0931_Sources_Sought_w_Draft_SOW_1_1.pdf

DOI | OFFICE OF HEARINGS AND APPEALS | PHD DIGITAL-TO-MAIL

Final • 13 OCT 2026 • Sources Sought Notification Letter

This is not a Request for Proposals.

This is a Sources Sought/Request for Information for market research purposes only.

Sources Sought | Market Research | 14 October 2026

The purpose of this announcement is to conduct market research and identify capable firms and businesses that can provide secure, automated digital-to-physical printing, fulfillment, and mailing services for the Department of the Interior (DOI), Office of Hearings and Appeals (OHA), Probate Hearings Division (PHD). The contemplated requirement will support the distribution of legally sensitive probate documents while reducing the manual print, assembly, and mailing workload currently performed by OHA personnel.

The anticipated service will receive Government electronic files through a secure transmission method; perform black-and-white printing, professional collation, finishing and binding; package and label documents; and induct completed mailpieces into the United States Postal Service (USPS). The service must support routine mailings as well as legally sensitive delivery methods such as Certified Mail with signature-related services and Priority Mail Express. The draft requirement also contemplates a secure dashboard for job submission, tracking, status, reporting, and invoicing.

For planning purposes, the Government anticipates approximately 70,000 individual mailpieces/packages per year, generated from approximately 8,000 Government-submitted jobs/batches, and up to approximately 900,000 printed black-and-white pages. A single Government job may produce multiple recipient mailpieces/packages, and a smaller number of jobs may include large probate packages requiring specialized collation and binding. These quantities are planning estimates only and may change. The service is expected to support OHA offices in Washington, DC; Albuquerque; Twin Cities; Rapid City; and Billings, as well as other OHA locations if required.

Because the work involves sensitive Government information, respondents should be prepared to describe their approach to protecting personally identifiable information (PII), Controlled Unclassified Information (CUI), and print-production data throughout the workflow. The draft Statement of Work includes requirements for data segregation, secure transmission, data minimization and purge, incident response, continuity, system availability, and applicable DOI information technology, cybersecurity, privacy, records management, and accessibility controls. For applicable cloud-hosted capabilities, the Government has identified FedRAMP Moderate as a preferred security posture and will consider substantive evidence supporting any alternate approach where legally permissible. A copy of the draft Statement of Work is attached as Attachment A for reference.

For market research purposes, the Government is considering North American Industry Classification System (NAICS) Code 541199, All Other Legal Services, and Product Service Code (PSC) R604, Administrative – Mailing/Distribution, consistent with the current acquisition. Respondents are specifically invited to recommend an alternate NAICS or PSC code if another classification better reflects the principal purpose of the contemplated requirement.

Following completion of market research, the Government may issue a solicitation for this requirement. Any future solicitation, acquisition strategy, contract type, period of performance, and schedule will be determined by the Government and, if applicable, announced separately in SAM.gov. All planning information in this notice is subject to change.

Responses to this Sources Sought/Request for Information are not offers and shall not constitute responses to any solicitation. No solicitation is currently available; therefore, do not request a copy of a solicitation. The decision to issue a solicitation is solely at the Government’s discretion. This notice is not a commitment by the Government, and the Government will not reimburse respondents for any costs associated with preparing or submitting information.

Respondents will not necessarily be individually notified of the results of the Government’s market research. Information received may be used to inform the acquisition strategy, including whether any future procurement is conducted as a small business set-aside, under another socioeconomic program, or on an unrestricted basis.

Firms that believe they are capable and interested in supporting this requirement may submit a capability statement for consideration by the Government. The capability statement should be no more than ten (10) pages in length and should address the following topics:

- Organization name, UEI, CAGE Code, address, telephone number, email address, and primary point of contact; identify any GSA Schedule, Governmentwide Acquisition Contract, Best-in-Class vehicle, or other existing contract vehicle that could support placement of an order.

- Business size and socioeconomic classification under the proposed NAICS code, including whether the firm is a small business, 8(a), HUBZone, SDVOSB, WOSB, VOSB, SDB, or other applicable classification.

- A brief description of the firm’s proposed solution and end-to-end workflow for secure electronic intake, printing, collation/binding, packaging, USPS induction, delivery tracking, reporting, and invoicing.

- Current production capacity and demonstrated ability to support the estimated annual workload, large multi-page probate packages, workload surges, and the turnaround/cutoff expectations described in the draft Statement of Work.

- Approach to cybersecurity, privacy, PII/CUI protection, customer data segregation, encryption, transient processing data, data purge, audit logging, and cloud security authorization. Identify any FedRAMP authorization and other relevant security evidence or certifications.

- USPS mailing capabilities, including experience with Certified Mail, signature/return-receipt services, Priority Mail Express, address/label controls, mailpiece tracking, exception handling, and reconciliation of postage charges.

