Attachment 1 - LPR IDIQ Statement of Work.pdf

FEDERAL BUREAU OF INVESTIGATION

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

STATEMENT OF WORK

License Plate Reader IDIQ

For the

Directorate of Intelligence

Section C - Statement of Work

May 11, 2026

1 Scope

This is a contract to establish an Indefinite Delivery/Indefinite Quantity (IDIQ) for purchase of Internet/Cyber Security Data Subscriptions on a Task Order (TO) basis to the Federal Bureau of Investigation (FBI) Directorate of Intelligence in support of Open Source Intelligence (OSINT) / Social Media searches and processing from License Plate Reader (LPR) tools or their data, to identify multiple investigative threats and use cases, and meet the needs of a diverse Open Source Intelligence user base in accordance with law, regulation, and policy.

1.1 Description of Services/Introduction

This is a non-personal services contract. The Government must not exercise any supervision or control over contractor employees performing the services herein. Such contract service providers must be accountable solely to the Contractor who, in turn is responsible to the

Government.

This SOW describes the full range of the FBI's information requirements for law enforcement and commercial LPR data. No single contractor is expected to meet all data requirements defined in Section 3. However, each contractor must identify which datatypes and datasets it can provide and at what price. Contractors must certify that the information provided is lawfully obtained and not under contestation by federal, regional, state or local legal processes.

Contractors must address all items listed and specify which ones will be provided in response to search requests by FBI users.

1.2 Background

The FBI’s mission is to “Protect the American People and Uphold the Constitution of the United

States” and this mission is core to all that we do as an organization. Through this mission, the

FBI's priorities are to prevent and reduce violent crime, defend the homeland, rebuild public trust, and maintain fierce organizational accountability. The Directorate of Intelligence (DI) of the FBI manages the Public Source Program (PSP), providing tools and training to assist

Headquarters Divisions and Field Offices in conducting lawful research and searches against

Commercially Available Data (CAI) and Publicly Available Information (PAI), which includes

Social Media data that is publicly available. The DI PSP also ensures users complete privacy and civil liberties legal training to perform open-source searches in accordance with applicable federal laws, regulations, and policy. One major type of Open-Source data that the PSP works with is License Plate Readers (LPRs).

The growing use of the internet has created significant opportunities for people to create, share, and exchange information, but also opportunities for threat actors to engage in a variety of criminal activities. As access to virtual mediums is increasing and diversifying, terrorists, violent extremists, malicious cyber actors, and foreign adversaries take advantage by having greater opportunities to make criminal threats, traffic individuals and drugs, commit fraud, and execute cyberattacks. Estimates show that approximately 5.24 billion people worldwide use social media in some fashion, which is 64% of the total population. Identifying threat-related data relevant to an authorized law enforcement purpose can be challenging. However, efficiently identifying, organizing, and analyzing lawfully collected PAI and CAI data is paramount to preventing, investigating, and defeating threats to our nation and American interests abroad. Tools that capture such relevant information are important in helping the FBI solve the complexities of this multifaceted problem.

To evaluate and manage threats to personal safety, property, and law enforcement, the FBI requires professional service firms that can provide License Plate Readers (LPRs) for tracking subjects on roads and highways over the US and its territories. This request must be satisfied by

Software as a Service (SaaS), by FBI users logging into a Contractor website for the FBI enterprise.

The FBI has a crucial need for accessible LPRs to provide a diverse and reliable range of collections across the United States. This data should be available across major highways and in an array of locations for maximum usefulness to law enforcement. For this reason, one LPR tool will not meet the requirement, and the FBI will create an Indefinite Delivery Indefinite Quantity

(IDIQ) contract providing various tools with different coverage for which TO’s can be placed against with requirements specific to the end-user need. More detailed requirements are found below. In all cases, the FBI is seeking new and cutting-edge capabilities in these systems.

This acquisition strategy is a multi-award IDIQ to allow for various LPR tools that have coverage in different geographic areas of the US and its territories, as well as tools that meet the needs of different investigations in accordance with law, regulation, and policy. The FBI intends to develop a storefront of approved LPR tools. The FBI reserves the right to single award each

Contract Line Item (CLIN) contained within this contract.

