20155109_Attachment 02 - Integration Overview_20250922.docx

Large-Scale Fixed Systems

ATTACHMENT 02 – INTEGRATION OVERVIEW

U.S. Department of Homeland Security U.S. Customs and Border Protection

Attachment 02 – Integration Overview

For:

U.S. CUSTOMS AND BORDER PROTECTION

NON-INTRUSIVE INSPECTION SYSTEMS

Large-Scale Fixed Systems

PREPARED BY:

OFFICE OF FIELD OPERATIONS

INNOVATION AND STRATEGY DIRECTORATE

NON-INTRUSIVE INSPECTION DIVISION

LAND BORDER INTEGRATION

October 2025

Contents

Integration Overview

Background and Deployment CBP employs Non-Intrusive Inspection (NII) systems as part of its layered enforcement strategy to detect contraband, illegal narcotics, weapons of mass destruction, and instruments of terror. These systems include Low-Energy Portal (LEP) and Multi-Energy Portal (MEP) systems, which are deployed at land Ports of Entry (POEs) for secondary inspections and pre-primary scans. These deployments aim to enhance CBP's inspection and interdiction capabilities while increasing throughput.

Historically, NII operations were limited to targeted shipments and conducted as secondary procedures due to the lack of integration between NII systems and CBP IT infrastructure. The acquisition of drive-through X-ray portals has enabled pre-primary and post-primary scanning, significantly increasing the volume of NII images processed.

Transition to Cloud-Based Architecture To address the increased image volume and improve operational efficiency, CBP transitioned to a cloud-based architecture. This shift enables the use of machine learning algorithms for image adjudication and facilitates the integration of targeting information. The transition supports CBP's mission to interdict threats more effectively.

Key Integration Components Common Integration Platform (CIP) Data Aggregation and Transformation:

Aggregates raw Original Equipment Manufacturer (OEM) data, including X-ray images and metadata, and transmits health and status information to CBP IT infrastructure.

Large Scale X-ray Interface Control Document (ICD) Compliance:

Ensures X-ray and ancillary data are in compliance with standards.

System Interoperability:

Ensures interoperability with NII equipment by transmitting configuration data and metadata (e.g., license plates, RFID data).

Latency and Scalability Requirements:

Meets latency requirements for data transmission, ensuring timely processing.

Data Quality Monitoring:

Detects and tags degraded radiographic images, identifies potential system failures, and generates data quality reports.

Data Transmission and Storage:

Ensures non-transmitted files are stored indefinitely until processed.

NII Middle Tier (NMT) Integrated Data Package (IDP) Creation:

Consolidates updates from CIP, including images, license plate reads, and adjudications, ensuring proper tracking.

Integration with CBP Data Holdings:

Incorporates data from CBP systems including Truck Manifest Modernization (TMM) and CBP Targeting Data.

Advanced Queuing:

Makes IDPs available for the Common Viewer (CV) and other stakeholders, including machine learning models.

Algorithm Integration:

Ingests machine learning results and makes them accessible to CBP systems including CV and TMM.

Health and Status Data Interface:

Ensures H&S data is made available to consumer applications (including dashboards).

Common Viewer (CV) Analysis Workflow Configuration:

Supports workflows for various cargo types (land, rail, air, seaport).

Health and Status Dashboard:

Integrates CIP data for operational visibility.

Latency and Response Time:

Responds to user commands within 1-2 seconds and ensures timely display of IDPs.

X-ray Image Display:

Maintains image quality as received from OEM systems.

Supervisor Tools:

Provides tools for user management, performance monitoring, and adjudication.

Data Quality Monitoring:

Detects degraded images and generates reports.

CBP Network Integration Requirements This section provides procedures and techniques necessary to implement the network integration with CBP infrastructure and network-enabled systems. OEM vendors will review the following integration areas to ensure integrity, availability, and functionality within the CBP IT infrastructure and operations. CBP policy mandates that all OEM systems connected with the CBP IT infrastructure to be individually accounted as part of an integrated IT system, which embraces the CBP applications and general support systems.

Standard Network Requirements

· All System workstations, regardless of location, shall be networked as part of a standalone Local Area Network (LAN).

· The contractor shall support integration with the CBP network infrastructure through a CBP Virtual Routing and Forwarding (VRF) router that connects to the CBP wide area network and cloud. This method will be used for the data integration with CBP Cloud and any integration with a future common integration platform (CIP). The OEM network is considered a “private” network segregated from the CBP network.

· The OEM local area network architecture shall include a firewall to segregate the OEM network from the CBP network.

