70B03C26R00000030 - NII Medium Energy Mobile System IDIQ.pdf.pdf

12. DISCOUNT TERMS

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS

6. SOLICITATION

ISSUE DATE

3. AWARD/EFFECTIVE DATE 5. SOLICITATION NUMBER2. CONTRACT NUMBER 4. ORDER NUMBER

a. NAME b. TELEPHONE NUMBER (No collect calls)7. FOR SOLICITATION

INFORMATION CALL:

SET ASIDE : % FOR:

SMALL BUSINESS

NAICS:

SIZE STANDARD:

HUBZONE SMALL

BUSINESS

11. DELIVERY FOR FOB

DESTINATION UNLESS

BLOCK IS MARKED

SEE SCHEDULE

13b. RATING

14. METHOD OF SOLICITATION

IFB RFPRFQ

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY17a. CONTRACTOR/ CODE

OFFEROR

FACILITY

CODE

TELEPHONE NO.

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS

BLOCK BELOW IS CHECKED.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS

IN OFFER.

8(A)

00/00/0000 70B03C26R00000030

Starla R. Van Winkle 317-715-6769 04/1 /2026 2:00 PM ET

DHS - Customs & Border Protection Border Enforcement Contracting Division 1300 Pennsylvania Ave, NW

Washington DC 20229

334517

See Attached Delivery Schedule DHS - Customs & Border Protection Border Enforcement Contracting Division 1300 Pennsylvania Ave, NW

Washington DC 20229

US Customs and Border Protection

FAD Mail Stop 203-V 8899 E. 56th Street Indianapolis IN 46249

PAGE OF PAGES1. REQUISITION NUMBERSolicitation/Contract/Order for Commercial Products and Commercial Services Offeror to Complete Blocks 12,17,23,24, & 30 0020154755 1 56

ORDER UNDER DPAS (15 CFR 700)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

UNRESTRICTED OR

13a. THIS CONTRACT IS A RATED

0 / /2026

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

24.

AMOUNT

22.

UNIT

23.

UNIT PRICE

SEE ADDENDUM

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

ECONOMICALLY DISADVANTAGED WOMEN-

OWNED SMALL BUSINESS (EDWOSB)

CODE

CODE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

31c. DATE SIGNED

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED.

ADDENDA

ADDENDA

ARE ARE NOT ATTACHED.

ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND

RETURN

AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH OR

OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS

SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

29. AWARD OF CONTRACT: REFERENCE

YOUR OFFER ON SOLICITATION (BLOCK 5), INCLUDING

ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH HEREIN, IS ACCEPTED AS TO

ITEMS:

OFFER DATED

30A. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE

SIGNED

31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT)

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

$0.00

Connie A. McKay

COPIES TO ISSUING OFFICE. CONTRACTOR

Medium Energy Mobile System IDIQ

70B03C26R00000030

TABLE OF CONTENTS

SECTION I SCHEDULES

I.1 DESCRIPTION:

I.2 MINIMUM GUARANTEE:

I.3 MAXIMUM AMOUNT:

I.4 ORDERING PERIOD:

I.5 OBLIGATION:

I.6 TYPES OF DELIVERY ORDERS:

I.7 CONTRACT PRICING:

I.8 SCHEDULE OF SUPPLIES/SERVICES

I.9 DELIVERY SCHEDULE

SECTION II CONTRACT CLAUSES

II.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

II.2 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN 2020), with Alternate I (NOV 2021) (41 U.S.C. 4704 and 10 U.S.C. 2402) II.3 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023) II.4 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (NOV 2025) (Deviation 25-27)(effective November 28, 2025) II.5 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (NOV 2025) (Deviation 25- 27)(effective November 28, 2025) II.6 52.219-8, Utilization of Small Business Concerns (OCT 2025) (Deviation 26-03)(effective November 28, 2025). .. 7 II.7 52.219-28, Post award Small Business Program Representation (OCT 2025)Deviation 26-03)(effective November 28, 2025) II.8 52.222-3, Convict Labor (JUN 2003) (E.O. 11755) II.9 52.222-35, Equal Opportunity for Veterans OCT 2025) (Deviation 26-10)(effective November 3, 2025) II.10 52.222-36, Equal Opportunity for Workers with Disabilities (OCT 2025) (Deviation 26-10)(effective November 3, 2025). 7 II.11 52.222-37, Employment Reports on Veterans (OCT 2025) (Deviation 26-10)(effective November 3, 2025) II.12 52.222-50, Combating Trafficking in Persons (NOV 2021) (22 U.S.C. chapter 78 and E.O. 13627) II.13 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (OCT 2025) (Deviation 26- 10)(effective November 3, 2025) II.14 52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS (DEC 2014) 7 II.15 52.222-40 NOTIFICATION OF EMPLOYEE RIGHTS UNDER THE NATIONAL LABOR RELATIONS ACT

