A14_MR_RFI_SOW_PSVAMS.docx

Personnel Security Vetting and Adjudication Management System (PSVAMS)

United States Department of the Interior Office of Law Enforcement & Security National Security Division

Personnel Security Vetting and Adjudication Management System (PSVAMS)

Statement of Work

10 February 2026

Purpose and Scope

a. The Department of the Interior (DOI or Department), Office of Law Enforcement and Security (OLES), seeks to acquire and implement a comprehensive, Commercial Off-the-Shelf (COTS) cloud-based Personnel Security Vetting and Adjudication Management System (PSVAMS). This acquisition will employ a best-value approach to strike the optimal balance between technical capabilities, security compliance, and lifecycle costs, thereby ensuring the most effective solution for the Department. This initiative is essential for unifying and modernizing the Department’s personnel vetting, adjudication, and continuous evaluation operations on a single, Department-wide platform. This encompasses personnel security activities across the Department, with all bureaus, including the Bureau of Indian Affairs (BIA) and Bureau of Indian Education (BIE), utilizing PSVAMS as part of the Department-wide program. The system must also be able to store BIA’s Office of Justice Services Law Enforcement adjudicative background investigations. The system will enable automation, standardization, and oversight of end-to-end personnel security operations, supporting over 90,000 federal employees, contractors, interns, volunteers, and other designated individuals.

b. PSVAMS will support the complete lifecycle of personnel vetting activities, including background investigations, continuous vetting (CV) alerts, credentialing actions, suitability and fitness adjudication, Record of Arrest and Prosecution Back (RapBack), and security clearance determinations. This system will focus on federal employees, contractors, seasonal workers, and volunteers, with access and permissions tailored to each individual's role and function. The system shall serve personnel security professionals, adjudicators, supervisors, and designated administrative users throughout the Department. Additionally, the solution must integrate seamlessly with external systems, such as the Defense Counterintelligence and Security Agency (DCSA)’s suite of systems (which includes eDelivery and the Central Verification System), the General Services Administration’s USAccess, the Office of Personnel Management’s eOPF and USAStaffing, as well as internal DOI-owned systems such as DOIAccess, the Federal Personnel and Payroll System, the Federal Business Management System, and applications built using the ServiceNow platform, while ensuring compliance with the Federal Information Security Management Act (FISMA), the Privacy Act, and Federal Risk and Authorization Management Program (FedRAMP) security requirements.

c. The purpose of the PSVAMS is to streamline, automate, and enhance the Department’s ability to collect, track, analyze, and report information related to credentialing Homeland Security Presidential Directive 12 (HSPD-12), suitability, fitness, and national security determinations, while integrating with internal and external systems to make required updates and to track cost of investigations. The solution must comply with existing Federal mandates, including Executive Orders 13467, 13764, 14028, 5 Code of Federal Regulations (CFR) 731, HSPD-12, and Federal Information Processing Standard (FIPS) 201 as well as the Trusted Workforce 2.0 (TW) framework and the Privacy Act of 1974. It must also be scalable to support emerging federal standards and policy changes without extensive redevelopment.

d. The anticipated vehicle will be a single-award Indefinite Delivery Indefinite Quantity (IDIQ) contract. There is no limit to the number of task orders that can be issued under the IDIQ. Each task order will be issued as a firm-fixed price (FFP) award.

e. The Government anticipates that the complete solution, which includes installation, testing, data migration and cleansing, system configuration, integration, training, and deployment, will be finished within nine (9) months of the initial award.

System Requirements

a. The PSVAMS solution must be a secure, cloud-based platform hosted in a Federal Risk and Authorization Management Program (FedRAMP) High–authorized cloud environment. While no system can meet all security requirements, the solution must fully comply with the FedRAMP High baseline controls, Department of the Interior Information Technology (DOI IT) security policies, and all applicable federal security mandates. The system must support modern architecture, including Application Programming Interfaces (APIs) and flat-file exchanges, providing interoperability with existing Human Resource (HR) and investigative systems.

b. Functional capabilities must include the ability to log and route investigations by tier (1 through 5), covering suitability, fitness, credentialing, and national security, determinations. They should trigger alerts for self-reported events, continuous data vetting, or timelines for reinvestigation. It should also automate everyday adjudication tasks with configuration-based rules (eAdjudication) and generate standardized reports, metrics, and dashboards by bureau, case type, or timeframe. Finally, provide tiered access through Phishing resistant Multi-Factor authentication and role-based permissions. The investigative and adjudicative standards applied within PSVAMS shall align with the federal mandates listed in paragraph 1.c, including Executive Orders 13467 and 14028, the Trusted Workforce 2.0 framework, HSPD-12, FIPS 201, and 5 CFR 731.

c. PSVAMS must accommodate onboarding, tracking, and case management for all Department employees, including federal staff, contractors, interns, volunteers, and seasonal workers. In this paragraph, the term “employees” refers exclusively to individuals whose personnel security cases are processed through PSVAMS, not to those who operate the system.

