DRAFT - Attachment 02 - Integration Overview.pdf

U.S. Department of Homeland Security U.S. Customs and Border Protection

Attachment 02 – Integration Overview

For:

U.S. CUSTOMS AND BORDER PROTECTION

NON-INTRUSIVE INSPECTION SYSTEMS

Large-Scale Fixed Systems

PREPARED BY:

OFFICE OF FIELD OPERATIONS

INNOVATION AND STRATEGY DIRECTORATE

NON-INTRUSIVE INSPECTION PROGRAM OFFICE

LAND BORDER INTEGRATION

January 29, 2026

ATTACHMENT 02 – INTEGRATION OVERVIEW

Contents

1. Background and Deployment

2. Transition to Cloud-Based Architecture

3. Key Integration Components

3.1. Common Integration Platform (CIP)

3.2. NII Middle Tier (NMT)

3.3. Common Viewer (CV)

4. CBP Network Integration Requirements

4.1. Standard Network Requirements

4.2. CBP Network Equipment

4.3. Network Cabling Requirements

All LAN connection nodes in the System shall be hardwired Engagement with Local Field Support Staff:

Cabling types

4.4. Physical Security Requirements

5. Border Security Deployment Program (BSDP) Integration

5.1. BSDP network integration

5.2. CAVSS Workstation Requirement

5.3. Video Wall Requirement

6. Summary

Integration Overview

1. Background and Deployment

CBP employs Non-Intrusive Inspection (NII) systems as part of its layered enforcement strategy to detect contraband, illegal narcotics, weapons of mass destruction, and instruments of terror. Historically, NII operations were limited to targeted shipments and conducted as secondary procedures due to the lack of integration between NII systems and CBP IT infrastructure. The acquisition of drive-through X-ray portals has enabled pre-primary and post-primary scanning, significantly increasing the volume of NII images processed.

CBP is committed to enhancing its mission effectiveness in securing the nation's borders, facilitating legitimate trade, and ensuring efficient travel. Non-Intrusive Inspection (NII) technologies are critical tools in achieving these objectives, providing essential capabilities for detecting illicit goods and threats. To that end, NII intends to modernize its infrastructure to enable CBP to revolutionize how NII data is utilized, including leveraging advanced technologies such as Artificial Intelligence and Machine Learning (AI/ML).

It is imperative that all NII hardware procured is designed and implemented with robust integration capabilities and is compliant with the Large Scale X-Ray Interface Control Document (LSX ICD), ensuring that images and associated data can be adjudicated in a common viewing platform of CBP’s choosing. In this modernized infrastructure, exporting data in real time, as soon as it is captured, becomes critical as it forms the foundation for new technologies like AI/ML and smart queuing systems. Furthermore, receiving anomalies identified by CBP Officers adjudicating images allows for operationally efficient AI/ML to stay current and adapt to emerging threat trends. This document outlines the critical requirements for data export, interoperability, and system readiness, ensuring that new NII platforms can seamlessly contribute to CBP's evolving data-driven operational strategies and adapt to future technological advancements.

2. Transition to Cloud-Based Architecture To address the increased image volume and improve operational efficiency, CBP transitioned to a cloud-based architecture. This shift enables the use of machine learning algorithms for image adjudication and facilitates the integration of targeting information. The transition supports CBP's mission to interdict threats more effectively.

This transition includes:

1. Integration Readiness and Compliance: All procured systems and their components must be designed and delivered to be LSX-compliant and ready for

Common Viewer (CV) integration. This ensures interoperability and adherence to current and future CBP data exchange standards.

2. Baseline Data Export Responsibility: Every component and sub-component is fundamentally responsible for exporting all acquired or generated data in a timely fashion, adhering to the LSX Interface Control Document (ICD). This includes critical operational data, system health, and status information.

3. Common Viewer (CV) and Third-Party Solutions: A Common Viewer (CV) is a standardized interface or application used by CBP personnel for the analysis and adjudication of data. CBP reserves the right to elect to utilize a CV, which may be a third-party solution, at various sites. Systems must be prepared to integrate with such solutions by being compliant with the LSX ICD at the time of delivery.

4. Separability of OEM Scanner and Analyst Interface: The Original Equipment Manufacturer (OEM) scanner hardware and any associated Viewer/Analyst interface functionalities should be architecturally separable. The OEM is responsible for sharing all data it acquires or generates as per the LSX ICD. If the OEM does not furnish a Viewer, it is not responsible for sending adjudication results.

