Threat Mitigation and Monitoring Services - PWS (Final Edits 5-28-2025).pdf

1 | P a g e

DEPARTMENT OF HOMELAND SECURITY (DHS)

U.S. IMMIGRATION AND CUSTOMS ENFORCEMENT (ICE)

OFFICE OF PROFESSIONAL RESPONSIBILITY (OPR)

THREAT MITIGATION AND MONITORING SERVICES

PERFORMANCE WORK STATEMENT

Date 05/28/2025

1. Background

ICE’s mission is to promote homeland security and public safety through the criminal and civil enforcement of approximately 400 federal laws governing border control, customs, trade and immigration.

Over the last several years, ICE has experienced an increased level of external threat activity directed towards its Senior Leaders, personnel and facilities. Much of this threat activity originates from social media and online postings and has since expanded to physical attacks on ICE facilities and the homes of ICE employees. To prevent adversaries from successfully targeting ICE Senior Leaders, personnel and facilities, ICE requires real-time threat mitigation and monitoring services, vulnerability assessments, and proactive threat monitoring services.

2. Period of Performance

This requirement includes one 12-month base period followed by two 12-month option periods. All option periods under the contract will be exercised at the Government’s sole discretion.

3. Place of Performance

Contractor employees shall perform work at the Contractor’s normal place of employment. Interaction with the Government shall take place via email, phone, and other electronic means.

4. Government Furnished Equipment

The Contractor shall furnish all other facilities, equipment, and services required in the performance of this contract. The Contractor is responsible for taking the actions necessary to protect supplies, material, and equipment and personal property of employees from loss, damage, or theft.

5. General Requirements

This is a non-personal services contract as defined by FAR Subpart 37.101. Contactor services are not considered to be inherently governmental in nature, as defined by Federal Acquisition Regulation (FAR) Subpart 7.5. Contractor personnel rendering services under this order are not subject to direct, day to day supervision or control by Government personnel. The Contractor will be responsible for the supervision of the contractor employees at all duty locations. The Contractor is expected to work

2 | P a g e independently to accomplish the requirements of this order. The Contractor must generate reports and other deliverables as specified in this Performance Work Statement (PWS). The Government will neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks or prepare work schedules for individual contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the Contractor believes that any actions constitute or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately.

The Contractor shall provide all necessary personnel, supervision, management, equipment, materials and services, except for those provided by the Government, in support of ICE’s mission to protect ICE Senior Leaders, personnel and facilities via internet-based threat mitigation and monitoring services.

These efforts include conducting vulnerability assessments and proactive threat monitoring. The Contractor is expected to utilize existing solutions in order to provide these services.

Minimum services include full data aggregation to provide proactive threat monitoring and vulnerability assessments stipulated in the following Task in Section 6. The Contractor will utilize the following Tier Level categories to identify the minimum deliverable and reporting requirements as stipulated in Sections 6 and 9.

Tier Level Tier Level Coverage Tier Level Description

Tier 1 ICE Senior Leaders

(Minimum 12 Targets)

Tier 1 provides detailed and tailored executive open-source Vulnerability Assessments and Proactive Threat Monitoring for ICE Senior Leaders, and, as requested by ICE OPR, their immediate family members.

Tier 2

General ICE Population and Facilities

(Minimum 100 Targets)

Tier 2 provides detailed open-source Vulnerability Assessments and Proactive Threat Monitoring for threats towards ICE employees and facilities in general. Tier 2 will also provide for the assessment and monitoring of threats and/or disruptions to general ICE operations.

Tier 3

Specific ICE Employees, Operations and Facilities as requested by ICE OPR (Minimum 15 Targets)

Tier 3 provides detailed open-source Vulnerability Assessments and Proactive Threat Monitoring for threats against designated ICE employees, their immediate family members and facilities on an AD-HOC basis. Tier 3 will also provide for the assessment and monitoring of threats and/or disruptions to specific ICE operations as requested.

3 | P a g e

The Government will provide a list of entities that require vulnerability assessments and threat monitoring as applicable for each tier level. At the request of OPR, the Contractor will adjust for the addition and removal of each Tier category from the monitoring list.

6. Specific Requirements:

6.1 Tasks

6.1.1. Task 1 - Vulnerability Assessments

Evaluate and conduct Tier 1 vulnerability assessments using proprietary and publicly available electronic information associated or regarding designated ICE Senior Leaders to identify threats, the exploitation of Protection Plans, and other risk factors. This assessment will be provided within thirty (30) days from the award of the contract and monthly thereafter.

