USBP-PMOD_20260803_IST_PWS_BPTOC-Enterprise-V00-01.docx

Performance Work Statement for Border Patrol Technical Operations Center (BPTOC) Services Enterprise Contract

Version 00-01

October 14, 2026

[Document Number, if applicable]

Developed By:

U.S. Border Patrol Headquarters Program Management Office Directorate 1300 Pennsylvania Avenue, NW Washington, DC 20229

FOR OFFICIAL USE ONLY: This document is FOR OFFICIAL USE ONLY (FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552).

It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public or other personnel who do not have a valid “need-to-know” without prior approval of an authorized DHS official.

Authority Signatories

[Title, Program] Program Management Office Directorate U.S. Border Patrol

[Title, Program] PMOD USBP/CBP/DHS (choose one)

[Title, Program] PMOD USBP/CBP/DHS (choose one)

Revision History

Table of Contents

List of Tables

List of Figures Figure 1: BPTOC Workflow 7

Background The Department of Homeland Security (DHS) has developed comprehensive multi-year plans to secure America’s borders in part through the critical capability that surveillance towers provide to Border Patrol Agents (BPA) in the field. To support the operational availability of the surveillance assets, the U.S. Border Patrol (USBP) Program Management Office Directorate (PMOD) created the Border Patrol Technical Operations Center (BPTOC) that provides centralized 24 hour a day/365 days a year (24/7/365) Network Operations Center (NOC), Security Operations Center (SOC), and Call Center (CC) Helpdesk support, including system monitoring, remote troubleshooting, incident management, service request coordination, and escalation to appropriate support providers.

This PWS expands the scope beyond the previous IST and LGDS programs to support additional USBP detection and surveillance assets identified in this PWS and provides a framework for incorporating additional systems through future delivery orders or contract modifications, as authorized.

USBP requires the ability to coordinate, monitor, and report on sustainment activities performed of the BPTOC customer base and provide interface with the U.S. Customs and Border Protection (CBP) Office of Information and Technology (OIT), and facility managers located at USBP sites and contracted logistics support entities. USBP will provide any necessary sustainment documentation, access roles, and configuration baselines to facilitate coordination of service support and maintenance of the BPTOC customer base. USBP requires all sustainment actions are properly tracked, issues are escalated in accordance with established Integrated Logistics Support System (ILSS) and CBP Enterprise Operations Center tiered service support workflows, and activities comply with CBP policies and procedures.

OIT provides enterprise Tier 1 level support for initial intake, triage, and routing of user-reported issues through established CBP enterprise service support workflows. The BPTOC contractor provides BPTOC-specific Helpdesk support, including creating and updating service requests in ILSS, performing initial BPTOC-related triage and basic troubleshooting in accordance with approved Standard Operating Procedures (SOPs), resolving routine BPTOC customer base user and system issues when possible, and escalating unresolved or complex issues to Tier 2, Tier 3, or other responsible support groups in accordance with established workflows. USBP seeks Tier 2 support for BPTOC activities in support of the BPTOC customer base, including advanced troubleshooting, system-level diagnostics, incident coordination, and escalation or assignment of incidents to responsible resolution groups in accordance with established workflows. Additionally, USBP requires BPTOC-related information administration and regular reporting on these activities to optimize operational performance and stakeholder engagement.

Tier Support Definitions

Tier 1 Support: Help Desk and Initial Incident Management Tier 1 support serves as the first point of contact for users requesting assistance or reporting technical issues. Tier 1 support includes basic issue resolution, initial troubleshooting, incident intake, documentation, categorization, prioritization, and escalation through ILSS or other Government-designated service management processes.

Tier 1 personnel handle common customer issues that can typically be resolved using approved SOPs, knowledge articles, scripts, or predefined troubleshooting steps. This includes resolving basic usage problems, answering user questions, assisting with access or account-related requests, and fulfilling service desk requests that require technical support involvement. Tier 1 support focuses on rapid response, accurate ticket documentation, consistent customer communication, and resolution of issues that do not require specialized technical intervention.

Typical Tier 1 responsibilities include:

1. Receiving, logging, and tracking customer incidents and service requests;

2. Performing initial triage to determine issue severity, impact, and urgency;

3. Resolving routine technical issues and user support requests;

4. Providing guidance on standard system use and common functionality;

5. Documenting troubleshooting steps, user communications, and resolution actions;

6. Escalating unresolved or more complex issues to Tier 2, Tier 3, or other responsible support groups, as appropriate; and

7. Monitoring ticket status and ensuring customers receive timely updates.

Tier 2 Support: Technical Support and System-Level Troubleshooting Tier 2 support provides technical assistance for issues that cannot be resolved by Tier 1 personnel. Tier 2 support typically involves personnel with specialized knowledge of the supported systems, equipment, operational environment, and customer mission requirements.

