ROC Wins $64.3M DOJ Contract for Digital Evidence Platform

Updates

1. Sep 30, 4:05 PM ET · SEC 8-K — The 8-K adds contract terms including a small business set-aside, PII breach reporting within one hour, and LLM compliance with Unbiased AI Principles.

   • Contract Structure
     • The contract's effective date is September 14, 2026.
     • The contract number is 15JPSS26F00001694.
     • The contract is a small business set-aside.
     • The contract's NAICS code is 541511.
     • Base period services are time and materials with a not-to-exceed amount, while licenses are firm fixed price.
     • Base period licenses include ROC-EV-BASELIC, ROC-EV-PROC-DEVICE, ROC-EV-STOR- -COLD-ADV, and ROC-EV-STOR- -HOT.
     • Option period licenses are at annually escalating unit prices.
     • First option period services are time and materials; second through seventh option periods are firm fixed price for operations, maintenance, and support.
     • Exercise of option periods is subject to the availability of appropriations.
     • Base period travel costs are subject to a not-to-exceed amount per period of performance.
     • Option periods include travel costs, firm fixed price, not-to-exceed per period of performance.
     • Per device license cost includes ROC-EV-ANLYT- under item 2003AB.
     • Government may extend services for up to 6 months beyond contract expiration under FAR 52.217-8.
     • Government must give preliminary written notice of intent to extend 30 days prior under FAR 52.217-9.
   • Termination — The government has the right to terminate the contract for its convenience or for cause. Termination for Government's convenience: Government may terminate by written notice; Contractor shall be paid for work performed and reasonable charges. Termination for cause: Contractor liable for non-accepted items; Government must provide a cure notice before termination.
   • PII Breach
     • The contractor must report any actual or suspected breach of Personally Identifiable Information (PII) within one hour of discovery.
     • The contractor is responsible for notifying victims and providing victim remediation services for PII breaches at DOJ's request.
     • Contractor should be self-insured for PII breach response and victim remediation costs.
     • Breach reports must be made to the DOJ Security Operations Center (dojcert@usdoj.gov, 202-357-7000), Component-level Security Operations Center, COR, and Contracting Officer.
     • A written report of a breach must be provided to the DOJ Security Operations Center within 24 hours, detailing events, amount/type/sensitivity of information, and cause.
     • Contractor must provide full access and cooperation for incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.
     • Victim remediation services include at least 18 months of credit monitoring and, for serious or large incidents as determined by the Government, call center help desk services for the individuals whose PII was lost or compromised.
   • LLM Requirements
     • Any Large Language Model (LLM) provided must adhere to Unbiased AI Principles, truth-seeking, and ideological neutrality.
     • Failure to comply with LLM provisions can lead to contract termination for default and contractor responsibility for costs and damages.
     • Specific disclosure obligations for any Large Language Model (LLM) provided are required under DOJ-09.
     • Definitions of "Large language model" (LLM) and "Restricted Intellectual Property" are provided.
     • LLMs must adhere to Unbiased AI Principles, truth-seeking, and ideological neutrality as set forth in Executive Order 14319, Preventing Woke AI in the Federal Government (July 23, 2025).
     • LLMs must provide a meaningful option for end-users to submit feedback and provide notice on outputs, including those violating Unbiased AI Principles.
     • Specific disclosure obligations for LLM provision include acceptable use policy, model/system/data cards, architecture decision records, API documentation, and development artifacts.
     • The LLM requirements flow down to subcontractors at all tiers.
   • Payment Terms
     • Payments under time-and-materials contracts include hourly rate components and substantiation per FAR 52.232-7.
     • Hourly rates include wages, indirect costs, general and administrative expense, and profit.
     • Vouchers may be submitted not more than once every two weeks, with more frequent payments for small businesses.
     • Contracting Officer may unilaterally require withholding of 5% (up to $50,000) from billings until a reserve is set aside.
     • Hourly rates in the Schedule shall not be varied by overtime unless approved in advance by the Contracting Officer.
     • "Materials" definition includes direct materials, subcontracts for supplies, other direct costs, and applicable indirect costs.
     • Payment for contractor-furnished commercial materials shall not exceed the contractor's established catalog or market price.
     • Government will reimburse for allowable cost of materials, but generally will not pay profit or fee to the prime Contractor on materials.
     • Contractor must use best efforts to perform within the ceiling price and notify the Contracting Officer if 85% of the ceiling is reached.
     • Government is not obligated to pay above the ceiling price, and Contractor is not obligated to continue performance if it would exceed the ceiling, unless Contracting Officer increases ceiling in writing.
     • Contracting Officer may audit vouchers and supporting documentation at any time before final payment.
     • Contractor and assignees must execute a release of claims at the time of final payment, with specified exceptions.