(DEC 2010)

II.16 52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUN 2013)

II.17 52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS (MAR 2023) 7

II.18 52.216-18 ORDERING (AUG 2020)

II.19 52.216-19 ORDER LIMITATIONS (OCT 1995)

II.20 52.216-22 INDEFINITE QUANTITY (OCT 2025)(Deviation 26-04)(effective November 28, 2025) II.21 52.217-7 OPTION FOR INCREASED QUANTITY – SEPARATELY PRICED LINE ITEM (MAR 1989)

II.22 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

II.23 3052.212-70 CONTRACT TERMS AND CONDITIONS APPLICABLE TO DHS ACQUISITION OF

COMMERCIAL ITEMS (JUL 2023)(HSAR Deviation 25-09)(effective November 28, 2025) II.24 3052204-71 CONTRACTOR EMPLOYEE ACCESS (JULY 2023)(Deviation 25-12)(effective November 3, 2025), ALTERNATE II

II.25 3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)(Deviation 25-12)(effective November 3, 2025)

II.26 52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACT PERSONNEL (JAN 2011)

II.27 52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE (AUG 2025)(DEVIATION 25-19) II.28 52.212-4 CONTRACT TERMS AND CONDITIONS–COMMERCIAL PRODUCTS and COMMERCIAL SERVICES (AUG 2025) (DEVIATION 25-21)(effective November 28, 2025) II.29 52.223-23 SUSTAINABLE PRODUCTS (OCT 2025) (DEVIATION 26-12)(effective November 28, 2025) II.30 52.224-3 PRIVACY TRAINING (JAN 2017), Alternate I (JAN 2017) II.31 52.233-1 DISPUTES (AUG 2025) (DEVIATION 25-25)(effective November 3, 2025) II.32 52.233-3 PROTEST AFTER AWARD (AUG 2025) (DEVIATION 25-25)(effective November 3, 2025) II.33 52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (AUG 2025) (DEVIATION 25- 25)(effective November 3, 2025) II.34 52.240-91 SECURITY PROHIBITIONS AND EXCLUSIONS (AUG 2025) (DEVIATION 25-23)(effective November 3, 2025) II.35 52.244-6 SUBCONTRACTS FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (DEVIATION SEPT 2025)(effective November 28, 2025)

II.36 CONTRACT TYPE (OCT 2008)

II.37 SPECIFICATIONS, STATEMENT OF WORK, STATEMENT OF OBJECTIVES OR PERFORMANCE WORK

STATEMENT ATTACHED (JUN 2013)

II.38 TERM OF CONTRACT (MARCH 2003)

II.39 ORDERING PROCEDURES – SUPPLIES (AUG 2022)

II.40 CONTRACTING OFFICER'S AUTHORITY (MAR 2003)

II.41 ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS - INVOICE PROCESSING PLATFORM (IPP)

(AUG 2024)

II.42 GOVERNMENT CONSENT OF PUBLICATION/ENDORSEMENT (MAR 2003)

II.43 CONTRACT SERVICES NOT REQUIRING A BACKGROUND INVESTIGATION (MAY 2022)

II.44 INFORMATION TECHNOLOGY SECURITY AWARENESS TRAINING (JULY 2023)

II.45 CONTRACT EMPLOYEE ACCESS (JUN 2011)

SECTION III SOLICITATION PROVISIONS

III.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

III.2 52.203-18 PROHIBITION ON CONTRACTING WITH ENTITIES THAT REQUIRE CERTAIN INTERNAL

CONFIDENTIALITY AGREEMENTS OR STATEMENTS – REPRESENTATION (JAN 2017)

III.3 52.209-2 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS--

REPRESENTATION (NOV 2025)(Deviation 25-27)(effective November 28, 2025) III.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (NOV 2025)(Deviation 25-27)(effective November 28, 2025) III.5 52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A FELONY CONVICTION UNDER ANY FEDERAL LAW NOV 2025)(Deviation 25-27)(effective November 28, 2025) III.6 52.216-1 TYPE OF CONTRACT (OCT 2025)(Deviation 26-04)(effective November 28, 2025)

