Draft Performance Work Statement .pdf

HUD Technology Transformation Next Generation

Table of Contents

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 Governing Law/Licensing Agreements

B.2 Contract Type

B.3 Minimum and Maximum Amounts

B.4 Other Direct Costs

B.5 Service Contract Labor Standards

B.6 Price/Cost Schedule

SECTION C DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

C.1 SCOPE

C.2 APPLICABLE DOCUMENTS

C.3 GENERAL REQUIREMENTS

C.4 TECHNICAL FUNCTIONAL AREAS

C.5 DELIVERABLES

C.6 SECURITY AND PRIVACY

C.7 REPORTING AND MEETING REQUIREMENTS

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 Governing Law/Licensing Agreements

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Task Orders (TOs). Commercial license agreements may be made a part of this

Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212 - Computer Software, FAR 27.405-3 – Commercial Computer Software, and

FAR 27.404-2 – Limited Rights Data and Restricted Computer Software. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/TOs; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap agreement/license), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap agreement/license), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this

Contract/TOs, and only to the extent that those provisions are not duplicative or inconsistent with

Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this

Contract/TO; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/TOs. Federal law and regulation including, without limitation, the

Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act

(31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and

FAR clauses 52.212-4 – Contract Terms and Conditions – Commercial Products and

Commercial Services, 52.227-14 – Rights in Data-General, 52.227-19 – Commercial Computer

Software License shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/TOs with unlimited rights as defined by FAR 52.227-

14 – Rights in Data-General. Claims of patent or copyright infringement brought against the

Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/TOs must be made by modification (Standard Form (SF) 30) and shall only be made by a warranted

Contracting Officer. Nothing in this Contract/TOs or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.2 Contract Type

This is a solicitation to issue a multiple award Indefinite Delivery/Indefinite Quantity (MAC

IDIQ) contract. Individual Task Orders (TOs) will be placed on a Firm Fixed Price (FFP), Labor

Hour/Time and Materials (T&M), or Cost Reimbursement (CR) basis, or a combination of these types for individual TO requirements, the cumulative value of which shall not exceed the maximum amount defined in the contract. The resulting TOs may include Fixed Price Incentive

(FPI) and/or award term arrangements.

B.3 Minimum and Maximum Amounts

In accordance with FAR 52.216-22 – Indefinite Quantity (IQ): (a)This is an IQ contract for the supplies or services specified, and effective for the period stated, in the Schedule. The quantities of supplies and services specified in the Schedule are estimates only and are not purchased by this MAC IDIQ, (b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. The contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the “maximum”. The Government shall order at least the quantity of supplies or services designated in the Schedule as the “minimum”., (c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, there is no limit on the number of orders that may be issued. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations., and (d) Any order issued during the effective period of this contract and not completed within that period shall be completed by the Contractor within the time specified in the order. The contract shall govern the Contractor’s and Government’s rights and obligations with respect to that order to the same extent as if the order were completed during the contract’s effective period; provided, that the Contractor shall not be required to make any deliveries under this contract after XXXX XX, 20XX.

In accordance with FAR 52.216-27 – Single or Multiple Awards, the Government may elect to award a single delivery order contract, TOs contract, or award a multiple delivery order contract for the same or similar supplies or service to two or more sources under this solicitation.

Minimum Amount: The “minimum amount” is defined as the total minimum amount the U.S.

Department of HUD is required to order under each H2TNG IDIQ TOs and the Contractor is required to furnish as ordered, over the entire term of the contract, inclusive of all ordering periods. The total minimum amount each prime Contractor shall receive for the life of the

H2TNG MAC IDIQ contract is $50,000 per year. These funds shall be utilized by the Contractor to maintain a one-third Full Time Equivalent (1/3 FTE) dedicated Proposal Manager or Program

Manager annually for the life of the IDIQ MAC contract. The Proposal Manager or Program

Manager shall maintain contact with the Contracting Officer and actively review TO RFIs weekly for opportunities to support the US Department of HUD.

Maximum Amount: The “maximum amount” is defined as the total maximum amount the U.S.

Department of HUD can order under each H2TNG IDIQ TOs and the Contractor is required to furnish as ordered, over the entire term of the contract, inclusive of all ordering periods. The total annual maximum ceiling amount of the H2TNG MAC IDIQ contract is; $700,000.00.

The total ceiling for all order periods of the H2TNG MAC IDIQ is $3,500,000.00.

In accordance with FAR 52.232-7 – Payments under Time-and-Materials and Labor-Hour

Contracts, Section (d) Total Cost and (e) Ceiling Price, all T&M and/or labor hour TOs will include a TO ceiling amount, and the contractor shall not exceed the ceiling amount set forth in the TO. The Government will not be obligated to pay the Contractor any amount in excess of the maximum amount of the TO ceiling unless a TO modification has been executed to support it prior to the TO ceiling increase.

Specific requirements will be identified in the individual Performance Work Statements (PWS) for the TOs that are issued under the H2TNG MAC IDIQ contract. During the life of the

H2TNG MAC IDIQ contract, the Government may order services utilizing the proposed prices by the offerors up to the specified TO ceiling maximum amount set forth in the H2TNG MAC

IDIQ.

