2_2_1_70SBUR26Q00000177_20260825.pdf

WOMEN-OWNED SMALL

BUSINESS (WOSB)

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3.AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

REQUEST

FOR QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 29. AWARD OF CONTRACT: REFERENCE

. YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON

BOARD (FOB) DESTINATION

UNLESS BLOCK IS MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4.

FAR 52.212-3 AND 52.212-5 ARE ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED.

8(A)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30.

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

DATED.

OFFER

ADDENDA

ADDENDA

70SBUR26Q00000177

Office of External Affairs 5900 Capital Gateway Drive Camp Springs MD 20588-0009

DHS / USCIS

Office of Contracting 124 Leroy Road Williston VT 05495

DHS / USCIS

Office of Contracting 124 Leroy Road Williston VT 05495

08/28/2026 1700 ET

ICS2600010

Christian Zaman 240.721.6236

70SBUR

70SBUR

Ya Lin Liu

541930

$22.5

08/25/2026

CIS-EXA

The Department of Homeland Security (DHS), U.S.

Citizenship and Immigration Services (USCIS) is issuing a Brand Name Request for Quotation

(RFQ) for a Firm-Fixed-Price (FFP) order for memoQ Licenses and services.

Continued...

STOCK RECORD (S/R)

STANDARD FORM 1449 (REV. 11/2021) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE RECEIVED (MM/DD/YYYY) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32g. EMAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

ACCEPTED,

0001 50 EAProject Manager Subscription

Firm Fixed Price

Period of Performance: 09/30/2026 to

09/29/2027

0002 50 EATranslation Licenses

Firm Fixed Price

Period of Performance: 09/30/2026 to

09/29/2027

0003 10 EAProject Manager Licenses

Firm Fixed Price

Period of Performance: 09/30/2026 to

09/29/2027

0004 1 EATranslation Subscription

Firm Fixed Price

Period of Performance: 09/30/2026 to

09/29/2027

0005 1 EAPremium Support Gold Package

Firm Fixed Price

Period of Performance: 09/30/2026 to

09/29/2027

Continued...

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGES

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C)

NSN 7540-01-152-8067

70SBUR26Q00000177

0006 1 EABusiness Services Implementation Silver

Package

Firm Fixed Price

Period of Performance: 09/30/2026 to

09/29/2027

1001 50 EAProject Manager Subscription

Firm Fixed Price

(Option Line Item)

07/30/2027

Period of Performance: 09/30/2027 to

09/29/2028

1002 50 EATranslation Licenses

Firm Fixed Price

(Option Line Item)

07/30/2027

Period of Performance: 09/30/2027 to

09/29/2028

1003 10 EAProject Manager Licenses

Firm Fixed Price

(Option Line Item)

07/30/2027

Period of Performance: 09/30/2027 to

09/29/2028

1004 1 EATranslation Subscription

Firm Fixed Price

(Option Line Item)

07/30/2027

Period of Performance: 09/30/2027 to

09/29/2028

1005 1 EAPremium Support Gold Package

Firm Fixed Price

(Option Line Item)

07/30/2027

Period of Performance: 09/30/2027 to

09/29/2028

PART II – PURCHASE ORDER CONTRACT CLAUSES

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/far-overhaul/far-part-deviation-guide and https://www.acquisition.gov/hsar.

(End of clause)

FAR 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any Revolutionary FAR Overhaul and Homeland Security Acquisition Regulation (48 CFR 30) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

FAR CLAUSES INCORPORATED BY REFERENCE

FAR 52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS (NOV 2023)

FAR 52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL CONFIDENTIALITY

AGREEMENTS OR STATEMENTS (JAN 2017)

FAR 52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE (OCT 2018)

FAR 52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS

(DEC 2014)

FAR 52.209-10 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS

(NOV 2025) (DEVIATION 25-27) (EFFECTIVE NOVEMBER 28, 2025)

FAR 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (AUG 2025) (DEVIATION 25-21) (EFFECTIVE NOVEMBER 28, 2025)

FAR 52.219-28 POSTAWARD SMALL BUSINESS PROGRAM REREPRESENTATION (OCT 2025)

(DEVIATION 26-03) (EFFECTIVE NOVEMBER 28, 2025)

FAR 52.222-3 CONVICT LABOR. (JUNE 2003)

FAR 52.222-19 CHILD LABOR-COOPERATION WITH AUTHORITIES AND REMEDIES (APR 2026)