Tier 2 personnel perform advanced troubleshooting, system diagnostics, and operational support activities. Tier 2 support may include hardware, software, access, configuration, system component, and operational issues that require technical expertise but do not necessarily require on-site field service support. Tier 2 support is intended to restore service when issues exceed routine Helpdesk capabilities but can still be addressed through remote or intermediate-level technical support.

Typical Tier 2 responsibilities include:

1. Supporting BPTOC customer base operator PIV/CAC card access;

2. Power cycling BPTOC customer base system components;

3. Supporting BPTOC customer base system component testing;

4. Troubleshooting and restoring video wall functionality;

5. Performing advanced diagnostics to isolate hardware, software, network, or configuration issues;

6. Coordinating with Tier 1 to validate incident details and confirm troubleshooting already performed;

7. Providing remote technical guidance to users or local support personnel;

8. Escalating issues to Tier 3 when on-site support, advanced engineering assistance, replacement parts, or specialized field service is required; and

9. Updating tickets with technical findings, actions taken, and recommended next steps.

Tier 3 Support: On-Site Field Service and Advanced Technical Resolution Tier 3 support consists of advanced technical support provided on site by Field Service Representatives or other designated subject matter experts. Tier 3 support is engaged when an issue cannot be resolved by Tier 1 or Tier 2 support, requires physical access to equipment, involves complex system failures, or requires specialized technical expertise.

Tier 3 personnel are responsible for diagnosing and resolving complex technical issues, performing hands-on maintenance, supporting hardware replacement or repair, and coordinating with engineering, logistics, vendor support, or program management when necessary. Tier 3 support may also assist with system restoration, component-level troubleshooting, operational validation, and post-resolution testing. Tier 3 support represents the highest level of operational support within the standard support model and is typically responsible for resolving issues requiring hands-on technical intervention, specialized expertise, or field-level maintenance.

Typical Tier 3 responsibilities include:

1. Providing on-site troubleshooting and technical support;

2. Diagnosing and resolving complex system, hardware, software, or integration issues;

3. Performing repair, replacement, or reconfiguration of system components;

4. Supporting restoration of mission-critical systems and services;

5. Conducting operational checks and validation testing after corrective actions;

6. Coordinating with Tier 2, engineering teams, vendors, or program management as required;

7. Documenting root cause, corrective actions, parts used, and final resolution; and providing recommendations to prevent recurrence of similar issues.

The BPTOC plays a crucial role in supporting USBP mission execution. This PWS describes BPTOC support for three types of deployed surveillance and detection systems. USBP and PMOD anticipate expansion to additional detection and surveillance capabilities. The five immediate need systems are listed below.

1. IST Portfolio systems

2. Remote Video Surveillance Systems (RVSS)

a. Integrated Fixed Towers (IFT) variants,

b. Consolidated Tower & Surveillance Equipment (CTSE)

c. All other IST systems as acquired/assigned (e.g., Enforcement Zone Cameras)

3. Mobile Portfolio systems Small Unmanned Aircraft System (S-UAS) Counter Unmanned Aircraft System (C-UAS)

4. Advanced Mobile Surveillance System (AMSS) Mobile Video Surveillance System (MVSS) Mobile Video Surveillance System with Radar (MVSS-R) Enhanced Mobile Video Surveillance System with Radar (eMVSS-R), Mobile Surveillance Capability-Lite (MSC-L), Enhanced Mobile Surveillance Capability-Lite (eMSC-L) Modular Mobile Surveillance System (M2S2)

5. Subterranean Portfolio/Linear Ground Detection Systems (LGDS)

· Linear Ground Detection System (LGDS)

· Passive Optical Network (PON) FirstNet Cellular Network (FCN)

The BPTOC provides a single point of contact for USBP users and stakeholders to report, track, and resolve any operational issues.

BPTOC provides a comprehensive NOC/SOC/CC solution to support CBP’s border security systems. This includes but is not limited to those listed below.

Network Architecture and Operations

· Maintain network architecture and connectivity between the existing BPTOC NOC/SOC/CC operating 24x7x365 through the CBP network

· Support the establishment of connectivity between newly deployed or newly onboarded systems and the BPTOC, including coordination of required architecture, configuration, access, firewall, and routing actions necessary to enable BPTOC monitoring and support.

System and incident management

· Monitoring system performance and health

· Manage alerts and providing user support Utilize designated CBP systems to log, track, manage and report BPTOC-related data for analysis and reporting of availability and performance metrics Cybersecurity and compliance

· Maintaining cybersecurity readiness through regular vulnerability scanning, patching, and remediation to ensure a consistent security posture across all network-attached border security systems Lifecycle and configuration management

· Maintain a real-time inventory of all monitored endpoints, promptly updating and notifying the Government of any changes, including removal of decommissioned assets.

