Amendment 8 Ext 60 days Updated Pro n Clauses WD.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE PAGE OF PAGES

1 1

2. AMENDMENT/MODIFICATION NO.

A00008

3. EFFECTIVE DATE

See Block 16C

4. REQUISITION / PURCHASE REQ. NO. PROJECT NO. (If Applicable)

6. ISSUED BY

Federal Bureau of Prisons Residential Reentry Contracting Office 320 First Street NW, Room 901-5 Washington, D.C. 20534

CODE 7. ADMINISTERED BY (If other than Item 6) CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

(√) 9A. AMENDMENT OF SOLICITATION NO

RFP 15BRRC25R00000018 √

9B. DATED (See Item 11)

02/28/2025

10A. MODIFICATION OF CONTRACT/ORDER NO.

CODE FACILITY CODE 10B. DATED (See Item 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

[X ] The above number solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers [ x ] is extended, [ ] is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods.

(a) By completing Items 8 and 15 and returning 1 copy of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OR CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THE CHANGE ORDER IS ISSUED PURSUANT TO: (Specify Authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

x B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor [ ] is not [ x ] is required to sign this document and return 1 copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible).

The amendment (# 08) notifies prospective offerors the proposal due date has been revised and extended as follows:

1) FROM: Tuesday, February 20. 2026 TO: Tuesday, April 21, 2026 no later than 2:00 Eastern Time.

2) Incorporate the updated Department of Labor Wage Determination 2015-4269 Rev 31 and 2015-4281 rev 35

3) Make the following changes to the below clauses and provisions:

Except as provided herein, all items and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

Tana Jankowiak

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

BY //s// (Signature of Contracting Officer)

16C. DATE SIGNED

02/18/2026

STANDARD FORM 30 (REV. 11/2016)

PREVIOUS EDITION UNUSABLE Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT - Continuation

1. CONTRACT ID CODE

RFP 15BRRC25R00000018

PAGE OF PAGES

2.AMENDMENT/MODIFICATION NO.

A00008

3. EFFECTIVE DATE

02/18/2026

4. REQUISITION / PURCHASE REQ. NO.

PROJECT NO. (If Applicable)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible).

STANDARD FORM 30 (REV. 11/2016)

3. Make the following changes to the below clauses and provisions:

The following clauses and provisions are deleted in their entirety from the solicitation:

52.204-8 Annual Representations and Certifications (Jan 2025) (DEVIATION FEB 2025) 52.204-18 Commercial and Government Entity Code Maintenance (Aug 2020) 52.204-21 Basic Safeguarding of Covered Contractor Information Systems (Nov 2021) 52.204-22 Alternative Line Item Proposal (Jan 2017) 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed by Kaspersky Lab Covered Entities (Dec 2023) 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021) 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021) 52.204-27 Prohibition on a ByteDance Covered Application (Jun 2023) 52.204-29 Federal Acquisition Supply Chain Security Act Orders – Representation and Disclosures (Dec 2023) 52.222-21 Prohibition of Segregated Facilities (Apr 2015) 52.222-26 Equal Opportunity (Sept 2016) 52.225-13 Restrictions on Certain Foreign Purchases (Feb 2021)

The following clauses and provisions have been updated:

