2.2.1-70CMSD23R00000008 Attachment 2-PWS 7-18-23.pdf

70CMSD23R00000008-Attachment 2-Performance Work Statement (PWS)

Performance Work Statement (PWS) HSI Financial Crimes Unit (FCU)

Financial Forensics Support Services July 18, 2023

1.0 GENERAL

This is a non-personal services requirement as defined in Federal Acquisition Regulation (FAR) 37.101. This requirement is to provide specialized support to high-impact financial investigations targeting Transnational Criminal Organizations (TCOs), which is a priority area of the Department of Homeland Security (DHS), U.S. Immigration and Customs Enforcement (ICE), and Homeland Security Investigations’ (HSI) Financial Crimes Unit (FCU). It is understood and agreed that the Contractor and/or the Contractor’s employees shall perform the services specified herein as independent contractors, not as employees of the Government.

The Government will not exercise any supervision or control over the Contractor employees performing the services described herein. Such contractor employees shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Contractor shall, pursuant to the Government’s right and obligation to inspect, accept or reject the work, comply with such general direction of the Contracting Officer (CO) or duly authorized representative of the CO as necessary to ensure accomplishment of all requirements under this

PWS.

2.0 DESCRIPTION OF SERVICES

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items for non-personal services necessary to perform Financial Forensics Support Services as defined in this Performance Work Statement (PWS), except for those items specified as Government furnished property and services. The Contractor shall perform to the standards in this PWS.

3.0 SCOPE

The Contractor shall support HSI FCU through activities centered on HSI’s strategic priorities with the intent to enhance its financial investigative results. The Contractor shall provide services, subject matter expertise, training, data, and consulting advisory work towards this endeavor.

This will enhance HSI FCU’s ability to support complex financial investigations through enhanced investigative and analytical support, training and development, strategic communications and updating the use of information technologies in the management of HSI programs.

Contractor shall provide full-time and temporary duty (TDY) support to designated Continental U.S. (CONUS) and Outside Continental U.S. (OCONUS) Government sites which support HSI. The Contractor shall have the expertise, capability, and resources to effectively complete all the tasks described herein.

4.0 TASKS

Contractor shall assist HSI in conducting analysis of complex financial and business records to support federal investigations and prosecutions. The Contractor shall provide strategic support that enables HSI to manage the FCU programs more effectively and efficiently. The Contractor shall possess a strong working knowledge of task forces and financial investigative groups and have experience in and exposure to investigations involving civil and criminal forfeitures, domestic and transnational organized crime, white collar crime, money laundering, drug trafficking offenses, illicit trade finance, and other related areas of activity. The Contractor shall also possess a strong understanding and working knowledge of general and complex financial crimes including, but not limited to: domestic and international money laundering methods, Black Market Peso Exchange (BMPE), Third-Party Money Laundering (3PML), Trade-Based Money Laundering (TBML), cryptocurrency, funnel accounts, shell companies, Foreign Corrupt Practices Act (FCPA) violations, government program frauds including, but not limited to: elder/romance/confidence frauds/other financial frauds, and financial crimes involving the utilization of cryptocurrency and digital payment platforms.

Additionally, due to the global scope of financial investigations, the Contractor must acquire information from their international sources, resources, commercial databases, and open-source research that is necessary to advance required investigations. Contractors are required to possess a minimum of two different blockchain analysis licenses to support the requirements within this PWS.

Contractor shall provide for the specific task areas described below:

4.1 FORENSIC ACCOUNTING INVESTIGATIVE SUPPORT

This task provides for forensic accounting investigations of complex financial and business records to support federal investigations and prosecutions.

Use financial forensic skill sets to investigate and analyze all components of the financial infrastructure of Money Laundering Organizations (MLOs), Drug Trafficking Organizations (DTOs), and TCOs syndicates, their methods of criminal money movements, and the professional money laundering infrastructure facilitating these movements.

Participate in strategic planning sessions with financial investigative groups and task forces.

Assist HSI with conducting interviews during the course of the financial investigation.

Conduct analysis during the course of investigation support on financial transactions in order to accurately identify all parties involved in the criminal activity.

Conduct analysis and audit complex financial and business records to support Federal investigations and prosecutions.

Obtain raw criminal intelligence from various database resources and correlate the data, culminating in a full analysis of the information.

Input all researched and analyzed data into various professional products (i.e., Excel charts, reports, PowerPoint presentations, infographics, link charts) for statistical analysis data, and intelligence summaries for law enforcement use.

May serve as a factual witness during Federal prosecutions.

4.2 FINANCIAL INVESTIGATIVE SUPPORT

This task provides for financial investigations of complex financial and business records to support federal investigations and prosecutions.