The individuals who operate the system, such as Personnel Security Specialists, adjudicators, supervisors, and administrators, are referred to throughout this document as “system users.” These system users’ access PSVAMS to perform case intake, adjudication, continuous vetting triage, reporting, and other operational functions.

PSVAMS must be capable of supporting the Department’s current population of approximately 90,000 employees, with additional capacity to manage seasonal surges averaging 16,000 additional personnel during peak periods. The system must support concurrent record processing for all employees and remain scalable as the workforce grows.

The Department can securely access a contractor-operated FISMA High cloud environment through approved, compliant web browsers from network, consistent with DOI cybersecurity boundary protection.

d. The diagram below serves as a conceptual representation of the PSVAMS operational architecture, showing how data, user access, and system components interact across DOI Moderate environments, contractor-operated FedRAMP High services, and external government systems.

In addition to the FedRAMP requirements established in this document, the solution proposed to DOI must be capable of being accessed from a FISMA moderate environment. Functioning in the FISMA moderate environment will still mean adherence to meeting current and future protection needs based on changing threats, vulnerabilities, requirements, and technologies. Additionally, any documentation that DOI (as the customer) would need to maintain on the proposed system will either need to be categorized at the FISMA moderate level, or the contractor will need to include a solution for maintaining that documentation at the appropriate level. The Department’s requirements to authorize and continually monitor the system remain consistent with those of its other systems.

DOI/OLES will also be servicing federal customers that include non-DOI agencies. Although the proposed solution will apply to all customers, DOI is requesting that virtual separation/separate environments be established for each customer within the entire PSVAMS solution. Non-DOI agencies will work through DOI as the shared service provider for access to the PSVAMS system. The proposed solution will need to either ensure that case files can be transferred to government customers, or that an appropriately accredited solution (such as OPM’s NP2 portal) is used to do so. This requirement does not negate the requirement for any customer of the PSVAMS solution to have an appropriately designated FISMA solution for receiving any artifacts/case files.

All users of the proposed solution – whether originating in a FISMA Moderate or High environment – will need to be able to upload documents/artifacts into the contractor-operated and maintained FISMA High environment. The contractor solution will need to account for this requirement, and their response to this solicitation will need to explain how this will occur. Additionally, the entire case files for each individual will be stored and maintained in the proposed contractor environment. These case files include the artifacts used to adjudicate candidates by government agencies. Up-time and accessibility requirements laid out elsewhere in this document ensure that all system users will have reliable access to these case files whenever their mission requirements dictate.

DOI will ensure that there is adequate network connectivity to access the solution from any geographic locations that the Department deems necessary. Users of the system will be capable of multifactor authentication via Personal Identification Verification (PIV) in order to meet National Institute of Standards and Technology (NIST) requirements and will be accessing the solution from hardware and facilities categorized at the FISMA moderate level. Any additional accommodation or equipment for the contractor solution will need to be included and priced into their proposal.

Solutions must be FIPS-199 compliant and must meet all DOI-specific policy compliance statements to the NIST Special Publication (SP) 800-53, in addition to those established for all organizations in NIST Specialized Publication (SP) 800-53. (see attached DOI’s Privacy Clause)

The following considerations should be made for vendor employees as part of the proposed solution to DOI/OLES:

i. Vendor employees may not access data until passing a complete background investigation at a level designated by the COR (and at the discretion of OLES) prior to on boarding:

ii. Lookback timeframe for the background investigation should be 10 years in states where permissible;

iii. Sensitive access termination process needs to be documented in the contract, where upon employee separation from the vendor, system access ends;

iv. Inclusion of a separation of duty provisioning for all administrators and users;

v. Continuous monitoring or automated/scheduled system audits should occur as a permanent feature; and

vi. Include controls that are in compliance with the most current standard under NIST SP 800-53 are in place to ensure unauthorized monitoring doesn't occur.

