RUUS-26-00006 Draft PWS.pdf

U.S. DEPARTMENT OF

HOMELAND SECURITY

f

Panama Case Management System

Performance Work Statement March 2026

1. BACKGROUND

Panama has encountered a sustained extraordinary movement of irregular migration into and through the Darien Panama-Colombia border region. Approximately 302,000 migrants entered Panama through the Darien region in 2024 with most originally from South America (primarily Venezuela, Colombia, and Ecuador), though there are often large numbers from Africa, South and Central Asia, and East Asia. Many continue in transit across Panama to destinations in Central and North America, though some attempt to remain in Panama.

Panama has requested U.S. assistance to enhance Panama’s capacity to remove irregular migrants that are deemed inadmissible under Panamanian law. Through partnership with the Department of State (DOS), the Department of Homeland Security (DHS) will provide support to the Panamanian government to expand capability to deter irregular migration.

Within the areas of expanded capability and capacity, DHS seeks to implement a Panamanian Case Management System (PCMS) from encounter to final disposition for the Government of Panama (GoP), specifically the Servicio Nacional de Migracion (SNM).

The Panama Case Management System (PCMS) is designed to assist Panamanian agents in managing migrant cases through various operational phases: identify, process, retain, and final disposition. The system aims to streamline the migration management process, improve data accuracy, and enhance coordination between different agencies involved in migrant processing.

Key features of the PCMS include:

• Biometric, biographic, and demographic data capture

• Identity verification and watchlist checking

• Case management across multiple locations

• Integration with existing systems like SIMPLUS and PISCES

• Mobile accessibility for remote areas

• Offline data entry capabilities

• Secure data sharing between various checkpoints

• Reporting and analytics for Panamanian authorities and international partners

The system will support multiple user roles with varying levels of access, ensuring data security and operational efficiency. It will be designed to handle connectivity challenges in remote areas and prioritize critical functions during degraded conditions.

Currently, SNM does not have a means to consolidate existing processes within an information technology platform to provide case management across their enterprise.

1.1. Period of Performance

Base Period: April 01, 2026 – March 31, 2027 (12 Months) Option Period 1: April 01, 2027 – March 31, 2028 (12 Months) Option Period 2: April 01, 2028 – March 31, 2028 (12 Months)

1.2. Scope of Contract

The proposed Panama Case Management System (PCMS) will serve as a centralized platform for processing, managing, serving of deportation orders, and recording final disposition of all cases. SNM users shall be able to create cases, upload biographic data and various file types, book-in/book-out, provide case comments, execute immigration policy, record the approval or denial decision for international protection/asylum, and provide real-time analytics for cases of enrollees within the PCMS program.

Key Considerations:

- Number of Accounts: Upper threshold ~420; Lower Threshold 250

- Estimated Annual Enrolled Cases: Upper threshold 6,000; Lower Threshold 2,500

- File types include but are not limited to: CSV, Excel, Word, PDF, PNG, JPEG, JPG, TXT

- Hosting Requirements: potential for cloud solutions (

- Optional Systems for Integration: BDSP (biometric data), BITMAP, PISCES, SIMPLUS, ONPAR Tre/GOB

- Concept Workflow: Refer to Appendix A

2. OPERATIONAL REQUIREMENTS

2.1. Effectiveness Requirements

This section describes the future solution's operational effectiveness requirements (OERs) and aligns them to the mission needs described by the GoP and U.S. Immigrations and Customs Enforcement (ICE) Enforcement and Removal Operations (ERO).

