RFI Q and A with out Vendor Names.pdf

Number of Questions Industry Question Government Response

1 Please confirm the industry questions deadline. The RFI schedule table lists “5:00 PM EDT on 10/20/2029,” while the SAM.gov response date is 10/29/2026. We assume the questions cutoff is 5:00 PM EDT on 10/20/2026;

please confirm.

Confirmed. Questions are due by 5:00 PM EDT on October 20, 2026. RFI responses remain due on October 29, 2026.

2 Will responses be accepted from teams? If so, should Attachment A list the prime only, or all teammates?

Yes. Team responses are acceptable. Attachment A should identify the proposed prime contractor and list known teammates or subcontractors, including their expected roles. A formal teaming agreement is not required for this RFI.

3 For SOC scope, should industry assume a contractor-operated SOC, CBP/OIT SOC augmentation, or either model?

Industry should assume a contractor-operated SOC as part of the BPTOC service. The contractor will coordinate with CBP and OIT cybersecurity organizations and use Government-designated tools and processes, as applicable. CBP welcomes feedback on the recommended division of responsibilities.

4 Which systems of record are expected for ticketing and operational awareness today (for example ILSS, ServiceNow, Tririga, or other), and will GFE tool access be provided during transition?

CBP anticipates providing access to Government-designated tools, interfaces, and environments required for performance, subject to security, licensing, ticketing, vulnerability-management, availability, and access requirements. Expected systems may include ILSS, ILSS Maximo, ServiceNow, TRIRIGA, Tenable Security Center, Nessus, Qualys, SolarWinds, Splunk, and other Government-designated tools. The final solicitation will identify required Government-furnished versus contractor-furnished tools, applicable licenses, API or interface access, test environments, and transition arrangements. The final solicitation will also identify the authoritative systems of record for incident status and operational availability reporting and address whether, and under what conditions, contractor-hosted components may be permitted.

5 Are endpoint counts, site counts, or portfolio volumes available even as notional ranges for ROM staffing?

Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation. The requirement has not been finalized. Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation.

6 Will personnel require a CBP background investigation / PIV as a condition of BPTOC floor access, and what cleared labor mix should industry assume?

Personnel requiring access to CBP facilities, systems, networks, or sensitive information will need to meet applicable CBP access and vetting requirements. The anticipated requirement is a CBP Background Investigation or other CBP Office of Professional Responsibility-approved access determination, as appropriate. Specific PIV and access requirements will be defined in a future solicitation. Vendors should state their assumptions for staffing, vetting, and privileged access.

7 Is there an incumbent BPTOC or equivalent NOC/SOC/helpdesk provider, and will transition artifacts (ticket history, monitoring configs, SOPs) be furnished to the awardee?

Yes, there is an incumbent BPTOC NOC/SOC/Helpdesk provider. However, this contract supports only portions of the PMOD portfolio. Subject to applicable restrictions, CBP expects to provide relevant transition information and materials to the successful contractor. Specific transition materials will be identified in a future solicitation.

8 For market research, does CBP prefer rough order of magnitude pricing for the baseline enterprise BPTOC only, or also for per-portfolio task-order shells?

For market research purposes, a ROM pricing the baseline enterprise and per portfolio task order shells. Vendors should identify non-recurring transition costs, recurring operations costs, pricing assumptions, and key cost drivers. ROM pricing is for market research only and is not binding.

9 Which tools, SIEM and scanners are Government-furnished, and who holds the licenses? Is the incumbent's monitoring configuration and ticket history available to the successor? What background investigation level applies to each labor category, and how long does adjudication take? Does CBP intend the alternate site to be contractor-furnished?

CBP anticipates providing access to Government-designated tools and relevant transition information, subject to security, licensing, and access requirements. For background investigations, Personnel requiring access to CBP facilities, systems, networks, or sensitive information will need to meet applicable CBP access and vetting requirements. The anticipated requirement is a CBP Background Investigation or other CBP Office of Professional Responsibility-approved access determination, as appropriate.

Specific PIV and access requirements will be defined in a future solicitation.

Vendors should state their assumptions for staffing, vetting, and privileged access. Specific tool ownership, licenses, available transition artifacts, vetting requirements, adjudication timelines, and alternate-site requirements will be addressed in a future solicitation.

10 Please confirm the question-submission deadline. The RFI states 10/20/2029, which appears inconsistent with the 10/29/2026 RFI response deadline.

Confirmed. Questions are due by 5:00 PM EDT on October 20, 2026. RFI responses remain due on October 29, 2026.

11 Does CBP anticipate a single enterprise award, an IDIQ with portfolio-specific task orders, or another structure?

CBP is considering an enterprise contract structure, possibly an IDIQ, issuing portfolio-specific task orders. The final acquisition structure has not been determined.

