Draft Consolidated Performance Work Statement

ICE Enforcement Systems and Data Reporting Operations, Maintenance, Modernization, and Enhancement Support Services

U.S. Immigration and Customs Enforcement (ICE), Office of the Chief Information Officer (OCIO)

Date: August 3, 2026

1.0 Project Title

Performance Work Statement (PWS) for ICE Enforcement Systems and Data Reporting Operations, Maintenance, Modernization, and Enhancement Support Services.

2.0 Background

U.S. Immigration and Customs Enforcement (ICE), within the Department of Homeland Security (DHS), is responsible for mission operations involving border, economic, transportation, infrastructure, immigration, and law enforcement activities. The ICE Office of the Chief Information Officer (OCIO) is responsible for the management, planning, development, deployment, operation, maintenance, coordination, and evaluation of ICE technology programs and activities.

The Solutions Delivery Division (SDD) within OCIO supports major enforcement systems used by Enforcement and Removal Operations (ERO) and other ICE mission partners. ICE also operates data reporting, data lake, analytics, and business intelligence capabilities that draw from enforcement systems and other source systems to support executive reporting, mission operations, fiscal year-end reporting, ad hoc analysis, data quality, and decision support.

Historically, multiple contracts supported separate enforcement application, data management, and reporting functions. This segmentation required the Government to coordinate system integration, interfaces, database changes, data marts, reporting repositories, user experience, testing, and data quality across multiple vendors. The consolidated award is intended to improve integration, accountability, delivery velocity, operational resilience, data governance, security posture, and modernization of mission systems and reporting capabilities.

ICE seeks a contractor that can operate as an integrated systems, data, and analytics support partner, capable of maintaining legacy enforcement systems while supporting migration, modernization, cloud adoption, DevOpsSec, data lake operations, analytics tooling, reporting repository support, and cross-system enhancement delivery.

3.0 Scope of Work

The Contractor shall provide qualified and experienced personnel, program management, technical oversight, Agile software development, data engineering, reporting, analytics, operations, maintenance, security, privacy, quality assurance, documentation, and system enhancement support for ICE Enforcement Systems and Data Reporting Systems.

The consolidated scope includes the following major service areas:

• Task Area 1 - Program Management: integrated program management, solution integration, transition, Agile/Kanban governance, requirements management, release planning, architecture coordination, security/privacy compliance management, quality governance, deliverables, and performance reporting.

• Task Area 2 - O&M/DevSecOps: Tier 2/3 operations and maintenance break-fix support, application portfolio sustainment, DevSecOps toolchain support, release engineering, system enhancements, modernization, technical debt reduction, CMA migration, and legacy decommissioning.

• Task Area 3 - Data Management: Enforcement Data Management, ERO Data Lake, IDRS/ERR, reporting repositories, Unity Catalog, data governance, ETL pipelines, data quality, dashboards, reports, ad hoc queries, analytics, user enablement, and data innovation.

3.1 Operating Environment

The operating environment includes AWS GovCloud environments, DHS/ICE-approved cloud services, Government-provided development, test, staging, and production environments, approved DevOpsSec toolchains, and supported commercial, open-source, and Government tools. The current and target environment may include, but is not limited to:

• AWS Commercial and GovCloud East/West hosting environments, Containers, Struts 1.x & 2.x, and approved cloud services.

• Data Analytics Platforms such as Palantir Foundry and Gotham

• Java, J2EE, Spring/Hibernate, REACT Native/Supported by Webpack, REST, SOAP, JSON, NIEM, microservices, and responsive web frameworks.

• Application servers and platform technologies such as JBoss, Tomcat, WebSphere, Resin, OpenShift, Docker, or successor

Government-approved technologies.

• Oracle, SQL Server, DynamoDB, PostgreSQL, Databricks, Delta Lake, Unity Catalog, data stores, data warehouses, and data marts.

• Databricks Workflows, Delta Live Tables, CDC, ETL/ELT pipelines, and related data engineering services.

• Qlik Sense,SQL analytics, notebooks, dashboards, reports, and ad hoc query tools.

• JIRA, ServiceNow, Confluence, ELMS, GitHub Enterprise, Jenkins, SonarQube, Terraform, Ansible, Chef, Vault, OKTA, or approved successor tools.

• Security, monitoring, scanning, logging, application performance monitoring, vulnerability management, audit, incident response, and access control tools approved by ICE.

The Contractor shall support modernization and migration from legacy tooling to approved target-state capabilities as directed by the Government, while maintaining operational continuity for production systems and reporting capabilities.

4.0 Applicable Policies and Standards

The Contractor shall comply with the latest version of all technology standards, architecture policies, security requirements, privacy requirements, accessibility standards, data governance standards, and OCIO processes applicable to the ICE IT environment. Applicable publications include, but are not limited to:

• DHS 4300A Sensitive Systems Handbook and DHS 4300A Sensitive Systems Policy Directive.

• DHS 4300B National Security Systems Handbook and DHS Management Directive 4300.

• DHS Systems Engineering Life Cycle (SELC) guidance and ICE System Lifecycle Management (SLM) requirements.

• ICE Technical Reference Model, ICE Application Security Cyber Security Standard, ICE Architecture Test and Evaluation

Plan, ICE Cybersecurity Standards, and ICE Enterprise Systems Assurance Plan.