2 Applicable Documents

None

3 Requirements

This SOW describes the full range of the FBI's information requirements for law enforcement and commercial LPR data. For each of the CLINs outlined below in Table A – CLIN Structure, the requirements in Section 3.0 must be provided as part of the proposed solution for each region.

The FBI requests professional service providers with expertise in LPR data and software to include publicly available and commercially available information platform offerings. This request is to assist the FBI in having the ability to acquire and utilize LPR data in a system with rich capabilities.

The ability to segment and customize LPR data collection capabilities is important for tools to align with authorized law enforcement usage. More detailed requirements are found below.

The FBI also requests capabilities that may be new or cutting-edge and which add value to the

FBI.

The Contractor's License Plate Reader (LPR) system must have the ability for the user to enter search criteria to include license plate information, and other descriptive data such as vehicle description information, time/date criteria, and geo-location criteria. Additionally, the system must provide search result notifications. The Contractor system must have the ability to access and/or query cameras across the United States and its territories. The Contractor system must be capable of providing this data in near real time.

Table A: CLIN Structure

CLIN No. Coverage Area

0001 Eastern Lower 48 & any additional coverage areas

0002 Western Lower 48 & any additional coverage areas

0003 Hawaii & any additional coverage areas

0004 Puerto Rico & any additional coverage areas

0005 Alaska & any additional coverage areas

0006 Outlying Areas & any additional coverage areas

CLIN 0001 – Eastern 48 (East of the Mississippi River)

The proposed tool must be successful and active in 75% locations within states located east of the Mississippi River.

CLIN 0002 – Western 48 (West of the Mississippi River)

The proposed tool must be successful and active in 75% locations within states located west of the Mississippi River.

CLIN 0003 – Hawaii

The proposed tool must be successful and active in 75% locations within the state of Hawaii.

CLIN 0004 – Puerto Rico

The proposed tool must be successful and active in 75% locations within Puerto Rico.

CLIN 0005 – Alaska

The proposed tool must be successful and active in 75% locations within the state of Alaska.

CLIN 0006 – Outlying Areas

The proposed tool provides services for areas in any of CLINS 0001 through 0005 that may be less defined areas or regions or areas that are not easily grouped to fit within the first 5 CLINS.

Other U.S. outlying areas may include but are not limited to Guam, U.S. Virgin Islands, Tribal

Territories.

NOTE: The FBI intends to award each CLIN to a single vendor. However, if a single vendor is unable to meet all requirements for a given CLIN, the FBI reserves the right to award that CLIN to up to two vendors.

OnRamp Authority:

The Government reserves the right to conduct onramp competitions at any time during the period of performance to add additional contractors to one or more CLINs under this IDIQ.

Onramp solicitations may be limited to specific CLINs. Contractors added through an onramp will be eligible to compete for orders only for the CLINs for which they are awarded. Existing

IDIQ contractors will not be required to recompete.

OffRamp Authority:

The Government reserves the right to offramp contractors from one or more CLINs under this

IDIQ. Offramping may occur due to poor performance, nonresponsiveness, loss of eligibility, or other reasons determined to be in the Government’s best interest. Offramping may be executed through nonexercise of options, termination, or other appropriate contractual mechanisms.

3.1 System/Company:

This section describes the full range of the FBI's information requirements for law enforcement and commercial LPR data.

Contractors must certify that the information provided is lawfully obtained and not under contestation by federal, regional, state or local legal processes. Contractors must address all listed items and specify which ones they are able to provide in response to search requests by

FBI users.

The Contractor must provide law enforcement and/or commercial license plate reader data provided through the Contractor’s existing platform under contract/delivery order.

The contractor must be a US-based company or subsidiary located within the United States.

The Contractor must provide the License Plate Reader (LPR) data required under this contract.

The FBI does not have its own License Plate Readers to bring to this contract, nor does it have its own LPR digital data/imagery.

The Contractor’s tool must provide the FBI the following capabilities:

Coverage/Database

• Ability to list and provide region, state, and city coverage(s)

• Ability to provide total records collected over specified period

• Ability to provide daily record intake over time.

• Provide the FBI the location of server(s) where data is stored to verify compliance with state / local laws regarding LPR.

• Ability to provide the FBI the source of information (i.e. red-light cameras, repossession vendors, speed cameras, etc.)