12 Will CBP provide endpoint counts, historical ticket volumes, concurrent shift staffing, user/site counts, and incident data before solicitation?

Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation. The requirement has not been finalized. Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation.

13 Which ITSM, SIEM, monitoring, vulnerability-management, asset-management, and helpdesk tools will be Government-furnished or mandated?

CBP anticipates providing access to Government-designated tools, interfaces, and environments required for performance, subject to security, licensing, availability, and access requirements. Expected systems may include ILSS, ILSS Maximo, ServiceNow, TRIRIGA, Tenable Security Center, Nessus, Qualys, SolarWinds, Splunk, and other Government-designated tools. The final solicitation will identify required Government-furnished versus contractor-furnished tools, applicable licenses, API or interface access, test environments, and transition arrangements. The final solicitation will also identify the authoritative systems of record for incident status and operational availability reporting and address whether, and under what conditions, contractor-hosted components may be permitted.

14 Will CBP authorize a contractor-managed primary and geographically separate alternate/COOP facility model, and what minimum physical-security, network-connectivity, redundancy, and facility requirements should industry assume?

CBP is seeking industry feedback on primary facility models. Final facility, physical-security, connectivity, redundancy, and continuity requirements will be identified in a future solicitation.

15 Will the prime itself be required to hold an FCL, or may an authorized teammate satisfy classified/facility requirements where applicable?

The prime will be required to have a Facility Clearance Level. Any applicable facility-clearance or classified-access requirements will be identified in a future solicitation if required.

16 What CBP background-investigation or suitability level is expected for each labor category, and what transition provisions will apply to pending vetting?

Personnel requiring access to CBP facilities, systems, networks, or sensitive information will need to meet applicable CBP access and vetting requirements. The anticipated requirement is a CBP Background Investigation or other CBP Office of Professional Responsibility-approved access determination, as appropriate. Specific PIV and access requirements will be defined in a future solicitation. Vendors should state their assumptions for staffing, vetting, and privileged access.

17 Does CBP expect the BPTOC prime to perform Tier 3 physical maintenance or primarily coordinate Tier 3 work to OEMs, FSRs, sustainment contractors, and field resources?

The BPTOC contractor is expected to provide Tier 1 and Tier 2 support and coordinate escalation to Tier 3 organizations, as applicable. Specific Tier 3 physical-maintenance responsibilities will be defined in a future solicitation or task order.

18 Will incumbent personnel be available for transition interviews or structured knowledge-transfer activities?

CBP anticipates an orderly transition and knowledge-transfer process. The availability of incumbent personnel for interviews or transition support will be addressed in a future solicitation.

19 How will CBP distinguish contractor-controlled service availability from outages caused by Government networks, carriers, facilities, OEMs, or field dependencies?

The future solicitation will define operational availability where vendor capture Ao calculations, exclusions, dependency treatment, outage attribution, and reporting requirements.

20 Does CBP intend to set aside the follow-on BPTOC acquisition for small business, and would portfolio-level or partial set-asides be considered?

CBP has not made a set-aside determination. However, partial set-asides are not anticipated.

21 Can CBP share current endpoint counts by portfolio, monthly ticket volume by priority, and current staffing levels by function (helpdesk, NOC, SOC, engineering) to support accurate responses and pricing?

Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation. The requirement has not been finalized. Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation.

22 Must the contractor provide the BPTOC primary and alternate facilities, or is a Government-furnished BPTOC location an option? Is there a required geographic location for either site?

CBP has not finalized whether the primary and alternate BPTOC facilities will be contractor-furnished, Government-furnished, or a combination of both. Facility location requirements will be addressed in a future solicitation.

23 Which tools are Government-furnished today (monitoring, SIEM, vulnerability scanning, ILSS licenses), and are they expected to transfer to the follow-on contractor?

CBP anticipates providing access to Government-designated tools needed to perform the work, subject to security, access, and licensing requirements. The final list of tools and transition arrangements will be identified in a future solicitation.

24 Would CBP consider defining system connectivity and onboarding (e.g., Mobile Portfolio Cisco upfits, firewall rules, AMSS integration) as a separate CLIN or task order from steady-state NOC/SOC/helpdesk services?

CBP welcomes feedback on separating system connectivity, onboarding, integration, and firewall activities from steady-state BPTOC operations. The final CLIN and task-order structure has not been determined.

25 The RFI lists the question deadline as 10/20/2029. Please confirm the intended date is 10/20/2026.

Confirmed. Questions are due by 5:00 PM EDT on October 20, 2026. RFI responses remain due on October 29, 2026.

26 The draft PWS is marked FOUO. May vendors share it with prospective teaming partners for the purpose of preparing an RFI response?

Vendors must handle the draft PWS according to its markings and applicable DHS/CBP handling requirements. Distribution should be limited to individuals with an official need to know for preparing an RFI response.