Participate in strategic planning sessions with financial investigative groups and task forces.

Conduct analysis during the course of investigation support on financial transactions in order to accurately identify all parties involved in the criminal activity.

Perform reviews on internet open resources for additional intelligence from the public sector and various reputable public intelligence sites, to include, but not limited to, the following:

o Collect, process, and analyze case-related, commercial, and open source data;

o Automate data analysis where possible to process large volumes of investigative data;

o Collaborate with analysts and partner law enforcement agencies on shared datasets, systems, services and tools.

Obtain raw criminal intelligence from various database resources and correlate the data, culminating in a full analysis of the information.

Use specialized knowledge of methods, techniques, and subject matter analysis applied to investigations, to provide, but not limited to, the following:

o Research, extraction, and correlation of large amounts of raw data from various criminal investigative tools and databases resulting in reports and data visualizations;

o Demonstrate specialized knowledge and cutting-edge technological tools to develop malleable visualizations for big data involved in large-scale financial investigations;

and o Possess specialized experience and utilize advanced technological tools to perform deep, global background intelligence research of persons and entities that are subject of criminal investigation.

Use subject matter expertise and financial investigative/analytical skills to target illicit trade finance activity in support of identifying and eliminating money laundering vulnerabilities in the U.S. financial system, to include, but not limited to, the following:

o Expertise in international trade finance risk management and compliance experience and training in lending, issuing letters of credit, documentary collection, factoring, export credit and insurance;

o Expertise in U.S. import and export laws, U.S. Customs regulations and compliance, international and domestic trade law, shipping operations, U.S.

sanction policies, U.S.A. PATRIOT Act, Bank Secrecy Act, and U.S. tariff regulations;

o Expertise in domestic and global scope of illicit trade, the complex and/or sophisticated means and methods by which it is facilitated such as Trade Based Money Laundering/Black Market Peso Exchange, and how it is evolving.

May serve as a factual witness during federal prosecutions.

5.0 OPTIONAL TASKS

Only as requested by the National Program Manager assigned to the contract, the Contractor shall provide support for optional tasks described below, as needed. Contracting Officer will execute optional tasks and fund them if/when required via task order. The Cyber Forensic Analysts and Operations Research Analysts labor categories shall be responsible for performing the optional tasks listed below.

5.1 GENERAL CONSULTING

Related Consulting Services

Perform related financial consulting services to the Financial Crimes Unit in the areas of Training, Management Consulting, Human Capital Consulting, and Investigative Technology Consulting services.

5.1.1 Training

Provide HSI Special Agents with training on trends identified during the performance of this contract to educate HSI on new and emerging nefarious practices concerning financial crimes. Also provide and/or customize off-the-shelf training packages, assist HSI with creating training packages, programs, webinars, and conference presentations/agendas. Training topics may include, but are not limited to: 3PML investigative techniques, money laundering techniques and investigative best practices, cybercrime, data science, and investigative tools utilization. The training may also include providing training to the Program Managers (PM) on the proper usage of the respective SharePoint site(s) or software system(s) used by FCU to collect or receive 3PML case submissions and/or Requests for Assistance (RFA) from the field offices.

This would serve as a “Train the Trainer” service thereby allowing the PMs in turn to train the field offices on the proper submission and utilization procedures of the SharePoint site(s) or software systems(s). Training may be conducted in-person or virtually at locations within the Washington DC area or at other locations within the US or internationally. The contractor shall be able to provide presentations as needed for up to 200 hours per year.

5.1.2 Management Consulting - Human Capital

Provide consulting to HSI in the area of human capital to include, but not limited to:

organizational development to improve the practices, systems and techniques that affect the FCU’s performance and goals. Business process improvement to maximize efficiency in analyzing case-related, commercial, and open-source data; change management, and facilitated employee engagement. Conduct organizational studies and evaluations, design systems and procedures and conduct work simplification and measurement studies.

Prepare operations and procedures manuals to assist HSI management in operating more efficiently and effectively in the area of Financial Crimes.

5.1.3 Investigative Technology Consulting

Provide consulting in the area of investigative technology to make recommendations for the latest, cutting-edge technology and computer programs to assist the FCU in enhancing its financial investigative capabilities leveraging knowledge of emerging technologies currently used by other Federal Law Enforcement agencies and/or private industries yielding a high rate of federal investigations and prosecutions. Contractor shall engage with government employees and contractors providing services and support, conduct research and provide results.

With the direction of HSI FCU, the contractor shall create or improve websites or software utilized by FCU to manage prioritization of case support and management of programs.

5.1.4 Data Analytics

Provide assistance to personnel that require ingestion, processing, and analysis of varied datasets acquired during investigations. Leverage either existing Government toolsets or provide Contractor tools.

