ORR Mobile Deployable Biometric and Identifiection Document Collection PWS Draft RFI July 10 2026.docx

PART 1 — PERFORMANCE WORK STATEMENT (PWS) v2.0 Mobile Deployable Biometric and Identity Document Collection Services Department of Health & Human Services (HHS) | Administration for Children and Families (ACF) | Office of Refugee Resettlement (ORR) Document Control: PWS Version 2.0 | June 2, 2026 | Supersedes Version 1.0 (May 21, 2026) Revision Note (v2.0): This revision incorporates: (1) PWS coverage for previously uncited RTM requirements (R-14, R-25, R-31, R-33, R-35, R-36, R-37, R-38, R-39, R-40, R-41, R-42); (2) inline RTM citations for previously untraced PWS clauses (AI, Section 508, CX/UX, ATO phasing, PIA, SCRM, API SLA, incident reporting, Transition-In/-Out, code repository ownership, CPI/SPI, records training, NACLC, 48-hour personnel notice); (3) deliverable description expansion (R-30); and (4) corresponding new RTM entries (R-43 through R-45; E-08, E-09; OPS-03; SEC-12 through SEC-17; C-09 through C-12) plus data-quality corrections. All changes have been incorporated 6/2/2026 by FTV.

PERFORMANCE WORK STATEMENT (PWS)

Mobile Deployable Biometric and Identity Document Collection Services Department of Health & Human Services (HHS) Administration for Children and Families (ACF) Office of Refugee Resettlement (ORR)

TABLE OF CONTENTS

1.0 General

1.1 Introduction

1.2 Objective

1.3 Scope of Work

1.4 Applicable Documents

2.0 Requirements

2.1 General Requirements

2.1.1 Personnel Requirements

2.1.2 SaaS Licensing and Capacity Requirements

2.2 Technical and Operational Requirements

2.2.1 System Development and Security Engineering Requirements

2.2.2 Customer Experience (CX) and User Experience (UX) Requirements

2.2.3 SaaS Licensing and Capacity Requirements

2.2.4 Transition-In

2.2.5 Project Management Plan (PMP)

2.2.6 Accessibility and Section 508 Compliance

2.2.7 Identity Proofing and Biometric Enrollment

2.2.8 Nationwide and Mobile/Field-Deployable Biometric Collection

2.2.9 Identity Document Collection and Validation

2.2.10 EBTS Payload Construction, Transmission, and Interoperability

2.2.11 Adjudication Services and FG-26 Release Gate Enforcement

2.2.12 System Data Development, Integration, and Reporting

2.2.13 Knowledge Transfer and Interoperability

2.2.14 Artificial Intelligence (AI) Requirements

2.2.15 Transition-Out

2.2.16 Optional Task: Rapid DNA Testing for Kinship Verification

2.3 Meetings and Reporting

3.0 Quality Assurance

4.0 Deliverables and Performance Requirements

5.0 Security and Privacy Requirements

5.1 Cloud Hosting and FedRAMP Requirements

5.2 Supply Chain Risk Management

5.3 Personnel Termination and Access Control

5.4 Records Protection and Incident Reporting

5.5 Protection of Personally Identifiable Information (PII) and Privacy Act Information

6.0 Data Rights and Records Management

7.0 Background Investigation and Suitability

8.0 Compliance

9.0 Performance Requirements Summary (PRS)

Attachments

· Attachment #1 – Quality Assurance Surveillance Plan (QASP)

· Attachment #2 – System Development and Integration

· Attachment #3 – Information Technology and Security Requirements

· Attachment #4 – Data Sharing Plan

· Attachment #5 – Customer Experience and User Experience Requirements

· Attachment #6 – Hosting of FedRAMP Compliant Service Provider

· Attachment #7 – Artificial Intelligence Requirements

· Attachment #8 – Operations and Maintenance for Federal IT Systems

· Attachment #9 – Knowledge Transfer, Interoperability, and Portability Requirements

· Attachment #10 – Accessibility and Section 508 Standards

1.0 GENERAL

1.1 Introduction

The Office of Refugee Resettlement (ORR) is responsible for ensuring that Unaccompanied Alien Children (UAC) are placed with suitable sponsors and remain safe following release. This responsibility requires a comprehensive, lifecycle-based suitability assessment that begins at initial sponsor intake and encompasses biometric capture, identity document collection and validation, criminal history checks, and adjudication before a release decision may be made.

Historically, biometric collection capabilities have been fragmented, relying on fixed-site operations that do not adequately serve sponsors in remote locations or those requiring overseas processing. This contract establishes a unified, integrated, nationwide capability for mobile and field-deployable biometric and identity document collection that operates in coordination with ORR's ORRbit case management system and the DOJ JCIS/CAS to FBI NGI pipeline.

This effort operates in coordination with the Government's separate OSINT Sponsor Monitoring and Vetting contract, which once awarded will provide open-source identity verification, continuous risk monitoring, and risk scoring as inputs to the broader ORR sponsor vetting ecosystem. The two contracts are operationally distinct and produce complementary, non-overlapping outputs. The Contractor under this contract produces foundational identity and biometric artifacts — fingerprints, photographs, identity document scans and metadata, EBTS payloads, NGI results, adjudication records, and chain-of-custody provenance — that feed ORRbit and the ORR Horizon platform built on Palantir Foundry. The OSINT contractor independently consumes confirmed identity attributes (Unique Person Identifier, name, date of birth, and identity document metadata) from those Government systems to perform open-source identity verification and risk scoring. All sponsor suitability determinations and release decisions remain inherently governmental and are made solely by ORR Federal personnel based on the combined inputs from both contracts.