Scope The scope: BPTOC Services for PMOD detection and Surveillance technologies.

The requirement: Support to coordinate, monitor, and report on operational availability (Ao) and sustainment activities of deployed detection and surveillance technology along the nation’s northern, southern and coastal borders.

1. The government will provide Government-furnished sustainment documentation, access roles, configuration baselines, and other Government-controlled information or approvals required for the contractor to coordinate service support and maintenance. The contractor shall provide the personnel, management, processes, facilities, tools, equipment, and technical resources necessary to perform BPTOC services, unless otherwise specified as Government-furnished in the applicable contract, delivery order, or task order.

PMOD is comprised of five detection and surveillance portfolios: Communications, Command and Control (C3), Infrastructure, IST, Mobile, and Subterranean. Additionally, the Portfolio Acquisition Executive (PAE) Support Division manages a communications enhancement capability that may benefit from BPTOC services. These portfolios and activities are potential customers of the BPTOC.

2. Currently the IST and Subterranean portfolios are benefiting from BPTOC services under the “1st generation contract.” Additionally, PMOD has received a set of Mobile Portfolio requirements for BPTOC services outlined in the sections below.

High Level Contract Requirements Properly and accurately track technology sustainment actions. Properly means issues are escalated in accordance with established Integrated Logistics Support System (ILSS) and CBP Enterprise Operations Center tiered service support workflows, and activities comply with CBP policies and procedures.

Provide Tier 2 support by performing system-level troubleshooting, coordinating incident response, and escalating or assigning incidents to the appropriate support tier or responsible support group in accordance with established workflows. The Contractor shall track incidents through resolution, provide status updates to stakeholders, and document closure actions in the Government-designated ticketing system.

1. Conduct administration and reporting to optimize USBP operational performance.

Provide support to currently deployed, newly deployed and newly onboarded surveillance and detection systems included in the BPTOC customer base. Individual delivery task orders will identify the applicable systems and unique requirements beyond those listed in this section of the PWS. The BPTOC provides a single point of contact for USBP users, including BPAs and other stakeholders to report, track, and resolve issues.

Provide a physical facility and maintain a backup or alternate operations site to support continuity of BPTOC services, conduct management, ownership, and operation of these facilities to deliver cost savings to USBP, enhance system operational availability, and maintain continuity of operations during disruptions.

Fully establish and manage a comprehensive NOC/SOC/CC solution to support CBP’s border security systems. This includes, but is not limited to:

a. Network architecture and operations

i. Develop network architecture and establish connectivity between the BPTOC customer base to the BPTOC NOC/SOC/CC operating 24x7x365 through the CBP network.

b. Establishing connectivity between newly and existing deployed systems and the BPTOC

i. Install and validate configurations on all integrated network hardware managed by the BPTOC to ensure seamless connectivity.

ii. Ensure required software is installed and operational.

iii. Manage firewall requests and monitor approval processes.

c. BPTOC Helpdesk/System and incident management

i. Monitor system performance and health.

ii. Manage BPTOC alerts.

iii. Provide Tier 1 helpdesk support and initial troubleshooting.

iv. Receive, document, triage, update, and track incidents, service requests, degraders, and outages in the Government-designated ticketing system.

v. Create service requests and work orders, as appropriate, and route or escalate issues that cannot be resolved at Tier 1 to the appropriate support organization.

vi. Coordinate with CBP OIT, system vendors, system operators, asset managers, facility managers, program staff, and other stakeholders to ensure incidents are properly routed, tracked, and resolved.

vii. Notify affected stakeholders of outages, degraders, or scheduled maintenance activities that may impact system availability.

viii. Capture and report system availability data and helpdesk support metrics in the Monthly Status Report.

d. Cybersecurity and compliance

i. Maintain cybersecurity readiness through regular vulnerability scanning, patching, and remediation to ensure a consistent security posture across all network-attached border security systems.

Support Authority to Operate (ATO) certification, authorization, and continuous monitoring activities, as directed by the Government. Support may include providing technical documentation, security control evidence, vulnerability scan results, remediation status, Plan of Action and Milestones (POA&M) inputs, configuration information, and other artifacts required to support Government review, certification, authorization, and continuous monitoring activities.

The Government retains responsibility for ATO ownership, authorization decisions, and risk acceptance. The contractor shall not make risk acceptance or authorization decisions unless expressly authorized in writing by the Government. BPTOC services include a range of other tasks to support USBP System. These tasks include:

i. monitoring system availability;

ii. managing service requests.