5. Real-Time Data for Advanced Analytics: The timely, real-time export of data elements is critical to support advanced capabilities such as Artificial Intelligence (AI) analysis and intelligent traffic queuing. This enables more efficient and effective border operations.

6. Network Connectivity Pathways: Systems must support multiple pathways for data ingress into the CBP network. These pathways may include, but are not limited to, the Common Integration Platform (CIP), local fileshare mechanisms, or direct VLAN connections. The CIP is not the sole method for data transfer.

7. Evolution of Data Standards: The legacy LBI ICD is being superseded by a comprehensive LSX ICD. Procurement should align with this transition, ensuring future compatibility and data accessibility.

8. System Health and Status Monitoring: Procured systems must include the capability to report comprehensive health and status information from all system components. This data is vital for operational monitoring and maintenance.

9. Data Transmission Criticality: It is imperative that all acquired data reaches the CBP cloud with the utmost speed and with consistently low failure rates. This ensures the availability of timely intelligence for operational decision-making.

10. OEM Responsibilities for Integration and Deployment: The OEM may be required to perform necessary civil works or procure additional hardware to support integration readiness or the deployment of a Common Viewer solution.

11. CBP Control Over Integration and Data Destination: The decision to enable integration for a particular system or scanner, and the specific destination for data transfer, rests solely with CBP. These changes shall be configurable as a simple, no-cost modification to the OEM system by CBP personnel.

12. Data Package Delivery Timelines: Specific, quantifiable timelines for the delivery of each data package by the OEM must be clearly defined and met.

3. Key Integration Components

U.S. Customs and Border Protection (CBP) is constantly working to enhance security and streamline operations at our nation's borders. To achieve this, we are implementing a strategy that includes a common integration platform, an NII middle tier, and a common viewer. The common integration platform serves as a switch or data aggregator/transferer that allows all our various inspection technologies, regardless of manufacturer, to "speak the same language" and share information seamlessly. This integrated approach means our officers can more quickly and effectively identify potential threats, contraband, and illegal activities, leading to enhanced national security, faster processing for legitimate trade and travel, and the ability to rapidly incorporate advanced technologies like Artificial Intelligence to stay ahead of evolving challenges

3.1. Common Integration Platform (CIP)

The common integration platform as a switch or data aggregator/transferer that allows all our various inspection technologies, regardless of manufacturer, to "speak the same language" and share information seamlessly. This data then flows into an NII middle tier, which acts like a central processing hub, organizing and enriching the information from all these different systems.

3.2. NII Middle Tier (NMT)

The NMT is a CBP built platform that orchestrates integrated data package collection, creation, and storage while also acting as a central processing hub for algorithm implementation, execution, and results monitoring through a CBP designated end point.

LSX ICD compliant data submitted by NII hardware will be used within this platform to interface with internal CBP processes.

3.3. Common Viewer (CV)

The common viewer provides our officers with a single, standardized screen to review all the images and data, no matter which machine collected it.

4. CBP Network Integration Requirements This section provides procedures and techniques necessary to implement the network integration with CBP infrastructure and network-enabled systems. OEM vendors will review the following integration areas to ensure integrity, availability, and functionality within the CBP IT infrastructure and operations. CBP policy mandates that all OEM systems connected with the CBP IT infrastructure to be individually accounted as part of an integrated IT system, which embraces the CBP applications and general support systems.

4.1. Standard Network Requirements

• All System workstations, regardless of location, shall be networked as part of a standalone Local Area Network (LAN).

• Where there is a local network deployment, the contractor shall support data integration with the CBP network infrastructure through a edge device of CBP’s choosing, CBP’s current standard is a Virtual Routing and Forwarding (VRF) router that connects to the CBP wide area network and cloud.

• The OEM local area network architecture shall include a firewall to segregate the OEM network from the CBP network.

• The OEM local area network architecture shall include a Domain Name Server (DNS) for routing traffic to the CBP network.

• Contractor shall include redundant network paths from the NII server to the CBP switch to ensure high availability.

• The MEP/LEP system shall interface with the Cloud and NII Common Integration Platform in accordance with the LSX ICD.

