1_2_1_Request For Information_Digital Credential_OIDP_20260305.pdf

U.S. DEPARTMENT OF HOMELAND SECURITY

U.S. CITIZENSHIP AND IMMIGRATION SERVICES

OFFICE OF INTAKE AND DOCUMENT PRODUCTION (OIDP)

REQUEST FOR INFORMATION (RFI)

Digital Immigration Document Solution (Mobile Employment Authorization Document and Permanent Resident Card EAD/PRC)

RFI Number: 70SBUR26I00000010

Issue Date: 03/05/2026

Response Due Date: 04/06/2026 @ 5:00pm EST

1. PURPOSE:

The U.S. Citizenship and Immigration Services (USCIS), Office of Intake and Document Production (OIDP), is conducting market research to identify industry capabilities, best practices, and innovative approaches to support the issuance of Secure Digital Credentials to serve as digital analogues to existing physical immigration credentials. Digital Credentials will be issued in parallel to the physical credentials and will not be replacing the physical credentials.

This Request for Information (RFI) is issued for information and planning purposes only in accordance with Federal Acquisition Regulation (FAR) Part 10. This RFI does not constitute a solicitation and will not directly result in the award of a contract. Responses to this RFI are strictly voluntary and will be used by USCIS to refine requirements, assess acquisition options, and inform a potential future solicitation.

USCIS is intentionally not prescribing a single technical standard or credential model at this time. USCIS is particularly interested in understanding the tradeoffs between using mDL-style mobile identity approaches and more general-purpose verifiable credential frameworks (e.g., W3C VC/DID) as the core credential model, including hybrid approaches. While the Agency is interested in solutions aligned with mobile identity and mobile driver’s license (mDL) standards, it also seeks information on other standards-based digital credential approaches (e.g., W3C Verifiable Credentials and Decentralized Identifiers, or equivalent), including their relative maturity, interoperability, and suitability for immigration use cases.

2. BACKGROUND:

USCIS administers the nation’s lawful immigration system, safeguarding its integrity and promise by efficiently and adjudicating requests for immigration benefits while protecting Americans, securing the homeland, and honoring our values.

The USCIS Office of Intake and Document Production (OIDP) is responsible for producing secure physical documents, including Employment Authorization Documents (EAD) and Permanent Resident Cards (PRC), to provide evidence of lawful immigration status and lawful employment authorization. These secure documents are integral to identity verification, employment eligibility, and public safety.

To strengthen security, reduce fraud, and increase public safety, USCIS is exploring a digital solution to complement, not replace, existing physical credentials. The concept under consideration is a digital representation of existing immigration credentials to:

Provide secure, verifiable digital versions of immigration credentials like EADs and PRCs for use in user-controlled digital wallets or credential containers (e.g., mobile, browser-based, or other supported platforms);

Leverage modern digital identity and credential standards, including but not limited to mobile driver’s license (mDL) standards (e.g., ISO/IEC 18013-5) and other relevant standards such as W3C Verifiable Credentials and Decentralized Identifiers, where appropriate;

Maintain security and anti-fraud protections equivalent to or greater than physical cards;

Enable privacy-preserving, selective data sharing and user consent;

Support both online and offline verification use cases; and

Integrate with existing USCIS and DHS systems in accordance with federal security, privacy, and accessibility requirements.

USCIS is seeking industry feedback on the feasibility, risks, trade-offs, and best practices associated with this concept, including comparative perspectives on different standards-based approaches (e.g., mDL, W3C VC/DID, and others).

3. OBJECTIVES OF THIS RFI:

Through this RFI, USCIS seeks to:

1. Understand market capabilities to design, develop, deploy, and operate a digital immigration document ecosystem aligned with:

o ISO/IEC 18013-5 mobile document standards and related mobile identity specifications;

o Other relevant digital credential standards (e.g., W3C Verifiable Credentials and Decentralized Identifiers, or equivalent), where applicable;

o Federal Information Processing Standards (FIPS) and NIST digital identity guidance;

o FedRAMP and DHS/USCIS security policies;

o Section 508 and WCAG 2.1 AA accessibility requirements.