2.1.1. User Experience (UX) Requirements

OER # OER Description Threshold Objective

OER-# The solution shall provide the capability to display operational activity data

Desktop application displays operational activity data

Display of operational data is mobile-friendly

OER-#

The solution shall provide the capability to alert (i.e., notify) users of updates in operational conditions

Automated notifications provided to user via desktop application

Automated notifications provided to users via desktop application and mobile-friendly interface of desktop application

OER-#

The solution shall provide users with the ability to search case and subject records files that is wildcard enabled

Search conducted via desktop application

Search conducted via desktop application and mobile-friendly interface of desktop application

OER-#

The solution provides the capability to apply bulk system actions across multiple profiles and subject records

Users employ desktop application to apply bulk system actions

Users employ mobile and desktop applications to apply bulk system actions

OER-# The solution shall provide the user with the ability to input data related to subjects and cases

Users employ desktop application to input data

Users employ desktop applications and mobile-friendly interface of desktop application to input data

OER-# The solution shall provide the capability to manipulate user preferences

Users employ desktop applications to select, establish, and archive user preferences

Users employ desktop applications and mobile-friendly interface of desktop application to select, establish, and archive user preferences

OER-# The solution shall provide a capability that allows users to submit system feedback

Users employ desktop applications to submit user feedback

Users employ desktop application and mobile-friendly interface of desktop application to submit user feedback

OER-# The solution shall provide a capability that allows users to submit system errors

Users employ desktop applications to submit system error information

Users employ desktop application and mobile-friendly interface of desktop application to submit system error information

OER-# The solution shall provide a capability that incorporates policy references

Users employ desktop applications to access policy references

Users employ desktop applications and mobile-friendly interface of desktop applications to access policy references

OER-#

The solution shall provide the capability to standardize (e.g., create, read, update and delete

– CRUD) operational activity data

Users employ a desktop application to manipulate operational activity data

Users employ a desktop application and mobile-friendly interface of desktop application to manipulate operational activity data

2.1.2. Manage Cases

The solution shall provide the capability to tailor workflows in support of all encounter and disposition tasks

Workflows can be tailored using a desktop application

Workflows can be tailored using a desktop and mobile friendly interface

OER-#

The solution shall provide the capability for supervisory validation (e.g., review and approval) of case processing and custody management actions (e.g., dispositions/adverse actions)

Users employ desktop applications to validate disposition/adverse action types

Users employ desktop applications and mobile-friendly interface of desktop application to validate disposition/adverse action types

OER-#

The solution shall provide the capability to manipulate (CRUD) a record related to an encounter

CRUD operations performed via desktop application

CRUD operations performed via desktop application and mobile-friendly interface of desktop application processes

OER-#

The solution shall provide the capability to process (e.g., create, edit, upload, download, attach, remove) case-related files and forms

Users employ desktop application to process forms for completing case processing and custody management tasks

Users employ desktop and mobile-friendly interface of desktop application to process forms for completing case processing and custody management tasks

OER-# The solution shall provide the capability to manage holding / detention locations

Users employ desktop application to manage [n] holding/detention locations

Users employ desktop application and mobile-friendly interface of desktop application to manage [n+] holding/detention locations

OER-#

The solution shall provide the capability to support generation and management of prosecution cases (e.g. open new, update ongoing, track the progress of ongoing, or close) prosecution cases

Users employ a desktop application to support prosecution case actions

Users employ a desktop application and mobile-friendly interface of desktop application to support prosecution case actions

The solution shall enable the planning, scheduling and conduct of deportation or voluntary return processes

Users employ a desktop application to support deportation or voluntary return processes

Users employ a desktop application and mobile-friendly interface of desktop application to support deportation or voluntary return processes

OER-#

The solution shall provide the capability to securely generate, review, and serve legal documents while maintaining a detailed audit trail

Users employ a desktop application to support the serving of deportation orders

Users employ a desktop application and mobile friendly interface of desktop application to support deportation tasks

OER-#

The solution shall provide the capability to manage detention operational activities (e.g.

configure locations, initiate and manage referrals, manage capacity, etc.)

Users employ a desktop application to support detention activities

Users employ a desktop application and mobile-friendly interface of desktop application to support detention activities

2.1.3. Manage Subject Records

OER-# The system shall provide a user with the ability to enter data as a subject record

Users employ desktop applications to enter data

Users employ a desktop application and mobile-friendly interface of desktop application to enter data

OER-# The solution shall support ingestion of biometric data

Biometric data can be ingested into the system via a desktop application

Biometric data can be ingested into the system via a desktop application and a mobile-friendly interface to a desktop application

2.1.4. Search and Audit

The solution shall provide a capability to report on subject records, case processing, and custody management actions

Users employ a desktop application to generate, and export reports

Users employ a desktop application and a mobile-friendly interface of desktop application to generate, and export reports

OER-#

The solution shall allow data owners to audit where and with whom their data was shared over a specified reporting period.