(DEVIATION 26-10, REVISION 1) (EFFECTIVE APRIL 3, 2026)

FAR 52.222-35 EQUAL OPPORTUNITY FOR VETERANS (OCT 2025) (DEVIATION 26-10) (EFFECTIVE

NOVEMBER 3, 2025)

FAR 52.222-36 EQUAL OPPORTUNITY FOR WORKERS WITH DISABILITIES (OCT 2025)

(DEVIATION 26-10) (EFFECTIVE NOVEMBER 3, 2025)

FAR 52.222-37 EMPLOYMENT REPORTS ON VETERANS (OCT 2025) (DEVIATION 26-10)

(EFFECTIVE NOVEMBER 3, 2025)

https://www.acquisition.gov/far-overhaul/far-part-deviation-guide

FAR 52.222-50 COMBATING TRAFFICKING IN PERSONS (NOV 2021)

FAR 52.222-54 EMPLOYMENT ELIGIBILITY VERIFICATION (OCT 2025) (DEVIATION 26-10)

(EFFECTIVE NOVEMBER 3, 2025)

FAR 52.226-8 ENCOURAGING CONTRACTOR POLICIES TO BAN TEXT MESSAGING WHILE

DRIVING (MAY 2024)

FAR 52.232-33 PAYMENT BY ELECTRONIC FUNDS TRANSFER-SYSTEM FOR AWARD

MANAGEMENT (OCT 2018)

FAR 52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUN 2013)

FAR 52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS

SUBCONTRACTORS (MAR 2023)

FAR 52.233-1 DISPUTES (AUG 2025) (DEVIATION 25-25) (EFFECTIVE NOVEMBER 3, 2025)

FAR 52.233-3 PROTEST AFTER AWARD (AUG 2025) (DEVIATION 25-25) (EFFECTIVE NOVEMBER 3, 2025)

FAR 52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (AUG 2025) (DEVIATION 25-

25) (EFFECTIVE NOVEMBER 3, 2025)

FAR 52.225-5 TRADE AGREEMENTS (NOV 2023)

FAR CLAUSES IN FULL TEXT

FAR 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 24 months.

FAR 52.222-90 ADDRESSING DEI DISCRIMINATION BY FEDERAL CONTRACTORS(APR 2026)

(DEVIATION 26-10, REVISION 2) (EFFECTIVE APRIL 27, 2026)

(a) Definitions. As used in this clause—

Program participation means membership or participation in, or access or admission to: training, mentoring, or leadership development programs;

educational opportunities; clubs; associations; or similar opportunities that are sponsored or established by the contractor or subcontractor.

Racially discriminatory diversity, equity, and inclusion (DEI) activities means disparate treatment based on race or ethnicity in the recruitment, employment (e.g., hiring, promotions), contracting (e.g., vendor agreements), program participation, or allocation or deployment of an entity's resources.

(b) In connection with the performance of work under this contract, the Contractor agrees as follows:

(1) The Contractor will not engage in any racially discriminatory DEI activities;

(2) The Contractor will furnish all information and reports, including providing access to books, records, and accounts, as required by the Contracting Officer, for purposes of ascertaining compliance with this clause;

(3) In the event of the Contractor's or a subcontractor's noncompliance with this clause, this contract may be canceled, terminated, or suspended in whole or in part, and the Contractor or subcontractor may be declared ineligible for further Government contracts;

(4) The Contractor will report any subcontractor's known or reasonably knowable conduct that may violate this clause to the Contracting Officer and take any appropriate remedial actions directed by the Contracting Officer; and

(5) The Contractor will inform the Contracting Officer if a subcontractor sues the Contractor and the suit puts at issue, in any way, the validity of this clause.

(6) The Contractor recognizes that compliance with the requirements of this clause are material to the Government's payment decisions for purposes of 31 U.S.C. 3729(b)(4).

(c) The Contractor must include the substance of this clause, including this paragraph (c), in subcontracts at any tier, including those for commercial products and commercial services, except those where the place of delivery or performance is outside the United States.

HSAR CLAUSES INCORPORATED IN FULL TEXT

HSAR 3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JUL

2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti- Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually, or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department.

Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting https://www.dhs.gov/dhs-security-and-training-requirements-contractors

Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email.

Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

Alternate I (JUL 2023)

When Federal information systems, which include Contractor information systems operated on behalf of the agency, are used to collect, process, store, or transmit CUI, add the following paragraphs:

(h) Authority to Operate. The Contractor shall not collect, process, store, or transmit CUI within a Federal information system until an ATO has been granted by the Component or Headquarters CIO, or designee. Once the ATO has been granted by the Government, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. Unless otherwise specified in the ATO letter, the ATO is valid for 3 years.

An ATO is granted at the sole discretion of the Government and can be revoked at any time. Contractor receipt of an ATO does not create any contractual right of access or entitlement. The Government's grant of an ATO does not alleviate the Contractor's responsibility to ensure the information system controls are implemented and operating effectively.

(1) Complete the Security Authorization process. The Security Authorization (SA) process shall proceed according to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems (Version 13.3, February 13, 2023), or any successor publication; and the Security Authorization Process Guide, including templates. These policies and templates are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(i) Security Authorization Package. The SA package shall be developed using the government-provided Security Requirements Traceability Matrix and SA templates. The SA package consists of the following:

Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). The Contractor shall submit a signed copy of the SA package, validated by an independent third party, to the COR for review and approval by the Component or Headquarters CIO, or designee, at least 30 days prior to the date of operation of the information system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of modified documents.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the information system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800- 53, Security and Privacy Controls for Information Systems and Organizations, or successor publication, accessible at https://csrc.nist.gov/publications/sp. The Contractor shall address all deficiencies before submitting the SA package to the COR for review.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the Contractor shall renew the ATO every 3 years. The Contractor is required to update its SA package as part of the ATO renewal process for review and verification of security controls. Review and verification of security controls is independent of the system production date and may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place. The updated SA package shall be submitted for review and approval by the Component or Headquarters CIO, or designee, at least 90 days before the ATO expiration date.

The Contractor shall update its SA package by one of the following methods:

(i) Updating the SA package in the DHS Information Assurance Compliance System; or

(ii) Submitting the updated SA package directly to the COR.

(3) Security Review. The Government may elect to conduct periodic reviews to ensure that the security requirements contained in the contract are being implemented and enforced. The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in security review activities. The Contractor shall afford DHS, the Office of the Inspector General, other government organizations, and Contractors working in support of the Government access to the Contractor's facilities, installations, operations, documentation, databases, networks, systems, and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and COR, contact the Component or Headquarters CIO, or designee, to coordinate and participate in review and inspection activity by government organizations external to DHS. Access shall be provided, to the extent necessary as determined by the Government (including providing all requested images), for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

(4) Federal Reporting and Continuous Monitoring Requirements. Contractors operating information systems on behalf of the Government shall comply with Federal reporting and information system continuous monitoring requirements. Reporting requirements are determined by the Government and are defined in the Fiscal Year 2015 DHS Information Security Performance Plan, or successor publication, accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. The plan is updated on an annual basis. Annual, quarterly, and monthly data collection will be coordinated by the Government. The Contractor shall provide the Government with all information to fully satisfy Federal reporting requirements for information systems. The Contractor shall provide the COR with requested information within 3 business days of receipt of the request. Unless otherwise specified in the contract, monthly continuous monitoring data shall be stored at the Contractor's location for a period not less than 1 year from the date the data are created. The Government may elect to perform information system continuous monitoring and IT security scanning of information systems from government tools and infrastructure.

PART III – CONTRACT DOCUMENTS, TERMS AND CONDITIONS, AND ATTACHMENTS

ADDITIONAL INVOICING INSTRUCTIONS:

USCIS’ preferred method for invoice submission is electronically. Invoices shall be submitted in Adobe pdf format with each pdf file containing only one invoice recording all deliveries or batches for the month. The pdf files shall be submitted electronically to USCISInvoice.Consolidation@ice.dhs.gov with each email conforming to a size limit of 500 KB.

If a paper invoice is submitted, mail the invoice to:

USCIS Invoice Consolidation PO Box 1000 Williston, VT 05495

DIRECT PAYMENT INQUIRIES TO ICE FINANCIAL OPERATIONS, (877) 491-6521

ATTACHMENTS:

Attachment 1 – Statement of Work (SOW), 4 pages

Attachment 2 – PENS Clause, 4 pages mailto:USCISInvoice.Consolidation@ice.dhs.gov

STATEMENT OF WORK

Computer-Assisted Translation (CAT) Tools

BACKGROUND

The Language Services Section (LSS) supports the Department of Homeland Security’s (DHS) mission to safeguard the American people. By using their specialized language skills, LSS enables U.S. Government officials to obtain intelligence and evidence for adjudicating immigration benefits, conducting law enforcement investigations, and prosecuting criminal activity. The team translates documents and verifies third-party translations for U.S. Government officials to make informed decisions when adjudicating immigration benefits and investigating immigration fraud or scams.

