Solicitation - CSOP Focus Area - Security (70RDA126R00000004).pdf

LIGHTWEIGHT DEVICE SECURITY AGENT FOR OT, IOT,

AND EDGE ENVIRONMENTS

COMMERCIAL SOLUTIONS OPENING (CSO)

GENERAL SOLICITATION

70RDA126R00000004

DEPARTMENT OF HOMELAND SECURITY (DHS)

JANUARY 16, 2026

Commercial Solutions Opening (CSO) for Lightweight Device Security Agent for OT, IoT, and Edge Environments

CSO Solicitation No. 70RDA126R00000004 Page 2 of 17

GENERAL SOLICITATION

1.0 GENERAL INFORMATION

1.1 Background

The Department of Homeland Security (DHS) was established in 2002, combining 22 different federal departments and agencies into a unified, integrated Cabinet agency. The Management Directorate is the Department’s operational support entity that supports asset management and logistics, budget and finance, human resources, information technology, procurement, and security functions.

The Department of Homeland Security lines of business house data and information across hundreds of disparate systems and tools that are siloed. One of the Management Directorate’s top priorities is standing up and maintaining a centralized information sharing environment with fully integrated and automated technical, oversight, governance, and business processes.

The National Defense Authorization Act for Fiscal Year 2017, Title VIII, § 880 (Pub. L. 114-328), Pilot Programs for Authority to Acquire Innovative Commercial Items Using General Solicitation Competitive Procedures, authorizes the Department of Homeland Security (DHS) to carry out a “commercial solutions opening” (CSO) to competitively procure innovative commercial items. The CSO is a merit-based solution selection strategy for DHS to acquire innovative commercial items through the use of general solicitation competitive procedures and the award of a contract.

“Innovative”, within the meaning of this statute, is any new technology, process, or method, including research and development; or any new application of an existing technology, process, or method.

“Commercial item” has the same meaning as commercial item under Federal Acquisition Regulation (FAR) 2.101, which includes certain commercial services.

2.0 SCOPE

The Department of Homeland Security requires a commercially available, lightweight security agent capable of providing device-level threat detection and alerting across Operational Technology (OT), Internet of Things (IoT), and edge environments, while remaining compatible with broader enterprise IT systems. This capability will be procured using the Commercial Solutions Offering (CSO) authority to enable rapid acquisition of innovative, field-ready security technologies that address evolving cyber threats in operational environments.

3.0 PROBLEM STATEMENT

OT and IoT systems are integral to DHS missions and national critical infrastructure, yet they present unique cybersecurity challenges:

• Devices are often resource-constrained and cannot support traditional endpoint security agents.

• Many systems require continuous uptime and cannot tolerate intrusive monitoring or frequent updates.

• Network connectivity may be intermittent or restricted.

CSO Solicitation No. 70RDA126R00000004 Page 3 of 17

• Existing enterprise security tooling provides limited visibility into device-level threats in these environments.

The Department requires a solution that can operate at the device level, provide early and reliable detection of malicious activity, and integrate into existing security operations without disrupting mission or safety-critical functions.

4.0 Capability Overview

The required solution shall consist of a lightweight security agent that can be deployed directly on devices across OT, IoT, and edge environments and optionally extended to broader IT systems for consistency and coverage.

The agent must be designed for environments where traditional Endpoint Detection and Response (EDR) or endpoint protection platforms are impractical or infeasible.

5.0 FUNCTIONAL CAPABILITY REQUIREMENTS

5.1 Device-Level Threat Detection

The solution shall:

• Detect malicious software or execution attempts directly on the device.

• Identify threats at or near the point of entry, not solely through post-execution behavioral analysis.

• Operate without continuous reliance on cloud-based analysis.

• Provide deterministic or explainable detection outcomes suitable for high-trust environments.

5.2 Lightweight Agent Architecture

The agent shall:

• Maintain a minimal resource footprint appropriate for embedded and industrial systems.

• Operate without kernel modification or invasive system hooks.

• Avoid degrading device performance or interfering with real-time operations.