- Capabilities for secure dashboards or portals, job-level unique identifiers, originating-office/user tracking, status visibility, management reports, transaction-level invoice support, and system availability/business continuity. Respondents should identify whether the solution can provide downloadable machine-readable job/production and postage detail showing, at a minimum: Government job ID; originating office and authorized user; Government case/reference number; a Government-provided tribe/beneficiary/case-group field when supplied; completed date/time; service/mail class; mailpiece/package count; total pages/images; unit price; extended charge; postage unit and total cost;

additional charges, credits, and discounts with explanations; USPS tracking/status; and notes/exceptions.

- An approximate order of magnitude for pricing and the customary commercial pricing structure for this type of service. Identify each unit of measure and what is included or excluded, including implementation/onboarding, recurring platform/dashboard fees, per-mailpiece/package production and fulfillment, per-page or per-image charges when separate (including included thresholds and overage treatment), binding/finishing, accountable-mail handling, special handling or surcharges, minimum charges, volume tiers/discounts and true-up methodology, and actual USPS postage as a separately funded pass-through cost without markup. Describe treatment of USPS credits/refunds and other billing credits. Estimates are for planning purposes only and are not offers.

- Up to three relevant past performance for comparable secure print, fulfillment, legal-document, Government, or high-volume mailing work.

Include customer/organization, scope, period of performance, approximate contract value, and a point of contact if available.

- A description of any proposed teaming or subcontracting arrangements, including which major functions would be performed by subcontractors and how security and quality controls would flow down to those entities.

The Government is also requesting that firms submit questions, recommendations, and industry feedback that would help the Government finalize the requirement and structure a competitive acquisition. Feedback is particularly encouraged regarding commercial practices, feasible service levels, whether pricing is customarily structured per mailpiece/package, per job, per image/page, or as a hybrid, typical image/page thresholds and volume-discount tiers, invoice-detail and reconciliation formats, security and data-retention requirements, USPS/postage administration, transition and implementation lead times, and any draft requirements that could unnecessarily restrict competition without materially reducing risk.

Vendors shall not contact OHA/PHD program personnel directly regarding this Sources Sought notice. Questions and responses should be submitted to the Contract Specialist identified in the corresponding SAM.gov notice using the method and deadline stated there. Questions and recommendations are encouraged; unless the SAM.gov notice states otherwise, the ten-page limit applies only to the capability statement.

WORKING DRAFT • 14 OCT 2026

Draft Statement of Work — Sources Sought / Market Research Draft | 14 October 2026 | Market Research

1. Purpose and procurement status [Department of the Interior, Office of Hearings and Appeals (OHA) seeks commercially available, secure digital-to-physical printing, assembly, and USPS mailing services for probate documentation under AIPRA. This is a DRAFT market-research SOW for a sources-sought notice; quantities, information-security requirements and award structure remain subject to validation.]

The purpose of this requirement is to acquire a secure, reliable, auditable, and scalable Digital-to-Physical mailing service that protects DOI information throughout the full lifecycle—from electronic receipt through printing, physical handling, USPS induction, delivery tracking, retention, and authorized disposition.

As a result, it will ensure that the new system:

• Protects the confidentiality, integrity, and availability of DOI information, including Personally identifiable information (PII), Sensitive PII (SPII), Privacy Act records, Controlled Unclassified Information (CUI), Federal Contract Information, and Federal records, as applicable.

• Accurately associate each Government-submitted document set with the correct intended recipient and mailing service and prevent cross-job commingling, omission, duplication, or misdelivery.

• Provide measurable, timely printing, assembly, mailing, tracking, support, incident-response, reporting, and continuity outcomes.

• Use secure electronic interfaces and contractor information systems that satisfy the Government-approved security, privacy, accessibility, and authorization requirements before DOI data is introduced.

• Provide auditable transaction, postage, delivery, exception, and invoice information sufficient for Government oversight, payment, records management, and dispute resolution.

• Support orderly transition-in and transition-out without interruption to legally significant probate mailings.

2. Scope and beneficiaries The contractor will accept approved electronic print jobs, print 8.5 x 11-inch black-and-white records, collate and finish multi-page probate packages, prepare addressed envelopes or packages, induct all mail into USPS, and furnish job-level tracking and reconciled billing. Offices include Washington DC, Albuquerque, Twin Cities, Rapid City, and Billings; expansion only by written direction from CO.

Multiple authorized OHA requestors may initiate jobs; only designated government administrators may authorize access and changes. No regional TPOCs assumed.

The Contractor will provide all personnel, management, secure information systems, software/services, production equipment, supplies, facilities, quality controls, USPS integration, reporting, and other resources necessary to perform the requirement.

