Virtualization SOO V6 11142025_RFI.pdf

U.S. Customs and Border Protection (CBP) Office of Information and Technology (OIT)

Statement of Objectives (SOO)

For

Virtualization Infrastructure Support

PR

November 6, 2025

U.S. Customs and Border Protection

PR# TBD

Table of Contents

1.0 BACKGROUND

2.0 SCOPE

3.0 APPLICABLE DOCUMENTS

4.0 PERFORMANCE OBJECTIVES, GOALS AND OUTCOMES

4.1 SUPPORT FOR TWO-FACTOR AUTHENTICATION GLOBALLY

4.2 SUPPORT BOTH ON-PREMISES AND EXTERNAL CLOUD SERVICE PROVIDERS

4.3 SOFTWARE

4.4 SOFTWARE TRAINING

4.5 MANAGED SERVICES

4.6 MIGRATION AND IMPLEMENTATION SUPPORT SERVICES

4.7 SUPPORTING DOCUMENTATION

5.0 OPERATING CONSTRAINTS

6.0 DELIVERABLES AND DELIVERY SCHEDULE

6.1 POST AWARD AND KICK-OFF MEETING

6.2 PROJECT MANAGEMENT PLAN

6.2.1 QUALITY ASSURANCE PLAN

6.2.2 RISK MANAGEMENT AND BUSINESS CONTINUITY PLAN

6.2.3 TRANSITION-IN PLAN

6.2.4 TRANSITION-OUT PLAN

6.3 MANAGED SERVICES

7.0 GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION (GFE / GFI)

8.0 PERIOD AND PLACE OF PERFORMANCE

9.0 SECURITY REQUIREMENTS

9.1 SECURITY CLEARANCES: PERSONNEL BACKGROUND DATA

9.2 GENERAL SECURITY REQUIREMENTS

9.3 CONTRACTOR SUITABILITY

9.4 CLEARANCES

9.5 IDENTIFICATION BADGE

9.6 TRANSITION IN PLAN

9.7 TRANSITION OUT PLAN

9.8 CONTRACTOR PRE-SCREENING

9.9 PHYSICAL AND IT SECURITY REQUIREMENTS

9.10 REMOTE ACCESS

10.0 TASK ORDER ADMINISTRATION:

11.0 TECHNICAL DIRECTION

12.0 UNIQUE STANDARDS

SECTION 508 REQUIREMENTS FOR TECHNOLOGY PRODUCTS

ADDENDUM A - ACRONYMS

ADDENDUM B – SUBMISSION REQUIREMENTS

1.0 BACKGROUND

The U.S. Customs and Border Protection (CBP), Office of Information and Technology (OIT) has a requirement to adapt and modernize their virtualization infrastructure to support multi-cloud and expanded automation options. CBP is seeking information on commercially available and open-source virtualization platforms and associated services that can serve as a robust, scalable, and cost-effective replacement for its current virtualization infrastructure, supporting its modernization goals for multi-cloud and expanded automation. CBP will consider different architectural approaches (e.g., HCI vs. traditional 3-tier) as long as the proposed solution meets the functional requirements.

The current environment is predominately VMware by Broadcom, with over 3,000 virtualization hosts at 3+ physical data center locations. Currently, CBP utilizes Cisco and Dell servers.

2.0 SCOPE

The scope of this effort contains the services CBP estimates are necessary to support a possible virtualization infrastructure replacement to include advanced technical support and migration services from legacy environment. This encompasses the comprehensive modernization of the CBP enterprise virtualization infrastructure, aiming to replace the existing VMware by Broadcom environment with a robust, scalable, and cost-effective virtualization platform that supports multi-cloud operations and advanced automation capabilities. The proposed solution should support the following services: (1) Platform Modernization and Architecture, (2) Automation and Multi-Cloud Capabilities, (3) Compatibility and Integration, (4) Security and Compliance, (5) Software, Licensing and Support Services, (6) Migration and Implementation Support Services, and (7) Training and Knowledge Transfer.

3.0 APPLICABLE DOCUMENTS

The Federal Acquisition Regulation: http://www.acquisition.gov/FAR/

Section 508 of the Rehabilitation Act: http://www.section508.gov/

Homeland Security Acquisition Regulation (HSAR) https://www.dhs.gov/publication/hsar

Code of Federal Regulations (CFR): https://www.govinfo.gov/app/collection/cfr

Federal Information Security Management Act of 2014 (FISMA)

NIST SP 800-53, Recommended Security Controls for Federal Information Systems http://www.acquisition.gov/FAR/ http://www.section508.gov/ https://www.dhs.gov/publication/hsar https://www.govinfo.gov/app/collection/cfr

CBP Information Systems Security Policies (CBP 1400-05x) and Procedures Handbook.