Collaborate and consult with Government data scientists, system engineers, and software developers to extract insight from Contractor proprietary data that result in investigative and law enforcement outcomes.

Deliver accurate, complete, and timely data analysis to users across the organization.

Collect feedback from stakeholders to inform the design and implementation of tools, applications, and solutions that provide the capability to export data to Excel, Word, SharePoint or other applications and/or HSI internal systems when directed by the Government.

Observe tasks and processes conducted by HSI personnel, at their field offices, and identify opportunities for process automation or tool development.

Field test the efficacy of HSI utilized, Commercial Off the Shelf (COTS), and open source solutions using data and investigative analytics platforms.

5.1.5 Investigative Data Analysis Capability Development

Review HSI’s SharePoint to identify needed updates. Create SharePoint updates according to needs of FCU. Contractor will be responsible for maintaining updates throughout the length of the contract on an as needed basis.

Consult and assist with the development of representational state transfer (REST) based microservices built on the Java Spring Boot framework.

Consult and assist with the development of front-end components of web applications in Government required languages, such as, but not limited to, React.js.

Consult and assist with the development of middleware components of web applications using Government required frameworks, such as, but not limited to Node.js and Apollo2.

Consult and assist with the development of mobile device applications using

ReactNative and iOS Swift.

5.1.6 Strategic Communications Support

Develop communications to message key program releases, enhancements, and technical updates that resonate with HSI and its partners; and assist with translating the technical updates and requirements so the end-users see the benefits and understand how these technical tools directly impact their workflows.

Facilitate internal communications with all internal and external stakeholders.

Support executive communications and reporting to communicate key program milestones and connections to HSI via FCU.

Communicate information about HSI and its Federal Law Enforcement systems through graphic design support.

Develop documentation of program historical knowledge to support continuity when onboarding new personnel; documentation shall include, but not be exclusive to, the development of briefings, talking points, marketing materials and slick sheets. Contractor shall compile a repository of financial crime and money laundering information/materials that can be used and are readily accessible for FCU personnel for various training and outreach efforts.

5.2 CYBER RECONNAISSANCE

This task provides for financial cyber investigations of complex financial and business records to include advanced analytical, technical, and operational support.

Contractor shall provide assistance with combatting cyber fraud activities, including the use of internet services or software with internet access to defraud victims or to otherwise take advantage of them.

Contractor shall have knowledge and expertise with high-profile fraud methods including the following:

Business E-Mail Compromise (BEC) A sophisticated scam targeting businesses working with foreign suppliers and companies that regularly perform wire transfer payments. The scam is carried out by compromising legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.

Data Breach A leak or spill of data which is released from a secure location to an untrusted environment. Data breaches can occur at the personal and corporate levels and involve sensitive, protected, or confidential information that is copied, transmitted, viewed, stolen, or used by an individual unauthorized to do so.

Denial of Service An interruption of an authorized user's access to any system or network, typically one caused with malicious intent.

Email Account Compromise (EAC) Similar to BEC, this scam targets the general public and professionals associated with, but not limited to, financial and lending institutions, real estate companies, and law firms. Perpetrators of EAC use compromised e-mails to request payments to fraudulent locations.

Malware/Scareware Malicious software that is intended to damage or disable computers and computer systems. Sometimes scare tactics are used by the perpetrators to solicit funds from victims.

Phishing/Spoofing Both terms deal with forged or faked electronic documents. Spoofing generally refers to the dissemination of e-mail which is forged to appear as though it was sent by someone other than the actual source. Phishing, also referred to as vishing, smishing, or pharming, is often used in conjunction with a spoofed e-mail. It is the act of sending an e-mail falsely claiming to be an established legitimate business in an attempt to deceive the unsuspecting recipient into divulging personal, sensitive information such as passwords, credit card numbers, and bank account information after directing the user to visit a specified website. The website, however, is not genuine and was set up only as an attempt to steal the user's information.

Ransomware A form of malware targeting both human and technical weaknesses in organizations and individual networks in an effort to deny the availability of critical data and/or systems. Ransomware is frequently delivered through spear phishing emails to end users, resulting in the rapid encryption of sensitive files on a corporate network. When the victim organization determines they are no longer able to access their data, the cyber perpetrator demands the payment of a ransom, typically in virtual currency such as Bitcoin, at which time the actor will purportedly provide an avenue to the victim to regain access to their data.

5.2.1 Cyber Crimes Investigations Support

Support investigations that involve the Internet and Internet based technologies/methodologies that enable criminals to engage in illegal activity with anonymity and cross international borders without a defined physical presence.

Provide analytical and product evaluative services to analyze cyber evidence. In addition, the Contractor shall provide case support to identify and evaluate effective technological methods and services to investigate cybercrimes.