27 The PWS refers to a 1st generation contract. Is there an incumbent contract number for this requirement, and would the Government share it?

Yes. An incumbent BPTOC NOC/SOC/Helpdesk provider currently supports portions of the PMOD portfolio. CBP does not intend to provide additional incumbent contract details in response to this RFI. Subject to applicable security, contractual, proprietary, and operational restrictions, CBP anticipates providing relevant Government-controlled transition information and materials to the successful contractor. Specific transition artifacts, access timing, and knowledge-transfer requirements will be identified in a future solicitation.

28 The PWS requires the contractor to provide a physical facility and an alternate operations site without naming a location. Is there a required location, or a maximum distance from Washington, DC, for either site?

CBP has not established final facility-location or distance requirements.

Vendors may describe proposed facility approaches and assumptions in their RFI responses.

29 Can the Government share the current number of monitored endpoints by portfolio?

Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation. The requirement has not been finalized. Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation.

30 Does the Government anticipate setting aside the resulting IDIQ contract for small business?

CBP has not made a small-business set-aside determination for the resulting acquisition.

31 Would CBP welcome responses from small businesses proposing to provide specialized capabilities as part of a larger team, rather than independently operating the entire NOC/SOC/Helpdesk environment?

For example, could a small business focus on AI-driven operational analytics, monitoring automation, system integration, cybersecurity engineering support, and RDT&E while an established prime contractor provides the required facilities, staffing, and continuous operations?

No. The Government is researching existing industry capabilities from individual firms, proposed teams or joint ventures that collectively address the Government's requirements. The Government anticipates an award will be made to a single vendor.

32 Must respondents have active SAM.gov registration, UEI, and CAGE codes at the RFI stage, or may businesses with registration in progress participate in this market research?

This RFI is for market research purposes. Vendors may respond if SAM.gov registration, UEI, or CAGE registration is planned or in progress. Any registration requirements for award will be stated in a future solicitation.

33 The draft PWS references a primary physical operations facility and a backup or alternate site.

Is CBP considering a required geographic location for these facilities, or may contractors propose facilities elsewhere within the United States, provided they meet applicable security, connectivity, personnel, and continuity requirements?

Additionally, would these facilities need to be fully operational at proposal submission, contract award, or completion of the transition period?

CBP has not established final geographic requirements or readiness dates for primary or alternate facilities. Vendors should identify their proposed approach and assumptions.

34 Does CBP anticipate requiring all contractor personnel to possess completed DHS/CBP background investigations before contract award, or could personnel complete the required vetting during transition before receiving access?

Would these requirements differ for personnel performing specialized development, automation, analytics, or RDT&E functions without direct access to operational CBP systems?

Personnel requiring access to CBP facilities, systems, networks, or sensitive information will need to meet applicable CBP access and vetting requirements. The anticipated requirement is a CBP Background Investigation or other CBP Office of Professional Responsibility-approved access determination, as appropriate. Specific PIV and access requirements will be defined in a future solicitation. Vendors should state their assumptions for staffing, vetting, and privileged access. The Government does not anticipate requiring contractor personnel to possess background investigations prior to contract award.

35 The draft PWS identifies continuous improvement, artificial intelligence, robotic process automation, and RDT&E activities.

Does CBP anticipate establishing separate task orders or work packages for these specialized technical capabilities, potentially allowing small businesses to participate independently or as subcontractors?

The Government welcomes any feedback or suggested approaches. At this juncture, the Government has not made a determination to separate task orders or work for specialized technical capabilities.

36 Draft PWS Appendix D measures helpdesk and NOC/SOC timelines to acknowledgment and initiation of Tier 2 troubleshooting, while the Appendix B AMSS table reads as resolution within the same windows. Which governs, which event ends each clock, and how are restoration, resolution and closure measured separately? For the 94 percent threshold and 97 percent objective BPTOC service availability, please also confirm the calculation and aggregation rules separately from supported-system operational availability, including partial degradation, dependencies among functions, exclusions and attribution.

CBP recognizes that the draft PWS may contain inconsistent incident-management language. The final solicitation will clarify governing performance measures, including acknowledgment, triage, restoration, resolution, closure, exclusions, dependencies, and attribution to include defining BPTOC service-availability calculations, including the application of threshold and objective measures, exclusions, dependencies, outage attribution, and reporting requirements.

37 Please provide the planning baseline by initial task order: sites, systems, monitored and managed endpoints by class, users, incident and call volumes by priority, peak concurrent workload and historical demand, including inaccessible or monitoring-only endpoints and the onboarding schedule. Are S-UAS and C-UAS outside the initial baseline until separately authorized?