• Support long-lived deployment with minimal update requirements.

5.3 OT and IoT Compatibility

• Support deployment across a range of OT and IoT devices, including embedded systems and industrial controllers.

• Function in segmented, restricted, or intermittently connected environments.

• Be deployable without requiring changes to existing operational workflows.

5.4 Applicability to Broader IT Environments

CSO Solicitation No. 70RDA126R00000004 Page 4 of 17

• Be usable on conventional IT systems where appropriate, enabling consistent detection coverage across environments.

• Integrate with enterprise security operations without requiring a separate management stack.

• Complement, not replace, existing endpoint and network security tools.

5.5 Alerting and Integration Requirements

5.5.1 Actionable Alerting

• Generate alerts that are actionable and operationally meaningful.

• Minimize false positives to avoid alert fatigue.

• Provide sufficient context to support triage by cybersecurity personnel without specialized OT expertise.

5.5.2 Integration with Security Operations

The solution shall:

• Integrate with existing DHS SOC tooling, including SIEM and SOAR platforms.

• Support standardized APIs or data formats for alert ingestion.

• Enable correlation with other cybersecurity telemetry.

5.6 Deployment and Management

The solution shall:

• Support scalable deployment across heterogeneous device populations.

• Enable centralized management and policy configuration.

• Allow staged or selective rollout to minimize operational risk.

5.7 Resilience and Reliability

The solution shall:

• Continue detection and alerting during network outages or degraded connectivity.

• Preserve local detection capabilities independent of centralized services.

• Resist tampering or disablement by compromised devices.

5.8 Security and Trust Requirements

The solution shall:

• Comply with DHS cybersecurity and supply chain risk management requirements.

• Be suitable for deployment in sensitive operational environments.

CSO Solicitation No. 70RDA126R00000004 Page 5 of 17

• Provide transparency into detection mechanisms sufficient for risk assessment.

5.9 CSO-Specific Considerations

Proposed solutions must:

• Be commercially available or near-commercial maturity.

• Require minimal customization to deploy in DHS environments.

• Demonstrate a clear path to rapid fielding and operational use.

• Support expansion to CISA-facilitated deployments with critical infrastructure partners.

6.0 EVALUATION FOCUS AREAS

Proposals will be evaluated based on:

• Effectiveness of device-level threat detection in OT/IoT environments.

• Agent footprint and operational impact.

• Integration with existing security operations.

• Scalability and manageability.

• Maturity and readiness for rapid deployment under CSO authority.

7.0 STRATEGIC INTENT

This requirement reflects DHS’s focus on securing operational and edge environments as a core element of homeland security. The Department is prioritizing solutions that acknowledge the realities of OT and IoT systems and deliver practical, deployable security without imposing enterprise IT assumptions where they do not fit.

8.0 PERIOD of PEFORMANCE

The period of performance is one, one-year base period and one, one-year option period.

9.0 PLACE of PERFORMANCE

Work will be performed at designated government facilities within the National Capital Region

(NCR).

10.0 ANTICIPATED DELIVERABLES

To be determined upon acceptance of a solution.

11.0 PROCUREMENT AUTHORITY

The Government contemplates use of a peer review process to select the awardee(s) for this effort, using the Commercial Solutions Opening Pilot (CSO) Program authority granted to DHS under the

CSO Solicitation No. 70RDA126R00000004 Page 6 of 17

National Defense Authorization Act for Fiscal Year 2017, Title VIII, § 880 (Pub. L. 114-328), Pilot Programs for Authority to Acquire Innovative Commercial Items Using General Solicitation Competitive Procedures.

12.0 EVALUATION/VENDOR ENGAGEMENT

12.1 General

Pursuant to the authority of NDAA 880, DHS has been vested with procedural discretion to make multiple contract awards resulting from the evaluation and determination of viable technology solutions. Proposals will be evaluated on their individual merits rather than on a comparative basis.