Demonstrate specialized knowledge of cyber investigations, cryptocurrency tracing and blockchain analysis to support federal investigations and prosecutions.

5.2.2 Cyber Forensics

Support HSI in supporting cyber forensics, to include the seizure of digital evidence, chain of custody, and analysis of electronic evidence from computers, mobile devices, and other digital storage media.

Support HSI with the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law. The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computing device and who was responsible for it.

5.2.3 Cryptocurrency/Blockchain Analytics and Deep/Dark Web Research

Provide assistance with Cryptocurrency analysis, Blockchain analytics, Open Internet, including social media, Deep and Dark Web intelligence gathering and analysis, data analytics, and electronic evidence analysis related to cybercrime investigations.

Provide assistance with identifying new systems, services, techniques, and cutting edge information technology services aimed at enhancing the investigative capabilities of the agency’s cyber-financial investigations.

Provide HSI with analytical case support, including Internet monitoring, evidence analysis, and data collection and exploitation. Contractors shall provide expertise in cybercrime investigative and analytical case support, with specific expertise in attribution, cyber data analytics, and virtual currency tracing.

Case support shall consist of working directly on cases with agents and partner law enforcement agencies to provide analytical input by leveraging CI-provided data (continuous integration-provided data), systems, services, and tools.

Have familiarity with querying and managing unstructured datasets and relational databases.

Activities required to complete the cyber investigative support function will include, but not be limited to:

o Cyber targeting, Cyber Recon, Cyber Fraud and analysis;

o Database forensics, analysis, and modeling;

o Virtual currency analysis and tracing of dominant and alternate crypto currencies, defi tokens and/or privacy coins.

o Data exploitation; and o Deep and Dark Web research and monitoring.

May also require contractor to serve as a factual witness during federal prosecutions.

6.0 SURGE LABOR

Based on the nature of services, there may be a need for surge support from the contractor during periods of increased workload, as requested by the COR, and contractually executed by the contracting officer, to support the requirements under PWS Sections 4.0. The Contractor shall be prepared to provide unanticipated surge support when needed.

7.0 LABOR CATEGORIES (LCATs)

Regular Support-Eight (8) Contractor Employees:

One (1) Junior Intelligence Analyst One (1) Journeyman Intelligence Analyst (KEY PERSONNEL) Three (3) Junior Forensic Accountants Two (2) Journeyman Forensic Accountants One (1) Senior Forensic Accountant (KEY PERSONNEL)

Surge Support-Eight (8) Contractor Employees:

One (1) Junior Intelligence Analyst One (1) Journeyman Intelligence Analyst Three (3) Junior Forensic Accountants Two (2) Journeyman Forensic Accountants One (1) Senior Forensic Accountant

Optional Task Support-Twenty (20) contractor employees:

Five (5) Journeyman Cyber Forensic Analysts Five (5) Junior Cyber Forensic Analysts Four (4) Journeyman Operations Research Analysts Four (4) Junior Operations Research Analysts

8.0 DELIVERABLES

All deliverables will be reviewed to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the PWS requirements. The Contractor shall ensure the accuracy and completeness of all deliverables. The Government will consider errors, misleading statements, incomplete, irrelevant information, excessive rhetoric, or repetition as deficiencies and the Contractor shall make corrections at no additional cost to the Government. Report deliverables must be submitted electronically to the COR with a copy to the CO.

8.1 DELIVERABLES

PWS

Reference #

Deliverables Due Date

10.0 Transition Plans Transition Plan

(Phase In) due NLT five calendar days after award.

Transition Plan (Phase Out) due NLT 60 calendar days prior to expiration of IDIQ contract.

4.1 Summary Report of Findings and Analysis for Forensic

Accounting Investigation

Quarterly, or as directed by COR

4.2 Summary Report of Findings and Analysis for Financials

Investigations

Quarterly, or as directed by COR

4.3 Summary Report of Findings and Analysis for Cyber

Reconnaissance

Quarterly, or as directed by COR

4.4 Summary Report of Findings and Analysis for

Investigative Data Analytic Consulting

Quarterly, or as directed by COR

5.0 Summary Report for any Optional tasks Quarterly, or as

directed by COR

6.0 Summary Report for Surge Labor Quarterly, or as

directed by COR

8.2 Status Report No later than the

15th of each month

19.0 Quality Control Plan (QCP) Submit final plan

within 30 days after date of award

8.2 STATUS REPORTS

The Contractor shall provide a Status Report to the COR with a copy to the CO. The report shall be submitted via email and is due by the 15th day of each month. The first Status Report is due by the 15th day of the second month of performance. This report shall contain the following information:

8.2.1 Contract number;

8.2.2 Contractor name;

8.2.3 Period covered by report;

8.2.4 Summary description of activities and accomplishments during the reported period;

8.2.5 Summary description of any outstanding action items HSI has responsibility for, affecting performance;

8.2.6 Description of problems and issues encountered during the reported period;

and

8.2.7 Status of open problems or issues identified in previous monthly report(s).

8.3 INVOICING

Invoice Submission: Invoices shall be submitted in a pdf format in accordance with the contract terms and conditions listed on the awarded Standard Form (SF) 1449 which details all invoicing instructions.