Users employ a desktop application to generate an audit trail

Users employ a desktop application and a mobile-friendly interface of the desktop application to generate, an audit trail

OER-#

The solution shall provide the capability to ensure data quality for requisite entry fields (e.g.

data completeness, consistency, accuracy, timeliness, validity and uniqueness)

Users employ desktop applications to validate data quality for entry fields

Users employ a desktop application and a mobile-friendly interface of desktop application to validate data quality for entry fields

OER-# The solution shall support the ability to export structured data types in standard formats

Export from standard formats

Export to standard formats (CSV, Excel, Word, PDF, PNG, JPEG, JPG, TXT)

OER-# The solution shall support the ability to import structured data types from standard formats

Import from standard formats

Import from standard formats (CSV, Excel, Word, PDF, PNG, JPEG, JPG, TXT)

2.2. Suitability Requirements

Operational suitability requirements describe what a system is supposed to be (e.g., reliable, safe, secure, resilient, and rugged).

Reliability, Availability, and Maintainability (RAM) requirement threshold (T) and objective (O) metrics are developed by calculating Mean Time Between Failure (MTBF) and MTTR. Additional and more detailed cost information for the PMCS is provided in the Current Program Estimate (CPE).

When calculating RAM requirement metrics, it is important that stakeholders have a common understanding of the definition of system failure and downtime. Defining failure also involves describing degraded and unacceptable performance from the user perspective.

These are defined as:

• External Degradation – A decline in PCMS quality or performance attributed to external system functionality; and

• Internal Degradation – A decline in PCMS quality or performance attributed to internal system functionality, where a work-around method exists; and

• Downtime – When case processing and custody management capabilities are unavailable in their entirety; and

• Failure – Failure of PCMS designed or installed system software, where a work around does not exist or that causes a breach of SLA.

Downtime related to external dependencies does not equate to a PCMS system failure.

2.2.1. Cyber Requirements

The development and operation of the PCMS solution will be conducted in compliance with GoP cyber requirements. Specific mission outcomes and recommendations of cybersecurity threats and the recommendations to address them are provided in the below table.

Cyber Threat Mission Outcomes Recommendations

• Extract, Alter, and/or Destroy Data

• Alter System and/or Network Behavior

• Destroy Hardware and/or Software

• Implement Zero Trust Architectures.

• Implement Identity Management solutions.

• Implement Continuous Diagnostics and

Monitoring solutions.

• Coordinate with appropriate technical subject-matter experts (e.g. Chief Information Officer, Chief Information Security Officer) to continuously evaluate and implement new technology solutions that address cybersecurity risk throughout a program’s lifecycle.

• Application shall protect against OWASP Top 10

• Implement controls to protect against OWASP Top 10.

A cybersecurity test and evaluation (T&E) process will support the development and testing of mission-driven cybersecurity and cyber resilience requirements. This process may include activities such as a Cyber Table-Top exercise and require specialized systems engineering and T&E expertise and consultation with the appropriate technical authorities, test agents, and applicable Penetration Test Teams for additional guidance.

The PMCS will collect and share large amounts of sensitive and non-sensitive data across the enforcement lifecycle. It is imperative that the system adhere to all relevant laws and policies mandating the protection and security of information. Future implementation of cloud service capabilities, conformant to GoP law, will bring additional cybersecurity concerns. In the “as a service” model, the GoP and the vendor will have a shared responsibility to protect the confidentiality, integrity, and availability of the data. Cloud service providers should be able to complete certifications similar to GSA’s Federal Risk and Authorization Management Program (FedRamP) or Joint Authorization Board (JAB) security authorization processes used by the United States Government. This will also include an independent review from an authorized Third-Party Assessment Organization

(3PAO).