• Ability to share / create maps depicting camera coverage (i.e. heat mapping) o Vendors must provide a coverage map within the technical response, clearly depicting their operational footprint and indicating the percentage of each region covered for the CLIN(s) proposed.

Analytic Capabilities:

• Ability to query the LPR data by:

o Partial and/or full plate o Plate state o Location where it was read / searched o Physical address o Vehicle Make/Model

• Ability to query multiple plates at one time

• Ability to provide blind logging or encrypted searches of hot lists and LPR data. Blind logging requires the tool to encrypt the search query, perform the search as needed, provide results of the search to the user, and then delete the search criteria. The

Contractor must log that a search was made by FBI and log the timestamp for that search.

• Ability to provide record count limitations for return on searches

• Ability to provide common/same plate analysis over multiple locations and times

• Ability to conduct offline (queued) searches not requiring user/s to be present in an interactive session (see also Persistent Searches below)

• Ability to offer real-time searching, modification/addition of hotlists. Importing Data:

• Ability to import the NCIC hotlist or other automated hotlist files

• Provide an API to ingest data into a government system

Notifications:

• Ability to tag items of interest

• Provide real-time or near real-time notification of hot listed tags by sending emails and/or by other well-known application. Real-time means being sent with little to no lag time once a search parameter result is found by the system.

• Ability to add batch lists of tags for hotlist notifications (any record count limitation must be identified)

• Ability to remove or add multiple hot listed tags at one time

• Ability to customize template of email notification layout

3.2 Security

All connections between the FBI and the Contractor must be encrypted. The technical encryption must meet FISMA and FEDRAMP Moderate standards. Contractors must never log/retain any system data communicated between the FBI and the Contractor. The FBI requires that the Contractor must provide support and cooperation to any possible computer security incidents involving the Contractor’s systems or applications. The Contractor must describe and include in its submission its process for notifying the FBI of possible security incidents. This must include providing technical points of contact and supporting technical documentation such as systems configurations, related security files, contingency plan, and recovery process.

The Contractor must be ready to modify, within reason, their system for legal reasons if required, for instance, for Privacy and Civil Liberties purposes.

3.2.1 Queries

Due to the sensitivity of investigations, the Contractor must provide firewall FEDRAMP

Moderate and CJIS Security Policy level protection to the interface to ensure queries and ingestion information remain protected. (See CJIS Security Policy further down in this document.) Searches conducted on the Contractor’s interface by FBI employees must remain untraceable under blind login. The entries and activities must remain untraceable and cannot be stored by the Contractor, except for the fact that a search was conducted by FBI and the timestamp. This stands regardless of the access being made from individual accounts or system-to-system service accounts. Searches must remain non-attributable.

3.2.2 Reporting Security Incidents

The contractor must inform the FBI of any potential or actual computer security incidents involving or potentially involving FBI information or users as soon as the contractor becomes aware of the issue. The contractor must notify the FBI immediately in the case of a breach of

FBI data involving personally identifiable information (PII), to include names and emails.

3.3 Reporting/Auditing:

The contractor must provide:

• Ability to generate reports in a variety of formats such as PDF, XLSX, and/or CSV (any record count limitation must be identified)

• Ability to conduct raw data searches (to include batch plate search) which sends results in a defined report via email to specific email addresses

• Customized auditing procedures specifically to be conducted by the FBI upon request.

3.4 Statistics/Metrics

The Contractor must provide tracking, auditing, and statistics on tool usage by FBI personnel, upon request. Basic statistics required include total number of accounts, number of searches monthly, number of one-time searches vs. persistent searches (if the system distinguishes those), duration of use, last login of users, and so forth.

3.5 Auditing

Due to the occasional need for auditing, contractors must provide information on their audit capability. The FBI requires that the Contractor not keep any copies or duplicates of any logs once provided to the FBI. Additionally, the contractor must not review or analyze any search traffic conducted by the Government.

