U.S. Department of Homeland Security (DHS) U.S. Customs and Border Protection (CBP)

Statement of Work (SOW)

For:

CBP

NON-INTRUSIVE INSPECTION SYSTEMS

Relocatable Passenger Vehicle Scanning System

(RPVSS)

PREPARED BY:

Office of Field Operations

Innovation and Strategy Directorate Non-Intrusive Inspection Program Office

March 2026

Table of Contents

1 PURPOSE

1.1 Background and Scope

1.2 Delivery

1.2.1 Period of Performance (PoP)

1.3 Program Organization

1.3.1 Government Management Organization

2 APPLICABLE DOCUMENTS

2.1 Federal Regulations and Publications

2.2 National Standards

2.3 DHS/CBP Documents

2.4 Order of Precedence

3 REQUIREMENTS

3.1 Requirements Definitions

3.1.1 Threshold (T)

3.1.2 Objective (O)

3.2 General Requirements

3.2.1 Performance Requirements for Relocatable Passenger Vehicle Scanning Systems

3.2.2 Computer Security

3.3 Systems Integration

3.3.1 Work Center

3.3.2 Workstation Integration and Interface

3.3.3 Integrated Image Capture

3.3.4 Integrated Image Storage

3.3.5 Integrated Image and Data Capture

3.3.6 Image Download

3.3.7 Integrated Data Package Download / Transfer

3.4 Safety Interlocks

3.5 Reliability, Availability and Maintainability

3.5.1 Classification of Reliability Critical Items

3.5.2 Basic Reliability Quantitative Requirements

3.5.3 Control of Reliability Critical Items

3.5.4 Availability - Operational Availability (Ao)

3.5.5 Customer Wait Time (CWT)

3.5.6 Obsolescence Report

3.5.7 Service Calls and Work Orders

3.5.8 Preventive Maintenance

3.5.9 Corrective Maintenance

3.5.10 Corrective Maintenance Services

3.5.11 Remote Maintenance Monitoring

3.5.12 Configuration Report

3.5.13 Cost-Wise Readiness (CWR)

3.5.14 Corrosion Control

3.6 On-Demand Services (Technology Refresh, Other Maintenance, and Other Support Services)

3.6.1 Engineering Services

3.6.2 Site Surveys

3.6.3 Retrofit Support

3.6.4 Site Work

3.6.5 On-Demand Training

3.7 Safety Plan

3.7.1 Hazardous Materials

3.8 Weatherproofing and Environmental Resilience of Mobile Units

3.8.1 Maintenance and Sustained Weatherproofing Services

3.9 System Support Requirements

3.9.1 System Installation

3.9.2 System Training

3.9.3 Operator Training

3.9.4 Ownership

3.9.5 Technical Manuals

3.9.6 System User's Manual

3.9.7 Operational/Storage Checklist

3.9.8 Operator Service Manual

3.10 Quality Assurance and Testing

3.10.1 Quality Assurance

3.10.2 Contractor Testing

3.10.3 CBP Factory Testing

3.10.4 CBP Site Acceptance Testing

3.10.5 Technical Reviews

3.10.6 Other Reviews

3.11 Material Discrimination Testing

3.12 Radiation Safety

3.12.1 Radiation Safety Design Review

3.12.2 Radiological Survey and Report

3.12.3 Radiation Survey and Report

3.13 Configuration Management

3.13.1 Technical Documentation

3.13.2 Configuration Baseline

3.13.3 Management of the Technical Documentation

3.13.4 Engineering Change Proposals (ECPs)

3.13.5 Interchangeability

3.13.6 Accessibility

4 LIFE CYCLE SUSTAINMENT AND SUPPORT REQUIREMENTS

4.1 Warranty

4.2 Warranty Period Configuration Changes

5 INFORMATION TECHNOLOGY SECURITY

5.1 Basic Requirements

5.2 Product Assurance

5.3 Access to Unclassified Facilities, Information Technology (IT) Resources, and Sensitive Information

5.4 Personal Identity Verification (PIV) of Contractor Personnel

5.5 PIV Credential Compliance

5.6 CBP Contractor Handling PII Level

5.7 Security Requirements for Unclassified Information Technology Resources

5.8 Supply Chain Risk Management Terms and Conditions:

5.9 DHS Information Technology Portfolio Alignment

5.10 Internet Protocol version 6 (IPv6)

5.11 Section 508 Requirements

5.12 Interconnection Security Agreement Requirements

6 SPECIAL CONSIDERATIONS

6.1 Changes to the SOW

6.2 Travel

6.3 Points of Contact (POCs)

6.3.1 Technical POC:

6.3.2 Contracting Officer (CO):

6.3.3 Contract Specialist (CS):

6.3.4 Contracting Officer's Representative (COR):

6.3.5 Budget (SAP Approver):

7 DATA ITEM DELIVERABLES (Data Item Description (DID))

8 APPENDICES

8.1 APPENDIX 1: DATA ITEM DELIVERABLES

8.2 APPENDIX 2: Acronyms

8.3 APPENDIX 3: Glossary of Terms

Table of Figures

Table 2. IDP Configuration Table 3. Data Item Deliverables

1 PURPOSE

The purpose of this SOW is to establish an Indefinite-Delivery Indefinite-Quantity (IDIQ) contract for Relocatable Passenger Vehicle Scanning Systems (RPVSS) to enable CBP to perform effective and efficient scanning passenger cars and other light vehicles in large numbers to reveal anomalies (including explosives, drugs, and currency) in high-throughput environments like border crossings. These mobile systems shall allow drivers and passengers to remain in the vehicle with the use of low dose x-ray. The RPVSS shall be capable of scanning 150 vehicles per hour or more in the normal flow of checkpoint traffic.