The Government anticipates that the initial Enterprise BPTOC scope may include requirements associated with the Integrated Surveillance Towers, Mobile, and Subterranean portfolios. The final solicitation will identify the initial systems, sites, endpoint categories, support boundaries, and planning assumptions, as available. The enterprise contract is intended to support the onboarding of additional PMOD systems, sites, endpoints, and capabilities through future delivery orders, task orders, modifications, or other authorized contractual actions as requirements mature and are approved by the Government.

S-UAS, C-UAS, and other future capabilities may be considered for BPTOC support as requirements mature and are authorized. They should not be assumed to be included in the initial baseline unless specifically identified in a future solicitation or applicable task or delivery order.

38 Which incumbent documentation, ticket history, configurations, monitoring rules, integrations, inventories, SOPs and operational data will be available to a successor, and when? What Government rights, licensing or transfer limits apply to incumbent tools and custom integrations, what overlap period should respondents assume, and what operational acceptance criteria apply?

Subject to applicable security, contractual, proprietary, and operational restrictions, CBP anticipates providing relevant Government-controlled transition information to the successful contractor. Specific artifacts, access timing, transition overlap, tool-transfer limitations, and acceptance criteria will be identified in a future solicitation.

39 What geographic, physical-security, connectivity, facility-authorization and alternate-site requirements apply to the primary and backup facilities?

Which approvals must exist at award versus before operations begin, and what lead time should respondents assume for facility connectivity, CBP background investigations, credentials and privileged access?

CBP has not finalized geographic, physical-security, connectivity, facility-authorization, or alternate-site requirements. Personnel requiring access to CBP facilities, systems, networks, or sensitive information will need to meet applicable CBP access and vetting requirements. The anticipated requirement is a CBP Background Investigation or other CBP Office of Professional Responsibility-approved access determination, as appropriate.

Specific PIV and access requirements will be defined in a future solicitation.

Vendors should state their assumptions for staffing, vetting, and privileged access. Final requirements and readiness timelines will be identified in a future solicitation.

40 Which tools, licenses, API access, interfaces and test environments will be Government-furnished for ILSS and ILSS Maximo, ServiceNow, Tririga, asset and configuration management, endpoint monitoring, vulnerability management and SIEM? Which systems are authoritative for incident status and availability reporting, and which contractor-hosted components are permitted?

CBP anticipates providing access to Government-designated tools, interfaces, and environments required for performance, subject to security, licensing, availability, and access requirements. Expected systems may include ILSS, ILSS Maximo, ServiceNow, TRIRIGA, Tenable Security Center, Nessus, Qualys, SolarWinds, Splunk, and other Government-designated tools. The final solicitation will identify required Government-furnished versus contractor-furnished tools, applicable licenses, API or interface access, test environments, and transition arrangements. The final solicitation will also identify the authoritative systems of record for incident status and operational availability reporting and address whether, and under what conditions, contractor-hosted components may be permitted.

41 Will each initial task order include an approved responsibility matrix identifying the contractor's direct authority for scans, patching, account administration, containment, backups and restores? How should the contractor document and escalate work that depends on CBP OIT, system owners, OEMs or field support?

CBP anticipates defining task-order-specific roles and responsibilities for scans, patching, account administration, containment, backups, and restores. Vendors should describe their recommended coordination, documentation, and escalation approach.

42 The PWS says CBP OIT provides enterprise Tier 1 intake, triage and routing while the BPTOC provides BPTOC-specific helpdesk support, and the RFI asks the BPTOC to be the single point of contact. Where does OIT's enterprise Tier 1 end and the BPTOC helpdesk begin, who creates the ILSS service request for a user-reported issue, and which timestamp starts the helpdesk clock?

The future solicitation will clarify the boundary between enterprise OIT Tier 1 support and BPTOC Helpdesk support, including ticket ownership, routing, and when service-level clocks begin.

43 The PWS body cites F-03 for the Disaster Recovery Plan, F-04 for the Incident Response Plan, F-05 for the Vulnerability Scan Report and F-06 for the POA&M, while Appendix A numbers them F-04, F-05, F-06 and F-07.

Please provide the controlling CDRL crosswalk, templates, due dates and acceptance criteria.

CBP recognizes inconsistencies in the draft CDRL references. The Government will reconcile the CDRL numbering, templates, due dates, and acceptance criteria before issuing a final solicitation.

44 The PWS table of contents lists Delivery Order 1 for the Integrated Surveillance Towers portfolio, but the body proceeds from section 3.6.3 to Delivery Order 2. Is an IST section missing, and what is the initial IST task-order scope, including its availability, MDT and MTBF targets?

CBP recognizes that the draft PWS structure requires further refinement.

The final solicitation will identify the initial IST scope, performance requirements, and applicable metrics.

45 Is this the same contract that was awarded to EVOTECH in December 2025?

Or is this a new requirement?

There is an incumbent BPTOC NOC/SOC/Helpdesk provider. However, this contract supports only portions of the PMOD portfolio. Subject to applicable restrictions, CBP expects to provide relevant transition information and materials to the successful contractor. Specific transition materials will be identified in a future solicitation.