III.7 52.225-18 PLACE OF MANUFACTURE (AUG 2018)

III.8 52.252-5 AUTHORIZED DEVIATIONS IN PROVISIONS (NOV 2020)

III.9 52.204-7, SYSTEM FOR AWARD MANAGEMENT (AUG 2025) (DEVIATION 25-19)(effective November 28, 2025) 42 III.10 52.215-1 INSTRUCTIONS to OFFERORS--COMPETITIVE ACQUISITION (OCT 2025) (DEVIATION 26- 08)(effective November 28, 2025) III.11 52.233-2 SERVICE OF PROTEST (AUG 2025) (DEVIATION 25-25)(effective November 3, 2025)

III.12 52.240-90 SECURITY PROHIBITIONS AND EXCLUSIONS REPRESENTATIONS AND CERTIFICATIONS (AUG 2025) (DEVIATION 25-23)(effective November 3, 2025)

III.13 AGENCY LEVEL PROTEST NOTICE (APR 2003)

III.14 GENERAL EVALUATION INFORMATION (OCT 2008)

SECTION I SCHEDULES

Any applicable updates to the Federal Acquisition Regulation (FAR) made pursuant to the Revolutionary FAR Overhaul (RFO) and subsequently adopted by the Department of Homeland Security via Class Deviation, shall be deemed adopted and included in this contract without adjustment to price. See FAR Overhaul - FAR Part DEVIATION Guidance | Acquisition.GOV. Any clauses contained in this contract that have already been, or are later, updated in the RFO and adopted by DHS shall be considered to be amended to mirror the most up to date FAR RFO language.

In compliance with Executive Order 14173, “Ending Illegal Discrimination and Restoring Merit-Based Opportunity,” dated January 21, 2025, the contractor agrees that its compliance in all respects with applicable Federal anti-discrimination laws is material to the government’s payment decisions for purposes of section 3729(b)(4) of title 31, United States Code; and, by virtue of submitting a quote/offer, the contractor certifies that it does not operate any programs promoting DEI that violate any applicable Federal anti-discrimination laws.

No requirement in this contract should conflict or contravene Executive Order “Unleashing American Energy” dated January 20, 2025. To the extent any requirement may conflict or contravene that Executive Order, the requirement is deemed inapplicable to this contract. This would include requirements related to “climate-related risk management and/or greenhouse gas (GHG) emissions inventory and/or reduction target disclosure requirements.” The Contractor should consult with the Contracting Officer on any such requirement they determine is inconsistent with the Executive Order, and work on proposed modifications to comply with the EO and statutory requirements.

I.1 DESCRIPTION:

This acquisition shall be conducted using the Revolutionary FAR Overhaul (RFO) Part 12 and 15. This solicitation is anticipated to result in a single award of an indefinite delivery / indefinite quantity (IDIQ) contract for the U.S.

Customs and Border Protection (CBP) Non-Intrusive Inspection (NII) Medium Energy Mobile System (MEMS).

I.2 MINIMUM GUARANTEE:

The minimum guarantee of the anticipated contract shall be one (1) system.

I.3 MAXIMUM AMOUNT:

The contractor is not obligated to fulfill requirements (singly or in the aggregate) that exceed $270,000,000.00 under this IDIQ.

I.4 ORDERING PERIOD:

The ordering period of the anticipated contract is 60 months from the date of the award (5 years total).

I.5 OBLIGATION:

The anticipated IDIQ contract does not obligate any funding. The individual DOs placed against the contract shall obligate the funding.

I.6 TYPES OF DELIVERY ORDERS:

Any DOs awarded as a result of the anticipated contract shall be awarded on a Firm Fixed Price (FFP) basis. Orders may be issued by any CBP Contracting Officer via email.

I.7 CONTRACT PRICING:

Prices for the systems shall be FOB Destination. The Contractor shall be required to deliver units to locations specified at the order level. The quoted price shall be a fixed price for the entire ordering period and shall include shipping charges, set-up costs, and factory test representation. Units may be delivered worldwide, but the schedule pricing should include pricing for anywhere in the contiguous United States (i.e., the lower 48 states). Additional shipping charges may be quoted at the order level for any units outside of the continental United States (OCONUS).

