Attachment I – Draft SOW Page 1 of 25

DEPARTMENT OF HOMELAND SECURITY (DHS)

DRAFT STATEMENT OF WORK (SOW)

Blanket Purchase Agreement

Enterprise License for Biometrics Software Matching - Futures Identity Branch

1. GENERAL

1.1 BACKGROUND

The Department of Homeland Security (DHS) requires an enterprise-level, scalable, and secure biometric matching software solution to support mission-critical identity verification, vetting, and investigative operations across DHS Components. DHS intends to procure an enterprise solution and supporting services that enable seamless integration of this biometric matching capability with other biometrics systems within the Department.

The software will support multi-modal biometric inputs, meet DHS operational performance requirements, and operate within the security, privacy, and interoperability frameworks mandated by DHS and federal standards.

1.2 OBJECTIVES

The objective of this Statement of Work (SOW) is to define the requirements, deliverables, scope, and performance expectations for the contractor to provide a DHS-wide solution for biometric matching software and all associated services necessary to integrate with other biometrics environments.

The contractor shall furnish all personnel, software, licenses, documentation, testing support, and technical services as indicated in these objectives:

1. Provide an Enterprise Biometric Matching Capability:

Deliver a DHS enterprise license for scalable, multi-modal biometric matching software capable of supporting mission-critical identity verification, vetting, and investigative functions across all DHS Components.

2. Ensure High Performance and Reliability:

Provide biometric matching services that meet DHS-defined standards for accuracy, throughput, latency, availability, and scalability to support high-volume operations.

3. Maintain Compliance and Security:

Ensure the solution complies with all applicable DHS policies (e.g., security, privacy).

4. Provide Sustainment and Support Services:

Deliver ongoing maintenance, troubleshooting, updates, enhancements, and technical support to ensure the system remains fully functional and current.

5. Support User Adoption and Operational Readiness:

Provide training, operational documentation, and technical guidance required to enable successful deployment and use of the biometric matching system across the DHS enterprise.

Attachment I – Draft SOW Page 2 of 25

This software will be deployed across DHS, including but not limited to: CBP, ICE, TSA, USCIS, USSS, and Headquarters elements.

2. SCOPE OF WORK

The contractor shall provide DHS with an enterprise-wide biometric matching software solution, including all licenses, services, and technical support necessary to enable seamless integration with all DHS biometric systems. The scope of this effort includes delivering and maintaining a scalable, multi-modal biometric matching capability; configuring and integrating the software with DHS interfaces, data formats, and cloud environments; supporting all required testing and accreditation activities; and providing training, documentation, maintenance, security updates, and help desk support. The contractor shall ensure the solution meets DHS performance, security, privacy, and interoperability requirements and remains fully functional and compliant throughout the period of performance.

2.1 Biometrics Matching Software Requirements:

The biometric matching software shall:

• Support multiple biometric modalities, including but not limited to:

o Facial recognition o Fingerprint and palm print matching o Iris recognition o Palm o Iris o Voiceprint matching (if applicable) o Biographic matching augmentation

• Provide real-time and batch matching capabilities.

• Enable configurable watchlist management, scoring logic, and threshold controls.

• Support search, identification, verification, and deduplication workflows.

• Maintain high accuracy, meeting or exceeding DHS-specified False Accept Rate

FAR) False Reject Rate (FRR) performance measures.

• Provide auditability, including detailed logs and chain-of-custody reporting features.

– Legal and Regulatory Compliance

• The vendor shall demonstrate compliance with applicable federal, state, and international privacy and data protection frameworks relevant to biometric data processing, including General Data Protection Regulation (GDPR) (where applicable), California Consumer Privacy Act (CCPA), Health Insurance Portability Accountability Act (HIPAA), Criminal Justice Information System (CJIS), and DHS privacy directives. Solutions shall align with ISO/IEC biometric performance and presentation attack detection standards (e.g., ISO/IEC 19795, ISO/IEC 30107).