DHS 4300A Policy Directive (Version 13.3, February 13, 2023)

DHS Sensitive System Handbook

4.0 PERFORMANCE OBJECTIVES, GOALS AND OUTCOMES

4.1 Support for Two-Factor Authentication Globally

This solution must support Two-Factor Authentication globally, using principal of least privilege, using CBP’s active directory or Azure Entra Active Directory (AD) credentials.

Automation. CBP expects a product to support multi-cloud automation and deployments, to include Preboot Execution Environment (PXE) or on-demand International Standardization Organization (ISO) boot provisioned virtual machines across all virtualization hosts, allowing customer (product owner) non-administrative console access to the provisioned virtual machines.

4.2 Support Both On-Premises and External Cloud Service Providers This solution must support both on-premises and external cloud service providers, both government and commercial offerings. This solution shall allow custom scripting or ancillary script engine or automation engine services to provide all Day-0, Day-1, Day-2 customization tasks to include changes to Virtual Machine (VM) provisioning, guest configurations, security configurations and changes.

4.3 Software

CBP will consider software offerings without integrated support, where the software responsibilities (i.e. security configuration) are provided by the service provider. Managed service providers can include hardware and software providers where the hardware, software, and the services providers are the same (primarily cloud service provider offerings).

To ensure supply chain integrity for commercial offerings, all source code, at no time, will manufacturer firmware or subcomponent firmware, source code or software be developed, sourced, or provided by the following prohibited countries: Cuba, Iran, Syria, North Korea, Russia, Crimea region of Ukraine, People's Republic of China, Venezuela; or any country that is prohibited from export of U.S cryptography modules; or restricted imports, export, reexport or materiel modifications with information technology, cryptography components.

4.4 Software Training

CBP requires training to be provided integral to software offering. Training shall include virtual instructor-led training for at least two (2) sessions per year, accommodating up to twelve (12) CBP attendees per year. On-Demand Computer Based Training (CBT) shall be available, without limit, to CBP employees and designated contractor staff. Virtual instructor-led training shall include installation, maintenance, advanced design and troubleshooting of proposed solutions to include advanced design and troubleshooting.

CBP does not require software providers to be a commercial off-the-shelf (COTS) offering.

4.5 Managed Services

Provide professional services for two (2) primary function(s): (1) design, engineering, installation, maintenance, and lifecycle management of provided Software and Software Licensing to include (2) scripting, provisioning support of all Day-x tasks and taskings, security vulnerability remediation and high-level operations support. This service shall be follow-the-sun support, for US EST 0800-1800 daily with after-hours support and after-hours maintenance tasks performed. Within the Managed Services offerings, system steward function for Authority to Operate (ATO) shall be included. All staff shall be CBP badged, credentialed and cleared. Government Furnished Equipment (GFE) will be provided if needed. All support staff shall be continental-US based.

4.6 Migration and Implementation Support Services

Provide comprehensive services and any ancillary scripting or expertise required for migration from a legacy VMware by Broadcom solution to proposed replacement solution.

This service shall include hypervisor redeployment, virtual machine migration and any modifications to virtual machines or hardware necessary for these functional migrations.

Migrations shall occur during coordinated customer maintenance windows, often after normal business hours to minimize impact. All issues that occur and any ancillary costs of said migration shall be accounted for within this Migration Services.

4.7 Supporting Documentation

Based on this SOO, the contractor shall develop a detailed Contractor Statement of Work and a draft Project Management Plan (PMP). The draft PMP will include a Quality Assurance Surveillance Plan (QASP), Risk Management and Business Continuity Plan, and Transition-In Plan.

5.0 OPERATING CONSTRAINTS

• Industry should account for the following existing infrastructure limitations and capabilities: 3+ physical data center locations. Approximately 60% Linux-based, 35% Windows-based, 5% vendor appliance and/or containerized applications.

• Traditional storage presentation from highly-available appliances, providing Network File System (NFS), Internet Small Computer System Interface (iSCSI), or Non-Volatile Memory Express(NVMe)/ Transmission Control Protocol (TCP) storage presentation.

Internet Protocol Version 4 (IPv4) and Internet Protocol Version 6 (IPv6) Traditional Network Presentation of layer 2 services, routing functions are not extended to virtualization infrastructure. Uplinks are typically trunked, without bonding to highly-available switches using 10 or 25gbe.

• Hypervisor/OS storage may be utilizing Secure Digital (SD Card) for minority of sites, M.2, or RAID 1 drives for majority of sites. The minority of sites utilizing hyperconverged infrastructure are primarily Dell VxRail or VMware vSAN locations.

• All current hosts are supported by the existing VMware by Broadcom Hardware

Compatibility Guide.

• The current environment is predominately VMware by Broadcom, with over 3,000 virtualization hosts, at 3+ locations and utilizes Cisco and Dell servers.

• For any contractors performing work that involves access to the CBP network, a CBP Background Investigation (BI) clearance is mandatory. A minimum 'Limited' clearance must be obtained prior to the start of performance for all personnel with direct network access.