3.6 Access

The contractor must ensure access to the interface is completed/obtained from an FBI issued device. The Contractor must be responsible for determining if criminal justice information (CJI) is being accessed, regardless of encryption. If CJI is being accessed, the Contractor is required to adhere to the latest version of the CJIS Security Policy in terms of Multi-Factor Authentication

(MFA). Under the CJIS Security Policy, Version 5.9.5, the Contractor must implement two-factor authentication. The authentication factors are defined as the following:

• Personal identification username/number

• Physical authenticator such as a cryptographic private key

• Biometric

• Physical authenticators such as Personal identity Verification card or Department of

Defense Common Access Card

The contractor must be responsible for ensuring FBI user access is not disrupted by security protocol changes, pursuant to CJIS Security Policy, Version 5.9.5. CJIS Security Policy is located at: https://www.fbi.gov/file-repository/cjis/cjis_security_policy_v5-9_20200601.pdf/view

If the contractor is not accessing CJI, the CJIS Security Policy MFA requirements will not apply.

The Public Source Program will require that the contractor must implement use of two-factor authentication utilizing FBI-only email addresses to receive a one-time passcode for access. The

Contractor must ensure FBI user access is not disrupted by security protocol changes.

3.7 Password

The contractor must create multi factor authentication through a validated IP address. The FBI requires that the Contractor must enforce a password change policy (every 90 days) for online and system-to-system service accounts. In addition, the Contractor must provide auto suspension of individual user accounts after 90 days of inactivity, and full deletion after 180 days of inactivity. These policies must work in harmony with the account creation and management processes used by PRCAs and Local User Administrators (see below).

3.8 Training

3.8.1 Onsite Training

If requested by the PSP Program of the FBI, in-person training must be conducted by contractor onsite. In-person training must occur, at a minimum, once every quarter, unless the Contractor introduces new updates that need more attention. In that event, the Contractor must provide needed training before new updates come online. The on-site training must be paid by the https://www.fbi.gov/file-repository/cjis/cjis_security_policy_v5-9_20200601.pdf/view

Government under Federal Travel rules (see ODC section below). Costs must be estimated based on those regulations. Completion and total numbers must be reported for monitoring to

PSP training coordinators. Credit may be given to the students in FBI’s Training Tracking system.

Note: For initial roll-out of the system upon contract award, more onsite training must be required, depending on the breadth of national coverage and where the LPR data would be utilized.

3.8.2 Online Material

Training material must be accessible via contractor interface and/or YouTube videos saved in restricted environment that meet the standards set forth in Section 504 of the Rehabilitation

Act of 1973. Closed captioning must be available on all videos to ensure access to hearing impaired personnel. Soft copies must undergo review by the FBI PSP after each major release.

3.8.3 Online Training

Contractor must provide at least one monthly online training session, and ad hoc training when requested, to FBI personnel. One of these monthly sessions must be directed to new users and present the interface, where to find resources, basic use of the system, troubleshooting steps, helpdesk structure and process, and Points of Contact (POCs). Additional sessions must focus on new features, system upgrades, and best practices derived from usage. Course outlines and schedules must be provided to the Public Source Program (PSP) Training Coordinator for review and approval prior to providing any training.

Furthermore, users must have access to training and training material for tool usage.

Contractors must provide both virtual (live) and self-paced on-demand training modules.

Training must be available at different times of the day to accommodate various time zones.

Contractor must have training ready to deliver upon contract execution.

Contractors must provide user training for FBI personnel as part of the basic tool cost. This training must be geared towards users consisting of but not limited to the career paths below:

• Intelligence Analysts

• Management and Program Analysts

• Special Agents

• Tactical Specialists

If the Contractor is charging for transactions per month, all database transactions performed as a part of any training must be included in the package cost. The FBI will not assume any cost for testing new or existing products and/or solutions. Holders of newly created accounts must receive initial training when gaining access to credentials to the tool.

3.9 Helpdesk

The Contractor must maintain a Helpdesk for access issues or other system problems, and the

Helpdesk must be familiar with the sensitivities of government and law enforcement. A specific mailbox to address the need for assistance, as well as a phone number to call, must be created by the contractor ensuring that requests be acknowledged within a specified timeframe. All emails/calls must be received/reviewed/responded to by CONUS personnel from a Helpdesk located in the United States of America (USA).

The Helpdesk and / or POC must be available 24/7 for on-call issues. The response must be within 10 minutes of the FBI user reaching out for help.