• The vendor shall support DHS-compliant data retention, archival, and deletion policies consistent with NARA-approved schedules, including lifecycle controls

Attachment I – Draft SOW Page 3 of 25 for biometric images, templates, and associated metadata. The vendor shall ensure that comprehensive audit logging is provided to support security reviews, incident response, and oversight.

– Data Governance & Privacy Controls

• The vendor shall support formal data governance structures, including roles responsible for biometric data stewardship and compliance oversight. Biometric templates shall be protected using industry-standard cryptographic techniques and, where applicable, irreversible template transformation methods to reduce the risk of biometric data compromise.

• The solution shall support data minimization principles, access segmentation, and controlled sharing to ensure biometric data is used strictly for authorized mission purposes.

2.2 Technical and Infrastructure Requirements

• Solutions shall support both on-premises and cloud-based deployment models to accommodate DHS enterprise-wide operational constraints. On-premises deployments shall specify hardware sizing requirements, supported operating systems, virtualization strategies, and accelerator usage (CPU/GPU).

• Cloud-based deployments shall support government-authorized regions, network isolation, API gateways, and integration with DHS identity and access management systems. The architecture shall be scalable and capable of on-demand performance expansion to adjust to varying workloads and evolving needs.

– System Integration

• The solution shall integrate with existing DHS enterprise identity systems, enrollment stations, and biometric sensors using standardized interfaces and APIs. Vendors shall support interoperability with existing biometric repositories and provide migration strategies for legacy biometric data where required.

• Preference will be given to solutions that minimize vendor lock-in and support standards-based data exchange formats.

2.3 Network Requirements

• The biometric matching solution shall operate reliably across diverse DHS network environments, including on-premises data centers, hybrid cloud architectures, and distributed Component networks. Vendors shall identify minimum network bandwidth requirements necessary to support enrollment, biometric transmission, and matching operations under both steady-state and peak load conditions, including support for high-volume enrollment events and concurrent authentication transactions.

Attachment I – Draft SOW Page 4 of 25

• All biometric data transmitted across networks shall be protected using secure communication channels, with encryption in transit implemented in accordance with current federal standards (e.g., TLS 1.2 or higher, with support for approved cryptographic algorithms and certificate management practices). The solution shall support secure API-based communication for system-to-system integration while maintaining compatibility with DHS network security policies.

• The vendor shall demonstrate that the solution can function within restricted or segmented network environments commonly used in federal systems. The solution shall support network segmentation, least-privilege access principles, and monitoring to reduce the attack surface and prevent unauthorized access.

• Where applicable, vendors shall describe how network latency and bandwidth variability may affect biometric matching performance, including impacts to response times.

2.4 Performance Requirements

• Vendors shall demonstrate the ability to support high-volume biometric operations, including daily enrollments, 1:1 verifications, and large-scale 1:N identification searches. Performance requirements shall include defined latency targets, thresholds, and uptime SLAs appropriate for mission-critical environments.

• Performance claims shall be supported by empirical evidence from operational deployments or government-relevant testing environments.

2.5 License Model Definition

• The Government seeks licensing structures that support predictable costs, elastic scaling, and enterprise-wide usage without punitive cost escalations as biometric volumes grow. However, such licensing applies solely to the biometric software, and any required supporting or ancillary software shall be separately procured and licensed by the government.

2.6 Enterprise Features Selection

• The biometric matching solution shall support a set of enterprise-grade features necessary to ensure accuracy, security, scalability, and operational effectiveness across DHS Components. These features are critical to mitigating identity fraud, maintaining performance at scale, and supporting evolving mission requirements.

• The solution shall include liveness detection and presentation attack detection capabilities to mitigate spoofing attempts, using artifacts such as photographs, video replays, masks, or synthetic biometric representations. Liveness detection capabilities shall align with recognized biometric presentation attack detection standards and shall be configurable to balance security, usability, and performance requirements across different operational contexts.

Attachment I – Draft SOW Page 5 of 25

• The solution shall support watchlist management capabilities, including the ability to manage, update, and query biometric watchlists in near-real time.