• ICE Agile/DevOpsSec guidance, ICE Agile Development Framework, and ICE Web Standards and Guidelines.

• NIST Computer Security Resource Center standards, guidelines, and special publications.

• Privacy Act of 1974, DHS/ICE privacy requirements, PIA/PTA/SORN support requirements, and records/data management requirements.

• Section 508 of the Rehabilitation Act and applicable DHS accessibility testing requirements.

• DHS data management policy, DHS Enterprise Data Management Office requirements, NIEM adoption policy, HLS EA, ICE TRM, IPv6, PIV, FIPS, FedRAMP, and COTS/cloud security requirements.

The Contractor shall not deviate from SLM, security, architecture, privacy, accessibility, or configuration management processes without express Government approval through the COR, CO, or other designated Government authority.

4.1 DHS Enterprise Architecture, Data Ownership, and Open Architecture

All solutions, services, data assets, information exchanges, and data standards developed, maintained, enhanced, or integrated under this PWS shall be compliant with DHS Enterprise Architecture, HLS EA, ICE TRM, DHS data management policy, and applicable DHS/ICE architecture guidance. All developed or modified data assets and information exchanges shall be documented, governed, and made available for review and approval as required by DHS/ICE data governance processes.

All program data associated with this acquisition shall be owned by the Government. The Contractor shall make Government-owned data accessible to the Government within one business day, or a shorter timeframe specified elsewhere in this PWS, using secure and Government-approved access methods. The Contractor shall provide sufficient metadata, schema, data dictionaries, table definitions, reference data, lineage, and documentation for the Government to interpret and use the data.

The Contractor shall prioritize open architecture, portability, interoperability, secure APIs, standards-based data exchange, reusable services, and reduction of technical debt. Proprietary or closed technologies shall not be introduced without Government approval.

5.0 Tasks

The Contractor shall provide all services necessary to accomplish the tasks below. The consolidated requirement is organized under three main task areas: (1) Program Management, (2) O&M/DevSecOps, and (3) Data Management. Work shall be tracked and managed using Government-approved tools, including ServiceNow for operational tickets and JIRA or approved successor tools for development, enhancement, backlog, research, defect, and release items. Contractor personnel shall document activities, dependencies, blockers, decisions, risks, issue status, story sizing, acceptance criteria, testing, release readiness, deployment outcomes, data quality results, and operational metrics in the approved tools.

Main task area

Task title Included workstreams

5.1 Program

Management

Integrated PMO, solution integration, transition, Agile/Kanban governance, requirements and release management, security/privacy compliance management, QA governance, deliverables, staffing, and performance reporting.

5.2 O&M/DevSecOps Tier 2/3 break-fix, application portfolio sustainment, DevSecOps toolchain support, system enhancements, modernization, CMA migration, legacy decommissioning, and release engineering

5.3 Data Management Enforcement data management, ERO Data Lake/IDRS/ERR operations, Unity Catalog, data governance, ETL pipelines, data quality, reporting, analytics, and user enablement support.

5.1 Task Area 1 - Program Management

The Contractor shall provide a single integrated program management and solution integration function for the consolidated award. This task area establishes the management, governance, coordination, reporting, compliance, quality, and transition framework used to direct the O&M/DevSecOps and Data Management task areas. The Contractor shall manage the consolidated requirement as one accountable delivery model while maintaining sufficient visibility into each portfolio, system, data asset, release, and funding source.

5.1.1 Integrated Program Management, Solution Integration, and Technical Oversight The Contractor shall provide integrated program management, solution integration, release planning, technical oversight, architecture coordination, personnel management, cost/schedule/risk reporting, quality oversight, security/privacy coordination, and cross-track governance for the consolidated award. At a minimum, the Contractor shall:

• Provide a single integrated PMO and governance model for Enforcement Systems, ERO Data Lake, IDRS/ERR, reporting, analytics, and related data management activities.

• Lead integrated release planning with Government project managers, product owners, system owners, ISSOs, privacy personnel, data stewards, and business stakeholders.

• Manage personnel, staffing plans, backfill plans, onboarding, access, training, sprint/Kanban ceremonies, integrated schedules, risks, issues, dependencies, decisions, and communications.

• Create, groom, manage, and report on user stories, epics, technical tasks, blockers, story sizing, issue tracking, and sprint/release progress in JIRA or approved successor tools.

• Maintain integrated technical documentation including architecture diagrams, logical design documents, interface documentation, data dictionaries, data asset catalogs, installation documents, test scripts, SOPs, and system lifecycle artifacts.

• Coordinate with OCIO, OCISO, cloud/infrastructure teams, operations teams, external Departments and Agencies, law enforcement partners, and other stakeholders as required.

• Provide technical team leads by portfolio or track to manage concurrent work efforts, releases, backlog priorities, and production support.

• Provide timely Government reporting on accomplishments, planned work, production outages, help desk counts, quality metrics, burn rate, release milestones, backlog, staffing, risks, issues, technical debt, security findings, data/reporting operations, and data quality trends.