The system shall scan entire vehicles, bumper to bumper, in just a few seconds and shall be able to be relocated quickly with no disassembly.

1.1 Background and Scope

The U.S. Customs and Border Protection (CBP) Office of Field Operations (OFO) and United States Border Patrol (USBP) requires a capability to quickly detect the illegal transit of contraband transported through people, cargo containers, and in other conveyances entering through ports of entry (POE) and at international mail and express consignment carrier facilities. Since 2014, there has been an escalation of dangerous synthetic drug usage, specifically fentanyl, in the United States. The majority of fentanyl being trafficked in the United States is produced in other countries such as China and is smuggled primarily through the international mail and express consignment carrier facilities (e.g., FedEx and UPS) and through POE along the southern land border. As America’s unified border agency, the CBP has a critical role in the Nation’s efforts to keep fentanyl, and other dangerous synthetic drugs, out of the hands of the American public while ensuring safety of CBP’s frontline officers.

1.2 Delivery

CBP estimates ordering approximately one hundred (100) Relocatable Passenger Vehicle Scanning Systems over a five (5) -year period. This IDIQ will have five (5) separate one-year ordering periods.

The Contractor shall provide a planned delivery schedule within 30 days of the award of a Delivery order. Delivery of systems shall begin no later than sixty (60) days from the date of execution of a Delivery Order. Coordination shall be made with the CBP Contracting Officer’s Representative (COR) and technical Point of Contact (POC) listed in SOW Section 6 prior to delivery. On-site operational testing shall be conducted prior to acceptance of each system.

The Contractor shall provide updates to the delivery schedule on a weekly basis, as well as notify the COR immediately of any delays anticipated in the delivery of a system or systems.

All deliveries shall be made Free-On-Board (F.o.b.) destination. The IDIQ will include a separate CLIN for deliveries required to be made outside of the continental United States (OCONUS). This separate CLIN will cover any additional surcharges, import/export costs, etc. related to OCONUS shipments. OCONUS locations may include pre-clearance and prescreening areas in Europe, Asia, Africa, the Middle East, and Latin and Central America.

1.2.1 Period of Performance (PoP)

The PoP of the IDIQ contract shall be for a total of 5 Years with 5 separate 1-year ordering periods.

1.3 Program Organization

This program is under the technical direction of the Large Scale Non-Intrusive Inspection (LS-NII) COR assigned to the Office of Field Operations (OFO) and Non-Intrusive Inspection Division (NIID) in coordination with CBP Office of Information Technology (OIT)/Enterprise Infrastructure and Operations Directorate (EIOD) Integrated Logistics Division (ILD).

1.3.1 Government Management Organization

CBP will manage this program through the CBP NII Program Management Office (PMO) process for system acquisition, delivery, and acceptance. CBP OIT/EIOD Integrated Logistics Division (ILD) will manage the system(s) during the warranty period(s) to include any corrective maintenance and preventive maintenance coordination, and logistic support reporting. CBP NII Division (NIID) will approve training development, operator training and presentations. CBP Human Resources Management (HRM) Radiation Safety Officer (RSO) will approve radiation safety limits.

2 APPLICABLE DOCUMENTS

Documents cited below shall be referenced and used as called for in this SOW, Performance Specifications, and attached Data Item Deliverables (DIDs). The Contractor shall ensure compliance with the following regulations and standards, as applicable.

2.1 Federal Regulations and Publications

• Code of Federal Regulations, 10 CFR 20, Standards for Protection against Radiation, 2012, U.S. Nuclear Regulatory Commission (NRC).

• Code of Federal Regulations, 10 CFR 39.35, Leak Testing of Sealed Sources, 2012, (NRC).

• Code of Federal Regulations, 10 CFR 71, Packaging and Transportation of

Radioactive Materials, 2012, (NRC).

• Code of Federal Regulations, 21 CFR 179, Irradiation in the Production, Processing and Handling of Food, 2012, {US. Food and Drug Administration (FDA)}.

• Code of Federal Regulations, 29 CFR 1910, Occupational Safety and Health Standards, 2012, (OSHA).

• Code of Federal Regulations, 49 CFR 172, Hazardous Materials, Etc., 2012, (DOT)

• U. S. Department of Transportation Federal Highway Administration (FHWA) Bridge Formula Weights August 2019 FHWA-HOP-19-028 https://ops.fhwa.dot.gov/FREIGHT/publications/brdg_frm_wghts/index.htm

2.2 National Standards

• American National Standards Institute, (ANSI)/IEEE N42.41, Minimum Performance Criteria for Active Interrogation Systems Used for Homeland Security, 2007.

• American National Standards Institute, ANSI/IEEE N42.46, Determination of the Imaging Performance of X-Ray and Gamma-Ray Systems for Cargo and Vehicle Security Screening, 2008.

• American National Standards Institute, ANSl/Health Physics Society (HPS) N43.3, General Radiation Safety - Installations Using Non-Medical X-Ray and Sealed Gamma-Ray Sources, Energies up to 10 MeV, 2008.

• American National Standards Institute, ANSl/HPS N43.14, Radiation Safety for Active Interrogation Systems for Security Screening of Cargo, Energies up to 100 MeV, 2011.