• Secure electronic intake of Government document files and job metadata.

• Job validation, controlled print production, collation, finishing/binding, packaging, addressing, and USPS induction.

• Support for Government-specified mail classes and accountable mail services, including Certified Mail and Priority Mail Express when ordered.

• Secure job-status dashboard or Government-approved equivalent interface, job/production detail, postage detail, transaction reporting, postage accounting, and invoice support.

• Protection and authorized disposition of electronic and physical DOI information and production waste.

• Technical support, operational support, incident and breach response, business continuity, and transition services.

All required compliance artifacts, assessments, training evidence, accessibility artifacts, records-management support, and security/privacy reporting.

3. Functional & Performance Requirements Support mixed job sizes including hundreds of pages, with stapling, coil/comb binding, rubber bands or sleeves as appropriate to package size; prohibit omission, cross-mailing and recipient data mixing. Exception handling must preserve audit trail and prevent premature mailing.

USPS is mandatory. Support First-Class as appropriate, Certified Mail with signature/receipt evidence, and USPS Priority Mail Express. USPS acceptance/attempt/delivery evidence and service-specific tracking shall be available to the government. USPS Express delivery is subject to USPS published terms; contractor shall not independently guarantee USPS outcomes.

3.1 Transition-In and Readiness

• The Contractor will submit a Transition-In and Implementation Plan that identifies schedule, dependencies, responsible parties, interface configuration, security/privacy authorization activities, test events, training, production-readiness criteria, and rollback/contingency actions. The plan will support Government operational cutover no later than the date established in the contract and will not assume an extension of the incumbent contract.

• No production DOI data will be introduced into a Contractor system, cloud service, or production workflow until the Government has completed all required security, privacy, accessibility, records, and operational readiness reviews and has authorized production use in writing.

• The Contractor will complete end-to-end testing using Government-approved test data. Testing will demonstrate file receipt, access control, job validation, printing, document-to-recipient matching, assembly, labeling, USPS integration, dashboard/reporting, exception handling, and secure deletion/disposition.

• The Contractor will provide a production-readiness package and will not begin operational service until accepted by the Government.

3.2 Secure Electronic Intake and Job Control

• The Contractor will receive electronic document files and associated job metadata only through Government-approved secure methods provided as part of the Contractor's COTS SaaS solution or an approved companion secure-transfer capability. The solution will not require integration with Bison or another OHA ticketing/incident-management platform. The specific transfer method, protocols, endpoints, authentication, and trust configuration will be defined in the solicitation or evaluated as part of the offeror's proposed technical approach.

• Each job will be assigned or retain a unique Government job identifier. The system will prevent duplicate processing and maintain an auditable chain of events from receipt through final disposition.

• The Contractor will validate file integrity, readability, expected file count/page count, required mailing metadata, and job completeness before production.

Exceptions will be quarantined and reported without exposing PII/SPII/CUI in ordinary email or ticket text.

• The Contractor will enforce least privilege, role-based access, unique user identification, MFA as required by the Government-approved architecture, timely deprovisioning, and separation of duties for administrative and production functions.

• The Contractor will segregate OHA electronic files, print queues, temporary files, and physical output from other customers to prevent commingling or unauthorized disclosure.

3.3 Print Production and Document Integrity

• The Contractor will securely print Government-provided documents in the format, sequence, and print characteristics specified in the job submission.

• The Contractor will preserve page order and package integrity for multi-page and high-page-count probate packages and will use automated and/or independent quality controls sufficient to detect missing, duplicate, misordered, truncated, or mixed-recipient pages before release.

• The Contractor will support finishing and binding appropriate to package size, including the methods identified by the Government in the solicitation/order (e.g., staple, comb, coil, sleeve, or other approved method).

• The Contractor will control test prints, spoiled prints, separator sheets, labels, reprints, and other physical media containing DOI information as sensitive material and will securely destroy them in accordance with Government-approved procedures and records-management restrictions.

• The Contractor will maintain job-level production reconciliation showing expected versus produced pages/packages and the disposition of all exceptions and reprints.

3.4 Packaging, Addressing, and USPS Induction

• The Contractor will package each completed document set to prevent loss, damage, disclosure, or mixing in transit and will apply the recipient address and Government-approved return address corresponding to the job.

• The Contractor will use the United States Postal Service for delivery and will support the mail classes and accountable-mail services specified by the Government, including Certified Mail and Priority Mail Express when ordered.

• The Contractor will produce and retain proof of USPS acceptance/induction, tracking numbers, and delivery/exception status associated with the unique Government job identifier.

• The Contractor will not substitute a different carrier or material mail service without written Contracting Officer authorization.

• The Contractor will promptly identify undeliverable, lost, damaged, rejected, delayed, or otherwise exceptional mail and follow the Government-approved exception and re-mail procedure.

