RFI Version Tablet SOO Posted.pdf

STATEMENT OF OBJECTIVES

Federal Bureau of Prisons

Inmate Tablet Implementation Initiative

Statement of Objectives (SOO) for the

Inmate Tablet Implementation Initiative

1.0 Purpose

The initiative enhances Federal Bureau FBOP’s rehabilitative mission by expanding digital access in a controlled, compliant environment. Tablets will serve as a unified delivery mechanism for educational modules, tele-health, family communication, legal resources, reentry programming, and approved leisure content. This initiative also strengthens institutional safety by digitizing forms, reducing paper handling, enabling controlled communication channels, and increasing transparency around user activity.

2.0 Background

The Federal Bureau of Prisons (FBOP) requires a modern, secure, and unified digital services platform to replace fragmented legacy systems and provide consistent access to educational, healthcare, legal, religious, and communication resources across all institutions. This acquisition will establish an enterprise-managed tablet ecosystem supported by reliable wired and wireless infrastructure including bed-level access operating within a FedRAMP-authorized cloud environment and fully compliant with FISMA, OPCL privacy requirements, and Section 508 accessibility standards. The effort addresses long-standing gaps in standardization, administrative oversight, and technological capability by enabling a controlled suite of approved services such as telehealth, educational streaming, legal and religious communication, and digital mail scanning, while enforcing modern networking, patching, and service-level expectations. By advancing a secure, equitable, and scalable digital framework, this initiative strengthens institutional operations, enhances rehabilitative engagement, and aligns FBOP’s technology landscape with contemporary federal and correctional best practices.

3.0 Scope

The program includes enterprise-wide deployment of secure tablets and supporting wired/wireless network infrastructure to the housing unit bed level and all designated program areas. The solution must operate within FedRAMP-authorized cloud environments (AWS GovCloud or Azure GovCloud), comply with FISMA and DOJ cybersecurity directives, and integrate seamlessly with FBOP’s existing IT landscape. Vendors shall propose both a current-state integration path and a future-state network architecture capable of supporting long-term expansion. The initiative seeks an enterprise solution that:

Provides secure tablets and supporting network infrastructure reaching all designated areas, including housing units (bed-level), visitation, education, medical, psychology, religious, and recreational spaces.

Enables subscription-based content, educational resources, and controlled communication services.

Supports tele-health, legal visits, educational sessions, and religious programming in approved locations only.

Ensures strong administrative oversight using role-based access controls, nested security groups, content filtering, and usage controls.

Includes enterprise-wide support services, hardware replacement SLAs, software/firmware update compliance, and performance reporting.

Integrates AI-enabled analytics to improve intelligence gathering, anomaly detection, and operational insight while maintaining privacy and FISMA-aligned safeguards.

4.0 Performance objectives (required results)

The performance objectives of this initiative articulate a comprehensive framework for delivering a secure, resilient, and forward-leaning digital services ecosystem that substantively advances the FBOPs capacity to administer educational, healthcare, legal, comprehensive communication, and rehabilitative resources across the enterprise. The envisioned solution must guarantee equitable and uninterrupted access for a population exceeding 150,000 users, while consistently demonstrating operational fidelity at enterprise scale under the rigor of federal cybersecurity, privacy, and accessibility mandates (e.g FISMA, FedRAMP, OPCL, NARA, and Section 508). Achieving these outcomes necessitates a technologically robust architecture capable of sustaining high-performance network operations, meeting stringent update and vulnerability-remediation timelines, and supporting transparent, hierarchical administrative governance. The system must be architected to avoid proprietary lock-in through a tablet agnostic design that ensures interoperability with both incumbent and emergent technologies.

The initiative further aspires to elevate institutional intelligence and operational acuity through advanced data governance practices and AI-enabled analytical capabilities that assist staff in discerning behavioral trends and potential security anomalies. Collectively, these objectives delineate a transformative modernization effort intended to strengthen institutional effectiveness, enhance rehabilitative engagement, and reinforce the Bureau’s overarching mission of promoting safety, accountability, and successful reentry outcomes.