B.4 Other Direct Costs

Other Directed Costs (ODCs) may be included in TOs for applicable costs for labor or material that are not accurately categorized under any type of order (i.e. FFP, labor hour, T&M, etc.)

including hardware, software, and/or subcontractor cost(s). ODCs may be included based on the

Contracting Officer’s determination that the ODCs are offered at a fair and reasonable price, and the inclusion of the ODCs is in the best interest of the government in order to complete associated TO requirements.

All TO material ODC’s for information technology hardware, software, applications, and other information technology incidentals and products shall exclusively be for material that is necessary to onboard the new information technology solutions and/or capabilities and are not currently readily available for procurement using one HUD’s existing BPAs for hardware, software, applications, and/or cloud. The H2TNG MAC IDIQ is not intended as a mechanism to solely purchase information technology products and incidentals. Such products may be purchased to the extent that those products are necessary to deliver the solution and/or capability required. Post delivery, those products shall be onboarded to HUD’s Hardware, Software, and

Cloud BPAs for continued lifecycle support and replacement.

B.5 Service Contract Labor Standards

The purpose of the H2TNG MAC IDIQ is to provide an avenue for the US Department of HUD

Office of Chief Information Officer (OCIO) to obtain technology transformation next generation information technology services and support for its portfolio capabilities and offices. As outlined in the list of labor categories in Attachment XX the US Department of HUD anticipates that in most cases the work/labor required at the individual TO level will not principally be covered un the US Department of Labor Wage Determination SCA Labor Categories.

For all SCA and non-SCA Labor Categories the Contractor shall comply with FAR 52.222-41 –

Service Contract Labor Standards, 41 U.S.C. Chapter 67 – Service Contract Labor Standards, 29

CFR Part 4 – Labor Standards for Federal Service, and Fair Labor Standards Act (FLSA).

B.6 Price/Cost Schedule

NOTE: FOR PROPOSAL PURPOSES ONLY, CLIN PRICING IS NOT REQUIRED IN

SECTION B OF THIS SOLICITATION.

All price proposals must be submitted in the format provided at Section J, Attachment 001. The deliverables associated with Contract Line Item Numbers (CLIN) 0004 through 0011 shall be submitted for each TOs and included in the price/cost of each TOs. The specific deliverables under CLINs 0004 through 0011 will not be set forth under individual TOs.

PRICE SCHEDULE

BASE PERIOD

CLIN DESCRIPTION QUANTITY UNIT UNIT

COSTS

TOTAL

COST

0001 Firm-Fixed-Price Line Item

SECURITY CLASS: Determined at

TOs Level

This CLIN is to provide Information

Technology (IT) services and incidental supplies on a FFP basis for a period of 60 months from date of award in accordance with the

HUD Technology Transformation

Next Generation (H2TNG)

Performance Work Statement (PWS) set forth in Section C.

Specific requirements and pricing shall be set forth under individual

TOs.

Inspection, Acceptance, and Free on

Board (FOB) Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual TOs.

The delivery or performance schedule shall be determined on each individual TOs.

0002 Time-and-Materials/Labor-Hour

Line Item

This CLIN is to provide IT services and incidental supplies on a

T&M/LH basis for a period of 60 months from date of award in accordance with the H2TNG PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual

TOs.

Inspection, Acceptance, and FOB

Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual TOs.

The delivery or performance schedule shall be determined on each individual TOs.

0003 Cost Reimbursement (CR) Line

Item

This CLIN is to provide IT services and incidental supplies on a CR basis for a period of 60 months from date of award in accordance with the

H2TNG PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual

TOs.

Inspection, Acceptance, and FOB

Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual TOs.

The delivery or performance schedule shall be determined on each individual TOs.

0004 Contractor’s Progress, Status, and

Management Report

Quarterly Status Report shall be provided in accordance with Section

C, PWS, Paragraph 8.1.1(A) and

(B)(C)(D) and (E), and Section J

Attachment 003 when applicable to

TOs contract type.

NSP NSP

FOB Point: Destination

Inspection/Acceptance: Destination

0005 Contract Performance Report

Contract Performance Report shall be provided in accordance with

Section C, PWS, Paragraph 8.1.2

(A) and (B), and Section J

Attachments 004 (T&M) and 005

(CR) when applicable to TOs contract type. Report not applicable for FFP TOs.

NSP NSP

0006 Government Furnished

Equipment (GFE) Status Report

Government Furnished Equipment

GFE Status Report shall be provided in accordance with Section C, PWS, Paragraph 8.1.3 (A-K) and Section J, Attachment 006.

0007 Personnel Contractor Manpower

Report

Personnel Contractor Manpower

Report shall be provided in accordance with Section C, PWS, Paragraph 8.1.4 (A-S) and Section J, Attachment 008.

0008 Contractor Staff Roster

Contractor Staff Roster shall be

C, PWS, Paragraph 8.1.5 and

Section J, Attachment 009.

0009 Small Business Participation

Small Business Participation Report shall be provided in accordance with

Section H, clause H-4 Small

Business Participation

Requirements, and Section J, Attachment 010.

NSP NSP

0010 Veterans Employment

Certification Report

Veterans Employment Certification

Report in accordance with Section

H, clause H-5 and Section J, Attachment 011.