When seeking assistance, the FBI PSP program will gather information about the problem from the user(s) and contact the Contractor Helpdesk for solutions. The FBI must be assured of the confidentiality of their queries, of safety in disclosing the location of the office asking for help, and of the legitimacy of the call recipient. Furthermore, a designated POC from the contractor, serving as the main POC representative of the Contractor, must also be assigned to this contract as support for overarching matters pertaining to the contract as well as the coordination of system-to-system and/or alerting support. If the Helpdesk is unable to assist, this POC must be the first escalation point.

3.10 User Account Management

Each TO issued under this IDIQ will stipulate requirements outlining one or all the number of users, number of accounts required, or number of queries. The tool proposed must be robust enough to handle the required number of accounts for FBI usage for a given TO.

For pricing, if the tool is not offered with a full Enterprise License, then the FBI requests Tiered licensing structure. The coverage required must be logical based on the Field Office Area of

Responsibility (AOR). In addition to Field Offices, at least 4 Headquarters divisions also must receive accounts. These licensing requirements must be flexible when there are major nationwide events.

To support the effort of creating accounts, the Contractor must provide account and username management tools to the FBI. Since users span across all 56 FBI Field Offices and Resident

Agencies as well as HQ Divisions, the monitoring of accounts must require two levels of administrative rights outlined below.

• Public Source Program Coordinators (PSPC): The contractor must provide five (5) administrative accounts to the FBI, to be maintained at the FBI program level, that will allow for the creation, deletion, and maintenance of accounts and supporting of local account administrators. In case of emergency, administrative POCs can generate and maintain user accounts on behalf of a field office/division with no designated or available Local User Administrators. These POCs will also facilitate the transfer of users from one field office to the next.

Administrative accounts must allow for the internal query of user accounts at each level.

The PSPCs must be able to generate a list of the existing administrative accounts (from both PSPCs and Local User Administrators) that must display full name, account status, username, Field Office/Division, and last login at minimum.

• Local User Administrator (less than 300 total): The Contractor must provide user account management capability for local FBI account administrators to create, suspend/disable user accounts, reset user account passwords, view all accounts with associated account information (active or inactive), and generate user account reports that must display full name, user ID, email and last login date and must be exportable to

MS Excel or CSV.

• Service-to-Service Accounts: The Government requires Service-to-Service (S-to-S)

Accounts to be provided for automated flow of data in special circumstances. These will function through API and provide large downloads of information when requested by the FBI

3.11 Monitoring and Reporting

The FBI must receive reports by the 10th of each month for all the FBI public records activity in the preceding month. Monthly reports must be submitted directly to the FBI Administrative PM and PSP inbox (DI-PSP@fbi.gov). Any other distribution must be requested and/or approved by the PM. Monthly reports must include the data and more detailed reporting requirements defined in the Monthly Reports section.

3.12 Non-Release of Information – Publication by Contractor Personnel

The Federal Bureau of Investigation (FBI) requires that contractors must not divulge, publish, or disclose information or produce material acquired or derived from the performance of their duties. For purposes of this clause, "Information" must include but not be limited to any or all media including on the web or web sites, publications, studies, books, theses, photographs, films, or public announcements, press releases describing any part of the subject matter of this contract or any phase of any program hereunder, except to the extent such as:

• Already known to the contractor prior to the commencement of the contract

• Required by law, regulation, subpoena or government or judicial order to be disclosed

No release of information must be made without the prior written consent of the FBI Office of

Public Affairs (OPA) and the CO. The contractor and author are warned that disclosure is not without potential consequences. The FBI will make every effort to review proposed publications in a timely manner to accommodate these and other publications. These obligations must not cease upon completion of the contract.

3.13 Additional Requirements

The contractor must:

• provide a coherent, organized, and intuitive Graphic User Interface (GUI) that is easily navigated by non-technical users.

o The GUI must not be cluttered or confusing and must be able to be understood without needing extensive training. Searches must be easily configured and launched, and the GUI must allow users to populate and analyze search results without assistance.

• provide Software as a Service (SaaS) for FBI users to log into a Contractor website to access the tool.

• provide capability to access and use the system from various commercial web-browsers, specifically Chrome and Edge, among others.