DOI’s Current Solution

a. Currently, DOI bureaus utilize varied, unstandardized systems to manage personnel vetting and adjudication activities. These include Microsoft Access-based tracking tools (Interior Business Center (IBC), Bureau of Reclamation (BOR), Fish and Wildlife Service (FWS)), SharePoint workflows and intake portals, Microsoft Excel spreadsheets for case logs and adjudication notes, email-based manual vetting coordination, and internal dashboards (e.g., National Park Service) NPS, (Bureau of Safety and Environment (BSEE), as well as custom-built utilities (IBC-Power Apps).

b. These systems lack integration, auditability, scalability, and alignment with current TW 2.0 and national security vetting frameworks. They are inefficient, prone to errors, and place a significant burden on bureau personnel security staff. Several systems are unsupported or fail to meet the DOI’s growing data retention, interface, and adjudication logging requirements.

c. An alternatives analysis conducted by the DOI TW 2.0 Workgroup evaluated the expansion of FWS ServiceNow onboarding tools, DCSA’s DISS CMS platform, and the procurement of a purpose-built COTS solution. ServiceNow lacked key functionalities (e.g., adjudication workflows, CV alert handling), while DCSA’s Defense Information System for Security (DISS) Case Management System (CMS) is not viable for DOI-wide deployment until FY28. The preferred solution is a cloud-based COTS platform modeled on GSA’s GSTARS, which will provide case management, CV alert triage, integration, and audit capabilities from day one.

Definitions

a. Contracting Officer (CO): An individual with the authority to enter into, administer, and/or terminate contracts, as well as make related determinations and findings. This term also includes certain authorized representatives of the contracting officer who act within the scope of their delegated authority. Only a warranted CO has the authority to issue modifications or otherwise change the terms and conditions of this IDIQ and its orders. If anyone other than the CO attempts to make changes to the terms and conditions of this IDIQ or its orders, do not proceed with the change and immediately notify the CO.

b. Contracting Officer’s Representative (COR): A Federal employee delegated limited authority by a Contracting Officer to monitor and perform specific, enumerated contract management duties related to contract planning, contract administration, technical oversight, and closeout to ensure that the Contractor’s performance meets the standards outlined in the contract. Upon awarding an order, the CO for the Government will designate an authorized COR to provide the contractor with any necessary Government-furnished data, documents, or equipment. Contract interpretation and related guidance from the Government will not be official unless explicitly provided by the COR or the CO. The COR will ensure the timely progress of the work and its satisfactory completion.

c. Defective Service: A service output that fails to meet the performance standards specified in the contract for that service.

d. Department-wide program: Refers to the unified personnel security program implemented across all bureaus and offices within the Department of the Interior, which utilizes the PSVAMS to standardize processes, improve efficiency, and ensure the consistent application of personnel vetting policies and procedures for all federal employees, contractors, interns, and volunteers.

e. Performance Requirements Summary (PRS): A list of service outputs under the contract that the COR will evaluate regularly, including the surveillance methods to be used for these outputs and the performance standards of the listed outputs.

f. Project Management Plan (PMP): A detailed document submitted by the Contractor that outlines the management approach for all work conducted under the contract. The PMP must include programming milestones, task dependencies, risk mitigation strategies, and resource allocation. It serves as an essential tool to guide the complete lifecycle implementation and maintenance of the PSVAMS platform and is subject to review and approval by the Government.

g. Quality Assurance: A systematic and planned approach to all government actions required to establish confidence that adequate technical requirements are in place that products and services meet these requirements, and that satisfactory performance is achieved. Quality assurance encompasses the actions taken by government assurance functions to ensure the quality of contracted services.

h. Quality Control: Actions taken by a Contractor to manage the production of outputs and ensure they meet contract requirements.

General Contractor Requirements

a. Program Manager

i. The Contractor will provide a program manager responsible for overseeing all work. The name of this individual, along with one or more alternates who will represent the Contractor during the manager's absence, will be designated in writing to the CO.

ii. The program manager or alternate will have the full authority to act on behalf of the Contractor in all contract matters related to the daily operation of this contract.

iii. The program manager or alternate will be available during regular duty hours within thirty (30) minutes to meet by phone or at the facility with government personnel designated by the CO to discuss problem areas. After regular duty hours, the manager or alternate will be available within two (2) hours.

iv. The program manager will provide an emergency phone or cell phone to the COR and CO.

v. The program manager and alternate or alternates will be able to read, write, speak, and understand English.

vi. The program manager will be responsible for ensuring that all quality control objectives for the project are met, as well as for managing project methodology, facilitating meetings and providing meeting minutes, developing a deployment schedule, coordinating resources (federal and contractor), and creating risk mitigation plans. The Program Manager shall pay particular attention to strategies for handling high-volume seasonal surges and ensuring smooth integration and adoption across all Department bureaus, including BIA and BIE.