The Contractor shall maintain 100% staffing for Firm-Fixed Price requirements. If FFP staffing levels fall below 100% and required tasks are not being met for more than 30 calendar days, the Government may withhold 10% of the fixed monthly rate for each affected period of performance. If the staffing shortfall is corrected within 30 calendar days, a penalty shall not be applied.

5.1.2 Transition-In and Transition-Out

The Contractor shall execute transition-in and transition-out activities with no disruption to operational services. Full performance for O&M, service desk, operational monitoring, security, privacy, reporting, data pipeline support, and all transition activities shall begin on day one of the base period unless otherwise directed by the Government.

The Transition-In Plan shall include, at a minimum:

• Inventory and orderly transfer of GFE/GFP, software, licenses, credentials, repositories, access rights, data assets, documentation, tickets, backlogs, reports, dashboards, data models, source code, databases, interface artifacts, and security/privacy artifacts.

• Knowledge transfer from incumbent contractors and Government teams for applications, databases, services, pipelines, reports, dashboards, data marts, data lake assets, security findings, production support, and special projects.

• A staffing, onboarding, training, suitability/EOD, account access, and workplace logistics plan.

• Operational continuity procedures for tickets, outages, deployments, data pipeline jobs, recurring reports, fiscal year-end reporting, service desk escalation, and after-hours support.

• Risks, dependencies, schedule, responsible parties, and completion criteria for all transition activities.

The Transition-Out Plan shall be submitted 90 days prior to the end of the final awarded period of performance and shall include inventory, transfer, knowledge sharing, final deliverables, source code, data, documentation, credentials, GFE/GFP, software, licenses, backlogs, unresolved tickets, open security/privacy items, and support to any successor contractor or Government team.

5.1.3 Agile, Kanban, Requirements, and Release Management

The Contractor shall use Agile Scrum, Kanban, Lean-Agile-DevSecOps, and Government-approved development and operations practices appropriate to each workstream. Application enhancement and modernization work shall be managed through sprints/releases unless an alternative Government-approved delivery method is required. Service desk and operational support may be managed through Kanban or an approved Information Technology Infrastructure Library (ITIL) process.

The Contractor shall ensure that functional, technical, reporting, data, security, privacy, accessibility, and operational requirements are accurate, testable, complete, traceable, and ready for development before work begins. Requirements artifacts shall include, as applicable:

• User stories, epics, business requirements, technical requirements, acceptance criteria, definitions of done, dependencies, blockers, related stories, priority, rank, label classification, and estimated level of effort.

• Business process flows, decision flows, swim lanes, entry and exit criteria, business rules, data rules, wireframes, mockups, use cases, training impacts, release notes, and deployment impacts.

• Data requirements, source-to-target mappings, data lineage, data quality rules, data classification, data access roles, reporting requirements, dashboard requirements, and schema impacts.

• Automated unit, functional, integration, regression, performance, security, Section 508, and data validation test coverage.

For development work, story point tickets greater than 3 shall include subtasks for unit testing, cookbook/playbook or deployment documentation, and code review. The Contractor and Government Project Manager shall agree on a Level of Effort (LOE) before commencing system modifications.

5.1.4 Security, Privacy, C&A/ATO, and Compliance Management

The Contractor shall manage and support security, privacy, authorization, continuous monitoring, access control, vulnerability management, incident response, and compliance activities required to maintain ATOs and comply with DHS/ICE, NIST, FISMA, FedRAMP, cloud, COTS, PIV, privacy, and sensitive information requirements. Security and privacy activities shall be coordinated through Program Management and executed across the O&M/DevSecOps and Data Management task areas.

• Create, update, and maintain security authorization documentation, System Security Plans, Contingency Plans, Configuration Management Plans, POA&M artifacts, Interconnection Security Agreements, Rules of Behavior support, separation of duties matrices, user certification records, training records, and related security artifacts.

• Support ISSOs, OCISO, system owners, privacy officers, data stewards, and authorizing officials with annual security activities, scans, self-assessments, contingency plan tests, incident response tests, control artifacts, audits, and continuous monitoring.

• Conduct security reviews of code, architecture, configurations, data pipelines, cloud services, access controls, reports, dashboards, and deployments.

• Support vulnerability scanning, scan artifact production, vulnerability remediation, POA&M closure, patch management, application security scans, database security scans, and scan result reporting.

• Support privacy documentation including PTA, PIA, SORN, privacy artifacts, privacy impact analysis of system changes, data protection, records management, and Privacy Lead coordination.

• Report incidents, sensitive information incidents, PII/SPII incidents, malware, unauthorized access, and security events according to DHS/ICE timelines and requirements.

• Ensure Contractor employees complete required DHS security, privacy, rules of behavior, NDA, suitability, PIV, and annual training requirements before accessing sensitive information or IT systems.

5.1.5 Quality Assurance, Testing Governance, QASP/QCP, and Performance Reporting The Contractor shall provide quality assurance governance, quality control, test strategy, test planning, test automation, test execution oversight, testing evidence, release readiness, and post-release validation for applications, data pipelines, reports, dashboards, data models, databases, APIs, interfaces, and cloud components. Testing shall include unit, functional, integration, regression, performance, data integrity, security, accessibility, and user acceptance support as applicable.

• Develop and maintain automated test scripts, regression test scripts, service desk scripts, technology compliance reports, test data, test reports, FQT evidence, Section 508 results, and executive summaries of test outcomes.

