RFP 70B01C25Q00000462 SF1449.pdf

12. DISCOUNT TERMS

8. OFFER DUE DATE/

9. ISSUED BY CODE 10. THIS ACQUISITION IS

6. SOLICITATION

ISSUE DATE

3. AWARD/EFFECTIVE DATE 5. SOLICITATION NUMBER2. CONTRACT NUMBER 4. ORDER NUMBER

a. NAME b. TELEPHONE NUMBER (No collect calls)7. FOR SOLICITATION

INFORMATION CALL:

SET ASIDE : % FOR:

SMALL BUSINESS

NAICS:

SIZE STANDARD:

HUBZONE SMALL

BUSINESS

11. DELIVERY FOR FOB

DESTINATION UNLESS

BLOCK IS MARKED

SEE SCHEDULE

13b. RATING

14. METHOD OF SOLICITATION

IFB RFPRFQ

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY17a. CONTRACTOR/ CODE

OFFEROR

FACILITY

CODE

TELEPHONE NO.

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS

BLOCK BELOW IS CHECKED.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS

IN OFFER.

8(A)

70B01C25Q00000462

Schmidt, Camilla J 202-325-1612

DHS - Customs & Border Protection

Administration Facilities Training Contracting Division

1300 Pennsylvania Ave, NW

Washington DC 20229

522320

$47M

See Attached Delivery Schedule DHS - Customs & Border Protection Administration Facilities Training Contracting Division 1300 Pennsylvania Ave, NW

Washington DC 20229

US Customs and Border Protection

FAD Mail Stop 203-V

8899 E. 56th Street

Indianapolis IN 46249

PAGE OF PAGES1. REQUISITION NUMBERSolicitation/Contract/Order for Commercial Products and Commercial Services

Offeror to Complete Blocks 12,17,23,24, & 30 0020152366 1 52

ORDER UNDER DPAS (15 CFR 700)

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

UNRESTRICTED OR

13a. THIS CONTRACT IS A RATED

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

24.

AMOUNT

22.

UNIT

23.

UNIT PRICE

SEE ADDENDUM

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

ECONOMICALLY DISADVANTAGED WOMEN-

OWNED SMALL BUSINESS (EDWOSB)

CODE

CODE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

31c. DATE SIGNED

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED.

ADDENDA

ADDENDA

ARE ARE NOT ATTACHED.

ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND

RETURN

AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH OR

OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS

SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

29. AWARD OF CONTRACT: REFERENCE

YOUR OFFER ON SOLICITATION (BLOCK 5), INCLUDING

ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH HEREIN, IS ACCEPTED AS TO

ITEMS:

OFFER DATED

30A. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE

SIGNED

31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT)

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

$0.00

COPIES TO ISSUING OFFICE. CONTRACTOR

10 BASE Pre-Tax Parking Electronic Financial Reimbursement Transaction Services (FFP FEE)

1.000

EA

LOCAL TIME

As indicated in SAM

08/12/2025

X

X

20 BASE Reimbursable Funding for Employees 1.000

EA

2 52

CONTRACT NUMBER REQUISITION NUMBER AWARD/EFFECTIVE DATE

PAGE OF PAGES

ADDITIONAL INFORMATION:

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

32a. QUANTITY IN COLUMN 21 HAS BEEN

ACCEPTED AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

FINALPARTIAL

36. PAYMENT 37. CHECK NUMBER

COMPLETE PARTIAL FINAL

39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print)

41c. DATE 42b. RECEIVED AT (Location)

STANDARD FORM 1449 (REV. 11/2021) BACK

42d. TOTAL CONTAINERS42c. DATE RECEIVED (MM/DD/YYYY)

0020152366

Offerors shall read this RFP in its entirety and shall specifically review PROVISIONS: ADDENDUM TO 52.212-1 INSTRUCTIONS TO OFFERORS-COMMERCIAL ITEMS, beginning on page 27 of this document (and RFP attachments: A - Statement of Work, and B - Pricing Sheet) before submitting a proposal.