46 The notice does not list a set-aside. Could you kindly let me know whether CBP is considering a small business set-aside for any portion of the BPTOC requirement, so that we prepare our response accordingly?

CBP has not made a set-aside determination for any portion of the BPTOC requirement.

47 What NAICS code and socioeconomic set-aside, if any, does the Government anticipate for the Enterprise BPTOC IDIQ?

CBP has not finalized the NAICS code or socioeconomic set-aside approach. These details will be included in a future solicitation, if applicable.

48 Will the Government consider separate task orders for operations (NOC, SOC and helpdesk) and for analytics, AI-enabled continuous improvement and RDT&E? Or does it expect a single contractor to hold all portfolio task orders?

The final acquisition plan or strategy has not been determined yet.

However, the Government contemplates a single contractor to hold all portfolio task orders.

49 Must the primary BPTOC facility and the backup site be contractor-owned?

Or may offerors propose a Government-furnished facility or an existing teaming partner’s facility?

CBP has not finalized the facility model. Vendors may propose contractor-furnished, teaming-partner, Government-furnished, or hybrid approaches, subject to final requirements.

50 What is the anticipated timeline for transition from the first-generation contract?

The anticipated transition timeline has not been finalized. It will be addressed in a future solicitation.

51 Is DHS/CBP-specific past performance mandatory, or will comparable DoD 24/7 mission-operations experience be considered?

CBP is interested in relevant 24/7 mission-operations experience, including DHS, CBP, DoD, or comparable experience. Final past-performance criteria will be stated in a future solicitation.

52 Will CBP furnish the monitoring (e.g., SolarWinds), SIEM, EDR, vulnerability scanning, and ITSM licenses and the BPTOC console environment, or must the contractor provide them?

CBP anticipates providing access to Government-designated tools, interfaces, and environments required for performance, subject to security, licensing, availability, and access requirements. Expected systems may include ILSS, ILSS Maximo, ServiceNow, TRIRIGA, Tenable Security Center, Nessus, Qualys, SolarWinds, Splunk, and other Government-designated tools. The final solicitation will identify required Government-furnished versus contractor-furnished tools, applicable licenses, API or interface access, test environments, and transition arrangements. The final solicitation will also identify the authoritative systems of record for incident status and operational availability reporting and address whether, and under what conditions, contractor-hosted components may be permitted.

53 Can an analytics component be hosted inside an existing CBP boundary under that system's ATO, and what is CBP's approval path for AI-enabled tools?

Any analytics or AI-enabled capability must comply with applicable CBP security, privacy, architecture, and authorization requirements. The approval process will be addressed in a future solicitation or task order, as applicable.

54 Can CBP release, for pricing, current endpoint counts by system and access class, 12 months of ILSS ticket volume by priority and portfolio, and the Mobile network upfit schedule?

Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation. The requirement has not been finalized. Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation.

55 The AMSS helpdesk table in the draft PWS states "resolve the issue within 1 hour" for P1, while Appendix D measures acknowledgment and triage initiation. Which applies?

CBP recognizes the apparent difference between the AMSS table and Appendix D. The final solicitation will clarify the applicable priority-based performance standards and distinguish acknowledgment, triage, restoration, resolution, and closure measures.

56 Also, the CDRL numbers cited in the PWS text (e.g., DRP as F-03, IRP as F-

04) differ from Appendix A (F-04, F-05). Please confirm.

CBP recognizes the CDRL numbering differences in the draft PWS and will correct them before issuing a final solicitation.

57 Must the primary facility be contractor-owned, or will CBP consider a Government-provided or incumbent facility with a contractor backup site?

Are there location or distance requirements for the backup site?

Suggestions are welcomed. CBP is seeking industry feedback on primary facility models. However, CBP has not finalized whether facilities must be contractor-owned or whether Government-furnished or incumbent facilities may be used. Final location, distance, and facility requirements will be identified in a future solicitation.

58 Is CBP considering a small-business set-aside or separate analytics/RDT&E task orders, and will it accept interim access determinations to reduce the vetting risk during the 45-day phase-in?

CBP has not made final decisions on set-aside strategy, separate analytics/RDT&E task orders, or interim access determinations during phase-in. These matters will be addressed in a future solicitation, as applicable.

59 Approximately how many endpoints, sites and monthly tickets does each initial portfolio generate, and how many endpoints are reachable remotely today?

The requirement has not been finalized. Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation.

60 Will system owners and their vendors provide interface documentation and read-only access to sensor status and output data (radar, camera control, ground-sensor alarms), or is BPTOC limited to network-level monitoring?

