U.S. Customs and Border Protection Office of Information and Technology Field Support Directorate

Statement of Work

Draft

PR 2017XXX Marketplace Order

1. Purpose

The Department of Homeland Security (DHS) seeks information from industry regarding the capability to provide implementation, operations, maintenance, enhancement, security, technical support, and authorized integration services for a secure, cloud-based Software-as-a-Service (SaaS) data platform.

The platform will support authorized DHS personnel and approved mission partners in securely ingesting, storing, managing, analyzing, sharing, and reporting on organizational data. Where authorized by the Government, the platform shall support information sharing and collaboration through or with the Homeland Security Information Network (HSIN).

This RFI is for market research and planning purposes only. It does not constitute a solicitation, request for proposal, commitment, or promise to issue a future solicitation.

2. Background

DHS requires support for a secure SaaS data platform that enables data integration, governance, analytics, reporting, and controlled collaboration. The platform must support appropriate handling of DHS information and integrate, as authorized, with existing Government identity, security, cloud, data-management, and information-sharing services.

HSIN is a DHS-managed secure information-sharing environment used to support collaboration among authorized Federal, State, local, tribal, territorial, private-sector, international, and other mission partners, as approved by the Government. The Government is interested in commercial capabilities that can securely support HSIN users, content, workflows, and authorized data exchanges without duplicating or undermining HSIN governance, access-control, or security requirements.

The contractor shall coordinate all HSIN-related work with the Government-designated HSIN program office, system owners, security officials, privacy officials, and other stakeholders identified by the Government.

3. Scope

The contractor shall provide personnel, processes, tools, documentation, and support necessary to operate and sustain a secure SaaS data platform. Services may include:

1. Platform onboarding, configuration, and implementation support.

2. Data-source integration and ingestion support.

3. Platform administration and tenant management.

4. Security configuration, monitoring support, and compliance support.

5. Data governance, metadata, cataloging, lineage, quality, and access-management support.

6. User support, training, and knowledge management.

7. System maintenance, release management, testing, and enhancement support.

8. Performance monitoring, capacity planning, and service reporting.

9. Incident, problem, and change-management support.

10. Authorized HSIN integration, interoperability, information-sharing, and collaboration support.

11. Transition-in and transition-out services.

4. Required Capabilities

4.1 SaaS Platform Operations and Administration

The contractor shall provide support for administration and operation of the SaaS data platform, including:

· User account, role, group, and permission administration.

· Platform configuration and environment management.

· Tenant administration and service configuration.

· Monitoring platform availability, performance, and usage.

· Management of platform upgrades, releases, patches, and feature changes.

· Maintenance of configuration records and platform documentation.

· Coordination with the SaaS provider, Government stakeholders, HSIN stakeholders, and authorized third parties.

· Administration of authorized user access consistent with Government-approved roles, permissions, data-sharing agreements, and need-to-know requirements.

4.2 HSIN Integration and Interoperability Support

The contractor shall provide technical, operational, and documentation support for authorized integration with HSIN. The contractor shall not establish, modify, or activate any connection to HSIN without prior Government authorization.

Support may include:

· Assessment of proposed use cases involving HSIN users, communities, content, data, and collaboration workflows.

· Development of integration designs, interface-control documents, data-flow diagrams, and security documentation for Government review.

· Support for authorized exchange of data, documents, alerts, notifications, dashboards, reports, and other information products between the SaaS platform and HSIN.

· Support for approved application programming interfaces, data feeds, file-transfer mechanisms, web services, or other Government-approved integration methods.

· Configuration of approved identity, authentication, authorization, and user-provisioning mechanisms.

· Support for synchronization or federated access to approved content repositories, data catalogs, dashboards, and collaboration artifacts.

· Testing and validation of data exchange, access controls, audit records, error handling, and performance prior to production deployment.

· Maintenance of technical documentation for each approved HSIN integration.

· Coordination with the Government to support deactivation, suspension, or modification of integrations when directed.

The contractor shall ensure that all HSIN-connected or HSIN-supported capabilities preserve the Government’s ability to control access, sharing, retention, and disposition of Government information.