Data flow is unidirectional and Government-mediated. Outputs from this contract flow through ORRbit and ORR Horizon to the OSINT contractor; no direct contractor-to-contractor data exchange is authorized. The Contractor shall not share biometric data, raw fingerprint images (Type-4 records), CHRI, identity document images, or sponsor case data with the OSINT contractor or its personnel through any channel other than Government-approved APIs to ORRbit and ORR Horizon. The Contractor shall not enter into any subcontract, teaming agreement, data-sharing arrangement, joint venture, or commercial relationship — directly or through an affiliate — with the OSINT prime contractor or any OSINT subcontractor concerning data generated under this contract, without prior written approval from the Contracting Officer. The Contractor shall notify the CO and COR in writing within five (5) business days of becoming aware of any new actual or apparent organizational conflict of interest involving the OSINT contract. (RTM: R-13)

1.2 Objective

The objective of this contract is to provide ORR and its associated operational components, including UACB sponsor services workflows, with a comprehensive, policy-compliant biometric capture, identity proofing, identity document ingestion, data transmission, and adjudication support capability. This capability shall enable ORR to enforce Field Guidance #26 (FG-26) release gates with high confidence, ensuring that fingerprint-based FBI NGI results are received, adjudicated, and recorded in ORRbit before any release approval may proceed.

The Contractor shall provide services that enable the Government to accurately verify sponsor identity, collect and transmit biometric data to law enforcement systems, and support timely, defensible, and auditable adjudication outcomes. The Contractor's outputs serve as foundational inputs to the broader ORR sponsor vetting ecosystem described in Section 1.1, including downstream consumption by authorized ORR Federal adjudicators and the separate OSINT Sponsor Monitoring and Vetting contractor through Government-mediated systems. The Contractor shall not perform sponsor risk scoring, suitability determination, release approval, or enforcement action; these functions are inherently governmental and remain solely with ORR Federal personnel.

1.3 Scope of Work

The Contractor shall design, deliver, operate, and maintain an integrated capability that includes:

· Identity proofing and biometric enrollment (fingerprints, photographs, identity document scans)

· Nationwide mobile/field-deployable biometric collection operations serving a minimum of 20,000 applicants per year (RTM: C-03)

· EBTS v11.x payload construction, validation, and transmission via DOJ JCIS/CAS to FBI NGI (RTM: R-06, R-07)

· Receipt, parsing, and adjudication lifecycle support for NGI responses (RTM: C-01, C-02)

· FG-26 release gate enforcement and ORRbit case management system integration (RTM: R-02, R-26)

· Overseas biometric collection at DHS-designated locations (RTM: R-17)

· Program management, quality assurance, training, and compliance reporting

· Optional: mobile DNA collection and processing

· Optional: Galton fingerprint card workflows (RTM: C-06) SDLC and custom-development requirements apply only to system components built under this contract, not to unmodified SaaS products. Consistent with Sections 1.1 and 1.2, the Contractor's role across all capabilities — biometric collection, identity proofing, EBTS transmission, NGI result routing, and adjudication workflow support — is operational and supportive. The Contractor shall not perform sponsor risk scoring, suitability determination, release approval, or enforcement action; these functions are inherently governmental and remain solely with ORR Federal personnel.

1.4 Applicable Documents

The Contractor shall comply with all applicable Federal laws, regulations, and policies, including but not limited to: ORR FG-26 (02/14/2025); UAC Policy Guide §2.5.1; Privacy Act of 1974 (5 U.S.C. §552a); FISMA (44 U.S.C. §3551 et seq.); OMB Circular A-130; OMB M-25-21; FRP-11A; HHS IS2P; NIST SP 800-53 Rev. 5; NIST SP 800-63 Rev. 3; NIST SP 800-160 Vol. 1 & 2; NIST SP 800-88 Rev. 2; FIPS 140-3; FIPS 199; FIPS 201-3; FBI EBTS v11.x; CJIS Security Policy v6.0; ICAO Doc 9303; ANSI/NIST-ITL 1-2011; FedRAMP Moderate Baseline; EO 13869; EO 14028; OMB M-22-09; FAR 52.224-1, 52.224-2, 52.239-1; and the Requirements Traceability Matrix (Recompete_RTM_Mapped_Clean_v2.xlsx).

All attachments are incorporated by reference and binding. Order of precedence: PWS main body → Attachments → Exhibits → Contractor documentation.

2.0 REQUIREMENTS

2.1 General Requirements

The Contractor shall perform all services in a manner that is secure, scalable, auditable, and compliant with Federal privacy and cybersecurity requirements. All operational outputs—biometric records, identity document images, transmission logs, adjudication records, and chain-of-custody artifacts—shall be traceable to source data, explainable through documented methodologies, and suitable for Government operational decision-making and oversight review.

The Contractor shall demonstrate the ability to integrate multiple operational modalities (mobile, field-deployable, and overseas), apply quality-controlled biometric capture procedures, and deliver consistent, high-quality outputs at operational scale under both standard and surge conditions.

2.1.1 Personnel Requirements

The Contractor shall provide personnel with expertise in biometric collection operations, identity proofing, FBI EBTS standards, CJIS compliance, identity document validation, and federal privacy requirements. Personnel shall demonstrate experience integrating multi-site operations to produce accurate, auditable biometric and identity outputs.