To uphold the USBP around-the-clock surveillance mission, the BPTOC service availability must maintain a 24/7/365 state of operational readiness and availability for the entire BPTOC services community. The contractor shall submit and maintain a Staffing Plan that demonstrates adequate staffing for 24/7/365 BPTOC operations, including proposed labor categories, shift coverage, minimum staffing levels by function, surge or backup coverage, shift turnover procedures, and processes for maintaining qualified coverage during nights, weekends, holidays, leave, training, and vacancies. The Staffing Plan shall be reviewed and updated as required to reflect changes in workload, customer base, system onboarding, operational tempo, and Government direction.

BPTOC Customer Base

· IST Portfolio

· Remote Video Surveillance System Upgrade (RVSS-U)

· Remote Video Surveillance System Overhaul (RVSS-O)

· Remote Video Surveillance System Legacy (RVSS-L)

· Northern Border Remote Video Surveillance System (NB-RVSS)

· Integrated Fixed Towers (IFT)

· IST, CTSE

· Mobile Portfolio

· S-UAS

· C-UAS

· Advanced Mobile Surveillance System (AMSS)

· MVSS

· MVSS-R

· eMVSS-R

· MSC-L

· eMSC-L

· M2S2 The following table provides a planning-level summary of current and planned mobile truck deployments, including CISCO hardware status and target deployment timelines, which are subject to change based on program schedules and acquisition timelines. Additional systems may be deployed based on USBP’s operational need in the future. All systems listed will be upfit with CISCO hardware to enable connectivity to the BPTOC.

Table 1: Mobile Truck Deployments

eMVSS-R platforms are a combination of new production systems and upfits of currently fielded MVSS-R. Thirty MVSS-R are currently fielded and are denoted in Table 1 with an “*” Subterranean Portfolio Linear Ground Detection System (LGDS) Passive Optical Network (PON) FirstNet Cellular Network (FCN) BPTOC allows monitoring of each of the systems that are in the customer base. The current monitoring is accomplished by monitoring all associated endpoints.

The number of endpoints being monitored is subject to change during the period of performance as additional surveillance and detection assets are included, as engineering changes to existing systems, technology upgrades, and/or system dispositions occur that decrease or increase the number of endpoints per system.

The BPTOC scope of work requires skilled professionals, including network engineers, security analysts, and helpdesk technicians who possess the necessary knowledge and expertise to efficiently manage and support the BPTOC customer base. USBP anticipates BPTOC support as a 24/7/365 activity, including nights, weekends, and holidays. Additionally, all BPTOC support staff will require a properly vetted and cleared DHS/CBP background investigation (BI).

Network and Security Monitoring Network and security monitoring shall be accomplished using Government-approved tools and methods, which may include agents, sensors, synthetic users, polling, log collection, endpoint monitoring, or other approved monitoring mechanisms, as authorized by the Government. Monitoring tools and configurations shall be coordinated with CBP OIT, applicable system owners, and security stakeholders prior to implementation. The contractor shall configure monitoring to minimize operational impact and shall not introduce unacceptable latency, degradation, or disruption to BPTOC customer base systems, users, or network operations. Any monitoring approach that may affect system performance, bandwidth utilization, security posture, or user experience shall be coordinated with and approved by the Government before implementation.

The Government seeks remote access for network and security monitoring. Systems that cannot be remotely accessed are excluded from the network and security monitoring unless otherwise authorized by the government. However, the Helpdesk support as outlined in Section 2.2 and Section 3.3 for operators shall include support for operators and these systems to the extent practicable.

Call Center/Helpdesk Support The scope of the CC/Helpdesk support includes assisting end-users with technical issues, managing incidents and service requests, and documenting, tracking, and coordinating resolution activities in the Integrated Logistics Support Services (ILSS) ticketing system or other Government-designated service management system. This support helps ensure timely resolution of user problems, high levels of user satisfaction, and increased system operational availability.

The CC/Helpdesk shall receive, document, route, coordinate, and track account-related issues and access-related requests in accordance with established Government access control procedures and approved access management workflows. Account administration actions shall be performed only where authorized and only by authorized personnel or responsible support organizations.

The CC/Helpdesk shall coordinate routing and escalation of incidents, service requests, and work orders to the Network Operations Center (NOC), Security Operations Center (SOC), Field Service Representatives (FSRs), sustainment contractors, vendors, CBP OIT, or other responsible support organizations in accordance with approved Standard Operating Procedures (SOPs) and established workflows.

The CC/Helpdesk shall use Government-provided or Government-designated systems, including ILSS as applicable, to create, track, maintain, update, and respond to system anomalies and user-reported issues, as appropriate. The CC/Helpdesk shall coordinate routing and escalation of incidents, service requests, and work orders to the Network Operations Center (NOC), Security Operations Center (SOC), Field Service Representatives (FSRs), sustainment contractors, vendors, CBP OIT, or other responsible support organizations in accordance with approved Standard Operating Procedures (SOPs) and established workflows.

The CC/Helpdesk shall receive, document, route, coordinate, and track approved system change requests through established Government change management workflows, but shall not approve system changes unless such authority is expressly delegated by the Government.