9.0 TRAVEL

The Government anticipates travel will be required under this requirement. Contractor personnel may travel CONUS (Continental U.S.) and OCONUS (Outside Continental U.S.)

upon notification and pre-authorization from the COR and shall consist of the following:

9.1 For all required travel, travel shall be reimbursed in accordance with the applicable

Federal Travel Regulation (FTR) and FAR 31.205-46 (a)(2). The COR will provide the Contractor specific travel information ten (10) calendar days prior to a scheduled trip. The COR may change a scheduled trip by providing written notice two days prior to travel (including E-Mail) provided the Contractor has incurred no costs.

Location and number of trips are unknown at this time. All travel estimates must be reviewed and approved by the COR in advance of travel taking place.

9.1.1 The Government will not reimburse the Contractor for any personal travel or travel unrelated to their assignment during the course of the authorized travel.

(Applies to CONUS and OCONUS travel.)

9.1.2 Office/workspace used during travel will be provided by the Government.

9.1.3 There may be times when the Contractor transports Government Furnished

Property (GFP). The Government assumes the risk of GFP damaged or lost in transport during the contract unless the Government has determined reckless or negligent handling of materials.

9.1.4 There may be times that the contractor is required to travel in Government

Owned Vehicles (GOV). The Contractors shall be permitted to travel in a GOV as a passenger, but not to operate them.

9.1.5 Travel shall be charged using a Time and Materials (T&M) Contract Line-

Item Number (CLIN) under the awarded contract. Total travel costs for all of the Contractor’s personnel shall not exceed $100,000.00 for the five-year ordering period.

9.1.6 The Contractor shall submit a completed travel authorization request to the

COR for approval no later than five (5) days prior to any departure. The Government is not responsible for travel costs not approved by the COR in advance of travel.

9.2 Contractor and its employees will be responsible for all local travel unless otherwise approved by the COR IAW the current FTR.

10.0 TRANSITION PHASE-IN/PHASE-OUT

10.1 Transition Plan

The Contractor shall provide a detailed transition plan with associated timelines for tasks that addresses both phase-in and phase-out for the contract. This plan shall be submitted in accordance with the delivery schedule in Section 8.0 and updated as appropriate throughout the period of performance.

10.2 Phase-In Activities

The Contractor shall include in its transition plan and perform, at a minimum, the following activities during the phase-in period of 30 days:

10.2.1 Submit requests for security clearance documentation and other items requiring responses from the Government.

10.3 Phase-Out Activities

The Contractor shall include in its transition plan and perform, at a minimum, the following activities during the phase-out period of 30 days:

10.3.1 Ensure all services and performance objectives required by the PWS and contract are met throughout the phase-out period.

10.3.2 Establish procedures with the Government to ensure transition of provided services without a degradation of service.

10.3.3 Provide copies of all instructions, records, databases, contract performance metric data, Government points of contact, and all other procedures developed by the Contractor in the performance of this contract to the Government.

10.3.4 Provide a detailed status report on all open financial investigations that are currently supported by the Contractor. Outline all activities that the Contractor has performed to date and provide recommended next steps to ensure continuity of the investigation.

11.0 PERIOD OF PERFORMANCE

This Indefinite Delivery, Indefinite Quantity (IDIQ) Contract will contain a five-year ordering period, with no option periods. Each task order issued under this IDIQ contract will have its own period of performance not exceeding 12-months. FAR 52.217-8 Option to Extend Services allows the Government to extend the ordering period by up to six months beyond the expiration date of the IDIQ, if determined in the best interest of the Government.

12.0 CONTRACT TYPE

Labor hour (LH) IDIQ from which task orders can be placed.

13.0 GOVERNMENT FURNISHED PROPERTY

13.1 On-site work: The Government will provide the Contractor with office space, computer, printer, facsimile service, reproduction capability, internet access and administrative support for the project as required, while working on-site at all ICE/HSI locations. Telephone service for official use and local calls only will be provided to the Contractor; all other calls shall be made at the Contractor’s expense. Government furnished databases include, but are not limited to: BankScan, ScanWriter, FinCEN Portal, and ICM (HSI-owned system used by investigators for case management). The Contractor shall not use Government furnished property or equipment to work on projects other than those directed by this performance work statement. Government furnished property/equipment provided to the Contractor shall be returned to the Government in good working order.