Watchlist functionality shall scale to large populations, support rapid updates, and integrate with existing DHS identity repositories and operational workflows while maintaining strict access controls and auditability.

• Quality assurance and biometric quality assessment modules shall be provided to evaluate enrollment data prior to template generation and matching. These modules should support automated quality scoring, rejection, or recapture workflows for poor-quality samples, and configurable thresholds to improve matching accuracy, reduce failure-to-enroll rates, and ensure consistent biometric data quality across Components.

• The solution shall support multimodal fusion capabilities, enabling the combination of multiple biometric modalities (e.g., fingerprint, face, iris) to improve matching confidence and resilience. Fusion engines shall support configurable fusion strategies (e.g., score-level, decision-level) to accommodate varying operational requirements and risk tolerances.

• Where applicable, the solution shall support edge-device or distributed deployment models, enabling biometric processing to occur at or near the point of collection. Edge-device capabilities shall be optional and support scenarios such as remote enrollment, bandwidth-constrained environments, or continuity-of-operations requirements. Licensing for edge-based deployments shall be clearly defined and compatible with the enterprise licensing model to prevent cost escalation or operational constraints.

2.7 Security Controls

• Solutions shall implement encryption for data at rest and in transit, role-based access controls, secure key management, and integration with DHS security monitoring tools. Audit and monitoring capabilities shall support centralized logging, long-term retention, and integration with DHS Security Information and Event Management (SIEM) platforms to enable continuous security oversight.

2.8 Audit & Monitoring

• The biometric matching solution shall provide comprehensive audit and monitoring capabilities to support security oversight, compliance verification, incident response, and operational transparency across DHS Components. Audit logging shall capture all security-relevant and operational events, including but not limited to enrollment activities, biometric matching transactions, administrative actions, configuration changes, access attempts, and data exports.

• Log retention policies shall be configurable to meet DHS security, privacy, and records management requirements, including alignment with NARA-approved retention schedules. The solution shall support secure storage of audit logs, protection against unauthorized modification, and controlled access to log data for authorized personnel.

Attachment I – Draft SOW Page 6 of 25

• The solution shall integrate with DHS-approved SIEM platforms (e.g., Splunk, QRadar, Elastic), using standardized log formats and secure transmission methods. Integration shall support near-real-time event forwarding, correlation with other enterprise security signals, and support for automated alerting and forensic analysis.

• Vendors shall identify applicable compliance certifications and attestations relevant to the solution and deployment model, such as SOC 2 Type II, FedRAMP authorization (for cloud-based offerings), and ISO/IEC 27001. Where certifications are not currently held, vendors shall describe their compliance posture and roadmap for achieving required certifications.

2.9 Capacity Planning

• The biometric matching solution shall support enterprise-scale capacity planning to ensure sustained performance as biometric volumes, transaction rates, and supported modalities grow over time. Vendors shall specify storage requirements for biometric templates, raw biometric images or videos, associated metadata, and audit logs, including assumptions related to data compression, retention duration, and redundancy.

• Vendors shall provide growth projections and scalability considerations for the next three to five years, including expected increases in enrolled identities, daily transaction volumes, and additional biometric modalities. The solution shall be capable of scaling without significant architectural redesign or service disruption.

• The solution shall support redundancy and failover mechanisms appropriate for mission-critical systems. Vendors shall describe supported high-availability architectures, including active-active or active-passive configurations, and how these configurations maintain continuity of operations during component failures, maintenance activities, or peak usage periods.

2.10 Disaster Recovery

• The biometric matching solution shall include robust disaster recovery capabilities to support continuity of operations in the event of system failures, cyber incidents, or natural disasters. Vendors shall describe backup mechanisms, including backup frequency, retention periods, and secure storage of backup data, as well as recovery processes and restoration timelines.

• For cloud-hosted or hybrid deployments, the solution shall support geographic redundancy through multi-region or multi-availability-zone architectures, where appropriate. Vendors shall identify recovery time objectives (RTOs) and recovery point objectives (RPOs) supported by the solution and describe how disaster recovery testing is conducted to validate recovery readiness.