• National Fire Protection Association, NFPA 79, Electrical Standards for Industrial Machinery, 2007.

• Federal Information Processing Standards Publication (FIPS PUB),

• Number 140-2, Security Requirements for Cryptographic Modules, 2001

• National Fire Protection Association, NFPA 70, Recommended Practice for

Electrical Equipment Maintenance, 2010.

2.3 DHS/CBP Documents

• DHS Sensitive Systems Policy Directive 4300A, Version 13.0.

• CBP Information Systems Security Policies and Procedures, HB 1400-05D, Version 7.0.

• DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But

Unclassified (For Official Use Only).

https://ops.fhwa.dot.gov/FREIGHT/publications/brdg_frm_wghts/index.htm

• DHS-CBP N.25, Standard Messaging Protocol, Version 1.5.0.6, 2010

• CBP Sweeper Interface Control Document v1.1.1

• World Customs Organization Unified File Format (UFF) 3.0

• CBP Training Development Standards, 2008.

• CBP Instructor-Led Training (ILT) Style Guide, 2009.

• CBP Instructor-Led Training (ILT) Process Guide, 2008

2.4 Order of Precedence

In the event of a conflict between the texts of this SOW and the references cited above, this SOW takes precedence. However, nothing in this SOW supersedes applicable federal and state safety laws.

3 REQUIREMENTS

The Contractor shall perform all tasks within this SOW pursuant to delivery orders issued against the IDIQ. The Contractor shall abide by all applicable Federal regulations, national standards, and DHS and CBP documents in performing all tasks. Requirements for this effort shall include the fabrication, integration, test, delivery, training, logistics, and on-demand support of Large Scale (LS)-NII Mobile Systems.

These systems will be deployed at various CBP POEs primarily along the Southwest Boarder within the United States and other CBP locations as designated by CBP. Specific sites and schedules shall be identified during contract negotiations.

3.1 Requirements Definitions

3.1.1 Threshold (T): The minimum level of operational performance that the Government is willing to accept is considered a threshold value.

3.1.2 Objective (O): A level of performance that significantly improves mission performance, safety, or supportability beyond that of the threshold value, and represents the desired yield for system performance is considered an objective.

3.1.3 Objective values are not required but can be defined to provide guidance to the

Contractor with respect to areas where increased capability is of interest/value to the government. If Objectives are defined, the interval between the Objective and Threshold values for a given parameter is the government program manager’s (PM) trade-space.

3.1.4 Single Requirement: Some requirements will have only a single parameter value and, when this is the case, these values are thresholds.

3.2 General Requirements

The Contractor shall perform all work necessary to manufacture, test and deliver the procured equipment. The Contractor shall also provide the additional requirements as outlined below in this Statement of Work in support of these LS- NII inspection systems.

Each LS-NII system shall meet the requirements defined in this Statement of Work/Performance Specification.

3.2.1 Performance Requirements for Relocatable Passenger Vehicle Scanning Systems

3.2.1.1 The complete system, all sub-systems, and all components, parts, and attachments shall be new. Proposals incorporating reconditioned or used systems in part or in full are not acceptable and will be deemed as non-responsive. The system shall be new, commercially available, and in commercial production as of the closing date of the solicitation for the IDIQ.

The system shall be relocatable, readily deployable, have self-contained mobile capability and meet all the main and sub-system manufacturers published overall and sub-system performance specifications prior to delivery.

3.2.1.2 The system containing all listed sub-systems and major components shall be provided as part of the complete system and shall meet individually described detailed technical and performance specifications. Thus, any vendor not responding to all minimum requirements shall be deemed as non-responsive. No prototypes, one- of-a-kind, or two-of-a-kind systems will be considered.

3.2.1.3 These systems will be used primarily to scan commercial privately owned vehicles.

3.2.1.4 Operational Environment –The system shall be capable of operating in temperatures ranging from -30°C to 50°C (-22° F to 122° F) (Threshold), with an Objective of -40°C to 60°C (-40°F to140°F).

The system shall be capable of operating in high humidity (98%), and in winds up to 40 mph. The system shall be able to operate in rain, sleet, freezing rain, snow, and blowing sand.

3.2.1.5 The system shall meet the following specifications:

• The system shall be capable of effective scanning while vehicles are traveling through a port of entry at a rate of 3 to 10 mph.

• The system shall be capable of maintaining a throughput of 150 or more vehicles per hour.

• The system shall be capable of being installed in a port of entry and rapidly relocated without requiring civil works.

• The system shall be relocatable for port entry or exit.

• The system shall be compliant with ANSI/HPS N43-17-2009.

• The system shall be capable of remote operations.

• Typical system deployment dimensions: approximately 13 ft. wide by 11 ft. high. x 13 ft. long.

• Typical scanning area dimensions: Approximately 10 ft. wide x 9 ft.

high.

• Typical Configuration: 3,500 lb.; Shipping: 4,550 lb.; Mobile configuration: Portal 3,080 lb.; Portal and truck combined: 16,060 lb.

• Each system shall have an ambidextrous portal with a tether (power cable) capable of connecting to either side of the deployed ambidextrous portal.

• The portal tether (power cable) shall be a minimum of 75’ long.

• Each system shall be capable of using shore power.

• Each system shall include the components needed to connect to shore power.

• Auxiliary heat shall be able to operate on both generator power and shore power.