I.8 SCHEDULE OF SUPPLIES/SERVICES

Medium Energy Mobile System

ITEM # DESCRIPTION QTY UNIT UNIT PRICE

10 Medium Energy Mobile System * 1.000 EA

*The proposed system price shall include a minimum warranty of five (5) years.

Quantity Discount

Quantity Range Item Price (per system) 2 – 5 6 - 10 11 +

The quantity discounts listed above apply to each order separately, not the sum of all systems over the course of the

IDIQ.

Other Direct Cost

20 Training Development 1 EA 30 Operator Training 1 EA 40 Shipping (OCONUS) 1 EA 50 Weatherproofing 1 EA 60 Cold Weather Package 1 EA

70 On-Demand Services 1 EA TBD

I.9 DELIVERY SCHEDULE

DELIVER TO: ITEM # QTY DELIVERY DATE

TBD BY TASK ORDER – CONUS/OCONUS

SECTION II CONTRACT CLAUSES

*Please note that all DHS FAR DEVIATIONS for the Revolutionary FAR Overhaul (RFO) are in effect. See FAR Overhaul

- FAR Part DEVIATION Guidance | Acquisition.GOV. CBP reserves the right to unilaterally modify this solicitation to incorporate additional DEVIATIONS arising from the RFO. As such, quoters should become familiar with those DEVIATIONS prior to entering into this contract. Acceptance of this contract is acceptance of unliteral modifications by the Government to incorporate any RFO deviation.

II.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer shall make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): www.acquisition.gov .

(End of clause)

II.2 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN 2020), with Alternate I (NOV 2021) (41 U.S.C. 4704 and 10 U.S.C. 2402).

II.3 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023)

II.4 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (NOV 2025) (Deviation 25-27)(effective November 28, 2025).

II.5 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (NOV 2025) (Deviation

25-27)(effective November 28, 2025).

II.6 52.219-8, Utilization of Small Business Concerns (OCT 2025) (Deviation 26-03)(effective November 28, 2025).

II.7 52.219-28, Post award Small Business Program Representation (OCT 2025)Deviation 26-03)(effective

November 28, 2025).

II.8 52.222-3, Convict Labor (JUN 2003) (E.O. 11755).

II.9 52.222-35, Equal Opportunity for Veterans OCT 2025) (Deviation 26-10)(effective November 3, 2025).

II.10 52.222-36, Equal Opportunity for Workers with Disabilities (OCT 2025) (Deviation 26-10)(effective November

3, 2025).

II.11 52.222-37, Employment Reports on Veterans (OCT 2025) (Deviation 26-10)(effective November 3, 2025).

II.12 52.222-50, Combating Trafficking in Persons (NOV 2021) (22 U.S.C. chapter 78 and E.O. 13627).

II.13 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (OCT 2025) (Deviation 26-

10)(effective November 3, 2025).

II.14 52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS (DEC 2014)

II.15 52.222-40 NOTIFICATION OF EMPLOYEE RIGHTS UNDER THE NATIONAL LABOR RELATIONS ACT (DEC

2010)

II.16 52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUN 2013)

II.17 52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS (MAR 2023)

II.18 52.216-18 ORDERING (AUG 2020)

(a) Any supplies and services to be furnished under this contract shall be ordered by issuance of delivery orders or task orders by the individuals or activities designated in the Schedule. Such orders may be issued from the contract award date through the end of the ordering period.

(b) All delivery orders or task orders are subject to the terms and conditions of this contract. In the event of conflict between a delivery order or task order and this contract, the contract shall control.

(c) A delivery order or task order is considered ‘‘issued’’ when –

(1) If sent by mail (includes transmittal by U.S. mail or private delivery service), the Government deposits the order in the mail;

(2) If sent by fax, the Government transmits the order to the Contractor’s fax number; or

(3) If sent electronically, the Government either --

(i) Posts a copy of the delivery order or task order to a Government document access system, and notice is sent to the Contractor; or

(ii) Distributes the delivery order or task order via email to the Contractor’s email address.

(d) Orders may be issued by methods other than those enumerated in this clause only if authorized in the contract.

II.19 52.216-19 ORDER LIMITATIONS (OCT 1995)

(a) Minimum order. When the Government requires supplies or services covered by this contract in an amount of less than one (1) system, the Government is not obligated to purchase, nor is the Contractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The Contractor is not obligated to honor--

(1) Any order for a single item in excess of $270,000,000.00;

(2) Any order for a combination of items in excess of $270,000,000.00; or

(3) A series of orders from the same ordering office within 30 days that together call for quantities exceeding the limitation in paragraph (b)(1) or (2) of this section.