     • Interim payments are contract financing payments and are not subject to Prompt Payment Act interest penalty provisions.
   • Security and Personnel
     • Personnel security requirements include background investigations, citizenship, identity proofing, and self-reporting.
     • Contractor must maintain performance during emergencies via cross-training, telework, and communication.
     • Contractor must safeguard covered information systems by implementing specific security controls, including limiting access, verifying connections, and protecting from malicious code.
     • Contractor must distribute the "Whistleblower Information for Employees of DOJ Contractors, Subcontractors, Grantees, or Sub-Grantees or Personal Services Contractors" document within 30 days of award and confirm within 45 days.
     • Prohibition on performing work outside authorized Government facilities/networks/equipment unless specifically authorized.
     • Contractor must obtain Contracting Officer's approval before engaging any subcontractor requiring disclosure of contract-related information.
     • Contractor must complete and submit a separation checklist for any employee terminating work, verifying return of equipment, disposition of PII, and termination of access.
     • All employees/subcontractors with PII access must take appropriate privacy training annually, including heightened security for sensitive PII and breach reporting.
     • Contractor employees must comply with DOJ Order 0904 and other guidance for safeguarding PII, including encryption of sensitive PII.
     • All contractor personnel with PII/sensitive information access must sign a Non-Disclosure Agreement (NDA) and DOJ IT Rules of Behavior.
     • Prohibition on regularly storing or including sensitive PII in Contractor's invoicing, billing, or administrative records without written permission.
     • All employees and Subcontractors who have access to PII or are involved in the creation, use, dissemination, and/or destruction of PII must take appropriate privacy training at the outset of work and every year thereafter, including DOJ Records and Information Management (RIM) training.
     • Government Agency owns rights to all electronic information, systems, databases, and deliverables created under the contract.
     • Contractor shall not retain, use, sell, disseminate, or dispose of government data/records or deliverables without express written permission.
     • Use of real data containing PII for testing or training purposes is generally prohibited; synthetic or de-identified data should be used.
     • Contractor must obtain an Authority To Operate (ATO) for any Contractor IT environment hosting Government data.
     • Contractor must support completion of Initial Privacy Assessment (IPA), Privacy Impact Assessment (PIA), and System of Records Notice (SORN) documents.
     • All contractor personnel are subject to Public Trust Positions, requiring security investigations.
     • Contractor employees must meet a residency requirement of 3 years out of the last 5 years in the U.S. or working for the U.S. abroad.
     • For Public Trust positions, contractor employees must be U.S. citizens/nationals or lawful permanent residents seeking U.S. citizenship, with specific waiver processes for non-U.S. citizens.
     • Dual citizenship status will be a consideration in the Public Trust Investigation (PTI) adjudication.
     • Non-U.S. citizens are not authorized to access DOJ IT systems unless a waiver is granted by the Head of the DOJ component with DSO/CIO concurrence.
     • Non-U.S. citizens are not authorized unescorted access to DOJ facilities/space unless a waiver is granted by the DSO.
     • Minimum background investigation required is Tier 4 (T4) for High Risk positions, Tier 2 (T2) for Moderate Risk, and Tier 1 (T1) for Low Risk/Non-Sensitive positions.
     • Short-term U.S. citizen contractor employees (6 months or less) require an approved pre-employment background investigation waiver.
     • Long-term U.S. citizen employees (longer than 6 months) and all non-U.S. citizen employees are subject to a full background investigation.
     • Reciprocity for existing Public Trust Investigations is accepted if current (within 5 years), favorably adjudicated, and meets/exceeds level.
     • The background investigation process involves completing e-QIP, designating an e-QIP Initiator, and submitting additional documentation including digital fingerprinting and credit report.
     • Pre-employment background investigation waivers require verification of citizenship, residency compliance, favorable security questionnaire, FBI fingerprint results, and credit report.
     • Identity proofing requires in-person appearance, checking two forms of original identification, and compliance with PIV card/building access badge requirements.
     • All contractor employees must sign the DOJ Self-Reporting Requirements statement and immediately self-report certain information using the Department's iReport system.
     • The government may direct the contractor, at its own expense, to remove and replace any contractor personnel who fails to comply with requirements.
     • Contractor must advise the government contracting officer if they anticipate not being able to perform and assist in estimating adverse impacts.
     • The Department reserves the right to use federal employees, employees of other agencies, or other contractors for critical support services during emergencies.
   • Compliance and Records
     • EULA or TOS clauses requiring Government indemnification are unenforceable.
     • Comptroller General has access to and right to examine contractor's directly pertinent records for 3 years after final payment.
     • Contractor must inform employees in writing of whistleblower rights and protections under 41 U.S.C. 4712.
     • Contractor must report annually by October 31 for services performed, including total dollar invoiced and direct labor hours, and first-tier subcontractor information.