Certain PHD mailings establish or trigger legally significant filing, rehearing, appeal, renunciation, or review periods. Current regulations include, among others, 43 CFR § 30.238 (petition for rehearing within 30 days after the decision was mailed), 43 CFR § 4.321(a) (probate appeal within 30 days after the probate judge sent the order and accurate appeal instructions), 43 CFR § 30.181 (renunciation periods tied to mailing of probate decisions/orders), 25 CFR §

15.403 (30-day periods measured from decision mailing dates for de novo review/rehearing/appeal), and the filing/computation provisions at 43 CFR §§ 4.22(c) and 4.310. The Contractor will preserve reliable evidence of the actual USPS mailing/acceptance date and postmark/induction event when applicable.

For each deadline-sensitive job, the Government will identify the required mail-by date or priority designation. The Contractor will process, induct, and document the mailing within the Government-specified deadline and will immediately escalate any circumstance that may jeopardize timely mailing. The Contractor will not independently interpret legal deadlines or change a Government-assigned mail-by date.

3.5 Dashboard, Reporting, and Auditability

• The Contractor will provide a secure, Section 508-conformant dashboard or

Government-approved equivalent that permits authorized users to view job status without exposing information beyond the user’s need-to-know.

• At a minimum, reporting will associate each unique Government job ID with the originating OHA office, authorized originating user identifier, Government case/reference number, Government-provided tribe/beneficiary/case-group field when supplied, receipt time, completed/production time, production status, mailing/USPS acceptance date, USPS service or mail class, tracking number/status, delivery/exception status, reprints/re-mails, and final disposition status.

• Each invoice-period Job/Production Detail export will include, at a minimum: Job ID;

originating user; originating OHA office; Government-provided tribe/beneficiary/case-group field when supplied; completed date/time; Government case/reference number; service type/mail class; mailpiece/package count; total printed pages/images; applicable unit price (for example, package each or other contract unit); extended service/fulfillment billing total;

any volume-tier discount, credit, or adjustment; and exceptions/notes. The export will provide one row per billable job/service line or another Government-approved structure that preserves equivalent detail and supports independent recalculation of the invoice.

• A linked Postage Detail export keyed to the Government job ID will include, at a minimum:

service/mail class; mailpiece/package count; postage unit cost; additional postage, surcharge, or special-service charge; total postage cost; USPS tracking number; acceptance/induction date; delivery/exception status; credits/refunds; and notes explaining any nonstandard charge. Contractor service fees and actual USPS postage will be separately identifiable.

• Dashboard exports and reports will use Government-approved formats and will be available for Government audit, reconciliation, records, performance monitoring, and invoice validation.

Invoice-period detail will be provided in a machine-readable format such as CSV or XLSX (or Government-approved equivalent), with a human-readable invoice summary as required;

PDF-only detail is not sufficient. Every billed charge, surcharge, adjustment, discount, credit, and postage amount must be traceable to the applicable Government job ID, contract pricing unit, and authorization or business rule.

• Reports containing Government user identifiers, case/reference identifiers, tribe/beneficiary metadata, or other controlled information will be protected, retained, transferred, and disposed of in accordance with Sections 4.7, 4.10, and 4.12. Recipient street addresses and document content will not be included in routine billing exports unless expressly required for Government reconciliation.

• The Contractor will maintain tamper-evident or otherwise integrity-protected audit logs sufficient to reconstruct administrative access, file/job events, security-relevant events, and disposition actions for the retention period approved by the Government.

3.6 Technical and Operational Support

• The Contractor will provide a staffed support function during the

Government-defined support window and 24x7 escalation for reportable cybersecurity or privacy incidents and other critical events that require immediate DOI notification.

• The Contractor will provide incident/ticket tracking with severity, timestamps, owner, actions, resolution, and root cause for recurring or significant issues.

• Support procedures will prohibit PII, SPII, CUI, passwords, or other controlled information from being placed in unapproved email subjects/bodies or ticket fields.

3.7 Business Continuity and Disaster Recovery

• The Contractor will maintain and test continuity and disaster-recovery capabilities commensurate with the Government-approved availability category, RTO, RPO, and legally significant mailing deadlines.

• The Contractor will document dependencies on facilities, USPS interfaces, cloud/service providers, telecommunications, utilities, critical personnel, and subcontractors and will maintain contingency procedures for material disruption.

• Where the Government requires an alternate production site, the site will satisfy the same security, privacy, records, personnel, and physical safeguards as the primary site before use.

