1.9.1 - Statement of Work.pdf

Statement of Work Department of Homeland Security (DHS)

Homeland Security Task Force (HSTF) National Coordination Center (NCC)

Project SAFEHAVEN April 7, 2026

1. BACKGROUND

1.1 Purpose.

The purpose of this contract is to establish Project SAFEHAVEN analytic support services to the Homeland Security Task Force (HSTF). The Homeland Security Task Force (HSTF) National Coordination Center (NCC) requires dedicated analytic support to sustain ongoing homeland security operations, including support to ICE Homeland Security Investigations (HSI) and broader mission partners. The Government requires an analytic cell capable of deploying against active mission requirements with real-time targeting, threat network analysis, and operational reporting. The Project SAFEHAVEN requires a mission-engineered, commercially available analytic support solution.

Unlike traditional subscriptions that deliver raw data and leave the analytic burden to Government personnel, Project SAFEHAVEN shall deliver operationally relevant analytic output—targeting packages, threat group associations, geolocation products, and pattern-of-life assessments—through an integrated support environment. This analytic support capability presents the Government with the ability to eliminate reliance on fragmented tools and disparate analytic efforts, achieving significant cost savings and operational efficiency.

1.2 Requirement Areas Overview

The scope of work is organized around seven (7) requirement areas. Each area represents a distinct deliverable within the Project SAFEHAVEN analytic cell and is defined in detail in Section 2.0 of this statement of work.

• Track and Geolocate. The analytic cell shall deploy real-time geolocation capability against mission targets, providing operators with current and historical location intelligence, pattern-of-life analysis, and positional awareness across domestic and international areas of interest.

• Threat Group Analysis. The analytic cell shall categorize individuals and networks into operationally relevant threat groupings—including transnational criminal organizations (TCOs), foreign terrorist organizations (FTOs), drug trafficking networks, human trafficking organizations, gang affiliates, extremists, fugitives, sex offenders, and illegal re-entrants—and produce actionable analytical products for mission leadership.

• Multi-Hardware Observation. The analytic cell shall correlate observations across multiple device types and signal sources to maintain continuity of observation on mission targets, ensuring subjects cannot evade analytic coverage by changing devices or networks.

• Training. The Contractor shall provide educational briefings—including on-site, virtual, and vendor-hosted sessions—to ensure Government personnel can effectively task, receive, and act on SAFEHAVEN analytic output.

• Reporting. The Contractor shall provide analytic products based on individual customer requirements for product delivery based on priorities determined by the PM. Structured monthly usage reports, analytical summaries, and ad hoc mission reporting will be proved upon request.

• User Support. The Contractor shall provide dedicated mission support specialists, and escalation pathways for urgent operational requirements.

• Information Security. The Contractor shall ensure all analytic operations comply with FedRAMP High, IL-5, Privacy Act, and DHS 4300A requirements, with zero-query-retention protections, end-to-end encryption, and hosting on a secure Cloud infrastructure meeting all applicable DHS security standards.

2.0 SCOPE OF WORK/TASK REQUIREMENTS

The following subsections define the seven (7) requirement areas comprising the Project SAFEHAVEN scope of this requirement for the HSTF NCC. The contractor shall deliver all capabilities described herein through the SAFEHAVEN analytic cell, deploying directing against Government mission requirements.

2.1 Track and Geolocate.

The Contractor shall deploy real-time track-and-geolocate analytic capability against HSTF NCC mission requirements. The SAFEHAVEN analytic cell shall produce geolocation intelligence products in support of active targeting operations, including but not limited to:

• Real-time location of mission targets across domestic and international areas of interest.

• Historical pattern-of-life analysis identifying habitual locations, routes, and behavioral patterns.

• Geolocation resolution leveraging multiple collection sources to establish and maintain positional awareness.

• Maritime positional intelligence in support of coastal, port, and open-ocean mission requirements.

• International and U.S. domestic location intelligence fusion to support cross-border targeting.

• Rapid-response geolocation tasking to support time-sensitive operational requirements.