b. Contractor Personnel Identification

i. The Contractor, when communicating with outside parties, DOI personnel, and other DOI contractors, will advise that they are Agency Contractors to ensure they are not mistaken for Government employees.

ii. Contractor employees will identify themselves as Agency Contractors in all documents (e.g., reports, correspondence, etc.) where they are listed as the Point of Contact.

iii. Email messages from contractor employees will include a signature block that identifies the individual as a contractor employee and references the firm’s name as a DOI Agency Contractor.

iv. The Contractor will display an identification badge that indicates they are a DOI Contractor while on-site and when off-site if their “attendance” is related to providing services under this contract.

c. Contractor Work Force Responsibility

i. The Contractor will have full responsibility to organize, furnish, maintain, supervise, and direct a workforce that, within the limitations of the provisions of this IDIQ, is fully capable of effectively performing the work outlined in this contract.

d. Transfer and Exchange of Contractor Personnel

i. Replacement of any proposed workforce will involve individuals with comparable experience and skills. Resumes for replacement personnel will be provided to the COR and CO for review in sufficient time to satisfactorily submit to and pass the pre-employment high-risk background investigation process, which typically requires at least six (6) weeks from when the Contractor supplies the required information to the DOI Office of Security. Shorter periods may be allowed for positions not deemed “High Risk” or for which the CO provides written approval to the Contractor. From the date of the initial background check to the receipt of a PIV Card, the onboarding process typically takes an average of sixty (60) calendar days.

e. Quality Control Plan

i. The contractor will develop and maintain an effective Quality Control Program (QCP) to ensure that all services are performed in accordance with this SOW and its orders, as well as an approved Program Management Plan (PMP). The contractor will create and implement procedures to identify, prevent, and eliminate the recurrence of defective services. The contractor’s quality control program will manage compliance with the requirements of the contract.

ii. A quality control plan and PMP will be submitted to the CO and the COR for review and approval within thirty (30) calendar days of the IDIQ award notice. The CO will notify the Contractor of acceptance or required modifications to the plan within fourteen (14) days. The Contractor will make the necessary modifications and obtain acceptance of the plan within ten (10) days of receiving comments. The QCP plan will include:

1) A description of the inspection system to cover all proposed services. The description will include specifics regarding the areas to be inspected, both on a scheduled and unscheduled basis, the frequency of inspections, and the title of the inspectors.

2) A description of the methods to be used for identifying and preventing defects in the quality of service performed.

3) A description of the records to be kept to document inspections and corrective or preventive actions taken.

4) The Contractor will maintain records of inspections and make them available to the CO upon request throughout the contract performance period and for a period after contract completion, until the final settlement of any claims under this contract.

f. Quality Assurance

i. According to Federal Acquisition Regulation (FAR) 52.212-4(a), the Government will evaluate the Contractor’s performance under this IDIQ. A Performance Requirements Summary (PRS) and Quality Assurance Surveillance Plan (QASP) will be provided with each Task Order. Government personnel will document all surveillance observations. When an observation indicates defective performance, the COR will ask the contract manager or on-site representative to initial the observation. Initialing the observation does not necessarily imply agreement with the observation, but rather acknowledgment that the individual has been made aware of the defective performance. Such surveillance will follow standard inspection procedures or other contract provisions. Any action taken by the CO as a result of surveillance will adhere to the terms of this IDIQ.

g. Performance Evaluation Meetings.

i. The CO may require the program manager to meet with the CO, COR, and other government personnel as necessary. The contractor may request a meeting with the CO when they believe such a meeting is warranted. Written minutes of any meeting will be prepared by the Contractor within two (2) calendar days following the meeting. The meeting minutes will provide a summarized transcript of the meeting, a participant list, discussion points, decisions, and any relevant action items that arose from the meeting. The program manager, COR, and CO will sign these minutes. If either party disagrees with any part of the minutes, they must notify the CO of their non-concurrence within seven (7) calendar days of receiving the minutes.

h. Other Meetings

i. For all other meetings, the contractor will be responsible for providing meeting materials and any other necessary administrative support. If meetings are required, they will primarily be conducted virtually or through teleconference, or as agreed upon by both parties. If needed, some examples of potential meetings that could be required on a Task Order are as follows:

1) Kickoff Meeting: When requested, the order will specify the date and time of this meeting. Typically, this is required within thirty (30) days of the order being awarded. Details regarding the meeting preparation will be provided on an as-needed basis.