• Support Government UAT, integration testing, engineering testing, and setup of production-like data in lower environments using approved data replication or masking approaches.

• Provide QASP/QCP metrics, monthly surveillance metrics, defect trends, release quality metrics, missed requirements metrics, on-time deployment metrics, availability metrics, data quality metrics, and corrective action recommendations.

• Provide root cause analysis after test failures, deployment failures, production outages, critical data/reporting outages, and recurring operational defects.

• Coordinate with Section 508, security, privacy, architecture, and data governance stakeholders before release readiness approval when applicable.

5.2 Task Area 2 - O&M/DevSecOps

The Contractor shall provide operations, maintenance, sustainment, DevSecOps, release engineering, modernization, enhancement, migration, and decommissioning for enforcement applications, services, databases, interfaces, cloud components, and approved technical environments. This task area covers application and platform O&M/DevSecOps; data-specific operations are addressed in Task Area 3 and coordinated through the integrated PMO.

5.2.1 Tier 2/3 O&M Break-Fix and Operational Support

The Contractor shall provide Tier 2/3 O&M break-fix support for systems, subsystems, applications, databases, interfaces, cloud components, network interfaces, queues, services, security controls, and web services within scope.

The Contractor shall provide mission system Tier 3 support on a 24x7 basis as required for critical production incidents. For data lake, reporting, and analytics support, the Contractor shall follow the coverage requirements in Task 5.3 and maintain a documented critical incident escalation process unless the Government directs full 24x7 coverage for those systems. The Contractor shall:

• Triage, analyze, resolve, document, and close incidents, defects, service desk tickets, production issues, security vulnerabilities, user access issues, interface failures, queue issues, and operational anomalies.

• Support escalations from Tier 1 and Tier 2 service desks and provide technical resources capable of restoring systems and services to full operating capability.

• Develop after-action reports, root cause analyses, revised troubleshooting scripts, and knowledge base updates after escalated incidents or outages.

• Resolve bugs, system issues, interface issues, operational defects, and security vulnerabilities as directed by the Government.

• Support testing and implementation of critical patches, zero-day response, unit testing, FQT, validation testing, Section 508 validation, regression testing, and operational maintenance windows.

• Collaborate with ICE Operations, OCISO, cloud/infrastructure teams, external Departments and Agencies, and law enforcement partners to maintain interfaces, queues, databases, web services, and connectivity.

• Support GAO/OIG audits, ad hoc operational data calls, production support requests, and other O&M support requirements as directed by the Government.

5.2.2 Application Portfolio Support

The Contractor shall provide O&M, break-fix, enhancement, security, privacy, integration, documentation, testing, migration, residual support, and decommissioning support for Enforcement Systems application portfolios. Portfolio support shall account for legacy operations, CMA migration, non-migrating systems, read-only or sunset states, interface continuity, reporting impacts, and data management impacts.

The application portfolio scope includes, at a minimum, the following areas as finalized by the Government:

System Category Subcomponents / Services Booking Systems To Be Provided with RFQ Case Management Systems To Be Provided with RFQ Logistics and Bonds Systems To Be Provided with RFQ Application Interfaces & Data Exchange To Be Provided with RFQ

5.2.3 System Enhancement, Modernization, and Technical Debt Reduction The Contractor shall provide system enhancement development and modernization support for applications, databases, interfaces, cloud environments, DevSecOps pipelines, test automation, and operational tools. This support shall be tracked separately from FFP break-fix work and managed through Government-approved T&M CLINs or optional CLINs. Enhancement support includes, at a minimum:

• Infrastructure modernization that improves functionality, performance, availability, scalability, security, or maintainability.

• Application enhancements and modifications to improve business functionality, user experience, performance, accessibility, data integrity, compliance, security, and operational effectiveness.

• Database, data model, and interface enhancements that support application functionality, source system accuracy, API modernization, and operational reporting impacts.

• System interface enhancements, API enhancements, message queue improvements, REST/SOAP/JSON/NIEM changes, and external partner integration.

• Enhancements that support law enforcement operations, executive orders, immigration policy changes, Title 8 program needs, field operations, reporting deadlines, data calls, and approved operational priorities.

• Security, privacy, Section 508, performance, resilience, monitoring, and maintainability improvements as approved by the

Government.

5.2.4 DevSecOps, Cloud Operations, Release Engineering, and Configuration Management The Contractor shall support Government-approved DevSecOps, cloud operations, release engineering, configuration management, automation, monitoring, and deployment practices. The Contractor shall:

• Support CI/CD, source control, build automation, deployment automation, environment configuration, test automation, static code analysis, vulnerability scanning, release traceability, and configuration management using Government-approved tools.

• Maintain and improve DevSecOps pipelines for application code, infrastructure-as-code, containerized services, databases, interfaces, scheduled jobs, and approved cloud components.

• Support cloud and environment monitoring, log analysis, patching, application performance monitoring, release readiness reviews, deployment planning, rollback planning, and post-release validation.

• Document configuration baselines, deployment procedures, cookbook/playbook materials, release notes, system login release history, and operational SOPs.