Personnel shall:

· Operate biometric collection equipment in compliance with FBI Appendix F and CJIS Security Policy requirements

· Interpret complex identity and quality data and produce accurate, timely operational outputs

· Ensure analytical transparency and chain-of-custody traceability for all biometric artifacts

· Operate in compliance with Federal privacy requirements, trauma-informed principles, and applicable ethical standards (RTM: R-01, R-15) All Contractor personnel shall maintain current CJIS certification for any role involving access to Criminal Justice Information (CJI). CJIS certification shall be tracked and reported to the COR quarterly.

In addition to field operations and technical personnel, the Contractor shall provide dedicated support staff for any Software-as-a-Service (SaaS) components provided under this contract. SaaS support staff shall be responsible for system administration, user support, configuration management, troubleshooting, and coordination with Government personnel.

All Contractor personnel who create, manage, or handle Government records shall complete required records management training, including initial and annual refresher training, in accordance with ACF policies. (RTM: R-45)

a. Field Operations Point of Contact. The Contractor shall designate a named, direct point of contact responsible for addressing field concerns, operator errors, and real-time questions from collection sites. The POC shall be available during published operational hours; all inquiries shall be tracked through documented resolution with workflow follow-up to reduce backlog and enable real-time support. (RTM: R-37)

b. Mobile Device Point of Contact. The Contractor shall designate a point of contact responsible for mobile capture device maintenance, software updates, firmware patching, and supply-kit coordination. The POC shall maintain device readiness logs and coordinate replacement, repair, and resupply activities aligned with mobile deployment schedules. POC responsibilities shall align with maintenance and readiness obligations defined in Attachment #8. (RTM: R-38)

c. Recurring Office Hours and Training Support. The Contractor shall provide recurring office hours and training support sessions accessible to all Government field staff, covering procedural updates, operational best practices, and emerging guidance. Session materials shall be distributed following each session and archived in the Government-designated learning management system. (RTM: R-41)

d. Mobile Fingerprint Capture Training. The Contractor shall provide mobile fingerprint capture training for all field-deployable staff, addressing capture technique, corrective procedures, common rejection causes, and troubleshooting of in-field errors. Training shall be accessible on demand, updated as standards evolve, and tracked through the LMS to reduce FBI-rejected print rates. (RTM: R-42)

2.1.2 SaaS Licensing and Capacity Requirements

Where SaaS tools are proposed to support biometric scheduling, case tracking, quality assurance dashboards, or reporting functions, the Contractor shall propose pricing based on a minimum baseline of twenty (20) user licenses and shall support scaling up to thirty (30) user licenses without service disruption or re-provisioning.

All SaaS components shall be FedRAMP-authorized at the appropriate impact level, support role-based access control (RBAC), maintain audit logging, and integrate with Government systems via secure APIs. (RTM: SEC-10)

2.2 Technical and Operational Requirements

2.2.1 System Development and Security Engineering Requirements The Contractor shall follow the ACF Solution Delivery Lifecycle (SDLC) framework for all system development, integration, or enhancement activities. The Contractor shall comply with all applicable OMB FISMA guidance and cybersecurity reporting requirements. The Contractor shall apply ACF-defined security and privacy engineering principles throughout the system lifecycle in accordance with NIST SP 800-160 Vol. 1 and Vol. 2. Detailed requirements are provided in Attachment #2.

Applicability: SDLC, secure coding, CI/CD pipeline, and containerization requirements apply only to custom code, integrations, or system components developed under this contract. These requirements do not apply to unmodified SaaS products.

2.2.2 Customer Experience (CX) and User Experience (UX) Requirements [REV] The Contractor shall implement CX and UX principles in the design, development, and delivery of all systems and interfaces provided under this contract, including scheduling portals, operator-facing capture applications, and sponsor-facing communications. Detailed requirements are provided in Attachment #5.

The Contractor shall apply the Digital Service Playbook and U.S. Web Design Standards to ensure solutions are user-centered, accessible, and aligned with Federal digital service best practices. (RTM: OPS-03) CX/UX practices shall be integrated continuously throughout the system development lifecycle and shall include user research, usability testing, iterative design, and continuous improvement. Sponsor-facing interfaces and materials shall be multilingual and reflect trauma-informed design principles. (RTM: R-22, OPS-03)

2.2.3 SaaS Licensing and Capacity Requirements

The Contractor shall provide SaaS capabilities necessary to support biometric scheduling, quality assurance, case tracking, dashboard reporting, and analytical functions. SaaS offerings shall be scalable and configurable.

· Minimum of twenty (20) user licenses, scalable to thirty (30) without service disruption

· Capacity to support scheduling and case tracking for a minimum of 20,000 individuals per year (RTM: C-03)

· All SaaS components shall support RBAC, audit logging, FedRAMP compliance, and secure API integration with ORRbit (RTM: SEC-10, E-05)

2.2.4 Transition-In

The Contractor shall execute a Transition-In period not to exceed ninety (90) calendar days from contract award. During this period, the Contractor shall establish full operational capability in the Government-approved staging and pre-production enclave, including deployment of mobile collection units, integration with ORRbit and JCIS/CAS in lower environments, validation of EBTS transmission workflows using Government-provided test data, and end-to-end verification of analytical outputs against synthetic or de-identified test data sets. Production processing of Government data — including any submission of live applicant biometrics to FBI NGI through JCIS/CAS — shall not commence until ATO issuance per §5.0.1, Phase 3. (RTM: C-09) Within five (5) business days of contract award, the Contractor shall conduct a kickoff meeting with the Government, presenting the project schedule, staffing plan, risk register, reporting approach, and transition activities. (RTM: C-09) The Contractor shall:

· Develop and execute a Transition-In Plan

· Conduct a contract kickoff meeting with Government stakeholders

· Develop and execute system onboarding and access provisioning processes

· Validate system functionality, EBTS transmission integrity, and ORRbit integration prior to processing production data

· Demonstrate, prior to the end of the Transition-In period, that the system is functionally complete and ATO-ready in the staging/pre-production enclave such that the only remaining gating item for production processing is ATO issuance per §5.0.1.