Evaluate and conduct Tier 2 vulnerability assessments using proprietary and publicly available electronic information associated or regarding threats to the general ICE population and facilities, as well as threats and/or disruptions to ICE operations. This assessment will be provided within five (5) business days of a request from ICE OPR.

Evaluate and conduct Tier 3 vulnerability assessments using proprietary and publicly available electronic information associated or regarding designated ICE personnel, facilities and operations. These assessments will be provided on an ADHOC basis as requested by

ICE OPR.

Assessments and/or searches shall involve real-time aggregating open-source information using unique identifiers for related association, enhanced data analytics, and analytic reporting on sentiment and other related factors.

Assessments will include queries to determine what personally identifiable information is publicly available about those in categories Tier 1, 2 and 3 (phone numbers, addresses, relatives, etc.).

Conduct analytics by utilizing social and behavioral sciences to multiple data sets to locate dangerous individuals posing a possible threat to categories Tier 1, 2 and 3.

Conduct real-time Deep Web and Dark Web searches to identify possible threats against categories Tier 1, 2 and 3.

Conduct open-source searches using key-terms and geolocation properties relative or associated with categories Tier 1, 2 and 3.

Provide digital erasure service to remove online information of Tier 1 personnel.

Supply ADHOC vulnerability assessments as requested by ICE OPR.

Supply assessments of locations and facilities as requested by ICE OPR.

6.1.2. Task 2 - Proactive Threat Monitoring & Report Requirements

6.1.2(a) Threat Monitoring Requirements

Provide a secure and proactive threat monitoring program that contains automatic alerts.

Provide monitoring and analysis of behavioral and social media sentiment (i.e. positive, neutral, and negative) based on a period of time (i.e., day, week, month-long period).

Upon system outages, be able to immediately recover complete searches of any lost or potentially lost threat information.

4 | P a g e

Provide ADHOC searches and reporting when requested by ICE OPR.

Provide secondary and/or follow-on real-time strategic monitoring of previous adverse findings.

Capability to save search criteria post obtaining adverse results, ADHOC queries, or for future queries.

Ensure searches and/or inquiries on information and alerting procedures never reveal ICE’s affiliation.

Contractor will analyze individual(s) and/or organization(s) making threats. Analysis should include: 1) Previous social media activity which would indicate any additional threats to ICE; 2) Information which would indicate the individual(s) and/or the organization(s) making threats have a proclivity for violence; and 3) Information indicating a potential for carrying out a threat (such as postings depicting weapons, acts of violence, refences to acts of violence, to include empathy or affiliation with a group which has violent tendencies; references to violent acts; affections with violent acts; eluding to violent acts, etc.).

Monitor and analyze all social media activities (including foreign/dark web/deep web social media networks) in REAL-TIME.

Conduct correlation of users’ social media accounts.

Provides psychological profiles.

Geo-locate individuals beyond standard geo-tagging. The Government defines geo-locating as the ability to provide a specific location of the subject/threat actor.

Identify any person or group who has previously identified as having made a threat and individual(s) whose language that would potentially lead to violence directed towards ICE, Facilities, and employees has reached a level of concern.

Identify whether a user has deleted messages and provide content from deleted accounts and/or deleted messages.

Capability to identify threats by location.

Monitoring capabilities need to include the ability to proactively search for any threatening information and/or information which would suggest a potential disruption in ICE operations by location.

Ability to determine which websites were accessed by users prior to making a threat.

Leverage artificial intelligence (AI) powered data analytics with natural language processing (NLP), machine learning, and multilingual analysis to automate monitoring across the open web and social media, as well as deep and dark web environments.

Conduct open-source intelligence (OSINT) sentiment analysis, emotion, topics, frequency of posts, reverse image searches, and link analysis to uncover connections between threat actors, map networks, and assess risk levels.

Utilize facial recognition and geospatial tracking to identify threat actors, along with data capture tools that timestamp and archive online content, including social media posts and web pages.

Utilize digital forensics tools to recover deleted messages and extract insights from deleted accounts, ensuring no critical information is lost.

Leverage AI-enabled OSINT risk analytics to interpret threats appearing in the form of images, videos, written text, or digital network connections.

Leverage AI-enabled OSINT risk detection to deliver critical anticipatory threat intelligence, identifying threats and potential targets.

5 | P a g e

Maintain continuous situational awareness regarding threat actors targeting ICE facilities for physical attacks, vandalism, and/or insider threats.

Leverage AI to provide real time intelligence collection for threats against ICE Senior Leadership, ICE employees/contractors, and ICE operations through continuous monitoring of atmospherics, publicly available information, and potential vulnerabilities.