• Coordinate with ICE Operations, OCISO, cloud/infrastructure teams, ISSOs, privacy personnel, and system owners to ensure releases maintain security, privacy, and operational readiness.

5.2.5 CMA Migration, Legacy Decommissioning, and Target-State Transition The Contractor shall support systems being migrated to the Case Management and Analytics (CMA) platform and shall maintain operational continuity during migration, decommissioning, read-only operations, residual sustainment, and target-state transition.

The Contractor shall:

• Support application-by-application CMA migration/decommissioning analysis, including business functionality, biometric dependencies, external interfaces, forms, services, data migration, reporting impacts, and residual support needs.

• Maintain legacy systems while migration activities are underway and support decreasing legacy support as migration activities are completed and systems become operational on CMA or another Government-approved target platform.

• Support target-state integration, interface migration, data migration, operational transition, decommissioning documentation, access changes, security/privacy updates, and user communications.

• Coordinate with Data Management to preserve source data integrity, data lineage, reporting continuity, historical data availability, and downstream data products during migration or decommissioning.

5.3 Task Area 3 - Data Management

This task area consolidates Enforcement Data Management, ERO Data Lake, IDRS/ERR/IIDS, reporting, analytics, and data innovation work under one accountable data management structure.

The Contractor shall provide integrated data management, data engineering, data lake/lakehouse operations, reporting, analytics, data governance, data quality, data stewardship, data modeling, data pipeline, dashboard, query, and user enablement support.

5.3.1 Enforcement Data Management and Source Data Support

The Contractor shall support Enforcement Data Management systems, source system data stores, data marts, interfaces, and reporting data sources and related transactional and reporting data assets. The Contractor shall:

• Maintain database artifacts, data dictionaries, data asset catalogs, interface documentation, source/destination mappings, triggers, stored procedures, indexes, business rules, data quality controls, and data management plans.

• Support source data interface documentation and coordination for source systems as finalized by the Government.

• Coordinate with application portfolio teams in Task 5.2 to ensure application changes, interface changes, CMA migration, and decommissioning activities are reflected in data models, lineage, reports, dashboards, and downstream data products.

• Ensure that ERO Data Lake, DSSDM, Qlik, Databricks, and other reporting/analytics capabilities receive accurate, timely, governed, secure, and well-documented data from source systems.

5.3.2 ERO Data Lake, IDRS/ERR O&M, and Reporting Operations

The Contractor shall manage, maintain, enhance, and support the ERO Data Lake, IDRS/ERR/IIDS capabilities, reporting repositories, data engineering processes, data governance, data quality, dashboards, reports, ad hoc queries, analytics tooling, fiscal year-end reporting, and end-user enablement. IDRS is conceptually composed of data sources, ETL/ELT processes, centralized data repositories, and analytical applications.

For ERO Data Lake, IDRS/ERR, reporting, and analytics support, the Contractor shall provide business-day support from 7:00 AM to 7:00 PM Eastern Time and maintain a documented critical incident escalation process unless the Government directs full 24x7 coverage. The Contractor shall:

• Provide Tier 3 service desk support, Kanban management for operational work, Agile Scrum for development and enhancement work, and coordination with OCIO system engineers and cloud environment owners.

• Maintain and monitor the DSSDM database hosted in Databricks, including star schema data models, incremental DSSDM ETL processes, daily incremental ETL using change data capture, and downstream data products.

• Maintain and monitor recurring reports, Qlik Sense dashboards where applicable, SQL analytics, notebooks, visualization tools, and ad hoc query support.

• Support approximately 100 ad hoc query requests per month for ERO Data Lake/ERR unless the Government revises the workload estimate.

• Support fiscal year-end reporting activities, additional report creation, data consistency, validation, executive reporting, operational data calls, and reporting deadlines as required.

• Maintain and enhance dashboards, reports, data models, source-to-target mappings, report usage statistics, report availability, performance metrics, testing evidence, release documentation, and user support documentation.

5.3.3 Unity Catalog Administration and Data Governance

The Contractor shall administer Unity Catalog and related data governance capabilities, including creation, maintenance, organization, classification, tagging, access control, lineage, audit trails, data stewardship, permissions reviews, user roles, security alerts, and compliance with DHS/ICE data governance requirements. The Contractor shall ensure that sensitive, regulated, or mission-critical datasets are classified, governed, and protected according to Government requirements.

5.3.4 ETL/ELT Pipeline Management

The Contractor shall build, maintain, monitor, troubleshoot, and optimize transactional data pipelines, DSSDM feeds, medallion architecture layers, Databricks workflows, Delta Live Tables, OAS/legacy data flows where applicable, batch ingestion, streaming ingestion, CDC, data replication, and downstream data products. Pipelines shall be robust, scalable, secure, auditable, cost-effective, and documented.

5.3.5 Data Quality, Stewardship, and Operational Excellence

The Contractor shall implement data quality checks, validation routines, stewardship processes, data profiling, cleansing, enrichment, completeness checks, consistency checks, reconciliation, and anomaly detection. The Contractor shall monitor pipeline success, job performance, query performance, workload performance, resource utilization, cluster scaling, storage costs, and operational incidents. The Contractor shall recommend corrective actions and improvements to reduce recurring failures and improve data quality.

