Amendment 5 Clauses and Pro Updates Ext 01.19.26.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE PAGE OF PAGES

1 2

2. AMENDMENT/MODIFICATION NO.

A00005

3. EFFECTIVE DATE

See Block 16C

4. REQUISITION / PURCHASE REQ. NO. PROJECT NO. (If Applicable)

6. ISSUED BY

Federal Bureau of Prisons Residential Reentry Contracting Office 320 First Street NW, Room 901-5 Washington, D.C. 20534

CODE 7. ADMINISTERED BY (If other than Item 6) CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

(√) 9A. AMENDMENT OF SOLICITATION NO

RFP 15BRRC25R00000018 √

9B. DATED (See Item 11)

02/28/2025

10A. MODIFICATION OF CONTRACT/ORDER NO.

CODE FACILITY CODE 10B. DATED (See Item 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

[X ] The above number solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers [ x ] is extended, [ ] is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods.

(a) By completing Items 8 and 15 and returning 1 copy of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OR CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THE CHANGE ORDER IS ISSUED PURSUANT TO: (Specify Authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

x B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor [ ] is not [ x ] is required to sign this document and return 1 copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible).

This amendment is issued to implement administrative and solicitation updates following with the denial of the GAO protest. Offerors are advised to carefully review all changes below.

1. Removal of FAR Clauses The following clauses are deleted in their entirety from the solicitation:

• FAR 52.222-21 Prohibition of Segregated Facilities

• FAR 52.222-26, Equal Opportunity No substitute clauses are added as part of this amendment.

2. The following Clauses have been updated:

T&C Number Title Section Effective Date Revision Date 52.222-50 Combating Trafficking in Persons (Oct 2025) I 10/01/2025 08/27/2025 52.244-6 Subcontracts for Commercial Products and Commercial Services (Oct 2025) I 10/01/2025 08/27/2025 52.209-12 Certification Regarding Tax Matters (Oct 2025) K 10/01/2025 08/27/2025 52.204-8 Annual Representations and Certifications (Oct 2025) K 10/01/2025 08/27/2025

DOJ-05

Deviation Security of Department Information and Systems H 01/01/2025 Added to this solicitation

Except as provided herein, all items and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

Tana Jankowiak

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

BY //s// (Signature of Contracting Officer)

16C. DATE SIGNED

12/19/2025

STANDARD FORM 30 (REV. 11/2016)

PREVIOUS EDITION UNUSABLE Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT - Continuation

1. CONTRACT ID CODE

RFP 15BRRC25R00000018

PAGE OF PAGES

2.AMENDMENT/MODIFICATION NO.

A00005

3. EFFECTIVE DATE

12/19/2025

4. REQUISITION / PURCHASE REQ. NO.

PROJECT NO. (If Applicable)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible).

STANDARD FORM 30 (REV. 11/2016)

Revision to Section B.1 – Services and Prices/Costs Section B.1 is hereby revised in the paragraph 4 (revised in highlighted area).

…”During the months when the ADP does not exceed 120 in-house Federal offenders or 60 home confinement placements, Contractor shall invoice at the defined monthly rate. If the ADP for a month exceeds 120 in-house Federal offenders or60 home confinement placements, Contractor shall invoice at the defined inmate day rate for the number of days utilized. Services are required to be provided in accordance with Section C, Statement of Work, with documentation as required. For the purposes of billing, home confinement and furloughs are considered one manday. Furloughs shall be billed at the home confinement rate. In-House Furloughs shall be counted towards the RRC ADP, not the Home Confinement ADP, and shall be billed at the home confinement rate. When the home confinement rate falls in Fixed Monthly rate, No payment will be made for those furloughs.”…

3. Revision to Section M.4 – Evaluation Criteria and Their Relative Importance (Paragraph 3.0 Price Evaluation Area) Section M.4, Paragraph 3.0 Price Evaluation Area is revised as follows (highlighted area):

3.0 Price Evaluation Area

The Government will evaluate the offeror's price for the overall requirement to ensure it is reasonable. The offeror’s evaluated price will be assessed against the evaluation results of the non-price areas in conducting possible trade-off analysis and determining best value to the Government. However, as offerors' proposals become more equal in the non-price factors, the overall price of the entire contract will be given greater importance.

For each performance period, the Government will determine an evaluated price using the following steps.

1) The fixed monthly rate for Tier 1 will be multiplied by 12 months to determine the total annual cost.

2) Government will identify the proposed daily rates for the rest of each tier and calculate the daily rate applicable for RRC and Home Confinement services, based on a 30-day month, where required. The daily rates for all these times will be added together and divided by three or four depending on how many total tiers of daily rates to determine an average daily rate for those tiers. For example, there are a total 4 tiers, tier 1 – Fixed Monthly rate, tier 2 – daily rate, tier3 –daily rate, tier 4 – daily rate (est. max. ADP). The average daily rate: (tier 2 + tier 3 + tier 4) / 3 = average daily rate. The average daily rate will then be multiplied by the maximum number of billable days for the performance period.

This revision supersedes all prior versions of Section M.4, Paragraph 3.0.

4. Proposal Due Date Extension The proposal submission due date is revised as follows:

• Previous Due Date: October 13, 2025

• New Due Date: January 19, 2026, by 2:00 pm Eastern Time.

Late proposals will be handled in accordance with FAR 52.215-1.

5. All Other Terms and Conditions All other terms, conditions, and requirements of the solicitation remain unchanged and in full force and effect.

6. Acknowledgment of Amendment Offerors must acknowledge receipt of this amendment in accordance with Section L of the solicitation. Failure to acknowledge may render a proposal unacceptable.