Deploy a Secure and Scalable Platform: Implement a standardized, secure, and scalable tablet solution for over 150,000 users across all facilities in the U.S., Hawaii, and Puerto Rico. This platform must enhance access to education, telehealth, legal, religious, and communication services while adhering to federal security and accessibility mandates.

Extend Network Infrastructure: Design a plan for current and future state of installation readiness for network access, both wired and wireless, to housing unit beds and designated service areas, with all devices supporting modern Wi-Fi and Ethernet standards.

Enable Subscription-Based Services: Provide secure access to subscription-based streaming, downloadable content, and learning modules, with restrictions such as single-player gaming and other facility-specific limitations. The subscription model must ensure secure user authentication and sufficient bandwidth for reliable performance.

Integrate Essential Government Services: Enable access to essential DOJ and FBOP services, including psychology and medical telehealth visits, proctored family communications, legal and educational sessions, and digital law library resources.

Establish Administrative Oversight: Implement a system with role-based access controls and nested security groups (up to five layers) to allow for granular management of permissions across devices, groups, locations, and content.

Maintain Service Level Agreements (SLAs): Ensure timely support and device replacement by enforcing a mandatory SLA of seven business days for device repair or replacement.

Ensure Compliance and Updates: Guarantee full Section 508 accessibility compliance and apply all software/firmware updates within 14 days of release, with hotfixes for security vulnerabilities applied within 24 hours.

User Access & Service Delivery: Provide equitable access to digital education, medical and psychology tele-health, legal visitation, religious programming, structured entertainment, and controlled communication services.

Security & Compliance: Enforce end-to-end encryption, strong authentication, role-based access controls, nested security groups, and full compliance with FISMA, FedRAMP, OPCL privacy requirements, NARA records schedules, and Section 508 accessibility.

Infrastructure Readiness: Extend Wi-Fi and Ethernet connectivity to all required areas using IEEE 802.11 and 802.3 compliant standards; deliver scalable infrastructure capable of supporting future high-demand workloads.

Operational Reliability: Meet a mandatory 7-day hardware replacement SLA, patch software/firmware within 14 days, and deploy critical security hotfixes within 24 hours.

Administrative Oversight: Provide enterprise-level device, content, and user management tools enabling granular control by location, group, or individual.

Data Governance: Ensure that all data is retained by FBOP, fully searchable, reportable, and aligned with OPCL and NARA requirements.

AI-Enabled Insight Outcomes: The AI solution shall provide advanced analytical capabilities including multidimensional pattern recognition, behavioral anomaly detection, multilingual monitoring, and cross-domain trend analysis to generate meaningful intelligence from both structured and unstructured data across approved communication channels and operational systems. All AI outputs must remain advisory, fully explainable, and subject to authorized staff review, with configurable oversight controls and continuous model validation to ensure the technology consistently supports, rather than substitutes for, human decision-making.

Service Level Agreements

Hardware replacement: Meet a seven (7) day repair or replacement Service Level Agreement (SLA) for failed devices.

Software and firmware updates: Apply all updates within fourteen (14) days of release.

Critical vulnerabilities: Apply fixes for critical security vulnerabilities within twenty-four

(24) hours of identification.

Accessibility: Fully comply with Section 508 accessibility standards.

Network Performance

Maintain reliable network coverage for all designated operational areas.

Conduct annual interoperability testing for all wireless and wired standards used.

Host all production services within FedRAMP-authorized cloud environments, such as

AWS GovCloud (US) or Azure GovCloud (US), consistent with FBOP and DOJ security requirements.

Data Management and Continuity

Ensure all data is retained, searchable, and reportable at the user, group, facility, and enterprise levels.

Align backup and restore procedures with FBOP continuity of operations (COOP) policies.

Maintain full data retention, privacy, and records management compliance with OPCL and NARA requirements.