· The OEM local area network architecture shall include a Domain Name Server (DNS) for routing traffic to the CBP network.

· Contractor shall include redundant network paths from the NII server to the CBP switch to ensure high availability.

· The MEP/LEP system shall interface with the Cloud and NII Common Integration Platform in accordance with the LS NII ICD.

· The MEP system shall interface with Land Border Integration (LBI) if directed by CBP.

CBP Network Equipment

· The contractor will ensure their technology is accessible, secure, and aligned to the CBP Enterprise Architecture (EA) in accordance with CBP Policy - DIRECTIVE NO. 5510-040-122. This Directive institutes the Technical Reference Model (TRM) as the primary tool for obtaining information technology (IT) and operational technology (OT) for use at CBP (e.g., software, hardware, applications, etc.) and includes a repository listing the technology and its associated authorization status for use within CBP.

· CBP initiated the TRM to provide instruction for reviewing, managing, maintaining, and cataloguing CBP technologies that are aligned to cybersecurity standards and the CBP EA. TRM also institutes standards and procedures to support CBP in solving previously identified persistent issues/challenges (i.e., duplicative technology, unnecessary increases in costs, technologies that were procured and implemented outside of coordination with Office of Information and Technology (OIT), identifying innovative new technologies, critical decisions made without considering technical security, and lengthy time and effort negatively impacting technology procurements.

· When to use TRM: TRM serves as our centralized service application, where all CBP employees and vetted contractors can browse a diverse range of hardware, software, software plugins, and third-party mobile applications that have undergone rigorous review and approval for use within CBP.

How to access TRM? OEMs with CBP background investigation can use the following link to open and review the CBP approved equipment list. TRM Search - Service Portal: https://cbpprod.servicenowservices.com/sp?id=trm_search_1

Network Cabling Requirements All LAN connection nodes in the System shall be hardwired.

Engagement with Local Field Support Staff:

· The contractor will consult with local Field Support (FTS/FTO) and the Infrastructure Support Service (ISS) engineering team during the initial survey and design phases to:

· Identify the cabling requirements for the connection from/to the Control Center, Intermediate distribution frames (IDFs), and main distribution frames (MDFs).

· Design the cabling scope via use of copper ports, power over ethernet connection, and fiber-optic cables.

· Design the cabling for the connection with BSDP cameras in the lane, NII server room, and IDFs/MDFs for the CBP VRF implementation.

Cabling types

· The contractor shall use fiber-optic cable between the scanners, Control Center, NII server room, and IDF/MDF LAN rooms.

· The contractor shall install single-mode fiber module with 48 strands recommended between NII server room and IDF/MDF LAN rooms.

· The minimum number of strands will be driven by the number of redundant connections.

· The contractor shall ensure there is sufficient “dark” fiber to accommodate potential breaks/damage to production fiber connections and possible expansion of services.

· Minimum of 24 strand fiber shall be used, with the possibility of 48 strands being required from MCC to first MDF, and, if required, and additional 12 strands up to 24 between MDFs if insufficient fiber exists.

· Related peripherals:

· 1100W redundant Power Supply with Power Cable

· Power Card/Interface Card

· Patch Panel

Physical Security Requirements

· CBP Policy - HB 1400-05D-v7 requires the implementation of physical security measures established to protect the network equipment by limiting access only to CBP authorized/escorted personnel. General Physical Access Policy (Section 4.2.1 shown below) states the restricted entry and exit of personnel from an area, such as an office building, data center, or room containing IT equipment. These controls protect against threats associated with the physical environment. The contractor will review the effectiveness of general physical access controls in each area during business hours and at other times. Effectiveness depends not only on the characteristics of the controls used but also on their implementation and operation.

· The contractor will keep IT equipment room doors locked (e.g., physical keys, cypher, or preferred PIV access control) to ensure the security of the NII server room and network equipment inside.

· NII Server Room Handover will be performed prior to establishing CBP network virtual routing and forwarding (VRF) connection. CBP network connection will occur approximately two weeks prior to Site Acceptance Test (SAT).

· NII MEP/LEP Integration Test Sequence: Contractor Witness Testing (CWT) - Confirmation of Infrastructure Readiness - NII Network Room Handover VRF Router Installation and Configuration - Lower Environment Test - SAT Comment by YOON, STEVE S (CTR): Both MEP/LEP systems connecting to CBP network will require the NII Server Room Handover (as part of Physical Security Policy).

· Handover does not require the contractors to be on-site to participate. However, the contractor will return all keys and the codes for cypher locks/PIV access (if available) to the LAN rooms.