52.204-7 (DEV) System for Award Management – Registration (Nov 2024) (DEVIATION NOV 2025) 52.204-10 (DEV) Reporting Executive Compensation and First-Tier Subcontract Award (Jun 2020) (DEVIATION NOV 2025) 52.204-13 (DEV) System for Award Management-Maintenance (Oct 2018) (DEVIATION NOV 2025) 52.204-15 (DEV) Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (DEVIATION NOV 2025) 52.209-6 (DEV) Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded (Jan 2025) (DEVIATION NOV 2025) 52.209-7 (DEV) Information Regarding Responsibility Matters (Oct 2018) (DEVIATION NOV 2025) 52.209-10 (DEV) Market Research (Nov 2021) (DEVIATION JUL 2025) 52.209-13 (DEV) Violation of Arms Control Treaties or Agreements—Certifications (NOV 2021) (DEVIATION NOV 2025) 52.215-1 (DEV) Instructions to Offerors-Competitive Acquisition (Nov 2021) (DEVIATION DEC 2025) 52.215-2 (DEV) Audit and Records-Negotiation (Jun 2020) (DEVIATION DEC 2025) 52.215-8 (DEV) Order of Precedence – Uniform Contract Format (Oct 1997) (DEVIATION DEC 2025) 52.215-11 (DEV)Price Reduction for Defective Certified Cost or Pricing Data-Modifications (Jun 2020) (DEVIATION DEC 2025) 52.215-13 (DEV) Subcontractor Certified Cost of Pricing Data-Modifications (Jun 2020) (DEVIATION DEC 2025) 52.215-15 (DEV) Pension Adjustments and Asset Reversions (Oct 2010) (DEVIATION DEC 2010) 52.215-18 (DEV) Reversion or Adjustment of Plans for Postretirement Benefits (PRB) Other than Pensions (July 2005) (DEVIATIONS Dec 2025) 52.215-19 (DEV) Notification of Ownership Changes (Oct 1997) (DEVIATION DEC 2025) 52.215-21 (DEV) Requirements for Certified Cost or Pricing Data and Data Other Than Certified Cost or Pricing Data- Modifications (Nov 2021) (DEVIATION DEC 2025) 52.216-1 (DEV) Type of Contract (Apr 1984) (DEVIATION DEC 2025) 52.217-5 (DEV) Evaluation of Options (July 1990) (DEVIATION Aug 2025) 52.216-22 (DEV) Indefinite Quantity (Oct 1995) (DEVIATION DEC 2025) 52.219-4 (DEV) Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2022) (DEVIATION

DEC 2025)

52.219-8 (DEV) Utilization of Small Business Concerns (Jan 2025) (DEVIATION DEC 2025) 52.219-9 Alt II (DEV) Small Business Subcontracting Plan (Jan 2025) – Alternate II (Nov 2016) (DEVIATION DEC 2025) 52.219-16 (DEV) Liquidated Damages – Subcontracting Plan (Sep 2021) (DEVIATION DEC 2025) 52.219-18 (DEV) Postaward Small Business Program Representation (Jan 2025) (DEVIATION DEC 2025) 52.222-1 (DEV) Notice to the Government of Labor Disputes (FEB 1997) (DEVIATION DEC 2025) 52.222-3 (DEV) Convict Labor (June 2003) (DEVIATION DEC 2025) 52.222-4 (DEV) Contract Work Hours and Safety Standards-Overtime Compensation (May 2018) (DEVIATION DEC 2025) 52.222-35 (DEV) Equal Opportunity for Veterans (Jun 2020) (DEVIATION DEC 2025) 52.222-36 (DEV) Equal Opportunity for Workers with Disabilities (Jun 2020) (DEVIATION DEC 2025) 52.222-37 (DEV) Employment Reports on Veterans (Jun 2020) (DEVIATION DEC 2025)

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT - Continuation

1. CONTRACT ID CODE

PAGE OF PAGES

2.AMENDMENT/MODIFICATION NO.

A00008

3. EFFECTIVE DATE

02/18/2026

4. REQUISITION / PURCHASE REQ. NO.

PROJECT NO. (If Applicable)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible).

STANDARD FORM 30 (REV. 11/2016)