(c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-21 of the Federal

Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the Contractor if that requirement exceeds the maximum-order limitations in paragraph (b) of this section.

(d) Notwithstanding paragraphs (b) and (c) of this section, the Contractor shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within days after issuance, with written notice stating the Contractor's intent not to ship the item (or items) called for and the reasons.

Upon receiving this notice, the Government may acquire the supplies or services from another source.

II.20 52.216-22 INDEFINITE QUANTITY (OCT 2025)(Deviation 26-04)(effective November 28, 2025)

(a) This is an indefinite-quantity contract for the supplies or services specified, and effective for the period stated, in the

Schedule. The quantities of supplies and services specified in the Schedule are estimates only and are not purchased by this contract.

(b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause.

The Contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the "maximum." The Government shall order at least the quantity of supplies or services designated in the Schedule as the "minimum."

(c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, there is no limit on the number of orders that may be issued. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations.

(d) Any order issued during the effective period of this contract and not completed within that period shall be completed by the Contractor within the time specified in the order. The contract shall govern the Contractor's and Government's rights and obligations with respect to that order to the same extent as if the order were completed during the contract's effective period; provided, that the Contractor shall not be required to make any deliveries under this contract after the ordering period expiration, plus 12 months.

II.21 52.217-7 OPTION FOR INCREASED QUANTITY – SEPARATELY PRICED LINE ITEM (MAR 1989)

The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within ten days from the final delivery on the order. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree.

(End of Clause)

II.22 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any Department of Homeland Security Acquisition Regulation (HSAR) (48

CFR 30) clause with an authorized deviation is indicated by the addition of “(DEVIATION)” after the name of the regulation.

II.23 3052.212-70 CONTRACT TERMS AND CONDITIONS APPLICABLE TO DHS ACQUISITION OF COMMERCIAL

ITEMS (JUL 2023)(HSAR Deviation 25-09)(effective November 28, 2025)

The Contractor agrees to comply with any provision or clause that is incorporated herein by reference to implement agency policy applicable to acquisition of commercial items or components. The provision or clause in effect based on the applicable regulation cited on the date the solicitation is issued applies unless otherwise stated herein. The following provisions and clauses are incorporated by reference:

(a) Provisions.

[X ] 3052.247-72 F.o.B. Destination Only.

(b) Clauses.

[X] 3052.240-71 Contractor Employee Access.

[X] Alternate II

[X] 3052.240-72 Safeguarding of Controlled Unclassified Information.

[X] 3052.205-70 Advertisement, Publicizing Awards, and Releases.

[X ] 3052.215-70 Key Personnel or Facilities.

[X ] 3052.228-70 Insurance.

[X] 3052.242-72 Contracting Officer’s Representative.

II.24 3052204-71 CONTRACTOR EMPLOYEE ACCESS (JULY 2023)(Deviation 25-12)(effective November 3, 2025), ALTERNATE II

(a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, ‘‘Chemical Facility Anti-Terrorism

Standards,’’ and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual ‘‘Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information’’ dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002

(title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116-283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, ‘‘Protection of Sensitive Security Information,’’ as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, ‘‘Sensitive Security Information (SSI)’’ and, within the Transportation Security Administration, TSA MD 2810.1, ‘‘SSI Program’’;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/ need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the

Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland

Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable

Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the

Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government’s activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

(f) The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

(g) Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-551). Any exceptions must be approved by the Department’s Chief Security Officer or designee.

(h) Contractors shall identify in their proposals, the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

II.25 3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)(Deviation 25-

12)(effective November 3, 2025)

(a) Definitions. As used in this clause--

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, ‘‘Chemical Facility Anti-Terrorism

Standards,’’ and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual ‘‘Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information’’ dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002

(title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Public Law 116-283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, ‘‘Protection of Sensitive Security Information,’’ as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, ‘‘Sensitive Security Information (SSI)’’ and, within the Transportation Security Administration, TSA MD 2810.1, ‘‘SSI Program’’;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the

Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland

Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable

Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that --

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide --

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information. (1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhssecurity-and-training-requirementscontractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the

Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the

Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security

Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems.

CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident

Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800-88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800-88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S.

Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

II.26 52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACT PERSONNEL (JAN 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12…