Leverage optical character recognition to collect pictures and videos that are responsive to threat terminology. Leverage AI to identify pictures and videos of Senior Leadership that are posted online in real time.

Maintain continuous situational awareness and reporting regarding ICE law enforcement sensitive, for official use only, private identifiable information, and/or classified information leaked to the public or any individual/entity who does not have authorization to possess the information.

6.1.2(b) Reporting Requirements Provide detailed daily, weekly, monthly and end of year/contract reporting, and ADHOC reporting on results with mitigating recommendations in Adobe PDF or Microsoft Office format. All daily, weekly, monthly and end of year/contract reports will be provided even when there is no reportable activity.

Provide ADHOC reports as requested by ICE OPR with the capability to adjust date ranges and identify threats by those made against ICE Senior Leaders, ICE employees, and facilities, as well as threat type.

Immediately notify ICE OPR via electronic means of imminent threats. For affected ICE Senior Leaders with protective services, threat notifications will also be made by automated text messages to assigned protection detail personnel.

All reports will include threat information in narrative form, including analytical summaries of identified threats and assessments.

All reports will contain statistical data in narrative form and will be depicted in graphs (bar charts, pie charts, etc.).

Statistical data provided in the reports should include information such as: 1) Total number of negative references to ICE found in social media during monitoring; 2) Total number of threats against Senior Leaders; 3) Total number of threats against ICE employees; 4) Total number of threats against ICE facilities/operations; 5) Trend analysis, such as the increase/decrease of threats for each of these categories during the requested period; and 6) Total number of threats by type.

Daily reports will contain a running total as to the number of social media provided by the vendor. Each daily report will break this number down by the daily number of social media posts provided for review by day and a running total for fiscal year to date (Beginning October 1st of one year and ending September 30th of the following year).

Daily reports will further break down the number of posts provided by platform (Reddit, YouTube, Facebook, News, X and other platforms). This breakdown will be included for the individual daily report and fiscal year running totals.

Reports will identify ICE Senior Leaders, ICE employees and facilities that have been repeatedly targeted.

Reports will provide all relevant information for threats identified by the contractor. This information shall include: 1) Screen renderings of threatening social media posts; 2) The real and social media identity of the threat originator; 3) Time, date and online platform

6 | P a g e through which the threat was made; and 4) Location and/or the identity of the ICE Senior Leader, ICE employee or facility identified in the threat.

Link analysis indicating individual may be associated with other potential threats/threat actors (narrative, charts & graphs).

If threatening information is identified and in a foreign language, the contractor will provide the threat as it appears and provide a translation of the threat in English.

6.2 Information Sources

The following information sources must be utilized to carry out the tasks listed above:

6.2.1. Data Sources (Required, but not limited to)

Open Source Information Portals Available Proprietary Sources Deep Web Content Dark Web Content IRC/Chat Message Boards Online Broadcasting Websites Mobilize

Public Email Groups and Discussion Forums

Social Media Sites USEnet Data Web Blogs World Wide Web Action Network

Public Records (Court records, police reports, DMV records, news reports, etc.)

6.2.2. Open Social Media Sources (Required, but not limited to)

Twitter/ X Facebook Foursquare Instagram Snapchat LinkedIn Pinterest Applicable Foreign Social Media

Sites WordPress

StumbleUpon Tagged YouTube Tumblr BlueSky Reddit Vine Camera Bitly Flickr

7. Constraints and Risks

7.1. Obtaining Information from Unrestricted Sources. When conducting social media searches, the Contractor may obtain information from publicly-accessible online sources and facilities under the same conditions they may obtain information from other sources generally open to the public. This principle applies to publicly-accessible sources located in foreign jurisdictions as well as those in the United States.

7.2. Accessing Restricted Sources. When conducting social media searches, the Contractor may not access restricted online sources or facilities.

5 | P a g e

7.3. Obtaining Identifying Information about Users or Networks. The Contractor may not use software tools, even those generally available as standard operating system software, to circumvent restrictions placed on system users.

7.4. Public Interaction. The Contractor may access publicly-available information only by reviewing posted information and may not interact with the individuals who posted the information.

7.5. International Issues. Unless gathering information from online facilities configured for public access, Contractor personnel conducting the required service or deliverables should use reasonable efforts to ascertain whether any pertinent computer system, data, witness, or subject is located in a foreign jurisdiction. Whenever an item or person is located abroad, contractor personnel shall follow ICE's policies and procedures in providing the required service or deliverables.

7.6. PII Safeguards. The contractor will protect personally identifiable information (PII) as required by the Privacy Act and DHS privacy policy.