2.2.5 Project Management Plan (PMP)

The Contractor shall develop and maintain a PMP within fifteen (15) days of award. The PMP shall include technical approach and staffing plan; deliverable schedule and milestone timeline; risk management approach and risk register; communications plan; quality assurance methodology; and mobile deployment logistics and device calibration tracking approach.

The Contractor shall comply with the ACF Tech Governance Framework and support all required governance processes, including data calls, Capital Planning and Investment Control (CPIC), and OMB Circular A-11 reporting requirements. The Contractor shall establish and maintain Cost Performance Index (CPI) and Schedule Performance Index (SPI) metrics and shall implement corrective actions for performance deviations. (RTM: C-11)

2.2.6 Accessibility and Section 508 Compliance

The Contractor shall ensure that all systems, applications, and digital services developed, maintained, or delivered under this contract comply with Section 508 of the Rehabilitation Act and applicable accessibility standards. (RTM: SEC-12) The Contractor shall incorporate accessibility requirements throughout the system development lifecycle and shall perform accessibility testing prior to delivery. All sponsor-facing and operator-facing user interfaces shall be accessible to individuals with disabilities. All sponsor-facing materials shall comply with language access requirements under Executive Order 13166. (RTM: SEC-12) Detailed accessibility requirements are provided in Attachment #10.

2.2.7 Identity Proofing and Biometric Enrollment

The Contractor shall establish identity proofing and biometric enrollment as the foundational capability supporting all downstream adjudication and release gate enforcement. Identity shall be derived through multi-attribute binding of biometric artifacts to a Unique Person Identifier (UID), incorporating fingerprints, facial photographs, and identity document images.

The Contractor shall implement sponsor, adult HHM, and adult caregiver identity proofing aligned with NIST SP 800-63 (IAL/AAL/FAL), including document validation and biometric binding. (RTM: R-21)

a. Fingerprint Capture. The Contractor shall collect FBI Appendix F-compliant ten-print fingerprint images using devices with a minimum resolution of 500 ppi that are CJIS-certified. A current device inventory including certification letters and QA/calibration logs shall be maintained. Quality thresholds shall be enforced automatically, with operator-prompted recapture when thresholds are not met. After two (2) failed capture attempts on the same subject, the system shall automatically initiate the FBI Name Check pathway as the primary fallback in accordance with §2.2.10(g). Ink-based (Galton) fingerprint card collection per §2.2.16 [or applicable optional task] shall be used only when the Name Check pathway is exhausted, unavailable, or returns a result requiring physical print resubmission. All failed capture attempts, the Name Check pathway initiation event, and any subsequent escalation to ink-based collection shall be logged with subject UID, operator ID, device ID, and timestamp. (RTM: R-04, R-24, R-35, SYS-03)

b. Biometric Photograph Capture. The Contractor shall capture passport-quality frontal photographs concurrent with fingerprint collection, meeting ICAO Doc 9303 and U.S. Department of State standards. Non-compliant photographs shall trigger automatic recapture prompts. Photographs shall be stored as EBTS Type-10-equivalent assets linked to the subject's UID. (RTM: R-03, E-03, E-04, SEC-08)

c. Biometric Binding. All biometric artifacts—fingerprints, Type-10 photographs, identity document images, and extracted metadata—shall be bound to a single unique subject record (UID). No orphaned images or unlinked records shall exist in the system of record. (RTM: SYS-04)

d. Scope of Enrollment. Fingerprinting and biometric photograph capture shall be performed for all adult sponsors, adult household members, and adult caregivers. Results shall be received, adjudicated, and recorded prior to any release approval. (RTM: R-26)

e. Privacy Act Consent. The Contractor shall present a Privacy Act Statement and obtain informed consent at every biometric collection point (fingerprints, photograph, identity document scans), documenting collection authority, purpose, uses, retention period, and redress rights in the subject's preferred language. Consent records shall be logged by subject, language, date, and time, and archived as PDF records. (RTM: R-01)

f. Contactless Fingerprint Pilots. The Contractor shall plan and execute contactless fingerprint pilots aligned to ANSI/NIST-ITL updates and FBI acceptance timelines. Pilot evaluation criteria, performance metrics, risk register entries, and go/no-go decision points shall be documented in the Contactless Fingerprint Roadmap deliverable. FBI Appendix F-compliant contact devices shall remain in production use until FBI acceptance of contactless capture is confirmed in writing. (RTM: R-14, R-25)

2.2.8 Nationwide and Mobile/Field-Deployable Biometric Collection The Contractor shall operate a network of mobile/field-deployable biometric collection units capable of supporting nationwide operations for a minimum of 20,000 applicants per year. (RTM: C-03) All mobile capture devices shall use centralized mobile device management, full-disk encryption, remote lock/wipe, device attestation, and immediate incident procedures for lost, stolen, or tampered devices.