The contractor shall support Government-led communications and transition activities to ensure BPTOC customer base users and operators understand the appropriate process for reporting system issues, requesting support, and using the BPTOC Helpdesk as the designated point of contact. The contractor shall provide helpdesk contact information, escalation procedures, user guidance, and updates to SOPs or knowledge articles, as approved by the Government, to support consistent use of the BPTOC support process and reduce direct reporting to prior providers or vendors except where authorized by established workflows.

The scope also requires the contractor to assist with transition support from the current NOC/SOC/CC provider to the contractor’s solution, including support for knowledge transfer, service continuity, user communication, ticketing process alignment, and coordination with Government-designated stakeholders.

Service Level Agreement Compliance The BPTOC shall support reporting and accurate calculation of BPTOC customer base system Operational Availability (Ao). Incidents shall be classified and prioritized with priority levels ranging from 1 to 3, as defined in Appendix B. Unless otherwise specified in the applicable delivery order, BPTOC customer base system Operational Availability (Ao) shall be calculated as Mission Capable Time divided by Total Time for the applicable reporting period. Mission Capable Time is the amount of time the system is available to perform its primary mission functions, excluding approved downtime or other exclusions authorized by the Government. Total Time is the total number of hours in the applicable reporting period, less approved exclusions, if applicable.

Downtime for Ao reporting begins when a Priority 1 incident causing loss of primary mission functionality is identified through BPTOC monitoring, user report, or other Government-designated reporting method and is documented in ILSS or other Government-designated service management system. Downtime ends when the system is returned to mission-capable status, the incident is resolved or downgraded in accordance with approved procedures, or the Government determines the outage is no longer attributable to the system condition being tracked.

Approved exclusions may include scheduled preventive maintenance, Government-directed outages, force majeure events, access delays outside the contractor’s control, outages caused by external networks or utilities not under the contractor’s control, delays awaiting Government approval or action, and other exclusions approved by the Government. Government-caused delays or delays outside the contractor’s authorized access, technical control, or approved scope of responsibility shall be documented in the applicable ticket and reported separately from contractor-responsible downtime.

Portfolio-specific Ao rules, incident priority definitions, degraders, examples, and any unique calculation assumptions for IST, LGDS, Mobile, or other BPTOC customer base systems shall be identified in Appendix B and/or the applicable delivery order. Where portfolio-specific definitions differ, the applicable delivery order or portfolio-specific appendix language shall govern.

BPTOC service performance shall be measured by the contractor’s ability to meet required incident intake, acknowledgment, triage, escalation, documentation, and reporting timeframes. The BPTOC shall document all incidents, service requests, work orders, status updates, escalation actions, resolution actions, and closure information in ILSS or other Government-designated service management systems, as applicable.

In support of BPTOC customer base system Ao, the NOC, SOC, and Helpdesk functions shall meet the roles, responsibilities, and target response times for incident acknowledgment and initiation of action based on severity levels as shown in Appendix C and Appendix D. These BPTOC service performance measures support, but do not independently determine, customer base system Ao.

The measure of effectiveness for BPTOC services is 94 percent threshold and 97 percent objective operational availability of BPTOC services, measured monthly and reported within five business days of the end of each month. The BPTOC services availability shall reflect the availability of BPTOC Helpdesk, NOC, SOC, monitoring, ticketing, reporting, and escalation support functions necessary to support the BPTOC customer base.

BPTOC service performance metrics, including incident intake timeliness, acknowledgment timeliness, escalation timeliness, ticket documentation completeness, status update timeliness, closure timeliness, and the BPTOC service availability, shall be reported in the Monthly Program Management Report in accordance with CDRL F-01.

To maximize remote Tier 2 support capability and minimize more costly onsite Tier 3 support, the technology, Standard Operating Procedures (SOPs), and resources used by the BPTOC require continuous updates.

The measure of effectiveness for BPTOC Services is the availability and responsiveness of BPTOC Helpdesk, NOC, SOC, monitoring, ticketing, reporting, and escalation support functions. BPTOC service performance shall be measured through service availability, incident intake timeliness, acknowledgment timeliness, escalation timeliness, ticket documentation completeness, status update timeliness, closure timeliness, and accurate reporting. BPTOC service performance shall be measured monthly and reported within five business days of the end of each month. Unless otherwise specified in the applicable delivery order, BPTOC service availability shall target 94 percent threshold and 97 percent objective for BPTOC-managed service functions, excluding outages or delays outside the contractor’s authorized access, technical control, or approved scope of responsibility.

In support of the BPTOC customer base system Ao requirement, the NOC, SOC, and Helpdesk functions of the BPTOC have certain responsibilities and target response times for acknowledging incidents and initiating action based on severity levels as shown in Appendix C and Appendix D.

