16-Specifications and Requirements BLD2131742P1.pdf

Specifications and Requirements Artificial Intelligence-Enabled System for Employee Screening X-Ray Machines

The Broward County Aviation Department (“BCAD”) is seeking proposals for a security screening technology solution with advanced artificial intelligence capabilities (“System”) to enhance the existing X-ray screening capabilities, which currently includes four (4) machines, at Fort Lauderdale-Hollywood International Airport.

The System will achieve two (2) broad objectives: (1) integrate artificial intelligence (“A.I.”) technologies into BCAD’s current X-ray screening capabilities to enhance real-time threat detection, and (2) reduce false positives and improve the efficiency of security personnel.

The proposed System should be hardware-agnostic and capable of fully integrating with any industry standard X-ray and CT screening equipment. The awarded vendor (“Contractor”) should have at least one regional office in the United States for the minimum functions of support and maintenance, hosting, and data storage; Contractor must not have only fully offshore resources (i.e., no offices in the United States).

Requirements

1. General

a. Contractor shall provide a complete System, including (if applicable) all necessary peripherals (e.g., monitors, cables, and/or keyboards), that effectively interfaces with BCAD’s existing X-ray screening machines.

b. Contractor shall provide a System that can detect, highlight, designate, and identify all Transportation Security Administration (“TSA”) designated prohibited items (including as modified by TSA from time to time), including but not limited to, liquids/chemicals, dangerous tools/equipment, flammables/liquids, and weapons, as well as any additional prohibited items as determined by BCAD.

c. Contractor shall provide a System that supports on-premises, cloud, or hybrid deployment. The System shall be capable of operating in a stand-alone mode, performing core functions such as detection and alerting without requiring continuous network or internet connectivity. When connected, the System may utilize cloud-based features through an on-premises server or gateway, consistent with County security policies.

d. Contractor shall provide a System with real-time enhanced protections and data access controls to eliminate any privacy concerns related to the screening population when applicable.

e. Contractor shall provide a System that prioritizes expeditious and scalable machine learning, including but not limited to, updating A.I. models and software with any new data sets.

f. Contractor shall provide a System that is able to process data from various technologies in any format deemed necessary, as determined by BCAD (e.g., XLS, CSV, XML, Syslog, PNG, JPG, etc.).

g. Contractor shall provide a System capable of downloading, storing, viewing, and transmitting scanned images in real time, in compliance with all applicable local, state, and federal regulations.

h. Contractor shall provide a System with dashboard capabilities, analytics features, and the ability to generate basic, advanced, and ad-hoc reports, as needed.

i. Contractor shall provide a System with Application Programming Interface (API) or industry equivalent to interface with current and future technologies for X-ray and CT screening hardware.

j. Contractor shall provide a System with image search capabilities.

k. Contractor’s pricing shall be all-inclusive, covering, but not limited to, travel time, labor, billing, equipment leases/rentals, and any other costs associated with the proper function and maintenance of the System.

2. Security, Compliance, and Governance

a. Contractor shall ensure proper vulnerability management of the System by remediating any and all security vulnerabilities or weaknesses in the System, including any vendor-provided software and equipment, and patch management by identifying, acquiring, testing, and deploying updates to fix bugs, patch security vulnerabilities, and improve performance of the System inclusive of its devices, operating systems, and applications.

b. Contractor shall ensure data at rest and in motion must be encrypted with the latest cryptographic standards.

c. Contractor shall provide any software, hardware, services, licenses, updates, and/or third-party services, including the operating system, any third-party software requirements, software as a service (SaaS) storage need, and any additional devices or connectors that may be needed to meet and maintain BCAD operational objectives.

d. Contractor shall collaborate with BCAD to identify, assess, and resolve technical and cybersecurity issues. Furthermore, Contractor shall maintain transparency by promptly reporting (within 24 hours or such shorter time period as required by applicable law) any cybersecurity incidents, vulnerabilities, or emerging risks that may impact BCAD’s security posture and/or regulatory compliance obligations to County via email.

e. Contractor shall ensure that any BCAD-specific configurations, customizations, model tuning, detection rules, threat libraries, workflows, or other airport-specific enhancements are used solely for BCAD’s benefit and maintained in a County-approved, segregated, access-controlled environment. Contractor shall not disclose, reuse, commercialize, or make such customizations or related BCAD data available to any other customer or third party without County’s prior written approval.

f. Contractor shall ensure that connections are secured utilizing a Virtual Private Network (VPN) with Multifactor Authentication (MFA).

g. Contractor shall ensure that all processing data is hosted and stored only within the United States.

h. Contractor shall comply with The National Institute of Standards and Technology (NIST) A.I. Risk Management Framework (A.I. RMF), Cybersecurity Framework Profile for Artificial Intelligence (Cyber A.I. Profile) and International Organization for Standardization (ISO)’s 27001 and 27002.

i. Contractor shall complete all training required by County at no additional cost to County; this requirement includes annual cybersecurity training and ad hoc training related to aviation specifics or industry best practices for cyber resilience.