6.0 DELIVERABLES AND DELIVERY SCHEDULE

The Contractor shall provide all deliverables in electronic format. Unless otherwise specified, the Contractor shall provide the deliverables as an attachment(s) to an e-mail.

The Contractor shall develop documentation in Microsoft Office 2010 (or higher) and/or Portable Document Format (PDF). All deliverables shall be delivered by 4:30 p.m.

Washington DC Local Time to the Contracting Office Representative (COR) and Subject Matter Expert (SME). Deliverables received after 4:30 p.m. Washington DC Local Time, will be considered received on the next business day.

Deliverable requirements are as follows:

• All deliverables shall be accurate in presentation, technical content, and shall adhere to the guidelines set forth in this SOO. All documentation presented to the Government shall be complete, correct, clear, and concise.

• All deliverables shall be clear and concise.

• All deliverables shall completely satisfy the requirements as defined in this SOO.

• All documentation deliverables shall be editable by the Government.

• All deliverables shall be submitted on or before the due date specified in the SOO or submitted in accordance with a later scheduled date mutually agreed upon by the Government and the contractor. A deliverable is considered timely if submitted on or before the date specified in this SOO and, if the Government provides any written notification of deficiencies, the Contractor shall correct the deficiencies within seven (7) calendar days.

• All deliverables shall not be marked as proprietary by the contractor.

Deliverable Section Due Date Submit to Presentation Materials for Post Award and Kick-Off Meeting

6.1 5 business days before the kick-off meeting

COR/CO

Post Award and Kick-Off Meeting

6.1 NLT 10 business days after the

award date

N/A

Meeting Minutes from the Post Award and Kick-off Meeting

6.1 5 business days after the kick-off meeting

COR/CO

Project Management Plan 6.2 + 5 business days of Kick-Off, updated annually

COR/CO

Quality Assurance Plan 6.2.1

Date of award + 5 business days, updated annually

COR/CO

Risk Management and Business Continuity Plan

6.2.2

Date of award + 5 business days, updated annually

Transition-In Plan 6.2.3

Date of award + 5 business days

COR/CO

Transition-Out Plan 6.2.4 90 calendar days prior to the end of performance period

6.1 Post Award and Kick-Off Meeting

The Contractor shall attend a Post Award and Task Order Kick-Off Meeting with the Government to review the award and discuss technical and contracting objectives within 10 business days after award. The Contractor shall provide meeting presentation materials to the COR for review 5 business days prior to the kick-off meeting. The Contractor shall also document meeting minutes and provide them to the COR and Contracting Officer (CO) 5 business days after the kick-off meeting is conducted.

6.2 Project Management Plan

The Contractor shall furnish to the Contracting Officer and the Program Office/COR an updated PMP five (5) business days after conduct of the Post Award/Kick-Off Meeting task order and updated annually thereafter.

The PMP must fully address all activities associated with performance under the task order to include any innovative processes and procedures the Contractor has implemented which improve performance and efficiency. The PMP must also describe the Contractor’s project organization, structure, authority, roles, responsibilities, and internal reporting relationships; define the interfaces between the project staff and the Government and define the roles and interfaces of the project relative to other corporate units, subcontractors, and suppliers. The PMP shall fully describe all pertinent information for the effective and efficient migration and management of the task order, including disaster recovery processes and procedures, transition plans, and continuous process improvement.

6.2.1 Quality Assurance Plan

As part of the PMP, the Contractor shall furnish updated detailed project Quality Assurance Plan (QAP) that addresses the Contractor’s plan for implementing and maintaining high-quality services and work activities required under this task order. The QAP must be submitted to the COR within five (5) business days after task order award. CBP expects the Contractor to implement and maintain a high quality and standard of services provided under this task order

Quality control is action(s) taken by the Contractor to fully ensure the quality and integrity of services and other deliverables provided to the Government. The Contractor's QAP is the Contractor-provided document that identifies, defines, and describes the Contractor’s procedures for controlling the quality and timeliness of services and other deliverables provided to the Government. The Contractor’s Quality Assurance (QA) program is the practical implementation of the QAP.

The Contractor’s QA program shall include audits, reviews, tests, inspections, and similar procedures designed and conducted to yield QA measures that will reveal the current quality status of all phases of the operation.

The Contractor's QAP shall include the methodology and procedures for an inspection system covering all services provided under the contract. The QAP shall be fully implemented within five (5) business days after acceptance by the Government.

6.2.2 Risk Management and Business Continuity Plan

As part of the PMP, the Contractor shall implement an updated proactive Risk Management and Business Continuity Plan that assesses, tracks, and reports potential risks and issues, while simultaneously allowing for their control and project-wide visibility.

The Contractor's Risk Management and Business Continuity Plan shall be submitted to the COR within five (5) business days after date of award.