To maximize the remote Tier 2 support capability and minimize more costly onsite Tier 3 support, the technology, SOPs and resources used by the BPTOC require continuous updates.

Contract Data Requirements List (CDRL) deliverables are included in Appendix A.

Performance Work Statement Requirements The following requirements encapsulate the essential BPTOC services and functionalities needed for effective operational support of PMOD systems.

Network Operations Center Services Network Monitoring and Maintenance In network monitoring and maintenance, the focus is on real-time monitoring of network performance metrics, bandwidth usage, and BPTOC customer base system status to detect or prevent anomalies. By using advanced traffic analysis tools, anomaly detection algorithms, and alert systems, the NOC identifies and addresses anomalies, network bottlenecks, and BPTOC customer base system downtime, promptly. Related requirements are listed below.

a. Employ real-time network monitoring tools to continuously monitor network performance metrics, bandwidth usage, and sensor statuses across the customer base.

b. Continuously track and analyze performance indicators including network bandwidth utilization, latency, packet loss, and throughput to ensure optimal network performance.

c. Incorporate traffic analysis tools that provide detailed insights into network activity, such as flow data analysis, application usage statistics, device communication patterns, and traffic prioritization for quality of service (QoS).

d. Perform continuous analysis of network traffic to distinguish between regular and irregular activities, ensuring legitimate use is not impacted by potential threats or congestion.

e. Perform routine health checks on all network devices and systems, including routers, switches, firewalls, servers, and BPTOC customer base equipment, to ensure they are functioning correctly and efficiently.

f. Configure health monitoring systems to generate proactive alerts for early warning signs of BPTOC customer base hardware degradation, resource depletion, or system errors.

g. Use dashboards to give BPTOC customer base stakeholders a comprehensive, real-time overview of system status, alerts, and performance metrics.

h. Use anomaly detection algorithms to identify any irregularities in network traffic patterns, enabling early detection of potential issues.

i. Establish automated alerting mechanisms to notify NOC personnel promptly about any detected anomalies, potential bottlenecks, or performance degradations.

j. Ensure NOC hardware and software monitoring systems are equipped with redundancy and failover capabilities to maintain continuous monitoring in case of system failures.

Troubleshooting and Incident Management The NOC is also responsible for the advanced troubleshooting and management of all incidents related to BPTOC customer base systems. In managing and resolving incidents, NOC personnel shall follow approved protocols to ensure that actions are documented accurately in ILSS, and that of customer base systems’ operational availability and are maintained at optimal levels. In the context of BPTOC services, this NOC capability is Tier 2 support for those incidents that cannot be resolved by the Helpdesk (Tier 1). The BPTOC provides the capabilities below.

· Troubleshooting, documenting, tracking, and resolving network incidents and service requests within the contractor’s authorized access, technical control, and approved scope of responsibility. Tier 2 support activities shall be performed where authorized and in accordance with approved processes, procedures, and SOPs. Tier 2 support activities may include, but are not limited to:

· supporting BPTOC customer base operator PIV/CAC card access;

· power cycling BPTOC Customer Base system components;

· supporting BPTOC Customer Base system component testing; and

· troubleshooting/restoring video walls.

· Attempting to duplicate reported problems, isolate symptoms, identify suspected cause, and document available root cause information, final cause if provided by the resolver group, and corrective actions in ILSS or other Government-designated service management systems. Maintaining ILSS or other Government-designated service management systems with detailed information on issues, symptoms, timelines, troubleshooting steps, suspected cause, final cause if provided by the resolver group, resolutions, corrective actions, and any follow-up actions. Escalation of complex technical issues to higher-tier support as necessary to ensure timely resolution of complex issues

· Collaboration with Tier 3 support (Field Service Representatives (FSR), the BPTOC customer base Sustainment Contractor, and/or BPTOC Customer Base In-Service Engineering Activity (ISEA) to resolve on-site issues when remote resolution is not possible Security Operations Center Services SOC services provide cybersecurity monitoring and coordination for BPTOC customer base IT infrastructure. The BPTOC contractor shall perform SOC functions for BPTOC customer base systems within the contractor’s authorized access, technical control, and approved scope of responsibility. These functions include monitoring, scanning, analysis, alert review, triage, reporting, evidence collection, remediation tracking, patch coordination, and cybersecurity incident coordination using Government-approved tools and processes, as authorized by the Government.

The BPTOC contractor shall coordinate with CBP OIT, applicable enterprise SOC or cybersecurity service providers, system owners, Information System Security Officers (ISSOs), In-Service Engineering Activities (ISEAs), sustainment contractors, vendors, and other Government-designated cybersecurity stakeholders, as required. The BPTOC contractor shall escalate cybersecurity events, findings, vulnerabilities, and incidents in accordance with approved incident response plans, SOPs, and Government-designated reporting procedures.