2) Monthly Project Status Reviews: Meetings will discuss the monthly progress report and will take place approximately every thirty (30) days after the order is awarded, or as agreed upon by the parties. The Contractor is responsible for reporting on the previous month’s activities (including any risks, issues, or concerns, along with actual or recommended actions for their mitigation) and for projecting activities for the upcoming month. The Government will provide feedback regarding this progress and performance.

i. Monthly Progress Reports

i. With the monthly progress reports, the report will capture items such as, but not limited to, descriptions of the issues, performance problems, usage metrics, system updates, system downtimes and their associated causes, the status of potential replacements of key personnel (if any), outstanding government issues/concerns/data requests, helpdesk reports including metrics, and document any unresolved issues from the Contractor.

ii. The first report will include a detailed work outline of the project, organized by reporting period, to provide updates on all outstanding tasks. This report will be submitted electronically in MS Word format to the COR via email. Additionally, a separate Monthly Progress Report will be provided for each Task Order.

j. Invoices

i. The Contractor will prepare and submit to the COR, with a copy to the CO, all invoices along with the accompanying monthly progress report. Please refer to the Clauses on Submittal of Invoices for additional details.

ii. One invoice cannot be submitted for multiple Task Orders. A separate invoice will be submitted for each Task Order.

iii. Invoices will be submitted monthly, as agreed with the COR, or as stated in a task order.

k. Government Point of Contact for Quality Assurance.

i. The COR serves as the Government’s Point of Contact. If a distinct COR is assigned to a Task Order, a separate letter will be issued to the Contractor outlining that individual’s authority.

ii. Hours of Operation, Holidays, and Closures

iii. The Government’s hours of operation are generally from 8:00 AM to 4:30 PM Eastern Time, Monday through Friday, excluding legal holidays, for meetings with the COR. The Contractor’s system and helpdesk support must be accessible 24 hours a day, 7 days a week, 365 days a year once the system is deployed.

l. Official Federal Holidays

i. A list of official Federal Holidays is listed below:

3) New Year’s Day

4) Martin Luther King, Jr.’s Birthday

5) Washington’s Birthday

6) Memorial Day

7) Juneteenth National Independence Day

8) Independence Day

9) Labor Day

10) Columbus Day

11) Veterans Day

12) Thanksgiving Day

13) Christmas Day

ii. Visit the official website for specific dates of these holidays: additional days may be designated by federal law, executive order, or presidential proclamation.

iii. If the government shuts down, the contractor will receive information with appropriate instructions regarding their performance during this period. If necessary, a change order modification may be issued concerning potential reductions in the contractor's effort.

Security Requirements

a. The Contractor shall comply with all DOI and federal security standards, including

i. FedRAMP high authorization covers all hosting and data processing services. NIST SP 800-53 Rev. 5 controls and FISMA compliance are in place. Multi-Factor Authentication (MFA), PIV access, and encryption of data at rest and in transit are implemented. Continuous monitoring and incident response follow DOI Computer Incident Response Center (CIRC) protocols. Submission of IT System Security Plans and vulnerability scan results are required for all environments. Adherence to EO 14028 and security-related clauses in FAR and Office of Management and Budget (OMB) memoranda is maintained.

b. Computers and Information Technology Systems.

i. For contractor employees who receive a PIV card, the investigative requirements will vary based on duties of the position and the access needed. Vendor employees may not access data until passing a complete background investigation at a level designated by the COR (and at the discretion of OLES) prior to on boarding. The COR on the order will coordinate with the OLES to determine the level of investigation required.

ii. Contractor personnel will have access to sensitive information and federal information technology systems. They must exercise due care in safeguarding both the information and the integrity of IT systems. Contractor personnel working on the DOI network are required to take and pass an online IT security awareness course. Access information to this website will be provided by the COR after the award of the Task Order. Evidence of course completion must be submitted to the COR within one (1) week of starting work.

c. Safeguarding the Network

i. The contractor and its subcontractors providing Information Technology (IT) services to the DOI agree to comply with the applicable IT security policy outlined in this document. The contractor and other external organizations will be responsible for IT security for all systems connected to the DOI network or operated by the contractor and other external organizations for the DOI, regardless of location. This clause applies to any part of the contract that includes IT resources or services where the contractor and other external organizations must have physical or electronic access to DOI-sensitive information that directly supports the mission of the DOI. The term “information technology,” as used in this clause, means any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by the OMB Circular A-130.

ii. The contractor and its subcontractors will be responsible for adequately protecting all information used, gathered, or developed as a result of work under this task. The contractor will also safeguard all unclassified government data, equipment, and so on, by treating the information as sensitive business, controlling and limiting access to it, and ensuring that the data and equipment are secured within their facility.