In addition to work as part of USCIS, LSS has interagency agreements to provide interpreting, translation, and transcription services to U.S. Immigration and Customs Enforcement's Office of the Principal Legal Advisor (OPLA) and Homeland Security Investigations (HSI), as well as offices at DHS Headquarters. LSS’ work for these investigations covers a range of topics including criminal records, arrest warrants, the production and sale of fraudulent or counterfeit documents, drug trafficking, weapons trafficking, human trafficking and smuggling, transnational crimes, acts of torture or genocide, human rights violations, and more.

LSS translations and transcriptions are used as evidence for hearings and prosecutions in Immigration Court and Criminal Court, where Department of Justice guidelines state that all foreign language documents filed with the court must be accompanied by a certified English translation from a competent and qualified translator.

OBJECTIVES

Computer-Assisted Translation (CAT) tools are essential to improving the quality and consistency of translations at LSS. The team is planning to purchase and implement memoQ to modernize and streamline operations. The adoption team has demoed four CAT tools and fully tested two during the proof-of-concept phase.

Given LSS’ need for precision and accuracy, adopting memoQ will provide the translators with the technology necessary to manage the high volume and complexity of projects. CAT tools streamline the translation process by leveraging previous translations, managing large technical texts, and automating tasks such as formatting. The tools also enhance collaboration by allowing translators to share and access common glossaries and translation memories, ensuring greater accuracy across all projects. Implementing these tools will significantly improve the quality of work and position LSS to meet growing demands.

Federal agencies such as DoS, FBI, NWS, DoD, and Census have used CAT tools for years, including memoQ, which has been thoroughly vetted for federal use.

• Statutory/regulatory foundation:

USCIS Director Edlow has identified “Ensuring integrity in the U.S. immigration system through enhanced screening and vetting to deter, detect, and disrupt immigration fraud and threats to our national security and public safety” as a top priority for the agency. The work of LSS directly supports this agency priority, which also aligns with Executive Order 14161, Protecting the United States from Foreign Terrorist and Other National Security and Public Safety Threats.

LSS has also seen an increased demand for translation services from OPLA assistant chief counsels funded by the One Beautiful Bill (OBBB) (H.R. 1) signed into law in July 2025, which provided more than $75 billion in supplemental funding to ICE to expand enforcement and deportation operations. The acquisition of memoQ will enable the unit to better support the USCIS and DHS mission.

SCOPE

The contractor shall provide memoQ licenses, a CAT tool software with the following specifications:

- Shall be compatible with Windows Operating System and network structure, where the CAT tool’s Translation Memory will be accessible simultaneously from 30-100 different computers inside USCIS Local Area Networks

- Shall meet USCIS and government information assurance requirements and guidelines

- Shall include a Translation Memory (TM) database deployed on premises that stores all new translations and propose similar translation, if they exist inside the TM

- Shall count with a built-in automatic terminology and quality assurance system

- Shall include a terminology management component as an extension of the TM database

- Shall be able to work with different file formats

- Shall allow import and export processes from external application; shall also allow merging and splitting TMs and projects

- Shall be language independent, able to work from/to any language

- Shall have the admin features be accessible through the client application instead of the server-side application

- Shall be suitable and compatible for Amazon Web Service (AWS) architecture deployment

- Software maintenance, implementation, training, and updates

TASKS

The contractor must provide licenses for yearly subscription of the software.

DELIVERY

• Deliverables: Licenses and files to download or update the software.

• Delivery time: Within a month of awarding the contract.

• Delivery location: The server and client-side software will be installed on premise server and on government-furnished laptops via the software center.

GOVERNMENT-FURNISHED PROPERTY, MATERIAL, EQUIPMENT, OR

INFORMATION (GFP, GFM, GFE, GFI)

The contractor will not have access to any government-furnished property or equipment.

SECURITY

The contract performance includes the following security conditions:

• Restricted to LSS;

• Only approved for the on-prem version; the cloud version is not approved;

• Approval includes add-on features/components such as Qterm;

• AI features, if any, must be disabled;

• Integration with ICAM Single Sign-on (SSO) is required;

• Restricted users are responsible for keeping the software updated/patched as required during the POP period; and,

• Software Licensing is responsible for confirming licensing model/agreement requirements and tracking of the software if/as required.