• provide the FBI with documentation in the original proposal demonstrating the security posture of their system, for example FedRAMP-certified to the Moderate level with

256-bit encryption, and other stringent security measures that are taken to safeguard the user data in the system, and update/recertify the information once a year to the

Government.

• provide information to the FBI once per year notating how FBI user information is handled.

• Furthermore, the contractor must ensure system availability of 99% for use by the FBI.

In the event of service outage, the Public Source Program (PSP) must be notified of service outage and time required to remediate within one hour of event occurrence.

Hourly updates must be provided until restoration of services. Email notification must be provided immediately upon restoration of services. For any scheduled downtime for maintenance the contractor must provide notification at least 48 hours in advance.

• be ready to modify, within reason, their system for legal reasons if required, for instance, for Privacy and Civil Liberties purposes.

Software must not be downloaded, installed, or integrated into FBI computers.

3.14 508 Compliance

The Contractor must ensure their system is 508 Compliant, or working towards 508

Compliance, including acceptable color-blind accommodations. The Contractor must provide a

508 Compliance scorecard in their proposal, and must provide the scorecard yearly, showing progress in making their system 508 Compliant.

3.15 System Reliability

The Contractor must provide notice of all upgrades and modifications to the system. This notification must be provided in a timely manner for the FBI to review the changes and ensure that all legal constraints and ease-of-use requirements will be met by the changes. The

Government will inform the Contractor if the upgrades being proposed are not in compliance with Government constraints. The Public Source Program must coordinate testing and evaluation for any enterprise-wide updates to enable successful adaptation.

3.16 Artificial Intelligence (AI) Description

The Contractor must provide artificial intelligence-based analytics to include, natural language processing (NLP) and/or machine learning (ML) analytic capabilities. Useful AI features include, but are not limited to, event timelines and event tracking. The Contractor must provide the

Government reports and details of all AI functionality in their system upon request. For example, the Contractor must share with the Government details of how their AI is trained and how bias is managed.

3.17 Data Sources

The Contractor must ensure the user has access to robust LPR data sources. This must include as many sources as possible, such as traffic cameras, toll plazas, commercial cameras, law enforcement cameras, etc. Contractor must provide a data retention of up to 30 days minimum and up to 120 days if possible and allowed by local, state, and federal laws.

The Contractor must provide data export capability in structured data formats and/or text-based data formats.

3.17.1 Ad Hoc Searches

The Contractor system must provide the user the ability to enter single-click search criteria and conduct ad hoc searches. Search capabilities must include the following:

• License Plate information (full/partial)

• Time/Date criteria

• Location

• Other data that the tool provides may include:

o Plate state o Vehicle Make/Model o Vehicle Description

• The system must provide sorting and filtering capabilities of data.

3.17.2 User Enabled Persistent Searches

The Contractor must have the ability to create and run persistent searches to collect over time without having to recreate and perform multiple queries. Searches must include the following data sets:

• License Plate information (full/partial)

• Plate state

• Location

• Vehicle Make/Model

• Vehicle Description

• Time/Date criteria

The Contractor must ensure the User can customize how to leverage the data (not just traditional text-based queries, but other ways to shape the findings, such as geolocation, start

/end time range, image-based searches, if possible, etc.).

3.17.3 Geospatial Search Capabilities

The Contractor must provide the ability to search data by city, county, state, region, country, and user-defined geo-fencing capabilities. This capability must include map visualizations. The tool must provide the ability to focus on customer-specific location areas of interest (e.g., selecting specific regions/boundaries, creating Field Office territory maps by counties, etc.).

3.17.4 Image Capture

The Contractor must provide image reviewing capabilities for plates that are found to meet search criteria. Preferred but not required, the Contractor must provide image search abilities that include some or all of the following: reverse image search; Optical Character Recognition

(OCR) of text (in large and common languages) in images; and emojis and object identification.

3.17.5 Video Capture

The Contractor must provide video reviewing capabilities. The Contractor must provide ability to analyze video. The Contractor must provide video search abilities. Preferred but not required, video analysis may include Optical Character Recognition (OCR) of text (in large and common languages) in video. Other preferred features include: Providing object identification, automated and multi-lingual video transcription capabilities, and pulling text and data from live stream and/or short-term video feeds and video postings.

3.18 Preferred Capabilities

Each contractor must identify which of the preferred requirements it can provide.