7.7. Complete ATO and Ongoing security scans and remediation for High-Risk Sensitive contracts in accordance with HSAR Deviation 15-01.

8. Federal Law Enforcement Sensitive

The data provided or processed within ICE OPR shall be considered federal law enforcement sensitive, and, therefore, cannot be used to solicit or benefit other work by the Contractor. All records received, created, used, and maintained by the Contractor for this effort shall be protected as sensitive data, in accordance with government laws, to include the Federal Acquisition Regulation (FAR), Part 24, Protection of Privacy and Freedom of Information, and shall be returned and provided to the government upon contract completion. All reports created by the vendor shall be labeled “Law Enforcement Sensitive” at the top and bottom of each page in red.

All data created for government use and delivered to or falling under the legal control of the government are federal records and shall be managed in accordance with records management legislation as codified at 44 U.S.C. Chapters 21, 29, 31, and 33, the Freedom of Information Act (5 U.S.C. 552), and the Privacy Act (5 U.S.C. 552a), and shall be scheduled for disposition in accordance with 36 CFR 1228.

All contractor employees for this effort will also be required to sign a nondisclosure statement, Acknowledgement and Agreement Handling Sensitive Government Data and Other Government Property, and are subject to the security requirements of the PWS. This form will be signed prior to beginning work for this effort.

9. Deliverables:

Acceptance by the Government of satisfactory products/services will be made once all the terms and conditions of the contract are fulfilled including the following delivery requirements:

6 | P a g e

Deliverable

PWS

Reference Frequency Delivery

Tier 1 – Vulnerability Assessment

6.1.1

Within five (30) days of contract award Monthly (by the 1st calendar day of each month)

Gov’t POC via electronic means

Tier 2 – Vulnerability Assessment

6.1.1 Within five (5) days of request

Gov’t POC via electronic means

Tier 3 – Vulnerability Assessment

6.1.1 As requested

Gov’t POC via electronic means

Tier 1 - Threat Report 6.1.2 9.1

Daily (NLT 11:00 AM

EST)

Gov’t POC via electronic means

Tier 2 - Threat Report 6.1.2 9.1

Daily (NLT 11:00 AM

EST)

Gov’t POC via electronic means

Tier 3 - Threat Report 9.1 Daily (NLT 11:00 AM

EST)

Gov’t POC via electronic means

In-depth Monthly Vulnerability Assessment

9.3 Monthly (by the 1st calendar day of each month)

Gov’t POC via email/electronic means

Continuous monitoring and alerting on imminent threats (via electronic notification 24/7).

6.1.2 Immediately

Gov’t POC via electronic means (email, text message)

ADHOC Report 6.1.1 9.1 9.2

As needed – within 24 hours of request

Gov’t POC via electronic means

Invoice 9.4 Monthly (NLT the 15th calendar day of each month)

COR via Invoice Processing Platform (IPP)

Quality Control Plan 9.5 Within 15 business days of contract award

CO/COR via email

Transition Plan 9.6 Within 15 business days of contract award

CO/COR via email

9.1. Tiers 1, 2, 3 Threat Reports

The Contractor shall provide a daily report of identified threats. The Contractor shall curate all findings into two sections:

1. Threat Intelligence: This section shall include a daily risk assessment based on the day’s threat activity; a summary of post volume and change from previous period to provide contextual

7 | P a g e intelligence; a summary of key insights and identified threats, including the user platform, and language of the threat.

2. Social Media Overview: This section shall include a daily risk assessment based on the day’s threat activity; a summary of post volume and change from previous period to provide contextual intelligence; a summary of key insights and identified threats, including the user platform, and language of the threat.

Each report shall include screenshots of threatening posts and a summary of active hyperlinks to the source material. Each report shall be delivered to ICE daily by 11:00 AM EST.

9.2. Ad Hoc Reporting

The Contractor shall develop and provide ICE Ad Hoc reports with actionable intelligence on identified threats within a 24-hour period. Once a threat is identified, the Contractor shall review a user’s available open source and social media activity to aid location of the associated individual.

The Ad Hoc reports shall be generated based on ICE guidance and request.

1. The Contractor shall provide public records details on the individual, as available. These details include, but are not limited to: Full legal name, date of birth, any aliases, Social Security Number (SSN), probable address(es), any relevant recent address(es), phone numbers, e-mail, work affiliations, vehicle registration information, and any criminal legal history, The Contractor shall also provide a summary of the methodology used to determine the subjects identity.