RFP 70B01C25Q00000462 Page 3 of 52

Agency:

U.S. Customs and Border Protections (CBP), Enterprise Services (ES), Financial Operations, National Finance Center

(NFC).

Title:

Pre-Tax Parking Electronic Financial Reimbursement Transaction Services.

Subject:

This Request for Proposal (RFP) 70B01C25Q00000462, is issued in accordance with the Terms and Conditions and Provisions outlined in this document. The clauses and provisions apply to this RFP and to any resulting purchase order award.

This RFP is issued to fill the requirement for Pre-Tax Parking Electronic Financial Reimbursement Transaction Services, as outlined in Attachment A: Statement of Work (SOW).

Offerors shall read this RFP in its entirety and shall specifically review PROVISIONS: ADDENDUM TO 52.212-1 INSTRUCTIONS TO OFFERORS-COMMERCIAL ITEMS, beginning on page 27 of this document (and RFP attachments: A - Statement of Work, and B - Pricing Sheet) before submitting a proposal.

Applicable NAICS Code: 522320 – Financial Transactions Processing, Reserve, and Clearinghouse Activities Subcategory Description: 522320 - Electronic funds transfer services

Period of Performance:

The Period of Performance (POP) will be for one year (12 months), and will include 4 option years to be exercised at the discretion of the Government as follows:

Base Year: 09/18/2025 – 09/17/2026 Option Year 1: 09/18/2026 – 09/17/2027 Option Year 2: 09/18/2027 – 09/17/2028 Option Year 3: 09/18/2028 – 09/17/2029 Option Year 4: 09/18/2029 – 09/17/2030

Place of Performance:

The Contractor shall perform all activities outlined in the scope of work at contractor facilities.

Attachments:

A. Statement of Work (SOW) B. Pricing Sheet

SOLICITATION CLAUSES AND PROVISIONS APPLICABLE TO THIS SOLICITATION AND TO ANY RESULTANT

PURCHASE ORDER:

Note: For purposes of evaluation, FAR Provision 52.217-5 Evaluation of Options will be used. For any resulting purchase order, FAR Clause 52.217-9 will be incorporated.

The balance of this page is intentionally left blank

RFP 70B01C25Q00000462 Page 4 of 52

SECTION I SCHEDULES

I.1 SCHEDULE OF SUPPLIES/SERVICES

ITEM # DESCRIPTION QTY UNIT UNIT PRICE EXT. PRICE

10 BASE Pre-Tax Parking Electronic Financial Reimbursement Transaction Services (FFP FEE)

1.000 EA

20 BASE Reimbursable Funding for Employees

1.00 EA $1,000.00

ITEM # DESCRIPTION QTY UNIT UNIT PRICE EXT. PRICE

30 OY1 Pre-Tax Parking Electronic Financial Reimbursement Transaction Services (FFP FEE)

1.000 EA

40 OY1 Reimbursable Funding for

1.00 EA $1,030.00

50 OY2 Pre-Tax Parking Electronic Financial Reimbursement Transaction Services (FFP FEE)

1.000 EA

60 OY2 Reimbursable Funding for

1.00 EA $1,060.90

70 OY3 Pre-Tax Parking Electronic

Services (FFP FEE)

1.000 EA

80 OY3 Reimbursable Funding for

1.00 EA $1,092.73

90 OY4 Pre-Tax Parking Electronic

Services (FFP FEE)

1.000 EA

100 OY4 Reimbursable Funding for

1.00 EA $1,125.51

Total Funded Value of Award: $

I.2 DELIVERY SCHEDULE

DELIVER TO: ITEM # QTY DELIVERY DATE (BASE YEAR)

CUSTOMS & BORDER PROTECTION

8899 E 56TH ST

INDIANAPOLIS, IN 46249

10 1.000 09/18/2025 – 09/17/2026

“ 20 1.000 09/18/2025 – 09/17/2026

DELIVER TO: ITEM # QTY DELIVERY DATE (Option Year 1)

“ 30 1.000 09/18/2026 – 09/17/2027

“ 40 1.000 09/18/2026 – 09/17/2027

DELIVER TO: ITEM # QTY DELIVERY DATE (Option Year 2)