• Disaster recovery capabilities shall be compatible with DHS security, privacy, and operational requirements, and shall not compromise the integrity or confidentiality of biometric data during backup or restoration activities.

Attachment I – Draft SOW Page 7 of 25

3. User & Workflow Requirements

• The biometric matching solution shall support flexible and configurable user workflows to accommodate diverse DHS operational environments. Enrollment workflows shall support multiple models, including supervised enrollment, self-service enrollment, and batch processing, with appropriate controls to ensure data quality and integrity.

• The solution shall enforce configurable biometric quality thresholds during enrollment and matching operations. These thresholds may include image resolution, lighting conditions, biometric quality scores (e.g., NFIQ for fingerprints), and other modality-specific criteria to reduce failure-to-enroll rates and improve matching accuracy.

• User interfaces shall be designed to support efficient onboarding and operational use by both technical and non-technical users. UX/UI design should emphasize clarity, consistency, and error-reduction, while supporting accessibility considerations where applicable.

• The solution shall support integration with multi-factor authentication (MFA) workflows, enabling biometric authentication to be combined with additional factors such as PINs, passwords, cryptographic tokens, or trusted devices. MFA integration shall be configurable to support varying risk levels and operational use cases.

3.1 Vendor Evaluation Requirements

• Vendors shall support proof-of-concept (PoC) activities or equivalent demonstrations to validate technical capabilities, performance, and integration feasibility in environments representative of DHS operational conditions. PoC results shall demonstrate functional compliance with stated requirements and provide evidence of performance at expected scale.

• Algorithm performance shall be validated using Government-provided or Government-approved datasets, where applicable, to assess accuracy, false accept rates (FAR), false reject rates (FRR), and failure-to-enroll or failure-to-acquire rates under realistic conditions. Vendor-provided laboratory results alone may not be sufficient to demonstrate operational performance.

• Vendors shall support integration testing to validate interoperability with existing DHS systems, biometric sensors, identity repositories, and network environments.

Integration testing shall assess data exchange, performance impacts, error handling, and operational workflows.

• Vendors shall participate in security reviews, including assessment of system architecture, data protection mechanisms, access controls, and vulnerability management practices. Security review outcomes may be used to inform risk assessments, licensing decisions, and task order awards under the BPA.

4. Performance required Under the BPA, vendors may be tasked with supporting enterprise licensing activities including requirements definition, performance validation, capacity planning, integration support, and ongoing technical advisory services.

Attachment I – Draft SOW Page 8 of 25

5. Licensing Rights, Data Ownership, and Intellectual Property The Contractor shall provide the Government with a DHS-wide enterprise license for the biometric matching software delivered under this BPA. The license shall, at a minimum:

• Permit unlimited use of the software by authorized DHS Components, systems, users, and operational environments, including production, test, development, training, disaster recovery, and continuity-of-operations environments.

• Support elastic scaling without punitive cost escalation based solely on growth in enrolled identities, transaction volumes, or supported biometric modalities, unless explicitly defined in the licensing agreement.

• Permit deployment in on-premises, cloud, and hybrid environments, including Government-authorized cloud regions and edge or distributed processing environments where applicable.

• Allow the Government to configure, integrate, and interface the software with DHS systems, without additional licensing restrictions beyond those defined in the enterprise license agreement.

The enterprise license shall remain valid for the duration of the BPA ordering period and any associated task order periods of performance, subject to the terms of the negotiated licensing agreement.

6. Government Data Ownership All data processed, generated, derived, or stored by the biometric matching solution in support of DHS operations shall be and remain the exclusive property of the Government. This includes, but is not limited to:

• Raw biometric data (e.g., images, videos, audio samples)

• Biometric templates and feature representations

• Biographic and contextual metadata

• Matching results, scores, confidence values, and decision outputs

• Audit logs, transaction records, and system usage metrics

• Performance, accuracy, and quality assessment data generated during testing or operations The Contractor shall not assert ownership, proprietary rights, or reuse rights over Government data and shall not use such data for purposes other than performance of this contract unless expressly authorized in writing by the Government.