a. Mobile Operations. Mobile units shall be capable of capturing fingerprints, photographs, and identity documents for multiple individuals in remote or operationally challenging environments. Mobile workflows shall support encrypted offline capture with integrity checks validated upon upload. Offline sessions shall be cryptographically signed; integrity shall be verified on upload; duplicate records shall be prevented; and operators shall be notified of any integrity exceptions. (RTM: R-11)

b. Scheduling SLA. The Contractor shall maintain a three (3) business-day scheduling compliance standard per FG-26, tracking first-available and accepted fingerprint appointment dates. SLA compliance reports shall document adherence and exceptions. (RTM: OPS-01, SYS-01)

c. Overseas Collection. The Contractor shall support biometric collection for sponsors and HHMs located overseas at DHS-designated locations, including appointment scheduling, collection event recording, jurisdiction routing, and status tracking in ORRbit. (RTM: R-17)

d. Sponsor and HHM Workflow Support. The Contractor shall provide multilingual appointment confirmations, reminders, and consent packets. The system shall allow documentation of sponsor progress in obtaining required identity documents, with timestamped progress notes. The Contractor shall additionally provide bilingual support to applicants throughout the fingerprint appointment via in-person interpreters or telephonic language line services, available on request or when operator assessment identifies a language access need. All language assistance events shall be logged with language, modality, and duration. (RTM: OPS-02, R-22, R-31)

e. Quality Control and Exception Handling. Quality Control and Exception Handling. The Contractor shall implement the following exception workflows with associated SLA timers and reporting:

· Poor biometric image quality (first attempt): operator-prompted recapture

· Poor biometric image quality (second failed attempt): automatic initiation of the FBI Name Check pathway per §2.2.10(g)

· FBI Name Check pathway exhausted or returns a result requiring physical print resubmission: escalation to ink-based (Galton) fingerprint card collection

· Identity document mismatch: supervisor remediation workflow with documented disposition

· NGI inconclusive result: escalation queue with SLA timer and adjudicator notification

· Appeals and redress requests: tracked through documented resolution per §2.2.9(d) and Privacy Act redress procedures

· Failed OCR or unreadable document: exception workflow with manual review and operator attestation Exception queue SLA compliance shall be maintained at ≥ 95%. All exception events shall be logged with subject UID, exception type, initiation timestamp, resolution timestamp, and disposition. (RTM: R-12, R-35)

f. Agency Payment Code Workflow. The Contractor shall implement a Government-issued agency code that allows authorized registration users to bypass applicant-facing payment screens during appointment scheduling and registration. Code entry shall automatically apply and record payment in the audit log; bypass events shall be logged with user ID, timestamp, and case identifier. The code shall be revocable and rotatable on the Government's defined schedule. (RTM: R-39)

2.2.9 Identity Document Collection and Validation

The Contractor shall scan and ingest high-resolution color images (front and back) of acceptable identity documents (e.g., passport, driver's license, state ID, foreign national ID). Documents shall be legible, unexpired, and meet minimum resolution requirements. The Contractor shall prevent upload of illegible or expired identity document images and shall require operator attestation for any exception. (RTM: R-05, R-27, SEC-02)

a. OCR and Barcode Parsing. OCR and barcode/PDF417 parsing shall be applied where technically supported. Extracted metadata shall be ingested into ORRbit.

b. Document Authentication. Identity document authenticity checks shall be performed, including detection of tampering and fraud indicators. The Contractor shall record which documents were submitted electronically and which originals were physically presented, with discrepancy alerts triggered for any mismatch. (RTM: SYS-02)

c. Verification at Release. Sponsors shall present original identity documents at the fingerprint appointment. Originals shall again be verified at the point of physical release of the child. Both verification events shall be logged in the case record. (RTM: R-27)

d. Public Records and NSOPW Checks. The Contractor shall support documentation and attachment of public records checks and National Sex Offender Public Website (NSOPW) searches to case records, including supplemental state repository pulls when NSOPW is incomplete or offline. All findings shall be documented in a clear, auditable format. (RTM: R-28, E-07)

e. Sponsor Copy of Scanned Documents. At the fingerprint appointment, the Contractor shall provide the sponsor with copies of all scanned identity documents and supporting materials captured during the session, in a format suitable for sponsor recordkeeping and to support fraud detection at the capture site. Issuance of copies shall be logged in the case record with timestamp and operator ID. (RTM: R-36)

2.2.10 EBTS Payload Construction, Transmission, and Interoperability

a. Payload Construction. The Contractor shall construct EBTS v11.x-compliant payloads including Type-2 (Descriptive Text), Type-4 (High-Resolution Grayscale Fingerprint), Type-10 (Facial/Photo), and Type-14 (Variable-Resolution) records as applicable. All EBTS payloads shall be validated using conformance validators prior to submission. Malformed payloads shall be rejected, and error logs with remediation guidance shall be generated. (RTM: R-06, R-20, SEC-07)

b. Transmission via JCIS/CAS. All fingerprint submissions and NGI result receipts shall be routed exclusively through the DOJ JCIS/CAS gateway. Transaction Control Numbers (TCNs) shall be captured for each submission. M-1 message codes shall be parsed and mapped to corresponding case status updates in ORRbit. JCIS/CAS submission success rate shall be maintained at ≥ 99%. (RTM: R-07, E-01)