4.3 HSIN User Access, Identity, and Access Management

The contractor shall support identity and access-management processes for users who require authorized access to platform functions or information through HSIN-related workflows.

The contractor shall:

· Implement role-based access control, least privileged access, and separation of duties.

· Support Government-approved authentication and identity-federation methods.

· Ensure users are granted access only after Government authorization and completion of required onboarding processes.

· Support user provisioning, modification, suspension, and deprovisioning in accordance with Government direction.

· Maintain audit records for user-access changes, privileged access, authentication events, administrative actions, and access to controlled information.

· Support periodic access reviews and recertifications, as directed by the Government.

· Prevent unauthorized sharing, download, export, replication, or disclosure of data available through HSIN-related functions.

· Ensure that access permissions align with the applicable HSIN community, mission, data-sharing agreement, user role, and Government-approved information-sharing rules.

The contractor shall not independently approve users, assign users to HSIN communities, or grant access to HSIN information unless specifically authorized by the Government.

4.4 Information Sharing, Data Handling, and Content Management

For data or content shared through HSIN-related capabilities, the contractor shall support Government-established information-sharing and handling requirements.

The contractor shall:

· Apply Government-directed data labels, handling caveats, dissemination restrictions, and access controls.

· Support content and data segmentation based on mission, organization, user role, community, geography, or other Government-approved criteria.

· Maintain metadata necessary to identify data source, ownership, classification or handling designation, access restrictions, retention requirements, and sharing limitations.

· Support data-quality validation, provenance, lineage, version control, and auditability for shared data.

· Ensure that content sharing is limited to Government-authorized recipients and approved HSIN communities.

· Support Government-directed retention, archival, legal hold, disposition, and deletion requirements.

· Provide mechanisms to remove, correct, suspend, or restrict access to content when directed by the Government.

· Prevent use of Government or HSIN-related content for commercial purposes, product development, advertising, model training, or any unauthorized secondary use.

The contractor shall not redistribute, disclose, sell, mine, profile, train artificial intelligence models on, or otherwise use Government data outside the scope of the contract and explicit Government authorization.

4.5 Data Integration and Engineering Support

The contractor shall support secure ingestion, transformation, integration, and management of data from authorized Government sources, including authorized HSIN-related data sources and outputs.

Services may include:

· Assessment and onboarding of new data sources.

· Development and maintenance of data pipelines, connectors, and APIs.

· Batch and near-real-time data ingestion, as applicable.

· Data transformation, validation, reconciliation, and quality checks.

· Integration of approved HSIN data feeds, shared content, notifications, or collaboration artifacts.

· Error handling, logging, retry procedures, and operational monitoring.

· Data schema management and documentation.

· Support for data export, retention, archival, and disposition requirements, as directed by the Government.

· Testing to ensure data exchange does not expose information to unauthorized users or organizations.

All data exchanges involving HSIN shall be documented and approved by the Government before operational use.

4.6 Security and Privacy Support

The contractor shall configure and support the platform in accordance with applicable DHS security, privacy, cloud, data-protection, and HSIN requirements.

The contractor shall support:

· Identity, credential, and access-management integration, including role-based access control and least-privilege principles.

· Multi-factor authentication and single sign-on, were authorized and available.

· Encryption of data in transit and at rest using Government-approved methods.

· Audit logging, monitoring, alerting, and reporting.

· Logging of HSIN-related user access, data exchanges, privileged actions, administrative changes, and data-sharing events.

· Vulnerability-management coordination and remediation tracking.

· Security-incident reporting, investigation support, and corrective-action tracking.

· Security-control assessment support, evidence collection, and continuous-monitoring activities.

· Privacy compliance support, including privacy threshold analyses or privacy impact assessment support when directed by the Government.

· Secure configuration baselines and configuration-change tracking.

· Separation of Government data from other customers’ data in a multi-tenant environment.

· Technical safeguards to prevent unauthorized cross-community, cross-organization, or cross-tenant access to HSIN-related information.

The contractor shall promptly notify the Government of suspected or confirmed unauthorized access, disclosure, alteration, loss, or unavailability of Government or HSIN-related data, in accordance with Government-provided incident-reporting procedures and timelines.