The Government retains authority for Authority to Operate (ATO) ownership, Plan of Action and Milestones (POA&M) ownership, risk acceptance, cybersecurity incident reporting authority, incident command, privileged access approval, and enterprise cybersecurity decisions unless such authority is expressly delegated in writing by the Government. The BPTOC contractor shall support FISMA compliance and cybersecurity posture maintenance within the contractor’s authorized access, technical control, and approved scope of responsibility.

Security Monitoring The goal of security monitoring is to employ Government-approved monitoring and detection tools, approved data sources, authorized accounts, and approved system boundaries to identify, analyze, and escalate potential threats and anomalies in real time. These tools may include Intrusion Detection and Prevention Systems (IDPS), Security Information and Event Management (SIEM) systems, endpoint security monitoring solutions, log aggregation tools, security event correlation tools, and other Government-approved monitoring mechanisms. The BPTOC contractor shall perform security monitoring within the contractor’s authorized access, technical control, and approved scope of responsibility.

The BPTOC contractor shall:

a. Use Government-approved IDPS tools, where authorized, to detect, alert on, and support prevention of unauthorized access, malicious activity, and potential security breaches in real time;

b. use Government-approved endpoint security monitoring solutions, where authorized, to monitor network-connected devices and support identification of malware, vulnerabilities, policy noncompliance, or other security concerns;

c. use Government-approved SIEM systems, log aggregation tools, and security event correlation tools to aggregate, analyze, and correlate approved security event data from authorized sources to support centralized visibility, triage, escalation, and response coordination;

d. maintain security monitoring records, alerts, audit trails, and supporting evidence in accordance with applicable DHS, CBP, and Government-designated cybersecurity requirements to support analysis, incident response, audits, and FISMA compliance activities; and

e. integrate network monitoring with security monitoring tools, where authorized, to support detection, triage, escalation, and coordination of cybersecurity events such as malware, intrusion attempts, denial-of-service activity, unauthorized access, and other suspicious activity affecting BPTOC customer base systems.

Vulnerability Scanning The BPTOC contractor shall support vulnerability scanning and vulnerability management for BPTOC customer base systems within the contractor’s authorized access, technical control, approved scope of responsibility, and Government-approved rules of engagement. Vulnerability scanning shall be conducted only for systems, endpoints, networks, applications, and environments for which the Government has granted approved scan authority, credentials, tool authorization, rules of engagement, and system owner coordination.

The BPTOC contractor shall conduct or support vulnerability assessments using Government-approved scanning tools and approved data sources. Penetration testing is separate from routine vulnerability scanning and shall occur only when specifically authorized by the Government under approved rules of engagement.

The Government, through the applicable Information System Security Officer (ISSO), CBP OIT Vulnerability Assessment Team (VAT), system owner, and other designated Government representatives, retains responsibility for security governance, risk acceptance, authorization decisions, Authority to Operate (ATO) ownership, Plan of Action and Milestones (POA&M) ownership, scan authorization, penetration testing authorization, and approval of remediation actions. The BPTOC contractor shall support the Government by analyzing findings, recommending corrective actions, tracking remediation status, implementing approved remediation actions only where the contractor has authorized access and technical control, and coordinating with the Government, ISEA, sustainment contractors, vendors, or other responsible parties when remediation is outside the contractor’s authority or access.

The BPTOC allows:

· conduct or support regular vulnerability assessments, as authorized by the government, to identify security weaknesses within BPTOC customer base systems, BPTOC-controlled environments, and associated network infrastructure;

· conduct or support penetration testing only when specifically authorized by the government and performed in accordance with approved rules of engagement;

· submission of vulnerability scan files and associated vulnerability reports in accordance with CDRL/DID F-05 Vulnerability Scan Report to the BPTOC customer base ISSO for review and action in compliance with FISMA;

· support for the BPTOC customer base ISSO to identify, document, and create a POA&M in accordance with CDRL/DID F-06;

· support to POA&M execution to mitigate findings as part of the ATO process;

· support for remediation of BPTOC customer base security deficiencies within the following timelines:

· Critical vulnerabilities within 15 calendar days

· High vulnerabilities within 30 calendar days

· Moderate vulnerabilities within 90 calendar days, and low vulnerabilities within 180 calendar days; and

· the BPTOC customer base ATO support and participation in scheduled meetings as required.

