2_2_1_70SBUR26Q00000172_20260813.pdf

WOMEN-OWNED SMALL

BUSINESS (WOSB)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3.AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

REQUEST

FOR QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 29. AWARD OF CONTRACT: REFERENCE

. YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4.

FAR 52.212-3 AND 52.212-5 ARE ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED.

8(A)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30.

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

DATED.

OFFER

ADDENDA

ADDENDA

70SBUR26Q00000172

Human Capital & Training 5900 Capital Gateway Drive Camp Springs MD 20588

DHS / USCIS

Office of Contracting 124 Leroy Road Williston VT 05495

DHS / USCIS

Office of Contracting 124 Leroy Road Williston VT 05495

08/19/2026 1700 ET

HCT260002

Christian Zaman 240.721.6236

70SBUR 100.00

70SBUR

Ya Lin Liu

339999

CIS-HCT

The Department of Homeland Security (DHS), U.S.

Citizenship and Immigration Services (USCIS) is issuing a Request for Quotation (RFQ) for a

Firm-Fixed-Price (FFP) delivery order of USCIS

Retirement Plaques.

Continued...

STOCK RECORD (S/R)

STANDARD FORM 1449 (REV. 11/2021) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE RECEIVED (MM/DD/YYYY) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32g. EMAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

ACCEPTED,

Delivery: 09/07/2026

Period of Performance: 09/07/2026 to

09/06/2027

0001 600 EABase Period Retirement Plaques: Not to exceed

(NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the

Government is not obligated to order the maximum quantity. Plaques shall be 11" x 14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached Description of

Requirements for additional specifications and the attached picture for a sample.

Product/Service Code: 8455

0001 A 120 EABase Period Retirement Plaques Surge: Not to exceed (NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be 11" x

14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached Description of

Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

07/07/2027

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGES

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C)

NSN 7540-01-152-8067

Product/Service Code: 8455

0002 400 EAOption Period 1 Retirement Plaques: Not to exceed (NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be 11" x

14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached Description of

Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

08/07/2027

Product/Service Code: 8455

Period of Performance: 09/07/2027 to

09/06/2028

0002 A 80 EAOption Period 1 Retirement Plaques Surge: Not to exceed (NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be

11" x 14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached

Description of Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

07/07/2028

Product/Service Code: 8455

Period of Performance: 09/07/2027 to

09/06/2028

0003 400 EAOption Period 2 Retirement Plaques: Not to exceed (NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be 11" x

14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached Description of

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C)

Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

08/07/2028

Product/Service Code: 8455

Period of Performance: 09/07/2028 to

09/06/2029

0003 A 80 EAOption Period 2 Retirement Plaques Surge: Not to exceed (NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be

11" x 14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached

Description of Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

07/07/2029

Product/Service Code: 8455

Period of Performance: 09/07/2028 to

09/06/2029

0004 400 EAOption Period 3 Retirement Plaques: Not to exceed (NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be 11" x

14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached Description of

Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

08/07/2029

Product/Service Code: 8455

Period of Performance: 09/07/2029 to

09/06/2030

0004 A 80 EAOption Period 3 Retirement Plaques Surge: Not to exceed (NTE) retirement plaques may be

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C) ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be

11" x 14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached

Description of Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

07/07/2030

Product/Service Code: 8455

Period of Performance: 09/07/2029 to

09/06/2030

0005 400 EAOption Period 4 Retirement Plaques: Not to exceed (NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be 11" x

14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached Description of

Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

08/07/2030

Product/Service Code: 8455

Period of Performance: 09/07/2030 to

09/06/2031

0005 A 80 EAOption Period 4 Retirement Plaques Surge: Not to exceed (NTE) retirement plaques may be ordered during the base period on an as-needed basis, and the Government is not obligated to order the maximum quantity. Plaques shall be

11" x 14" solid wood with a cherry finish and include a gold/velour/gold plate, a 3" die-struck brass seal surrounded by a brass ring, and the DHS seal. See the attached

Description of Requirements for additional specifications and the attached picture for a sample.