2. Identify technical and operational approaches for:

o User-facing digital wallets or credential containers (e.g., mobile apps on iOS and

Android, browser-based wallets, OS-native wallets, or other supported platforms) for credential storage, presentation, and validation;

o A secure, scalable backend and trust infrastructure (e.g., cloud-based services, PKI, registries, or equivalent components);

o Verification tools and interfaces for relying parties (e.g., mobile verifier apps, web-based portals, SDKs, or APIs);

o Integration of APIs for USCIS, DHS, and other authorized federal, state, and local government systems, and potentially private sector relying parties.

3. Assess risks, constraints, ecosystem maturity, and mitigations related to security, privacy, interoperability, user adoption, and relying party adoption, including:

o Program management considerations;

o Continuity of operations planning and support.

4. Gather input on acquisition strategies, including phasing, delivery models, and pricing approaches, to support a multi-year program with pilot(s), incremental rollout, and ongoing operations and maintenance.

4. NOTIONAL CAPABILITY AREAS:

4.1 Standards and Compliance:

USCIS is interested in solutions that can:

Employ FIPS validated cryptographic modules and align with NIST digital identity and authentication guidance;

Operate within or achieve authorization in a FedRAMP authorized cloud environment at an appropriate impact level;

Support Section 508 and WCAG 2.1 AA accessibility for all user-facing components;

Align with DHS and USCIS security and privacy policies, including DHS 4300A and

USCIS privacy compliance processes;

Provide an integrated solution to create a wallet and allow for the entire life cycle of credentials to be managed (e.g. signed, validated, revoked, expired etc.); and

Support, where applicable, emerging and established digital credential standards beyond mDL (e.g., W3C Verifiable Credentials and Decentralized Identifiers, or equivalent), and describe how these can interoperate with mDL-based approaches.

4.2 Core Functional Capabilities:

The envisioned solution would:

Create and manage secure digital representations of immigration credentials to:

o Support the data elements necessary to fulfill the legal and operational functions of the physical cards, while enabling privacy-preserving designs (e.g., derived or scoped attributes rather than always presenting the full data set) Support additional, privacy enhancing data elements and derived attributes (e.g., age verification, document validity status, eligibility indicators);

o Utilize cryptographically signed mobile security objects (MSOs) or equivalent signed data structures for document authentication consistent with applicable standards (e.g., ISO/IEC 18013-5, W3C Verifiable Credentials, or similar); and o Support both ISO standard namespaces (e.g., org.iso.18013.5.1) and, where applicable, custom USCIS namespaces for immigration specific data.

Provide robust security features, including but not limited to:

o End-to-end encryption;

o Hardware security module (HSM) integration for key protection;

o Biometric authentication for access;

o Device binding to prevent unauthorized copying; and o Tamper evident design and cryptographic integrity verification.

Implement privacy and data minimization features, including:

o Selective attribute disclosure;

o Clear user interface indicating what data is requested and shared;

o User visible activity logging and user-controlled log retention;

o No tracking of beneficiary location or usage patterns; and o User controlled data deletion, consistent with federal records and privacy requirements.

Credential Signing Equities: Respondents should describe their approach to:

o Cryptographic Standards and algorithms used;

o Key Management (generation, storage, rotations and protection);

o Signing processes and controls;

o Integration with existing or new PKI or trust infrastructures;

o Scalability & Performance;

o Compliance & Certification (e.g., FIPS 140-3); and o Impacts on user Experience.

Credential Verification Equities: Respondents should describe their approach to:

o Verification protocols and flows (online and offline);

o Trust Model (e.g., PKI, trusts registries, decentralized trust frameworks);

o Revocation & Status Checking;

o Integration with relying party systems;

o Security controls and fraud detection;

o Scalability & Performance;

o Compliance & privacy protections; and o Relying party and end-user experience.

5. QUESTIONS FOR INDUSTRY:

USCIS invites respondents to address the following questions. Respondents may address only those questions relevant to their capabilities, but more complete responses on respondents demonstrated history of implementing and maintaining solutions are encouraged. Where possible, respondents should reference prior implementations, lessons learned, and concrete examples.

5.1 Solution Overview, Relevant Experience, and Standards:

Please provide a high-level overview of your proposed digital immigration credential solution and your relevant experience, including:

• Solution Overview:

o Major components (e.g., user-facing wallets/credential containers, backend services, trust and key management services, verification tools, integration interfaces); and o How these components work together to support issuance, storage, presentation, and verification of digital EADs/PRCs (and related credentials, if applicable).