Patch Management BPTOC supports patch management activities:

a. coordinate with the BPTOC customer base ISSO, ISSM, ISEA, CBP OIT, sustainment contractors, vendor support entities, and other Government-designated stakeholders to support remediation planning and patch management activities;

b. by implementation of BPTOC customer base software patches and updates as needed to maintain system performance and cybersecurity compliance; and

c. support testing and validation of patches and configuration changes in approved test environments prior to implementation, where applicable;

d. implement Government-approved software patches, security patches, updates, and configuration changes only for systems or components within the contractor’s authorized access, technical control, and approved BPTOC support boundary;

e. coordinate scheduling of patch deployment with the Government and affected stakeholders to minimize operational impacts and align with approved maintenance windows;

f. support rollback planning and coordination in the event a patch or update causes system degradation, operational impact, or other unintended effects;

g. document patch status, implementation results, exceptions, failures, rollback actions, and residual risks in ILSS or other Government-designated systems, as applicable; and

h. maintain Microsoft Windows update compliance for BPTOC customer base systems within the contractor’s authorized access, technical control, and approved support boundary by ensuring Government-approved versions, patches, and updates are installed and operational, where authorized.

Security Incident Response The BPTOC contractor shall support security incident response for BPTOC customer base systems by detecting, documenting, ticketing, escalating, coordinating, and providing technical evidence in accordance with approved CBP/DHS procedures, SOPs, incident response plans, and Government-designated reporting workflows. Formal incident reporting authority, incident command, containment decisions, quarantine decisions, mission-impact decisions, risk-based response decisions, and notifications to external authorities shall remain with the designated Government cybersecurity authority unless expressly delegated in writing by the Government.

The BPTOC contractor shall support timely identification, coordination, and restoration activities to minimize operational disruptions, maintain security, and support recovery from security incidents within the contractor’s authorized access, technical control, and approved scope of responsibility. The BPTOC contractor shall:

a. support development, maintenance, and implementation of SOPs for security incident detection, documentation, escalation, coordination, response support, and resolution tracking. These SOPs shall address common and critical scenarios and support consistent incident handling in accordance with Government-approved procedures;

b. support development and maintenance of the Security Incident Response Plan (IRP) in accordance with CDRL/DID F-04 by providing technical inputs, workflows, contact lists, escalation paths, roles and responsibilities, communications protocols, evidence handling procedures, reporting dependencies, and system-specific operational considerations;

c. detect, document, ticket, triage, and escalate suspected cybersecurity events affecting BPTOC customer base systems in accordance with approved incident response procedures and Government-designated reporting workflows;

d. coordinate with CBP OIT, applicable cybersecurity authorities, ISSOs/ISSMs, system owners, ISEAs, sustainment contractors, vendors, and other Government-designated stakeholders during security incident response activities;

e. provide technical evidence, logs, monitoring data, ticket history, timelines, screenshots, configuration information, and other relevant artifacts to support Government-led incident response, investigation, analysis, and reporting, as authorized;

f. support implementation of Government-approved response or recovery actions within the contractor’s authorized access, technical control, and approved scope of responsibility; and

g. document incident status, escalation actions, technical findings, response support actions, recovery actions, and closure information in ILSS or other Government-designated systems, as applicable.

Helpdesk Services The BPTOC provides Helpdesk support to assist end-users with technical issues and manage incidents and service requests within ILSS, ILSS Maximo, or other Government-designated service management systems, as applicable. The BPTOC supports resolution of user problems, maintains BPTOC customer base satisfaction, and enhances BPTOC customer base operational availability.

The BPTOC provides the support listed below:

a. Tier 1 support and troubleshooting, acting as the initial point of contact for BPTOC Customer Base system users reporting issues.

b. Creation of service requests in ILSS and take appropriate preemptive/triage actions to resolve BPTOC customer base system and network issues in accordance with SOPs.

c. Updates of incidents in ILSS for root cause analysis or corrective actions.

d. Updates of service requests in ILSS with details of the reported incident and its resolution.

e. Development and enforcement of SOPs for incident detection, escalation, response, and resolution.

f. Assists users with software installation and updates related to BPTOC Customer Base systems.

g. Provides remote support for configuring and troubleshooting end-user devices.

h. Escalation to NOC/SOC or FSR, as required, for more complex issues that cannot be resolved by Tier 1 support.

i. Closes tickets in ILSS following incident resolution and documentation.

j. Support account administration tasks, such as account creation, account unlocks, password resets, and permission updates, only where authorized and in accordance with approved access management workflows. Access approval, role authorization, privileged access approval, and recertification decisions remain with the authorized Government or system owner approval authority unless expressly delegated in writing.

Disaster Recovery and Data Backup The BPTOC contractor shall provide and maintain an actionable Disaster Recovery Plan (DRP) and data backup processes for BPTOC-managed systems, support tools, configurations, logs, tickets, reports, and operational support data necessary to restore BPTOC services after a disruption and support operational continuity. Backup and recovery of portfolio operational data, application databases, vendor-managed systems, program-controlled data, or OIT-controlled data shall not be assigned to the BPTOC contractor unless expressly assigned by the Government in the applicable contract, delivery order, or other Government-approved contractual action.

The BPTOC contractor shall provide the support…