Track-and-geolocate output shall be delivered through SIGNAL and /or a secure, web-based interface accessible to authorized HSTF NCC personnel. The analytic cell shall provide geolocation products in response to specific mission taskings and standing analytic coverage of priority targets. Frontline operators shall be able to task, receive, and act on geolocation intelligence without requiring manual data processing or external support.

2.2 Threat Group Analysis.

The Contractor shall provide dedicated threat group analysis in support of HSTF NCC targeting and intelligence operations. The SAFEHAVEN analytic cell shall identify, categorize, and map individuals and networks into operationally relevant threat groups, producing analytical products that enable mission leadership to understand and act against organized threat structures. Threat categories shall include but not be limited to: Transnational Criminal Organizations (TCOs), Foreign Terrorist Organizations (FTOs), Drug Trafficking Networks, Gang Members, International Extremists, and Fugitives etc.

The analytic cell shall produce threat group products that identify associations between subjects, map patterns of movement and communication, reveal network structures, and highlight operational vulnerabilities within targeted organizations.

Threat group analysis shall be integrated directly into SAFEHAVEN’s targeting workflow, enabling analysts to move from identification to actionable intelligence within relevant operational timelines.

2.3 Multi-Hardware Observation.

The Contractor shall analytic capability to maintain continuity of observation on mission targets across multiple device types, networks, and operational environments. Multi-hardware observation capabilities shall include:

• Correlation of target activity across mobile IoT devices to maintain unified target profiles.

• Association mapping across Wi-Fi access points and network identifiers.

• Correlation of target activity across multiple networks and geographic locations.

• Fusion of observations from multiple collection sources to build comprehensive operational pictures of target behavior.

• Temporal analysis correlating multi-source observations to establish and refine pattern-of-life assessments.

The analytic cell shall produce unified target profiles that aggregate available observations. This ensures that HSTF NCC analysts receive a robust operational picture rather than fragmentary reporting from individual collection sources.

2.4 Training.

The Contractor shall comprehensive, mission-tailored briefings to ensure HSTF NCC personnel can effectively task the SAFEHAVEN analytic cell, interpret analytic output, and integrate SAFEHAVEN products into operational workflows.

2.5 Reporting.

The Contractor shall deliver project reports to help the Government maintain visibility into analytic activity, mission output, and operational impact. Reporting requirements include:

• Monthly usage reports include analyst activity, tasking volume, and analytic output summaries.

• Analytical summary reports aggregating SAFEHAVEN mission output for leadership review.

• Ad hoc mission reporting as requested by the Contracting Officer’s Representative (COR).

All reports shall be designed to support both program oversight and operational decision-making at the mission leadership level.

2.6 User Support.

The Contractor shall dedicated support to ensure uninterrupted access to the SAFEHAVEN analytic cell for all authorized HSTF NCC personnel. User support shall include:

• Dedicated mission support specialists who understand the HSTF NCC operational environment and can assist with analytic tasking.

• Escalation pathways for urgent operational requirements to ensure the analytic cell remains responsive to time-sensitive mission needs.

• Compliance with applicable DHS security policies in relation to OPSEC and reporting.

User support shall be designed to minimize unplanned downtime for operational users. The Contractor shall maintain dedicated personnel familiar with the HSTF NCC mission environment to provide responsive, context-aware support throughout the period of performance.

2.7 Information Security.

The Contractor shall ensure that SAFEHAVEN analytic operations meet or exceed information security requirements applicable to DHS operations. The security posture of the analytic cell shall protect both Government operational activity and the integrity of analytic products. Information security requirements include:

• FedRAMP High authorization, ensuring compliance with the federal cloud security baseline.

• Impact Level 5 (IL-5) compliance for controlled unclassified information

(CUI).

• Zero-query-retention architecture. The analytic cell shall not retain user search parameters, tasking details, or sensitive operational metadata beyond what is required to produce the requested analytic output.

• Compliance with the Privacy Act and DHS 4300A security policy.