NSP NSP

0011 Final Section 508 Compliance Test

Results

Final Section 508 Compliance Test

Results in accordance with PWS

Paragraph 8.1, Reporting Requirements.

Option Period One

This 60-month option period may be exercised at the Government’s discretion in accordance with FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer (CO). If exercised, this option shall commence immediately after expiration of the base period.

PRICE SCHEDULE

OPTION PERIOD

CLIN DESCRIPTION QUANTITY UNIT UNIT

COSTS

TOTAL

COST

1001 Firm-Fixed-Price Line Item

This CLIN is to provide IT services and incidental supplies on a FFP basis for a period of 60 months from date of option exercise in accordance with the H2TNG PWS set forth in

Section C.

Specific requirements and pricing shall be set forth under individual

TOs.

Inspection, Acceptance, and Free on

Board (FOB) Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual TOs.

The delivery or performance schedule shall be determined on each individual TOs.

1002 Time-and-Materials/Labor-Hour

Line Item

This CLIN is to provide IT services and incidental supplies on a

T&M/LH basis for a period of 60 months from date of option exercise in accordance with the H2TNG PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual

TOs.

Inspection, Acceptance, and FOB

Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual TOs.

The delivery or performance schedule shall be determined on each individual TOs.

1003 Cost Reimbursement Line Item

This CLIN is to provide IT services and incidental supplies on a CR basis for a period of 60 months from date of option exercise in accordance with the H2TNG PWS set forth in

Section C.

Specific requirements and pricing shall be set forth under individual

TOs.

Inspection, Acceptance, and FOB

Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual TOs.

The delivery or performance schedule shall be determined on each individual TOs.

1004 Contractor’s Progress, Status, and

Management Report – TOs Level

Quarterly Status Report shall be

C, PWS, Paragraph 8.1.1(A) and

(B)(C)(D) and (E), and Section J

Attachment 003 when applicable to

TOs contract type.

1005 Contract Performance Report -

Quarterly Contract Performance

Report shall be provided in accordance with Section C, PWS, Paragraph 8.1.2 (A) and (B), and

Section J Attachments 004 (T&M) and 005 (CR) when applicable to

TOs contract type. Report not applicable for FFP TOs.

1006 Government Furnished

Equipment (GFE) Status Report –

Quarterly Government Furnished

Equipment GFE Status Report shall be provided in accordance with

Section C, PWS, Paragraph 8.1.3

(A-K) and Section J, Attachment

006.

1007 Personnel Contractor Manpower

Report – TOs Level

Quarterly Personnel Contractor

Manpower Report shall be provided in accordance with Section C, PWS, Paragraph 8.1.4 (A-S) and Section J, Attachment 008.

1008 Contractor Staff Roster - TOs

Level

Due within three (3) business days of TOs award. Contractor Staff

Roster shall be provided in accordance with Section C, PWS, Paragraph 8.1.5 and Section J, Attachment 009.

FOB Point: Destination

Inspection/Acceptance: Destination

1009 Small Business Participation

Quarterly Small Business

Participation Report shall be provided in accordance with Section

H, clause H.4 Small Business

Participation Requirements, PWS

Paragraph 8.1.6 and Section J, Attachment 010.

1010 Veterans Employment

Certification Report

Quarterly Veterans Employment

Certification Report in accordance with Section H, clause H.5, PWS

Paragraph 8.1.7 and Section J, Attachment 011.

1011 Final Section 508 Compliance Test

Results

Final Section 508 Compliance Test

Results in accordance with PWS

Paragraph 8.1, Reporting Requirements.

SECTION C DESCRIPTION/SPECIFICATIONS/STATEMENT OF

WORK

Performance Work Statement (PWS) for the

Multiple Award Contract

Indefinite Deliver Indefinite Quantity

(H2TNG MAC IDIQ) Contract

DATE: February 25, 2026

United States Department of Housing and Urban Development Office of Chief Information Officer

(US Department of HUD OCIO)

C.1 SCOPE

Under the HUD Technology Transformation Next Generation Multiple Award Contract

Indefinite Delivery/Indefinite Quantity Performance Work Statement (H2TNG MAC IDIQ

PWS), the Contractor shall deliver comprehensive IT Support Services and Technology

Transformation Next Generation (ITSS and 2TNG) solutions across HUD Headquarters (HQ), regional and field offices, data centers, and other designated locations. Support under this contract shall span the functional areas of the Office of Chief Information Officer (OCIO), including but not limited to:

• OCIO front office

• Assistance Chief Information Officer Business IT Resource Management (ACIO BIRM)

• Office of Chief Technology Officer (OCTO)

• ACIO Customer Relationship & Performance Management (ACIO CRPM)

• Office of Chief Information Security Office (OCISO)

• ACIO Office of Infrastructure & Operations (ACIO OIO)

• Office of the Artificial Intelligence Officer (OAIO)

• Office of Digital Business Officer (ODBO)

C.1.1 Scope of Support

Individual TOs (TOs) may include support request for, but are not limited to:

Enterprise performance & risk management, performance management, project health assessments, risk planning, TechStat management, audit response development, communications, OCIO communications and channels, governance, annual strategic planning, customer care committee board, policy management, contract management, adjudication of contracts requesting onsite performance by contractors, acquisition management, acquisition coordination, asset requisition, COR support, administrative management, leadership and employee development and training support, telework/remote work support, reasonable accommodations, timekeeping, travel, space manage, supplies, workforce planning and talent management, financial management, budget execution, budget formulation and capital planning, micro-purchases, spend plan management, customer experience (CX), employee experience

(EX), enterprise architecture, capabilities and standards, solution engineering, technical governance, technology strategy, technical solutions, analytics and reporting, cloud applications, custom development, data services, emerging technology, systems/software engineering, software technology demonstration and transitions, test and evaluation (T&E), independent verification & validation (IV&V), acquisition support, acquisition engagement and support, contract management support, budget formulation & capital planning, business need intake for pre-select phase, business need and case/select phase support, budget support, budget management and support, customer engagement, customer centric communication, customer relationship management, FITARA, FITARA request process facilitation, open government, audit and policy response facilitation, program & project management (P/PM), IT asset management, project lifecycle management, governance, risk & compliance, enterprise management framework (EMF), cybersecurity policies and procedures, FISMA CIO

Quarterly/Annual Data Calls, plans of action and milestones (POA&Ms) tracking, security assessments, cyber incident response team (CIRT), security operations center (SOC), threat intelligence, Information System Security Officer (ISSO) support, phishing exercises, security awareness and training, security architecture, data loss prevention, Zero Trust Architecture

(ZTA), end-to-end lifecycle O&M support for program office systems, accounts & access, data center access management and support, DIAMS administration and support, DIAMS requests, asset management, hardware (H/W) and software (S/W) asset management, audit & reporting compliance, audit support, DHS/CIS BOD Reporting, configuration & release management, patch planning, existing device support, checkout inventory, Headquarters (H/Q) printer support, power outages, printer support, workstation moves, field support, enterprise application support, testing and deployment of new technologies, IT training, H/W, assistive technology (AT) & training resources, IT and operations & maintenance (O&M) support, IT and DME

(development, modernization, and enhancement) support, IT and integration and deployment

(I&D) support, end user support, network support, telecommunication support, updating outlook distribution lists, data center network security administration, data center network administration, email support, fiber cabling, IP address management, LAN administration, network operation pilots, regional and field office moves, remote access systems support, service desk ticket management, system/performance monitoring, system XID approvals, Tiger Team testing and troubleshooting, VoIP support, Video Teleconferencing (VTC) HQ support, WAN administration Wi-Fi administration, security management, antivirus management, Continuous

Diagnostic Monitoring (CDM) administration, Enterprise Mobility Management (EMM), log monitoring and event management, security assessment, security configuration settings management (CSM), vulnerability scanning, system support, data center application support, data center asset and quality management and support, data center cloud management and support, data center database administration, data center mainframe administration, data center middleware administration, data center network administration, data center production control, data center security compliance, data center server administration, event support, IT facilities;

and other solutions encompassing the entire spectrum of IT and IT requirements, to include software and hardware incidental to the solutions.

Contractors shall deliver scalable, secure, compliant, and customer-focused solutions under individual TOs that specify outcomes, service levels, and delivery locations.

C.1.2 IT Product Acquisition

Individual TOs may include the acquisition of software and hardware IT products necessary to implement the required solution or capability when such products aren’t readily available through HUD’s existing Blanket Purchase Agreements (BPAs) for hardware, software, and/or cloud services.

• The H2TNG MAC IDIQ is not intended to serve solely as a vehicle for purchasing IT products; however, products may be acquired when they are essential to delivering the specified solution or capability.

• After delivery, these products will be transitioned to HUD’s Hardware, Software, and

Cloud BPAs for ongoing lifecycle support and replacement.

• ITSS, and related IT products, may cover the full system lifecycle.

Contractors must be prepared to provide services and deliverables nationwide, including the

United States (U.S.), the U.S. commonwealths, and unincorporated U.S. territories.

C.1.3 Functional Area Requirements

The H2TNG MAC IDIQ PWS outlines general requirements, while specific requirements will be defined in individual TOs. Functional area requirements, described in Section 4.0 - Technical

Function Areas, are not mutually exclusive; many requirements will span multiple areas to deliver a comprehensive, end-to-end lifecycle solution.

For this contract, end-to-end lifecycle refers to all phases of the product lifecycle, including:

• Development, Modernization, & Enhancement (DME)

• Integration & Deployment (I&D)

• Operations & Maintenance (O&M)

• Decommissioning and End-of-Life (EOL)

To support HUD’s small business objectives and promote maximum competition, a minimum of thirty percent (30%) of the overall H2TNG MAC IDIQ contract will be awarded as Small

Business Set-Asides across the Technical Function Areas.

C.2 APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual TOs.

1. 44 U.S.C. § 3554, “Federal Information Security Modernization Act of 2014”

2. 44 U.S.C. 3551-3558, “Cybersecurity Improvements to Agency Information

Systems”

3. 41 U.S.C. § 1321-1328, Federal Acquisition Supply Chain Security Act.