BOP DOJ-05 DEVIATION BOP-05 Security of Department Information and Systems (January 2025)

The vendor is required to complete Attachment [FBOP Proposed Attestation], Federal Bureau of Prisons Vendor Cybersecurity Attestation Form, addressing the security measures they rely upon to protect any DOJ Information and/or DOJ Information Systems for which they come into contact within the course of performing services under contract/agreement with DOJ.

The vendor shall submit the Federal Bureau of Prisons Vendor Cybersecurity Attestation Form, along with supporting documentation, at the time of solicitation response, annually, and when significant changes to the provided services, operating environment, or data processed occur.

Acquisition Plan FBOP | Department of Justice

The vendor affirms that they have security controls in place to protect DOJ information when that data is being stored, transmitted, processed, or displayed on the vendor’s information technologies. Applicable security controls include certifications indicating compliance with: state licensure requirements, SOC 2, ISO 27001, Payment Card Industry, HIPAA as applicable or other environment certifications that would be applicable (to be specified by the vendor). Vendor has attached documentation of said certifications as part of this affirmation.

The vendor affirms that internal controls are in place to identify and remediate vulnerabilities within any IT system in which DOJ information is stored and that DOJ data will be stored exclusively within the boundaries of the United States and that only US citizens have access to DOJ’s data. The vendor affirms that any DOJ information made available to vendor under this contract shall be used only for the purpose of performance of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of this contract. The vendor shall neither reproduce nor release such information to any third-party at any time, including during or after performance of the contract, without prior written permission of the CO or COR.

The vendor agrees to report any actual or suspected breach of DOJ Information within one hour of discovery of an actual breach, and within 24 hours of a suspected breach if vendor has not yet been able to determine whether a breach has occurred. A “breach” is an incident or occurrence that involves the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses DOJ Information or (2) an authorized user accesses or potentially accesses DOJ Information for an other than authorized purpose. The report of a breach must be made to the CO or COR; if neither can be reached, the vendor must report the breach to the DOJ Security Operations Center (jsoc@usdoj.gov, 202-357-7000) and FBOP’s Information Security Program Office; the COR; and the Contracting Officer within one (1) hour of the initial discovery. The vendor should not disclose any details of the potential or confirmed breach to any individual not involved in responding to the breach. The vendor agrees to cooperate with DOJ’s inquiry into the incident and efforts to minimize risks to DOJ or individuals. Such cooperation includes, but is not limited to, providing to DOJ full access to any facility and/or Information System affected or potentially affected the breah or potential breach, and to undertake any and all response actions DOJ determines are required to ensure the protection of DOJ Information, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. The vendor further agrees that it shall be responsible for all costs and related resource allocations that DOJ deems required for all such response activities related to any breach.

[FBOP Proposed Attestation] [BOP RRC, CMS & Credit Reporting Contracts: To Address ATU concerns]

A. Vendor Information Types Questions Yes No N/A Description ☐ ☐ ☐ Is the data sensitive (as defined by NIST)?

☐ ☐ ☐ Does the data contain Personally Identifiable Information (PII)?

☐ ☐ ☐ Does the data contain Federal Tax Information (FTI)?

☐ ☐ ☐ Does the data contain Protected Health Information (PHI)?

Does the data contain other Limited Official Use Information:

☐ Legal Privilege ☐ Legal Strategy ☐ Grand Jury ☐ Title III Information ☐ Protected Materials ☐ Privacy Act ☐ Procurement Sensitive ☐ Intellectual Property ☐ Law Enforcement Sensitive ☐ Infrastructure Sensitive

Approximately how many records will be transmitted to the vendor during the contract period?

B. Vendor Information Security Questions Yes No N/A Description

☐ ☐ ☐ Is Multi Factor Authentication (MFA) used to access DOJ data?

Describe implementation:

Explain N/A:

☐ ☐ ☐ Is the principle of least privilege employed for access management?

Describe implementation:

Explain N/A:

Is sensitive data encrypted at rest and/or in transit (e.g., sensitive Personally Identifiable Information (PII), Federal Tax Information (FTI), health information (HIPAA))?

Describe implementation:

Explain N/A:

Do portable devices require mobile device management tools before allowing access to corporate data, including email?

Describe implementation:

Explain N/A:

☐ ☐ ☐ Is there a formal cyber security program which includes policy enforcement?

Describe implementation:

Explain N/A:

☐ ☐ ☐ Are routine vulnerability scans of all system assets and endpoints performed?

Yes No N/A Description Describe implementation:

Explain N/A:

Are internal and external penetration tests conducted?

Describe implementation:

Explain N/A:

Are known vulnerabilities mitigated or remediated within 30 for critical and high risk, and 90 days for medium risks?

Describe implementation:

Explain N/A:

o Critical Patch - to be installed within 30 days or sooner if possible o High Risk Patch - to be installed within 60 days or sooner if possible o Medium Risk Patch - to be installed within 90 days or sooner if possible o Low Risk Patch - to be installed within the normal patching rotation, but within at least a year.

Are monitoring services employed which will notify resources as needed 24x7x365 to support incident response?

Describe implementation:

Explain N/A:

If sub-contractors are used, describe questionnaire and other requirements of sub-contractors:

Describe implementation:

Explain N/A:

C. Data Owners Role Responsible Party Responsibilities

Data Steward Entity who is responsible for the categorization, protection, usage, and quality of the data.

Data Steward Entity who is responsible for the confidentiality, integrity, and availability of the data on a day-to-day basis.

Data Steward Entity who is responsible for the confidentiality, integrity, and availability of data on a day-to-day basis.

D. Vendor Signature As the vendor representative, I attest that the information in sections A and B are accurate, and I accept the responsibility of protecting and ensuring the confidentiality, integrity, and availability of DOJ data on a day-to-day basis when it is on the vendor or subcontracted vendor networks.