13.2 Teleworking: Government-owned equipment, including government-owned computer equipment, will be issued by the organization, and used for the purposes of performing work under this contract.. The contractor shall protect Government-owned equipment in accordance with established procedures and understands that he or she is accountable for any Government-owned equipment that may be assigned. If Government-owned equipment is unsecured and consequently damaged by non-employees (for example, dependents of the contractor), the contractor may be held liable for the repair or replacement of the equipment, software, etc., to the same extent to which he or she is presently held when loaned equipment is damaged due to employee negligence.

14.0 PLACE OF PERFORMANCE

The Contractor shall provide personnel to work at the following locations:

Primary place of performance: 500 12th Street SW, Washington, DC 20536

Other ICE/HSI locations in the Washington Capital Region

Contractor facilities. The specific location(s) where the Contractor provides Financial

Forensics Support will be coordinated by FCU in furtherance of the FIT Program.

Telework is authorized, however, must be approved by the Government CORs. (The Government shall not be responsible for operating costs, home maintenance, or any other incidental costs (e.g., utilities, insurance, etc.) whatsoever, associated with the use of the contractor’s residence).

Additional or updated guidance will be provided to the contractor and its employees on an as needed basis. Normal duty hours will range from 8 a.m. to 5 p.m., Monday through Friday, excluding Government holidays, eight hours each day. Modification to duty hours may be required to accommodate Government requirements. Contractor employees shall not work more than 40 hours per week without COR approval. There is no overtime

CLIN on this contract; therefore, any hours worked under this labor hour contract, to include any hours in excess of 40 hours per week will be invoiced and paid at the regular labor hour rate for each respective labor category. The contractor can only charge the Government for “Productive Direct Labor Hours”.

Productive Direct Labor Hours are defined as those hours expended by the contractor performing work under this PWS. This does not include sick leave, vacation, Government or contractor holidays, jury duty, military leave, or any other kind of administrative leave.

15.0 HOURS OF OPERATION

The Contractor must be available eight hours per day, five days per week, during core business hours of 8 a.m. to 5 p.m., Monday through Friday in the respective the time zone of the place of performance required/approved in Section 14.0. Services are not expected to normally occur on federal holidays, or weekends unless requested and approved by all parties (COR and Contractor). The following is a list of federal holidays:

New Year’s Day January 1 Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth June 19 Independence Day July 4 Labor Day September 1 Columbus Day Second Monday in October Veteran’s Day November 11 Thanksgiving Day Fourth Thursday in November Christmas Day December 25

The Contractor shall also follow any other holiday as declared by the President.

16.0 PERSONNEL

The Journeyman Intelligence Analyst, and Senior Forensic Accountant personnel on this contract are considered Key Personnel and are subject to the Key Personnel clause. The FCU Program Manager will provide technical direction to all contractor personnel in the accomplishment of the task efforts. Labor categories for this effort are listed in Section 7.0 of this document. The minimum requirements for each position are as follows:

16.1 LABOR CATEGORIES AND MINIMUM EDUCATION AND

EXPERIENCE REQUIREMENTS

16.1.1 Intelligence Analyst, Junior Level –must have at least one year of specialized experience and will be required to:

Possess a bachelor’s degree in accounting, finance, economics or a related field and have prior experience providing financial analysis and investigative support to law enforcement agencies.

Possess general knowledge of HSI organizational structures, functions, sources and types of records maintained;

Demonstrate a knowledge of task forces and financial investigative groups that target money laundering and other financial criminal activities;

Demonstrate an understanding of criminal activity, such as general and complex financial crimes, civil and criminal forfeitures, domestic and transnational organized crime, white collar crime, money laundering, drug trafficking offenses, illicit trade finance, and other related areas of activity;

Demonstrate specialized knowledge of methods, techniques and subject matter analysis applied to federal investigations, plus skills in researching, collecting, and analyzing large amounts of raw data from various criminal investigative tools and other client-owned databases; and

Apply specialized knowledge of methods, techniques, and subject matter analysis to financial and investigative data. Possess skills in researching, extracting, and correlating large amounts of raw data from various sources resulting in reports and data visualizations.

16.1.2 Intelligence Analyst, Journeyman Level – must have more than three years of specialized experience and will be required to:

Possess a bachelor’s degree in accounting, finance, economics or a related and have prior experience providing financial analysis and investigative support to law enforcement agencies.