“ 50 1.000 09/18/2027 – 09/17/2028

“ 60 1.000 09/18/2027 – 09/17/2028

DELIVER TO: ITEM # QTY DELIVERY DATE (Option Year 3)

“ 70 1.000 09/18/2028 – 09/17/2029

“ 80 1.000 09/18/2028 – 09/17/2029

DELIVER TO: ITEM # QTY DELIVERY DATE (Option Year 4)

RFP 70B01C25Q00000462 Page 5 of 52

“ 90 1.000 09/18/2029 – 09/17/2030

“ 100 1.000 09/18/2029 – 09/17/2030

SECTION II CONTRACT CLAUSES

II.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): www.acquisition.gov | https://www.dhs.gov/homeland-security-acquisition-manual.

(End of Clause)

II.2 52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE (OCT 2018)

II.3 52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE MAINTENANCE (AUG 2020)

II.4 52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS (DEC 2014)

II.5 52.212-4 CONTRACT TERMS AND CONDITIONS -- COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

(NOV 2023)

II.6 52.227-14 RIGHTS IN DATA--GENERAL (MAY 2014)

II.7 52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUN 2013)

II.8 52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS (MAR 2023)

II.9 52.204-21 - BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (NOV 2021)

(a) Definitions. As used in this clause -

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

RFP 70B01C25Q00000462 Page 6 of 52

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

II.10 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE

ORDERS--COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (JAN 2025)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section

743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113–235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions))

RFP 70B01C25Q00000462 Page 7 of 52

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (DEC 2023) (Section 1634 of Pub. L. 115–91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or

Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015)

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (MAR 2023) (31 U.S.C. 3903 and

10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108–77 and 108–78 (19 U.S.C.

3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[X] (4) 52.203–17, Contractor Employee Whistleblower Rights (NOV 2023) (41 U.S.C. 4712); this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

[X] (5) 52.204–10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020) (Pub. L. 109–

282) (31 U.S.C. 6101 note).

[X] (7) 52.204–14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111–117, section 743 of Div. C).

[X] (9) 52.204–27, Prohibition on a ByteDance Covered Application (JUN 2023) (Section 102 of Division R of Pub. L.

117–328).

[X] (12) 52.209–6, Protecting the Government’s Interest When Subcontracting With Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded. (JAN 2025) (31 U.S.C. 6101 note).

[X] (26)(i) 52.219–28, Postaward Small Business Program Rerepresentation (JAN 2025) (15 U.S.C. 632(a)(2)).

[X] (31) 52.222–3, Convict Labor (JUN 2003) (E.O. 11755).

[X] (32) 52.222-19, Child Labor–Cooperation with Authorities and Remedies (JAN 2025) (E.O. 13126).

[X] (36)(i) 52.222–36, Equal Opportunity for Workers with Disabilities (JUN 2020) (29 U.S.C. 793).

[X] (37) 52.222–37, Employment Reports on Veterans (JUN 2020) (38 U.S.C. 4212).

[X] (38) 52.222–40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

[X] (39)(i) 52.222–50, Combating Trafficking in Persons (NOV 2021) (22 U.S.C. chapter 78 and E.O. 13627).

[X] (51) 52.225–13, Restrictions on Certain Foreign Purchases (FEB 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

[X] (55) 52.226–8, Encouraging Contractor Policies to Ban Text Messaging While Driving (MAY 2024) (E.O. 13513).

[X] (59) 52.232–33, Payment by Electronic Funds Transfer—System for Award Management (OCT 2018) (31 U.S.C.

3332).

[X] (63) 52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone

Act-Covered Foreign Entities (NOV 2024) (Sections 1821-1826, Pub. L. 118-31, 41 U.S.C. 3901 note prec.).

RFP 70B01C25Q00000462 Page 8 of 52

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

None.

(d) Comptroller General Examination of Record The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records-- Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor's directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in paragraphs (e)(1) in a subcontract for commercial products and commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause--

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV 2021) (41 U.S.C. 3509).

(ii) 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023) (41 U.S.C. 4712).

(iii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017)

(section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub.