c. DCSA and NGI Connectivity. The Contractor shall maintain connectivity to DCSA (formerly NBIB) and FBI NGI systems as required. (RTM: E-02)

d. Retry and Failover. Transmission retry logic shall be implemented with exponential backoff. The JCIS/CAS connection shall be monitored continuously, with automated alerts on degradation, queued retries, and an operational runbook for escalation. (RTM: R-19)

e. ORRbit Interoperability. Seamless interoperability with ORRbit and ACF task-order systems shall be verified through integration tests with no regression of fingerprint processing flows. The Contractor shall support EBTS construction, CAS transmission, ACK receipt, M-1 result parsing, and case status updates in ORRbit. (RTM: E-05)

f. System Data Integration. The system shall integrate with Government systems through secure APIs and provide both operational and analytical reporting capabilities. The data collected under this contract shall be made available to ORR via API connection(s) with the ORR Horizon platform built on Palantir Foundry and integrated into the ORR Sponsor Vetting application. The exact structure of APIs shall be collaboratively agreed upon with the Government after award. API integrations shall use an authentication mechanism defined by the Government. The Contractor shall integrate with lower environments to perform testing with sample data. (RTM: E-05, E-06) To ensure interoperability:

· API Interface: Provide RESTful APIs with JSON schemas and versioned endpoints; publish OpenAPI/Swagger documentation

· Authentication: Support OAuth 2.0 or mTLS as directed by Government; enforce RBAC and token rotation

· Data Contracts: Use Government-provided canonical schemas; include metadata for provenance, timestamps, and confidence scores

· Error Handling: Standardize error codes; implement circuit-breaking/retry policies; log failed transactions for audit

· SLA: 95th percentile response time ≤ 2 seconds; monthly error rate ≤ 0.5%; uptime ≥ 99.0% (RTM: E-08)

g. Name Check Fallback. The FBI Name Check pathway serves as the primary fallback when fingerprint capture or NGI submission cannot be successfully completed. The Contractor shall enable verification of FBI name check results under the same originating order number for: (i) cases in which two (2) consecutive fingerprint capture attempts have failed quality thresholds per §2.2.7(a) and §2.2.8(e); and (ii) cases in which fingerprint submissions are rejected by FBI NGI. Name Check results shall be retrievable, associated with the original TCN or order number, and posted to ORRbit on a timely basis. Where the Name Check pathway is unavailable, exhausted, or returns a result requiring physical print resubmission, the Contractor shall escalate to ink-based (Galton) fingerprint card collection. The Contractor shall track Name Check pathway utilization and outcomes as a metric in the monthly PMR. (RTM: R-35) The Contractor shall not use production PII, PAI, CJI, CHRI, biometric artifacts, or live credentials in development, test, training, or lower environments; only synthetic or Government-approved sample data may be used, unless expressly approved in writing by the CO, COR, ISSO, and SAOP.

2.2.11 Adjudication Services and FG-26 Release Gate Enforcement

a. Adjudication Lifecycle Support. The Contractor shall support fingerprint-based criminal history adjudication workflows. NGI result packages shall be automatically routed to adjudication queues in ORRbit. Adjudication access shall be restricted to authorized FFS staff and PSC/DCS personnel via RBAC. All blocked access attempts shall be logged. (RTM: C-01, SEC-03)

b. FG-26 Release Gate Enforcement. Release decisions in ORRbit shall be blocked until all required adjudication steps are complete and recorded. The system shall display clear status indicators showing pending gate conditions. FG-26 gate adherence shall be maintained at ≥ 99%. (RTM: R-02, R-26)

c. Adjudication Documentation. The Contractor shall support PSC/DCS and FFS documentation of adjudication dispositions (clear, review, fail), including supporting narratives. Audit logs shall record adjudicator ID, timestamp, and disposition for every adjudication action. (RTM: C-08)

d. Transmittal of Results. The Contractor shall transmit fingerprint adjudication outcomes to ACF/ORR and maintain transmission logs verifiable by the Government. (RTM: C-02)

e. CHRI Storage and Dissemination. The Contractor shall support off-site Criminal History Record Information (CHRI) storage and dissemination with FBI approval as required. (RTM: C-04)

f. Demographic Mismatch and Inconclusive Results. The Contractor shall support demographic mismatch resolution and inconclusive result escalation workflows, including SLA timers and reporting. (RTM: R-12) [REV] g. Daily Adjudication and Fraud-Assessment List. The Contractor shall generate a daily adjudication list in a Government-approved format identifying all transactions and cases processed during the reporting period, free of duplicate records, to support BBSB cross-reference against ORRbit for prior sponsorship and previous UC profile checks. The list shall be delivered on the Government-defined schedule, linked at the case level to CHRI and sponsor photo (single-profile linkage), and retained per approved records schedules. (RTM: R-32, R-33)

