CLEAN CAD_SOO 2.20.2025 (1).docx

DEPARTMENT OF COMMERCE ENTERPRISE SERVICES

STATEMENT OF OBJECTIVES

PERSONNEL SERVICE CONTRACT

FOR

OFFICE OF INFORMATION AND COMMUNICATIONS TECHNOLOGY AND SERVICES (OICTS)

1. Overview

The Department of Commerce (DOC), Office of Information and Communications Technology and Services (OICTS), Compliance and Adjudication Division (CAD) is responsible for ensuring that information and communications technology and services (ICTS) subject to DOC jurisdiction are developed, deployed, and operated in a manner that protects U.S. national security and advances the public interest. OICTS executes this mission through the development of ICTS regulations, the review and monitoring of regulated entities, and the conduct of compliance, investigative, and enforcement activities conducted under International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) (IEEPA), Presidential Executive Order 13873 (E.O. 13873), E.O. 14034 and 15 CFR 791 (collectively “OICTS authorities”).

2. Background

In 2019, President Trump determined that foreign adversaries are increasingly creating and exploiting vulnerabilities in ICTS, which store and communicate vast amounts of sensitive information, facilitate the digital economy, and support critical infrastructure and vital emergency services, in order to commit malicious cyber-enabled actions, including economic and industrial espionage against the United States (U.S.) and its people. The President further determined:

· That the unrestricted acquisition or use in the U.S. of ICTS designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries augments the ability of foreign adversaries to create and exploit vulnerabilities in ICTS, with potentially catastrophic effects, and thereby constitutes an unusual and extraordinary threat to U.S. national security, foreign policy, and economy.

· That this threat exists both in the case of individual acquisitions or uses of such technology or services, and when acquisitions or uses of such technologies are considered as a class.

· That although maintaining an open investment climate in ICTS, and in the U.S. economy more generally, is important for the overall growth and prosperity of the U.S., such openness must be balanced by the need to protect our country against critical national security threats.

To deal with this threat, the President directed those additional steps be taken to protect the security, integrity, and reliability of ICTS provided and used in the U.S. A series of Executive Orders (EO) and supporting regulations provided the following authorities and missions to the Commerce Secretary, which have been further delegated to the Under Security, BIS, for implementation and execution. These include:

· Executive Order 13873, “Securing the Information and Communications Technology and Services Supply Chain”[footnoteRef:2], 84 FR 22689 (May 15, 213873 019), and as codified in federal regulations at 15 C.F.R. Part 7 (same title as EO 13873, January 19, 2021)[footnoteRef:3]. This provides the Department the authority to, among other things, investigate, regulate, and prohibit certain commercial ICTS transactions. [2: See https://www.federalregister.gov/documents/2019/05/17/2019-10538/securing-the-information-and-communications-technology-and-services-supply-chain.] [3: See https://www.federalregister.gov/documents/2021/01/19/2021-01234/securing-the-information-and-communications-technology-and-services-supply-chain. ]

· Executive Order 14034, “Protecting Americans’ Sensitive Data from Foreign Adversaries,” 86 FR 31423 (June 11, 2021). [footnoteRef:4] This requires the Secretary to “evaluate on a continuing basis transactions involving connected software applications” that may cause an “undue” or “unacceptable” risk as defined in EO 13873. [4: See https://www.federalregister.gov/documents/2021/06/11/2021-12506/protecting-americans-sensitive-data-from-foreign-adversaries.]

· Finally, the above EOs were issued under the authority the President under the International Emergency Economic Powers Act (IEEPA),[footnoteRef:5] 50 U.S.C. § 1702, to, among other things, investigate, regulate, and prohibit certain commercial transactions. [5: https://uscode.house.gov/view.xhtml?path=/prelim@title50/chapter35&edition=prelim]

OICTS is responsible for safeguarding U.S. national security through the regulation, making investigative determinations, authorizations, monitoring, and enforcement of ICTS. OICTS is building foundational capabilities to design, implement, and enforce technology-related regulations. Support is required across multiple mission areas, including compliance monitoring, national security risk adjudication, enforcement targeting, and bespoke advisory solutions.