Besides the criterion described in section 12.3 below, the concept paper responses must clearly demonstrate how the commercial item is offered in an innovative manner. Within the meaning of the statute, Innovative is defined as:

any new technology, process, or method, including research and development, or any new application of an existing technology, process, or method.

The concept papers will be evaluated against the evaluation criteria. Each concept paper submitted may be evaluated against the evaluation criteria separately and need not be evaluated against other concept paper responses submitted by other Offerors. More than one concept paper may be accepted.

The Government reserves the right to request interview-style oral presentations or additional written information, if applicable, from one or more Offerors.

12.2 Submission Instructions

The Government is interested in receiving proposals that provide a lightweight device security agent for OT, IOT, and EDGE environments. The Focus Area Topic under this CSO is Security. The window for proposal submissions in the Security area closes on Friday January 30, 2026 @ 5:00 p.m. eastern time. The Government will review responses as they are submitted and may award at any time.

12.3 Evaluation Criteria

The following evaluation criteria will be used by the peer review team to assess the merit of all proposals. The proposals shall not exceed 2 pages. The evaluation criteria are listed below in order of importance from top to bottom.

Criterion I: Product Capability: Solutions will be evaluated based on their effectiveness in device-level threat detection across OT/IoT environments, minimal resource footprint, seamless integration with existing security operations, scalability, resilience, compliance with DHS requirements, and readiness for rapid deployment. The assessment of whether the proposed commercial product or service is innovative within the meaning of the statute will be conducted.

Criterion II: Price – Whether the price reflects 1) a sufficient understanding of the technical goals and the objectives; 2) is consistent with the offeror’s technical approach; and 3) is based on realistic assumptions.

CSO Solicitation No. 70RDA126R00000004 Page 7 of 17

The Offeror must complete (Attachment 1) and submit the total price to complete the project, utilizing a price template (Attachment 1), and shall provide any other data or supporting information that the parties agree is necessary for the determination of a fair and reasonable price.

13.0 EVALUATION AND NOTIFICATION TO OFFERORS

Proposals will be evaluated in accordance with the evaluation criteria. After evaluating the Offeror’s responses, DHS will notify the Offeror whether they are being considered for award. In addition, Offerors will be notified if they were not selected for award. Offerors not selected for award may request, within five (5) calendar days of notification of non-selection, feedback regarding the technical review findings of their submitted responses.

14.0 PEER REVIEW PANEL

A Peer Review Panel will be used to evaluate the concept papers submitted in response to this solicitation. The Peer Review Panel will consist of U.S. Government employees.

15.0 GENERAL

The cost of preparing proposals in response to this Request is not considered a direct charge to any resulting CSO contract award or any other contract. Proposal preparation costs are not recoverable.

Proposals should be limited to a page count of 2 letter size pages (8.5” x 11”), with a font type of times new roman and a minimum font size of 12 pt.

16.0 CONTRACT TYPE

It is intended that any resulting contract from this solicitation shall be Firm Fixed Price.

17.0 OPTIONS

DHS may establish options for future purchasing requirements. Options shall be executed in accordance with terms established in the resulting CSO contract.

18.0 PROPRIETARY MARKINGS

Offerors must mark any pages of the concept paper that contain business plans, technical information, pricing or other business sensitive information as proprietary information, which the Government agrees to safeguard.

To ensure that sensitive data is appropriately marked by the Offeror, include the following sentences on the cover page: “This concept paper includes data that shall not be disclosed outside the Government, except to non-Government personnel for evaluation purposes, and shall not be duplicated, used or disclosed – in whole or in part – for any purpose other than to evaluate this submission. If, however, an agreement is awarded to this Company as a result of – or in connection with – the submission of this data, the Government shall have the right to duplicate, use, or disclose

CSO Solicitation No. 70RDA126R00000004 Page 8 of 17 the data to the extent agreed upon by both parties in the resulting agreement. The data subject to this restriction are contained in sheets [insert numbers or other identification of sheets].”