L. 113–235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iv) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by

Kaspersky Lab Covered Entities (DEC 2023) (Section 1634 of Pub. L. 115-91).

(v) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or

Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115–232).

(vi) 52.204-27, Prohibition on a ByteDance Covered Application (JUN 2023) (Section 102 of Division R of Pub. L.

117-328).

(vii)(A) 52.204-30, Federal Acquisition Supply Chain Security Act Orders-Prohibition. (DEC 2023) (Pub. L. 115–390, title II).

(B) Alternate I (DEC 2023) of 52.204-30.

(viii) 52.219-8, Utilization of Small Business Concerns (JAN 2025) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(ix) 52.222-21, Prohibition of Segregated Facilities (APR 2015)

RFP 70B01C25Q00000462 Page 9 of 52

(x) 52.222-26, Equal Opportunity (SEP 2016) (E.O. 11246).

(xi) 52.222-35, Equal Opportunity for Veterans (JUN 2020) (38 U.S.C. 4212).

(xii) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN 2020) (29 U.S.C. 793).

(xiii) 52.222-37, Employment Reports on Veterans (JUN 2020) (38 U.S.C. 4212)

(xiv) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xv) 52.222-41, Service Contract Labor Standards (AUG 2018) (41 U.S.C. chapter 67).

(xvi) [X] (A) 52.222-50, Combating Trafficking in Persons (NOV 2021) (22 U.S.C. chapter 78 and E.O. 13627).

(xvii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for

Maintenance, Calibration, or Repair of Certain Equipment—Requirements (MAY 2014) (41 U.S.C. chapter 67).

(xviii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain

Services—Requirements (MAY 2014) (41 U.S.C. chapter 67).

(xix) 52.222-54, Employment Eligibility Verification (JAN 2025) (E.O. 12989).

(xx) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (JAN 2022).

(xxi) 52.222-62 Paid Sick Leave Under Executive Order 13706 (JAN 2022) (E.O. 13706).

(xxii) (A) 52.224-3, Privacy Training (JAN 2017) (5 U.S.C. 552a).

(B) Alternate I (JAN 2017) of 52.224-3.

(xxiii) 52.225-26, Contractors Performing Private Security Functions Outside the United States (OCT 2016) (Section

862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

(xxiv) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (JUN 2020) (42 U.S.C. 1792).

(xxv) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (MAR 2023) (31 U.S.C. 3903 and 10 U.S.C. 3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxvi) 52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security

Drone Act-Covered Foreign Entities (NOV 2024) (Sections 1821-1826, Pub. L. 118-31, 41 U.S.C. 3901 note prec.).

(xxvii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (NOV 2021) (46 U.S.C. Appx

1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

II.11 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this purchase order by written notice to the Contractor within 30 days of order expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the order expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

RFP 70B01C25Q00000462 Page 10 of 52

(c) The total duration of this order, including the exercise of any options under this clause, shall not exceed 5 years (60 months).

II.12 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any Department of Homeland Security Acquisition Regulation (HSAR) (48

CFR 30) clause with an authorized deviation is indicated by the addition of “(DEVIATION)” after the name of the regulation.

II.1 3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JUL 2023)

(a) Definitions. As used in this clause--

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, ‘‘Chemical Facility Anti-Terrorism

Standards,’’ and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual ‘‘Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information’’ dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002

(title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Public Law 116-283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, ‘‘Protection of Sensitive Security Information,’’ as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, ‘‘Sensitive Security Information (SSI)’’ and, within the Transportation Security Administration, TSA MD 2810.1, ‘‘SSI Program’’;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an

RFP 70B01C25Q00000462 Page 11 of 52 international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the

Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland

Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable

Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal

RFP 70B01C25Q00000462 Page 12 of 52 identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that --

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide --

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information. (1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhssecurity-and-training-requirementscontractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the

Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the

Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security

RFP 70B01C25Q00000462 Page 13 of 52

Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems.

CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident

Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by

RFP 70B01C25Q00000462 Page 14 of 52 the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800-88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800-88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S.

Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

II.2 3052.204-73 NOTIFICATION AND CREDIT MONITORING REQUIREMENTS FOR PERSONALLY IDENTIFIABLE

INFORMATION INCIDENTS (JUL 2023)

(a) Definitions. Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally

Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

RFP 70B01C25Q00000462 Page 15 of 52

(1) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(2) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Truncated SSN (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Ethnic or religious affiliation;

(v) Sexual orientation;

(vi) Criminal history;

(vii) Medical information; and

(viii) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(3) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) PII and SPII Notification Requirements.

(1) No later than 5 business days after being directed by the Contracting Officer, or as otherwise required by applicable law, the Contractor shall notify any individual whose PII or SPII was either under the control of the Contractor or resided in an information system under control of the Contractor at the time the incident occurred. The method and content of any notification by the Contractor shall be coordinated with, and subject to prior written approval by, the Contracting Officer. The Contractor shall not proceed with notification unless directed in writing by the Contracting Officer.

(2) All determinations by the Department related to notifications to affected individuals and/or Federal agencies and related services (e.g., credit monitoring) will be made in writing by the Contracting Officer.

(3) Subject to government analysis of the incident and direction to the Contractor regarding any resulting notification, the notification method may consist of letters to affected individuals sent by first-class mail, electronic means, or general public notice, as approved by the Government. Notification may require the Contractor’s use of address verification and/or address location services. At a minimum, the notification shall include:

(i) A brief description of the incident;

(ii) A description of the types of PII or SPII involved;

(iii) A statement as to whether the PII or SPII was encrypted or protected by other means;

(iv) Steps individuals may take to protect themselves;

(v) What the Contractor and/or the Government are doing to investigate the incident, mitigate the incident, and protect against any future incidents; and

(vi) Information identifying who individuals may contact for additional information.

(c) Credit Monitoring Requirements. The Contracting Officer may direct the Contractor to:

RFP 70B01C25Q00000462 Page 16 of 52

(1) Provide notification to affected individuals as described in paragraph (b).

(2) Provide credit monitoring services to individuals whose PII or SPII was under the control of the Contractor or resided in the information system at the time of the incident for a period beginning the date of the incident and extending not less than 18 months from the date the individual is notified. Credit monitoring services shall be provided from a company with which the Contractor has no affiliation. At a minimum, credit monitoring services shall include:

(i) Triple credit bureau monitoring;

(ii) Daily customer service;

(iii) Alerts provided to the individual for changes and fraud; and

(iv) Assistance to the individual with enrollment in the services and the use of fraud alerts.

(3) Establish a dedicated call center. Call center services shall include:

(i) A dedicated telephone number to contact customer service within a fixed period;

(ii) Information necessary for registrants/enrollees to access credit reports and credit scores;

(iii) Weekly reports on call center volume, issue escalation (i.e., those calls that cannot be handled by call center staff and must be resolved by call center management or DHS, as appropriate), and other key metrics;

(iv) Escalation of calls that cannot be handled by call center staff to call center management or DHS, as appropriate;

(v) Customized Frequently Asked Questions, approved in writing by the Contracting Officer in coordination with the

Component or Headquarters Privacy Officer; and

(vi) Information for registrants to contact customer service representatives and fraud resolution representatives for credit monitoring assistance.

II.3 3052.212-70 CONTRACT TERMS AND CONDITIONS APPLICABLE TO DHS ACQUISITION OF COMMERCIAL

ITEMS (JUL 2023)

The Contractor agrees to comply with any provision or clause that is incorporated herein by reference to implement agency policy applicable to acquisition of commercial items or components. The provision or clause in effect based on the applicable regulation cited on the date the solicitation is issued applies unless otherwise stated herein. The following provisions and clauses are incorporated by reference:

[The Contracting Officer should either check the provisions and clauses that apply or delete the provisions and clauses that do not apply from the list. The Contracting Officer may add the date of the provision or clause if desired for clarity.]

(a) Provisions.

None.

(b) Clauses.

[X] 3052.204-71 Contractor Employee Access.

[X] 3052.204-73 Notification and Credit Monitoring Requirements for Personally Identifiable Information…