7. Rights to Derivative Works and Configurations The Government shall retain rights to all configurations, integration artifacts, interface definitions, scripts, workflows, data mappings, tuning parameters, and documentation developed specifically for DHS under this BPA, including those created to integrate the biometric matching solution with other DHS systems.

This includes, but is not limited to:

Attachment I – Draft SOW Page 9 of 25

• API configurations and interface mappings

• Scoring logic configurations and threshold definitions

• Watchlist workflows and deduplication processes

• Performance tuning and scaling configurations

• Deployment scripts and infrastructure-as-code artifacts developed for DHS environments

Nothing in this section shall be construed to require the Contractor to relinquish ownership of its pre-existing proprietary algorithms, commercial software, or underlying intellectual property.

7.1. Algorithm Protection and Use Limitations

The Contractor shall retain ownership of its proprietary biometric matching algorithms and commercial software components. However:

• The Contractor shall not embed technical restrictions that prevent lawful Government use, integration, testing, or migration consistent with the enterprise license.

• The Contractor shall not require DHS biometric data to be used for algorithm training, retraining, or commercial improvement unless explicitly approved in writing by the Government.

• Any use of Government data for algorithm improvement, analytics, or research purposes shall be subject to a separate, Government-approved data use agreement.

8. Data Access, Portability, and Exit Rights The Contractor shall ensure that all Government data is fully accessible, exportable, and portable in non-proprietary or standards-based formats upon request. This includes support for data export to enable:

• System migration

• Vendor transition

• Archival or records management activities

• Independent testing or analysis

Upon contract expiration or termination, the Contractor shall support an orderly transition, including the secure return or destruction of Government data in accordance with DHS data retention and NARA-approved schedules.

9. Compliance with Records Management and Retention All Government data processed by the biometric matching solution shall be managed in accordance with DHS records management policies and NARA-approved retention schedules.

The Contractor shall support configurable retention, archival, and deletion controls and shall provide auditable evidence of compliance upon request.

Attachment I – Draft SOW Page 10 of 25

10. Deliverables

Deliverable Description Due Date Distribution

Kick Off Meeting

Sets a shared understanding of what the project will deliver, how the work will be done and establishes communication plans and next steps before execution begins.

Within five business days of the award

N/A

Contract Management Plan

Outlines how the contract will be administered throughout the lifecycle. It defines responsibilities, processes, timelines, performance requirements, communication methods, and procedures for managing changes.

Draft: Five business days after award

Final: Five business days after receipt of Government comments

COR

Weekly Status Reports

Summarizes progress of work completed over the past week.

Weekly Friday by Close of Business. As outlined in section

COR

White papers, Presentations, and

Strategic Plans

Used to inform decision makers on updates, proposals or ideas.

Strategic Plans define priorities, resources, timelines and performance measures to guide decision making.

Develop as required

COR

Attachment I – Draft SOW Page 11 of 25

Monthly Asset Management

Report

Provides updates on asset inventory, maintenance, activities, financial performance, utilization, risks and any issues requiring attention.

The last week of every month/As requested by the government

COR

Annual Inventory Report

Ensures accurate record keeping of equipment, materials OBIM owns. It includes locations, conditions, valuations and discrepancies found during a physical count.

Initial inventory upon deployment and 12 months after deployment

COR

Data Dictionary

Document that defines and describes the data elements used within a system, database or project.

30 days after award/updates as required by the government

PM/COR

Enterprise License Package/Licensing

Rights

Full enterprise licensing agreement and documentation covering all DHS Components.

30 days after award

PM/CO/COR

System Integration Plan

Technical architecture, interface specifications, data mappings, and integration approach for

DHS’s biometric systems alignment.

45 days after award/updates as requested by government

PM/CO/COR

Implementation Schedule

Detailed project schedule including milestones, dependencies, and resource allocations.