Demonstrate a strong knowledge of task forces and financial investigative groups that target money laundering and other financial criminal activities;

Demonstrate a deep understanding of criminal activity, such as general and complex financial crimes, civil and criminal forfeitures, domestic and transnational organized crime, white collar crime, money laundering, drug trafficking offenses, illicit trade finance, and other related areas of activity;

16.1.3 Forensic Accountant, Junior Level – must have at least one year of specialized experience and will be required to:

Possess a bachelor’s degree in accounting, finance, economics, or a related course of study.

Demonstrate knowledge of procedures and techniques as generally prescribed under American Institute of Certified Public Accountants (AICPA) disciplines;

Solve problems independently by following accounting procedures and have experience in evaluating controls associated with complex business processes;

Experience conducting analysis of financial and business records to support federal investigations and prosecutions by using criminal investigative tools and other client-owned databases;

Demonstrate knowledge to the enforcement of Title 18, Title 31 and other applicable statutes of the Federal Criminal Code, and the seizure and forfeiture of illegally derived property; and

Apply to conduct research and analysis using open-source information, national and international databases, and corporate record filings to correlate and summarize data into a finished professional product.

16.1.4 Forensic Accountant, Journeyman Level – must have 3-10 years of specialized experience in forensic accounting and a BA/BS or MA/MS degree and will be required to:

of study.

Demonstrate strong knowledge of procedures and techniques as generally prescribed under American Institute of Certified Public Accountants (AICPA) disciplines;

Solve problems independently by following accounting procedures and have experience in evaluating controls associated with complex business processes;

Experience conducting analysis of financial and business records to support federal investigations and prosecutions by using criminal investigative tools and other client-owned databases;

Demonstrate applied knowledge to the enforcement of Title 18, Title 31 and other illegally derived property; and

Apply to conduct research and analysis using open source information, national and international databases, and corporate record filings to correlate and

16.1.5 Forensic Accountant, Senior Level – must have more than 10 years of specialized experience in forensic accounting and a MA/MS degree and will be required to:

of study;

Demonstrate an in-depth knowledge of procedures and techniques as generally prescribed under American Institute of Certified Public Accountants (AICPA) disciplines;

Solve complex problems independently by following accounting procedures and have experience in evaluating controls associated with complex business processes;

Knowledge of current and anticipated banking anti-money laundering regulations and practices;

Experience conducting analysis of complex financial and business records to support federal investigations and prosecutions by using criminal investigative tools and other client-owned databases;

Demonstrate applied knowledge to the enforcement of Title 18, Title 31 and other illegally derived property;

Ability to conduct extensive research and analysis using open-source information, national and international databases, and corporate record filings to correlate and

NOTE: Forensic Accountants may be required to serve as a Factual Witnesses.

16.1.6 Cyber Forensic Analyst, Junior Level – must have one year of specialized experience in supporting cyber-financial investigations and will be required to:

Possess a bachelor’s degree in computer science, cyber-security or a related discipline and have prior experience providing cyber-financial analysis and investigative support to law enforcement agencies;

Demonstrate knowledge of task forces and financial investigative groups that target money laundering and other financial criminal activities;

Demonstrate understanding of criminal activity, such as general and complex financial crimes, civil and criminal forfeitures, domestic and transnational organized crime, white collar crime, money laundering, drug trafficking offenses, illicit trade finance, cyber-enabled financial crimes as mentioned in section 5.2, and other related areas of activity;

Demonstrate understanding of Cryptocurrency analysis, Blockchain analytics, Open Internet, including social media, Deep and Dark Web intelligence gathering and analysis, data analytics, and electronic evidence analysis related to cybercrime investigations;

Demonstrate knowledge of methods, techniques and subject matter analysis applied to federal investigations, plus skills in researching, collecting, and analyzing large amounts of raw data from various criminal investigative tools and other client-owned databases; and

Demonstrate knowledge of methods, techniques, and subject matter analysis to financial and investigative data. Possess skills in researching, extracting, and

16.1.7 Cyber Forensic Analyst, Journeyman Level – must have more than three years of specialized experience in supporting cyber-financial investigations and will be required to:

Possess a bachelor’s degree in computer science, cyber-security or a related discipline and have prior experience providing cyber-financial analysis and investigative support to law enforcement agencies;

Demonstrate a strong knowledge of task forces and financial investigative groups that target money laundering and other financial criminal activities;

Demonstrate a deep understanding of criminal activity, such as general and complex financial crimes, civil and criminal forfeitures, domestic and transnational organized crime, white collar crime, money laundering, drug trafficking offenses, illicit trade finance, cyber-enabled financial crimes as mentioned in section 5.2, and other related areas of activity;

Demonstrate a deep understanding of Cryptocurrency analysis, Blockchain analytics, Open Internet, including social media, Deep and Dark Web intelligence gathering and analysis, data analytics, and electronic evidence analysis related to cybercrime investigations;

16.1.8 Operations Research Analyst, Junior Level – must have one (1) year of specialized experience providing operational research and analysis, supporting and enhancing financial investigations, providing investigative technology consulting, training and development, human capital and strategic communications and may be required to:

Possess a bachelor's degree in Mathematics, Statistics, Computer Science, Operations Research, or a related field.