• Each unit shall be delivered with an independent power source/generator that is capable of running at least 24 hours without having a cool down period.

• The generator shall be fueled by the same fuel source as the main unit.

• The generator shall automatically shut-off if the fuel gauge reaches ¼ tank.

• The generator shall be capable of operating at 208 or 220 VAC, 1 to 3-phase, 80 amps per phase, and 60 hertz.

• System shall be capable of being set-up, started, and begin scanning within 20 minutes at environmental temperatures.

• The System shall have the capability of being operated with two (2) operators: one (1) Driver and one (1) Image Analyst.

• Image Display – The system shall be capable of displaying the entire length of the scanned conveyance and its height.

• Real-Time Imaging – The system shall provide real-time imaging so that the image is displayed during the scan with a delay of no more than three seconds.

• Image Quality – X-ray images shall have a true aspect ratio

(uncompressed and distortion free).

• License Plate Reader (LPR)System- The System shall include an LPR system capable of reading a single front license plate and a single rear license plate. The system LPR, for both the front and the rear, shall provide a broad image of the front and rear areas of the vehicle such that the operator can zoom in on one or more areas to confirm the accuracy of the optical characters read or to zoom in on a different area where the LP might be located. The LPR camera capture rate for image shall be 99.5% (T) and 100% (O). Note: “Capture” is defined as detecting the license plate. The LPR shall read license plates with a 90.0 (T) 95.0 (O) percent accuracy in day and night conditions for all 50 U.S. states, 31 Mexican states and 12 Canadian provinces/territories.

• Note: Exclusions for physical obstructions or damage are not allowed.

• Integrated Data Package (IDP) Requirements - The system shall deliver an IDP to the operator/analyst as a single or coherent case using Unified File Format 3.0 (or later) standard.

The system shall export data for each conveyance in at minimum both Tagged Image File Format (.tiff or .tif) and the international Unified File Format (UFF) version 3.0 or later current version.

The system shall export the radiographic image in native format for analysis on any computer equipped with corresponding image analysis software without loss of image analysis functionality and full dynamic gray-level range. Derived images (e.g. material discrimination) shall also be included.

The IDP shall be compiled and assigned a unique case record number.

The IDP shall be saved and protected from overwrite or auto-delete features.

IDPs identified by a CBP analyst as "suspect records" shall be saved such that only a user with administrator privileges can delete suspect records.

The IDP shall be configurable and contain as a minimum the data from the table below:

Table 1. IDP Configuration

Item No Item Name

1 System Unit Number

2 Vehicle X-Ray image(s)

3 Front vehicle area image (scene image)

5 Front license plate read

6 Rear area image (scene Image)

7 Rear license plate read

8 Vehicle average speed

11 Analyst and ADA annotations for anomalies and associated analyst ID; primary adjudication with timestamp(s).

12 Tag: Suspect or Non-Suspect

13 Date / Timestamp of IDP creation, and for both control center and secondary adjudications and final package resolution.

• Data Integration - The system shall be capable of sharing data across a cellular and wi-fi network in accordance with DHS and CBP policy, (threshold). System data shall be exported in UFF 3.0 (or later) format. The RPVSS shall transmit the UFF file comprised of the image file in its RAW format, the associated file data, images, photos, and video in compliance with sweeper Interface Control Document v1.1.1. The ability to distribute the subject system output to CBP Imaged tablets and hand-held devices in addition to standard desktops and laptops is an objective.

• Data Storage (DS) Requirements - The system DS shall store

IDP’s for a rolling first-in first-out period of thirty (30) days.

The system shall provide an option at the Administrator level for auto delete of non-suspect files that are over 30 days old.

The system DS shall have a full capacity backup system that is configured to automatically backup files at designated intervals.

The system DS shall create a warning when storage reaches 70% of its maximum storage capacity.

The system DS shall create a warning when storage reaches 90% of its maximum storage capacity.

The system DS shall create an alarm when storage reaches 99% of its maximum storage capacity.

The system DS shall delete oldest data packages to restore room for new packages when storage reaches 99% of its maximum storage capacity.

The system DS shall store IDP images in an uncompressed data format.

The system shall provide raw X-Ray image data for high and low energies for each IDP in addition to any proprietary / processed X- Ray image format. The raw images are for off-line, CBP analytic / research purposes and are not intended for system workstation display.

The system DS stored images shall retain the full dynamic gray-level range of the x-ray image.

Locally stored files, records, and scan images shall be accessible to operators who are able to copy these items to removable media storage devices: encrypted, FIPS 1402 Level 2 and FIPS 197 compliant flash and hard drives.

The system DS shall support operator-defined queries, including standard reports for scans performed, scans per day / per analyst and other Government defined metrics.

The system DS shall store data in encrypted form.

• Image Analysis- The analyst shall have the ability to do the following: enhance the image(s), change the magnification, select different color palettes, optimize the image’s contrast and brightness, sharpen the image, highlight potential areas of interest, annotate the file for secondary inspection, input decisions on shipment adjudication and perform other standard and required operations to meet the objective of detecting contraband and anomalies. (T) The system shall have a scalable measuring tool to reference identified objects on the image relative to the conveyance dimensions (e.g. ruler tool bar).

The analyst shall have the means to add graphical annotation (circles, boxes, arrows, text boxes) to the IDP file. Such annotations do not get incorporated into the radiographic images, themselves, except as they may be included as an image layer separate from a “clean” radiographic image (e.g., in a TIFF file)

The system shall have the capability to tag an image as suspect or non-suspect and store that decision with the IDP.