30 days after award/updates as requested by government

PM/CO/COR

Attachment I – Draft SOW Page 12 of 25

Test & Evaluation Materials

Test plans, test scripts, data requirements, and success criteria for functional, performance, and security testing.

Prior to integration testing/updates as requested by the government

PM/CO/COR

Security & Compliance

Documentation

Artifacts required for DHS security assessment and authorization (SSP, diagrams, control responses, etc.).

Per DHS ATO timeline

PM/CO/COR

Configured Software Release

Deployment-ready software, integrations, configurations, and interface components for

DHS.

Prior to deployment

PM/CO/COR

Training Materials & Sessions

Administrator, operator, and technical training; user guides; quick-reference materials; and e-learning modules.

Prior to go-live

PM/CO/COR

Sustainment Plan

Maintenance strategy, release management plan, support SLAs, and lifecycle management documentation.

60 days after award

PM/CO/COR

Monthly Status Reports

Summary of progress, risks, issues, resolutions, KPIs, and schedule updates.

Monthly

COR

Attachment I – Draft SOW Page 13 of 25

11. Qualified Personnel The Contractor shall provide qualified personnel to perform all requirements specified in this

SOW.

Program Manager (PM) Senior level manager shall have a solid understanding of the system development life cycle;

strong leadership and management abilities; excellent written and verbal communication skills; familiarity with industry best practices; and experience with government contract and subcontract management. Shall be knowledgeable of the acquisition life cycle. This position requires knowledge of the Federal Acquisition Regulations (FAR), Department of Homeland Security Acquisition Regulations, requirements, policies and procedures, cost and schedule estimating, systems disciplines, engineering specifications and commercial practices relating to information systems procurement and production. Shall be knowledgeable of organizational behavior, direction, and requirements of the contract efforts.

Experience in interfacing directly with the government designated representatives and supervising various task order activities is also required. Shall be capable of managing large-scale technical implementation projects. Shall be capable of developing integrated project plans, business cases, inclusive of the development and quantification of courses of action, evaluation criteria, scoring methods, lifecycle cost analysis, and performance of Analysis of Alternatives. Shall be capable of developing risk plans, mitigation strategies, stakeholder registers, and project schedules for large projects or programs. Shall be capable of leading large teams that include a mix of different tasks.

Shall have demonstratable knowledge of biometric principles and concepts. Shall have the ability to track multiple component projects and requirements. Shall have excellent communication and interpersonal skill. Shall have experience advancing biometric technology to large and diverse enterprises, inclusive of how different types of systems and capabilities are rolled out. Shall have experience with development of biometric systems or platform environments, including activity and service models and security and performance architectures.

Shall have the ability to learn and apply new concepts, including a history of self-teaching and learning through doing. Should possess a bachelor’s degree in project management, Business Administration, Engineering, Information Technology, or hold an advanced certification such as PMP, DAU Program Management Level III, or FAI FAC P/PM Senior Level. Shall have at least five (5) years of experience overseeing large, multi-functional project teams—preferably in a systems

Deliverable Description Due Date Distribution

Annual Software & Performance

Review

Assessment of system performance, improvements, usage metrics, and planned enhancements.

12 months after contract is awarded/As requested by the government

PM/CO/COR

Attachment I – Draft SOW Page 14 of 25 development environment—and managing complex tasks, often under tight budget and time constraints.

Deputy Program Manager / Task Order Manager Develop comprehensive program management plans that consider program goals and objectives, requirements, and analysis. Participates in the negotiation of contracts, proposals, plans, and specifications. Monitors all scheduling, resource allocation, pricing, and technical performance throughout the life of the program. Works to ensure programs are completed on time and within budget.

Advises team on program strategy, program delegation, and program implementation.

Communicates updates to all stakeholders by providing timely reporting of program status throughout life cycle. Understand fundamentals of subject matter and how to apply basic principles of topic area with guidance from supervisors. Able to function productively with daily to weekly input from supervision. Should possess a bachelor’s degree. Should have 5 years of project management or team lead experience.