The Risk Management and Business Continuity Plan shall include the following processes:

• Risk Identification

• Qualitative Risk Analysis

• Quantitative Risk Analysis

• Mitigation Plan

• Risk Response Planning

• Risk Monitoring and Control

• Disaster Recovery, to include off-site data storage (as it pertains to the contractor)

• Documentation

6.2.3 Transition-In Plan

As part of the PMP, the Contractor shall submit a separate document as a Transition-In Plan to the COR within 5-10 business days after date of award. The COR will review and return the Transition-In Plan to the Contractor within 7 business days. If changes are required, the Contractor shall submit a revised Transition Plan within 7 business days upon receipt from the COR. The Transition Plan shall describe the approach to be taken to migrate the incumbent’s operation to the Contractor’s site, including weekly Contractor’s progress notifications to COR, milestones (incremental/partial transition and full transition of repair operations) and schedule of activities. The Contractor shall address their approach to project management, status reporting, and problem reporting and resolution.

The COR shall provide guidance and direction on the migration of operations from the incumbent’s facility as well as with the setup and installation at the Contractor’s facility.

The Contractor shall organize the Transition-In Plan as follows:

• Description - A detailed description of the Transition-In Plan, including design, implementation, and management.

• Personnel - Overall personnel requirements (i.e., total person-hours) to accomplish the transition, including a staff loading chart indicating staff by task/hours.

• Schedule - A schedule in Gantt chart format showing beginning and ending dates for each of the migration tasks and the time frame for all tasks.

6.2.4 Transition-Out Plan

The Contractor shall submit a Transition-Out Plan that fully addresses the activities and efforts required to transition the operations from the Contractor’s facility to a new Contractor’s facility at the end of the period of performance. The transition-out activities will be directed toward ensuring that all essential operations will be available and will flow seamlessly from time-of-service shutdown at the beginning of the physical transition until the new contractor’s facility is fully functional. It is expected that the physical transition will commence on a Friday evening so as to have minimal effect on business hours operations.

The Contractor’s Transition-Out Plan shall be submitted 90 calendar days prior to the end of the final option performance period, or as otherwise directed by the COR. The Contractor shall submit a Final Transition Plan as preparation for the conclusion of contract activities.

6.3 Managed Services

For those contractor personnel working in direct support of the virtualization efforts, the normal business hours are 7:00 am to 6:00 pm (EST), Monday through Friday with core business hours between 8:00 am and 5:30 pm each business day. This will be follow-the-sun support, for US EST 0800-1800 daily; with after-hours support and after-hours maintenance tasks performed. Within the Managed Services offerings, system steward function for ATO shall be included. All staff shall be CBP badged, credentialed and cleared; Government Furnished Equipment (GFE) will be provided if needed. All support staff shall be continental-US based. The contractor shall ensure coverage of these core hours for those in direct support of the virtualization effort. Those directly supporting the virtualization effort will recognize all official federal holidays. However, all computer and software applications support a 24/7/365 mission requirement and the contractor shall ensure system application performance standards are maintained over the full range of mission operations.

Holidays and Administrative Leave Bureau of Customs and Border Protection (CBP) personnel observe the following days as holidays:

• New Year’s Day

• Martin Luther King’s Birthday

• Presidents Day

• Memorial Day

• Juneteenth

• Independence Day

• Labor Day

• Veterans Day

• Columbus Day

• Thanksgiving Day

• Christmas Day

Note: When a holiday falls on a non-workday – Saturday or Sunday – the holiday usually is observed on Monday (if the holiday falls on Sunday) or Friday (if the holiday falls on Saturday)

Any other day designated by Federal statue, by Executive Order or by the President’s proclamation.

In the event CBP grants administrative leave to its Government employees, on-site Contractor personnel shall also be dismissed if the site is closed. In each instance when the site is closed to Contractor personnel because of inclement weather, potentially hazardous conditions, explosions, or other special circumstances, the Contractor shall direct its staff in accordance and OPM Operating Status for the Washington, DC area available by calling (202) 606-1900 or at http://www.opm.gov/Operating_Status_Schedules

Travel Travel is not required to support the tasks outlined in this SOW.

7.0 GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION (GFE / GFI)

Government Furnished Equipment (GFE) will be provided as part of this contract. The Government will provide office space and basic equipment, including desktops, laptops, and/or http://www.opm.gov/Operating_Status_Schedules mobility devices to be used for Official Government business only. The Contractor shall maintain an inventory of GFE, which shall be made available to the COR upon request. The Contractor shall be responsible for maintaining, securing, accounting, and inventorying.

All such Government furnished information and equipment remains the property of the Government. The Contractor shall be responsible for maintaining all GFE until such GFE is removed from the Contractor’s accountability. The Government reserves the right to inspect the GFE upon notice.

