TSAWebinarQuestionsandAnswersJune2026.pdf

June SB Webinar Questions Received (Notice 2026-001)

Questions and Answers:

1. For the Cybersecurity Requirement's do small businesses have to obtain CMMC to do business with TSA or would this be driven by a specific contract?

a. No, not for TSA. The Cybersecurity Maturity Model Certification (CMMC) is not a Department of Homeland Security (DHS) requirement at this time.

2. Does TSA have a plan to defend itself from the threat of the tidal wave that we all are facing from agentic Artificial Intelligence, AI agents, that will go rogue?

a. Any AI guidance will be issued Government-wide in collaboration with all CIOs at government agencies. The main overall guidance will be filtered down to each agency for CIOs to decide based on the agency and their specific requirements.

3. How can an SBA 8(a) firm best position itself today to support TSA's future technology modernization initiatives, either as a prime contractor or a strategic subcontractor?

a. Reviewing requirements on APFS or SAM.gov for modernization efforts will be posted on either.

b. Attending industry days is also a good way to know and understand requirements for modernization efforts and those announcements are typically posted on SAM.gov.

c. To find subcontracting opportunities, identify the contractor that was the awardee, and contact them directly. Most large companies have a Small Business Liaison that works those strategic partnerships. The government does not get involved in prime/subcontractor relationships.

4. Can you identify the major IT and engineering requirements TSA expects to release over the next 12 to 24 months, particularly in software development, cloud modernization, cybersecurity, data analytics, systems engineering, and AI?

a. All upcoming requirements can be found in the DHS Acquisition Planning Forecast: https://www.tsa.gov/for-industry/tsa-industry-portal

5. Which upcoming IT requirements does TSA anticipate setting aside for SBA 8(a), small business, or other socioeconomic programs, and which are expected to be unrestricted?

a. Market Research determines the acquisition strategy. The more small businesses that respond to market research inquiries increases the likelihood of small business set-asides.

6. Which contract vehicles should small businesses prioritize to compete for TSA IT opportunities? Does TSA primarily use GSA MAS, OASIS+, GSA 8(a) STARS III, or agency-specific contract vehicles?

a. Market Research determines the contract vehicle, depending on the results of market research and the contract vehicles identified, it will be considered especially if there is a high probability of competition.

https://www.tsa.gov/for-industry/tsa-industry-portal

7. What are TSA's highest priorities for cloud modernization over the next few years, and where are the greatest opportunities for small businesses to contribute?

a. TSA's highest priority for cloud modernization is accelerating the migration of legacy on-prem applications to secure, scalable cloud environments. Small businesses may support this effort by providing specialized, FedRAMP-compliant tools for discovery, mapping, and migration that streamline processes and reduce complexity. AI-driven capabilities that automate discovery, optimize migration paths, and predict potential issues are particularly valuable. Small businesses benefit in emphasis on their strengths—specialized tools, AI-driven capabilities, and focused expertise—to demonstrate clear, differentiated value in supporting TSA's cloud modernization objectives.

8. How is TSA incorporating artificial intelligence and machine learning into its modernization roadmap, and what types of AI capabilities is TSA actively seeking from industry?

a. TSA plans to use artificial intelligence and machine learning to strengthen security, improve passenger flow and increase efficiency by enhancing detection in screening systems, automating and improving biometric identity verification, optimizing staffing and throughput with predictive models, augmenting workforce skills through AI based and mixed reality training, applying large language models to streamline procedures and workflows, contact center support, and using advanced analytics to improve vetting, situational awareness, and cybersecurity.

Consistent with the DHS AI Strategy, TSA is seeking from industry mature, secure by design, and explainable AI solutions in advanced screening and machine vision, biometric and document authentication, forecasting and optimization, language and translation services, identity resolution and vetting support, application and solution development, cyber analytics, as well as AI driven query, search, and retrieval capabilities over structured and unstructured data, that can be rigorously tested, governed, and integrated into TSA’s cloud and data environments.

9. Is TSA planning additional investments in enterprise data analytics, business intelligence, data integration, or decision support platforms?

a. The newly established TSA Modernization office was established to connect with vendors through the TSA Industry Portal to work with industry to identify any new efforts that could help advance TSA.

10. Are there upcoming requirements for systems engineering, DevSecOps, digital engineering, or model-based systems engineering beyond traditional software development efforts?

a. All upcoming requirements can be found in the DHS Acquisition Planning Forecast: https://www.tsa.gov/for-industry/tsa-industry-portal

11. Beyond traditional cybersecurity operations, where does TSA see the greatest need for Zero Trust, cloud security, identity management, or cyber engineering support?

a. TSA is on a Zero Trust journey, ensuring we are effectively addressing the five pillars of the ZT maturity model across all TSA systems is an important part of all IT procurements

12. Are there incumbent IT contracts approaching recompete that small businesses should begin preparing for now?

a. You can do research in FPDS-NG to identify any upcoming expiring contracts. All upcoming requirements can be found in the DHS Acquisition Planning Forecast:

https://www.tsa.gov/for-industry/tsa-industry-portal where you can identify recompete requirements as well, it will identify if the requirement is a recompete.

13. What qualities and capabilities make a small business an attractive teaming partner for TSA's incumbent prime contractors?

a. Prime contractors look for small businesses that offer specialized skills, clear past performance, and access to set-aside contracts. Successful partners reduce risk by bringing agile capabilities, deep local or technical expertise, and relevant security clearances. Top Qualities Primes Seek in a Small Business:

• Proven Past Performance: A strong track record of reliability, staying on budget, and delivering quality work on federal contracts.

• Complementary Capabilities: Offering specialized skills that fill gaps in the prime’s own service offerings, making the combined proposal much stronger.

• Access & Set-Asides: Eligibility for specific socioeconomic categories (e.g., 8(a), WOSB, SDVOSB) that help primes win targeted contracts.

• Active Security Clearances: Possessing necessary facility clearances or cleared personnel to quickly step into secure TSA Information Assurance Handbook and mission-critical roles.

• Agility & Lower Costs: The ability to pivot quickly and execute specific tasks at a lower overhead cost than larger corporations.

14. What are the best ways for small businesses to engage with TSA program offices before solicitations are released? Are there recurring industry days, capability briefings, or matchmaking events?

a. As stated during the webinar, anytime during the pre-solicitation phase any notices you see on SAM.gov or on the TSA.gov site, you are more than welcome to engage with the program offices.

15. What types of past performance are most valuable to TSA when evaluating small businesses for technology modernization efforts?

a. Any past performance that can equate to the same size, scope, and magnitude of the requirement is acceptable. This also includes commercial contracts and those with other agencies.

https://www.tsa.gov/for-industry/small-business

16. Does TSA have innovation programs, pilot initiatives, or technology demonstrations where small businesses can showcase emerging capabilities before a formal procurement?

a. The newly established TSA Modernization office was established to connect with vendors through the TSA Industry Portal to work with industry to identify any new efforts that could help advance TSA.

17. What emerging technology areas does TSA expect to prioritize over the next three to five years, such as AI, automation, digital identity, biometrics, cloud-native applications, or predictive analytics?

a. TSA depends on industry to help determine what would be the best technology to incorporate to ensure we maintain our mission. Market Research is what helps the programs determine better planning to improve the programs.