Office of Trade

Illegal Transshipment Pilot

Statement of Work (SOW)

March 31, 2026

THIS PAGE INTENTIONALLY LEFT BLANK

Table of Contents

1.0 BACKGROUND

2.0 SCOPE

3.0 PERIOD OF PERFORMANCE

4.0 TYPE OF CONTRACT

5.0 POINTS OF CONTACT

6.0 DELIVERABLES AND SUPPORT

7.0 COMPLIANCE REQUIREMENTS

7.1 INFORMATION TECHNOLOGY SECURITY COMPLIANCE REQUIREMENTS

7.1.1 DHS Security Policy Compliance Requirements

7.1.2 Basic Requirements

7.1.3 Security Authorization

7.1.4 Encryption Compliance Requirement

7.1.5 Security Review

7.1.6 Enterprise Security Architecture

7.1.7 Information Assurance

Department of Homeland Security Customs & Border Protection (CBP) Statement of Work (SOW) for Illegal Transshipment Pilot

1.0 BACKGROUND

U.S. Customs and Border Protection (CBP) plays a critical role in the enforcement of trade regulations and the collection of customs revenue, positioning itself as the nation’s second largest revenue collection agency. In Fiscal Year 2025, CBP successfully collected $216.7 billion in duties, taxes, and fees, continuing a legacy of robust enforcement that has led to the collection of 99.5% of all customs tariff revenue owed to the U.S. since 1992.

Despite this high collection rate, unscrupulous importers continue to engage in deceptive practices to evade antidumping and countervailing duties, tariffs, and other trade regulations, harming compliant business and eroding the revenue base. Chief among these deceptive practices are illegal transshipment schemes, or the act of routing of goods through a third country to obscure their true country of origin and avoid higher tariffs.

To combat illegal transshipment, CBP has intensified its enforcement efforts by leveraging advanced technology, data analytics, and partnerships with other federal agencies and industry partners. These measures aim to detect and prevent illegal transshipment and other illicit schemes, ensuring compliance with trade laws and protecting U.S. economic interests.

Under the Illegal Transshipment Pilot, CBP will explore whether Artificial Intelligence (AI) technology solutions offered by the private sector can help uncover illegal transshipment schemes at scale and with a high degree of accuracy. This technology demonstration presents opportunities for the private sector and CBP to identify enforcement efficiencies and maximize revenue collection.

2.0 SCOPE

CBP will assess the value of Artificial Intelligence (AI) driven commercial solutions that identify imports which pose a high risk for illegal transshipment. The development and implementation of these private sector solutions will enable CBP to explore how cutting-edge technologies may be leveraged to inform enforcement actions that prevent high-risk imports from entering the U.S.

and/or lead to the identification of additional duties owed.

Vendors will deliver insights about illegal transshipment risk via referral packages to CBP.

Referral packages shall articulate specific risk factors that vendors believe are indicative of illegal transshipment. Referral packages must also identify or be easily traced to imports that are in transit and have not yet arrived in the U.S. To support this requirement, vendors may choose to receive the below manifest information for imports originating from countries that CBP identifies as being higher risk for illegal transshipment. CBP will make manifest information available to vendors no later than 72 hours before imports are expected to arrive in the U.S.

• Port of Unlading

• Port of Lading

• Arrival Date

• Bill Number

• HTS Code

• Shipper

• Consignee

• Cargo Description

• Declared Country of Origin

Vendors will be given an opportunity to prove out the scalability and accuracy of their illegal transshipment solutions over the course of a no-cost, 180-day base period of performance.

Scalability will be measured by the number of actionable referral packages vendors submit to CBP. Accuracy will be measured by the percentage of referral packages that lead to the prevention of high-risk imports from entering the U.S. and/or the identification of additional duties owed. CBP will have full discretion over which referral packages to investigate based on confidence levels, potential revenue impact, ongoing or previous enforcement actions, and resource availability. Only referral packages that CBP chooses to investigate and act upon will be factored into its assessment of accuracy.

Vendors who achieve the performance milestones defined in Section 6.0 may have their option periods exercised by CBP.

The solutions delivered under the Illegal Transshipment Pilot as outlined in this SOW must drive enhancements and efficiencies around targeting for illegal transshipment, maximizing the collection of revenue owed to the U.S., and allocation of CBP resources towards areas of highest revenue risk. The desired end state for this SOW is to identify AI-driven solutions that demonstrate the ability to accurately detect illegal transshipment at a rate of 90 percent or higher—all without exposure to law enforcement sensitive algorithms, CBP’s targeting models, and other sensitive data sets.

3.0 PERIOD OF PERFORMANCE

The contract base period of performance is intended to be 180 days and may contain up to two options.

4.0 TYPE OF CONTRACT

This award will establish a Non-FAR Contract through the DHS Commercial Solution Opening Pilot Program (CSOP).