8.0 PERIOD AND PLACE OF PERFORMANCE

The Period of Performance for this Task Order is a total of four (4) years, which consists of a 12-month base period and three (3) 12-month Option Periods. The base period of performance is (00/00/2026 – 00/00/0000) for 12 months. CBP is currently exercising the Base Period.

Base Period: Date of Award for One Year Option Period 1: One Year from the end of the Base Period Option Period 2: One Year from the end of Option Period 1 Option Period 3: One Year from the end of Option Period 2

Place of Performance US Customs and Border Protection 22001 Loudoun County Parkway Ashburn VA, 20147

9.0 SECURITY REQUIREMENTS

This work is Unclassified and considered Law Enforcement Sensitive.

The Contractor shall comply with Government administrative, physical, and technical security controls to ensure the Government’s security requirements are met. During the course of this task order, Contractor must not use, disclose, or reproduce data which bears a restrictive legend, other than as required in the performance of this SOW. Prior to commencement of any work, the Contractor must sign a Non-Disclosure Agreement (NDA) in presence of the COR.

All Government furnished information must be protected to the degree and extent required by local rules, regulations, and procedures. Contractor must conform to all security policies contained in the Security Policies and Procedures documentation. All services provided under this task order must be compliant with Information Security Policy, identified in MD4300.1, Information Technology Systems Security Program and 4300A Sensitive Systems Handbook.

9.1 Security Clearances: Personnel Background Data

A BI is required for performance under this effort. Contractor employees shall not begin working until the BI is approved by CBP, Security Programs Division. Exceptions to this requirement will be handled on a case-by-case basis, and access to facilities, systems, data, etc.

will be limited until the individual is cleared. All personnel employed by the Contractor for performance under this Task Order shall either currently possess or be able to favorably pass a background investigation. It is highly recommended that the Contractor have employees who have already passed a CBP BI. Task orders shall reflect any additional security clearance requirements beyond a CBP BI (e.g., Secret, Top Secret, etc.) that may be required.

All personnel employed by the Contractor or responsible to the Contractor for work performed hereunder shall either currently possess or be able to favorably pass a full 5-year BI required by CBP policies and procedures for employment prior to beginning work with CBP. This policy applies to any new personnel hired during the term of this task order. Executive Order 13467 allows for the acceptance of “suitability reciprocity” to contract personnel who are component employees within DHS.

The Contractor shall submit within ten (10) working days after award: A list containing the full name, Social Security Number, and date of birth of those people who shall require BIs by CBP and submit such information and documentation as may be required by the Government to have a BI performed.

Information must be correct and reviewed by the designated CBP Security Official for completeness. Normally, information requests for a BI consists of SF-85P, “Questionnaire for Public Trust Positions” or SF-86, “Questionnaire for Sensitive Positions (For National Security)” TDF 67-32.4 “U.S. USCS Authorization for Release of Information”, FD-258, “Fingerprint Charts” and a Financial Statement. Failure of any contract personnel to successfully pass a BI shall be cause for the candidate’s immediate dismissal from the project and replacement by a similar and equally qualified candidate as determined and approved by the CO/COR. This policy also applies to any personnel hired as replacements during the term on the task order.

All BI forms must be accepted by CBP with verbal approval from a representative for CBP Office of Management Inspection and Integrity Assurance, Security Program Division (MIIA- SPD) before contract personnel can begin work under this order. MIAA-SPD estimates these procedures will take approximately ten (10) days from the time they receive the packet.

Currently, completion of BIs is taking approximately six (6) months from initial acceptance of the package.

The Contractor shall notify the COR and CBP OIT Workforce Management Group (WMG), BI Coordinator of any changes in access requirements for its personnel no later than one (1) business day after any personnel changes occur. This includes name changes, resignations, terminations, and reassignments, including those to another contract. The Contractor/Project Manager/Program Manager is responsible for the completion and timely submission to the COR of the CF-242 for all departing task order personnel.

Full Name

Social Security Number

Effective Date

Reason for change

In accordance with Customs Directive No. 51715-006, “Separation procedures for Contractor Employees (CF-242),” the Contractor is responsible for ensuring that contract employees separating from the agency complete the relevant portions of the CF-242. This requirement covers all Contract employees who depart while the contract is still active (including resignations, terminations, etc.) or upon final completion of contract. Failure of a Contractor to properly comply with these requirements shall be documented and considered when completing Contractor Performance Reports.

9.2 General Security Requirements

All GFI must be protected to the degree and extent required by local rules, regulations, and procedures. The Contractor shall conform to all security policies contained in the “CBP Information Systems Security Policies and Procedures Handbook,” CIS HB 1400-05C.

All services provided under this SOO must be compliant with DHS Information Security Policy, identified in MD 4300.1, “Information Technology Systems Security Program” and DHS 4300A, “Sensitive Systems Directive version 13.3.”