4. Federal Information Processing Standards (FIPS) Publication 140-3, “Security

Requirements for Cryptographic Modules”, April 1, 2022

5. ISO/IEC 19790:2025, Information Security, cybersecurity and privacy protection –

Security requirements for cryptographic modules, Edition 3, 2025.

6. 18 U.S.C. § 278g-3a, Internet of Things Cybersecurity Act.

7. 44 U.S.C. § 3607-3616, FEDRAMP Authorization Act

8. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

9. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

10. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 24, 2022

11. 10 U.S.C. § 2224, "Defense Information Assurance Program"

12. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

13. Cyber Information Security Agency Binding Operational Directive 22-01 and its successors

14. HUDAR 2452.239-70 (Access to HUD systems) Part of HUD Procurement

Handbook 2210.3, March 31, 2017

15. NIST SP 800-83 Rev 1, Guide to Malware Incident Prevention and Handling for

Desktops and Laptops, July 2013

16. NIST SP 1800-25, Data Integrity: Identifying and Protecting Assets Against

Ransomware and Other Destructive Events, December 2020

17. NIST SP 800-61 Rev 3, Computer Security Incident Handling Guide, April 3, 2025

18. NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems

Organizations, September 2020

19. OMB M-21-31, Improving the Federal Government’s Investigative and Remediation

Capabilities Related to Cybersecurity Incidents

20. OMB Memorandum M-22-09, "Moving the U.S. Government Toward Zero Trust

Cybersecurity Principles

21. OMB M-25-22, "Driving Efficient Acquisition of Artificial Intelligence in

Government

22. OMB M-19-17, "Enabling Mission Delivery through Improved Identity, Credential, and Access Management

23. OMB Memorandum M-19-03, "Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program,"

24. Executive Order 14306, June 6, 2025, "Sustaining Select Efforts to Strengthen the

Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order

14144,"

25. HUD CPO, AS-2315 Cybersecurity and Privacy Requirements (APRIL 2022)

26. HUD Handbook 2400.1 - Information Resources Management (IRM) Policies

27. HUD Handbook 2400.25 - Information Technology Security Policy

28. HUD Handbook 2400.25 - Vulnerability Disclosure Policy

29. HUD Handbook 3150.1 - Breach Notification Policy and Response Plan Rev 1.0

30. HUD Handbook 3250.1 - HUD Business Process Improvement

31. HUD Handbook 3251.1 - Secure Configuration Management Policy

32. HUD Handbook 3252.1 - Software Configuration Management Policy

33. HUD Handbook 3253.1 - Change Management Policy

34. HUD Handbook 3254.1 - Enterprise Patch Management Policy

35. HUD Handbook 3255.1 - Enterprise Architecture Policy

36. HUD Handbook 3256.1 - Information Technology Asset Management Policy

37. HUD Handbook 3260.1 - Enterprise Data Management (EDM) Policy

38. HUD Handbook 3262.1 - Software Acquisition Capability Maturity Model Policy

39. HUD Handbook 300.00.1 - Total Information Quality Management

40. HUD Handbook 3400.1 - HUD Policy for IT Management Framework

41. HUD Handbook 3410.1 - HUD Policy for Information Technology Governance

42. HUD Handbook 3417.1 - Web Application Policy

43. HUD Handbook 3425.1 - HUD Policy for Information Technology Strategic Planning

44. HUD Handbook 3430.1 - HUD Policy for Agile Methodology Rev. 1

45. HUD Handbook 3435.1 - HUD OCIO Risk Management Policy

46. HUD Handbook 3440.1 - HUD OCIO Techstat Policy

47. HUD Handbook 3500.1 - HUD Source Code Policy

48. HUD IT Capital Planning and Investment Control Process Guide, October 2020

49. HUD Handbook 2300.2 - Travel Handbook

50. HUD Handbook 1325.1 - HUD Privacy Handbook Rev. 1.0

51. HUD Handbook 1750.1 - Information and Administrative Security Program

52. HUD Handbook 1751.1 - HUD Controlled Information Program

53. HUD Handbook 2135.1 - Forms Management

54. HUD Handbook 2225.6 - HUD Records Disposition Schedules

55. HUD Handbook 2228.2 - HUD Records & Information Management Handbook

56. HUD Handbook 3230.2 - Physical Security Handbook for HUD Regional and Field

Offices

57. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

58. Office of Management and Budget Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

59. 5 U.S.C. Section 552a, as amended, the Privacy Act of 1974

60. NIST SP 800-66 Rev. 2, “An Introductory Resource Guide for Implementing the

Health Insurance Portability and Accountability Act (HIPAA) Security Rule,”

February 2024

61. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. Section § 794d), as amended, January 18, 2017

62. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

63. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-

53 Rev 5, “Security and Privacy Controls for Federal Information Systems and

Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

64. Federal Travel Regulation (FTR). 2025 (www.gsa.gov/federaltravelregulation)

65. Common Approach to Federal Enterprise Architecture and the Collaborative Planning

Methodology (CPM), May 2012NIST SP 800-37 Rev 2, “Risk Management

Framework for Information Systems and Organizations: A System Life Cycle

Approach for Security and Privacy,” December 2018

66. OMB Memorandum M-24-15, Modernizing the Federal Risk and Authorization

Management Program, July 25, 2024OMB Memorandum 05-24, “Implementation of

Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common

Identification Standard for Federal Employees and Contractors,” August 5, 2005

67. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved

Identity, Credential, and Access Management,” May 21, 2019

68. GSA ICAM Solutions and Shared Services Roadmap (GSA ICAM Solutions and

Shared Services Roadmap - IDManagement

69. OMB Memorandum, “Guidance for Homeland Security Presidential Directive

(HSPD) 12 Implementation,” May 23, 2008

70. FICAM Architecture and Accompanying Playbooks, Version 3.3, June 30, 2023

(FICAM Architecture - IDManagement)NIST SP 800-116 Rev 1, “Guidelines for the

Use of Personal Identity Verification (PIV) Credentials in Facility Access,” June

71. NIST SP 800-63-4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” updated August 1,2025

72. NIST SP 800-157 Rev. 1, “Guidelines for Derived PIV Credentials,” November 2024

73. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

74. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC)

Initiative,” September 12, 2019

75. OMB Memorandum M-22-09, Federal Zero Trust Strategy, January 26, 2022

76. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name

System Infrastructure,” August 22, 2008

77. OMB Memorandum M-23-10, DOTGOV Online Trust in Government Act of 2020, February 8, 2023 https://www.gsa.gov/federaltravelregulation https://www.idmanagement.gov/icamsolutions/#:~:text=The%20roadmap%20aligns%20actions%20to,%2Dto%2Dmission%20partner%20interactions.

https://www.idmanagement.gov/icamsolutions/#:~:text=The%20roadmap%20aligns%20actions%20to,%2Dto%2Dmission%20partner%20interactions.

https://www.idmanagement.gov/arch/ https://www.cisa.gov/publication/tic-30-core-guidance-documents

78. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public

Law 110–140), December 19, 2007

79. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

80. Clinger-Cohen Act of 1996, 40 U.S.C. §11101, § 11331, and §11103

81. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

82. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),“ November 19, 2020

83. ANSI/EIA-310, Cabinets, Racks, Panels, and Associated Equipment, December 1st,

84. ANSI/TIA-607-C, Telecommunications Bonding and Grounding (Earthing), November 2015

85. NFPA 70, National Electric Code (NEC), 2026

86. BICSI N3-2020, Bonding and Grounding, January 7, 2020

87. NFPA 17/17A, Dry & Wet Chemical Systems, 2024

88. NFPA 101, Life Safety Code, 2024

89. ASTM E814 & UL 1479, Standard Test Method for Fire Tests of Penetration Firestop

Systems, May 2024

90. ASTM E1966 & UL 2079, Standard Test Method for Fire-Resistive Joint Systems, October 2024

91. NFPA 221, Standard for High Challenging Fire Walls, Fire Walls, and Fire Barrier

Walls, 2024

92. NEC 406.3, Receptacle Rating and Type, 2023

93. NECA/NEMA 105-2024, Standard for Installing Metal Cable Tray Systems, 2024

94. ANSI/TIA-568-E-2020, Commercial Building Telecommunications Cabling

Standards, 2020

95. ANSI/TIA-569, Telecommunication Pathways and Spaces, June 2022

96. ANSI/BICSI N2-3029, Installation of Telecommunications and ICT Cabling, December 2017

97. NEC Article 392, Cable Trays, P/O NFPA 70, 2026

C.3 GENERAL REQUIREMENTS

The Contractor shall provide and/or acquire ITSS and 2TNG solutions in support of the HUD

OCIO relevant functional areas, together with any incidental hardware and software required under the individual Task Orders (TOs). Offerors are not required to address all functional areas to be eligible for award under this IDIQ. Specific requirements will be defined at the TO level, and the Government may issue TOs that address one or more of the relevant OCIO functional areas based on mission needs. Offerors must have already qualified for all functional areas relevant to a TO for eligibility of an award to that specific TO.

C.3.1 Contract Type

This is a solicitation to issue a multiple award Indefinite Delivery/Indefinite Quantity (MAC

IDIQ) contract. Individual TOs will be placed on a Firm Fixed Price (FFP), Labor Hour/Time and Materials (T&M), or Cost Reimbursement (CR) basis, or a combination of these types for individual TO requirements, the cumulative value of which shall not exceed the maximum amount defined in the contract. The resulting TOs may include Fixed Price Incentive (FPI) and/or award term arrangements.

C.3.2 Annual Re-Solicitation

C.3.2.1 Annual Re-Solicitation Refresh

The Contracting Officer reserves the unilateral right to conduct an annual re-solicitation refresh of the H2TNG MAC IDIQ contract. The refresh will typically occur during March or April of each calendar year, or at another time determined necessary by the government to maintain alignment with HUD’s mission needs, technical advancements, and applicable laws or policies.

The annual refresh may include updates to requirements, evaluation criteria, functional area designations, or other solicitation elements.