PLACE OF PERFORMANCE

The principal place of work will be at the contractor’s facility.

PERIOD OF PERFORMANCE

The period of performance for this contract is base year one (1) 12-month, and one (1) 12-month option period. The period of performance will be determined after award.

508 COMPLIANCE

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L.

105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities.

Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by nondisabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt.

Section 508 Compliance Requirements

36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of market research that identifies a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2. All tasks for testing of functional and/or technical requirements must include specific testing for Section 508 compliance, and must use DHS Office of Accessible Systems and Technology approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov.

U.S. Citizenship and Immigration Services (USCIS) Personnel Emergency Notification System (PENS) and Contractor Emergency Notification and Accountability Requirements

1. Government Notification System: USCIS PENS

The USCIS Personnel Emergency Notification System (PENS) is the official USCIS system of record for emergency notifications and personnel accountability and is one of multiple lines of communication utilized during emergency events, both during normal duty hours and non-duty hours. PENS is accessible by USCIS contractor employees issued network accounts with a USCIS email address, as well as other contractor personnel authorized and provisioned PENS accounts by USCIS. PENS is used to push emergency event notifications requiring timely actions and/or responses, such as fires, unexpected weather events, terrorist attacks, cybersecurity breaches, and other emergencies. The current designated application for USCIS’s PENS is the Blackberry AtHoc software application.

(a) Government-owned IT Equipment: The PENS application will be available on government-owned IT equipment, and contract employees will access it using their USCIS government email account.

(b) Contractor/Employee-owned IT Equipment: Use of PENS on company-owned or employee-owned equipment is optional. Contractor employees with USCIS email addresses may use the Blackberry AtHoc app on personal equipment to receive USCIS emergency notifications by logging in with their USCIS email address.

2. Contractor Emergency Notification and Accountability Requirements

(a) Definitions

(1) Emergency: Any incident beyond routine procedures necessitating urgent action to protect people, property, mission, and infrastructure.

(2) Contractor Employee: Individuals employed by the contractor or its subcontractor(s) performing work or providing services under this contract.

(3) Work Site Code: A unique code provided by USCIS that PENS uses to identify the workplace affiliation of a federal employee or contractor.

(b) Contractor Points of Contact (POC)

(1) Contractors must designate a POC and alternate to receive PENS notifications for all contractor employees associated with the Work Site Codes (WSC) where they perform work, including remote personnel physically traveling to a government facility to receive government-furnished equipment (GFE), IT support, or attend meetings. Contractor POCs serve as the primary coordination point for relaying PENS notifications to contractor employees who don’t have USCIS email addresses, and for gathering accountability information during emergency events.

(i) Contractor POCs with a USCIS email address serve as first-line Accountability Officers after completing required training. Training can be accessed here.

(ii) Contractor POCs without a USCIS email address receive system access from the PENS team as required.

(2) The contractor must provide the Contracting Officer’s Representative (COR) with the identification of all POCs, POC contact information, a list of contractor employees assigned to each POC, and identification of all government facilities where the contractor has personnel assigned (including sites where remote personnel receive USCIS IT support or GFE). Contractors must submit this information using the spreadsheet template found here. This information must be updated in the system and submitted to the COR within 14 calendar days of any change, including employees who have been removed from the contract.

(3) POCs must be subscribed to all applicable WSCs covering their workforce.

(4) A PENS notification account for a primary and alternate contractor POC will be established by USCIS, which may include POCs without USCIS email addresses. POCs will be responsible for collecting accountability information and uploading status into PENS on behalf of contractor employees unable to update PENS.

(c) PENS Maintenance

(1) PENS Profile: Contractors must ensure all contractor employees with USCIS email addresses maintain accurate and current profile information in PENS, including WSC information corresponding to their assigned facility or support location using the Validate User Profile and Subscription knowledge base. Updates must be reflected in PENS profiles within 14 calendar days of any change.

(2) myAccess/ICAM Emergency Contact: If contractor employees choose to update the After Hours and Emergency Center (AHEC) contact information in in the myAccess portal (ICAM system), contractors must ensure contractor employees maintain accurate information, updating within 14 calendar days of any change.

(d) Notification and Accountability Requirements

(1) Notification: In the event of an emergency impacting contract performance or personnel safety/security, the contractor must immediately notify the contracting officer…