2.2.12 System Data Development, Integration, and Reporting

The Contractor shall provide a secure data environment supporting storage, retrieval, analysis, and reporting of all contract data. Reports shall support both case-level decision-making and portfolio-level analysis. All data shall be provided in machine-readable formats and include sufficient metadata to support interpretation and reuse. The Contractor shall perform operations and maintenance activities in accordance with Attachment #8. (RTM: R-18)

a. Chain-of-Custody Provenance. The Contractor shall capture full chain-of-custody provenance for all biometric and identity artifacts, including device ID, operator ID, GPS coordinates and timestamp, quality metrics, submission IDs, ACK receipts, result receipts, and adjudication events. Provenance trails shall be complete, exportable, and stored in an immutable audit log. (RTM: R-10)

b. Workflow Logging. All workflow steps—ARI receipt, identity document upload, scheduling events, TCN assignment, NGI result receipt, and adjudication outcomes—shall be logged as immutable events in ORRbit. (RTM: E-06)

c. Dashboards and Reporting. The Contractor shall provide operational dashboards and exportable reports covering: FG-26 gate adherence (≥ 99%); exception queue SLA compliance (≥ 95%); biometric capture quality pass rate (≥ 98%); JCIS/CAS submission success rate (≥ 99%); scheduling SLA compliance and exceptions; identity document readability and OCR success rates; throughput by location and collection type; and overseas collection event logs. Reports shall be produced in formats suitable for submission to OIG, GAO, DHS, and DOJ. (RTM: R-18)

d. Immutable Logging and Privacy Compliance. Immutable, append-only audit logs shall be maintained for all artifact access, capture events, transmissions, and adjudication actions. Periodic privacy compliance assessments shall be conducted at least quarterly, with remediation plans tracked. (RTM: R-23)

e. Retention and Disposition. The Contractor shall implement retention schedules for biometric photographs, identity document images, and NGI results, consistent with records schedules approved by the HHS Senior Agency Official for Privacy (SAOP). Automated purge jobs shall execute per approved schedules. Destruction logs shall be maintained and auditable. (RTM: R-16, SEC-06)

f. Applicant and UAC Demographic Capture. The system shall enable entry, update, and correction of demographic information for both adult applicants (sponsors, HHMs, caregivers) and associated UAC. Demographic fields shall auto-populate into daily reporting outputs and reflect updates within the same reporting cycle. Audit logs shall capture all demographic edits with user ID and timestamp. (RTM: R-40)

2.2.13 Knowledge Transfer and Interoperability

The Contractor shall design and deliver all systems and capabilities in a manner that ensures interoperability, portability, and continuity of operations. The Contractor shall adhere to open data standards, implement and document APIs, enable data export in commonly used non-proprietary formats, and ensure system integration with Government systems.

The Contractor shall store all code developed under this contract in Government-owned repositories with version control and shall ensure that all software components and external dependencies are modular, documented, and replaceable to prevent vendor lock-in. The Contractor shall disclose all third-party software, services, and dependencies and ensure such dependencies meet Federal security and interoperability requirements. (RTM: E-09) The Contractor shall provide comprehensive knowledge transfer to Government personnel to ensure continuity of operations, including system demonstrations, training, and delivery of complete technical and user documentation. Detailed requirements are defined in Attachment #9.

2.2.14 Artificial Intelligence (AI) Requirements

The Contractor shall comply with all AI requirements defined in Attachment #7. The Contractor shall develop, submit, and maintain an AI Compliance and Risk Management Plan and shall complete the ACF AI Activation Toolkit for Government approval prior to developing, deploying, accessing, or utilizing any AI capability — including Generative AI (GenAI) — in biometric quality assessment, identity matching, fraud detection, EBTS conformance validation, exception detection, or any other function under this contract. The Contractor shall not deploy or utilize AI capabilities without prior written approval from the ACF OCIO Cybersecurity Team and designated Government leadership. Unauthorized AI use shall constitute a material breach of contract. (RTM: R-43) All AI features must be turned off by default. Any use of AI requires CISO approval before use.

AI Performance, Explainability, and Bias Standards. If AI capabilities are proposed or utilized:

· Model Documentation: Provide model cards, training data lineage, known limitations, and operational boundaries

· Explainability: Provide per-decision explanations using recognized methods (e.g., SHAP/LIME) sufficient for audit and human review

· Bias Thresholds: Demonstrate and maintain disparate impact/bias differentials ≤ 5% across protected classes in relevant outputs or provide Government-approved mitigation plans

· Human-in-the-Loop: High-risk classifications and adjudication-affecting outputs require human review prior to reporting

· Audit Cadence: Quarterly fairness/bias audits; annual third-party or independent validation as directed by Government Prohibited Data Use. SSN and ITIN data shall not be used in any AI or machine learning models, including training, tuning, or inference, unless explicitly approved in writing by the Government and documented in the AI Compliance and Risk Management Plan.

Authorization Requirements. The Contractor shall not develop, deploy, access, or utilize any AI, including Generative AI (GenAI), without prior written approval from the ACF OCIO Cybersecurity Team and designated Government leadership. Unauthorized AI use shall be considered a material breach of contract.

Disclosure Requirement The contractor must explain how it will meet the AI-related requirements in the PWS or SOO and associated tasks and deliverables. The AI compliance and risk management plan is a required deliverable and may also be evaluated as a technical factor during source selection. If used as an evaluation factor, the offeror must submit the plan with its technical proposal.

Required Elements of the AI Compliance and Risk Management Plan The plan must:

• Identify the specific tasks or functions where AI will be used.

• Explain how AI-generated data will be stored, used, retained, or deleted.

• State whether the AI technologies (including GenAI tools) are open-source, proprietary, or another type.

• Include applicable model cards or system documentation for the AI technologies used.

• Describe how bias in AI models and outputs will be identified, monitored, and mitigated, including information about the origin, quality, and any known limitations of training data.

• Explain the AI safeguards in place, including compliance and risk management practices, protections against unauthorized data access, and measures to reduce bias and other risks in alignment with applicable AI policies and directives.