2. The Contractor shall provide all available identifying information to aid ICE in identification in complete information is unavailable. These details can include, but are not limited to:

photograph, partial legal name, partial date of birth, possible city, possible work affiliations, possible school or university affiliation, and any identified possible family members or associates.

9.3. Monthly Vulnerability Assessment

The Contractor shall provide a monthly Vulnerability Assessment on all key identified ICE Personnel to mitigate threats to high-risk personnel. The Monthly Vulnerability Assessment shall provide a comprehensive understanding of an executive’s online exposure on social media, open-source public record aggregators, and other open sources so ICE personnel can limit such exposure and remove vulnerable information adversaries could use to target ICE personnel.

The contractor can collect, analyze, and report on the full collection of openly available information on an identified individual and his immediate family, including spouse and children, in the Monthly Vulnerability Assessment.

All Monthly Vulnerability Assessments shall include:

1. An executive summary of key findings and identified threats.

2. An overview of the executive’s social media presence collected of all social media platforms and open sources. The overview details the social media presence of the executive and includes the publicly available information used to connect the executive to his or her immediate family, 8 | P a g e including spouse and children, on social media and/or in open sources. Screenshots and hyperlinks (where available) of all relevant findings shall be included.

3. A summary of the open-source presence of the executive’s immediate family, including spouse and children. This summary details the analysis of open-source public records for identifying information such as relatives, address, and phone number; social media; and open sources for key identifying and/or contextual details on a person’s pattern of life.

4. An overview of any relevant open source a Deep Web and Dark Web exposure identified during research which adversaries could use to target ICE personnel or their families.

5. A comprehensive listing of all identified open-source exposures. This listing shall include, but not limited to; type (public records, social media, or open source), an indication of whether the site is active as of the assessment; the URL; details of the available information; details of any links to the executive under review and/or their immediate family; and details of any addresses or phone numbers listed on the source.

9.4. Monthly Invoices

The Contractor shall provide monthly invoices to the ICE Invoice Consolidation Office, CO, and COR for services completed within that calendar month. Invoices will separate and note costs per CLIN (Tier Level) for the billed Period of Performance (POP). POP dates for each monthly invoice shall begin with the first and end on the last date of that month.

9.4.1. Invoices shall be submitted no later than the 15th calendar day of the following month.

Should the 15th calendar day of the month fall on a Federal holiday or weekend, the invoice shall be delivered to the COR the following business day.

9.4.2. When using Standard Form 1034, Public Voucher for Purchases and Services Other Than Personal, the inclusive dates of delivery of services must only be for the period for which the incurred costs are being claimed.

9.4.3 All invoicing procedures will take place via the Invoice Processing Platform (IPP), located at www.IPP.gov. The Contractor must be registered www.IPP.gov. Registration on www.IPP.gov is required to receive payment. Invoices will not be accepted by any other method.

9.4.4. These invoice requirements are in addition to, not in place of, any invoice submission instructions provided by the CO at the time of award.

9.5. Quality Control

The Contractor will establish and maintain a complete Quality Control Plan (QCP). This plan will include expected services delivered, contractor procedures for review of delivered services, and other items that may have impact on the performance of this contract. The Contractor will submit their QCP within 15 business days of contract award. When changes are made to the QCP a revised plan will be submitted to the Government.

9.6 Transition Plan

The contractor shall provide a transition plan to show the transition procedures from the current provider of this service (if necessary) as well as the plan for transitioning out at the end of the period of performance. “Transitioning in” shall cover, but is not limited to, items such as implementation of

9 | P a g e processes to request reports, training, IT compliance and testing. The Contractor will submit their transition plan within 15 business days of contract award.

10. Personnel Requirements

The Contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The Contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. Personnel performing work under this requirement should possess previous law enforcement or intelligence analysis experience. Contractor personnel performing under this requirement must demonstrate and effectively utilize skill sets and competencies that result in the successful accomplishment of the objectives, tasks, and requirements outlined in the PWS.

While it is the Contractor’s responsibility to supervise its personnel, the Government, will require and ensure all contractor personnel have received the requisite Privacy training, and any other training deemed necessary to satisfy the mission and requirements of ICE. The delivery of said training will be determined by the Government, but may include online training via a link provided by the Government to contract employees, via virtual training, and/or in person training

The Contractor shall provide a point of contact responsible for coordinating work performance. The point of contact shall have full authority to act on behalf of the Contractor on all matters relating to the daily operation of this contract.

It is preferred to utilize contract employees that have previously been cleared by DHS and/or ICE;

however, it is not a requirement. The requirements for vetting contractor personnel are listed in Section 14 – Security Requirements.