The analyst workstation application shall provide threshold signal processing requirements and employ smart signal processing that automatically identifies anomalies that could be drugs, explosives, weapons, and potential casings for radioactive materials. This may include system auto-generated identification of regions of interest such as anomaly cueing/annotation, identification and denotation of conveyance areas that were not penetrated and change detection of a previously scanned conveyance (image compare). (O)

The smart signal processing features shall be enabled/disabled upon operator command (O).

• Material Discrimination – System shall have the capability to distinguish between low-Z (organic), medium-Z (intermediate:

inorganic and composite) and high-Z (metallic) materials based on their atomic number (Z) (O). Material categories are to be color-coded as follows: organic (orange), intermediate (green) and metallic (blue) (Threshold) and Heavy Metals (Color not defined by CBP) (Objective). Shades of these colors are to be used to indicate thickness.

3.2.1.6 Special Non-System Requirements

• The Contractor shall install a government furnished radio installation kit in each system.

• Each unit delivered shall be delivered with a pair of signs specific to the size, shape, colors and wording as required by CBP. Specific requirements will be provided to the contractor after award.

• Each portal shall be equipped with signage attached to the overhead, horizontal support structure entrance side, informing the occupants they will be scanned with low dose X- rays, in both English and one additional language which will be identified at the time of task order award.

• Each system delivered shall be delivered with CBP OFO branding.

(Per current CBP OFO branding style guidelines provided after contract award).

• The system shall be equipped with a set of Law Enforcement lights (with both blue and red flashing lights/strobes to conform with regular OFO fleet vehicle light bars), that when activated can be seen from all sides of the unit, 360 degrees. The lights shall be capable of being controlled from the Driver's Cab. The siren shall include at a minimum two tones, the wail and yelp (such as the Whelen PA series). The siren may be integrated with the lighting or separate.

• The system shall have LED lighting for system operation in dusk and nighttime that provide the following capabilities:

• Lighting conditions extending 50 feet as measured from vehicles center point, providing a 360° perimeter around the system in the deployed position. (Shadowed areas within this perimeter are not acceptable)

• Sufficient lighting to read and capture video and photographic images of truck and conveyance license plates and container shipping numbers without additional lighting

• LED Lighting shall be capable of operating in both scanning and non-scanning modes.

• Lighting shall be capable of operating off generator and engine-drive power and have an on/off switch accessible to driver.

• Movement Safety Requirements

• Backup Audible Tone – The system shall have a clear audible tone that shall be activated at a discernably higher decibel than the system’s normal operating decibel when the system’s gear selection shift is placed in reverse; in both scanning and non-scanning modes.

• Back-up features: Rear View (back-up) Camera with a wide angle and monitor for use by the driver when the system’s gear selection shift is placed in reverse; in both scanning and non-scanning modes (threshold), combined with Surveillance monitor (Objective).

• Reverse Collision Sensor system for the vehicle with audible collision alert tone in the cabin of the vehicle to alert the driver of possible rear collisions. (O)

• Forward Collision Sensor system for the vehicle with audible collision alert tone in the cabin of the vehicle to alert the driver of possible forward collisions. (O)

• System shall be equipped with a key lockable docking station for an OIT imaged-approved laptop computer that allows for easy access by the primary operator. The docking station shall be installed on each system, and a laptop procured for each system by the Contractor. Laptop specifications will be coordinated through CBP-

OIT.

3.2.2 Computer Security

All LS-NII System computers and software programs that allow a User to analyze, enhance and store the IDS, and the Data Base computers and programs that store the IDS, shall have the following security features incorporated.

3.2.2.2. Identification and Authentication

• User Accounts - Three levels of CBP User access (Operator Level 1, Operator Level 2, and Administrator) shall be provided. Operator Level 1 shall be able to perform all system functions except copying and deleting images or Data Sets. Operator Level 1 shall not have access to User Accounts. Operator Level 2 shall be able to perform all Operator functions plus be able to copy and delete IDP files. Operator Level 2 shall not have access to User Accounts. The Administrator shall be able to perform all Operator Level 2 functions plus have access to User Accounts. The Administrator shall be able to create, edit and/or delete User Accounts. The Contractor shall be required to create a simplified procedure for the Administrator to use in order to create, edit and delete User Accounts. Operator Level 1 & 2 shall not have access to Windows except for those hard drives that have IDP stored on them or the external drives from which an image may be imported or an image or IDP may be exported or copied. The Administrator shall have access to Windows if required for system operation.

• Passwords – All user account passwords shall be required to be strong passwords. Passwords shall meet the requirements of Password Management of the DHS 4300A Sensitive Systems Handbook Version

9.0 dated 2011, or the latest version at the time of award. Strong password requirements are:

o Be at least 8 characters in length o Contain a combination of alphabetic, numeric, and special characters o Not be the same as any of the user’s previous 8 passwords o Should not contain a dictionary word o Should not contain any simple pattern of letters or numbers o Should not be any word, noun, or name spelled backwards or with a single digit appended, or with a two digit “year” string o Should not be the same as the user Id.

• Passwords – Automatic password change frequency. The system shall prompt the user to change their password every 90 days.

• Password Storage – They system shall store all user account passwords in encrypted form.

3.2.2.3. Access Control

• Unique User Accounts – All users shall have unique account identifiers, including separate operator accounts and administrator accounts for users that have both responsibilities.