19.0 PROTESTS TO THE AGENCY

19.1 Protests under CSO awards shall be adjudicated as prescribed under DHS Agency-Level protest procedures.

Protest submissions shall be sent via e-mail to the Contracting Officer, Tanya Hill at Tanya.Hill@hq.dhs.gov and the Contracting Officer, Tracy Miller at Tracy.Miller@hq.dhs.gov

19.2 Offerors may seek assistance from the agency Advocate for Competition. The Department

Advocate for Competition and Procuring Activity Advocates for Competition are shown on the Doing Business with DHS page, and is accessible at:

https://www.dhs.gov/competition-advocates-and-task-order-and-delivery-order-ombudsman.

20.0 DHS CYBER HYGIENE CLAUSES

DHS will include specific Cyber Hygiene Clauses based on the proposed solutions in all resulting awards.

mailto:Tanya.Hill@hq.dhs.gov mailto:Tracy.Miller@hq.dhs.gov

CSO Solicitation No. 70RDA126R00000004 Page 9 of 17

TERMS AND CONDITIONS

Clauses that may be incorporated at Award

A. Required Terms related to IT Security Requirements and Statutory Prohibitions.

1. Security requirements for contractor access to unclassified facilities, information resources, classified information, and controlled unclassified information. The clauses required by HSAR 3004.470-4 and HSAR Class Deviation 15-01, Revision 1, Safeguarding of Controlled Unclassified Information, as applicable, and ensure solicitations and awards identify the applicable information security requirements as well as documentation contractor employees must complete for determining contractor suitability may be included.

2. Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by

Kaspersky Lab Covered Entities. Section 1634 of the FY 2018 NDAA contains a prohibition related to Kaspersky Lab covered articles, as defined at FAR Clause 52.204-23, and DHS FAR Class Deviation 20-05, Rev 3 (JUL 2024) (or successor policy) (required in all solicitations and contracts). Section 1634 prohibits the contractor from providing and using any Kaspersky Lab covered article on or after October 2018 (see FAR 4.20).

3. Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment

(see FAR 4.21). Section 889 of the FY 2019 NDAA contains prohibitions related to certain covered telecommunications equipment or services, as defined at FAR Clause 52.204-25 and DHS FAR Class Deviation 20-05, Rev 3 (DEC 2020) (or successor policy).

a. Section 889(a)(1)(A) prohibits an agency from procuring or obtaining, or extending or renewing a contract to procure or obtain any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition on procuring or obtaining covered telecommunications extends to CSO contracts.

b. Section 889(a)(1)(B) prohibits an agency from entering into a contract (or extending or renewing a contract) with an entity that uses any equipment, system, or service that uses covered telecommunication equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Because a CSO contract may result in the delivery of goods or services that enter the federal supply chain, the section 889 (a)(1)(B) prohibition will likely apply. COs shall examine and consult with OGC to determine if the section 889(a)(1)(B) prohibition is applicable to a particular CSO.

4. The Federal Acquisition Supply Chain Security Act (FASCSA) of 2018 prohibits agencies from procuring, obtaining, extending or renewing a contract to procure or obtain, any covered article, or any products or services produced or provided by a source, including contractor use of covered articles or sources, if that prohibition is established by an applicable FASCSA order issued by the Director of National Intelligence, Secretary of Defense, or Secretary of Homeland Security (see FAR Subpart 4.23 and HSAM Subchapter 3004.23).

CSO Solicitation No. 70RDA126R00000004 Page 10 of 17

5. Prohibition on a ByteDance covered application. Section 102 of Division R of the Consolidated Appropriations Act, 2023 (Pub. L. 117-328), the No TikTok on Government Devices Act, and its implementing guidance under Office of Management and Budget (OMB) Memorandum M-23-13, dated February 27, 2023, “No TikTok on Government Devices” Implementation Guidance, collectively prohibit the presence or use of a covered application on executive agency information technology, including certain equipment used by Federal contractors. The CSO Contractor is prohibited from having or using a covered application on any information technology owned or managed by the Government, or on any information technology used or provided by the CSO Contractor under the CSO contract, including equipment provided by the Contractor’s employees unless the Contractor received a written notice that an exception has been granted in accordance with OMB Memorandum M-23-13.

