investing in more resilient infrastructures and infrastructure systems? How do companies, public utilities, or SLTTs communicate the business cases effectively to their stakeholders? How do decision makers identify the essential stakeholders to involve? How do various stakeholders determine equitable shares of joint investments to reduce risk?

What is the business case for infrastructure sectors to collaborate in creating a resilient community that is able to recover quickly after a catastrophic event?

How did proposed incentives, policies and practices motivate owners and operators to adopt resilience-building strategies? How do they evaluate the potential benefits of a resilience-building strategy before investing?

Do the businesses that make up the infrastructure sectors favor insurance, preventive measures, or risk acceptance? How do they decide? Is there a critical threshold of organizational size, amount of resources, or other considerations that changes the way they make decisions about accepting risk or investing in resilience?

How do organizations plan gradual changes to infrastructure to mitigate threats over time?

How do existing government programs and regulations affect the way businesses operate and respond to catastrophic incidents? What are pros and cons of the existing programs and regulations?

What are the cost-benefit calculations for resilience investments and how can policies or partnerships change this calculation?

What potential funding mechanisms could be created that would encourage investments in infrastructure resilience?

What policy approaches (e.g., tax incentives, liability limits, property rights, regulations, etc.) performed “best” during the Center’s real- world testing and evaluations to enhance mitigation of the effects of future catastrophic incidents? How would they impact an entity’s business operations and response to incidents?

Distribution is authorized to U.S. government agencies only. Contains information that may be exempt from public release under the

Freedom of Information Act. Before this SOW is released to the public, approval is required by the Department of Homeland Security

How would potential incentives encourage disaster mitigation given the organization of critical infrastructure sectors or the relevant business community?

What institutions are best positioned to offer incentives and have strategic or legal authorities to do so?

What lessons learned from the international community or successful practices within a country could help the United States better understand and motivate public and private sector postures in preparedness and resilience? Is there a threshold for individual businesses (e.g., size, customer base, product liability, profit margin, etc.) that enables them to be more resilient? In parallel, is there a threshold for economic make-up (percentage of small, medium, large businesses;

ratio of exports to domestic use production or services, (etc.), that enables a community or region to be more resilient? Is there an analogous threshold for infrastructures?

What incentivizes communities and public service providers to team up with industry to speed recovery?

How can we motivate communities that have not yet experienced a real and credible threat or significant near-miss to change their preparedness behaviors, practices, partnerships and policies to become more resilient?

What investments were made in resilience following significant catastrophic events, and what investments were made to restore things to a less-than resilient state or to abandon areas? What influenced the way that these communities and infrastructure systems responded?

o The Future of Resilience – How will infrastructures evolve and how can resilience be built into future infrastructure systems and business environments?

What would a future resilient infrastructure system look like?

What are possible future states for critical infrastructures (e.g., short term trends over 0-5 years, longer term trends over next 20+ years)?

• What are emerging threats and hazards within the infrastructure sectors that could shape or impact business operations or practices, relationships with the community, the local economy, perception of risk, etc.?

• How will trends alter the interdependencies among the infrastructure sectors, and impact the evolving dynamic risk landscape?

What would be effective future infrastructure resiliency investments, understanding that they may not be fully aligned with existing community needs and industry objectives?

Taking into account possible future trends or scenarios, what would incentivize industry, local businesses, the public sector and the community to invest now in creating more resilient infrastructure and communities?

How can emerging threats and hazards, evolving vulnerabilities, changing consequences, and dynamic risks with homeland security be better considered in resilience policy analyses, and community planning efforts?

What types of integrated national-level risk, trends, and futures information would be useful to stimulate planning for community preparedness and resilience?