   • Other details
     • ROC-EV-STOR- -COLD-ADV license is an annual recurring software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs.
   All 85 details

   • The contract is with the U.S. Department of Justice Executive Office for United States Attorneys (EOUSA).
   • The contract's effective date is September 14, 2026.
   • The contract number is 15JPSS26F00001694.
   • The contract is a small business set-aside.
   • The contract's NAICS code is 541511.
   • Base period services are time and materials with a not-to-exceed amount, while licenses are firm fixed price.
   • Base period licenses include ROC-EV-BASELIC, ROC-EV-PROC-DEVICE, ROC-EV-STOR- -COLD-ADV, and ROC-EV-STOR- -HOT.
   • Option period licenses are at annually escalating unit prices.
   • First option period services are time and materials; second through seventh option periods are firm fixed price for operations, maintenance, and support.
   • The government has the right to terminate the contract for its convenience or for cause.
   • The contractor must report any actual or suspected breach of Personally Identifiable Information (PII) within one hour of discovery.
   • The contractor is responsible for notifying victims and providing victim remediation services for PII breaches at DOJ's request.
   • Any Large Language Model (LLM) provided must adhere to Unbiased AI Principles, truth-seeking, and ideological neutrality.
   • Failure to comply with LLM provisions can lead to contract termination for default and contractor responsibility for costs and damages.
   • Exercise of option periods is subject to the availability of appropriations.
   • Base period travel costs are subject to a not-to-exceed amount per period of performance.
   • Option periods include travel costs, firm fixed price, not-to-exceed per period of performance.
   • Per device license cost includes ROC-EV-ANLYT- under item 2003AB.
   • Government may extend services for up to 6 months beyond contract expiration under FAR 52.217-8.
   • Government must give preliminary written notice of intent to extend 30 days prior under FAR 52.217-9.
   • Payments under time-and-materials contracts include hourly rate components and substantiation per FAR 52.232-7.
   • Contractor should be self-insured for PII breach response and victim remediation costs.
   • Specific disclosure obligations for any Large Language Model (LLM) provided are required under DOJ-09.
   • Personnel security requirements include background investigations, citizenship, identity proofing, and self-reporting.
   • Contractor must maintain performance during emergencies via cross-training, telework, and communication.
   • ROC-EV-STOR- -COLD-ADV license is an annual recurring software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs.
   • Termination for Government's convenience: Government may terminate by written notice; Contractor shall be paid for work performed and reasonable charges.
   • Termination for cause: Contractor liable for non-accepted items; Government must provide a cure notice before termination.
   • EULA or TOS clauses requiring Government indemnification are unenforceable.
   • Comptroller General has access to and right to examine contractor's directly pertinent records for 3 years after final payment.
   • Contractor must inform employees in writing of whistleblower rights and protections under 41 U.S.C. 4712.
   • Contractor must report annually by October 31 for services performed, including total dollar invoiced and direct labor hours, and first-tier subcontractor information.
   • Hourly rates include wages, indirect costs, general and administrative expense, and profit.
   • Vouchers may be submitted not more than once every two weeks, with more frequent payments for small businesses.
   • Contracting Officer may unilaterally require withholding of 5% (up to $50,000) from billings until a reserve is set aside.
   • Hourly rates in the Schedule shall not be varied by overtime unless approved in advance by the Contracting Officer.
   • "Materials" definition includes direct materials, subcontracts for supplies, other direct costs, and applicable indirect costs.
   • Payment for contractor-furnished commercial materials shall not exceed the contractor's established catalog or market price.
   • Government will reimburse for allowable cost of materials, but generally will not pay profit or fee to the prime Contractor on materials.
   • Contractor must use best efforts to perform within the ceiling price and notify the Contracting Officer if 85% of the ceiling is reached.
   • Government is not obligated to pay above the ceiling price, and Contractor is not obligated to continue performance if it would exceed the ceiling, unless Contracting Officer increases ceiling in writing.
   • Contracting Officer may audit vouchers and supporting documentation at any time before final payment.
   • Contractor and assignees must execute a release of claims at the time of final payment, with specified exceptions.
   • Interim payments are contract financing payments and are not subject to Prompt Payment Act interest penalty provisions.
   • Contractor must safeguard covered information systems by implementing specific security controls, including limiting access, verifying connections, and protecting from malicious code.
   • Contractor must distribute the "Whistleblower Information for Employees of DOJ Contractors, Subcontractors, Grantees, or Sub-Grantees or Personal Services Contractors" document within 30 days of award and confirm within 45 days.
   • Prohibition on performing work outside authorized Government facilities/networks/equipment unless specifically authorized.
   • Contractor must obtain Contracting Officer's approval before engaging any subcontractor requiring disclosure of contract-related information.