4. Information Security, Privacy, CUI, and Records Requirements

4.1 Security Categorization and Authorization

• The planning security baseline for this acquisition is FISMA Moderate, with provisional FIPS 199 impact values of Moderate confidentiality, Moderate integrity, and Moderate availability (M/M/M), based on the sensitivity of PII/SPII/CUI and the mission impact of untimely or inaccurate probate mailings. The final FIPS 199 categorization, system boundary, control baseline, and authorization approach will be approved by the responsible DOI officials.

The Contractor will implement the approved baseline and boundary.

• The Contractor will support DOI Risk Management Framework and security authorization activities. An ATO or ATU, as determined by DOI for the selected COTS SaaS solution and authorization boundary, is required before production DOI data is introduced. The Contractor will provide all required system security documentation, privacy/security evidence, scans, assessments, POA&M support, continuous-monitoring reports, and Government access necessary to obtain and maintain that authorization.

• The Contractor will not materially change hosting, architecture, data flow, security controls, subcontractors/subprocessors, production facilities, or other approved security/privacy characteristics without prior written Government approval.

4.2 Cloud Services and FedRAMP — Conditional

If any in-scope capability is provided through IaaS, PaaS, SaaS, or another cloud service, the following apply:

• The cloud service will satisfy the FedRAMP authorization status/impact level and DOI cloud approval requirements identified by the Government before DOI data is processed, stored, or transmitted.

• The Contractor will disclose all cloud service providers and subprocessors, data locations, administrative access paths, backup/replication locations, inherited controls, customer-responsibility controls, and material dependencies.

• The Contractor will provide DOI access to the applicable authorization package and continuous-monitoring artifacts through approved mechanisms and will notify DOI of authorization status changes, significant findings, or material changes affecting the service.

• A non-FedRAMP or alternate cloud approach will not be used unless expressly approved through the applicable DOI exception/concurrence process and incorporated into the contract.

4.3 CUI and Contractor Systems

• The Contractor will identify and safeguard CUI in accordance with 32 CFR Part

2002, the CUI Registry, DOI policy, contract markings/instructions, and applicable NIST requirements.

• Where CUI is processed, stored, or transmitted in a nonfederal system and NIST SP 800-171 is contractually applicable, the Contractor will implement the current required revision and provide assessment evidence using the current NIST SP 800-171A revision or other Government-specified assessment method.

• CUI and SPII will be disclosed only to authorized holders with a lawful Government purpose and need-to-know, including approved subcontractors.

4.4 Encryption and Data Protection

• The Contractor will protect DOI information in transit and at rest using

Government-approved cryptographic methods and modules validated to the current applicable FIPS 140 standard.

• Encryption keys, credentials, passwords, recovery secrets, and administrative tokens will be protected separately from encrypted data and will not be transmitted in the same channel when doing so would defeat the protection.

• The Contractor will prohibit use of removable media for DOI information unless expressly authorized and controlled by Government-approved procedures.

4.5 Vulnerability Management, Monitoring, and Logging

• Contractor-operated systems storing, processing, transmitting, or routing DOI

CUI will be vulnerability scanned at least monthly using authenticated scans acceptable to DOI, consistent with the DOI baseline, and findings will be remediated within Government-mandated risk-based timeframes.

• The Contractor will maintain patch, malware protection, configuration, account, vulnerability, event, incident, and license-management processes appropriate to the solution and will support DOI continuous-monitoring requirements.

• Security and event logs relevant to an incident will be preserved and made available to DOI for the period required by the contract; the DOI baseline contemplates providing incident-period logs and up to six months prior when applicable.

4.6 Cybersecurity Incident Response

• All suspected or confirmed information-security incidents will be reported to the Contracting Officer, COR, DOI CIRC, and the applicable Bureau/Office incident-response point of contact immediately and no later than one hour after becoming aware, consistent with the DOI baseline and current incident-response instructions provided at award.

• The Contractor will not include controlled information in unapproved email subject lines or message bodies. Controlled information transmitted as an attachment will use Government-approved FIPS-validated encryption and passwords/secrets will be sent separately.

• The Contractor will preserve evidence, provide logs/images and other requested information, support containment/eradication/recovery, and cooperate with DOI, OIG, law-enforcement, and Government-authorized incident-response/forensic activities as directed.

4.7 Privacy and PII/SPII

• The Contractor will process PII/SPII only to perform the contract, only for authorized purposes, and only to the minimum extent necessary. The Contractor will not sell, disclose, monetize, profile, advertise against, or otherwise use DOI information for a secondary purpose.

For requirements and solution-design purposes, OHA probate data may include:

(a) PII such as names, addresses, enrollment identifiers, relationships, and contact information; (b) SPII such as birth/death records, family-history information, trust-account-related information, and beneficiary relationship information; (c) Privacy Act data such as case-participant data, address history, notice eligibility, representation relationships, and communications records; (d) CUI such as adjudicative records, hearing records, administrative records, and official probate workflow data; and (e) FOIA-exempt or privileged information such as attorney work product, drafts, legal analyses, deliberative materials, and protected internal communications. The Contractor will protect the information according to the most restrictive applicable marking, handling rule, contract requirement, or Government instruction.