• Automatic Account Lockout – The system shall lock a user account for twenty (20) minutes after three consecutive failed logon attempts.

• Automatic Session Termination – The system shall lock the user login session after twenty (20) minutes of inactivity. The system shall require the user to authenticate with the user account password to regain system access after the system lock. After 60 minutes of inactivity, the user account shall be logged off of the system.

• Warning Banner – The DHS Chief Information Security Officer (CISO) stipulates that a warning banner statement be displayed on all DHS systems during user account logon. The system shall prompt the user to accept the current language before they can authenticate with the user id and user password to access the system. The current language required follows:

o You are accessing a U.S. Government information system, which includes (1) this computer, (2) this computer network, (3) all computers connected to this network and (4) all devices and storage media attached to this network or to a computer on this network. This information system is provided for U.S. Government-authorized use only.

o Unauthorized or improper use or access of this system may result in disciplinary action, as well as civil and criminal penalties.

o By using this information system, you understand and consent to the following:

You have no reasonable expectation of privacy when you use this information system; this includes any communications or data transiting, stored on, originated from or directed to this information system. At any time, and for any lawful government purpose, the government may monitor, intercept, search and seize any communication or data transiting, stored on, originated from or directed to or from this information system.

The government may disclose or use any communications or data transiting, stored on, originated from or directed to or from this information system for any lawful government purpose.

You are NOT authorized to process classified information on this information system.

3.2.2.4. Auditing

• Audit Records – System shall retain audit records sufficient in detail to facilitate the reconstruction of events if compromise or malfunction occurs. Audit records shall contain at least the following information:

o Identity of each user and device accessing or attempting to access the system o Time and date of the access and the logoff o Activities that might modify, bypass, or negate information security safeguards o Security – relevant actions associated with processing o All activities performed using an administrator account/identity

• Audit Record Access – Audit records and audit logs should be protected from unauthorized access, modification, or destruction.

• Audit Record Retention – Audit records should be maintained on the system for a minimum of thirty (30) days for non-suspect images.

Suspect Images shall be stored indefinitely.

• Audit Reduction / Report Generation – The system shall provide an audit reduction and report generation capability that:

o Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents o Without altering the original content or time ordering of audit records

• The system shall have the capability to tag each scan with the username who conducted it. The username and time shall be displayed with the image and the IDP.

3.2.3. Printed Documents

All LS-NII Systems shall have the capability of printing all the items of an IDP.

This is to include the radiographic image, video capture "snapshots", notes and the Data Sheet and/or Manifest if included as part of the IDP. All printed documents shall have "LAW ENFORCEMENT SENSITIVE" in the header or footer.

3.2.4. Printer / Scanner

Printer shall be capable of quality printing (i.e. at least 300 DPI for text and 600 DPI for graphics/photos) while retaining a limited physical footprint. Scan/print devices may be combined or separate units.

3.3 Systems Integration

Integration of NII inspection system equipment and its supporting Subsystems shall be the responsibility of the NII systems Contractor.

3.3.1 Work Center

The Contractor shall deliver a Work Center ergonomically designed for housing the system's Workstation. The system's Workstation for mobile systems shall be housed inside the mobile unit.

3.3.2 Workstation Integration and Interface

The Contractor shall configure and integrate Workstations and Interface Operating systems to include an Operator Console, computers and computer software, cameras and the controls and displays to scan a conveyance, analyze the image, make a Suspect or Non-suspect decision and store all the items that make up that IDS.

3.3.3 Integrated Image Capture

All LS-NII Systems shall be capable of capturing and displaying all of the items that make up an IDS. The IDS shall include the radiographic image, one or more video capture snapshot images, a Data Sheet or Manifest, Notes, the Suspect or Non-suspect decision and the User's name. This Metadata shall be the sole property of CBP.

3.3.4 Integrated Image Storage

All LS-NII Systems shall be capable of storing a complete IDP for a period of 90 days, or one (1) terabyte of storage, whichever is greater. A warning shall be provided when the hard drive used to store the IDP files reaches 70% of its maximum storage capacity and again when it reaches 90% of its maximum storage capacity. The warnings shall alert the operator for the need to copy and delete IDP files. If the hard drive reaches 99% of its maximum storage capacity, a warning shall be provided and the system will not be allowed to scan until IDP files have been copied and deleted. The system shall provide an option at the administrator level for auto delete of non-suspect files that are over 90 days old.

3.3.5 Integrated Image and Data Capture

All NII Systems will be capable of capturing and displaying all of the items that are contained in an Integrated Data Package (IDP) in this SOW on section

3.2.1.5. The IDP shall include, as applicable, the radiographic image(s), a video capture snapshot image from each system CCTV camera, system metadata, conveyance identification (e.g., container ID, LPR, RFID and QR code reads), a data sheet or manifest, operator notes, the operator’s suspect or non-suspect decision and the user's name. All NII image data and metadata shall be the sole property of CBP.

LPR and container ID (if applicable) read capability shall be installed as a means to identify a particular vehicle and cargo shipment, and to associate it with its NII image package as the vehicle proceeds through the POE scanning and inspection process. This metadata shall be collected as the vehicle queues to be scanned by the NII sensor system.