GoP program leadership will work closely with appropriate cybersecurity offices to ensure all component systems conform to security and resilience requirements to address known actors and intentions previously listed above. For this document, cyber resilience is the ability of an information system to continue to operate while under attack, even if in a degraded or debilitated state, and to rapidly recover operational capabilities for essential functions after a successful attack. More specific PCMS cyber security details below that of the operational requirement level listed may be addressed in follow-on Interconnection Security Agreements, the System Security Plan, the security authorization package in an Authority to Operate (ATO), or a combination of these products.

The table below captures the PCMS requirements to collectively address cybersecurity threats.

CYB # OER Description Threshold Objective

CYB-#

The solution shall have the ability to withstand hostile operational environment conditions.

System threat conditions do not reduce PCMS operational availability below 98.5% for (AoT) desktop applications.

System threat conditions do not reduce PMCS’s operational availability below 99.0% (AoO) for desktop applications.

CYB-#

The solution shall have the ability to recover from hostile operational environment conditions.

PCMS total detect, react, adapt, and restore times are no more than 1 hour

(MTTR)

PMCS total detect, react, adapt, and restore times are no more than .91 hours

(MTTR)

CYB-#

The solution shall provide data integrity controls to ensure that data is not modified (intentionally or unintentionally) by unauthorized users or system components.

GoP Vulnerability Assessment Team (VAT) using TENABLE, scans all GoP addressed assets within the GoP infrastructure to determine overall GoP Cybersecurity health at a scored value of 90%.

TENABLE

scans are assessed against the

DHS

Executive

FISMA

Scorecard to determine overall GoP Cybersecurity health at a scored value of ≥ 95%.

CYB-#

The solution shall be secure against unauthorized access to its sensitive digital assets.

Role-Based Access Control (RBAC) will be employed to authorize access for a minimum of [n] PMCS roles.

Role-Based Access Control (RBAC) will be employed to authorize access for a minimum of [n+] PMCS roles.

CYB-#

The solution shall integrate with the GoP information technology and cybersecurity operations centers.

The solution gains access to enterprise services, network support and cyber security services.

CYB-# The solution shall protect data in transit and at rest.

The solution shall encrypt data as it travels from user to server and database. Also, all data shall be encrypted at rest.

2.2.2. Survivability Requirements

The system must be resilient under extreme conditions to support SNM critical role in continuity of operation. The components of the PMCS solution will support the mission operations of SNM which requires the solution to be available for case processing and custody management actions 24 hours per day, 7 days per week. Possible operation conditions include natural disasters such as earthquakes, floods, and storms as well as infrastructure failures such as power outages, and system failures. The exception to this will be planned service and maintenance time identified in the program acquisition baseline or outages due to enterprise level service outages. PMCS must be compliant with GoP records management regulations. Specific retention requirements are currently unknown. Retention requirements in place for other systems that will be incorporated into PMCS may not be the same used in PMCS going forward. The table below provides the Survivability requirement for PCMS.

SUR # OER Description Threshold Objective

SUR-# The solution shall have the ability to recover from failures caused by natural disasters.

PCMS total recovery times are no more than 24 hours.

PCMS total recovery times are no more than 12 hours.

SUR-# The solution shall comply with GoP records regulations.

PMCS complies with all applicable records regulations.

SUR-# The system shall be capable of backing up data.

All data is backed-up at least once per calendar day.

SUR-# The solution shall be capable of restoring lost data from a backup.

The solution can recover data lost from a backup copy.

SUR-#

The system shall continue to operate and provide user-defined stored data to users when connections to source systems from which it obtains data are unavailable.

The solution shall provide the capability to work in different modes (i.e., online and offline).

The system shall sync the data once the connections to the source systems become available.

The solution shall provide the capability to work in different modes (i.e., online and offline).

The system shall continue to operate and provide data to users from a devolution site for the continuity of operations during a natural disaster or other condition that reduces capacity.

2.2.3. Availability Requirements

Operational Availability (AO), is a percentage of time that a system or group of systems within a unit are operationally capable of performing an assigned mission and can be expressed as uptime/uptime/downtime). The GoP test authority will evaluate Availability, which will include downtime for scheduled and unscheduled maintenance.