5.0 Place of Performance

This initiative will require the vendor to perform at all FBOP institutions, Regional Offices, and Central Office. https://www.bop.gov/locations/list.jsp

6.0 Government information

When government-furnished information is required, such as baseline infrastructure details or documents related to federal compliance frameworks, FBOP will cite only the specific sections relevant to this effort, rather than entire publications. Whenever possible, publicly available documents will be linked instead of reproduced in full.

The Contractor shall adhere to all applicable Department of Justice (DOJ) and FBOP policies, including but not limited to:

DOJ Order 2640.2D, which restricts the use of non–U.S. citizens in positions involving access to or development of DOJ information technology systems.

DOJ residency requirements applicable to contractor personnel.

Prohibitions on unauthorized wireless bridging and unapproved connectivity methods.

Requirements that all hosting occur within approved cloud environments such as AWS

GovCloud (US) or Azure GovCloud (US).

Protection of FBOP intellectual property for any content or materials provided to the

Contractor.

Federal Information Security Modernization Act (FISMA).

Federal Risk and Authorization Management Program (FedRAMP).

Privacy Act of 1974.

E-Government Act of 2002.

Federal Records Act and applicable National Archives and Records Administration (NARA) records schedules.

Section 508 of the Rehabilitation Act accessibility standards.

Department of Justice (DOJ) Cybersecurity Directives.

DOJ Office of Privacy and Civil Liberties (OPCL) privacy and records management requirements.

7.0 Government property/equipment

The vendor shall ensure all proposed solutions integrate seamlessly with the Federal Bureau of Prisons’ existing enterprise infrastructure, aligning with established technical baselines, security controls, and operational processes. To maintain system integrity and standardization, the use of Government Furnished Equipment (GFE) is mandatory wherever provided. This requirement preserves architectural consistency, minimizes sustainment risks, and ensures interoperability across all FBOP environments. Vendors must therefore design their approach to fully leverage the capabilities of the FBOP ecosystem while incorporating all required GFE as core elements of their solution. This promotes unified enterprise architecture and strengthens the Bureau’s ability to manage, secure, and optimize the system throughout its lifecycle.

8.0 Required nongovernment information/documents

Vendor must maintain a service desk using the ITIL framework and accessible by FBOP administrators for the purpose of documenting/tracking repairs, upgrades and issues.

Service Level Agreement (SLA):

Vendor must meet a 7-day repair/replacement SLA for any device failures.

o SLA: Software:

Critical: 24 - 48 hours Moderate: 7 Days Low/Advisory: Normal maintenance windows (14 days post release of operating system update) o SLA: Hardware

Low: Normal repair/replace window is 7 days post remittance.

Software and firmware updates: Apply all updates within fourteen (14) days of release.

Critical vulnerabilities: Apply fixes for critical security vulnerabilities within twenty-four (24) hours of identification.

Accessibility: Fully comply with Section 508 accessibility standards.

Vendors must also ensure that all deployed devices maintain compliance with IEEE

Wi-Fi and Ethernet standards throughout the lifecycle of the contract.

Vendors must perform annual interoperability testing across both wireless and wired standards to ensure compatibility with evolving DOJ enterprise infrastructure.

Certification documentation from recognized testing bodies (e.g., Wi-Fi Alliance, IEEE compliance labs) must be provided annually to validate continued compatibility.

Maintain reliable network coverage for all designated operational areas.

Conduct annual interoperability testing for all wireless and wired standards used.

Host all production services within FedRAMP-authorized cloud environments, such as AWS GovCloud (US) or Azure GovCloud (US), consistent with FBOP and DOJ security requirements.

Ensure all data is retained, searchable, and reportable at the user, group, facility, and enterprise levels.

Align backup and restore procedures with FBOP continuity of operations (COOP) policies.

Maintain full data retention, privacy, and records management compliance with OPCL and NARA requirements.