The mission goals are:

· Protect U.S. National Security Interests: Ensure that covered transactions, technologies, and services subject to OICTS authorities do not present unacceptable risks to the national security of the United States.

· Establish a Sustainable Regulatory Framework: Build enduring compliance, enforcement, and operational processes that enable OICTS to function as a mature regulator capable of addressing current and emerging technology risks.

3. Purpose

OICTS requires contractor support services to enable the compliance division to meet its mission as a national security–focused regulator. The purpose of this contract is to provide on-site contractor personnel, management, and expertise in support of numerous core functions. The contractor shall deliver consistent, professional, and outcomes-based services that ensure the effective execution of OICTS’s statutory and regulatory responsibilities.

4. Scope

The contract will provide a flexible vehicle for support services in alignment with OICTS’s evolving mission requirements. Support will cover activities such as:

· Development of standard operating procedures (SOPs), compliance frameworks, and regulatory text.

· Authorization and monitoring of regulated entities, including due diligence, designing mitigation frameworks and agreements, inspections, and responses to inquiries.

· Enforcement targeting through research, vetting, and production of analytical products.

· Development of mitigation measures and tailored solutions.

· Advisory services to ensure regulatory actions are feasible and streamlined.

The contractor shall provide comprehensive program management to ensure effective, timely, and high-quality performance across all objectives described in this Statement of Objectives. The contractor shall establish internal management controls, quality assurance measures, and reporting mechanisms necessary to monitor performance, mitigate risks, and ensure alignment with OICTS mission objectives.

5. Current Environment

OICTS’ compliance functions and organizational development are expanding. Foundational policies, procedures, and operating frameworks are being established and continue to mature. Many mission-critical functions requiring supplemental expertise to meet regulatory deadlines and requirements. Tools for regulatory monitoring, due diligence, case management, and interagency information sharing are in early deployment and require refinement and integration.

While its regulatory authorities are in place, the compliance division continues to develop the policies, processes, and internal controls necessary to exercise those authorities effectively. Some functions rely on limited capacity, within personnel, automation, procedures, or limited IT infrastructure. The division’s ability to engage with regulated industry, conduct investigations, and carry out enforcement actions is growing at a fast rate, and its institutional knowledge base is still forming. As such, OICTS requires contractor support to establish baseline capabilities, expand its reach, and mature into a fully functional regulatory body capable of executing its compliance and enforcement mission.

6. Target Environment

The target environment is for a fully operational compliance and enforcement division equipped with established processes, standard operating procedures that enable efficient, transparent, and legally defensible regulatory enforcement. In this future state, OICTS will have mature monitoring, investigative, enforcement, and advisory capabilities capable of managing sustained caseloads while delivering consistent and predictable outcomes. Industry-facing functions will be structured to provide regulated entities with clear compliance guidance, transparent licensing-like support, and a fair enforcement posture that promotes voluntary compliance and deters violations. Collectively, this environment will position OICTS as a credible national security regulator with the institutional capacity to enforce ICTS regulations in a manner that is both rigorous and sustainable.

7. Objectives

The Government seeks a contractor that can achieve the following objectives and tasks:

a) Investigations and Research – Contractor personnel performing investigations and research duties must have TS/SCI security clearance and will be responsible for the following tasks:

a. Oversee and manage planning, collection and research, analysis and investigatory findings of entities and transactions related to administrative, regulatory, civil or criminal action, including in the areas of telecommunications (including optical, wireless and wireline networking), advanced computers, computer science, software development, computer networking, information security, cybersecurity, encryption, mobile networking, satellite communication, networking infrastructure, or internet connected devices.

b. Identify and prioritize ICTS classes and entities for potential OICTS investigation nominations, regulatory actions or other OICTS program actions.

c. Intake and administratively handle referrals from other agencies, vet and prioritize referrals, compile intelligence on transactions, conduct investigations into transactions, and deliver reports of investigative findings to reviewing agencies.