4.7 HSIN Security Authorization and Compliance Support

The contractor shall provide documentation and technical support necessary for the Government to assess whether proposed HSIN-related capabilities, interfaces, or data exchanges meet applicable authorization and security requirements.

The contractor shall support:

· Development and maintenance of system-boundary descriptions, architecture diagrams, data-flow diagrams, interface-control documents, and integration inventories.

· Identification of dependencies, interconnections, external services, and shared-service responsibilities.

· Security assessment evidence collection for platform and integration controls.

· Development of plans of action and milestones, remediation plans, and risk-mitigation documentation, as directed by the Government.

· Participation in security reviews, architecture reviews, privacy reviews, test events, and readiness assessments.

· Continuous monitoring, vulnerability reporting, audit-log support, and security-control evidence updates.

· Government review and approval of security documentation before implementation of new or materially changed HSIN integrations.

Industry should describe its experience supporting Federal and DHS security processes, including FedRAMP-authorized SaaS environments, NIST Risk Management Framework processes, and interconnection-security requirements.

4.8 Help Desk, User Support, and Training

The contractor shall provide user and administrator support services, including support for authorized HSIN users and Government administrators.

Support may include:

· Tier 1, Tier 2, and Tier 3 support, as defined by the Government.

· Incident intake, tracking, escalation, resolution, and closure.

· Service-request fulfillment.

· Support for access issues, role changes, onboarding, deprovisioning, and approved user provisioning.

· Support for HSIN-related integration issues, data-sharing errors, synchronization failures, and access-control issues.

· Knowledge articles, frequently asked questions, user guides, and administrator guides.

· End-user and administrator training on secure use of platform and HSIN-connected capabilities.

· Release communications, change-management activities, and user-impact assessments.

· Escalation to Government-designated HSIN support personnel when required.

4.9 Reporting and Performance Management

The contractor shall provide recurring operational and performance reports. At a minimum, reports should address:

· Platform availability and service-level performance.

· Incident and service-request volumes, status, and trends.

· Data pipeline performance and failed-job metrics.

· HSIN-related integration availability, data-transfer success rates, error rates, and transaction volumes, as applicable.

· User adoption and utilization metrics, aggregated to avoid unnecessary disclosure of individual user activity.

· Security events, vulnerabilities, and remediation status.

· Access-review status, including overdue access reviews or unresolved access-control findings.

· Platform changes, releases, planned maintenance, and potential impacts to HSIN-related capabilities.

· Capacity, storage, and forecasted growth.

· Risks, issues, dependencies, and recommended corrective actions.

5. Deliverables

Add the following deliverables to the existing deliverables table:

6. Additional Performance Standards

In addition to general platform performance standards, industry should recommend measurable service levels for HSIN-related capabilities, such as:

· Availability of approved HSIN interfaces and integration services.

· Timeliness of detection, reporting, escalation, and resolution of HSIN-related incidents.

· Accuracy and completeness of data exchanges.

· Timeliness of user-provisioning, modification, suspension, and deprovisioning actions after Government approval.

· Percentage of access reviews completed by required due dates.

· Timeliness of remediation for access-control, security, data-quality, and integration defects.

· Timeliness of notification to the Government regarding planned changes that could affect HSIN interoperability.

· Percentage of integration changes tested and approved before production deployment.

· Completeness and currency of integration documentation, audit records, data-flow documentation, and operating procedures.

7. Contractor Qualifications

Add the following qualification requirements:

The Government is interested in vendors with demonstrated experience in:

· Supporting secure information sharing among Federal, State, local, tribal, territorial, private-sector, and other approved mission partners.

· Integrating SaaS platforms with Federal collaboration, identity, data-sharing, and information-exchange environments.

· Implementing role-based access controls, data segmentation, identity federation, and detailed audit logging in multi-organization environments.

· Supporting secure data sharing subject to Government-defined handling caveats, dissemination controls, and need-to-know requirements.

· Supporting DHS or comparable Federal security authorization, continuous monitoring, and interconnection approval processes.

· Developing and operating secure APIs, data pipelines, file exchanges, and event-driven integrations in regulated environments.

image1.png