The CSO Contractor is required to insert the substance of the clause, in all subcontracts, including subcontracts for the acquisition of commercial products or commercial services.

Applicable definitions are:

a. Covered application means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

b. Information technology, as defined in 40 U.S.C. 11101(6) means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use of that equipment; or the use of that equipment to a significant extent in the performance of a service or the furnishing of a product.

Information technology includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but does not include any equipment acquired by a CSO Federal contractor incidental to a CSO Federal contract.

B. Data Rights

The United States Government (USG) have unlimited rights in all data, computer databases, computer software, as defined in FAR 52.227-14, developed during the performance of this task order, including manuals or instructional and training material for installation, operation, or routine maintenance and repair of items, components, or processes delivered or furnished for use. Additionally, all deliverables produced under this contract shall meet form, fit, and function requirements defined in FAR 52.227-

14. The USG have the right to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so.

CSO Solicitation No. 70RDA126R00000004 Page 11 of 17

C. Advance Payments

The CSO Contract cannot provide for advance payments. Advance payments are prohibited unless a statute specifically authorizes the advance payment. The CSO statute does not authorize advance payments.

D. Federal Acquisition Regulation (FAR) Clauses

FAR Clauses/Provisions 52.203-16 Preventing Personal Conflicts of Interest JUN 2020 52.203-17 Contractor Employee Whistleblower Rights and Requirement to

Inform Employee of Whistleblower Rights

NOV 2023

52.222-50 Combating Trafficking in Persons (DHS FAR Deviation 26-10) NOV 2025 52.222-54 Employment Eligibility Verification (DHS FAR Deviation 26-10) NOV 2025

FAR 52.217-8 Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days of contract expiration.

(End of clause)

If needed, the Government intends to exercise the option or options under FAR 52.217-8 without further competition or need for justification for other than full or open competition [or limited source justification or sole source justification]. For purposes of evaluation, the potential need to exercise the option under FAR 52.217-8 to extend the period of contract performance for the maximum period of six (6) months beyond the last option period will be considered the same for all offerors. In considering the price of the base period and any option periods, the Government will consider that if the extension of service clause (FAR 52.217-8) is exercised, it will be at the exact same rates and terms, other than length of performance, as the base or option period being extended. The Government will determine whether the price, inclusive of all options (including the options available under FAR 52.217-8), is fair and reasonable, and whether the price of the base period and all option periods (including the option(s) represented by FAR 52.217-8), in combination with the other evaluation factors specified in the solicitation, represents the best value to the Government.

CSO Solicitation No. 70RDA126R00000004 Page 12 of 17

FAR 52.217-9 Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 5 days of contract expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 24 months.

CSO Solicitation No. 70RDA126R00000004 Page 13 of 17

ADDITIONAL TERMS AND CONDITIONS

Examples likely to be incorporated into resultant contract.

1.0 DEFINITIONS

Administrative Modification: Changes that do not affect the substantive rights of the parties, such as changes in the paying office, appropriations errors and typographical errors.

Head of the Contracting Activity (HCA) means the official delegated by the Chief Procurement Officer and the Senior Procurement Executive who is responsible for managing a Component’s procurement.

Government refers to the United States Government, including the DHS.

Parties, as used herein, shall refer to [CONTRACTOR NAME] and the United States of America, hereinafter called the Government, represented by DHS.

Contracting Officer (CO): Individual who can bind the Government to a contract within the scope of the authority delegated to the CO by the HCA.

2.0 ORDER OF PRECEDENCE

In the event of a conflict between the terms of this contract and other governing documents, the conflict shall be resolved by giving precedence in descending order as follows:

(1) The clauses of this contract.

(2) Any attachments to this contract.

3.0 MODIFICATIONS

A. Modifications to the contract may be proposed by either party. Only a CO has the authority to modify this contract on behalf of the Government.

B. The CO may unilaterally issue administrative modifications to the contract.

4.0 SUSPENSION AND TERMINATION PROCEDURES

A. The Government reserves the right to terminate the CSO for cause or for convenience of the

Government.

