Enterprise License for Biometrics Matching Software

Statement of Work (SOW) / Performance Work Statement (PWS)

This Statement of Work (SOW) aims to define the requirements, deliverables, scope, and performance expectations for a contractor to provide a Department of Homeland Security (DHS)-wide solution for biometric matching software and associated integration services.

• Provide an enterprise-level, scalable, and secure biometric matching software solution.

• Enable seamless integration with existing DHS biometric systems.

• Support multi-modal biometric inputs (e.g., facial recognition, fingerprint, iris, voiceprint) and biographic matching.

• Offer real-time and batch matching capabilities, configurable watchlist management, and search/identification/verification workflows.

• Maintain high accuracy, meeting or exceeding DHS-specified False Accept Rate (FAR) and False Reject Rate (FRR) performance measures.

• Ensure compliance with federal, state, and international privacy and data protection frameworks (e.g., GDPR, CCPA, HIPAA, CJIS) and DHS privacy directives.

• Support data retention, archival, and deletion policies consistent with NARA-approved schedules.

• Implement robust security controls including encryption, role-based access, and integration with DHS security monitoring tools.

• Provide comprehensive audit and monitoring capabilities.

• Support both on-premises and cloud-based deployment models, with scalability for evolving needs.

• Integrate with existing DHS enterprise identity systems, enrollment stations, and biometric sensors.

• Operate reliably across diverse DHS network environments.

• Include liveness detection and presentation attack detection capabilities.

• Support watchlist management capabilities for near-real-time updates and queries.

• Provide quality assurance and biometric quality assessment modules.

• Support multimodal fusion capabilities.

• Support edge-device or distributed deployment models (optional).

• Include disaster recovery capabilities.

• High accuracy, meeting or exceeding DHS-specified FAR and FRR.

• Defined latency targets, uptime SLAs appropriate for mission-critical environments.

• Performance claims must be supported by empirical evidence.

• Deployment across DHS, including but not limited to CBP, ICE, TSA, USCIS, USSS, and Headquarters elements.

• The software will be deployed across DHS, including on-premises data centers, hybrid cloud architectures, and distributed Component networks.

• Personnel qualifications are detailed, including requirements for Program Manager, Deputy Program Manager/Task Order Manager, Technical Lead/Chief Engineer, Biometric Systems Architect, Biometric Quality & Data Analyst, Systems Integration Engineer, and Software Engineer/API Developer.

• Compliance with Section 508 accessibility standards for Information and Communications Technology (ICT).

• Compliance with DHS Enterprise Architecture policies and standards.

• HSPD-12 Compliance for PIV-enabled systems and credentials.

• Contractor employees must comply with Government regulations, policies, and procedures regarding conduct, safety, and security.

• No travel outside the National Capitol Region is anticipated; travel within NCR is not reimbursable.

• Deliverables include Kick Off Meeting, Contract Management Plan, Weekly Status Reports, White papers, Presentations, and Strategic Plans, Monthly Asset Management Report, Annual Inventory Report, Data Dictionary, Enterprise License Package/Licensing Rights, System Integration Plan, Implementation Schedule, Test & Evaluation Materials, Security & Compliance Documentation, Configured Software Release, Training Materials & Sessions, Sustainment Plan, Monthly Status Reports, and Annual Software & Performance Review.

Questions & Answers / Clarifications

This document, "Attachment II - RFI 70RDA126RFI000003 QUESTIONS," contains questions posed by the Department of Homeland Security (DHS) as part of a Request for Information (RFI) regarding an Enterprise License for Biometrics Matching Software. It seeks vendor responses and suggestions on specific areas.

1. Enterprise Biometric Matching Capability & Technical Maturity:

   • Vendors should describe their capability to deliver an enterprise-wide, multi-modal biometric matching solution.
   • Responses should detail supported biometric modalities, technical approach, performance metrics (FAR, FRR, latency, throughput, scalability), support for 1:1 verification/1:N identification, deduplication, watchlist management, scoring, real-time vs. batch processing, evidence of operational deployments, alignment with biometric standards (ISO/IEC 19795, ISO/IEC 30107), presentation attack detection (PAD) capabilities, and approaches to minimizing vendor lock-in and ensuring interoperability.