5.3.6 Reporting, Analytics, Collaboration, User Enablement, and Training The Contractor shall support reporting, analytics, collaboration, onboarding, training, and enablement of data lake, reporting, dashboard, notebook, and analytics users. The Contractor shall provide documentation and best practices for Unity Catalog, Databricks notebooks, SQL analytics, Qlik Sense streams, dashboards, report development, access requests, data interpretation, approved reporting procedures, and end-user support.

5.3.7 Advanced Analytics, BI Innovation, and Data Management Modernization The Contractor shall provide subject matter expertise and approved innovation support for reporting, visualization, data engineering, data mart modernization, real-time data sharing, data replication, ML/AI proof-of-concepts, advanced analytics, data quality automation, and new tools. The Contractor shall analyze the marketplace for open-source and leading reporting/visualization tools, compare capabilities to ERO and ICE requirements, conduct proof-of-concepts when approved, and implement improvements only after Government approval.

Data Management innovation may include design of future-state roadmaps for data marts, improvements to Delta Lake data stores, data marts, ETL/ELT processes, live data sharing, replication approaches, data quality automation, and approved advanced analytics capabilities.

Advanced Analytics and Innovation may include:

• Provide subject matter expertise for Databricks and Qlik Sense to support adoption and advanced usage by the data scientist and operational user base, including Databricks Notebooks and SQL Analytics, Qlik Sense Streams, data pipelines, and dashboards.

• Analyze the current marketplace of open source and leading reporting and visualization tools, perform assessments of tool functionality compared to ERO requirements, and make recommendations for potential expansion of existing tool sets.

• Conduct proof-of-concept initiatives using new tools to enhance reporting, analytics, or dashboarding capabilities.

• Design future state roadmaps for new data marts to better leverage Delta Lake data stores; recommend and implement improvements to data stores, data marts, and ETL processes upon government approval.

• Recommend and implement innovative solutions for real-time data sharing and replication, as approved by the government.

• Analyze opportunities for Machine Learning and Artificial Intelligence capabilities within existing data stores and warehouses; conduct proof-of-concept initiatives and implement ML/AI technologies to advance data insights and improve data quality, as approved.

6.0 Government Furnished Equipment

ICE will provide GFE as necessary to support work under this PWS. Contractors must use GFE and Government-approved systems to perform work and are prohibited from placing ICE data on non-GFE or non-approved technology. GFE, software, licenses, training materials, policies, procedures, electronic work products, source code, documentation, and data generated under this PWS shall be Government property unless otherwise stated by the contract.

The Contractor shall maintain an accurate GFE inventory and provide reports upon request and monthly as part of status reporting. The report shall include asset tag, serial number, assigned resource, primary office location, date issued, description, and status. The Contractor shall provide executed property receipts within 48 hours of receipt of Government equipment.

7.0 Place of Performance

Work, meetings, and briefings shall be performed primarily remotely using Government-approved video conferencing, collaboration, email, and phone technologies, unless the Government identifies specific onsite requirements. Occasional travel to ICE offices in the Washington, DC metropolitan area or other Government-approved locations may be required for meetings, briefings, stakeholder engagement, training, property management, PIV/GFE activities, or mission support.

The Contractor shall establish a collaborative work environment conducive to Agile and iterative delivery, including virtual daily scrum/Kanban boards, accessible shared documentation, and effective collaboration with business sponsors, stakeholders, system owners, product owners, project sponsors, and development/data teams.

8.0 Period of Performance

The recommended period of performance for the consolidated task order is one 12-month base period with four 12-month option periods. Transition-in shall occur during the base period, and transition-out shall occur during the final option period. Full performance level for O&M support and transition activities shall begin on day one of the base period.

9.0 Progress Meetings and Governance Ceremonies

During the period of performance, the Contractor shall participate in meetings and ceremonies required by the Government, including daily stand-ups, Kanban reviews, backlog grooming, sprint planning, sprint reviews, sprint retrospectives, release readiness reviews, weekly progress meetings, monthly status reviews, quarterly program management reviews, security/privacy meetings, data governance meetings, architecture reviews, and ad hoc stakeholder meetings.

The Contractor shall limit attendance to personnel necessary to accomplish meeting objectives. Non-essential personnel shall not attend unless approved by the ITPM or COR.

10.0 Deliverables and Delivery Schedule

The Contractor shall submit all deliverables to the COR and designated Government representatives using Government-approved collaboration tools and email notifications. Unless otherwise noted, all days are calendar days. Deliverables shall be professionally prepared, clear, accurate, editable by the Government, timely, and sufficiently complete for Government review and acceptance.