iii. The contractor and its subcontractors will not publish or disclose, in any manner, the details of any programs, documentation, data, or safeguards designed or developed by the Contractor or other external organizations under this Contract, or otherwise provided by the Government, without the DOI Contracting Officer’s written consent. The Contractor may be required to sign non-disclosure or other appropriate security agreements. A written agreement between the DOI and any contractors, as well as other external organizations, will be entered into before any DOI data and information that is otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The contractor and other external organizations will agree to establish and adhere to security precautions deemed necessary by the DOI to ensure proper handling of data and information. As may be specified elsewhere in this contract, the Contractor agrees that:

1) The draft and final deliverables and all associated working papers and other materials deemed relevant by the COR that have been generated by the Contractor in the performance of this contract are the property of the U.S. Government and must be submitted to the COR at the conclusion of the tasks.

2) All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor.

3) To the extent necessary to conduct an inspection program that protects against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will provide the Government access to its, or other external organizations', facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations regarding the protection of DOI information. Cooperation may involve supplying relevant documentation that demonstrates compliance with federal and agency requirements and offering other assistance as deemed necessary.

iv. If new or unanticipated threats or hazards are discovered by either the Government, the Contractor, or any external organization, or if existing safeguards cease to function, the discoverer must promptly inform the other party. The Contractor must immediately report any suspected or confirmed loss of privacy data or other sensitive information, as well as any suspected computer security incidents, to the DOI CIRC (doicirc@ios.doi.gov) and the COR.

v. The Contractor will incorporate these clauses into all subcontracts when the subcontractor is mandated to have routine physical access to a federally controlled facility and/or regular access to a federally controlled information system. Failure to comply with these requirements will be grounds for termination.

d. Acquiring External IT Services (Processing, Storing, or Transmitting DOI Data on Non-DOI Systems.

i. The Contractor or other external organizations will develop, provide, implement, and maintain an IT System Security Plan for any system that involves the acquisition, transmission, or analysis of data owned by DOI, where any significant replacement cost could result in the Contractor’s or other external organization’s copy being compromised. This plan will outline the processes and procedures to ensure the appropriate security of IT resources that are developed, processed, or utilized under this contract. It will specify which parts of the contract this clause applies to. The Contractor or other external organization’s IT System Security Plan will comply with applicable Federal laws, including but not limited to: (e.g., the Clinger-Cohen Act of 1996 and the Federal Information Security Management Act of 2002) The IT System Security Plan will adhere to IT security requirements in accordance with Federal and FS policies and procedures, including but not limited to: National Institute of Standards and Technology (NIST) SP 800-53, and 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. The Contractor shall comply with all applicable FAR 52 security and privacy clauses, including those governing safeguarding of information systems, privacy protections, incident reporting, and restrictions on prohibited telecommunications equipment.

a. Source Code Ownership, Rights, and Open-Source Software Compliance

i. The Contractor shall comply with all federal laws, regulations, and Departmental policies governing source-code ownership, reuse, publication, and protection, including but not limited to:

• OMB Memorandum M-16-21, Federal Source Code Policy

• The Source Code Harmonization and Reuse in Information Technology Act (SHARE IT Act)

• The Department of the Interior’s Open-Source Software Policy dated November 8, 2021 (attached)

ii. The Government shall retain the rights to any custom-developed code, configuration scripts, system connectors, workflow logic, or other software artifacts produced under this contract. The Contractor shall ensure that all custom-developed code or modified code produced under this contract is inventoried, documented, and made available for Government reuse or release in accordance with Departmental policy, subject to applicable exemptions. This requirement applies to all subcontractors performing software development or customization activities on behalf of PSVAMS.

b. Security Banners

a. The Contractor and other external organizations will ensure that the appropriate security banners are displayed on all DOI systems, both public and private, operated by the contractors and other external organizations, before granting anyone access to the system.

b. Non-US Citizens: Additionally, there are security concerns regarding access to the DOI network, DOI systems, and DOI facilities for any individual who does not possess an I-551 Permanent Resident Card (Green Card). Although an individual may have the right to work in the country, they may not fulfill this contract’s security requirements without an I-551. To prevent potential concerns, the contractor will consult the government about any non-US citizen lacking an I-551 before engaging in any capacity on this contract.

Acquiring and/or implementing Software Applications, when applicable

a. At least one week before delivering any code required under this contract, the Contractor will provide the COR with the following reports for all code that will be delivered:

i. Source code testing results show all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief Information Officer of DOI. In the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.” The Contractor must then correct the vulnerabilities, resend the code, and ensure the integrity of the delivered source code.

ii. For web applications, the results of web application scanning tests will show all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of DOI. In the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.”

iii. For all applications: Release notes and updated user documentation.