d. Develop and serve subpoena questions requiring answers from investigation targets.

e. Develop intelligence requirements requiring intelligence collection, analysis or other production support.

f. Develop and compile records supporting the factual and legal standard to analyze and process a case.

g. Review and analyze a wide range of intelligence (raw and finished), financial, business, media, academic and subpoena response data to process cases, identify threat/vulnerability/consequence risk factors, perform analyses, and produce case recommendations and other administrative records documenting the factual and legal basis for program determinations and other planning and decision-making needs.

h. Research and maintain situational awareness of adversary nations’ state and private organizations ICTS activities and developments, with emphasis on timely identification of products and services offered to U.S. persons and organizations.

i. Conduct analyses of adversary nations and international laws to identify implications for adversaries’ cyber capabilities, ICTS risks, and possible program responses.

j. Analyze all-source data (quantitative and qualitative) through several means including technical platforms, documents, subject matter expertise from all ICTS areas, and meetings.

k. Provide analytical input about potential national security risks posed by transactions, based on the case data and other technical and factual considerations to support government determinations.

l. Working proficiency with analytical tools and database within intelligence community and non-intelligence community databases.

b) Authorizations and Monitoring – Establish and execute standardized processes for conducting due diligence, granting specific authorizations (licensing-like exceptions for companies to conduct ICTS activities), and issuing advisory opinions.

a. Developing and maintaining standard operating procedures for specific authorization, informal guidance, and advisory opinion determinations.

b. Conducting due diligence on applicants, including assessments of ownership, operations, supply chain dependencies, and national security risk factors.

c. Drafting general inquiry responses to ensure regulated parties understand obligations and compliance expectations.

d. Designing binding mitigation terms and conditions to be associated with specific and general authorizations. Such terms would assuage or eliminate foreign ownership, control, and influence risks that stem from and untrusted entity or untrusted technology in the U.S. supply chain. Mitigation terms would include but are not limited to, corporate proxy structures, board directorships,

e. Conduct and oversee proactive monitoring and inspection programs to verify ongoing compliance with terms and conditions.

f. Supporting civil penalty actions by documenting non-compliance, preparing evidentiary records, and coordinating with enforcement teams.

c) Enforcement Targeting – Deliver timely, accurate, and actionable targeting investigations of potential non-compliance through open-source and classified research, interagency engagement, and specialized expertise (e.g., customs and imports).

a. Conducting continuous vetting of regulated entities using numerous data sources.

b. Producing alerts, watchlists, and analytical products that identify patterns of non-compliance and provide actionable leads for compliance follow-up.

c. Establishing partnerships with key interagency organizations and expertise in customs, trade, and import operations to identify non-compliant activity.

d) Adjudication and Advisory Solutions – Provide innovative and legally sound approaches to mitigation agreements, draft regulations, penalty frameworks, and settlement terms.

a. Developing bespoke mitigation terms, within industry specific authorizations that balance enforcement objectives with industry compliance feasibility.

b. Review penalty and settlement orders that are clear, consistent, and that align with the International Emergency Economic Powers Act (IEEPA).

c. Providing cross-division advisory support, identifying and integrating lessons learned from enforcement, investigations, and monitoring and providing solutions for future regulatory design and compliance strategies.

d. Supporting industry engagement on general authorization matters, including the preparation and drafting of outreach materials, frequently asked questions, and best practices documents.

The following workload estimates are provided solely for planning and proposal preparation purposes. They are intended to assist offerors in understanding the anticipated scope and scale of mission support requirements under this contract. These estimates are not binding on the Government and do not represent a guaranteed level of effort or specific task volume. Actual workloads may vary based on evolving national security priorities.

Estimated workloads may include:

Authorizations and Monitoring: Approximately 50–150 company specific authorization and advisory opinion requests processed and 10 monitoring or inspection activities annually.

Adjudication and Advisory Solutions: Approximately 50-100 tailored mitigation agreements or specific authorizations with terms and conditions.