OAR # OER Description Threshold Objective

OAR-#

The solution shall provide an operationally available application to support case processing and custody management activities.

PCMS will be operationally available ≥99.5% (AoT) of the time.

PMCS will be operationally available ≥99.8% (AoO) of the time.

2.2.4. Reliability Requirements

Operational Reliability for PCMS is expressed as a measure of how long the system will perform without failure during annual operational conditions. PCMS reliability measures the number of hours the technology performs in a satisfactory manner annually, when used under operating conditions. Reliability is measured by calculating the MTBF, as described in the below table.

REL # OER Description Threshold Objective

REL-# The solution shall have the ability to operate without failure.

Annual MTBF shall not exceed 225 hours .

Annual MTBF shall not exceed 279 hours (O).

2.2.5. Maintainability Requirements

Maintainability is a measure of the ability of the technology to be retained in, or restored to, a specified condition when maintenance is performed by personnel having specified skill levels, using prescribed procedures and resources. This is calculated using the formula for MTTR defined as the meantime taken to repair the technology functions after a failure and is measured from when the technology fails until it is fully restored and capable of delivering its functionality. MTTR Threshold and Objective metrics were calculated by dividing estimated downtime by the estimated total number of failures.

MNT # OER Description Threshold Objective

MNT-# The solution shall have the ability to be retained in or restored to a specified condition.

PCMS MTTR no more than 1 hour

PMCS MTTR no more than .91 hours

2.2.6. Interoperability Requirements

In an information technology context, interoperability refers to the ability of different computer systems or databases to exchange data in a commonly understood format and the ability to act upon such data without manual intervention.

INT # OER Description Threshold Objective

INT-#

The solution shall be able to receive data from authorized systems and sources via an unclassified network connection.

Receive/ingest:

• Spreadsheets conforming to Open Document Format for Office Applications

• Documents conforming to Open Document Format for Office Applications

• Geospatial data Relational databases

Receive/ingest:

• Biometric data

• Imagery data Non-relational databases

INT-#

The solution shall provide the capability to use Optical Character Recognition (OCR) to support case management activities.

Desktop application supports OCR

• Desktop application and mobile-friendly interface of desktop application supports OCR

INT-#

The solution shall provide the capability to transform, and map imported structured data to the system's data model.

Manual data transformation

Automated data transformation with configurable mapping

INT-#

The solution shall provide the capability to interface with peripheral devices (e.g., cameras, smartphones, tablets, scanners, etc.)

Users employ peripheral devices to complete case processing and custody management actions via desktop application.

Users employ peripheral devices to complete case processing and custody management actions via desktop application and mobile-friendly interface of desktop application.

INT-#

The solution shall provide seamless integration with translation services to support real-time multilingual case management across all features such as case documentation, reporting, and user interfacing.

Integration with translation service

Integration with translation services

2.2.7. Personnel Requirements

Qualifications necessary for personnel to be fit for duty will be managed and enforced by the GoP. The GoP will also manage and enforce the skills and readiness required for their personnel to access and operate IT networks and equipment in accordance with GoP policy and law. The system shall support the following user roles:

• Administrator (Full system access)

• Supervisor (Oversight and approval capabilities)

• User (e.g., migration officers, border patrol agents, retention center staff, legal staff, judicial secretariat staff) with role specific access

Each role shall have specific access levels and permissions as detailed in the full requirements document.

PER # OER Description Threshold Objective

PER-#

The solution shall provide the capability to access user functions based on the user’s roles and permissions.

PCMS offers (n) unique user types

2.2.8. Training Requirements for Operators and Maintainers

The training and learning are key components to the success of GoP as they enable efficient and accurate use of the system by user. The GoP is responsible for offering training to users and providing a platform for ongoing learning. The training itself will be coordinated and managed by the GoP. The GoP PCMS program office will develop a training plan to coordinate its approach to training and learning. Options for training delivery include embedded simulations, tutorials, live instructor-led training, executed in-person or via webinar or pre-recorded video. All training curriculum is designed to ensure the users understand and are fully capable of operating and using all the features of the PCMS solution.

TRN # OER Description Threshold Objective

TRN-# The solution shall provide access to training for users.