C.3.2.2 On-Ramp of New Contractors

As part of the annual – or at any other time determined to be in the Government’s best interest -re-solicitation refresh, the government may conduct an on-ramp to add new Contractors to the

H2TNG MAC IDIQ. On-ramps may be open to all offerors or limited to specific business categories or functional areas to support competition, socioeconomic objectives, or mission requirements. New Contractors awarded under an on-ramp will be incorporated under the same

IDIQ terms, conditions, and ordering procedures unless otherwise specified in the refresh solicitation. During an authorized annual re-solicitation refresh, existing prime contractors may restructure their teams, including adding, removing subcontractors and modifying teaming arrangements to prepare for future H2TNG MAC IDIQ contract and task order requirements.

In rare, unforeseen, or urgent circumstances, the CO may approve Contractor additions outside of an annual re-solicitation refresh when such additions support the US Department of HUD’s best interest.

The Contracting Officer may reevaluate Contractor teaming arrangements undergoing substantial changes to determine whether they continue to represent the best value. Contractor teaming arrangements may be evaluated against newly proposed Contractor teaming arrangements during the annual re-solicitation refresh. Any approved Contractor teaming arrangement changes require a new or modified Contractor Teaming Arrangement Agreement signed by the prime contractor and all sub-contractor members and will be implemented via H2TNG MAC IDIQ contract modification signed by the Contracting Officer.

C.3.2.3 Off-Ramp of Existing Contractors

The Contracting Officer may remove Contractors (off-ramp) from the H2TNG MAC IDIQ if any of the following conditions occur:

• Persistent poor performance on task orders.

• Loss of required certification or eligibility status.

• Failure to submit proposals for multiple task order competitions without justification.

• Merger, acquisition, or corporate restructuring impacting contract suitability.

• Any other condition determined by the Contracting Officer to be contrary to the

Government’s/US Department of HUD’s best interest.

Off-ramp actions will be processed through applicable contractual remedied and appropriate notice procedures. Off-ramped Contractors may recompete for entry during future on-ramp opportunities if eligible.

Off-ramping a Contractor does not terminate any existing properly awarded task orders. Such task orders shall continue under their terms until completion, termination, or other disposition.

C.3.2.4 No Automatic Entitlement

Participation in the H2TNG MAC IDIQ - whether as an original awardee or an on-ramped

Contractor - does not guarantee the award of any task orders.

C.3.3 Ordering Period

The ordering period for the basic contract shall be sixty (60) months with one sixty (60) month option period.

C.3.4 Hours of Work

Generally, work at a Government site shall not take place on Federal holidays or weekends unless directed by the CO or individual TOs; however, the Contractor may be required to support

24/7 operations 365 days per year as identified in individual TOs.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that HUD follows:

Under current definitions, five holidays are set by date:

New Year's Day January 1

Juneteenth June 19

Independence Day July 4

Veterans Day November 11

Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six holidays are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January

Washington's Birthday Third Monday in February

Memorial Day Last Monday in May

Labor Day First Monday in September

Columbus Day Second Monday in October

Thanksgiving Fourth Thursday in November

C.3.5 Place of Performance

The place of performance will be specified in individual TOs. Work may occur at Government or non-Government sites within the United States, U.S. commonwealths, and unincorporated

U.S. territories. Locations may include, but are not limited to, HUD HQ’s, regional and field offices, data centers, and other designated sites as defined in each of the individual TOs.

C.3.6 Travel

Travel to HUD HQ’s, regional and field offices, data centers, and/or other designated locations may be required under the H2TNG MAC IDIQ contract or individual TOs. Travel expenses will not be reimbursed separately unless explicitly authorized in an individual TO. When approved, travel costs may be included in a TO at the discretion of the Contracting Officer and must not exceed the limits established in the Federal Travel Regulation (FTR) 2025 and HUD Handbook

2300.2 - Travel Handbook. HUD offices are located within the U.S., U.S. territories, and U.S.

commonwealths.

All travel must comply with the Travel section of the PWS for the awarded TO and be pre-approved by the Contracting Officer, Contracting Officers Representative, or their designated representative. Authorized travel shall adhere to the FTR 2025 and HUD Handbook 2300.2 -

Travel Handbook requirements.

C.3.7 Materials, Equipment and Locations

C.3.7.1 Government-Furnished

Government Furnished Property (GFP) – including Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be provided and will be identified in individual TOs. Upon receipt, the Contractor shall conduct all necessary examinations, inspections, maintenance, and testing. The Contractor is responsible for reporting inspection results, maintenance actions, losses, and any damage to the Government through HUD’s Software Asset Management (SAM) and/or Hardware Asset Management

(HAM) modules, or other required asset management repositories specified in the individual

TOs, as well as to the assigned Contracting Officers Representative (COR) and Program/Project

Manager (P/PM).

HUD may provide HUD-specific software as required in individual TOs. The Contractor may use HUD-provided software development and test accounts, document repositories, and other resources necessary for development, storage, maintenance, and delivery of products.

Contractors must comply with all HUD security policies and procedures for protecting sensitive data. Refer to Section 6.0 for detailed security requirements.

C.3.7.2 Contractor-Acquired

Upon Government approval, the Contractor shall acquire and/or provide any hardware or software required to fulfill each TO that is not supplied as GFP. The Contractor shall maintain software integrity in accordance with the producer’s licensing agreement until the software is delivered to the Government or otherwise disposed of as directed by the Government. All items delivered must receive prior Government approval and comply with the requirements outlined in the H2TNG MAC IDIQ Contract PWS. Refer to Section 6.0 for detailed security requirements.