The BPTOC contractor is expected to support operational monitoring and coordination within the scope defined for each portfolio and task order. The availability of system-owner documentation, interfaces, and read-only access to operational sensor data will depend on the applicable system, security requirements, and Government authorization. Specific interface and access requirements will be identified in a future solicitation or task order.

61 Will monitoring, SIEM and ticketing tools be Government-furnished, or should vendors price contractor tools?

CBP anticipates providing access to Government-designated monitoring, security operations, ticketing, and related tools required for performance, subject to applicable security, licensing, and access requirements. The final Government-furnished or contractor-furnished tool approach will be identified in a future solicitation.

62 Must the BPTOC facility be Government-provided, or is a contractor facility with secure connectivity to the CBP network acceptable?

CBP has not finalized whether BPTOC facilities will be Government-furnished, contractor-furnished, or a hybrid model. Vendors may describe proposed facility approaches and assumptions, including secure connectivity to CBP systems. Final facility and connectivity requirements will be addressed in a future solicitation.

63 How does CBP calculate Ao today, and will degraded mission functions (for example, radar up but camera down) count as partial availability?

The future solicitation will define operational-availability calculations, including treatment of degraded functionality, partial availability, dependencies, exclusions, outage attribution, and reporting requirements.

64 Will the Government consider a separate planned-maintenance priority category, as recommended in Section 5?

CBP welcomes feedback on whether a planned-maintenance priority category would improve operational management and reporting. The final incident-priority structure and treatment of planned maintenance will be addressed in a future solicitation.

65 Will the IDIQ include a small-business reserve or on-ramp for specialized subcontractors?

CBP has not made a determination regarding a small-business reserve, on-ramp procedures, or other participation mechanisms for specialized subcontractors. However, they are not anticipated.

66 Will CBP consider a small business set-aside, and will the acquisition be a standalone IDIQ or an order under an existing governmentwide vehicle?

CBP has not made a set-aside determination. The final acquisition vehicle and contract structure, including whether the requirement will be competed as a standalone IDIQ or through another vehicle, have not been determined.

67 Must the primary or alternate BPTOC facility be in a specific location, and what physical security standard or facility clearance applies?

CBP has not finalized location, physical-security, accreditation, or facility-clearance requirements for primary or alternate BPTOC facilities. Any applicable requirements will be identified in a future solicitation.

68 What investigation level applies to each role, will CBP accept transferred or interim determinations, and what is the current average processing time?

Personnel requiring access to CBP facilities, systems, networks, or sensitive information will need to meet applicable CBP access and vetting requirements. The anticipated requirement is a CBP Background Investigation or other CBP Office of Professional Responsibility-approved access determination, as appropriate. Specific role-based requirements, acceptance of transferred or interim determinations, and adjudication timelines will be addressed in a future solicitation.

69 Will ILSS, ServiceNow, SIEM, scanning, and monitoring tools be Government-furnished, or should vendors price contractor-furnished tools?

CBP anticipates providing access to Government-designated tools, including ITSM, monitoring, vulnerability-management, and security operations tools, as applicable and subject to security, licensing, and access requirements. Final tool requirements will be identified in a future solicitation.

70 Can CBP share current endpoint counts and 12 months of ticket volume by priority and portfolio to support staffing estimates?

Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation. The requirement has not been finalized. Final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation.

71 Is the current BPTOC facility contractor-owned, and will incumbent staff, configurations, and ticket history be available during transition?

The current BPTOC facility is contractor-owned. An incumbent BPTOC NOC/SOC/Helpdesk provider currently supports portions of the PMOD portfolio. CBP does not intend to provide additional incumbent contract details in response to this RFI. Subject to applicable security, contractual, proprietary, and operational restrictions, CBP anticipates providing relevant Government-controlled transition information and materials to the successful contractor. Specific facility, transition artifacts, access timing, and knowledge-transfer requirements will be identified in a future solicitation.

72 Is the 94 percent threshold and 97 percent objective in draft PWS Section

2.4 measured on BPTOC service availability alone, and which exclusions apply?

CBP recognizes that the draft PWS may contain inconsistent incident-management language. The final solicitation will clarify governing performance measures, including acknowledgment, triage, restoration, resolution, closure, exclusions, dependencies, and attribution to include defining BPTOC service-availability calculations, including the application of threshold and objective measures, exclusions, dependencies, outage attribution, and reporting requirements.

73 Set-aside. Is CBP considering a small business or service-disabled veteran-owned small business set-aside for the enterprise contract or for individual portfolio task orders?

CBP has not made a set-aside determination for the enterprise requirement or individual portfolio task orders. Partial set-asides are not currently anticipated.

74 Facility. Does CBP expect the contractor to provide the BPTOC facility, or will the Government furnish space? If contractor-provided, are there location or accreditation requirements for it?

CBP has not finalized whether BPTOC facilities will be contractor-furnished, Government-furnished, or a hybrid model. Final facility location, security, connectivity, and authorization requirements will be addressed in a future solicitation.