Users access training via a desktop application interface.

Users access training via a desktop application interface and mobile-friendly interface.

2.2.9. Human Factors or Human Engineering Requirements

HFA # OER Description Threshold Objective

HFA-#

The solution shall enable a novice end-user to successfully perform consecutive mission tasks.

Users can perform consecutive mission tasks with 95% success.

Users can perform consecutive mission tasks with 99% success.

HFA-#

The solution shall enable the user to efficiently respond to a case processing and custody management event.

Users employ PCMS to respond in under 10 minutes.

Users employ PCMS to respond in under 5 minutes.

HFA-# PCMS shall enable users to create specialized operational workflows.

Users create specialized operational workflows.

2.2.10. Environmental Safety and Occupational Health (ESOH) Requirements

The system shall comply with relevant GoP health and safety regulations for electronic systems used in office and field environments.

3. Key Performance Parameters

This section identifies the key performance parameters (KPPs) for PCMS, and indicates which operational requirements were elevated in importance. KPPs are those capabilities or characteristics so significant that failure to meet the threshold can be cause for the program to be reassessed or terminated. The KPPs identified are based on the understanding that external dependencies do not count against system uptime. The KPPs provided for PCMS address measuring key areas of initial and final system performance threshold and objective values.

KPP Measure Threshold Objective

KPP-# The solution shall have the ability to operate without failure.

Annual MTBF shall not exceed 225 hours.

Annual MTBF shall not exceed 279 hours (O).

KPP-#

The solution shall provide an operationally available application to support case processing and custody management activities.

PCMS will be operationally available ≥99.5% (AoT) of the time.

PMCS will be operationally available ≥99.8% (AoO) of the time.

KPP-#

The solution shall be interoperable with existing GoP, U.S. Government, and non-governmental organization case management systems.

PCMS shall interoperate with [n] systems.

PCMS shall interoperate with [n+] systems.

KPP-# The solution shall have the ability to withstand hostile operational environment conditions.

System threat conditions do not reduce PCMS operational availability below 98.5% for (AoT) desktop applications.

System threat conditions do not reduce PMCS’s operational availability below 99.0% (AoO) for desktop applications.

4. SCHEDULE

4.1. Implementation

The implementation of the PCMS pilot program will follow a 2-stage approach as detailed in the Schedule section. It will focus on a standalone pilot version, during which users will not be able to perform background checks or automated queries into other GOP systems.

Additionally, flight manifests will be generated external of PCMS.

4.2. Schedule

Initial Operational Capability (IOC):

The PCMS shall achieve IOC within 6 months of project initiation, with the following capabilities:

• Basic data entry and case management for SNM officials in the Darién region

• Basic reporting functionalities

Full Operational Capability (FOC):

The PCMS shall achieve FOC within 12 months of project initiation, with all specified requirements met, including:

• Full integration with all relevant systems

• Advanced reporting and analytics capabilities

4.3. Assumptions

• The PCMS pilot program will interface with other government systems once FOC is achieved.

• Relevant Panamanian Privacy policies will be integrated in relevant case workflows.

• DHS/USG will be able to login to PCMS and review case info as needed.

• SNM users will be able to process case workflows from any relevant geographic site.

• Data migration will not be required. The new system and database will be clear of any biographic migrant information.

• There will be an operational dependency to other GoP.

• Continued Operations and Support (O&S) will be fully burdened by GoP

4.4. INVOICING

ENTER BOILER PLATE INVOICE INFORATION.

5. ADDITIONAL REQUIREMENTS

5.1. Contract Management

The Contractor shall provide continuous management oversight to ensure that all services required under the contract are performed in a timely and satisfactory manner. A Contractor Project Manager (PM) will be designated and who will be available via phone and e-mail during normal business hours 0800 - 1700, seven days a week, during the contract period of performance. This position is included as Key Personnel in accordance with HSAR 3052.215-70 Key Personnel or Facilities (DEC 2003).

The PM shall have a minimum of 5 years’ project management experience, demonstrating project management support services with large, high risk, sensitive projects and division level management experience managing projects and staff of comparable scope to the effort assigned.