   • Contractor must complete and submit a separation checklist for any employee terminating work, verifying return of equipment, disposition of PII, and termination of access.
   • All employees/subcontractors with PII access must take appropriate privacy training annually, including heightened security for sensitive PII and breach reporting.
   • Contractor employees must comply with DOJ Order 0904 and other guidance for safeguarding PII, including encryption of sensitive PII.
   • All contractor personnel with PII/sensitive information access must sign a Non-Disclosure Agreement (NDA) and DOJ IT Rules of Behavior.
   • Prohibition on regularly storing or including sensitive PII in Contractor's invoicing, billing, or administrative records without written permission.
   • Breach reports must be made to the DOJ Security Operations Center (dojcert@usdoj.gov, 202-357-7000), Component-level Security Operations Center, COR, and Contracting Officer.
   • A written report of a breach must be provided to the DOJ Security Operations Center within 24 hours, detailing events, amount/type/sensitivity of information, and cause.
   • Contractor must provide full access and cooperation for incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.
   • Victim remediation services include at least 18 months of credit monitoring and, for serious or large incidents as determined by the Government, call center help desk services for the individuals whose PII was lost or compromised.
   • All employees and Subcontractors who have access to PII or are involved in the creation, use, dissemination, and/or destruction of PII must take appropriate privacy training at the outset of work and every year thereafter, including DOJ Records and Information Management (RIM) training.
   • Government Agency owns rights to all electronic information, systems, databases, and deliverables created under the contract.
   • Contractor shall not retain, use, sell, disseminate, or dispose of government data/records or deliverables without express written permission.
   • Use of real data containing PII for testing or training purposes is generally prohibited; synthetic or de-identified data should be used.
   • Contractor must obtain an Authority To Operate (ATO) for any Contractor IT environment hosting Government data.
   • Contractor must support completion of Initial Privacy Assessment (IPA), Privacy Impact Assessment (PIA), and System of Records Notice (SORN) documents.
   • All contractor personnel are subject to Public Trust Positions, requiring security investigations.
   • Contractor employees must meet a residency requirement of 3 years out of the last 5 years in the U.S. or working for the U.S. abroad.
   • For Public Trust positions, contractor employees must be U.S. citizens/nationals or lawful permanent residents seeking U.S. citizenship, with specific waiver processes for non-U.S. citizens.
   • Dual citizenship status will be a consideration in the Public Trust Investigation (PTI) adjudication.
   • Non-U.S. citizens are not authorized to access DOJ IT systems unless a waiver is granted by the Head of the DOJ component with DSO/CIO concurrence.
   • Non-U.S. citizens are not authorized unescorted access to DOJ facilities/space unless a waiver is granted by the DSO.
   • Minimum background investigation required is Tier 4 (T4) for High Risk positions, Tier 2 (T2) for Moderate Risk, and Tier 1 (T1) for Low Risk/Non-Sensitive positions.
   • Short-term U.S. citizen contractor employees (6 months or less) require an approved pre-employment background investigation waiver.
   • Long-term U.S. citizen employees (longer than 6 months) and all non-U.S. citizen employees are subject to a full background investigation.
   • Reciprocity for existing Public Trust Investigations is accepted if current (within 5 years), favorably adjudicated, and meets/exceeds level.
   • The background investigation process involves completing e-QIP, designating an e-QIP Initiator, and submitting additional documentation including digital fingerprinting and credit report.
   • Pre-employment background investigation waivers require verification of citizenship, residency compliance, favorable security questionnaire, FBI fingerprint results, and credit report.
   • Identity proofing requires in-person appearance, checking two forms of original identification, and compliance with PIV card/building access badge requirements.
   • All contractor employees must sign the DOJ Self-Reporting Requirements statement and immediately self-report certain information using the Department's iReport system.
   • The government may direct the contractor, at its own expense, to remove and replace any contractor personnel who fails to comply with requirements.
   • Contractor must advise the government contracting officer if they anticipate not being able to perform and assist in estimating adverse impacts.
   • The Department reserves the right to use federal employees, employees of other agencies, or other contractors for critical support services during emergencies.
   • Definitions of "Large language model" (LLM) and "Restricted Intellectual Property" are provided.
   • LLMs must adhere to Unbiased AI Principles, truth-seeking, and ideological neutrality as set forth in Executive Order 14319, Preventing Woke AI in the Federal Government (July 23, 2025).
   • LLMs must provide a meaningful option for end-users to submit feedback and provide notice on outputs, including those violating Unbiased AI Principles.
   • Specific disclosure obligations for LLM provision include acceptable use policy, model/system/data cards, architecture decision records, API documentation, and development artifacts.
   • The LLM requirements flow down to subcontractors at all tiers.