(Option Line Item)

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C)

07/07/2031

Product/Service Code: 8455

Period of Performance: 09/07/2030 to

09/06/2031

PART II – PURCHASE ORDER CONTRACT CLAUSES

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/far-overhaul/far-part-deviation-guide and https://www.acquisition.gov/hsar.

(End of clause)

FAR 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any Revolutionary FAR Overhaul and Homeland Security Acquisition Regulation (48 CFR 30) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

FAR CLAUSES INCORPORATED BY REFERENCE

FAR 52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS (NOV 2023)

FAR 52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL CONFIDENTIALITY

AGREEMENTS OR STATEMENTS (JAN 2017)

FAR 52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE (OCT 2018)

FAR 52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS

(DEC 2014)

FAR 52.209-10 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS

(NOV 2025) (DEVIATION 25-27) (EFFECTIVE NOVEMBER 28, 2025)

FAR 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (AUG 2025) (DEVIATION 25-21) (EFFECTIVE NOVEMBER 28, 2025)

FAR 52.219-28 POSTAWARD SMALL BUSINESS PROGRAM REREPRESENTATION (OCT 2025)

(DEVIATION 26-03) (EFFECTIVE NOVEMBER 28, 2025)

FAR 52.222-3 CONVICT LABOR. (JUNE 2003)

FAR 52.222-19 CHILD LABOR-COOPERATION WITH AUTHORITIES AND REMEDIES (APR 2026)

(DEVIATION 26-10, REVISION 1) (EFFECTIVE APRIL 3, 2026)

FAR 52.222-35 EQUAL OPPORTUNITY FOR VETERANS (OCT 2025) (DEVIATION 26-10) (EFFECTIVE

NOVEMBER 3, 2025)

FAR 52.222-36 EQUAL OPPORTUNITY FOR WORKERS WITH DISABILITIES (OCT 2025)

(DEVIATION 26-10) (EFFECTIVE NOVEMBER 3, 2025)

FAR 52.222-37 EMPLOYMENT REPORTS ON VETERANS (OCT 2025) (DEVIATION 26-10)

(EFFECTIVE NOVEMBER 3, 2025)

https://www.acquisition.gov/far-overhaul/far-part-deviation-guide

FAR 52.222-50 COMBATING TRAFFICKING IN PERSONS (NOV 2021)

FAR 52.222-54 EMPLOYMENT ELIGIBILITY VERIFICATION (OCT 2025) (DEVIATION 26-10)

(EFFECTIVE NOVEMBER 3, 2025)

FAR 52.232-33 PAYMENT BY ELECTRONIC FUNDS TRANSFER-SYSTEM FOR AWARD

MANAGEMENT (OCT 2018)

FAR 52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUN 2013)

FAR 52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS

SUBCONTRACTORS (MAR 2023)

FAR 52.233-1 DISPUTES (AUG 2025) (DEVIATION 25-25) (EFFECTIVE NOVEMBER 3, 2025)

FAR 52.233-3 PROTEST AFTER AWARD (AUG 2025) (DEVIATION 25-25) (EFFECTIVE NOVEMBER 3, 2025)

FAR 52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (AUG 2025) (DEVIATION 25-

25) (EFFECTIVE NOVEMBER 3, 2025)

FAR CLAUSES IN FULL TEXT

FAR 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months.

FAR 52.222-90 ADDRESSING DEI DISCRIMINATION BY FEDERAL CONTRACTORS(APR 2026)

(DEVIATION 26-10, REVISION 2) (EFFECTIVE APRIL 27, 2026)

(a) Definitions. As used in this clause—

Program participation means membership or participation in, or access or admission to: training, mentoring, or leadership development programs;

educational opportunities; clubs; associations; or similar opportunities that are sponsored or established by the contractor or subcontractor.

Racially discriminatory diversity, equity, and inclusion (DEI) activities means disparate treatment based on race or ethnicity in the recruitment, employment (e.g., hiring, promotions), contracting (e.g., vendor agreements), program participation, or allocation or deployment of an entity's resources.