• Relevant Experience:

o Prior implementations of mobile identity, mobile driver’s license (mDL), or other digital credential solutions for government or large public user populations; and o Experience with high-assurance identity or credential systems involving sensitive personal data and high regulatory or compliance requirements.

• Standards and Architectural Approaches:

o Digital credential standards and protocols that your solution supports today (e.g., ISO/IEC 18013-5 mDL, W3C Verifiable Credentials, Decentralized Identifiers, FIDO2/WebAuthn, OpenID Connect (OIDC), SAML, or others);

o For each supported standard/protocol, indicate whether support is generally available or on your roadmap;

o If you support multiple models (e.g., mDL and VC/DID), describe how these models coexist or interoperate within a single ecosystem (e.g., common underlying data model with multiple presentation protocols); and o How your architecture avoids vendor lock-in and enables portability of credentials and data across wallets, platforms, and vendors.

5.2 Credential Design, Issuance, Binding, and Lifecycle Management:

How would you design, issue, and manage secure digital representations of Employment Authorization Documents (EADs) and Permanent Resident Cards (PRCs)?

Please address:

• Credential Design and Data Model:

o How you would design the data model for digital EADs and PRCs so that it supports the data elements necessary to fulfill the legal and operational functions of the physical cards;

o How your data model aligns with applicable standards (e.g., ISO/IEC 18013-5, W3C Verifiable Credentials/Decentralized Identifiers, or equivalent), including support for:

Standardized data elements and namespaces (e.g., ISO standard namespaces such as org.iso.18013.5.1);

USCIS-specific data elements or namespaces for immigration-specific data;

and

Derived or scoped attributes (e.g., “age over 21,” “document validity status,” “authorized to work,” or other eligibility indicators) to minimize data exposure and support privacy-preserving designs.

o How status and status changes (e.g., active, expired, revoked, superseded, re-adjudicated) would be represented in the data model and communicated to relying parties in both online and offline scenarios.

• Issuance, Binding, and Lifecycle:

o How digital credentials would be bound to the underlying immigration record and/or physical card;

o Processes for initial issuance, activation, renewal, replacement, and revocation of digital credentials;

o How you would manage status changes (e.g., expiration, termination of authorization, re-adjudication) and ensure relying parties receive up-to-date status, including any use of revocation lists, status lists, or other status-checking mechanisms; and o How your solution would support parallel issuance of physical and digital credentials, and any implications for operations and user experience.

• Cryptographic Signing, Key Management, and Integrity:

o What signed data structures you would use (e.g., Mobile Security Objects (MSOs), signed Verifiable Credentials, or equivalent constructs) consistent with the standards you support;

o How cryptographic keys would be generated, stored, rotated, and protected (e.g., use of Hardware Security Modules (HSMs), FIPS-validated cryptographic modules); and o How signing and verification services would be designed for scalability, high availability, resilience, and auditability.

5.3 Wallets/Credential Containers, User Access, and Security:

What types of wallets or credential containers does your solution support, and how would users interact with them?

• Wallets / Credential Containers:

o Supported platforms (e.g., native mobile apps on iOS and Android, browser-based wallets, OS-native wallets, or other supported platforms);

o How users would enroll, activate, and access their digital credentials;

o How users would manage multiple credentials (e.g., holding both an EAD and a

PRC, or potentially other digital credentials) within a single wallet or container;

o How you would support a diverse public user base with varying devices, connectivity, and technical capabilities.

• User Authentication and Access Security:

o Authentication methods used to protect access to digital credentials (e.g., device biometrics, device PIN, FIDO2/WebAuthn), and how they align with NIST SP 800- 63-3 Authenticator Assurance Levels (e.g., AAL2/AAL3) and phishing-resistant authentication;

o Protections such as device binding, prevention of unauthorized copying or export of credentials, and tamper-evident design; and o How you would manage scenarios such as device loss, replacement, or compromise (e.g., wallet recovery, re-issuance, or re-binding of credentials).

• Accessibility and Inclusive User Experience:

o How your solution would ensure compliance with Section 508 and WCAG 2.1 AA for all user-facing components; and o How you would support users with disabilities and users with limited digital literacy, language barriers, or limited access to high-end devices.