• DOI data will not be used to train or improve commercial or general-purpose AI/ML models, or submitted to public/unapproved generative-AI services, unless expressly authorized in writing by the Contracting Officer after required DOI privacy, cybersecurity, legal, and records reviews.

• The Contractor will support Privacy Impact Assessments, System of Records Notices, privacy control assessments, privacy risk assessments, records of processing/data flows, and other documentation required by DOI for the solution.

4.8 Privacy Breach Response

• Known or suspected breaches of PII in electronic or physical form will be reported to the Contracting Officer, COR, DOI CIRC, and applicable Bureau/Office privacy/incident response point of contact no later than one hour after discovery or awareness, in accordance with current DOI breach-response plans.

• The Contractor will provide an initial report with available facts and a detailed follow-up/update within 24 hours or the then-current DOI-required timeframe, including systems/programs involved, discovery time, event description, types of PII, estimated individuals/records affected, containment, and outstanding actions.

• The Contractor will not notify affected individuals or external parties unless directed in writing by the Contracting Officer after DOI Privacy Official approval.

• The Contractor will provide full cooperation, preserve evidence, support forensic review, and perform Government-directed corrective/remedial actions. Remedies and allocation of breach-response costs will be governed by the contract.

4.9 Physical Security and Chain of Custody

• Facilities and production areas used to handle DOI information will employ access controls, visitor controls, employee authorization, secure storage, secure staging, clean-desk/clear-work-area practices appropriate to the sensitivity, and protections against observation or removal by unauthorized persons.

• The Contractor will maintain chain-of-custody and reconciliation controls from release to print through USPS handoff, including control of partially completed jobs, reprints, spoiled output, labels, and returned/undeliverable items.

• Physical media and production waste containing DOI information will be stored in secured containers and destroyed only using Government-approved methods after applicable retention/legal-hold requirements are satisfied.

4.10 Media Sanitization and Secure Deletion

• The Contractor will use current Government-approved media sanitization methods consistent with NIST SP 800-88 and DOI policy for electronic media, storage, caches, temporary files, backups where technically feasible, and decommissioned equipment containing DOI data.

• The Contractor will provide a reliable mechanism to delete DOI data upon Government direction and will provide disposition/certificate evidence when required. Deletion will be coordinated with Federal records schedules, legal holds, security investigations, and backup-retention requirements.

4.11 Personnel Security and Training

• Contractor and subcontractor personnel will satisfy the Government-designated position risk, background investigation, access authorization, citizenship/residency (if any), and facility/logical access requirements before being granted access.

• Personnel will complete DOI-required security awareness, privacy awareness and role-based privacy training, CUI training, records-management training, and other role-based training before access and annually thereafter, as required by current policy and contract terms.

• The Contractor will maintain training and access records and will promptly remove logical/physical access when personnel no longer require access or separate from contract performance.

4.12 Records Management and Government Data Ownership

• Federal records created, received, or maintained in performance of the contract will be managed in accordance with applicable law, NARA regulations, DOI policy, and the Government-designated records schedules and recordkeeping systems.

• The Contractor will preserve sufficient metadata and technical documentation to permit Government understanding, retrieval, transfer, and lawful disposition of electronic records.

• The Contractor will not destroy, alienate, remove, retain, sell, or disseminate Federal records or non-public DOI information except as expressly authorized by the contract and applicable records schedules.

• At transition/closeout, the Contractor will return/export Government data and records in the format and manner directed by the Government, support legal holds, and certify completion of authorized disposition.

4.13 Section 508 Accessibility

• All in-scope ICT, including the secure dashboard/portal, reports, support documentation, and electronic content, will conform to the applicable Revised Section 508 Standards at 36 CFR Part 1194.

• The Contractor will provide an Accessibility Conformance Report (ACR) using the current Government-accepted VPAT template for commercial ICT and will provide Government-requested testing evidence.

• For developed or modified web/software ICT, the Contractor will provide conformance test results using the Government-required methodology and qualified testers, including DHS Trusted Tester methods/certification when required by DOI.

• Accessibility defects identified before or after acceptance will be corrected without reducing the accessibility of the delivered ICT.

4.14 Supply Chain, Subcontractors, and Data Location

• The Contractor will disclose all subcontractors/subprocessors that will receive, host, process, store, transmit, print, transport, access, administer, or dispose of DOI information and will obtain Government approval where required by contract or records/privacy terms.