Enforcement Targeting: Continuous vetting of 200–300 entities per year, with production of monthly analytic alerts of compliance or non-compliance or summaries based on all-source targeting research.

8. Place of Performance

The primary place of performance will be DOC headquarters in Washington, D.C. Additional performance may occur at other DOC facilities or Government-designated locations, or contractor facilities, as specified and approved by the Government.

9. Period of Performance

This contract shall consist of one (1) base year and four (4) one-year option periods. Task order performance periods will be defined at the time of award.

10. Hours of Operation

Contractor support shall generally be performed during the standard business hours, Eastern Time, Monday through Friday, excluding Federal holidays.

At the Government’s discretion, certain tasks may require extended or non-standard hours, including evenings, weekends, or Federal holidays. When such needs arise, the Government will provide reasonable advance notice, and the contractor shall ensure that personnel are available to meet mission-critical requirements.

11. Government Furnished Resources

Government will provide contractor personnel with office workspace, Government-furnished laptops, network access, and secure communications equipment necessary to perform work on-site. Government Furnished Equipment (GFE) is provided solely for performance of contract requirements and remains the property of the Government. The contractor is responsible for proper use, safeguarding, and return of all GFE. The Government may also provide access to databases, templates, and policy reference materials necessary for contractor performance.

12. Qualifications

The contractor shall possess demonstrated capability and experience necessary to successfully perform the objectives outlined in this Statement of Objectives. The Government seeks a contractor with a proven track record to support complex, national security–related regulatory and compliance missions for the federal government.

At a minimum, the contractor shall demonstrate the following types of expertise:

Federal National Security Regulatory Programs and Compliance:

Demonstrated experience supporting federal regulatory programs, including rulemaking, compliance monitoring, investigations, enforcement such as penalty actions, or licensing activities. Similar expertise may have been obtained through experience supporting government offices or programs associated with the Committee on Foreign Investment in the United States (CFIUS); the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector (Team Telecom); the Department of the Treasury’s Outbound Investment Security Program; the Office of Foreign Assets Control (OFAC); or U.S. Customs and Border Protection activities related to the Uyghur Forced Labor Prevention Act (UFLPA). (Relevant LCAT types may include: Regulatory Analyst, Risk Assessment & Mitigation Consultant, Compliance Specialist, Policy Advisor)

National Security and ICTS-Related:

Experience supporting programs involving national security, supply chain risk, foreign ownership, control, or influence (FOCI), data security, or technology-based regulatory regimes, particularly in information and communications technology and services (ICTS) or adjacent sectors. (Relevant LCAT types may include: Policy Advisor, Risk Analyst, Intelligence Analyst, Risk Assessment & Mitigation Consultant, Compliance Specialist)

Legal Support:

Proven capability to provide legal support related to administrative law, enforcement actions, due process requirements, and regulatory drafting. (Relevant LCAT types may include: Legal Analyst, Attorney, Paralegal)

Program and Contract Management:

Demonstrated ability to manage on-site federal support contracts. (Relevant LCAT types may include: Program Manager and Project Manager)

13. Travel

Contractor personnel may be required to travel occasionally in support of mission requirements, including attendance at interagency meetings, stakeholder engagements, training, inspections, or other official activities. All travel shall be pre-approved in writing by the Government and conducted in accordance with government regulations.

14. Conflicts of Interest

15. Applicable Publications (Current Editions)

16. Reports, Deliverables, and Invoicing

Monthly Progress Report. The contractor shall prepare and submit a monthly progress report describing at a minimum the work performed during the month, the projected work over the next month, and any issues or barriers that need to be addressed.

RFI:

REQUEST FOR INFORMATION (RFI)

Title: Investigations, Authorizations, Monitoring, Enforcement Targeting, and Adjudication Support Services RFI Number: [Insert Number] Issue Date: [Insert Date] Response Due: [Insert Date and Time]

1. Purpose The purpose of this RFI is to gather information from qualified contractors capable of providing support services across investigative, analytical, regulatory, monitoring, enforcement, and adjudicative functions related to Information and Communications Technology and Services (ICTS) activities. This RFI seeks industry feedback regarding capabilities, staffing, experience, and potential approaches.