Data Continuity:

All applications, goods and services provided under this contract shall be fully tablet agnostic, ensuring compatibility across multiple hardware platforms, operating systems, and device manufacturers without degradation of functionality or performance. The vendor shall design, develop, and deliver all solutions in a manner that prevents vendor lock-in and supports interoperability with existing and future devices approved by the FBOP. Software and applications must operate consistently within the agency’s network environment and remain compliant with all applicable federal security and accessibility standards.

The vendor shall provide a comprehensive backup and restore functionality to ensure data resilience and continuity of operations. All user data, configurations, and application settings must be capable of being securely backed up and restored in the event of device failure, replacement, or system outage. Backup procedures shall align with the FBOPs disaster recovery and continuity of operations (COOP) policies, utilizing encrypted storage and maintaining compliance with FISMA, FedRAMP, and OPCL privacy requirements. The vendor must document these capabilities within the Operations and Maintenance (O&M) plan and demonstrate successful recovery testing during pilot and production phases.

9.0 Deliverables & Compliance Assurance

The Contractor shall provide the following deliverables to ensure the successful deployment, sustainment, and compliance of the Enterprise Tablet Initiative. All deliverables shall be submitted to IT Planning & Development for review and approval in accordance with the project schedule and subject to Government approval.

Enterprise Deployment Plan – A detailed plan outlining phased rollout across all facilities, including site surveys, infrastructure installation to the housing unit bed level, bandwidth provisioning, and contingency strategies for access delays.

Infrastructure Installation Plan – Technical documentation of wired and wireless infrastructure, including device configurations, network diagrams, and interoperability certifications with DOJ enterprise systems.

Training Materials – Comprehensive user and administrator training guides, quick reference materials, and “train-the-trainer” programs. Refresher modules shall be provided quarterly to address new features, updates, or security enhancements.

Operations and Maintenance (O&M) Plan – A plan for ongoing operations, patch management, service desk support, and escalation procedures, including the mandated seven-day Service Level Agreement (SLA) for repair or replacement.

Security and Compliance Documentation – Evidence demonstrating adherence to FISMA, FedRAMP, Section 508, and DOJ/OMB cybersecurity directives, including:

Current Authority to Operate (ATO) package and FedRAMP authorization.

Voluntary Product Accessibility Templates (VPATs) and accessibility testing results.

Privacy Impact Assessments (PIAs) and System of Records Notices (SORNs) approved by

DOJ OPCL.

Records management retention schedules and audit logs in compliance with NARA guidelines.

End-to-end encryption certifications and penetration test results for sensitive services.

Compliance Reporting – Ongoing reporting and assurance artifacts, including:

Quarterly compliance reports covering vulnerability scans, patch management (14-day compliance), accessibility validation, and privacy/records management audits.

Annual independent third-party security assessments validating ongoing compliance.

Corrective Action Plans (CAPs) within thirty (30) days of any audit finding, identifying deficiencies, remediation strategies, and timelines.

Performance Reports – Metrics validating uptime, SLA adherence, interoperability testing, and user adoption. Dashboards shall be provided to senior leadership for ongoing program oversight.

o AI Enabled Analytics and Reporting Package – Vendor shall deliver an AI enabled analytics and reporting package that supports the FBOPs intelligence and operational insights needs. This deliverable must include configuration of AI tools, dashboards, and reports the provide clear, actionable trends and pattern analysis without exposing sensitive personal information. The solution must also include documentation explaining how the AI models work, how data is processed, and how decisions are derived to ensure transparency and accountability. The vendor must provide evidence that all AI functions meet DOJ privacy requirements, OPCL oversight expectations, and FISMA security controls.

Ongoing updates, tuning methods, and audit logs must be included as part of quarterly compliance submissions.

Continuously monitor security controls of system and its environment of operation to determine if the security controls in the information system can continue to be effective over time considering changes that occur in the system and environment.

Report on all systems on an ongoing basis and inform Administrators when changes occur that may impact the security of the system.