• Hosted on secure Cloud infrastructure that meets applicable DHS security standards.

The information security posture shall ensure that HSTF NCC operations are protected against unauthorized access and compromise of analyst activities. The zero-query-retention design protects operational security—ensuring that the analytic cell does not become a repository of sensitive Government tasking information.

3.0 OTHER APPLICABLE REQUIREMENTS

3.1 Period of Performance.

The period of performance will consist of one (1) base year, May 1, 2026 through

April 30, 2027.

3.2 Place of Performance.

The primary place of performance will be the Contractor’s facilities with frequent visits to the Immigration and Customs Enforcement (ICE) headquarters facilities in the Washington Metro Area.

3.3 Travel.

The Contractor travel is not required for this requirement. Local meetings or activities planned outside of the defined place of performance are permitted, but all expenses incurred are the responsibility of the contractor

4.0 DELIVERABLES

The contractor shall provide the following deliverables in the format and frequency listed.

Deliverables Name PWS Paragraph Frequency

Kick-off Meeting/Post Award Conference

A kick-off meeting with the government will be conducted within 5 days of award. Meeting minutes due from Contractor to COR & CO within 2 business days of the meeting.

Monthly Usage report

2.5

Reports are due monthly to the COR.

To include any subsequent updates.

(analyst activity, tasking volume and analytic output summaries)

Analytical Summary Reports 2.5

Reports are due monthly to the COR.

To include any subsequent updates, (aggregating SAFEHAVEN mission output for leadership review).

Ad Hoc Mission Reporting 2.5 Reports are due as required to the

COR.

4.1 Deliverables

A standard invoice template shall be provided by the contractor and confirmed by the COR for use on this contract. Invoices shall be verified by the Government COR and submitted on a monthly basis.

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with ICE workstations (Windows XP and Microsoft Office Applications).

4.2 Acceptance Criteria

DHS/HSTF will accept or reject deliverables within five (5) business days after delivery. If rejected, the Contractor shall make corrections as specified and resubmit the deliverable for review and approval within three (3) business days provided however that contractor is not dependent upon a third party for performance. If the government does not reply within the specific timeframe, then the deliverable shall be determined acceptable.

OCIO/ Data Management Unit (DMU) - Data Ownership Contract Requirements Language

1. Accessibility of Government-owned Data

All stored program data associated with this acquisition shall be owned by the Government.

As such, it shall be made accessible to the Government in accordance with the Minimum Data Access Capability described below. This accessibility is required to allow full data transparency, flexibility in performing data analytics, and integration with data from other government programs.

In addition to the Minimum Data Access Capability, the Government prefers, but does not require, that program data be accessible via Enhanced Access Capabilities as described below.

Definition of “program data”: Program Data refers to any data resulting from ICE and DHS organizational activity. Examples of such data include but are not limited to administrative data resulting from human resource, management, and financial actions, as well as operational data resulting from performance of the ICE mission.

Definition of “associated with this acquisition”: Program Data is associated with an acquisition if it is created by DHS organizational activity that is facilitated by the contractor.

Examples of how a contractor might facilitate organizational activity follow:

Invoices

Invoice should be submitted on a monthly basis to the COR and designated Finance Center for all services performed and no more than 30 days in the arrears of the last day of the POP.

o Program data is stored by contractor personnel o Program data is stored by software that is managed, developed, or used by the contractor o Program data is stored in a repository that is managed, developed, or used by the contractor

2. Minimum Data Access Capability

• The current version of all Program Data is accessible to the Government within 24 hours of request, as well as on any pre-defined schedule as required by the Government.

Data access can occur by various means, provided that Government security requirements are met, and data is accessible in a format that is acceptable to the Government. Examples include but are not limited to APIs that are consumable by the Government, files made available for Government download (e.g., Excel Spreadsheets), or direct database query by federal or contractor personnel.

• The contractor shall format program data accessed by the Government to anticipate the maximum file size of any data to be accessed. File size shall be small enough to assure rapid processing by government applications.