Support financial investigations, conduct operational research and analysis, analyze data and develop solutions to complex problems. Demonstrate knowledge of financial fraud schemes, money laundering, and other financial crime typologies, possess knowledge of investigative techniques and procedures, and have excellent written and verbal communication skills.

Demonstrate understanding in mathematical modeling or other optimizing methods to develop and interpret information that assists HSI with decision making, policy formation, or other managerial functions. The Operations Research Analyst may collect and analyze data and develop decision support software, service, or products. May develop and supply optimal time, cost, or logistics networks for program evaluation, review or implementation.

Possess knowledge of organizational studies and evaluations, design systems and procedures, conduct work simplification and measurement studies, and prepare operations and procedures manuals to assist HSI in operating more efficiently and effectively.

Possess knowledge of strategic communications, training, operational research, and investigative consulting.

Develop communications to inform Special Agents, HSI wide on new techniques that criminals are employing to further their nefarious activities and how the work performed under this contract and its results have uncovered new or improved investigative methods, tools, techniques for combating financial crimes.

Possess knowledge of drafting HSI leadership announcements to include white papers, PowerPoint presentations to relay messages to all HSI offices. to message key program releases, enhancements, and technical updates that resonate with HSI and its Federal Law Enforcement agencies; and assist with translating the technical updates and requirements so the end-users see the benefits and understand how these technical tools directly impact their workflows.

Facilitate internal communications with all HSI internal and external stakeholders.

Support communications with HSI leadership with briefings and reports to communicate outcomes and findings on work performed under this contract and how that work furthers key program milestones and connections to HSI via FCU.

through graphic design support and

Possess knowledge of writing program SOP’s cataloging historical knowledge and maintain continuity when onboarding new contract key personnel;

documentation shall include, but not be exclusive to, the development of briefings, talking points, and outreach materials.

16.1.9 Operations Research Analyst, Journeyman Level – must have five (5) or more years experience providing operational research and analysis, supporting and enhancing financial investigations, providing investigative technology consulting, training and development, human capital and strategic communications and may be required to:

Possess a bachelor's degree in Mathematics, Statistics, Computer Science, Operations Research, or a related field.

Support financial investigations, conduct operational research and analysis, analyze data and develop solutions to complex problems. Must have knowledge of financial fraud schemes, money laundering, and other financial crime typologies, possess knowledge of investigative techniques and procedures, and have excellent written and verbal communication skills.

Formulate and apply mathematical modeling or other optimizing methods to develop and interpret information that assists HSI with decision making, policy formation, or other managerial functions. The Operations Research Analyst may collect and analyze data and develop decision support software, service, or products. May develop and supply optimal time, cost, or logistics networks for program evaluation, review or implementation.

Conduct organizational studies and evaluations, design systems and procedures, conduct work simplification and measurement studies, and prepare operations and procedures manuals to assist HSI in operating more efficiently and effectively.

Conduct strategic communications, training, operational research, and investigative consulting.

Develop communications to inform Special Agents, HSI wide on new techniques that criminals are employing to further their nefarious activities and how the work performed under this contract and its results have uncovered new or improved investigative methods, tools, techniques for combating financial crimes.

Submit draft HSI leadership announcements to include white papers, PowerPoint presentations to relay messages to all HSI offices. to message key program releases, enhancements, and technical updates that resonate with HSI and its Federal Law Enforcement agencies; and assist with translating the technical updates and requirements so the end-users see the benefits and understand how these technical tools directly impact their workflows.

Facilitate internal communications with all HSI internal and external stakeholders.

Support communications with HSI leadership with briefings and reports to communicate outcomes and findings on work performed under this contract and how that work furthers key program milestones and connections to HSI via FCU.

through graphic design support and

Write program SOP’s cataloging historical knowledge and maintain continuity when onboarding new contract key personnel; documentation shall include, but not be exclusive to, the development of briefings, talking points, and outreach materials.

17.0 SECTION 508 COMPLIANCE

All electronic and information technology (EIT) changes recommended as a result of any performance through this PWS must adhere to the applicable accessibility standards at 36 CFR 1994, unless an agency exception to this requirement exists. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www.section508.gov.

17.1 Section 508 Requirements

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5.

In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018, and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

17.2 Section 508 Requirements for Technology Services

When providing maintenance upgrades, substitutions, and replacements to ICT, the contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed upgrades, substitutions and replacements prior to acceptance.