LPR Data Analysis: The Contractor must provide the ability to conduct analysis across time and location with advanced filtering capabilities within their data holdings.

Mobile use: The contractor must provide the ability for their tool to be used in mobile phone applications, and the capability of working in a mobile interface.

Contractor must provide the ability to offer at a minimum real-time searching, modification/addition of hotlists, and real-time mapping with historical hits of hot listed tags.

• Contractor must ensure that the tool is capable of being updated by and from outside

Government structured data and hotlists. These lists include National Crime

Information Center (NCIC) and other sources of data. System must accept batch and manual updates. The Contractor must inform the Government about record count limitations imposed by laws, regulations, and policies, and the process utilized for daily replacement of hotlists.

In-system Tracking and Collaboration: The Contractor must provide robust collaboration capabilities within the system. Examples of collaboration features include, but are not limited to, sharing data streams and filters with other users, ability to flag, tag, color-code, comment, and annotate data returns that others can see.

During the lifecycle of the contract, the development of new capabilities is extremely likely. The

FBI encourages contractors to present their proposed process for introducing new capabilities that are or will become available to the organization. It is expected that future access to these capabilities must be provided under the proposed pricing structure for basic/optional searches.

Any capability and features proposed must be provided to the PM and COR for consideration.

No proposed capability or feature that impacts pricing under this contract/agreement must be implemented without the express written acceptance by the FBI CO.

4 Key Personnel

Not Applicable

5 Place of Performance

Performance of this contract does not require contractor to access FBI facilities.

Access to systems may be required from any FBI location, with each TO issued under this IDIQ identifying end user Division, Point of Contact, and other identifying information.

6 Deliverables

Monthly Status Report

The Contractor must provide monthly status reports to the Contracting Officer (CO) and the

Contracting Office Representative (COR). The format will be agreed to by the Contractor and

COR at the start of performance, but the contents must contain the following, at a minimum:

• Activities, accomplishments, and issues reports

• Summary of services and pricing information

• Monthly summary and detailed usage reports o Individual o System-to-system (when applicable)

• Monthly account listing reports broken down by Field Office o New accounts o Transferred accounts o Suspended accounts o Deleted accounts

• Completed trainings broken down by locations, subjects, and lists of attendees

For each monthly report, the FBI requires data from the current month, as well as all previous months from contract/agreement date. Finally, the FBI requires cost data to be included in reports to include charges per search /user, total estimated cost for the month, and cumulative cost and usage data for the current contract/agreement period.

Monthly Meeting

Meetings with contractors to discuss the reviewed reports are to occur monthly throughout the Fiscal Year (FY). They can be held via conference call but must be occur in person at least twice each year with the PSP team in attendance. In person meetings may be waived by the CO and/or COR. The standard agenda will be as follows:

• Contract o Invoice status o Cumulative expenditures

• Reports o Usage (previous month and current fiscal year) o Account maintenance activities

• Training o Completed trainings o Upcoming trainings

• System upgrades/changes o Release notes o Impact on users

• New capabilities and recommendations o Presentations o Pricing models (licenses/accounts/usage)

The Contractor is responsible for providing the following deliverables:

Deliverable Title Deliverable Date SOW Reference

Monthly Status Reports 10th of Every Month 6.0

Monthly Meeting Synopsis Within 5 Business Days of Meeting 6.0

7 Electronic Invoicing Requirements

The Federal Bureau of Investigation (FBI) requires Contractors to submit invoices and supporting documentation electronically through the Invoice Processing Platform (IPP). IPP is a secure, web-based electronic invoicing system provided by the U.S. Department of the

Treasury’s Bureau of the Fiscal Service (Treasury) in partnership with the Federal Reserve Bank of St. Louis (FRSTL). IPP is available at no cost to any commercial vendor or independent contractor doing business with a participating government agency. To learn more about IPP, please visit IPP.gov.

Invoice Submission

Contractors are required to create and submit electronic invoices using the IPP system.

Invoices submitted by email will not be accepted. This requirement applies immediately upon contract award. For contract-specific questions, please contact the designated contracting officer for your contract.

Obtaining IPP Access

If your company has already enrolled in IPP:

You will not be required to re-register. Please contact your company's IPP account administrator so that he/she may add you as an additional user to your company’s IPP Collector account.

