US Top Level Domain (usTLD) Registry Management Services

Statement of Work (SOW) / Performance Work Statement (PWS)

This document outlines the requirements for an Administrator of the United States country code Top Level Domain (usTLD) registry. The objective is to provide baseline services and innovative program ideas to enhance the usTLD and its services, while promoting a multistakeholder approach to internet governance.

• Centralized management and coordination of registry, registrar, database, and information services for the usTLD.

• Ensuring the administration of the usTLD supports a secure, stable, and resilient Domain Name System (DNS).

• Creating, maintaining, and evolving a policy-rich environment for the usTLD that meets or exceeds industry best practices.

• Accrediting and establishing contractual arrangements with usTLD registrars.

• Advocating for and participating in the multistakeholder system of internet governance.

• Coordinating with NTIA in developing transparent, multistakeholder policy development processes.

• Ensuring the continued stability of the usTLD during management transitions.

• Serving as the usTLD Administrator, overseeing all services, with potential subcontracting subject to approval.

• Providing services as a U.S. entity, with a physical address within the United States, and ensuring primary registry services remain within the U.S.

• Performing all requirements without cost to the U.S. Government.

• Secure, stable, and reliable operation of the usTLD registry functions (e.g., uptime, zone file propagation, database maintenance).

• Implementation of DNSSEC for the usTLD.

• Creation and publication of Route Origin Authorizations.

• Support for Universal Acceptance of Internationalized Domain Names (IDNs) and Email Addresses (IEAs).

• Maintenance of an effective Information Security Management System (compliant with ISO 27001).

• Implementation of cybersecurity controls.

• Establishment of Registry-Registrar and Registrar-Registrant agreements.

• Accreditation of usTLD Registrars based on corporate, operational, and security criteria.

• Process for re-accreditation of existing usTLD Registrars.

• Secure Registration Transfer plan for domain registrations.

• Oversight, audit, and enforcement of compliance of all Registrars and subcontractors.

• Implementation of the United States Nexus Requirement policy and dispute resolution mechanisms.

• Policies and procedures for addressing DNS Abuse and other malicious conduct.

• Trusted notifier programs for website content abuses.

• Protection of intellectual property, including sunrise periods and dispute resolution procedures.

• Policies and procedures for the usTLD Locality Space.

• Maintenance of usTLD Registration Data and Delegated Manager Databases.

• Prohibition of proxy and anonymous services.

• Processes for managing registration data disclosures.

• Ensuring accuracy of usTLD registration data.

• Facilitating meaningful multistakeholder engagement in usTLD policy development.

• Advocacy for and participation in multistakeholder internet governance.

• Implementation and enforcement of other policies, including Registrant Acceptable Use, Data Rights and Use, Domain Name Transfers, Redemption Grace Period, Domain Name Review, Reserved Domain Names List, Code of Conduct, and Conflict of Interest.

• Generation of security process and financial statement audit data.

• Innovative approaches for the revitalization of the kids.us domain.

• Total period of performance: 7 Years (Base Period of 3 Years + 4 Option Periods of 1 Year each).

• Travel is not required under the contract, but contractors may travel to attend ICANN and other meetings at their own expense.

• The Contractor shall not serve as a registrar in the usTLD space, with specific exceptions.

• The Contractor must comply with applicable Internet Engineering Task Force (IETF) RFCs and ICANN policies.

• All documents and materials produced, including usTLD Registry Data, shall be Government-owned.

• The Contractor shall provide a finalized management plan within 30 days of award.

• Public-facing websites and electronic documents must conform to Revised 508 Standards and WCAG 2.0.

• The Contractor shall provide a narrative overview of its fees and a detailed budget.

Questions & Answers / Clarifications

This document contains questions and answers related to the US Top Level Domain (usTLD) Registry Management Services opportunity.

• Question: The Performance Work Statement (PWS) Paragraph 8.0 "Qualifications" references an Appendix for position descriptions, but no such appendix is included in the PWS. Could the Job Description Appendix be provided?
• Answer: (No answer provided in the document.)

This document highlights a missing appendix referenced in the PWS. Bidders should note that the answer to this question is not yet available, which may impact their understanding of qualification requirements.

Solicitation / RFP / RFQ

This document is a draft solicitation for services related to the administration of the .us domain name system (DNS). The U.S. Department of Commerce (DOC) is seeking proposals for a contractor to act as the administrator for the .us TLD, ensuring its secure, stable, and reliable operation, and advancing a multistakeholder approach to Internet governance. This is a no-cost contract for the U.S. Government, meaning the contractor will not receive funding from the government but may establish and collect fees from third parties, subject to Contracting Officer approval.

• Domain Management Operation and Scale: Evidence of operating a TLD with at least two million domains under management (DUM) for at least five years.

• Registrar Connectivity: Details on connections with ICANN-accredited registrars.

• Regulatory Compliance: Description of compliance with relevant security and privacy regulations, supported by examples of security frameworks, certifications, or audits.

• DNS Abuse Mitigation: Proactive measures, strategies, and tools to prevent and mitigate DNS Abuse, including automated tools, monitoring systems, and incentive programs for registrars.

• Addressing DNS Abuse Reports: Process for handling DNS Abuse reports, including registrar obligations and the differing responsibilities of the Registry and Registrar.

• Evidence-Based DNS Abuse Reporting: Use of evidence-based reporting to track, document, and analyze DNS Abuse incidents, with examples and verification mechanisms.

• Illegal and Egregious Website Content: Tools and methodologies to detect, address, and prevent Child Sexual Abuse Materials (CSAM), illicit opioid distribution, and other egregious content.

• Transparency Reporting: Details on transparency reports related to DNS Abuse, court orders, and law enforcement requests.

• Due Process and Appeal Mechanisms: Procedures for registrant appeals of anti-abuse actions.

• Registrant Compliance Auditing and Verification: Approach to auditing registrants for nexus requirement compliance.

• Registrar Accreditation Plan: Plan to ensure registrars are accredited and comply with security standards (e.g., ISO 27001).

• Electronic and Information Technology (EIT): All electronic documents must meet Section 508 of the Rehabilitation Act accessibility requirements.

• Contract Type: No-cost contract ($0.00) for the U.S. Government. Contractor may collect fees from third parties.

• Period of Performance: Transition period (up to 9 months), base period (36 months), and four (4) one-year option periods, totaling up to 7 years.

• Place of Performance: United States.

• Phased Procurement: The procurement will be conducted in two phases. Phase 1 involves submission of Technical Volume I (Demonstrated Experience & Approach). Phase 2 involves submission of Technical Volume II (Work Statement Submissions) and Cost Volume (Fee Structure with Cost Narrative).

• Evaluation Factors:

  • Phase 1: Demonstrated Experience & Approach (Factor 1)
  • Phase 2: Work Statement Submissions (Factor 2) and Cost Volume (Factor 3).

• Importance: Factors 1 and 2 are more important than Factor 3.

• Proposal Submission: Specific page limits and formatting requirements are detailed in Section L.

• Questions Due: January 8, 2026, by 2:00 PM ET.

• The solicitation is for Small Business (unrestricted).

• NAICS Code: 561110 (Office Administrative Services).

• This is a draft solicitation; dates are subject to change.

• Offerors are directed to submit questions during the draft solicitation phase only.

• Active SAM registration is required.

• The Government may contact Reference POCs for prior experience verification and review CPARS data.