Privacy Act Compliance

a. The system must comply with INTERIOR/DOI-45 SORN and associated Privacy Act controls. All Personally Identifiable Information (PII), including fingerprints, adjudicative histories, and clearance levels, must be securely stored and auditable. Access must be role-based, logged, and restricted to authorized individuals. The contractor shall implement breach notification procedures and provide privacy training for all assigned personnel.

b. The contractor is responsible for complying with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies it.

c. The systems of records; and

i. The design, development, or operation work that the contractor is to perform.

ii. The contractor will include the Act notification specified in this contract in every solicitation, in every resulting subcontract, and in every subcontract awarded without a solicitation when the work statement in the proposed subcontract necessitates the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

iii. Include this requirement, specifically this paragraph, in all subcontracts awarded under this contract that necessitate the design, development, or operation of such a system of records.

iv. In the event of violations of the Act, a civil action may be initiated against the involved agency if the violation pertains to the design, development, or operation of a system of records on individuals to fulfill an agency function. Criminal penalties may also be enforced upon the officers or employees of the agency when the violation relates to the operation of a system of records on individuals to achieve an agency function. For the purposes of the Act, when the contract involves the operation of a system of records on individuals to accomplish an agency function, the Contractor is regarded as an employee of the agency.

Definitions of the Clause

a. “Operation of a system of records,” as used in this clause, refers to the performance of any activities related to maintaining the system of records, including the collection, use, and dissemination of records.

b. “Record,” as used in this clause, refers to any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history, which contains the person’s name or an identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint, voiceprint, or photograph.

c. “System of records on individuals,” as used in this clause, refers to a collection of records maintained by any agency from which information can be retrieved using the name of the individual or an identifying number, symbol, or other identifying detail assigned to that individual.

d. Security Banner. Contractors and other external organizations must display the following banner on all DOI systems containing Privacy Act information they operate before granting anyone access to the system:

e. “This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93-579). Any privacy information displayed on the screen or printed must be protected from unauthorized disclosure. Employees who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both.”

Section 508 Compliance Requirements

a. The solution must comply with the latest Section 508 standards. All user interfaces must be accessible through screen readers, alternative input devices, and adhere to Web Content Accessibility Guidelines (WCAG) 2.1 AA criteria. The contractor shall submit a Voluntary Product Accessibility Template (VPAT) with the technical proposal and after implementation.

Government-Contractor Relations

a. This contract establishes a non-personal services relationship between the Department of the Interior and the Contractor for the delivery of the PSVAMS solution. Contractor personnel shall not be considered Government employees and shall not be subject to the supervision or control typically associated with an employer-employee relationship. Contractor staff are expected to perform their duties independently, without direct oversight from Government personnel. While coordination with the Government is essential, all contract-related actions must be executed under the authority of the Contractor's management structure.

b. Notice: The Contractor must notify the CO in writing promptly, within three (3) calendar days from the date of any incident that the Contractor believes constitutes a violation of this requirement. The notice should include the date, nature, and circumstances of the conduct; the name, function, and activities of each Government employee or Contractor official or employee involved or knowledgeable about such conduct; identify any documents or the substance of any oral communication involved in the conduct; and provide an estimate of the time by which the Government will respond to the notice to minimize costs, delays, or disruptions in performance.

Inherently Governmental Functions

a. Under this agreement, the Contractor is prohibited from performing inherently governmental functions as defined in FAR 7.503. Such functions include making decisions that require the exercise of discretion in applying Government authority or involve value judgments that commit the Government to a specific course of action. If any task under the PSVAMS contract nears the threshold of inherently governmental activity, the Contractor must promptly notify the CO for clarification or redirection.

Confidential Information

a. During the performance of this contract, the Contractor may have access to sensitive or confidential Government information. Disclosure of any such information to unauthorized parties is strictly prohibited. The Contractor is responsible for implementing robust safeguards to ensure that all data handled under the PSVAMS initiative is protected in accordance with the Privacy Act, the FISMA, and DOI policies. If required, Contractor personnel shall sign appropriate non-disclosure agreements before accessing sensitive data or systems.

b. The term “information,” as defined herein, includes, but is not limited to, oral or written communication, planning documents, strategy, research documents, data, conclusions, field notes, computer files, designs, equipment, photographic or video media, and conversations related to any work performed for DOI. The term “information” also encompasses internal Government memoranda, both draft and final documents, procurement-sensitive information that includes details about other contractors, cost or pricing details, financial information, as well as information marked “Confidential Business Information” or information not specifically labeled but still falling under the definition of “Confidential Business Information” and “Attorney-Client Work Products.”

c. Any information viewed, received, obtained, developed, or generated in connection with the work assigned or performed with DOI is sensitive and may serve as a basis for identifying and evaluating policy options, planning future budgets and work priorities, or addressing ongoing or future litigation. Some information may involve additional sensitivities and restrictions regarding use or disclosure, including “Confidential Business Information” and “Proprietary Information.”