During the course of this task, the Contractor shall not use, disclose, or reproduce data which bears a restrictive legend other than as required in the performance of this contract.

9.3 Contractor Suitability

All Contractors shall have appropriately adjudicated suitability BIs and shall be US citizens.

Under normal conditions, only U.S. Citizens are allowed access to DHS systems and networks, however, at times there is a need to grant access to foreign nationals. If a non-US citizen has access to OIT assets, appropriate exceptions must be documented in accordance with DHS policy.

Access for foreign nationals is normally a long-term commitment, and exceptions to appropriate policies are treated separately from standard exceptions and waivers. The approval chain for an exception to the U.S. Citizenship requirement flows through the Component Head, the Office of Security, and the Chief Information Officer.

9.4 Clearances

Contractor personnel under this contract will require a CBP BI or an in-process CBP BI.

All Contractor employees shall always be required to wear CBP Identification badges when working in Government facilities.

9.5 Identification Badge

All Contractor employees shall be required to wear CBP Identification badges at all times when working in Government facilities.

9.6 Transition in Plan

The Contractor shall plan for and facilitate the smooth and effective start of performance under this contract. The Contractor shall develop a Transition in Plan that identifies all activities required to progress from start-up to becoming fully integrated into current operations within ninety (90) calendar days after contract award.

9.7 Transition out Plan

The Contractor shall plan for and support an orderly and efficient transition from the contract beginning at the direction of the COR and Technical SME (approximately three months prior to the end of the period of performance). The Contractor shall develop a Transition out Plan that includes the full range of plans and activities required to bring the work effort to logical completion where possible and record the status of any and all work-in-progress that will be delivered to the Government for use at the Government’s discretion.

9.8 Contractor Pre-Screening

Contractors requiring recurring access to Government facilities or access to sensitive but unclassified information and/or logical access to IT resources shall verify minimal suitability requirements, as described below, for all persons/candidates designated for employment under any CBP contract by pre-screening the person/candidate prior to submitting the name for consideration. Pre-screening the candidate ensures that minimum suitability requirements are considered and mitigates the burden of DHS having to conduct background investigations on objectionable candidates. The Contractor shall submit only those candidates that have not had a felony conviction within the past 36 months or illegal drug use within the past 12 months from the date of submission of their name as a candidate to perform work under this contract. Contractors are required to flow this requirement down to subcontractors. Pre-screening involves contractors and subcontractors reviewing:

i. Felony convictions within the past 36 months. An acceptable means of obtaining information on felony convictions is from public records, free of charge, or from the National Crime Information Center (NCIC).

ii. Illegal drug use within the past 12 months. An acceptable means of obtaining information related to drug use is through employee self-certification, by public records check; or if the contractor or subcontractor already has drug testing in place. There is no requirement for contractors and/or subcontracts to initiate a drug testing program if they do not have one already in place.

iii. Misconduct such as criminal activity on the job relating to fraud or theft within the past 12 months. An acceptable means of obtaining information related to misconduct is through employee self-certification, by public records check, or other reference checks conducted in the normal course of business.

iv. Financial irresponsibility related to tax liens and bankruptcy within the last 7-10 years.

An acceptable means of obtaining information related to financial irresponsibility is through a financial background check.

Pre-screening shall be conducted within fifteen (15) business days after contract award. This requirement shall be placed in all subcontracts if the subcontractor requires routine physical access, access to sensitive but unclassified information, and/or logical access to IT resources.

Failure to comply with the pre-screening requirement will result in the CO taking the appropriate remedy.

9.9 Physical and IT Security Requirements

Provide qualified personnel to perform the work required by this Statement of Work requiring:

A. Supervision of personnel in the performance of their duties B. Providing instructions to contractor employees to ensure that work progresses on schedule to meet any required deadlines and any accuracy requirements C. Coordination with Government personnel in the assignment and prioritization of requested work D. Assurance that all deliverables are submitted as required E. When determined to be appropriate, contractor employees may be required to execute a non-disclosure agreement as a condition to access sensitive but unclassified information.

The Contractor shall ensure that its employees follow the general procedures governing physical, environmental, and information security described in the various DHS CBP regulations identified in this clause. The Contractor shall ensure that its employees apply proper business practices in accordance with the specifications, directives, and manuals required for conducting work under this contract. Applicable Contractor personnel shall be responsible for physical security of work areas and CBP furnished equipment issued under this contract.

The CO/COR may require the Contractor to prohibit its employees from working on this contract if continued employment becomes detrimental to the public’s interest for any reason including, but not limited to carelessness, insubordination, incompetence, or security concerns.

Work under this contract may require access to sensitive information as defined under Homeland Security Acquisition Regulation (HSAR) Clause 3052.204-71, Contractor Employee Access, included in the solicitation/contract. The Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the CO.

The Contractor shall ensure that its employees who are authorized access to sensitive information, receive training pertaining to protection and disclosure of sensitive information. The training shall be conducted during and after contract performance.