(b) In connection with the performance of work under this contract, the Contractor agrees as follows:

(1) The Contractor will not engage in any racially discriminatory DEI activities;

(2) The Contractor will furnish all information and reports, including providing access to books, records, and accounts, as required by the Contracting Officer, for purposes of ascertaining compliance with this clause;

(3) In the event of the Contractor's or a subcontractor's noncompliance with this clause, this contract may be canceled, terminated, or suspended in whole or in part, and the Contractor or subcontractor may be declared ineligible for further Government contracts;

(4) The Contractor will report any subcontractor's known or reasonably knowable conduct that may violate this clause to the Contracting Officer and take any appropriate remedial actions directed by the Contracting Officer; and

(5) The Contractor will inform the Contracting Officer if a subcontractor sues the Contractor and the suit puts at issue, in any way, the validity of this clause.

(6) The Contractor recognizes that compliance with the requirements of this clause are material to the Government's payment decisions for purposes of 31 U.S.C. 3729(b)(4).

(c) The Contractor must include the substance of this clause, including this paragraph (c), in subcontracts at any tier, including those for commercial products and commercial services, except those where the place of delivery or performance is outside the United States.

HSAR CLAUSES INCORPORATED IN FULL TEXT

HSAR 3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JUL

2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti- Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually, or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department.

Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR https://www.dhs.gov/dhs-security-and-training-requirements-contractors immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email.

Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

HSAR 3052.204-73 NOTIFICATION AND CREDIT MONITORING REQUIREMENTS FOR

PERSONALLY IDENTIFIABLE INFORMATION INCIDENTS (JUL 2023)

(a) Definitions. Privacy Information includes both Personally Identifiable Information (PII) and

Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(1) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(2) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Truncated SSN (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Ethnic or religious affiliation;

(v) Sexual orientation;

(vi) Criminal history;

(vii) Medical information; and

(viii) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(3) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) PII and SPII Notification Requirements.

(1) No later than 5 business days after being directed by the Contracting Officer, or as otherwise required by applicable law, the Contractor shall notify any individual whose PII or SPII was either under the control of the Contractor or resided in an information system under control of the Contractor at the time the incident occurred.

The method and content of any notification by the Contractor shall be coordinated with, and subject to prior written approval by, the Contracting Officer. The Contractor shall not proceed with notification unless directed in writing by the Contracting Officer.

(2) All determinations by the Department related to notifications to affected individuals and/or Federal agencies and related services (e.g., credit monitoring) will be made in writing by the Contracting Officer.

(3) Subject to government analysis of the incident and direction to the Contractor regarding any resulting notification, the notification method may consist of letters to affected individuals sent by first-class mail, electronic means, or general public notice, as approved by the Government. Notification may require the Contractor’s use of address verification and/or address location services. At a minimum, the notification shall include:

(i) A brief description of the incident;

(ii) A description of the types of PII or SPII involved;

(iii) A statement as to whether the PII or SPII was encrypted or protected by other means;

(iv) Steps individuals may take to protect themselves;

(v) What the Contractor and/or the Government are doing to investigate the incident, mitigate the incident, and protect against any future incidents; and

(vi) Information identifying who individuals may contact for additional information.

(c) Credit Monitoring Requirements. The Contracting Officer may direct the Contractor to:

(1) Provide notification to affected individuals as described in paragraph (b).

(2) Provide credit monitoring services to individuals whose PII or SPII was under the control of the Contractor or resided in the information system at the time of the incident for a period beginning the date of the incident and extending not less than 18 months from the date the individual is notified. Credit monitoring services shall be provided from a company with which the Contractor has no affiliation. At a minimum, credit monitoring services shall include:

(i) Triple credit bureau monitoring;

(ii) Daily customer service;

(iii) Alerts provided to the individual for changes and fraud; and

(iv) Assistance to the individual with enrollment in the services and the use of fraud alerts.