11. Contract Administration & Management

The Contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The Contractor shall manage the timeliness, completeness, and quality of problem identification. The Contractor shall provide corrective action plans, proposal submittals and timely identification of issues. The Contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

The Contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The Contractor must maintain continuity between the support operations at OPR and the Contractor's corporate offices.

Overall coordination, final approval and authority for this project are the responsibility of the ICE OPR. The Contracting Officer will be the administrative point of contact at ICE Office of Acquisition Management for all official correspondence and information concerning this contract. Final acceptability or unacceptability of all deliverables and tasks performed by the Contractor is the responsibility of the Contracting Officer.

10 | P a g e

A Contracting Officer’s Representative (COR) will be identified for this effort. The COR will recommend acceptance of the deliverable products, but only after concurrence from Government on-site Subject Matter Experts (SMEs) that deliverables are complete and correct.

12. Auditing

The United States Government, DHS and ICE reserve the right to audit the Contractor’s equipment, tool and/or platform, as well as any equipment provided by the Government to the Contractor for the purposes of ensuring the contract is being performed in a manner that is consistent with the contract, with Privacy regulations, and any other regulation enforced by the Government. This can include allegations made against contract employees and the contractor in the performance of this contract.

The timing and frequency of these audits will be determined by the United States Government, DHS and ICE, but will more than likely occur on a monthly, quarterly and yearly basis.

13. Acronym List

AI Artificial Intelligence CO Contracting Officer COR Contracting Officer’s Representative DHS Department of Homeland Security HRI High Risk Indicators ICE Immigration and Customs Enforcement IPP Invoice Processing Platform NLP Natural Language Processing OPR Office of Professional Responsibility OSINT Open Source Intelligence POP Period of Performance PSD Personnel Security Division PWS Performance Work Statement QCP Quality Control Plan SME Subject Matter Expert

14. Security Requirements (Updated October 2024)

GENERAL

The United States Immigration and Customs Enforcement (ICE) has determined that performance of the tasks as described in this contract requires that the Contractor, subcontractor(s), vendor(s), etc.

(herein known as Contractor) have access to sensitive DHS information, and that the Contractor will adhere to the following.

PRELIMINARY FITNESS DETERMINATION

ICE will exercise full control over granting, denying, withholding or terminating unescorted government facility and/or sensitive Government information access for Contractor applicants/employees, based upon the results of a Fitness screening process. ICE may, as it deems

11 | P a g e appropriate, authorize and make a favorable expedited preliminary Fitness determination based on preliminary security checks. The preliminary Fitness determination will allow the Contractor employee to commence work temporarily prior to the completion of a Full Field Background Investigation. The granting of a favorable preliminary Fitness shall not be considered as assurance that a favorable final Fitness determination will follow as a result thereof. The granting of preliminary Fitness or final Fitness shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by ICE, at any time during the term of the contract. No employee of the Contractor shall be allowed to enter on duty and/or access sensitive information or systems without a favorable Fitness determination by the Office of Professional Responsibility (OPR), Personnel Security Division (PSD). No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable Fitness determination by OPR PSD. Contract employees are processed under DHS Instruction 121-01- 007-001, Revision 2, dated August 10, 2024, Personnel Security, Suitability and Fitness Program, dated June 14, 2017, or successor thereto; those having direct contact with Detainees will also have 6 CFR § 115.117 considerations made as part of the Fitness screening process. Sexual Abuse and Assault Prevention Standards implemented pursuant to Public Law 108-79 (Prison Rape Elimination Act (PREA) of 2003)).

BACKGROUND INVESTIGATIONS

Contractor employees (to include applicants, temporary, part-time and replacement employees) under the contract, needing access to sensitive information and/or ICE Detainees, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted.

Background investigations will be processed through OPR PSD. Contractor applicant/employees are nominated by a Contracting Officer Representative (COR) for consideration to support this contract via submission of the DHS Form 11000-25 and ICE Supplement to the DHS Form 11000-25 to the PSD. This contract shall submit the following security vetting documentation to OPR PSD, through the COR, within 10 days of notification of initiation of an Electronic Application (eAPP), or successor thereto, in the National Background Investigative Services (NBIS) automated on-line system:

1. Standard Form 85P (Standard Form 85PS (with supplement to 85P required for those with direct contact with detainees or armed positions)), “Questionnaire for Public Trust Positions,” or successor Personnel Vetting Questionnaire (PVQ) form completed online and archived by the Contractor applicant/employee in their NBIS eAPP account.

2. Signature Release Forms (Three total) generated by NBIS eAPP upon completion of

Questionnaire (e-signature recommended/acceptable). Completed online and archived by the Contractor applicant/employee in their NBIS eAPP account.