4.2. CBP Network Equipment

• The contractor will ensure their technology is accessible, secure, and aligned to the CBP Enterprise Architecture (EA) in accordance with CBP Policy - DIRECTIVE NO. 5510-040-122. This Directive institutes the Technical Reference Model (TRM) as the primary tool for obtaining information technology (IT) and operational technology (OT) for use at CBP (e.g., software, hardware, applications, etc.) and includes a repository listing the technology and its associated authorization status for use within CBP.

• CBP initiated the TRM to provide instruction for reviewing, managing, maintaining, and cataloguing CBP technologies that are aligned to cybersecurity standards and the CBP EA. TRM also institutes standards and procedures to support CBP in solving previously identified persistent issues/challenges (i.e., duplicative technology, unnecessary increases in costs, technologies that were procured and implemented outside of coordination with Office of Information and Technology (OIT), identifying innovative new technologies, critical decisions made without considering technical security, and lengthy time and effort negatively impacting technology procurements.

o When to use TRM: TRM serves as our centralized service application, where all

CBP employees and vetted contractors can browse a diverse range of hardware, software, software plugins, and third-party mobile applications that have undergone rigorous review and approval for use within CBP.

How to access TRM? OEMs with CBP background investigation can use the following link to open and review the CBP approved equipment list. TRM Search - Service Portal: https://cbpprod.servicenowservices.com/sp?id=trm_search_1

4.3. Network Cabling Requirements

All LAN connection nodes in the System shall be hardwired.

Engagement with Local Field Support Staff:

• The contractor will consult with local Field Support (FTS/FTO) and the Infrastructure Support Service (ISS) engineering team during the initial survey and design phases to:

• Identify the cabling requirements for the connection from/to the Control Center, Intermediate distribution frames (IDFs), and main distribution frames (MDFs).

• Design the cabling scope via use of copper ports, power over ethernet connection, and fiber-optic cables.

• Design the cabling for the connection with BSDP cameras in the lane, NII server room, and IDFs/MDFs for the CBP VRF implementation.

Cabling types

• The contractor shall use fiber-optic cable between the scanners, Control

Center, NII server room, and IDF/MDF LAN rooms.

• The contractor shall install single-mode fiber module with 48 strands recommended between NII server room and IDF/MDF LAN rooms.

• The minimum number of strands will be driven by the number of redundant connections.

• The contractor shall ensure there is sufficient “dark” fiber to accommodate potential breaks/damage to production fiber connections and possible expansion of services.

• Minimum of 24 strand fiber shall be used, with the possibility of 48 strands being required from MCC to first MDF, and, if required, and additional 12 strands up to 24 between MDFs if insufficient fiber exists.

• Related peripherals:

o 1100W redundant Power Supply with Power Cable o Power Card/Interface Card https://cbpprod.servicenowservices.com/sp?id=trm_search_1 o Patch Panel

4.4. Physical Security Requirements

• CBP Policy HB 1400-05D V9 - Section 3.1 Physical Access Control requires the general physical access controls by restricting the entry and exit of personnel from areas such as office buildings, data centers, and rooms containing IT equipment. These controls protect against threats associated with the physical environment. It is important to review the effectiveness of general physical access controls in each area during business hours and at other times.

• The contractor will keep IT equipment room doors locked (e.g., physical keys, cypher, or preferred PIV access control) to ensure the security of the NII server room and network equipment inside.

• NII Server Room Handover will be performed prior to establishing CBP network virtual routing and forwarding (VRF) connection. CBP network connection will occur approximately two weeks prior to Site Acceptance Test (SAT).

• NII MEP/LEP Integration Test Sequence: Contractor Witness Testing (CWT) - Confirmation of Infrastructure Readiness - NII Network Room Handover VRF Router Installation and Configuration - Lower Environment Test - SAT

• Handover does not require the contractors to be on-site to participate.

However, the contractor will return all keys and the codes for cypher locks/PIV access (if available) to the LAN rooms.

• After the handover, the operational access is limited only to CBP authorized/escorted personnel. For contractor access, the contractor will request and identify the purpose of network equipment access. The contractor must be escorted and monitored by OEM staff to have access to the room. Per OPR guidance, even if the contractors are vetted and obtain clearance, they may not have authorization for access to all facilities (i.e., network rooms). For example, they may be authorized work in the common areas, and work on their equipment, but CBP controls access to the CBP offices/network rooms.