Deliverable Type Delivery method Frequency / due date Kick-Off Meeting Brief Briefing PowerPoint or approved format Within 10 calendar days after award Transition-In Plan Document Word or approved format Within 10 calendar days after award; updated through transition completion Transition-Out Plan Document Word or approved format 90 calendar days prior to completion of PoP Project Management Plan Document Word or approved format 30 calendar days after award; updated as needed Integrated Master Schedule Report / schedule MS Project or approved equivalent Initial due 15 calendar days after award;

updated weekly by Friday noon ET Weekly Status Report Report PowerPoint, Confluence, Teams, JIRA dashboard, or approved format Each Friday by 12:00 PM Eastern

Monthly Status Report / Briefing Report / briefing PowerPoint, Confluence, dashboard, or approved format

Monthly by 5th day for previous month

Monthly Burn-Rate Report Report Excel or approved format Monthly by 15th day for previous month QASP/QCP and Surveillance Metrics Plan / report Word, Excel, or approved format QCP due 30 days after award; metrics monthly by 5th day; update each option period SLM / SELC Documentation Documents Word, PowerPoint, Excel, approved repositories As required; estimated up to four times annually per major system or repository

Deliverable Type Delivery method Frequency / due date C&A/ATO/Security Authorization Documentation

Documents Word, Excel, templates, security repositories

90 days prior to ATO renewal or as required by ISSO/OCISO; within 30 days of major change if required

Security Scan and Compliance Artifacts

Reports / raw files Raw scanner format, CSV, PDF, HTML, or Government-specified format

Monthly by 5th day and as needed for security activities

Privacy Documentation Documents Word/templates/approved repositories As required by SLM, DHS/ICE Privacy, and system changes

Standard Operating Procedures Documents Word, Confluence, ELMS, Teams, or approved repository

Initial due 30 days after award; updated monthly by 5th day reflecting changes

Architecture Diagrams Documents / diagrams

PowerPoint, Visio, source files, approved repository

Initial due 30 days after award; updated monthly by 5th day and before modification

Requirements Artifacts Artifacts JIRA, Confluence, Word, diagrams, approved repository

Continuously updated; baselined by release/sprint

Quality Assurance Reports and Scripts Reports / scripts Word, Excel, source scripts, JIRA, approved repository

Initial baseline within 90 days after award;

updated monthly by 5th day

Database, Data Lake, Data Asset, and Interface Artifacts

Documents / models

Word, ER/Win, PDF, source files, Databricks/Unity Catalog metadata, approved repository

Initial baseline within 60-90 days after award as directed; updated monthly by 5th day

User Interface / User Experience Artifacts

Documents / source files

Word, Visio, HTML/mockups, source files

Initial baseline within 90 days after award;

updated monthly by 5th day

Reports, Dashboards, Data Products, and Pre-built Queries

Reports / data products

Approved reporting and analytics tools As scheduled, as needed, and by approved release

Training Guides and User Enablement Materials

Documents / briefings / CBT

Word, PowerPoint, ICE Virtual University-compatible material, approved repository

As needed; updates 30 days prior to major/minor deployment when applicable

Presentations, Demonstrations, Project Support Materials

Briefings / materials

As required As required; not to exceed two per month per team unless approved

GFE Inventory Report Report Excel or approved format Within 24 hours of request; included monthly Active Roster Report Excel or approved format Included with monthly status report ICE Agile Maturity Model Self- Assessment

Assessment Excel or approved format Quarterly before end of each fiscal quarter

Root Cause Analysis Report Report Email, Confluence, Word, or approved format

Within 24 hours of resolved application outage or critical data/reporting outage

Revised Troubleshooting Scripts and Knowledge Base

Documentation Scripts, Word, Excel, Confluence/ELMS As needed following Tier 2/3 incident

FFP Backfill Staffing Plan Document Word/PDF/Confluence Within 90 days after award and updated as staffing changes

10.1 Acceptance and Rejection

The Government shall provide written notification of acceptance or rejection of final deliverables within two weeks of receipt unless another review period is specified. Rejections shall identify specific deficiencies. Non-conforming products or services shall be corrected within 14 calendar days of rejection notice unless the Contractor provides a Government-approved corrective action plan. The documents shall be considered final upon Government approval.

11.0 Performance Standards

The Contractor shall report all performance standards and associated metrics by the 5th day of each month. Tickets shall be tracked and managed using ServiceNow or approved successor tools for operational tickets and JIRA or approved successor tools for development, enhancements, and research items. The Contractor shall be considered Tier 3 support within the ICE ITIL service model.

Performance area Metric / SLA How measured Production code errors Reported code errors in production at or below Government-defined threshold; initial target 0.9% unless revised.

Application performance monitoring, logs, defect tracking, monthly report.

Long-running transactions Reported transactions over five seconds at or below Government-defined threshold; initial target 3% unless revised.

APM and database/query performance monitoring.

Missed requirements in production

No more than 5% of deployed stories/reports require defect resolution after release.

Defect resolution stories compared to total deployed stories/reports per release.

On-time deployment At least 90% of enhancements deployed on time within five days of planned date when delays are attributable to development.

Planned vs actual deployment dates in release plan/JIRA.

Account creation 1-hour response; account creation within 24 hours or less when all approvals and prerequisites are complete.

ServiceNow/Remedy ticket timestamps and resolution.

Tier 2 response rate Average response rate of non-emergency/non-failure Tier 2 tickets within 1 hour.

Ticket placement timestamp to triage/assignment timestamp.

Tier 3 escalation rate Emergency/failure escalations that could not be resolved by Tier 1/2 below 10%, unless workload baseline is revised.

Percentage of tickets escalated to Tier 3.

Performance area Metric / SLA How measured Tier 3 resolution rate Average resolution time for non-emergency/non-failure Tier 2 tickets within 5 business days.

Ticket placement timestamp to closed/referred timestamp.