5.2. Reports

The Contractor shall provide reports to the COR including, but not limited to:

• Project Management Plan: Outlining the project plan with critical path and key milestones identified to meet both IOC and FOC functionality and requirements listed within the PWS.

• Monthly Invoice summary reports detailing charges across contracted line items (CLINs), progress reports on work completed and objectives met against the project management plan; risk section, and project remaining funds and burn-rate

All reporting will be based upon industry’s best practices and provided at no additional cost to the Government.

6. DELIVERY PERFORMANCE OBJECTIVES

Performance Objective PWS Section(s) Performance Threshold System Functionality 2.0 System Requirements PCMS reflects agreed upon joint application design between stakeholders and contractor; system functionality supports SNM operational needs and data reporting; aligns with GoP IT governance laws and regulation

Provide accurate reporting 6.2 100% accurate, complete and on-time Provide accurate invoicing 4.0 100% accurate, complete and on-time Bilingual Help Desk Support 6.3 100% of Help Desk personnel proficient in English and Spanish; ≥95% of tickets resolved within 24 hours

6.1. TRANSITION IN/OUT

6.1.1. Transition Out

The transition-out phase shall identify those actions, plans, procedures, and timelines necessary to ensure a smooth transition to a new contractor from start date to full operational status by the new contractor. If the contractor is not awarded a follow-on contract, or if their performance is deemed unsatisfactory and a new vendor is awarded the contract, the contractor shall be responsible for the transition-out of all technical activities identified in this PWS during the final, awarded period of performance.

The incumbent contractor agrees to cooperate with the incoming contractor to minimize the disruption of services during the change-over of operations. The incumbent contractor shall continue to perform contract requirements during the period between the initial decision date and completion of the phase-out period. The incumbent contractor shall fully support the transition of all requirements to any successor to ensure no disruption in operational services.

The incumbent contractor, the incoming contractor, and the CORs shall plan contract change-over procedures within ten (10) calendar days of a follow-on contract award, to consider, at a minimum, the following: the time to effect, the tasks to be performed, and the information and or data to be exchanged.

In the event the contractor, the incoming contractor, and the COR cannot agree on change-over procedures, all parties shall comply with the terms and procedures established by the

CO.

The transitioning out (incumbent) contractor shall submit the Transition-out Plan 15 days following official notification of a transition period. The transition-out plan shall be approved by the COR. The contractor shall complete the transition by the end of the period of performance of this TO.

The Transition-Out Plan shall address, at a minimum, the following areas:

• Inventory and orderly transfer of all GFE/GFP;

• Briefing on all in-progress and committed items;

• Any additional information required by other clauses contained in the contract.

6.2. PERFORMANCE STANDARDS

The following performance standards govern contractor accountability throughout the period of performance:

• All contractual milestones met on schedule and within budget.

• WTO issuance achieved within 120 days of assessment submission.

• System availability maintained at ≥ 99.5 % post-deployment, excluding outages attributed to GoP/SNM network or infrastructure dependencies

• ≥ 95 % of designated SNM users trained and ≥ 10 trainers certified.

• ≥ 95% of technical support tickets are resolved within 24 hours of submission.

• User satisfaction score of ≥ 90% maintained based on quarterly surveys.

• 100% compliance on periodic vulnerability scan with all security issues remediated per GoP cybersecurity standards.

6.3. Post-Deployment Help Desk Support

The contractor shall provide bilingual Help Desk Support to SNM end users and GoP stakeholders throughout the period of performance. The following requirement governs Help Desk staffing and operation:

• Provide Mid-Level Help Support staffed with personnel proficient in both English and Spanish to ensure effective communication with SNM end users and GoP stakeholders throughout the period of performance.

• Respond to and resolve end-user support requests submitted in either English or Spanish within the timeframe established in section 6.2 Performance Standards.

• Maintain bilingual support documentation, including troubleshooting guides and user-facing communication in both English and Spanish.

• Coordinate with SNM designated points of contact to escalate unresolved status in Spanish.

• Document support tickets, resolution times, and outcome in the monthly contractor performance report submitted to the COR