• The Contractor will flow down all applicable cybersecurity, privacy, CUI, records, incident/breach, personnel, physical security, accessibility, and other protective requirements to subcontractors at every applicable tier.

The Contractor remains responsible for subcontractor performance, incident/breach reporting, data protection, records management, and compliance.

5. Estimated Workload and Demand Data For planning purposes, the Government anticipates a workload profile and estimated quantities as follows per year:

Workload Element Initial Estimate

Annual Government-submitted jobs/batches Approximately 8,000

Annual mailpieces/packages 70,000

B&W pages Up to 900,000

Collation/binding 1,000 units

Certified Mail w/signature 1,000

Priority Mail Express 1,000

Secure dashboard

Large packages Potentially hundreds of pages

6. Deliverables The following deliverables are proposed for the recompete.

ID Deliverable Minimum Content Due/Frequency Recipient

D-01 Transition-In & Implementation Plan

Schedule, interfaces, dependencies, security/privacy activities, testing, training, cutover, contingency.

Within [TBD] business days after award;

updates through go-live

CO/COR/TPOC

D-02 System/Data Flow & Subprocessor Inventory

Architecture, data flows, locations, components, cloud services, subprocessors, admin paths.

Proposal and update before any material change

CO/COR/ISSO/Privacy

D-03 ATO/ATU Security & Privacy Authorization Package

Artifacts, assessments, POA&M support, architecture/data flow, inherited-control evidence, and other documentation required by DOI to obtain and maintain the ATO or ATU for the COTS SaaS solution.

Initial package per Government authorization schedule;

authorization required before production data;

continuous updates thereafter

DOI

Cybersecurity/Privacy

D-04 Accessibility Conformance Package

ACR/VPAT, test results, remediation status for dashboard/ICT.

Before acceptance and after material change

COR/508 Office

D-05 Training Compliance Certification

Security, privacy, role-based, CUI, records training evidence.

Before access and annually

COR

ID Deliverable Minimum Content Due/Frequency Recipient

D-06 Production Readiness Test Report

End-to-end test evidence, defects, corrective actions, readiness certification, and demonstration that deadline-sensitive jobs can be inducted and evidenced within Government-assigned mail-by dates.

Before go-live COR/TPOC

D-07 Monthly Performance Report Volumes, SLA metrics, exceptions, reprints, incidents, vulnerabilities/patching summary as applicable, trends.

Monthly, within [TBD] business days

COR

D-08 Job/Production Transaction Detail

Government Job ID; originating user/office;

Government case/reference and Government-provided tribe/beneficiary/case-group field when supplied; completed date/time; service type/mail class; mailpiece/package count;

total pages/images; unit price; extended billing total; discounts/credits/adjustments;

tracking/status; exceptions/notes.

Near-real-time dashboard; monthly invoice-period CSV/XLSX export and invoice summary

COR/Finance

D-09 Postage Detail & Reconciliation

Job-level USPS service; mailpiece/package count; postage each; additional charge/surcharge; total postage;

tracking/acceptance/delivery status; notes;

credits/refunds; plus beginning balance, deposits, ending balance, and adjustments.

Monthly with invoice and at closeout

COR/CO

ID Deliverable Minimum Content Due/Frequency Recipient

D-10 Incident/Breach Reports One-hour notification; follow-up and final/root-cause documentation per DOI direction.

Per Section 7 DOI CIRC/CO/COR

D-11 Continuous Monitoring / Assessment Evidence

Scans, remediation status, control evidence, annual assessment support as applicable.

Per Government-approved monitoring plan

ISSO/COR

D-12 Continuity/DR Test Results Test scope/results, deficiencies, corrective actions.

At least annually and after significant change [confirm]

COR/ISSO

D-13 Records/Data Disposition Certificate

Transfer/return/deletion/destruction evidence consistent with records holds/schedules.

Upon direction and at closeout

CO/COR/Records

D-14 Transition-Out Plan Open jobs, data export, account/postage reconciliation, knowledge transfer, deletion, cutoff.

[TBD] days before end/termination

CO/COR

7. Performance Standards and Surveillance Metric Status: The targets below are recommended starting points to enable a performance-based solicitation. The Government must confirm targets after reviewing legal mailing deadlines, actual workload, market research, and incumbent performance. Final accepted standards should be reflected in the PWS and

QASP.

ID Performance Measure Proposed Standard Surveillance Remedy/Response

PS-01 Correct recipient / correct document package

100% Job reconciliation, QC records, sampling, complaints

Any mismatch is a critical defect; quarantine, notify, investigate, correct/re-mail as directed.

PS-02 Page/package completeness and sequence

≥99.95% with no known recipient mix

Production reconciliation and QC sampling

Correct at no additional handling cost when Contractor-caused;

trend/root cause for recurring defects.