C.3.7.3 Non-Developmental Items and Commercial Processes

Non-Developmental Items (NDI), Commercial-Off-The-Shelf (COTS), and Government-Off-

The-Shelf (GOTS) products shall be utilized to the maximum extent possible. The Contractor shall apply federal government – approved and commercially available – federal government approved industry best processes, standards, and technologies wherever feasible.

C.3.7.4 Connectivity

HUD will provide connectivity to HUD-specific systems and network as required for task execution through HUD-approved remote access technology. This remote access will enable connectivity to HUD-specific software and development tools authorized for use on the HUD network. HUD may install equipment at the Contractor’s site to ensure compliance with security requirements. The Contractor must meet all of HUD’s security standards outlined in Section 2.0 and will bear the cost of providing connectivity to HUD data centers, HUD HQ’s, regional, and field offices, and other designated locations as required and specified in individual TOs.

Additional connectivity to HUD systems may be authorized as appropriate within individual

TOs.

C.3.7.5 Government and Non-Government Facilities

HUD HQ’s, regional and field offices, data centers, and other designated locations may be made available for the performance of individual TOs. Contractor personnel may also perform at

HUD-approved contractor facilities or remote locations if specified in the TO. Contractors may be required to establish operational support at these locations and must comply with all HUD and

Federal Assessment and Authorization (A&A) requirements. Specific facilities will be identified in each TO, and the Contractor shall disclose facility details during the Request for Proposal

(RFP) process for each TO. All facilities must be approved by HUD and comply with the security and privacy requirements outline in the H2TNG MAC IDIQ PWS Section 6.0 and the standards specified in Section 2.0. HUD facilities are located within the U.S., U.S. territories, and U.S. commonwealths.

C.3.7.6 Warranty

Items acquired under individual TOs may require warranty protection. Any applicable commercial warranties shall be transferred to the Government. The type of warranty and extent of coverage will be determined for each TO.

C.3.7.7 Marking, Handling, Storage, Preservation, Packaging, Tracking & Shipping

The Contractor shall establish and maintain procedures, in accordance with the H2TNG MAC

IDIQ PWS Section 2.0 – Applicable Documents for handling, storage, preservation, packaging, marking, tracking, and shipping of all products. These procedures must ensure the protection of product quality and prevent damage, loss, deterioration, degradation, or substitution. The

Contractor shall document these procedures and make them available for Government review and approval upon request by the CO, COR, P/PM, or designated representative. Documentation shall include process descriptions, quality control measures, and compliance verification records.

C.3.7.8 Export Control

The Contractor shall comply with all applicable laws and regulations governing export-controlled information and technology. The Contractor shall not use, distribute, transfer, or transmit any technology – including technology incorporated into products, software, or other information except in full compliance with these laws and regulations. Additionally, the

Contractor is responsible for planning, obtaining, and maintaining all required export licenses necessary to fulfill the requirements of individual TOs.

C.3.8 Safety and Environmental

Safety and environmental requirements will be specified in individual TOs. The Contractor shall comply with the Office of Federal Sustainability Acquisition and Electronics Stewardship initiatives as outlined in each TO and in accordance with the policies referenced at https://www.sustainability.gov/resources-eo-efo.html.

C.3.9 Enterprise and IT Framework

C.3.9.1 HUD Technical Reference Model

For HUD-specific TOs, the Contractor shall support the HUD Enterprise Management

Framework (EMF). In alignment with this framework, the Contractor shall comply with the US

Department of HUD Office of Chief Information Officers Technical Reference Model (HUD

OCIO TRM) and consider the HUD Enterprise Technology Strategic Plan. The HUD’s OCIO

TRM is a key component of the overall Enterprise Architecture (EA), providing a common vocabulary and structure for describing the IT used to develop, operate, and maintain enterprise applications. Additionally, the OCIO TRM – which includes the Standards Profile and Product

List – serves as a technology roadmap and a tool for guiding and supporting OCIO initiatives.

The Contractor is responsible for ensuring that all proposed solutions, designs, and implementations adhere to TRM standards and align with HUD’s enterprise architecture principles. Compliance shall be documented and made available for Government review upon request by the CO, COR, IT P/PM, technical point of contact (TPOC), and or subject matter expert (SME).

C.3.9.2 Federal Identity, Credential, And Access Management (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting Homeland Security Presidential Directive-12 (HSPD-12) credentials.

This shall be implemented using HUD’s Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp and HUD Identity and Access Management (IAM) approved enterprise design and integration patterns, All

Contractor delivered applications and systems must comply with HUD Identity, Credential, and

Access Management (ICAM) policies and guidelines, the HSPD-12 Program, and align with the

Federal Identity, Credential, and Access Management (FICAM) Architecture v3.3 and accompanying playbooks.

Contractor-delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology Special Publication (NIST SP) 800-63-3

– Digital Identity Guidelines. At a minimum, authentication must include Public Key

Infrastructure (PKI)-based authentication supporting PIV cards and/or Common Access Card

(CAC), as determined by the business needs.

All…