5.0 POINTS OF CONTACT

Contracting Officer: Peter Giambone Email: PETER.A.GIAMBONE@CBP.DHS.GOV

Contract Specialist: Aristide Horugayve Email: aristide.horugavye@cbp.dhs.gov

6.0 DELIVERABLES AND SUPPORT

Based Period Deliverables Vendors shall submit illegal transshipment referral packages to CBP via email in accordance with the below performance milestone schedule. Referral packages must be actionable, meaning mailto:PETER.A.GIAMBONE@CBP.DHS.GOV mailto:aristide.horugavye@cbp.dhs.gov they:

• Must identify and trace to imports that are in transit and have not yet arrived in the U.S.;

and,

• Must contain substantive supporting evidence (minimum of five pages) with which to make high-confidence decisions about illegal transshipment risk.

During the base period of performance, vendors will be asked to progressively demonstrate the scalability and accuracy of their solutions in 60-day increments. CBP will provide regularly scheduled feedback on whether referral packages:

• Meet the above criteria for being considered actionable; and,

• Lead to the prevention of high-risk imports being released into the U.S. and/or the identification of additional duties owed.

CBP may at any time issue a stop work order to vendors who are unable to meet or exceed the scalability and accuracy thresholds for each 60-day increment.

Base Period of Performance Milestone Schedule

Performance Measure

Gate Timeline Scalability

Threshold Accuracy Threshold

0 – 60 days from base period award

Vendors must submit no less than two actionable referral packages a week 10% or higher

61 – 120 days from base period award

Vendors must submit no less than one actionable referral package a day 30% or higher

121 – 180 days from base period award

Vendors must submit no less than two actional referral packages a day 50% or higher

Option Period Deliverables

Vendors who achieve the performance milestones defined above during the base period may be invited to perform up to two option periods with CBP. If a vendor successfully achieves all of the base period performance thresholds, CBP may, in its discretion, exercise the first option period.

If the first option period is exercised and the vendor successfully achieves the performance thresholds for option period 1, outlined below, then CBP may, in its discretion, exercise the second option period.

Option Period of Performance Milestone Schedule

Option Period Timeline Scalability

Threshold Accuracy Threshold

1 Not to exceed 90 days

Vendors must submit no less than two actionable referral packages a day 70% or higher

2 Not to exceed 90 days

Vendors must submit no less than five actionable referral packages a day 90% or higher

7.0 COMPLIANCE REQUIREMENTS

7.1 Information Technology Security Compliance Requirements

The contractor shall adhere to all DHS and CBP IT security policies and the basic requirements, security authorization, encryption compliance, and pass security review.

7.1.1 DHS Security Policy Compliance Requirements

All hardware, software, and services provided under this CSOP contract must be compliant with DHS 4300A, the DHS Management Directive 140-01, and Information Security Program and CBP Information Systems Security Policies and Procedures Directive, HB 1400-05D.

7.1.2 Basic Requirements

The contractor shall adhere to all DHS and CBP IT security policies listed in the applicable documents section, including the guidelines and policies stated in the DHS Sensitive Systems Policy Directive 4300A or any subsequent, replacement or revised publication. This policy mandates DHS organizational elements, including contractors, follow guidelines outlined in the DHS MD 4300A, DHS Sensitive Systems Directive, Information Technology Security Program, Version 13, with attachments or any subsequent, replacement or revised publication.

DHS Directive 4300A, Basic Requirements outlines the management, operational and technical baseline security requirements (BLSR) for DHS Components to ensure confidentiality, integrity, availability, authenticity, and non-repudiation of sensitive information systems. The 4300A Directive provides greater detail of the BLSRs, including the roles and responsibilities associated with each.

CBP will provide personnel with the appropriate background investigation, clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS MD 4300A, DHS Sensitive Systems Policy and Directive. During all systems development life cycle (SDLC) phases of CBP systems, CBP personnel will develop documentation and provide any required information for all levels of classification in support of the certification/accreditation process. In addition, all security certification/accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

systems development life cycle (SDLC) phases of CBP systems, CBP personnel will develop documentation and provide any required information for all levels of classification in support of the certification/accreditation process. In addition, all security certification/accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

Legacy air gapped non-integrated systems shall:

a) Wi-Fi shall not be used and be disabled.

b) All operating systems must use the requisite DHS Security Technical Implementation

Guides (STIGs) for hardening configurations.

c) All vendor contractors shall not remove image data from systems nor store said data on contractor networks.

d) Ground-truthing or tuning of systems will be performed only on CBP systems and not on contractor networks unless specifically authorized.

e) Integrated networked systems shall follow the above requirements and additionally:

o If systems are using WIFI the design must be explicitly reviewed and approved by the CBP EIOD organization and Security and Technology Policy (STP).

f) Other wireless connectivity may be approved by EIOD

g) Systems must be patched and security updates maintained according to DHS patching standards (within 30 days usually) CBP Information Systems Security Policies and Procedures, Information Security Continuous Monitoring guidelines.

h) Username/Password authentication is not allowed.