PS-03 Deadline-sensitive mail induction

100% inducted by the Government-assigned mail-by date/time; zero Contractor-caused missed legal/program deadlines

Government job priority/mail-by timestamp vs. Contractor and USPS acceptance/induction evidence

Immediate escalation before deadline when at risk; preserve evidence;

corrective action/re-mail only as directed by Government.

ID Performance Measure Proposed Standard Surveillance Remedy/Response

PS-04 Standard/non-deadline job induction turnaround

[TBD after workload/market research; recommended ≤1 business day after accepted job before cutoff]

Timestamp comparison Exception report and corrective action.

PS-05 Dashboard/service availability [TBD; recommended ≥99.9% during defined service hours excluding approved maintenance]

Service monitoring Service restoration and RCA for material outages.

PS-06 Job/tracking status currency [TBD; recommended update within 4 hours of source status]

Automated/report sample Correct feed/integration;

report backlog.

PS-07 Support acknowledgement [TBD by severity; current requirement is 4 hours during business support]

Ticket system Escalation based on severity.

PS-08 Cyber/privacy incident notification

≤1 hour after awareness/discovery

Incident timestamps Critical contractual compliance measure.

PS-09 Privacy breach follow-up Within 24 hours of initial report or current DOI-directed timeframe

Incident record Update until closure.

ID Performance Measure Proposed Standard Surveillance Remedy/Response

PS-10 Invoice/detail and postage reconciliation accuracy

100% of billed amounts traceable to valid Government Job IDs, contract unit prices, mailpiece/package counts, authorized adjustments/discounts, and actual USPS charges;

required detail fields complete

Invoice-detail export-to-rate-table and postage reconciliation sampling

Correct invoice/detail before payment;

refund/credit unauthorized or unsupported charges.

PS-11 Unauthorized access/disclosure/data use

0 known events Audit/incident records Immediate incident/breach response and contractual remedies.

PS-12 Required training/access gating 100% before access; annual thereafter

Training/access records Suspend access until compliant.

PS-13 Accessibility acceptance No unresolved critical/high conformance defects at acceptance; final threshold

TBD

ACR/test results/Government testing Remediate before acceptance or approved exception.

PS-14 Secure disposition 100% of directed disposition actions completed and evidenced

Certificates/logs Corrective action and incident evaluation for failures.

8. Quality Control and Government Quality Assurance

• The Contractor will maintain a written Quality Control Plan that describes controls for file/job validation, recipient/document matching, print quality, page completeness, assembly, mailing labels, billing-unit capture, unit-price and volume-discount application, authorization and explanation of additional charges, invoice-detail completeness, postage, USPS induction, tracking, exception handling, rework, data protection, and corrective action.

• The Government will perform surveillance under a QASP or other contract administration method using performance data, inspection/sampling, dashboard/report review, incident records, invoice/postage reconciliation, user feedback, and audits as appropriate.

• Government surveillance does not relieve the Contractor of responsibility for complete quality control or compliance.

9. Government-Furnished Information, Access, and Responsibilities

• The Government will provide authorized source documents, job metadata, return-address information, and service selections in the agreed interface format.

• The Government will designate the CO, COR, technical/security/privacy contacts, authorized users, and escalation contacts.

• The Government will provide or identify applicable DOI incident/breach plans, records schedules, system/SORN/PIA information, formal FIPS 199 categorization, authorization instructions, approved authorization boundary, and other controlled Government policies required for performance. The planning baseline is FISMA Moderate (M/M/M), subject to formal validation and approval.

• The Government will fund postage in accordance with the contract-established method and will review reconciliation reports.

• No Bison or other OHA ticketing/incident-management system integration is required. Any Government-furnished credentials, identity federation, connectivity, or other access dependencies will be identified in the solicitation or implementation plan.

10. Period and pricing structure Planning assumption: 12-month base requirement; acquisition strategy/options subject to CO determination. Request offerors to distinguish fixed implementation/onboarding and recurring platform/dashboard fees from variable production charges. Variable pricing should separately identify, as applicable, per-mailpiece/package production/fulfillment; per-image or per-page charges and any included image/page threshold or overage; binding/finishing;

accountable-mail handling; special handling/surcharges; and actual USPS postage. For each priced unit, identify what is included/excluded, any minimums, volume tiers and discounts, annual or periodic true-up methodology, and treatment of credits/refunds. USPS postage will be structured as a separately funded reimbursable/pass-through cost at actual cost without markup unless the solicitation establishes another Government-approved method. The pricing structure should permit invoice-period detail to be recalculated from contract unit prices and transaction quantities and should avoid charging the Government twice for the same print, production, fulfillment, or mailing activity.

Government reserves right to revise quantities and structure in any formal solicitation. This draft is not an authorization to perform or a commitment to award.