3. Final Testing and Acceptance Procedures

a. Project Overview

Contractor shall be responsible for implementing the System while ensuring compliance with regulatory and operational requirements. The implementation will follow a structured approach that minimizes operational disruptions and aligns with industry best practices in A.I. deployment, cybersecurity, and change management.

b. Implementation Phases

The implementation shall be executed in a phased approach to ensure systematic deployment, testing, and optimization, and will follow the Implementation Timeline set forth below.

Phase 1: Project Initiation & Planning

1) Conduct a kickoff meeting with key stakeholders, including security, IT, and operational teams.

2) Establish a Project Governance Structure to define roles, responsibilities, and escalation protocols.

3) Develop a detailed project plan, to include timelines, milestones, and deliverables.

4) Identify key performance indicators and success metrics for system performance, accuracy, and compliance.

Phase 2: System Design & Customization

1) Conduct site assessments to evaluate infrastructure readiness and integration points.

2) Define System parameters, including detection criteria, false positive reduction strategies, and system tuning.

3) Ensure compliance with privacy, data protection, and regulatory requirements (e.g. TSA requirements, NIST CSF 2.0, and A.I. Risk Management Framework, where applicable).

4) Develop System design to align with operational workflows and risk profiles.

Phase 3: Solution Deployment

1) Install and configure the System on designated X-ray screening machines.

2) Integrate the System into/with existing security systems and infrastructure.

3) Establish secure data transmission protocols to ensure the confidentiality and integrity of scanned images.

4) Implement user access controls and role-based permissions.

5) Conduct cybersecurity assessments to validate System security.

Phase 4: Testing & Validation

1) Perform functional testing to ensure the System as implemented accurately meets all functionalities listed in the Functionality Checklist.

2) Conduct integration testing to validate compatibility of the System with existing security systems.

3) Complete user acceptance testing with security personnel to ensure operational feasibility.

4) Validate System performance through real-world testing scenarios and iterative improvements.

Phase 5: Training & Change Management

1) Develop and deliver training programs for security operators, IT personnel, and stakeholders (where applicable).

2) Train with BCAD IT staff on the BCAD required Change Control Procedures.

3) Provide all user manuals for System operation and incident response.

4) Conduct awareness sessions to familiarize security and operating personnel (to include BCAD and its contractor, respectively) with A.I.

decision-making processes and bias mitigation.

5) Establish a feedback loop to gather insights from users for continuous improvement.

Phase 6: Deployment & Go-Live

1) Implement a controlled rollout with a pilot phase before full deployment.

2) Provide on-site and remote support during the initial operational period.

3) Monitor System performance in real time, addressing issues within 48 hours.

4) Validate compliance with airport security policies and legal requirements.

Phase 7: Post-Implementation Support & Optimization

1) Establish a maintenance and support framework, including performance in accordance with required service level standards.

2) Implement continuous monitoring and periodic System (including A.I.

model) updates to improve accuracy and document all processes.

3) Conduct regular performance reviews to assess System effectiveness and identify areas for enhancement.

4) Provide ongoing training and refresher courses for security personnel at an agreed-upon interval (example: 6-, 12-, and 18-month touch point after Final Acceptance).

c. Implementation Timeline

The project should be completed according to the timelines below, with milestone-based progress reviews:

Phase Duration Project Initiation & Planning 2 weeks System Design & Customization 2 weeks Solution Deployment 2 weeks Testing & Validation 2 weeks Training & Change Management 2 weeks Deployment & Go-Live 2 weeks Post-Implementation Support & Optimization Ongoing

4. Communication and Reports

a. Meetings/Communication Upon County’s request, and at a time agreed to by the parties, Contractor shall participate in virtual meetings with BCAD regarding any aspect of the System for no more than one

(1) hour per month.

b. Required Reporting In addition to any other reporting requirements set forth in the resulting agreement, Contractor shall provide County with a detailed summary of the Services within 14 days after completion of the services, including but not limited to, any preventive maintenance and/or repairs, an assessment of the issues, corrective action(s) taken by Contractor, and recommendations to County regarding its routine maintenance responsibility.