3.3.6 Image Download

The image shall be configured in a format known as Unified File Format (UFF), where CBP may easily transfer the image from one computer containing the image analysis software to another computer containing the image analysis software without the loss of the image analysis functionality. For traditional NII scanning operations in secondary, this transfer will be conducted manually via secure thumb drive or other OIT-approved media. In future NII- IP integrated system applications, all NII image and metadata shall be collected by CBP and securely transferred to the CBP Cloud.

3.3.7 Integrated Data Package Download / Transfer

The consolidated IDP shall encompass all of the data required to perform an offsite scan review and analysis as though the reviewer was stationed at the original data site. The system shall also be capable of creating and exporting a summary scan report for each conveyance scanned – the format of this report shall be PDF. For the NII-IP, the complete IDP will be securely transferred via the CBP network to the CBP Cloud and no longer needs to be retained for any extended length of time on the NII sensor system itself. NII-I will associate manifest and/or other more sensitive data with the NII IDP within the XARDIS Cloud database. The Contractor shall support the development of an Interface Control Specification (ICD) and physical/data connections to CBP IT systems, to facilitate the connection to CBP network and IDP transfer capabilities.

3.4 Safety Interlocks

The Contractor shall provide safety interlocks such as operator proximity/presence sensors and/or "dead man switches" for all systems for the protection of pedestrian traffic and untrained personnel.

The Contractor shall provide Emergency Stop Switches for all systems which will allow an operator to manually interrupt the scanning process disabling the transmission of X-rays in an emergency or when there is an unauthorized entry inside the system's Radiation Control Area. Emergency Stops shall be strategically located in the driver's cab, in the Work Center, and on the side and rear of the system where applicable. A remote emergency stop switch for the traffic control secondary operator is an objective.

See ANSI N43.3-2008 and ANSI N43.14- 2011 for more details on safety interlocks.

When actively radiating the LS-NII system shall provide audible and visible (flashing lights) alarms.

3.5 Reliability, Availability and Maintainability

Each NII system is expected to have the highest Reliability, Availability and

Maintainability achievable for this type of technology. The following are minimum requirements for these systems.

3.5.1 Classification of Reliability Critical Items

A Critical Item is an identified weak link in a system, has an adverse impact on, or contributes to failures of the system performing its mission, creates potential safety problems, or contributes to other areas of high risk to overall system reliability. The Contractor shall classify all LS-NII items as critical if one or more of the following conditions are satisfied:

• Item represents a significant new development or application.

• Item has critical failure modes.

• Item has history indicating need for improvement. A Preplanned

Product Improvement Plan (PPIP) shall be developed and provided by the Contractor for any item with a history of needing improvement.

• Item has known operating life, limited shelf life, or environmental sensitivity (e.g., vibration, thermal, etc.) that warrants controlled surveillance.

• Item whose failure can result in the failure of the system and which is not compensated by redundancy or alternate operational procedures

3.5.2 Basic Reliability Quantitative Requirements

The system shall possess a mean time between failure (MTBF) of no less than 1000 hours or 8000 scans. The operating life of the NII system shall be no less than 10 years. The NII system shall normally operates 16 hours a day, 6 days a week, 52 weeks a year during an operating life of 10 years but it shall be capable of surge operating 24 hours a day, 7 days a week for 2 weeks (336 hours).

3.5.3 Control of Reliability Critical Items

The Contractor shall be responsible for the Quality Control of critical items, which shall include as a minimum:

• Procedures for the procurement of, and availability of, spares of critical items.

• Criteria and procedures for the design and redesign of critical items

• Procedures for controlling and monitoring of critical items after manufacture (e.g., date coding, traceability, assembly techniques, test requirements, acceptance test requirements, control of sub- Contractors' and manufacturers' controls, in-process controls, special handling and storage requirements).

3.5.4 Availability - Operational Availability (Ao)

An average Ao by unit shall be calculated using data for WOs completed during the reporting period:

AO = Total Hours by Unit – Down Time Hours by Unit

Total Hours by Unit

Operational Availability is defined as the percentage of time during the reporting period (monthly) that a specific unit serialized device listed in the contract is available to support the operations for which it was designed.

Downtime associated with preventive maintenance, accidents, incidents, or delays at the Government request are not included in the Ao calculation. The following lists the standard Ao requirements for equipment types, as defined in the definition section of this document, by location category:

96% - Large Scale Equipment (to include rail inspection) in CONUS Pre- Primary Ports of Entry locations.

95% - Large Scale NII Systems (excluding handheld technologies) in CONUS locations

90% - NII Systems (excluding handheld technologies) in OCONUS locations

The Ao shall be calculated at the system level (per serialized system). The Contractor shall also consider the pre-primary NII at CBP locations when assessing the urgency and nature of the request.

3.5.5 Customer Wait Time (CWT)

The Contractor shall restore systems reported in a non-operational status to a satisfactory operational status within the CWT corresponding to the Ao’s above, based on a 720-hour month.

WOs for work performed under on-demand (other maintenance support services) and WOs with customer delays are excluded from all the formulas above.

The Contractor shall meet or exceed these performance standards while complying with all applicable State and Federal regulations. In addition to the quality of deliverables, operational availability levels achieved, coordination, and reporting requirements represent the measurements considered appropriate to the performance of this work statement.

3.5.6 Obsolescence Report

The Contractor shall provide obsolescence notifications to the ILD as soon as possible, but no later than one (1) year in advance of a component, software, firmware, hardware, part, or peripheral associated with the system becoming obsolete, and which would cause the device to be unserviceable, unrepairable, or otherwise unsupportable.