Distribution is authorized to U.S. government agencies only. Contains information that may be exempt from public release under the

Freedom of Information Act. Before this SOW is released to the public, approval is required by the Department of Homeland Security

III. Other Contract Details

1. Period of Performance The sole-source BOA will be for a period of (five) 5 years. BOAs of shorter duration would not provide the time that DHS would need to conduct the initial science, test, pilot, and potentially transition research. This 5-year period of performance (POP) is the historical POP for the issuance of the COE BOAs and allows for DHS components to issue multiple year task orders under the BOAs as a strategic sourcing vehicle. The purpose is to streamline ongoing access of the capabilities available from the COEs. Task Order Request for Proposals (TORPs) POPs will vary based on the requirement.

2. Travel

Travel may be required in the performance of the duties listed. All travel will be limited to Contiguous United States (CONUS).

3. DHS-Furnished Information and Property Not applicable.

4. Place(s) of Performance

All work is required to be performed within the United States or its territories.

5. Program Status Report/Deliverables The Contracting Officer (CO) and Contracting Officer Representative (COR) responsible for establishing of the BOAs will manage the contractual and technical aspects of the BOAs themselves, whereas the ordering officers and assigned CORs within each ordering component will manage their respective task orders using a combination of monitoring techniques including the use of in-process review meetings, monthly status reports, and reviews of all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the terms and conditions of the respective task orders and BOAs.

6. Invoices

No invoices will be issued against the BOAs because no funds will be issued on the BOAs.

However, the TORP level COs and CORs will address as per current policy. Rate Agreement Pricing is updated annually by the universities.

7. Classified Information

The BOA task orders do allow for sensitive and classified work

8. Funding Requirements Obligations of funds shall be accomplished solely through Task Orders issued in accordance with the terms and conditions of the BOAs. It is the responsibility of the DHS component requiring offices to commit and obligate sufficient and appropriate funds in issuing their respective Task Orders under the COE BOAs. The amount of funds obligated and made available for payment will be specified in each Task Order. Funding shall be obligated under each Task Order in accordance with federal appropriations laws, federal acquisition regulations specified in each BOA, and internal DHS component procedures and practices.

Distribution is authorized to U.S. government agencies only. Contains information that may be exempt from public release under the

Freedom of Information Act. Before this SOW is released to the public, approval is required by the Department of Homeland Security

9. Foreign Participation Reporting Instructions

The admittance of foreign detailees, scientists, and students into DHS sponsored/funded academic and other programs may result in continuous exposure of DHS information, personnel, IT systems, technologies, facilities, resources, and programs by non-U.S. citizens. In order to mitigate this potential security risk, DHS Management Policy 121-08 stipulates all foreign detailees, scientist, professors, principal investigators, and student nominees involved in long-term (greater than 30 days) DHS sponsored/funded academic or other DHS programs must submit a DHS Form 11055 to Director of the Office of University Programs. The University is required to ensure all foreign investigators and students working on DHS sponsored/funded research or receiving tuition or travel support of any kind through this award, complete DHS Form11055, to report all foreign national students/teaching assistants. Within the Form, Section I (Foreign National Information), Section II (Foreign National Information -Passport/Visa), and Section III (Foreign National Information (Employer Information) must be completed. Sponsor information will be completed internally at S&T.

Please complete, save and return Form 11055 by email to the OUP Director. Do Not Use the “Submit” button on the form. For individual engagements with foreign nations, the Recipient will submit Form 11055 at least 30-days prior to the activity in which the foreign nationals participate. Please indicate your Center of Excellence affiliation and position title in the email.

IV. Points of Contact

DHS S&T Technical Representative:

Dr. Chelsea Thompson Department of Homeland Security Washington, DC Phone: 202-996-4873 Email: chelsea.thompson@hq.dhs.gov

DHS S&T Contracting Officer:

Danette Williams Department of Homeland Security Attn: Office of the Chief Procurement Officer Office of Procurement Operations Washington, DC 20528 Phone: 202-843-8878 Email: danette.williams@hq.dhs.gov

DHS S&T may change the individuals designated as POCs upon notice to the awardee.

mailto:dana.saft@hq.dhs.gov mailto:jessica.wilson@hq.dhs.gov Newman, Susan If OPO objects to this phrasing, add in “Contact information to be provided by the program POC.”