• The contractor shall provide the means for the Government to interpret accessible Program Data as follows:

o Data elements and groupings of data elements shall be clearly identifiable by labels embedded in the data itself, or by a separate schema or file layout which allows such elements and groupings to be identified.

In the case of a relational database schema defined through Data Definition Language (DDL), data elements would be represented as columns, and groupings of data would be represented as tables. In addition, relationships between tables would be described as foreign key relations.

o Labels or names used to identify data elements and groupings of data elements shall be approved by the Government. In addition, each label or name shall be associated with a government approved definition which describes the content of data held therein.

o Program data delivered to the Government shall conform to the Government approved definition for each data element and grouping of data elements.

o All data accessible by the Government shall be both machine readable and human-readable in plain text.

o All reference data associated with Program Data also needs to be accessible to the Government. Such reference data is required to provide complete understanding of a record.

Reference Data Example: Program data may include a city code which uniquely identifies a city. Reference data associated with a city code may include its name, geographic boundaries, population, median income, etc. This example is provided for clarification of the meaning of reference data and may or may not apply to this specific acquisition. Examples of other reference data codes would include codes representing eye color, gender, country of origin, etc.

3. Enhanced Access Capabilities

The Government prefers that sharing of program data take place via an Application Programming Interface (API) or multiple APIs. APIs allow the Government to efficiently consume data via a widely recognized standard where the data has been completely abstracted from the technology platform that produces it.

In addition, the Government prefers that sharing of program data take place using techniques that enhance efficiency, such as Change Data Capture (CDC). CDC enhances efficiency of data transfer by providing only incremental updates to program data as opposed to providing all program data each time data is shared.

1. Compliance with Federal Laws and Policies; AI Use Limitations. The Contractor shall ensure any AI system or service provided complies with all applicable federal, Department of Homeland Security (DHS), and U.S. Immigration and Customs Enforcement (ICE) AI Policies, Directives, and Memos, as well as ICE AI governance requirements. The AI solution must align with the U.S. Constitution and all relevant laws and regulations, including privacy, civil rights, and civil liberties. Specifically:

a. The Contractor must stay current and comply with any updates or new AI policy and AI governance requirements issued during the contract term.

b. AI used to support law enforcement decisions or civil actions must include technical and operational safeguards to:

i. Establish human-in-the loop oversight.

ii. Document or label AI-generated content.

c. For AI used in determinations impacting individuals (e.g., risk assessments, identity verification), the Contractor must cooperate with federal, DHS, and ICE procedures for notice and appeal, providing explanations or adjusting outputs upon error findings.

d. The contract prohibits use of AI that violates DHS policy, including:

i. Using AI outputs as sole evidence for punitive or enforcement actions.

ii. Utilizing AI to make or support decisions on improper bases (e.g., predicting future behavior or emotional state leading to discriminatory or unlawful actions).

e. The Contractor must follow AI Use Case approval, Security Authorization, and ICE AI governance and AI risk management processes and requirements before developing, piloting, testing, or deploying AI in ICE environments or using ICE data.

f. The Contractor is responsible for complying with AI Security Control Baseline requirements.

2. Traceability, Auditability, and Transparency. The Contractor shall design, build, document, and operate the AI system or service to be explainable, auditable, and transparent. At a minimum, the Contractor shall:

a. Document the provenance of data used for AI training, fine-tuning, or operation.

b. Ensure data used for AI training, fine tuning, or operation was lawfully obtained and processed.

c. Document the provenance of any third-party AI models used (source, version, etc.).

d. Provide comprehensive system diagrams and inventories that map the AI systems’

API and system connections, data flows, and technical components.

e. Provide comprehensive documentation explaining how the AI system works, including any models and algorithms.

f. Ensure the AI system, where applicable, provides clear explanations or reasoning for its decisions or predictions.

g. Ensure AI outputs are traceable, auditable, meet evidentiary standards, and are explainable to non-technical users. Additionally:

i. Ensure GenAI inputs and their outputs are logged and preserved in line with federal, DHS, and ICE retention policies.