Upon completion of this contract, the Contractor shall return all sensitive information used in the performance of the contract to the CO/COR. The Contractor shall certify, in writing, that all sensitive and non-public information has been purged from any Contractor-owned system.

9.10 Remote Access

Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Contractor performs business for the DHS Component. It is not a right, a guarantee of access, a condition of the contract, or Government Furnished Equipment (GFE).

10.0 TASK ORDER ADMINISTRATION:

Task Monitor To be Determined

Subject Matter Expert (SME) To be Determined

Contracting Officer Representative (COR) Name: TBD Phone: TBD Email: TBD

Notwithstanding the contractor’s responsibility for management during performance, the administration of this task order will require some coordination between the CBP and the contractor. The Contracting Officer (CO) will appoint a Contracting Officer’s Representative (COR) to ensure orderly performance of the tasks and provide technical direction. The types of actions within the purview of the COR’s authority are to assure that the contractor performs the technical requirements of the contract; to perform or cause to be performed inspections necessary in connection with performance of the contract; to maintain both written and oral communications with the contractor concerning the aspects of the task order within his/her purview; to issue interpretations of technical requirements; to monitor the contractor’s performance under the task order and notify the contractor and CO of any deficiencies observed; and to coordinate Government-Furnished Property or Data availability and provide for site entry of contractor personnel if required.

The COR will provide no supervision to contractor personnel. The COR is not empowered to make any commitments or changes which affect the task order price or other items and conditions. Any such proposed changes must be brought to the immediate attention of the CO for action. Only the Contracting Officer has the authority to represent the Government in cases where the task order requires a change in the terms and conditions, delivery schedule, scope of work and/or price of the products and/or services under this task order. The acceptance of any changes by the contractor without specific approval and written consent of the CO shall be at the contractor’s risk.

11.0 Technical Direction

Performance of the work shall be subject to the technical direction of the Contracting Officer’s Representative (COR). The term "technical direction" is defined to include the following:

a. Technical directions to the Contractor which shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual scope of work;

b. Providing information to the Contractor for assistance in the interpretation of drawings, specifications, or technical portions of the work description; and

c. Review and, where required by the contract, approval of technical reports, drawings, specifications; and technical information to be delivered by the Contractor to the Government under the contract.

Technical direction will be within the general scope of work stated in the contract. The COR does not have the authority to, and may not, issue any technical direction which (1) constitutes an assignment of additional work outside the general scope of the contract; (2) constitutes a change as defined in the contract clause entitled "Changes," (3) in any manner causes an increase or decrease in the total contract price; or (4) changes any of the expressed terms, conditions, or specifications of the contract.

Invoice Instructions NOTE: Failure to follow the instructions below may cause delays in payment.

The Contractor shall submit a monthly firm-fixed price invoice for professional services costs.

Payment requests shall be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

Invoices shall be electronically transmitted to the COR as listed in Section 10, and the Contractor shall invoice CBP in accordance with CBP invoicing clause, “Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP) (JAN 2016)”.

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b), “Payment documentation and process". The IPP website address is: https://www.ipp.gov.

• Purchase Order number

• Description of services provided for a specified time period.

• Unit price and total amount of each item.

• Discount terms

• Company name, telephone number, taxpayer’s identification number, and complete mailing address to which payment will be mailed.

A courtesy e-mail notification shall be sent by the Contractor to the COR prior to submission in

IPP.

12.0 UNIQUE STANDARDS

CBP Contractor Handling PII Level https://www.ipp.gov/

When a contractor, on the behalf of CBP, handles Sensitive PII data, stores and transmits, the contractor will Accredit (ATO) this information system to the (HHM) FIPS level.

Unclassified Requests ISO Terms and Conditions for Sensitive but Unclassified Requests

DHS Security Policy Requirement The following terms and conditions should be included in all acquisition documents.

All hardware, software, and services provided under this task order must be compliant with DHS Sensitive Systems Directive 4300A (version 13.3, February 13, 2023).

Encryption Compliance Requirement The following terms and conditions should be included in all acquisition documents.

1. FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

2. National Security Agency (NSA) Type 2 or Type 1 encryption.

3. Public Key Infrastructure (PKI) (see DHS Sensitive Systems Directive 4300A (version 13.3, February 13, 2023)

Security Review The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer’s Technical Representative (COTR), and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

Interconnection Security Agreement (ISA) The following requirements should be included in the acquisition document if the service being supplied requires a connection to a non-DHS, Contractor system, or DHS system of different sensitivity.

Interconnection Security Agreement Requirements Interconnections between DHS and non- DHS IT systems shall be established only through controlled interfaces and via approved service providers. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements.

Required Protections for DHS Systems Hosted in Non-DHS Data Centers The following requirements should be included in acquisition documents for information systems which are hosted, operated, maintained, and used on behalf of DHS at non-DHS facilities.