3. Electronic fingerprints taken at an approved facility OR two (2) SF 87 Fingerprint Cards

(current revision) sent to OPR PSD. Additional information regarding fingerprints will be sent to the Contractor applicant/employee from OPR PSD.

4. Optional Form 306 Declaration for Federal Employment. This document is sent as an attachment in an e-mail to the Contractor applicant/employee from OPR PSD.

12 | P a g e

5. Social Security Administration 89 form (SSA-89): Authorization for the Social Security Administration (SSA) to Release Social Security Number (SSN) Verification. This document is sent as an attachment in an e-mail to the Contractor applicant/employee from OPR PSD.

6. One additional document may be applicable if the Contractor applicant/employee was born abroad. If applicable, the document will be sent as an attachment in an e-mail to OPR PSD from the Contractor applicant/employee.

An adequate and current investigation is one where the investigation was favorably adjudicated within 5 years and not to exceed 7 years, meets the contract risk level requirement, and applicant has not had a break in service of more than two years. (Executive Order 13488 amended under Executive Order 13764/DHS Instruction 121-01-007Rev 2)

Required information for submission of security packet will be provided by OPR PSD at the time of award of the contract. Only complete packages will be accepted by OPR PSD as notified by the COR.

To ensure adequate background investigative coverage, Contractor applicants/employees must currently reside in the United States or its Territories. Additionally, Contractor applicants/employees are required to have resided within the United States or its Territories for three or more years out of the last five (ICE retains the right to deem a Contractor applicant/employee ineligible due to insufficient background coverage). This timeline is assessed based on the signature date of the standard form questionnaire submitted for the applied position. Contractor employees falling under the following situations may be exempt from the residency requirement: 1) work or worked for the U.S. Government in foreign countries in federal civilian or military capacities; 2) were or are dependents accompanying a federal civilian or a military employee serving in foreign countries so long as they were or are authorized by the U.S. Government to accompany their federal civilian or military sponsor in the foreign location; 3) worked as a Contractor employee, volunteer, consultant or intern on behalf of the federal government overseas, where stateside coverage can be obtained to complete the background investigation; 4) studied abroad at a U.S. affiliated college or university; or 5) have a current and adequate background investigation (commensurate with the position risk/sensitivity levels) completed for a Federal or Contractor employee position, barring any break in federal employment or federal sponsorship.

Only U.S. citizens and Legal Permanent Residents are eligible for employment on contracts requiring access to DHS sensitive information unless an exception is granted as outlined under DHS Instruction 121-01-007-Rev 2. Per DHS Sensitive Systems Policy Directive 4300A, only U.S. citizens are eligible for positions requiring access to DHS Information Technology (IT) systems or positions that are involved in the development, operation, management, or maintenance of DHS IT systems, unless an exception is granted as outlined under DHS Instruction 121-01-007-Rev 2.

CONTINUED ELIGIBILITY

ICE reserves the right and prerogative to deny and/or restrict facility and information access of any Contractor employee whose actions conflict with Fitness standards contained in 5 CFR Part 731. The Contracting Officer or their representative can determine if a risk of compromising sensitive Government information exists or if the efficiency of service is at risk and may direct immediate removal of a Contractor employee from contract support.

13 | P a g e

OPR PSD will conduct periodic reinvestigations every 5 years, or when derogatory information is received, to evaluate continued Fitness of Contractor employees.

The Federal Government is transitioning to Trusted Workforce (TW) 2.0. TW 2.0 is a whole-of-government background investigation reform effort overhauling the personnel vetting process by creating a government-wide system that allows transfer of trust across organizations. All contractor employees will be subjected to the transition and will be enrolled into continuous vetting at a date to be determined and via a to be determined continuous vetting system. Enrollment will include multiple requirements from all personnel and potential changes to processes, procedures, and systems. This contract will comply with all requirements that facilitate the mandated transition to TW 2.0.

REQUIRED REPORTS

The Contractor will notify OPR PSD, via the COR providing an ICE Form 50-005, Contractor Employee Separation Clearance Checklist, of all terminations/resignations of Contractor employees under the contract within five days of occurrence to the ICEDepartureNotification@ice.dhs.gov group box. The Contractor will return any expired ICE issued identification cards and building passes of terminated/resigned employees to the COR. If an identification card or building pass is not available to be returned, a report must be submitted to the COR referencing the pass or card number, name of individual to whom issued, the last known location and disposition of the pass or card. The COR will return the identification cards and building passes to the responsible ID Unit.