5.4 Verification Flows, Trust Model, and Relying Party Adoption:

How would relying parties (e.g., employers, federal/state/local agencies, and authorized private sector entities) verify digital EAD/PRC credentials and integrate them into their systems?

• Verification Methods and Flows:

o In-person verification methods (e.g., contactless/mobile presentation, QR codes, NFC, Bluetooth, or other methods), including how relying parties would initiate and complete a verification session;

o Online/remote verification methods (e.g., APIs, SDKs, web-based verification portals) suitable for employers, government agencies, and other relying parties;

o How your solution supports:

Online verification (with network connectivity);

Offline verification (no network connectivity for the verifier); and

Near real-time status checking (e.g., revocation, suspension, expiration, re-adjudication).

• Trust Model and Trust Infrastructure:

o Trust models and protocols used (e.g., PKI-based trust, trust registries, decentralized trust frameworks), including how relying parties obtain and validate trust anchors, metadata, or issuer information;

o How you would design a governance and trust framework (e.g., management of issuer lists, trust anchors, policies for adding/removing issuers, and alignment with DHS/USCIS oversight); and o How your approach scales to a multi-party ecosystem that may include federal, state, and authorized private sector verifiers.

• Relying Party Integration and Adoption:

o Integration mechanisms for relying parties (e.g., APIs, SDKs, reference implementations, test environments, or sandbox environments);

o How your solution would integrate with existing systems such as employer systems, E-Verify, other federal or state systems, and other DHS/USCIS systems;

o Recommended approaches to support relying party onboarding, training, and adoption, and to encourage consistent and compliant verification practices across different types of relying parties.

5.5 Security Architecture, Privacy Protections, and Fraud Mitigation:

Describe your security and privacy approach for the proposed solution.

• Protection of Data at Rest and in Transit:

o How data at rest and in transit would be protected (e.g., encryption algorithms, key management practices, use of FIPS-validated cryptographic modules); and o How you would segregate sensitive functions and data, enforce least privilege, and monitor access.

• Privacy-Preserving Features:

o How your solution supports selective attribute disclosure, data minimization, and clear user consent, including user-friendly interfaces that indicate what data is requested and shared;

o User-visible activity logging, user-controlled log visibility and retention, and how log retention is designed to be consistent with federal records and privacy requirements; and o How do you avoid unnecessary tracking of beneficiary location or usage patterns, including any design choices that reduce or eliminate collection of telemetry that could be used to infer such information.

• Fraud Detection and Mitigation:

o Fraud detection and mitigation capabilities (e.g., anomaly detection, device reputation, behavioral analytics, anti-tampering measures) and how they are applied in a way that protects program integrity while respecting privacy; and o How suspected compromise of user credentials, user devices, or signing keys would be detected, investigated, and addressed (e.g., revocation, re-issuance, incident response processes).

• Compliance with Federal Guidance:

o How your solution aligns with NIST digital identity guidance (e.g., SP 800-63-3) in terms of identity assurance, authenticator assurance, and, where applicable, federation assurance levels; and o How your solution aligns with DHS and USCIS security and privacy policies, including but not limited to DHS 4300A and USCIS privacy compliance processes.

5.6 Integration, Hosting, Operations, and Performance:

How would you deploy, integrate, operate, and scale the proposed solution?

• Integration with USCIS/DHS Systems:

o Integration with USCIS and DHS systems used for identity proofing, eligibility determination, card production, and case/status management; and o Approaches to minimize changes to existing systems while enabling secure and reliable data exchange.

• Deployment and Hosting Models:

o Supported deployment and hosting models (e.g., FedRAMP-authorized cloud services, on-premises, hybrid); and o How you would achieve or leverage FedRAMP authorization at an appropriate impact level, and how you would align with DHS/USCIS security requirements.

• Operations and Maintenance:

o Operations and maintenance approach, including monitoring, logging, incident response, software updates, security patching, vulnerability management, disaster recovery, and continuity of operations (COOP); and o Service level expectations and typical or target performance metrics (e.g., response times for verification, issuance throughput, availability/uptime).

• Scalability and Performance:

o How you would design the solution to scale to millions of users and high verification volumes; and o Any performance benchmarks or lessons learned from comparable large-scale deployments.