This is not a solicitation. Responses will be used for market research and acquisition planning.

2. Background The Government requires contractor support to conduct investigations, risk assessments, due diligence, monitoring, enforcement targeting, and regulatory advisory functions related to ICTS transactions that may pose national security concerns. Required support spans multiple mission areas including investigations, authorizations, ongoing monitoring, enforcement targeting, and adjudication solutions.

3. Scope of Required Capabilities Respondents should address their ability to perform the following mission areas:

A. Investigations and Research Contractor personnel must hold TS/SCI clearances and be capable of:

• Managing planning, collection, research, analysis, and investigative findings related to administrative, regulatory, civil, or criminal actions across telecommunications, cybersecurity, advanced computing, encryption, mobile networking, satellite communications, and ICTS technologies.

• Identifying and prioritizing ICTS classes/entities for investigation or regulatory action.

• Handling interagency referrals, conducting investigative research, and producing investigative reports.

• Drafting subpoena questions and developing intelligence requirements.

• Compiling factual/legal case records.

• Analyzing intelligence, financial, business, media, academic, and subpoena data.

• Assessing adversary nation ICTS developments and global legal frameworks.

• Conducting all-source analysis using technical tools, documents, SMEs, and other data sources.

• Providing analytical input on national security risks and demonstrating proficiency in IC analytical tools and databases.

B. Authorizations and Monitoring

• Developing SOPs for determinations, guidance, and advisory opinions.

• Conducting due diligence on applicants including ownership, supply chain, and national security risk assessments.

• Drafting inquiry responses and supporting regulatory understanding for external entities.

• Designing mitigation terms (e.g., proxy structures, board controls).

• Conducting monitoring and inspections for compliance verification.

• Supporting civil penalties through documentation and evidentiary preparation.

C. Enforcement Targeting

• Conducting continuous vetting across numerous data sources.

• Producing alerts, watchlists, and analytical products identifying non-compliance.

• Partnering with interagency organizations involved in customs, trade, and imports to identify problematic activity.

D. Adjudication and Advisory Solutions

• Developing mitigation terms aligned with enforcement goals and industry feasibility.

• Reviewing penalty/settlement orders for consistency with IEEPA.

• Integrating lessons-learned into program design and regulatory improvements.

• Preparing outreach materials, FAQs, and best practices documentation.

4. Requested Information from Respondents Organizations responding to this RFI should provide:

1. Company Information

• Name, address, DUNS/UEI, CAGE Code

• Small business status (SB, SDVOSB, HUBZone, WOSB, 8(a), etc.)

• Point of contact

2. Relevant Capabilities and Experience

• Description of experience performing similar investigative, regulatory, enforcement, or intelligence-related work

• Experience supporting ICTS-related, cybersecurity, trade, or national security missions

• Experience with TS/SCI-cleared personnel and secure workspace operations

3. Staffing Approach

• Ability to recruit/retain TS/SCI-cleared personnel

• Proposed labor categories

• Estimated staffing levels for the scope

4. Technical Approach Summary

• How your company would execute each mission area (A–D)

• Analytical methods, tools, or data exploitation capabilities

• Compliance or monitoring frameworks your company uses

5. Sample Work Products (optional) Examples may include anonymized investigative reports, risk assessments, mitigation frameworks, or compliance monitoring methodologies.

6. Feedback for the Government

• Recommended contract type

• Any elements requiring clarification

• Risks/challenges and mitigation strategies

• Suggested NAICS codes

5. Response Instructions

• Responses should not exceed [X] pages.

• Submit electronically in PDF format to: [Insert Email Address]

• Email subject line: “RFI Response – ICTS Support – [Company Name]”

6. Disclaimer This RFI is issued solely for information and planning purposes and does not constitute a solicitation or commitment by the Government. Respondents will not be reimbursed for costs incurred.

4 | Page image1.gif