System availability Data reporting systems availability at or above 99.5%;

mission application availability as defined by system-specific

SLA.

Cumulative uptime divided by total scheduled availability time, excluding approved maintenance and external/network issues.

ETL/ELT pipeline reliability Recurring pipelines, data refreshes, and scheduled jobs complete within Government-approved windows; failures triaged and reported.

Job monitoring, pipeline logs, Databricks/Informatica/Qlik/OAS monitoring, monthly report.

Data quality Data quality rules, validation checks, and reconciliation results meet Government-approved thresholds.

Data quality dashboards, validation logs, exception reports, stewardship review.

Dashboard/report performance Dashboards, reports, and ad hoc query support meet Government-approved response and support targets.

Usage statistics, query metrics, help desk tickets, report run metrics.

Security vulnerability remediation

Remediate vulnerabilities within DHS/ICE POA&M and severity-based timelines.

Scan reports, POA&M status, OCISO/ISSO validation.

Section 508 All developed or modified ICT conforms to applicable Section 508 standards unless an approved exception applies.

Trusted Tester results, accessibility test plans, ACR/VPAT documentation, remediation plans.

Staff Retention

Maintain Firm-Fixed Price (FFP) staffing level at 100% at all times. 100% Staffing Level for FFP

The vendor must maintain staffing levels at 100% at all times. If the staffing levels fall below 100% and tasks are not being met for a period greater than 30 days, the government will withhold 10% of the fixed monthly rate for each period of performance staffing levels are below 100%. If the staffing shortfall is corrected within 30 days, a penalty will not be applied to the monthly rate.

Reported % of errors in production Number of code errors recorded by application server logs

0.9%

Review and analysis of Application Performance Monitoring (APM) reports on monthly basis (by 5th day)

Reported % of long running transactions in production Number of transactions (server only calculations) that take over five (5) seconds 3%

Review and analysis of Application Performance Monitoring (APM) reports on monthly basis (by 5th day)

Reported % of missed requirements in production

Number of stories requiring defect resolution after a release 5%

Number of stories requiring defect resolution compared to the total number of stories deployed in a release

Reported % of on-time deployment Deployment of system enhancements is on-time 90%

Planned date vs. actual date within five

(5) days due to development delays (including scope creep)

Account creation for database access to the EID

Time to create an account 1 hour response; creation in 24 hours or less

Remedy report logging initial request, acknowledged request, to resolved request

DCR implementation in EID Time to make updates to records in EID 1 hour response;

updates in 24 hours or less

JIRA ticket logging initial request, acknowledge requested, to resolved request

Changes to List of Values (LOVs) and ad-hoc records updates to the

EID

Time to make updates to records in EID 1 hour response;

updates in 24 hours or less

JIRA ticket logging initial request, acknowledge requested, to resolved request; create additional JIRA ticket

12.0 Security

RESERVED

13.0 Accessibility Requirements - Section 508

RESERVED

14.0 Other Direct Costs and Travel

The Contractor may be required to purchase approved software, supplies, licenses, tools, or other items necessary to support this PWS. All ODCs must be approved in advance by the COR and shall remain Government property as applicable. COTS/GOTS products must be approved through required ITCR and security processes before implementation.

Travel may be required. Travel costs shall be allowable only to the extent permitted by FAR 31.205-46 and the Federal Travel Regulations. All travel outside the Washington, DC metropolitan area must be approved in advance by the COR. The Contractor shall not incur expenses exceeding the funded value of the travel CLIN without prior written approval from the Contracting Officer.

15.0 Key Personnel and Staffing

The Contractor shall provide qualified personnel to perform all requirements in the PWS. The Contractor shall identify a corporate representative with full authority to act for the Contractor on matters relating to daily operation of the contract and shall designate an alternate. Key personnel shall serve for the duration of the contract unless an equivalent replacement is nominated by the Contractor and approved by the Government.

Recommended key personnel for the consolidated award include:

Role Primary responsibilities Program Manager Overall contract responsibility; planning, organizing, directing, controlling, staffing, reporting, budget, schedule, risk, deliverables, and Government communications.

Deputy Program Manager / Operations Manager

Backup to PM; manages daily operations, cross-track coordination, staffing, reporting, escalations, and operational metrics.

Lead Enterprise Architect Senior technical authority; architecture strategy, cloud, DevOpsSec, integration, data architecture coordination, technical conflict resolution, technical debt roadmap.

Security Engineer Security reviews, vulnerability assessments, remediation, secure configuration, security documentation, incident support, secure coding guidance.

Privacy Lead PTA/PIA/SORN support, privacy impact analysis, privacy documentation, coordination with ICE Privacy, Records and Data Management, and system teams.

Quality Assurance Lead Test strategy, automation, FQT, regression, requirements traceability, Section 508 coordination, quality metrics, release readiness, QA reporting.

Data / Analytics Technical Lead ERO Data Lake, IDRS/ERR, Databricks, Unity Catalog, DSSDM, ETL/ELT, Qlik/OAS, data governance, data quality, reporting, analytics modernization.

Senior IT Systems Solution Architects / Portfolio Leads

Lead technical execution for Booking, Case Management, Logistics/Bonds, Data Management, and Data Reporting/Analytics portfolios.

Software…