75 Page limit. Will the Government count a shared responsibility matrix, submitted as a table, against the 20-page limit?

The 20-page limitation applies to the white paper. Vendors may include a concise responsibility matrix within the white paper, but it will count toward the page limit.

76 Sizing data. Can the Government share notional endpoint counts, ticket volumes or current staffing levels by portfolio, so vendors can recommend staffing and pricing models on a common basis?

CBP will not release detailed portfolio-level endpoint counts, ticket volumes, or staffing data under this RFI. The final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation. The requirement has not been finalized. Vendors should identify their assumptions and recommend an appropriate staffing approach.

77 Timeline. What is the anticipated timeframe for the enterprise solicitation and for transition from the current BPTOC support contract?

The anticipated solicitation and transition timelines have not been finalized and will not be provided under this RFI.

78 Personnel vetting. Will CBP sponsor background investigations for transition staff before contract start, and what adjudication timelines should vendors plan for?

Personnel requiring access to CBP facilities, systems, networks, or sensitive information will need to meet applicable CBP access and vetting requirements. CBP does not anticipate requiring contractor personnel to possess completed background investigations before contract award.

Specific sponsorship, transition, interim-access, and adjudication-timeline requirements will be addressed in a future solicitation.

79 Draft PWS. The draft PWS does not include the text of the Integrated Surveillance Towers delivery order, and its deliverable numbers differ between the body and the appendix. Will the Government publish the delivery order text and a reconciled deliverables list?

CBP recognizes that the draft PWS requires further refinement, including the Integrated Surveillance Towers delivery-order content and CDRL references. The final solicitation will identify the applicable delivery-order or contract scope and reconcile deliverable numbering, templates, due dates, and acceptance criteria.

80 Is there an incumbent on this requirement? If yes, please provide the contract number.

Yes, there is an incumbent BPTOC NOC/SOC/Helpdesk provider. However, this contract supports only portions of the PMOD portfolio. Subject to applicable restrictions, CBP expects to provide relevant transition information and materials to the successful contractor. Specific transition materials will be identified in a future solicitation.

81 Does the Government expect the current incumbent to compete for any future solicitation related to this requirement?

CBP cannot comment on the anticipated participation of any individual firm in a future solicitation. Any responsible vendor that meets the requirements of a future solicitation may compete, as applicable.

82 Does the Government anticipate identifying the Program Manager as Key Personnel in the final solicitation?

CBP has not determined final key-personnel requirements. Any required key personnel, including whether a Program Manager will be designated as key personnel, will be identified in a future solicitation.

83 Does the 20-page limit include a cover page, table of contents and acronym list? Does the 12-point font requirement also apply to tables, graphics, headers and footers? Are there any margin requirements?

The 20-page limit applies to the white paper and excludes Attachment A.

To ensure consistency and readability, the stated 12-point Times New Roman font requirement applies throughout the response, including tables, graphics, headers, and footers. Vendors should use standard page and margin formatting.

84 The Security Documentation and Deliverables section asks vendors to describe their ability to provide "sample or template documentation." Would you like samples included with the response? If so, may they be submitted as separate attachments outside the 20-page limit?

Vendors may describe their capability to provide sample or template documentation within the white paper. Unless specifically authorized otherwise, separate sample artifacts or attachments beyond Attachment A should not be submitted and will not be considered.

85 Should Attachment A and the white paper be submitted as one file or two?

Is there a preferred file-naming convention?

The white paper and Attachment A can be separate files or combined.

86 The RFI specifies 12-point Times New Roman font for responses. Could the Government please clarify whether smaller font sizes (9 or 10 point) are permissible for tables, graphics, figures, and headers/footers, provided the content remains clearly legible?

To ensure consistent evaluation and readability, the 12-point Times New Roman font requirement applies throughout the response, including tables, graphics, figures, headers, and footers.

87 The RFI specifies 1.5 line spacing with a 20-page response limit.

Considering the extensive technical and service requirements to be addressed, could the Government kindly consider allowing single (1.0) line spacing to enable vendors to provide more comprehensive responses within the prescribed page limit?

The 1.5-line-spacing requirement remains applicable to the white paper.

Vendors should provide concise responses within the stated 20-page limitation.

88 Sections 1 through 5 of the RFI outline various technical, service, security, and contracting considerations and instruct vendors to address the identified capabilities in sequence. However, the RESPONSE section separately identifies 12 specific topics to be addressed in sequence. We understand that vendors are expected to structure their responses around the 12 topics under the RESPONSE section, using Sections 1 through 5 as supporting guidance rather than responding to each requirement individually. Could the Government please confirm whether our understanding is correct?

Vendors should organize their white papers around the 12 response topics identified in the RESPONSE section and address them in sequence.