7.1.3 Security Authorization

a) A Security Authorization of any infrastructure directly in support of the DHS information system shall be performed by the contractor as a general support system (GSS) prior to DHS occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results.

The Security Authorization shall be performed in accordance with the DHS Security Policy and the controls provided by the hosting provider shall be equal to or stronger than the Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, Section 3, security categorization of the DHS information system.

b) At the beginning of the contract, and annually thereafter, the contractor shall provide the results of an independent assessment and verification of security controls in the contractor’s format. The independent assessment and verification shall apply the same standards that DHS applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the Contracting Officer Representative (COR) for entry into the DHS Plan of Action and Milestone (POA&M) Management Process. The contractor shall use the DHS POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS POA&M Management Process. contractor procedures shall be subject to periodic, unannounced assessments by DHS officials. The physical aspects associated with contractor activities shall also be subject to such assessments.

c) On a periodic basis, the DHS and its components, including the DHS Office of Inspector General, may choose to evaluate any or all of the security controls implemented by the contractor under these clauses. Evaluation could include but is not limited to vulnerability scanning. The DHS and its Components reserve the right to conduct audits at their discretion. With ten working days’ notice, at the request of the Government, the contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein DHS information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of DHS, including those initiated by the Office of the Inspector

General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by DHS in the event of a security incident.

7.1.4 Encryption Compliance Requirement

a) Systems requiring encryption shall comply with FIPS 197 Advanced Encryption Standard (AES) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

b) Systems requiring encryption shall comply with National Security Agency (NSA) Type 2 or Type 1 encryption.

c) Only cryptographic modules that are FIPS 197 (AES 256) compliant and have received FIPS 140-2 validation at the level appropriate to their intended use may be used in systems requiring encryption.

d) Public Key Infrastructure (PKI) (see the Department of Homeland Security (DHS) Sensitive Systems Policy Directive 4300A).

7.1.5 Security Review

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The contractor shall afford DHS including the organization of the DHS Office of the Chief Information Officer, Office of Inspector General, the CBP Chief Information Security Officer, authorized COR, and other Government oversight organizations, access to the Contractor’s and subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of Government oversight organizations external to the DHS. The contractor shall provide access to the extent necessary for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

7.1.6 Enterprise Security Architecture

The contractor shall utilize and adhere to the DHS Enterprise Security Architecture in accordance with applicable laws and DHS policies to the satisfaction of the DHS COR. Areas of consideration could include:

a) Use of multi-tier design (separating web, application, and data base) with policy enforcement between tiers

b) Compliance to DHS Identity Credential and Access Management (ICAM)

c) Security reporting to DHS central control points (i.e., the DHS Enterprise

Security Operations Center (ESOC) and integration into DHS Security Incident Response

d) Integration into DHS Change Management (for example, the Infrastructure Change Control Board (ICCB) process)

e) Performance of security maintenance activities per continuous monitoring requirements

7.1.7 Information Assurance

Information Assurance (IA) is considered a requirement for all systems used to input, process, store, display, or transmit sensitive or national security information. IA is achieved through the acquisition and appropriate implementation of evaluated or validated commercial-off-the-shelf (COTS) IA and IA-enabled Information Technology (IT) products. These products provide for the availability of systems. The products also ensure the integrity and confidentiality of information and the authentication and nonrepudiation of parties in electronic transactions.

Strong preference is given to the acquisition of COTS IA and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting sensitive information) that have been evaluated and validated by authorized commercial laboratories or by National Institute of Standards and Technology (NIST), as appropriate, in accordance with the following:

a) The NIST Federal Information Processing Standards (FIPS) validation program

b) The National Security Area (NSA) /NIST National Information Assurance Partnership

(NIAP) Evaluation and Validation Program

c) The International Common Criteria for Information Security Technology Evaluation

Mutual Recognition Agreement

The Contractor acknowledges all CBP data provided or accessed under this SOW shall be handled in strict accordance with all applicable federal laws, regulations, and CBP policies consistent with HSAR 3052.204-70(e), including but not limited to those pertaining to data privacy, security, and retention. The Contractor shall use such data exclusively for the performance of the services specified in this SOW and for no other purpose.

Upon the expiration or termination of this contract, or at any time CBP determines the data is no longer necessary for the performance of the services, the Contractor shall:

1. Cease all use of the CBP data.

2. Securely delete, destroy, or render unreadable all CBP data, including all copies, extracts, analyses, and derivatives, from all Contractor systems, databases, storage devices, and backup media.

3. Provide written certification to the CBP Contracting Officer within 5 business days of such deletion or destruction, confirming full compliance with this requirement.

4. The Contractor shall ensure that any subcontractors or third parties granted access to CBP data are bound by equivalent data use and deletion obligations.