(3) Establish a dedicated call center. Call center services shall include:

(i) A dedicated telephone number to contact customer service within a fixed period;

(ii) Information necessary for registrants/enrollees to access credit reports and credit scores;

(iii) Weekly reports on call center volume, issue escalation (i.e., those calls that cannot be handled by call center staff and must be resolved by call center management or DHS, as appropriate), and other key metrics;

(iv) Escalation of calls that cannot be handled by call center staff to call center management or DHS, as appropriate;

(v) Customized Frequently Asked Questions, approved in writing by the Contracting Officer in coordination with the Component or Headquarters Privacy Officer; and

(vi) Information for registrants to contact customer service representatives and fraud resolution representatives for credit monitoring assistance.

PART III – CONTRACT DOCUMENTS, TERMS AND CONDITIONS, AND ATTACHMENTS

ADDITIONAL INVOICING INSTRUCTIONS:

USCIS’ preferred method for invoice submission is electronically. Invoices shall be submitted in Adobe pdf format with each pdf file containing only one invoice recording all deliveries or batches for the month. The pdf files shall be submitted electronically to USCISInvoice.Consolidation@ice.dhs.gov with each email conforming to a size limit of 500 KB.

If a paper invoice is submitted, mail the invoice to:

USCIS Invoice Consolidation PO Box 1000 Williston, VT 05495

DIRECT PAYMENT INQUIRIES TO ICE FINANCIAL OPERATIONS, (877) 491-6521

ATTACHMENTS:

Attachment 1 – Description of Requirement (DOR), 1 page

Attachment 2 – Sample Picture, 1 page

Attachment 3 – PENS Clause, 4 pages mailto:USCISInvoice.Consolidation@ice.dhs.gov

Agency/Organization/Division: USCIS - HCT - HROC Contract Name and/or Description: USCIS Retirement Plaques Contract Number: New Requirement

Background: The Department of Homeland Security (DHS), U.S. Citizenship and Immigration Services (USCIS), has the need for a vendor to provide retirement plaques to honor and recognize the service of USCIS employees.

Scope:

USCIS needs the ability to order various quantities as desired (as few as one plaque per order), have them shipped to various locations within the United States and delivered within five (5) business days after the receipt of an order. There are approximately four hundred (400) retirements per year. A small number of designated ordering contacts will be appointed. The vendor shall coordinate order quantities, details for engraving, and delivery locations with only these

Period of Performance: Base plus 4 option years (9/07/2026 - 9/06/2031) Place of Performance: Shipping addresses will vary and will be provided with each order.

Technical Requirements:

Plaques shall be 11 inches wide by 14 inches tall, made of solid wood with a cherry finish. They shall be assembled using stacked layers (sheets) of gold aluminum, dark blue velour and a face layer of gold aluminum (or comparable materials) to create a gold border/blue border/gold face appearance. The plaque shall include a 3-inch die struck brass Department of Homeland Security (DHS) seal surrounded by a brass ring. The layer/plate of navy-blue velour (or comparable material) shall be visible between the DHS seal and the surrounding brass ring.

As the customized text/messaging for each plaque becomes known, the USCIS ordering contact will notify the awarded vendor, indicating the order number agains which the shipment is to be billed (if applicable), the specific text/messaging required, and the accompanying number assigned to a given plaque (if applicable).

The vendor will assemble and engrave/sublimate the text/messaging for each plaque, and ship as requested until the maximum has been met for that period of performance. If additional plaques are required within a period of performance, USCIS will have the option to order additional plaques at fixed pricing equal to that of the current option in a surge Contract Line Item Number (CLIN).

The vendor shall provide an email address for placement of orders. The USCIS ordering contact shall submit orders via email to the vendor as needed and all text/messaging applicable to the plaque shall be typed. The vendor shall, within one (1) business day of receipt, reject and require resubmission of any orders requiring text/messaging correction. The vendor shall notify both the USCIS HCT Business Center (via email at USCISHCTAcquisitionSupport@uscis.dhs.gov) and the USCIS ordering contact(s) when 75% of the maximum has been ordered/shipped. Delivery is required to be made within five (5) business days after placement of the order.