Sections 1 through 5 provide the capability and technical context that vendors should address, as applicable, within those response topics.

89 The RFI specifies a 20-page limit excluding Attachment A. We understand that the cover page, table of contents, and acronym list are also excluded from the 20-page limit. Could the Government please confirm if our understanding is correct?

The 20-page limit applies to the white paper and excludes Attachment A. A cover page, table of contents, cover letter, acronym list, and any sample artifacts included with the white paper count toward the 20-page limit.

90 The RFI requests responses to the identified capability areas and 12 response topics in sequence, with a maximum of 20 pages excluding Attachment A. Could the Government please confirm whether vendors may consolidate overlapping requirements under the 12 response topics, provided all applicable areas are addressed?

Yes. Vendors may consolidate overlapping content under the 12 response topics, provided the response clearly addresses all applicable capability areas and identifies where each topic is addressed. The 20-page limit applies to the white paper and excludes Attachment A. A cover page, table of contents, cover letter, acronym list, and any sample artifacts included with the white paper count toward the 20-page limit. The 12-point font requirement applies throughout the response, including tables and graphics.

91 Could the Government kindly provide historical data, including the number of supported systems, sites, endpoints, and users; monthly helpdesk calls, incidents, service requests, and work orders; NOC/SOC alert volumes;

incident priorities; and operational availability metrics to better understand the scope and scale of the requirement and propose an appropriate technical and staffing approach.

CBP will not release detailed historical operating data under this RFI, including system, site, user, ticket, alert, incident, and availability data to include not releasing detailed portfolio-level endpoint counts, ticket volumes, or staffing data under this RFI. The final endpoint counts, applicable system scope, endpoint-counting methodology, and any associated pricing basis will be identified in a future solicitation. The requirement has not been finalized. Vendors should identify their assumptions and recommend an appropriate staffing approach.

92 The RFI identifies various SOC operating models, including contractor-operated SOC services, SOC augmentation, and integration with existing CBP/OIT SOC capabilities. Could the Government please clarify whether it has a preferred SOC operating model or if vendors are encouraged to recommend the most suitable approach based on their capabilities?

Industry should assume a contractor-operated SOC as part of the BPTOC service. The contractor will coordinate with CBP and OIT cybersecurity organizations and use Government-designated tools and processes, as applicable. CBP welcomes feedback on the recommended division of responsibilities.

93 The RFI requests vendors to recommend a transition timeline and approach for assuming BPTOC operations from the incumbent provider. Could the Government please confirm whether there is an anticipated transition-in period and whether incumbent operational documentation, monitoring configurations, ticket histories, and other relevant resources will be made available to support knowledge transfer and service continuity?

CBP anticipates an orderly transition and knowledge-transfer process.

Subject to applicable security, contractual, proprietary, and operational restrictions, CBP anticipates providing relevant Government-controlled transition information to the successful contractor. Specific transition duration, artifacts, access timing, overlap, and acceptance requirements will be identified in a future solicitation.

94 RFI p.4 asks vendors to address the Section 1-5 capabilities "in sequence," and p.23 asks for Attachment B topics 1-12 "in sequence." Which structure should the white paper follow? Must every Section 1-5 bullet be answered explicitly?

Vendors should structure the white paper around the 12 response topics identified in the RESPONSE section and address them in sequence.

Sections 1 through 5 provide supporting capability and technical context.

Vendors are not required to provide a separate response to every individual bullet if the applicable information is clearly addressed under the relevant response topic.

95 "Responses shall not exceed 20 pages plus Attachment A." Do the cover page, table of contents, cover letter, acronym list and sample artifacts count toward the 20-page limit? Is there a page size or margin requirement? Does the 12-point rule apply to tables and graphics?

The 20-page limit applies to the white paper and excludes Attachment A. A cover page, table of contents, cover letter, acronym list, and any sample artifacts included with the white paper count toward the 20-page limit. The 12-point font requirement applies throughout the response, including tables and graphics.

96 The Draft PWS lists "Figure 1: BPTOC Workflow," but the figure is not included. Can CBP provide it?

CBP recognizes that the referenced BPTOC workflow figure was not included in the draft PWS. The Government will determine whether to include, revise, or remove the figure in a future solicitation.

97 Appendix B (AMSS) says "Resolve the issue within 1 hour / 4 hours / 8 hours of service request creation." Appendix D measures the same 1, 4, and 8 hours as acknowledgment and triage initiation. Is the AMSS standard resolution or acknowledgment?

CBP recognizes the apparent difference between the AMSS table and Appendix D. The final solicitation will clarify the applicable priority-based performance standards and distinguish acknowledgment, triage, restoration, resolution, and closure measures.

98 The RFI IST list includes Autonomous Integrated Surveillance Towers and Border Wall Integrated Surveillance Systems, which are not in the PWS.