3.5.7 Service Calls and Work Orders

All service calls and work orders apply to corrective maintenance under the warranty period, and preventative maintenance. The Integrated Logistics Division (ILD) - manages an NII Maintenance Dispatch Center (MDC) for maintenance, repair call activities, and incident management that operates 24/7/365. The NII Maintenance Dispatch Center responds to service calls from the numerous CBP locations to intake and track the calls for service in the CBP databases. The NII Maintenance Dispatch Center staff issue requests for repair or maintenance services to the Vendor in the form of a work order (WO) that initiates the maintenance request.

Work Completion Form - The WCF is a unique form to a specific maintenance event. The WCF shall include the WO number assigned by the Government, a description of the maintenance action performed, identify the failure cause or part if any, a list of replaced parts, usage data or scan count since last maintenance activity, name and email address of the Port Official that witnessed completion, and completion date/time. The Contractor shall forward both the Corrective Maintenance WCF within 24 hours and the Preventative Maintenance WCF within 48 hours to the ILD Maintenance Dispatch Center upon completion of each maintenance action, E-mail: MDC@cbp.dhs.gov. Call the Technology Service Desk (TSD) at 1- 800-927-8729, choose the option “NII and RPM” to reach the Maintenance Dispatch Center.

The Contractor shall provide one (1) copy of the completed WCF to the Government Site Representative.

Work Site Cleanliness – The Contractor shall properly dispose of all damaged parts; components; assemblies; subassemblies; consumables; and Petroleum, mailto:MDC@cbp.dhs.gov

Oil, and Lubricants (POL), unless otherwise directed to retain for failure item analysis or other reasons. The Contractor shall remove all work-related used parts, waste, and debris from the CBP site upon job completion, unless directed otherwise.

3.5.8 Preventive Maintenance

The contractor shall provide Preventive Maintenance (PM) during the warranty period of each system. PM is defined as any scheduled and planned maintenance actions performed to maintain the target Operational Availability (Ao) and maintenance metrics as defined herein. Preventive Maintenance includes periodic inspections, calibration, condition monitoring, critical item replacement, and servicing requirements. Necessary repair actions discovered during the performance of a preventive maintenance action require separate corrective Work Orders (WO) from the Maintenance Dispatch Center. To the widest extent possible, all preventive maintenance shall be scheduled around port operational activities to prevent disruption to daily operations. The Preventive Maintenance Schedule which entails the number of PMs to perform during that period may also have to be adjusted based on Operational tempo.

These decisions will be communicated to the Contractor based on the direction of the Government, to include the ILD staff and the COR. Preventive Maintenance activities shall be considered fluid and maybe adjusted throughout the life of the contract based on evidence from corrective actions. In such cases, the proposed action shall be proposed and agreed upon bilaterally.

NII Monthly Preventive Maintenance Schedule – The Contractor shall provide a schedule of planned preventive maintenance actions that has been coordinated with Port Officials organized by equipment model, equipment serial number, location, estimated duration of the visit, and planned date of the preventative maintenance visit to the designated ILD Maintenance Manager and COR fifteen (15) business days prior to the beginning of the month.

Preventive Maintenance Visit Schedule – The Contractor shall provide a list of scheduled preventive maintenance visits that were conducted with maintenance action to include completed, partially completed, or not performed. The report shall be in excel format to the COR, NII Asset Manager, NII Regional Manager and Port Official. The report should include columns for WO number, equipment model, equipment serial number, location, type of maintenance, maintenance status (fully completed, partially completed, or not performed), duration of service, and monthly date of service by the 5th business day for the previous month.

3.5.9 Corrective Maintenance

The contractor shall provide Corrective Maintenance as necessary during the warranty period of each system. Corrective maintenance is defined as any maintenance activity, which is required to diagnose, correct equipment malfunctions or failures that have occurred or is in the process of occurring. This may consist of repair, restoration, or replacement of components, Desktop/Workstation support that includes password resets, application support, staff access support, and all other Desktop support that might be needed.

Corrective maintenance is an unscheduled maintenance activity caused by a unit or component failure and includes tests, measurements, and adjustments.

The Contractor shall contact site and attempt to troubleshoot each problem telephonically. If unable to meet the Customer Wait Time (CWT) as established in the metrics listed above in section 3.5.5 corresponding with the target Ao, the Contractor shall provide the justification, and a time estimate for effecting repairs to the ILD Maintenance Dispatch Center. The Contractor shall notify the ILD Maintenance Dispatch Center and provide the date and time of System Operational Status changes, Estimated Time of Arrival (ETA) for parts, and Contractor Technician scheduled arrival at site.

These updates to the ILD MDC are integral to successful operations and must be maintained. The Contractor must ensure that a minimum update must be made every 48 hours to the MDC even if the status is stagnant to maintain an adequate work history. Deficiencies in updates may result in contractual actions. Habitual deficiencies in the same area will be addressed with the Contractor PM for reconciliation and may result in contractual actions.

The Contractor shall coordinate site visits with the CBP ports, as required.

Corrective services may also include assessments on how system comments operate in conjunction with other CBP systems. CBP has deployed integrated and common viewer systems, providing data to other CBP applications. This means that individual systems are connected to software (SW) and hardware (HW) components of other original equipment manufacturers (OEMs). The communication link and compatibility of systems needs to be evaluated in a coordinated effort with other OEMs to meet CBPs operational requirements.

Failure to work with other OEMs to meet the success of the mission results in failure to meet the…