(1) The CO may suspend performance of this contract at any time by providing written notice to the contractor. Upon receipt of such a notice, the contractor shall cease performance until the CO either (1) withdraws the suspension of work in writing or (2) notifies the contractor in writing of his or her intention to terminate this contract whether for convenience of the Government or for cause. If the suspension results in the incurrence of costs that the contractor was unable avoid, the contractor may request an equitable adjustment in writing to the CO.

CSO Solicitation No. 70RDA126R00000004 Page 14 of 17

(2) If the CO fails to provide further instructions within sixty (60) days from the notice to suspend work, this contract will be considered terminated for the convenience of the Government, and the contractor will cooperate with the Government with closing out his contract.

(3) The CO may terminate this contract in whole or in part for the convenience of the Government at any time by written notice. The contractor shall then cease further performance and take all reasonable measures to minimize any further incurrence of costs.

(4) If the contractor fails to comply with the terms and conditions of this contract, the CO will provide written notice of breach or deficiency to the contractor and will provide the contractor an opportunity to explain or correct the breach or deficiency within thirty (30) days from receipt of notice. As a result of any response by the contractor, the CO may (1) proceed with the termination for cause; (2) convert the termination to one for the convenience of the Government; or (3) direct the contractor to continue performance.

B. This contract may be terminated by the CO at the request of the contractor under the following conditions:

(1) The contractor shall notify the CO at least 30 days prior to the termination requested effective date.

(2) The notification shall state the reasons for the termination, the requested effective date, and, if a partial termination, the portion to be terminated. If the CO determines, in the case of a partial termination, that the reduced or modified portion of the award will not accomplish the purpose for which the award was made, the CO may terminate the award in its entirety.

C. The Government and the contractor will negotiate in good faith an equitable reimbursement for work performed for which the contractor has not received payment.

5.0 PAYMENTS

The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727).

5.1 Payment and Invoice Instructions

An invoice must include—

1. Contract Number

2. Invoice Number

3. A description of the innovative commercial item(s)

4. Quantity received

5. The period of performance covered by the invoice

6. Terms of Payment

7. Payment Office

CSO Solicitation No. 70RDA126R00000004 Page 15 of 17

8. Amount claimed

9. Bank Account of Payee:

10. Bank Name:

11. Address:

12. Routing Transit Number:

13. Depositor Account Title:

14. Depositor Number:

The Contractor shall submit the invoice electronically to the address below:

ATTN: InvoiceMGT.Consolidation / E-mail: InvoiceMGT.Consolidation @ice.dhs.gov

Simultaneously provide an electronic copy of the invoice to the following individuals at the addresses below:

a) ATTN: Office of Procurement Operations/Tanya M. Hill (Contract Specialist) E-mail: Tanya.Hill@hq.dhs.gov

b) ATTN: Office of Procurement Operations/Tracy Miller (Contracting Officer) E-mail: Tracy.Miller@hq.dhs.gov

c) ATTN: Office of Chief Procurement Officer/TBD (COR) E-mail: TBD

The Contractor shall prepare and submit a sufficient and procurement regulatory compliant invoice and receiving report for technical certification of inspection/acceptance of services and approval for payment.

The Contractor shall attach back up information to the invoices and receiving reports substantiating all costs for services performed. The receiving agency’s written or electronic acceptance by the COR and date of acceptance shall be included as part of the backup documentation.

6.0 RETENTION AND ACCESS TO RECORDS

The contractor shall retain and maintain all records of performance, whether technical, business, and financial or other under this contract for a period of three years after the completion of this contract.

Those records shall be maintained in a manner that will provide easy access, use, and search by representatives of the CO or the Government Accountability Office.