Technical Lead / Chief Engineer Provides expert-level knowledge, technical insight, and strategic guidance in a specific subject area to support program goals, decision-making, and problem solving. Serves as a key advisor to project teams, offering authoritative recommendations on design, development, implementation, and evaluation of solutions.

Prepares engineering management plans, monitors schedule execution, and integrates recommendations for corrective and remedial action; prepares status reports and provides technical guidance to junior engineers for development of engineering designs and documentation. Ability to perform some or all the following functions: Algorithm Development, Mathematical Model Development, Embedded Algorithms, Firmware Application Development, Real Time/non-real Time Control System Algorithm Development, Simulation Software Development, Hardware/Software Integration, Software Test. Collaborates with stakeholders to ensure that technical approaches meet mission requirements, industry standards, and regulatory compliance.

Supports the development of documentation, training, and policy related to their area of expertise. Reviews deliverables for accuracy and provides quality assurance across the project lifecycle. Demonstrates mastery of the subject matter and applies both theoretical and practical knowledge with minimal supervision. Functions independently and often leads efforts requiring specialized insight.

Provides mentorship to junior staff and contributes to long-term strategic planning. Should possess a bachelor’s degree and a minimum of 7 years of specialized experience in a technical, operational, or domain-specific field.

Biometric Systems Architect Leads the design of complex enterprise-wide IT solutions which incorporate technical infrastructure, hardware, and software. Supports business case analysis and identification of

Attachment I – Draft SOW Page 15 of 25 alternative solutions and resulting business impacts. Leads detailed design of complex enterprise IT solutions involving multiple COTS/GOTS applications, processing platforms, and legacy system. Detailed migration planning and trade-off analysis; GOTS/COTS software installation and configuration for multiple functional modules of enterprise software.

Design database applications, such as interfaces, data transfer mechanisms, global temporary tables, data partitions, and function based indexes to enable efficient access of the generic database structure. Design databases to support business applications, ensuring system scalability, security, performance, and reliability. Design and develop data models and architectures for applications, metadata tables, views, or related database structures. Design and develop load-balancing processes to eliminate down time for backup processes. Design, develop and document technical system architectures. Develop technical architectural strategies at the modeling, design, and implementation stages to address business or industry requirements.

Collaborate with system architects, software architects, design analysts, and others to understand business or industry requirements. Create and enforce system standards. Demonstrate technical functionality, such as performance, security, and reliability. Ability to perform some or all the following functions: Algorithm Development, Mathematical Model Development, Embedded Algorithms, Firmware Application Development, Real Time/non-real Time Control System Algorithm Development, Simulation Software Development, Hardware/Software Integration, Software Test.

Biometric Quality & Data Analyst Provides technical and administrative direction for personnel performing software development tasks, including the review of work products for correctness, software testing, and adherence to the design concept and to user standards, review of program documentation to assure government standards / requirements are adhered to, and for progress in accordance with schedules.

Coordinates with the Project Manager and/or Quality Assurance Manager to ensure problem solution and user satisfaction. Makes recommendations, if needed, for approval of major systems installations. Prepares milestone status reports and deliveries/presentations on the system concept to colleagues, subordinates, and end user representatives. Design algorithms, statistical and data models.

Documents established standards and protocols for medical data analysis. Possess clinical experience. Ability to lead team members for projects in biometrics. Ability to perform some or all the following functions: Algorithm Development, Mathematical Model Development, Embedded Algorithms, Firmware Application Development, Real Time/non-real Time Control System Algorithm Development, Simulation Software Development, Hardware/Software Integration, Software Test.