The vendor shall provide confirmation of receipt for each order in the format of their choosing as well as tracking information at the time of shipment The vendor shall ensure correct engraving/sublimation and shall replace at no charge to the government, any incorrect plaques that are the vendor’s error within five (5) business days. Any return shipping charges for incorrect plaques shall be paid by the vendor. The vendor shall provide a return shipping label to the USCIS ordering contact within five (5) business days of notification of error for any plaques expected to be returned The vendor shall choose a packaging and shipping method to ensure that plaques are delivered undamaged. Any plaque that sustains damage during shipping shall be repaired or replaced within five (5) business days. Any return-shipping charges for damaged plaques shall be the responsibility of the vendor. For any plaques expected to be returned, the vendor shall provide a return shipping label to the USCIS caller within five (5) business days of the notification of damage.

The vendor shall assist the USCIS ordering contact with engraving/sublimating and replacing any plaques with incorrect engraving that were the USCIS contact’s error within five (5) business days.

Vendor Invoices shall include the name of the retiree along with the corresponding plaque number (if applicable) as indicated by the USCIS ordering contact.

Multiple plaque orders should be consolidated onto a single invoice and invoices should be submitted at a frequency of not more than one per week.

A detailed image or digital rendering of the proposed final product shall be provided by the vendor with their bid submission.

Security Requirements: Employee names will be engraved or sublimated onto each plaque, plaques could be shipped to retirees residence Evaluation Criteria: Lowest Price Technically Acceptable (LPTA) PM/Point of Contact (POC)/Number/Email: Scott Wells PM POC Alternate(s): James Collins, Simona Chubb COR Name: Nate King Suggested Contract Type: FFP Date Prepared: 1/27/2026

CLIN

Number Part Number/SKU Minimum Salient Characteristics Qty Unit Cost Extended

Amount 0001 USCIS Retirement Plaque NTE 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 600 $0

0001A USCIS Retirement Plaque Surge 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 120 $0 1001 USCIS Retirement Plaque 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 400 $0

1001A USCIS Retirement Plaque Surge 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 80 $0 2001 USCIS Retirement Plaque 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 400 $0

2001A USCIS Retirement Plaque Surge 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 80 $0 3001 USCIS Retirement Plaque 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 400 $0

3001A USCIS Retirement Plaque Surge 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 80 $0 4001 USCIS Retirement Plaque 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 400 $0

4001A USCIS Retirement Plaque Surge 11x14 solid wood w/ cherry finish; gold/dark blue velour/gold plate; 3” die struck brass DHS seal surrounded by brass ring 80 $0 $0Delivery Order Total

Description of Requirements (DOR)

Requirements/Deliverables:

U.S. Citizenship and Immigration Services (USCIS) Personnel Emergency Notification System (PENS) and Contractor Emergency Notification and Accountability Requirements

1. Government Notification System: USCIS PENS

The USCIS Personnel Emergency Notification System (PENS) is the official USCIS system of record for emergency notifications and personnel accountability and is one of multiple lines of communication utilized during emergency events, both during normal duty hours and non-duty hours. PENS is accessible by USCIS contractor employees issued network accounts with a USCIS email address, as well as other contractor personnel authorized and provisioned PENS accounts by USCIS. PENS is used to push emergency event notifications requiring timely actions and/or responses, such as fires, unexpected weather events, terrorist attacks, cybersecurity breaches, and other emergencies. The current designated application for USCIS’s PENS is the Blackberry AtHoc software application.

(a) Government-owned IT Equipment: The PENS application will be available on government-owned IT equipment, and contract employees will access it using their USCIS government email account.

(b) Contractor/Employee-owned IT Equipment: Use of PENS on company-owned or employee-owned equipment is optional. Contractor employees with USCIS email addresses may use the Blackberry AtHoc app on personal equipment to receive USCIS emergency notifications by logging in with their USCIS email address.

2. Contractor Emergency Notification and Accountability Requirements

(a) Definitions

(1) Emergency: Any incident beyond routine procedures necessitating urgent action to…