IAW DHS Instruction #121-01-007, Revision 2, dated August 10, 2024, the Contracting Officer’s Representatives (CORs) notify the servicing personnel and industrial security offices when a contractor employee is no longer working for DHS on any contract and report any derogatory information concerning the individual immediately, in accordance with the contract requirements. Report this information to PSD-CEP-REPORTING@ice.dhs.gov. The report shall include the Contractor employees’ name and social security number, along with the adverse information being reported.

The Contractor will provide, through the COR, a Quarterly Report (on a Microsoft Excel Spreadsheet) containing the names of Contractor employees who are actively serving on their contract. The list shall include the Name, Position and SSN (Last Four) and should be derived from system(s) used for Contractor payroll/voucher processing to ensure accuracy. This list is what ICE Industrial Security uses to reconcile the contract quarterly. CORs will submit reports to PSD-Industrial- Security@ice.dhs.gov no later than the 10th day of each January, April, July and October.

Contractors, who are involved with management and/or use of information/data deemed “sensitive” to include ‘law enforcement sensitive” are required to complete the DHS Form 11000-6-Sensitive but Unclassified Information Non-Disclosure Agreement (NDA) for Contractor employee access to sensitive information. The NDA will be administered by the COR to all contract personnel within 10 calendar days of the entry on duty date. The completed form shall remain on file with the COR for purpose of administration and inspection.

Sensitive information as defined under the Computer Security Act of 1987, Public Law 100-235 is information not otherwise categorized by statute or regulation that if disclosed could have an adverse

14 | P a g e impact on the welfare or privacy of individuals or on the welfare or conduct of Federal programs or other programs or operations essential to the national interest. Examples of sensitive information include personal data such as Social Security numbers; trade secrets; system vulnerability information;

pre-solicitation procurement documents, such as statements of work; and information pertaining to law enforcement investigative methods; similarly, detailed reports related to computer security deficiencies in internal controls are also sensitive information because of the potential damage that could be caused by the misuse of this information. All sensitive information must be protected from loss, misuse, modification, and unauthorized access in accordance with DHS Management Directive 11042.1, DHS Policy for Sensitive Information and ICE Policy 4003, Safeguarding Law Enforcement Sensitive Information.”

Any unauthorized disclosure of information will be reported to ICE.ADSEC@ice.dhs.gov.

SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OPR PSD through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and OPR shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract, the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken to effect compliance with such requirements.

INFORMATION TECHNOLOGY SECURITY

When sensitive government information is processed on Department telecommunications and automated information systems, the contract company agrees to provide for the administrative control of sensitive data being processed and to adhere to the procedures governing such data as outlined in DHS MD 4300.1, Information Technology Systems Security (or its replacement).

Contractor employees must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractor employees who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, regardless if the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

In accordance with Office of the Chief Information Officer (OCIO) requirements and provisions, all Contractor employees accessing Department IT systems or processing DHS sensitive data via an IT system will require an ICE issued/provisioned Personal Identity Verification (PIV) card. Additionally, Cybersecurity Awareness Training (CSAT) will be required upon initial access and annually thereafter.

CSAT training will be provided by the appropriate component agency of DHS.

Contractor employees, who are involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the Department, shall receive periodic

15 | P a g e training at least annually in security awareness and accepted security practices, systems rules of behavior, to include Unauthorized Disclosure Training, available on the ICE Training System (ITS) or by contacting ICE.ADSEC@ice.dhs.gov. Contractor employees with significant security responsibilities shall receive specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Department information systems will be continually evaluated while performing these duties. System Administrators should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer (ISSO).

CYBERSECURITY CONTRACT REQUIREMENTS

A.2 In accordance with ITAR 4.5.3.1 – Compliance with DHS Security Policy Terms and Conditions.

The following requirement should be incorporated into all acquisition documents for CUI

REQUESTS:

Compliance with DHS Security Policy Terms and Conditions:

All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Program 4300A version 13.3 Feb. 13, 2023 and attachments.

A.3 In accordance with ITAR 4.5.3.4 and ITAR 4.5.4.4 – Security Review

The following clause should be incorporated into ALL acquisition documents:

Security Review Terms and Conditions

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

A.4 In accordance with ITAR 4.5.3.7 – Supply Chain Risk Management

The following clause should be incorporated into ALL acquisition documents, but exclude services-only contracts:

Supply Chain Risk Management Terms and Conditions

16 | P a g e

The Contractors supplying the Government hardware and software shall provide the manufacturer's name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number for all components comprising the hardware and software.

If subcontractors or subcomponents are used, the name, address, state, and/or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors.

Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of…