Contractors are fully responsible and accountable for ensuring compliance with all Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) and related DHS security control requirements (to include configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance). The contractor security procedures shall be the same or greater than those that are provided by DHS Enterprise Data Center(s). Please note that all of the subsections from Security Authorization to Log Retention are included in this requirement.

Security Authorization A Security Authorization of any infrastructure directly in support of the DHS information system shall be performed as a general support system (GSS) prior to DHS occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results. The Security Authorization shall be performed in accordance with the DHS Security Policy and the controls provided by the hosting provider shall be equal to or stronger than the FIPS 199 security categorization of the DHS information system.

At the beginning of the contract, and annually thereafter, the contractor shall provide the results of an independent assessment and verification of security controls. The independent assessment and verification shall apply the same standards that DHS applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the COTR for entry into the DHS’ Plan of Action and Milestone (POA&M) Management Process.

The contractor shall use the DHS’ POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS POA&M Management Process. Contractor procedures shall be subject to periodic, unannounced assessments by DHS officials. The physical aspects associated with contractor activities shall also be subject to such assessments.

On a periodic basis, the DHS and its Components, including the DHS Office of Inspector General, may choose to evaluate any or all of the security controls implemented by the contractor under these requirements. Evaluation could include, but it not limited to vulnerability scanning. The DHS and its Components reserve the right to conduct audits at their discretion. With ten working days’ notice, at the request of the Government, the contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein DHS information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of DHS, including those initiated by the Office of the Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by DHS in the event of a security incident.

Enterprise Security Architecture The contractor shall utilize and adhere to the DHS Enterprise Security Architecture in accordance with applicable laws and DHS policies to the satisfaction of the DHS COTR. Areas of consideration could include:

1. Use of multi-tier design (separating web, application and data base) with policy enforcement between tiers

2. Compliance to DHS Identity Credential Access Management (ICAM)

3. Security reporting to DHS central control points (i.e. the DHS Security Operations Center (SOC) and integration into DHS Security Incident Response

4. Integration into DHS Change Management (for example, the Infrastructure Change Control Board (ICCB) process)

5. Performance of activities per continuous monitoring requirements

Enterprise Architecture Compliance The Offeror shall ensure that the design conforms to the Department of Homeland Security (DHS) and Customs and Border Protection (CBP) Enterprise Architecture (EA), the DHS and CBP Technical Reference Models (TRM), and all DHS and CBP policies and guidelines (such as the CBP Information Technology Enterprise Principles and the DHS Service Oriented Architecture - Technical Framework), as promulgated by the DHS and CBP Chief Information Officers (CIO), Chief Technology Officers (CTO) and Chief Architects (CA).

The Offeror shall conform to the Federal Enterprise Architecture (FEA) model and the DHS and CBP versions of the FEA model, as described in their respective EAs. All models will be submitted using Business Process Modeling Notation (BPMN 1.1 or BPMN 2.0 when available) and the CBP Architectural Modeling Standards. Universal Modeling Language (UML2) may be used for infrastructure only. Data semantics shall be in conformance with the National Information Exchange Model (NIEM). Development solutions will also ensure compliance with the current version of the DHS and CBP target architectures.

Where possible, the Offeror shall use DHS/CBP approved products, standards, services, and profiles, as reflected by the hardware, software, application, and infrastructure components of the DHS/CBP TRM/standards profile. If new hardware, software, or infrastructure components are required to develop, test, or implement the program, these products will be coordinated through the DHS and CBP formal Technology Insertion (TI) process (to include a trade study with no less than http://cbpnet.cbp.dhs.gov/linkhandler/cbpnet/oit/edme/soa.ctt/soa.pdf http://cbpnet.cbp.dhs.gov/linkhandler/cbpnet/oit/edme/soa.ctt/soa.pdf four alternatives, one of which reflecting the status quo and another reflecting multi-agency collaboration). The DHS/CBP TRM/standards profile will be updated as TIs are resolved.

All developed solutions shall be compliant with the Homeland Security (HLS) EA.

All IT hardware and software shall be compliant with the HLS EA.

Compliance with the HLS EA shall be derived from and aligned through the CBP EA.

Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval, and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

Development of data assets, information exchanges, and data standards will comply with the DHS Data Management Policy MD 103-01. All data-related artifacts will be developed and validated according to DHS Data Management Architectural Guidelines.

Applicability of Internet Protocol version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS EA (per OMB Memorandum M-05-22, August 2, 2005), regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant, as defined in the USGv6 Profile (NIST Special Publication 500-267) and the corresponding declarations of conformance, defined in the USGv6 Test Program.

Continuous Monitoring The contractor shall participate in DHS’ Continuous Monitoring Strategy and methods or shall provide a Continuous Monitoring capability that the DHS determines acceptable.