Attachment I – Draft SOW Page 16 of 25

Systems Integration Engineer Analysis experience. Strong Data Modeling experience. Excellent Operations and Maintenance skills. Experience in either Power BI, Jaspersoft Server, or Reporting Services. Expert level SQL and ad hoc reporting skills. Proven experience of information technology principles, best practices, architectures, tools, and processes. Practical experience with Hadoop and extensive experience w/ SQL and NoSQL databases. Working knowledge and experience with SAS.5

Software Engineer / API Developer Proficient in the use of SAS Base, Macros, ODS and SQL for process development and system automation. May perform all tasks of Programmer. Ability to perform some or all the following functions: Algorithm Development, Mathematical Model Development, Embedded Algorithms, Firmware Application Development, Real Time/non-real Time Control System Algorithm Development, Simulation Software Development, Hardware/Software Integration, Software Test.

12. Contractor Performance Reviews (CPRs) The contractor shall participate in and prepare monthly Contractor Performance Reviews (CPR) reports, briefing status of contract performance to the COR. Within the CPR, the contractor shall provide a monthly status and projected staff-hours, and work completion for evaluation of the contractor’s progress on the contract tasks and subtasks. CPR format is provided as Government Furnished Information (GFI) and shall take place at the government’s facility or via teleconference. At a minimum, this data shall include:

13.Contractor Employee Identification

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

14. Contractor Employee Conduct Contractor employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of arts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure contractor employees present a professional appearance at all times and that their conduct shall not reflect negatively on the United States or

Attachment I – Draft SOW Page 17 of 25 discredit DHS. The Contractor shall ensure that Contractor employees understand and abide by DHS established rules, regulations and policies with regard to safety and security.

The Government may, at its sole discretion (via the COR), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The COR will provide the Contractor with a written explanation to support any request to remove an employee.

The CO may require the contractor to prohibit individuals from working on contracts if the Government deems their initial or continued employment to be contrary to the public interest for any reason, including, but not limited to, carelessness, and insubordination, incompetence, or security concerns.

15. Travel No travel outside of the National Capitol Region (NCR) is anticipated under this task order.

Travel within the NCR is not reimbursable.

16. Key Personnel The Contractor Program Manager is considered Key on this task order. The Contractor Program Manager is responsible for managing the project and for the oversight of the work.

Before replacing any individual designated as Key by the Government, the contractor shall notify the CO no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced unless approved by the Contracting Officer. The contractor shall not replace Key Contractor personnel without acknowledgment from the CO.

17. Accessibility Requirements (Section 508) Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5

Attachment I – Draft SOW Page 18 of 25

139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

Section 508 Applicable EIT Accessibility Standards 36 CFR 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.24 Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required

1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using

TTY.

Section 508 Applicable Exceptions Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

Section 508 Compliance Requirements 36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of

Attachment I – Draft SOW Page 19 of 25 market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

All tasks for testing of functional and/or technical requirements must include specific testing for Section 508 compliance, and must use DHS Office of Accessible Systems and Technology approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov.

Section 508 Requirements for Technology Products Section 508 applicability to Information and Communications Technology (ICT):

Communications Materials Applicable Exception: N/A Authorization #: N/A Applicable Functional Performance Criteria: Does not apply Applicable 508 requirements for electronic content features and components (including but not limited to Electronic documents; Electronic document templates; Electronic surveys; Electronic reports; Electronic training materials; Multimedia (video/audio)): All requirements in E205 apply, including all WCAG 2.0 Level A and AA Success Criteria apply as specified in E205 Applicable 508 requirements for software features and components: Does not apply Applicable 508 requirements for hardware features and components: Does not apply Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply Section 508 Deliverables Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards.

The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat.

Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

18. Enterprise Architecture Compliance DHS Enterprise Architecture Compliance All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following HLS EA requirements:

• All developed solutions and requirements shall be compliant with the HLS EA.

• All IT hardware and software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

• Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Architecture Division (EAD) for review, approval and insertion into the DHS Data Reference Model and Mobius.

https://www.itic.org/policy/accessibility/vpat

Attachment I – Draft SOW Page 20 of 25

• Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01 and all data-related artifacts will be developed and validated according to DHS data management architectural guidelines.

• Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

C-SCRM Compliance

a. Definitions

i. Component: a unit defined…