• Describe internal AI governance policies addressing transparency, accountability, data integrity, accuracy, protection of sensitive or proprietary information, foreseeable risks, and potential social impacts.

• Explain how the contractor will assess and prevent disparate or unfair outcomes, address privacy, civil rights, and civil liberties concerns, and prevent misuse or corruption of AI systems.

• Confirm that the AI solution will not make or support decisions based on unlawful discrimination in violation of federal civil rights laws, including Title VII, the ADA, and the ADEA.

Review and Approval If the AI compliance and risk management plan is evaluated as a technical factor before award, the offeror’s rating and debriefing will reflect how well the requirement was addressed. Regardless of whether it is evaluated as a pre-award, the plan must be maintained and updated during contract performance.

If the plan is not evaluated during source selection, it should be required shortly after award as a deliverable and updated on a recurring basis. In all cases, the contractor must obtain written approval from the contracting officer for the AI compliance and risk management plan before implementing or continuing the use of AI technologies under the contract. The Government reserves the right to review and approve or disapprove the proposed use of AI.

Deliverable Timeline The contractor must submit the AI compliance and risk management plan within a specified number of days after contract award, as determined by the contracting officer, and update it on a recurring basis as directed. An updated plan must also be submitted whenever there are material changes to the contractor’s use of AI outside the established reporting schedule.

The Government reserves the right to review and approve or disapprove the proposed use of AI technology in the performance of this contract. The contractor must obtain the contracting officer’s written acceptance and approval of the AI compliance and risk management plan (Deliverable) that lists all AI technologies and tools.

The contractor must provide the Artificial Intelligence (AI) compliance and risk management plan within 30 days after the contract award and on reoccurring basis as directed by the contracting officer. The contractor will provide an updated AI compliance and risk management plan if any changes to the use of AI take place outside of established timeline.

2.2.15 Transition-Out

The Contractor shall support an orderly transition at the end of the period of performance, including transfer of all biometric data, identity document images, adjudication records, transmission logs, documentation, and system knowledge to the Government or a successor contractor in non-proprietary formats. (RTM: C-10) The Contractor shall develop and submit a Transition-Out Plan no later than one hundred twenty (120) days prior to contract expiration or as otherwise directed by the Government. (RTM: C-10) Transition-Out Final Data Package. At contract completion or termination, the Contractor shall deliver:

· Full data export in non-proprietary formats (CSV/JSON/Parquet), including provenance, timestamps, and chain-of-custody metadata

· API specifications, configuration files, and environment runbooks

· Training materials, recorded demonstrations, and user/admin guides

· A vendor-agnostic transition playbook covering cutover steps, dependencies, and validation procedures

· Written data sanitization certification per NIST SP 800-88 Rev. 2 confirming all Government data has been removed from Contractor-owned systems (RTM: SEC-11)

2.2.16 Optional Task: Rapid DNA Testing for Kinship Verification Upon exercise of this optional task by the Government, the Contractor shall provide end-to-end rapid DNA testing services to verify claimed biological relationships between UAC and potential sponsors. This capability shall be fully integrated with the Contractor's standard biometric collection appointment, allowing for the capture of fingerprints, a facial photograph, identity documents, and a DNA sample within a single, unified transaction. All personnel, logistics, testing services, analysis, and reporting necessary to meet the requirements herein shall be provided.

Integrated Collection at Biometric Appointment. The Contractor shall incorporate DNA sample collection as a standard step within the mobile biometric collection appointment for any sponsor identified by the Government as requiring kinship verification.

a. The Contractor's field personnel shall collect, or directly supervise the self- collection of, a buccal (cheek) swab from the sponsor during the same appointment where fingerprints and photographs are captured.

b. The collected DNA sample shall be immediately sealed in its provided packaging, and its tracking identifier shall be linked to the same unique subject record (UID) and transaction data as the fingerprints, photograph, and identity documents captured in that session. This ensures a complete and unbroken chain of custody for all artifacts from a single encounter.

b. Test Kit Logistics and Management. The Contractor shall equip its mobile collection units and field personnel with self-contained DNA buccal swab collection kits as a standard component of their field equipment.

a. Each kit shall include all necessary supplies for sample collection (swabs, gloves, instructions), secure packaging, and prepaid return shipping labels for transport to the Contractor's designated testing facility.

b. The Contractor shall maintain a logistics management system that provides end-to-end tracking of all test kits, from initial inventory assignment to a field operator, through sample collection, and to final receipt at the testing laboratory.

c. DNA Sample Processing and Analysis. The Contractor shall perform rapid, automated DNA testing on submitted samples to confirm or deny a claimed biological relationship.

a. Standard Processing: The Contractor shall deliver kinship verification results to the Government no later than forty-eight (48) hours from the receipt of both the UAC and sponsor samples at the testing facility.

b. Split-Sample Handling: If UAC and sponsor samples are received at different times, the Contractor shall test the first received sample within 48 hours, securely store the resulting DNA profile, and notify ORR. Upon receipt of the second sample, the Contractor shall complete the analysis and deliver results within the standard 48-hour timeframe.

c. Surge Capacity: The Contractor shall provide the resources necessary to process testing volumes that exceed the daily base capacity. Surge capacity shall be made available in fixed two (2) or four (4) hour blocks of additional instrument time and/or labor, as determined by the Contractor to be most advantageous to the Government.

d. Priority Processing (Separately Priced Sub-Task). Upon specific request by the Government, the Contractor shall conduct priority…