If your company has NOT enrolled in IPP:

Your company will be auto-enrolled for IPP using information from your SAM.gov account. Your company's Primary Electronic Business Point of Contact (POC) will be designated as an IPP administrator. This POC will be contacted by email to register when the FBI initiates the enrollment process through IPP. To prevent enrollment delays, please ensure your designated

Electronic Business POC in SAM.gov is up to date.

Your company’s IPP administrator will be responsible for initial account registration as well as creating and managing your company’s IPP users and permissions. Please note that due to U.S.

Department of the Treasury guidelines, IPP cannot set up User IDs using a shared email address.

How to register for IPP:

1. Once FBI initiates the enrollment process, your company’s designated Electronic Business

POC in SAM.gov will receive two emails from IPP Customer Support

(ipp.noreply@mail.eroc.twai.gov):

• The first email contains the initial administrative IPP User ID

• The second email, sent within 24 hours of receipt of the first email, contains a temporary password

• You must log in with the temporary password within 30 days

2. Registration is complete when the initial administrative user logs into the IPP web site with the User ID and password provided and accepts the IPP rules of behavior. Additional user accounts, including administrators, can be created after initial login.

Training

Contractor training materials, including a first-time login tutorial, are available on the IPP.gov website. Once you have logged in to the IPP application, you will have access to user guides that provide step-by-step instructions for all IPP capabilities ranging from creating and submitting an invoice to setting up email notifications.

Additional Support

IPP Customer Support Team is available Monday through Friday from 8:00 am to 6:00 pm EST

•Phone: (866) 973-3131 or Email: IPPCustomerSupport@fiscal.treasury.gov

•For answers to frequently asked questions, visit the Contractor FAQ page on the

IPP.gov web site.

8 Government Furnished Equipment or Information

No government furnished equipment will be provided. As for Government information, the only information will be some FBI usernames and emails put into the system for privileged users

(system admins and PSP staff).

9 Personnel Availability

Any services required during this IDIQ will be outlined in the TO SOW which will outline typical workhours or requirements for availability. No work is expected to be required at government site. This contract is unclassified.

10 Government Representatives The functions inherent to this contract must be performed by the designated Contracting

Officer. The duly assigned COR must ensure all actions pertaining to this contract are requested via the Contracting Officer.

10.1 Contracting Officer Representative

The COR will be identified via letter of COR delegation authority for this contract. The COR is responsible, as applicable, for: receiving all deliverables, inspecting and accepting the supplies or services provided hereunder in accordance with the terms and conditions of this contract;

providing direction to the Contractor which clarifies the contract effort, fills in details or otherwise serves to accomplish the contractual Scope of Work; evaluating performance; and certifying all invoices/vouchers for acceptance of the supplies or services furnished for payment.

The COR does not have the authority to alter or modify the Contractor's obligations, contract terms, conditions, specifications, or cost. If as a result of technical discussions, it is in the

Government’s best interest to alter/change contractual obligations or the Scope of Work, the

CO must issue such changes. The COR for this contract is Laura Dowdy. She can be reached at lpdowdy@fbi.gov .

10.2 Contracting Officer

This contract will be administered by:

Contracting Officer:

Name: Harriett Williams

E-mail address: hlwilliams2@fbi.gov mailto:lpdowdy@fbi.gov

Contract Specialist:

Name: Teala Watkins

E-mail address: tmwatkins@fbi.gov

11 Travel and Other Direct Costs (ODCs)

When required and requested by the government, in order to provide onsite training at an FBI Headquarters, Quantico FBI Academy, or Field Office location, travel must be conducted in accordance with Federal Travel Regulations, as found at the General Services Administration (GSA) website. Contractor personnel must receive authorization in writing from the Government CO/COR before traveling. Local travel will not be reimbursed. Local travel is defined as being within 50 miles of company headquarters or subsidiary location. Travel to work and home does not constitute reimbursable travel. Business and first-class travel will not be reimbursed unless initial planned travel exceeds 14 hours, and then only with FFD approval.

For on-site training required by the FBI, the Contractor must include the price of travel in the overall costs of acquiring the tool.

Other Direct Costs (ODCs) are not authorized.