52.222-40 (DEV) Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (DEVIATION DEC 2025) 52.222-41 (DEV) Service Contract Labor Standards (Aug 2018) (DEVIATION DEC 2025) 52.222-43 (DEV) Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (DEVIATION DEC 2025) 52.222-50 (DEV) Combating Trafficking in Persons (Oct 2025) (DEVIATION DEC 2025) 52.222-54 (DEV) Employment Eligibility Verification (Jan 2025) (DEVIATION DEC 2025) 52.222-55 (DEV) Minimum Wage for Contractor Workers Under Executive Order 14026 (Jan 2022) (Deviation Dec 2025) 52.222-62 (DEV) Paid Sick Leave Under Executive Order 13706 (Jan 2022) (Deviation Dec 2025) 52.229-3 (DEV) Federal, State, and Local Taxes (Feb 2013) (DEVIATION AUG 2025) 52.233-1 Alt I (DEV) Disputes (May 2014) – Alternate I (Dec 1991) (DEVIATION NOV 2025) 52.233-2 (DEV) Service of Protest (Sep 2026) (DEVIATION NOV 2025) 52.233-3 (DEV) Protest after Award (Aug 1996) (DEVIATION NOV 2025) 52.233-4 (DEV) Applicable Law for Breach of Contract Claim (Oct 2004) (DEVIATION NOV 2025) 52.243-1 Alt I (DEV) Changes-Fixed-Price (Aug 1987) – Alternate I (Apr 1984) (DEVIATION JUL 2025) 52.244-6 (DEV) Subcontracts for Commercial Products and Commercial Services (JAN 2025) (DEVIATION FEB 2025) 52.253-1 (DEV) Computer Generated Forms (Jan 1991) (DEVIATION NOV 2025)

The following clauses and provisions have been added:

52.226-7 Drug-Free Workplace (May 2024) 52.226-8 Encouraging Contractor Policies To Ban Text Messaging While Driving (May 2024) 52.240-90 (DEV) Security Prohibitions and Exclusions Representations and Certifications (DEVIATION NOV 2025) 52.240-91 (DEV) Security Prohibitions and Exclusions (DEVIATION NOV 2025) 52.240-93 (DEV) Basic Safeguarding of Covered Contractor Information Systems (DEVIATION NOV 2025) 52.252-6 Authorized Deviations in Clauses (Nov 2020) BOP DOJ-05 DEVIATION BOP-05 Security of Department Information and Systems (January 2025) Contractor must fill out the Federal Bureau of Prisons Vendor Cybersecurity Attestation Form – See Attached

BOP DOJ-05 DEVIATION BOP-05 Security of Department Information and Systems (January 2025)

The vendor is required to complete Attachment [FBOP Proposed Attestation], Federal Bureau of Prisons Vendor Cybersecurity Attestation Form, addressing the security measures they rely upon to protect any DOJ Information and/or DOJ Information Systems for which they come into contact within the course of performing services under contract/agreement with DOJ.

The vendor shall submit the Federal Bureau of Prisons Vendor Cybersecurity Attestation Form, along with supporting documentation, at the time of solicitation response, annually, and when significant changes to the provided services, operating environment, or data processed occur.

Acquisition Plan FBOP | Department of Justice

The vendor affirms that they have security controls in place to protect DOJ information when that data is being stored, transmitted, processed, or displayed on the vendor’s information technologies. Applicable security controls include certifications indicating compliance with: state licensure requirements, SOC 2, ISO 27001, Payment Card Industry, HIPAA as applicable or other environment certifications that would be applicable (to be specified by the vendor). Vendor has attached documentation of said certifications as part of this affirmation.

The vendor affirms that internal controls are in place to identify and remediate vulnerabilities within any IT system in which DOJ information is stored and that DOJ data will be stored exclusively within the boundaries of the United States and that only US citizens have access to DOJ’s data. The vendor affirms that any DOJ information made available to vendor under this contract shall be used only for the purpose of performance of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of this contract. The vendor shall neither reproduce nor release such information to any third-party at any time, including during or after performance of the contract, without prior written permission of the CO or COR.

The vendor agrees to report any actual or suspected breach of DOJ Information within one hour of discovery of an actual breach, and within 24 hours of a suspected breach if vendor has not yet been able to determine whether a breach has occurred. A “breach” is an incident or occurrence that involves the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses DOJ Information or (2) an authorized user accesses or potentially accesses DOJ Information for an other than authorized purpose. The report of a breach must be made to the CO or COR; if neither can be reached, the vendor must report the breach to the DOJ Security Operations Center (jsoc@usdoj.gov, 202-357-7000) and FBOP’s Information Security Program Office; the COR; and the Contracting Officer within one (1) hour of the initial discovery. The vendor should not disclose any details of the potential or confirmed breach to any individual not involved in responding to the breach. The vendor agrees to cooperate with DOJ’s inquiry into the incident and efforts to minimize risks to DOJ or individuals. Such cooperation includes, but is not limited to, providing to DOJ full access to any facility and/or Information System affected or potentially affected the breah or potential breach, and to undertake any and all response actions DOJ determines are required to ensure the protection of DOJ Information, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. The vendor further agrees that it shall be responsible for all costs and related resource allocations that DOJ deems required for all such response activities related to any breach.