Travel

a. All travel conducted under this contract must be pre-approved by the COR and carried out in accordance with the Federal Travel Regulation (FTR). The Contractor is required to use cost-effective travel options and keep accurate records of all travel expenses, including original receipts, for reimbursement purposes. Any deviations from authorized travel must be documented and justified in advance to the COR. The COR will be responsible for disseminating all travel requirements and restrictions to ensure the Contractor’s awareness.

i. For firm-fixed-price orders in which travel has been negotiated and agreed upon by the parties, no travel estimates are needed for submission prior to traveling to the COR.

ii. For orders where travel cannot be negotiated as part of the award, the Government will create a reimbursable line-item for travel expenses. To receive payment, all travel estimates must receive approval from the COR at least fourteen (14) calendar days before the anticipated travel date.

iii. The Contractor will provide actual incurred travel expenses for reimbursement. At a minimum, any bill over $75.00 will accompany the invoice for trips.

iv. Travel expenses will be calculated using the per diem rate(s) outlined in the FTR that are in effect at the time the requirement is awarded (e.g., Task Order, Change Order Modification).

Task Areas

a. Option 1 – Software-as-a-Service (SaaS): The contractor shall provide a fully configured, COTS SaaS solution hosted in a FedRAMP-High cloud. The system must be deployable immediately with configuration-based workflows for adjudication, CV alerts, and reporting.

b. Option 2 – Platform-as-a-Service (PaaS): The contractor shall provide a customizable platform with COTS modules that fulfill the functional requirements. The Government will set up workflows and dashboards.

c. Note: Infrastructure-as-a-Service (IaaS) is not acceptable under this SOW.

a. Task Area 1: Implementation, Installation, Transition of Old Database Records

i. The Contractor will lead the deployment of the PSVAMS solution, which encompasses installing necessary software components, configuring the system, and transitioning all legacy vetting data to the new platform. Activities will involve data mapping, cleansing, transformation, and validation to ensure the completeness and integrity of the migrated information. A formal implementation plan, including timelines, milestones, and contingency measures, will be submitted for Government review and approval. This implementation plan must explicitly detail how the PSVAMS deployment, system configuration, and data migration will support the dynamic nature of a seasonal surge team, particularly in terms of rapid user provisioning, background investigation processing, and data handling for high-volume, potentially short-term personnel, including those from the BIA and BIE. The plan must specifically address how the system will manage data related to these fluctuating user groups, especially regarding background investigations and continuous vetting for seasonal employees. Continuous Vetting Alerts Management Continuous Vetting Alerts Management

ii. RapBack Program Configuration: As part of the system configuration activities, the Contractor shall implement and configure all necessary functionalities within PSVAMS to fully support the Department’s RapBack program management. This includes capabilities for centralized enrollment and tracking of individuals covered by the FBI RapBack program, processing and logging recurring criminal history checks, and maintaining comprehensive records to ensure accurate coverage and avoid duplication of efforts. The implementation plan shall detail the specific configurations and workflows for this critical program element.

b. Task Area 2: Hosting with Application and Data Management Services

i. The Contractor shall provide cloud hosting for PSVAMS in a FedRAMP-authorized environment at the High-baseline. Services must include secure application hosting, data backup and recovery, system monitoring, patch management, user provisioning, and support for API and flat-file data exchange. All hosted services shall be governed by DOI’s cybersecurity requirements and must maintain a service availability rate of at least 99.9%. The cloud hosting solution must demonstrate elasticity and performance capabilities to handle sudden, significant surges in user activity and data intake during peak seasonal hiring periods. This includes accommodating the combined workload from all participating bureaus, including BIA and BIE. The 99.9% service availability rate must apply universally across these various operational loads.

c. Task Area 3: Helpdesk Support Services

i. A comprehensive helpdesk will be established to provide Tier 1 and Tier 2 support for all PSVAMS users. Support services must be available 24 hours a day, 7 days a week, 365 days a year. The helpdesk will manage incident tracking, user troubleshooting, escalation protocols, and resolution reporting. Monthly metrics must be submitted to the Government detailing support volume and responsiveness. Helpdesk services will be unified across all Department users, including those involved in seasonal surges and personnel from BIA and BIE.