· After the handover, the operational access is limited only to CBP authorized/escorted personnel. For contractor access, the contractor will request and identify the purpose of network equipment access. The contractor must be escorted and monitored by OEM staff to have access to the room. Per OPR guidance, even if the contractors are vetted and obtain clearance, they may not have authorization for access to all facilities (i.e., network rooms). For example, they may be authorized work in the common areas, and work on their equipment, but CBP controls access to the CBP offices/network rooms.

Border Security Deployment Program (BSDP) Integration BSDP network integration

· The contractor will provide CAVSS Cameras/CCTV Kit to the NIID Test Directors for verification as approved IP Devices. Final approval will be made by the BSDP/CAVSS team. The approved devices, including cameras, are not to be purchased more than 9 months prior to installation.

· The contractor will confirm that the cameras have been validated in accordance with the CAVSS Operational Readiness checklist for their functionality during vendor Pre-SAT.

· The cameras will not be connected to the CBP network by BSDP until full functionality has been validated by the contractor. Cameras with known vulnerabilities will be replaced prior to connecting to the CBP Network.

· NIID Test Directors and NIID Regional Managers will confirm the approved field of view of the cameras during the government SAT and assist in completing the CAVSS Operational Readiness checklist.

· BSDP Engineer will make the connections to the CBP VLAN 140 switch ports when they deploy the image/program to the CAVSS devices. BSDP will need confirmation from MEP/LEP contractor and/or Port OIT/FTO that the cable path exists to the designated CBP switch.

CAVSS Workstation Requirement

· CAVSS workstations will be equipped with a desktop tower form factor with keyboard. This configuration makes Control Center CONOPS consistent and more efficient for the CBP Officers since the Officers will need to interact with the workstation during ongoing operations.

For the BSDP workstation, the contractor needs to purchase the CAVSS approved Dell Optiplex SFF (small form factor) desktop with a ViconNet software license.

· Workstations will be installed near the CBP officers so that officers have the ability to access the systems on a regular basis. These workstations will be placed on the CBP Active Director which will require the system to be logged into every 30 days. If the system is not accessed in 30 days it will be automatically disabled from the CBP network.

Video Wall Requirement

· The size of video wall depends on the room size. Larger monitors between 43” and 86” are recommended. Many current MEP/LEP locations have 50” to 55” monitors installed.

· Note that each workstation can only display up to 16 cameras on a monitor. A virtual matrix display controller (VMDC) can typically get around 20 cameras, but these can be split between two large displays if desired. VMDC does not have the ability to archive video, thus, this can only be done with a workstation.

· The contractor will select large format monitors listed on the technical reference model (TRM) cited in Section 5.2. Coordinate with the test directors, who have access to the CBP TRM app.

· Centralized Area Video Surveillance System (CAVSS) Camera Deployment Process

· Clarification received from the Border Security Deployment Program (BSDP) on nomenclature: BSDP is the Office of Field Operations (OFO) program, CAVSS is the system managed by the Office of Information and Technology (OIT), Enterprise Infrastructure and Operations Directorate (EIOD), Integrated Logistics Division (ILD). The BSDP boundary is the network switch. BSDP is responsible for the cameras, workstation for viewing video, video management system (VMS), network video recorders (NVRs), system administration, configuration, and connection to CBP switch.

· The contractor will coordinate with the BSDP engineering team to plan the connection of CAVSS to the CBP Network.

· The contractor will coordinate with the EIOD/Network engineering team (NAED) to support the CBP network design in the lane, so that both VLAN 157 and VLAN 140 can be prepared, tested and validated.

· The contractor will provide the bandwidth and data transmission requirements to OFO/NIID and BEMSD/EASD, so that the sites will prepare the adequate network infrastructure (circuits, routers/switches, and cabling) while planning the available switch ports, programmed to VLANs and available IP addresses to accommodate the CAVSS devices.

· Note: For BSDP CAVSS equipment, the BSDP Engineering Team manages the standard equipment list for each contractor.

Summary The integration of CIP, NMT, CV, and machine learning algorithms within a cloud-based architecture enhances CBP's ability to process high volumes of data, utilize advanced technologies, and maintain operational efficiency. This approach supports CBP's mission to detect and interdict threats effectively while improving the scalability and reliability of NII systems.

Future Exhibits Exhibit A: Land Border Initiative Interface Control Document (LBI ICD) - POV ICD v5.9

Exhibit B: Large Scale X-ray Interface Control Document (LXS ICD) Ready by October 31, 2025 image1.jpg image2.jpeg image2.png