[FBOP Proposed Attestation] [BOP RRC, CMS & Credit Reporting Contracts: To Address ATU concerns]

A. Vendor Information Types Questions Yes No N/A Description ☐ ☐ ☐ Is the data sensitive (as defined by NIST)?

☐ ☐ ☐ Does the data contain Personally Identifiable Information (PII)?

☐ ☐ ☐ Does the data contain Federal Tax Information (FTI)?

☐ ☐ ☐ Does the data contain Protected Health Information (PHI)?

Does the data contain other Limited Official Use Information:

☐ Legal Privilege ☐ Legal Strategy ☐ Grand Jury ☐ Title III Information ☐ Protected Materials ☐ Privacy Act ☐ Procurement Sensitive ☐ Intellectual Property ☐ Law Enforcement Sensitive ☐ Infrastructure Sensitive

Approximately how many records will be transmitted to the vendor during the contract period?

B. Vendor Information Security Questions Yes No N/A Description

☐ ☐ ☐ Is Multi Factor Authentication (MFA) used to access DOJ data?

Describe implementation:

Explain N/A:

☐ ☐ ☐ Is the principle of least privilege employed for access management?

Describe implementation:

Explain N/A:

Is sensitive data encrypted at rest and/or in transit (e.g., sensitive Personally Identifiable Information (PII), Federal Tax Information (FTI), health information (HIPAA))?

Describe implementation:

Explain N/A:

Do portable devices require mobile device management tools before allowing access to corporate data, including email?

Describe implementation:

Explain N/A:

☐ ☐ ☐ Is there a formal cyber security program which includes policy enforcement?

Describe implementation:

Explain N/A:

☐ ☐ ☐ Are routine vulnerability scans of all system assets and endpoints performed?

Yes No N/A Description Describe implementation:

Explain N/A:

Are internal and external penetration tests conducted?

Describe implementation:

Explain N/A:

Are known vulnerabilities mitigated or remediated within 30 for critical and high risk, and 90 days for medium risks?

Describe implementation:

Explain N/A:

o Critical Patch - to be installed within 30 days or sooner if possible o High Risk Patch - to be installed within 60 days or sooner if possible o Medium Risk Patch - to be installed within 90 days or sooner if possible o Low Risk Patch - to be installed within the normal patching rotation, but within at least a year.

Are monitoring services employed which will notify resources as needed 24x7x365 to support incident response?

Describe implementation:

Explain N/A:

If sub-contractors are used, describe questionnaire and other requirements of sub-contractors:

Describe implementation:

Explain N/A:

C. Data Owners Role Responsible Party Responsibilities

Data Steward Entity who is responsible for the categorization, protection, usage, and quality of the data.

Data Steward Entity who is responsible for the confidentiality, integrity, and availability of the data on a day-to-day basis.

Data Steward Entity who is responsible for the confidentiality, integrity, and availability of data on a day-to-day basis.

D. Vendor Signature As the vendor representative, I attest that the information in sections A and B are accurate, and I accept the responsibility of protecting and ensuring the confidentiality, integrity, and availability of DOJ data on a day-to-day basis when it is on the vendor or subcontracted vendor networks.

RRC In-House services MALE only and home confinement services. Facility to be located in the Washington, DC area, within either: the city limits of Washington, DC; Montgomery County, Maryland; Prince George's County, Maryland; Arlington County, Virginia; or Fairfax County, Virginia.

The following Wage Determinations have been updated and posted on SAM.GOV:

• WD 2015-4269 Rev 31, Dec 3, 2025

• WD 2015-4281 Rev 35, Dec 3, 2025