5. Border Security Deployment Program (BSDP) Integration

5.1. BSDP network integration

• The contractor will provide CAVSS Cameras/CCTV Kit to the NIID Test Directors for verification as approved IP Devices. Final approval will be made by the BSDP/CAVSS team. The approved devices, including cameras, are not to be purchased more than 9 months prior to installation.

• The contractor will confirm that the cameras have been validated in accordance with the CAVSS Operational Readiness checklist for their functionality during vendor Pre-SAT.

• The cameras will not be connected to the CBP network by BSDP until full functionality has been validated by the contractor. Cameras with known vulnerabilities will be replaced prior to connecting to the CBP Network.

• NIID Test Directors and NIID Regional Managers will confirm the approved field of view of the cameras during the government SAT and assist in completing the CAVSS Operational Readiness checklist.

• BSDP Engineer will make the connections to the CBP VLAN 140 switch ports when they deploy the image/program to the CAVSS devices. BSDP will need confirmation from MEP/LEP contractor and/or Port OIT/FTO that the cable path exists to the designated CBP switch.

5.2. CAVSS Workstation Requirement

• CAVSS workstations will be equipped with a desktop tower form factor with keyboard. This configuration makes Control Center CONOPS consistent and more efficient for the CBP Officers since the Officers will need to interact with the workstation during ongoing operations.

• Two (2) workstations will display up to 32 cameras, if additional storage capacity is needed, then Network Video Recorder (NVR) would need to be installed to ensure the site meets the 90-day recording requirement.

• The workstation, 27” monitor, keyboard, and mouse will be placed in the Control Center near the large format CAVSS monitor(s). The link below provides a possible solution to move a current rack mounted workstation out into the Control Center (i.e. allows the workstation to be placed on the wall where the Officers can access for archiving). Using these wall rack brackets the rack mounted workstation can be mounted near the CAVSS operator position.

https://www.racksolutions.com/wall-racks.html

• Workstations will be installed near the CBP officers so that officers have the ability to access the systems on a regular basis. These workstations will be placed on the CBP Active Director which will require the system to be logged into every 30 days. If the system is not accessed in 30 days it will be automatically disabled from the CBP network.

5.3. Video Wall Requirement

• The size of video wall depends on the room size. Larger monitors between 43” and 86” are recommended. Many current MEP/LEP locations have 50” to 55” monitors installed.

• Note that each workstation can only display up to 16 cameras on a monitor. A virtual matrix display controller (VMDC) can typically get around 20 cameras, but these can be split between two large displays if desired. VMDC does not have the ability to archive video, thus, this can only be done with a workstation.

• The contractor will select large format monitors listed on the technical reference model (TRM) cited in Section 5.2. Coordinate with the test directors, who have access to the CBP TRM app.

• Centralized Area Video Surveillance System (CAVSS) Camera Deployment Process https://www.racksolutions.com/wall-racks.html o Clarification received from the Border Security Deployment Program (BSDP) on nomenclature: BSDP is the Office of Field Operations (OFO) program, CAVSS is the system managed by the Office of Information and Technology (OIT), Enterprise Infrastructure and Operations Directorate (EIOD), Integrated Logistics Division (ILD). The BSDP boundary is the network switch. BSDP is responsible for the cameras, workstation for viewing video, video management system (VMS), network video recorders (NVRs), system administration, configuration, and connection to CBP switch.

o The contractor will coordinate with the BSDP engineering team to plan the connection of CAVSS to the CBP Network.

o The contractor will coordinate with the EIOD/Network engineering team (NAED) to support the CBP network design in the lane, so that both VLAN 157 and VLAN 140 can be prepared, tested and validated.

o The contractor will provide the bandwidth and data transmission requirements to OFO/NIID and BEMSD/EASD, so that the sites will prepare the adequate network infrastructure (circuits, routers/switches, and cabling) while planning the available switch ports, programmed to VLANs and available IP addresses to accommodate the CAVSS devices.

• Note: For BSDP CAVSS equipment, the BSDP Engineering Team manages the standard equipment list for each contractor.

6. Summary The integration of CIP, NMT, CV, and machine learning algorithms within a cloud-based architecture enhances CBP's ability to process high volumes of data, utilize advanced technologies, and maintain operational efficiency. This approach supports CBP's mission to detect and interdict threats effectively while improving the scalability and reliability of NII systems.

4.4. Physical Security Requirements

6. Summary