5.7 Ecosystem Maturity, Risks, and Acquisition Considerations:

Based on your experience, what should USCIS know about ecosystem maturity, risks, and acquisition strategy for a digital immigration document program?

• Ecosystem Maturity and Tradeoffs:

o Key strengths, limitations, and tradeoffs of:

mDL-based approaches (e.g., ISO/IEC 18013-5 and related mobile identity specifications);

W3C Verifiable Credentials / Decentralized Identifier-based approaches;

Any other standards-based approaches you recommend for this use case.

o Your assessment of ecosystem maturity (wallets, verifier tools, vendor support, interoperability) for these approaches today, particularly for large-scale public issuance and verification in the U.S.; and o Whether you recommend a single model or a hybrid approach (e.g., a common underlying credential data model with multiple presentation/transport protocols), and why.

• Risks, Dependencies, and Critical Success Factors:

o Major risks, dependencies, or considerations (technical, operational, policy, user experience, or ecosystem-related) that you believe are critical to the success of a digital immigration document program; and o Considerations related to user adoption, relying party adoption, and long-term sustainability of the ecosystem.

• Acquisition and Phasing Recommendations:

o Recommended phasing and delivery models (e.g., pilots, incremental rollout, staged feature deployment);

o Recommended pricing structures or contracting strategies for a multi-year program that includes pilots, incremental rollout, and ongoing operations and maintenance;

o Any additional comments, lessons learned, or best practices USCIS should consider in refining its requirements and acquisition strategy.

5.8 Additional RFI related questions:

Does your company have the capability to fulfil the requirements as outlined in the questions above?

How much lead time would your company need from notification of award to start of contract performance?

In your estimation, how much of this potential requirement would your company need to subcontract to other companies?

Which NAICS code and Product Service Code (PSC) is most applicable for this type of requirement?

Does your company have a contract vehicle under GSA or under a Strategic Sourcing Vehicle (SSV) (GWAC, IDIQ, BPAs) that these types of requirements would best fit? If so, which vehicle is it?

What is your business size and socio-economic status, both in the open market and under any of the contract vehicles identified above?

Are there barriers to competition the Government should be aware of?

What pricing drivers most impact cost for this type of requirement?

Is there a preferred Contract Line-Item Number (CLIN) structure/contract type (Firm Fixed

Price, Time and Materials, Labor Hour, etc.) that you believe would reduce risk? What contract type do you consider the most appropriate and why?

Please describe your company’s core competencies relevant to this requirement.

6. RESPONSE FORMAT AND INSTRUCTIONS:

• Page Limit: USCIS recommends responses not exceeding 25 pages, excluding cover page and appendices.

• File Format: Adobe PDF or Microsoft Word (docx).

• Submission Method:

o Primary Email: Nicholas.R.Posey@uscis.dhs.gov, Carl.F.Prosack@uscis.dhs.gov o Secondary Email: Joshua.S.Riley@uscis.dhs.gov, Andrea.K.Cline2@uscis.dhs.gov

• Email Subject Line: “RFI Response – Digital Immigration Document Solution – [Company Name]”.

• Due Date: Responses are requested no later than [04/06/2026 @ 5:00pm EST].

Please include the following information:

1. Company Information:

o Legal name, address, and website;

o SAM UEI o Point of contact (name, title, email, telephone).

2. Response to Questions for Industry (Section 5):

o Organized using the numbering and headings in Section 5, to the extent practicable.

7. DISCLAIMER AND IMPORTANT NOTES:

This RFI is not a Request for Proposal (RFP), Invitation for Bid (IFB), or Request for

Quote (RFQ).

No contract award will be made based solely on responses to this RFI.

USCIS will not provide reimbursement for any costs incurred in responding to this RFI;

responses are strictly voluntary.

Do not submit classified information. If proprietary information is included, it must be clearly marked; USCIS will handle marked proprietary information in accordance with applicable laws and regulations.

mailto:Nicholas.R.Posey@uscis.dhs.gov mailto:Carl.F.Prosack@uscis.dhs.gov mailto:Joshua.S.Riley@uscis.dhs.gov mailto:Andrea.K.Cline2@uscis.dhs.gov

Respondents will not be notified of the results of the review of their submissions; however, USCIS may contact respondents for clarification or follow-up discussions.