3. Data Rights and Solution Ownership. The contract shall clearly delineate data and intellectual property rights to protect ICE’s interests in the AI solution and associated data. Specifically:

a. All data provided by the Government or generated through the AI system belongs to the Government. The Contractor is prohibited from:

i. Using nonpublic agency data and outputted results to train publicly or commercially available AI algorithms, or any non-ICE systems outside the contract’s scope without ICE’s authorization.

ii. Using Government-furnished data or AI-generated data for purposes outside the contract without ICE authorization.

iii. Sharing, disclosing, or transferring Government data, AI models, or AI-outputs with third parties without ICE’s authorization.

b. The Contractor must grant the Government appropriate license rights in any custom-developed AI models, software, or deliverables. Intellectual Property (IP) rights will be negotiated consistent with federal law and the agency’s mission needs, aiming to avoid vendor lock-in. The Government may require broad or unlimited rights to certain deliverables (including source code or trained model files) for long-term use, maintenance, or integration of the AI solution.

c. ICE maintains ownership over and the Contractor must provide ICE access to:

i. Any derivative outputs of AI developed under the Contract, including data processed using AI.

ii. Any models trained, fine-tuned, or otherwise developed using ICE data.

4. Prevention Against Vendor Lock-In: To promote a competitive marketplace and long-term sustainability of ICE’s AI capabilities, the Contractor shall:

a. Utilize industry-standards, Application Programming Interfaces (APIs), and protocols wherever possible to ensure interoperability and combability within and between ICE and DHS systems.

b. Ensure inputs and outputs of the AI system are exportable in a non-proprietary, machine-readable format to facilitate integration or transfer of functions to other systems.

c. Where custom components are developed, deliver sufficient technical documentation and access to components (including source code, model weights, or other foundational code) to enable ICE’s long-term use of the AI system.

d. In the case of transitioning the AI system to another contractor or in-house provider, the Contractor must support knowledge transfer and provide all necessary documentation, models, data, derivative outputs, and software to enable sustained system use.

i. The Contract must also document estimated costs and related steps that will be required to exit the Contract.

5. Security, Testing & Evaluation, and Continuous Monitoring: The Contractor shall implement rigorous security and risk management measures for the AI solution, per federal standards, ICE procedures, and Office of Management and Budget (OMB) guidance on AI risks. Key requirements include:

a. If designated as a High Impact AI system, complying with all required AI Risk Management practices (per OMB, DHS, and ICE policy), unless officially granted a waiver.

b. Before deploying the AI system: The Contractor must provide testing and evaluation artifacts and support (including providing requisite access) to enable ICE independent test and evaluation processes to evaluate factors such as, but not limited to:

i. AI system performance, including accuracy and reliability.

ii. Compliance with DHS AI Security Controls.

iii. Resiliency against AI cybersecurity and operational threats, including system misuse/abuse.

iv. Completion of an AI impact assessment and/or other risk assessment procedures, in line with federal, DHS, and ICE policy and practices.

v. Fulfillment of functional, business, and technical requirements.

c. While operating the AI system: The Contractor must re-test system performance, security, resiliency, and abuse/mis-use vulnerabilities before deploying new AI models, fine-tuned models, or other changes to AI systems that require Change Requests.

d. Audit and Logging: Ensure compliance with DHS and ICE AI auditing and logging requirements, including, but not limited to audit and logging the access, usage, and modification of:

i. AI Guardrails deployed in GenAI systems.

ii. Models, including parameters and weights.

iii. AI system inputs and outputs (including prompts).

iv. Additional requirements as determined by federal, DHS, and ICE policy.

e. Continuous Monitoring: The Contractor shall implement continuous monitoring mechanisms to detect and respond to anomalies, biases, or performance degradation in AI systems. Additionally:

i. The Contractor shall establish protocols for the timely remediation of identified issues, including the potential suspension of AI system operations if necessary.

The Contractor shall comply with all continuous monitoring requirements, per federal, DHS, and ICE policy.

End of Statement of Work