2. Security, Privacy, Data Governance, and Compliance Posture:

   • Vendors must describe their approach to ensuring security, privacy, and regulatory compliance for a biometric matching solution within DHS environments.
   • Responses should cover encryption methods (at rest/in transit), key management, role-based access controls, least-privilege enforcement, integration with enterprise IAM systems, audit logging capabilities, SIEM integration, forensic analysis support, compliance with frameworks (CJIS, HIPAA, GDPR, CCPA, ISO 27001, SOC 2, FedRAMP), data governance capabilities (minimization, retention, archival, deletion, NARA schedules, data ownership), policies on using government data for training/testing, and data portability/transition support.

3. Scalability, Deployment Flexibility, Licensing, and Sustainment:

   • Vendors need to describe their ability to support DHS enterprise deployment models, elastic scaling, and long-term sustainment.
   • Responses should address support for on-premises, cloud (FedRAMP-authorized), hybrid, and edge deployments (including hardware requirements), architecture for high availability/redundancy/disaster recovery (RTO/RPO), capacity planning and scaling over a 3-5 year horizon, licensing model structure (enterprise-wide use, scaling by volume/modalities/transactions), approach to updates/maintenance/patching/vulnerability management/technical support, and training/documentation/user adoption support. Experience with PoCs, integration testing, and government validation is also requested.

This document clarifies the specific technical, security, and operational details DHS is seeking information on. Vendors responding to the RFI should use this as a guide for their submissions. No specific due dates or submission rules are mentioned in this document, but it directly informs the expected capabilities and requirements for the potential procurement.

Request for Information (RFI)

This RFI is for planning purposes only by the Department of Homeland Security (DHS) to gather information on enterprise-wide, scalable, and secure biometric matching software solutions. DHS is seeking to procure an enterprise license for multi-modal biometric matching software, including associated services, integration support, maintenance, and technical assistance.

• Support for multiple biometric modalities (facial recognition, fingerprint, palm print, iris, voice) and biographic matching.

• Capabilities for real-time and batch processing, search (1:N), verification (1:1), identification, duplication, configurable watchlists, scoring thresholds, and multimodal fusion.

• High performance with demonstrated accuracy, low false accept/reject rates, and strict requirements for latency, throughput, scalability, and uptime.

• Compliance with DHS policies, federal/international frameworks (CJIS, HIPAA, GDPR), ISO biometric standards, robust encryption, role-based access controls, secure key management, and SIEM integration.

• Comprehensive audit logging, chain-of-custody reporting, and support for NARA-approved records retention schedules.

• Support for on-premises, cloud, hybrid, and edge deployments, integration with existing DHS systems via standardized APIs, and minimizing vendor lock-in.

• Capacity planning, high availability, redundancy, disaster recovery (RTO/RPO), and elastic scalability.

• Proof-of-concept validation, integration testing, and security reviews.

• Ongoing sustainment including updates, troubleshooting, training, documentation, and help desk support.

• Anticipated NAICS code: 513210 "Software Publishers"

• Responders are requested to submit a written Capability Statement.

• The response must include a Cover Page with specific identifying information (RFI Title, Company Name, UEI, Business Size, Socio-Economic Status, NAICS code, contractual vehicles, company overview, description of products/services, statement of assurance, client list, contact information).

• Responses must address RFI Questions (Attachment II) and indicate any sections of the Draft SOW (Attachment I) the responder cannot comply with.

• Page limit: 10 pages (excluding cover page and attachments).

• Submissions must be electronic via email to specified points of contact.

• Response Due Date: Wednesday, March 4, 2026, at 10:00 AM Eastern Time.

• Not specified in this RFI; however, respondents must indicate their business size and socio-economic status.

• This RFI is for planning purposes only and is not a solicitation. No contract will be formed based on responses.

• The Government will not pay for response expenses.

• Proprietary, trade secret, or confidential information is not requested and should not be submitted.

• Responses are voluntary and will not provide a competitive advantage in future solicitations.