10.0 Meetings

For all meetings, the contractor shall be responsible for providing meeting materials and administrative/facilitation support. Meetings will be conducted either onsite, or through an alternative method of communication (such as a teleconference), as approved by the CO.

10.1 Weekly Meetings – Tactical Execution & Issue Resolution

Purpose: Ensure day-to-day progress, address risks early, and maintain operational alignment.

Attendees: Vendor PM, FBOP PM, Technical Leads, Site Coordinators, Helpdesk/O&M leads.

Agenda:

Deployment progress and site-readiness status

Open defects, system incidents, and SLA tracking Pilot feedback, testing updates, and configuration needs Immediate risks and mitigation activities Coordination with facility staff for installations and training

Output: Weekly status report, updated RAID log (Risks, Actions, Issues, Decisions)

10.2 Monthly Meetings – Program Management & Performance Oversight Purpose: Evaluate program-level health, performance metrics, and compliance posture.

Attendees: FBOP PM, Vendor PM, COR, Regional Stakeholders, Technical SMEs, O&M teams Agenda:

Review of monthly performance metrics (uptime, SLA compliance, patch adherence)

Deployment schedule validation and resource alignment Review of accessibility compliance and user adoption metrics Review of integration points with enterprise systems (financial, case management, etc.)

Review of AI analytic outputs and operational enhancements Documentation updates (O&M plan, training artifacts, configuration changes)

Output: Monthly Program Dashboard, updated deployment roadmap, validated performance metrics

10.3 Quarterly Meetings – Executive Governance & Compliance Assurance Purpose: Provide enterprise-wide visibility, ensure compliance with federal mandates, and align program goals with FBOP leadership priorities.

Attendees: SES Leadership, Program Sponsors, PM, COR, Vendor Executive Team, IT Security, OPCL, Records Management, Accessibility Office Agenda:

Review Quarterly Compliance Report (FISMA, FedRAMP, OPCL, NARA, Section 508)

Review of system security audits, vulnerability scans, and remediation Evaluation of AI model governance, transparency logs, and drift detection Assessment of enterprise risk posture and long-range implications Review of financials, invoice validation, and burn-rate forecasting Strategic review of the future-state infrastructure roadmap Policy changes, operational impacts, and emerging requirements

Output: Quarterly Executive Briefing Package, Corrective Action Plans (if required), governance directives

10.4 Annual Meeting – Strategic Planning & Full Lifecycle Review Purpose: Assess long-term performance and set goals for the next program year.

Attendees: Agency CIO, Executive Sponsors, Vendor Executive Governance Team, FBOP PMO

Agenda:

Full lifecycle evaluation of year’s deployments, performance, and user outcomes

Future-state technical enhancements (network expansion, new services, AI capabilities)

Contract alignment with agency modernization strategy

Planning for option year or re-compete Output: Annual Performance Review, updated Strategic Modernization Plan

Meeting Cadence Purpose Outputs

Weekly Tactical Meetings Execution tracking, SLA compliance, issue resolution

Weekly Status Report & RAID Log

Monthly Program Meetings Program health, performance metrics, deployment oversight

Monthly Dashboard &

Updated Roadmap

Quarterly Executive Governance Meetings

Compliance assurance, strategic alignment, audit readiness

Quarterly Executive

Briefing & CAPs

Annual Strategic Review Long-term planning, modernization alignment

Annual Review & Strategic Plan

DOJ Order 2640.2D The Department of Justice does not permit the use of Non-U.S. citizens in the performance of this contract or commitment for any position that involves access to or development of any DOJ IT system. By signing the contract document or beginning performance, the contractor agrees to this restriction.

DOJ Residency Requirement The Residency requirement implemented by the Department of Justice requires that contractors providing services for DOJ components for three of the five years immediately prior to applying for a position, must have: 1) resided in the United States; 2) worked for the United States overseas in a federal or military capacity; or 3) be a dependent of a Federal or military employee serving overseas.