7.0 SYSTEM FOR AWARD MANAGEMENT AND UNIVERSAL IDENTIFIER

REQUIREMENTS

A. Requirement for System for Award Management (SAM): The contractor must maintain the currency of the contractor’s information in the SAM until the contractor submits the final financial report required under this award or receive the final payment, whichever is later. This requires that the contractor review and update the information at least annually after the initial mailto:Tanya.Hill@hq.dhs.gov mailto:Tracy.Miller@hq.dhs.gov

CSO Solicitation No. 70RDA126R00000004 Page 16 of 17 registration, and more frequently if required by changes in the contractor’s information or another award term.

B. Requirement for Unique Entity Identifier (UEI) number7: If Contractor is authorized to make subawards under this award, Contractor: 7 “Unique entity identifier” (UEI) means the nine-digit number established and assigned by the General Services Administration (GSA) to uniquely identify business entities.

(1) Must notify potential subcontractors that no entity may receive a subcontract from

Contractor unless the entity has provided its UEI number to Contractor.

(2) May not make a subcontract to an entity unless the entity has provided its UEI number to Contractor.

(3) Contractor's financial records, supporting documents, statistical records, and all other records pertinent to an award shall be retained by the contractor for the term of the contract. The CO shall be allowed access to these records.

8.0 FOREIGN NATIONALS

A. For purposes of this clause, foreign nationals are all persons not citizens of, not nationals of, nor immigrant aliens to, the United States of America. Nothing in this clause is intended to waive any requirements imposed by any other U.S. Government agency with respect to employment of foreign nationals or export control.

B. The contractor acknowledges that the technical data generated under this contract may be subject to export control, including disclosure to foreign nationals, whether such data is provided orally or in written form.

C. The contractor agrees to obtain written approval from the CO before assigning any foreign national to perform work under this contract or before granting foreign nationals access to data related to this contract, whether such data is provided by the Government or generated under this contract.

9.0 PROTECTION OF INFORMATION

Contractor access to unclassified but Security Sensitive Information may be required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with DHS MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information. The Contractor shall ensure that all Contractor personnel having access to business or procurement sensitive information sign a non-disclosure agreement, DHS Form 11000-6. Contractor shall protect personal identifiable information (PII) under the Privacy Act Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policies and regulations.

CSO Solicitation No. 70RDA126R00000004 Page 17 of 17

10.0 PROTECTED CRITICAL INFRASTRUCTURE INFORMATION

Non-Disclosure of Protected Critical Infrastructure Information (CII)

The parties have agreed to implement a Rule promulgating new regulations at Title 6 Code of Federal Regulations Section 29.8(c) to govern procedures for handling critical infrastructure information. The regulations detailed in the Rule, which was effective upon publication pursuant to Section 808 of the Congressional Review Act, were promulgated pursuant to Title II, Section 214 of the Homeland Security Act of 2002, known as the “Critical Infrastructure Information Act of 2002” (CII Act).

The Contractor shall not request, obtain, maintain, or use Protected CII without a prior written certification from the Protected CII Program Manager or a Protected CII Officer that conforms to the requirements of Section 29.8(c) of the regulations in the Rule.

The Contractor shall comply with all requirements of the Protected CII (PCII) Program set out in the CII Act, in the implementing regulations published in the Rule, and in the PCII Procedures Manual, as they may be amended from time to time and shall safeguard Protected CII in accordance with the procedures contained therein.

The Contractor shall ensure that each of its employees, consultants, and sub-Contractors who work on the PCII Program have executed Non-Disclosure Agreements (NDAs) in a form prescribed by the PCII Program Manager. The Contractor shall ensure that each of its employees, consultants and sub- Contractors has executed a NDA and agrees that none of its employees, consultants or sub-Contractors will be given access to Protected CII without having previously executed a NDA.

11.0 CONTRACTING OFFICER’S AUTHORITY

The Contracting Officer (CO) is the only person authorized to approve changes in any of the requirements of this contract. In the event the Contractor effects any changes at the direction of any person other than the Contracting Officer, the changes will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. The Contracting Officer shall be the only individual authorized to accept nonconforming work, waive any requirement of the contract, or to modify any term or Government funds. No cost chargeable to the proposed contract can be incurred before receipt of a fully executed contract or specific authorization from the Contracting Officer.