A00001_Attachment_01_-_IDIQ_SOW.pdf

Transportation Security Administration Office of Intelligence and Analysis

Program Management Division Universal Enrollment Services

Statement of Work

SECTION J, ATTACHMENT 1 – STATEMENT OF WORK (SOW) FOR IDIQ

1. PURPOSE

In accordance with Federal Acquisition Regulations, a full and open competition is sought to establish a single vendor, Indefinite Delivery Indefinite Quantity (IDIQ) contract to support the Office of Intelligence and Analysis (OIA) Universal Enrollment Services (UES). This contract will require the vendor to work with OIA’s Program Management Division (PMD) in the development, planning, deployment, implementation, and maintenance of UES. This shall be accomplished, at a minimum, by issuing a base Task Order (TO) under this IDIQ contract.

The base Task Order (i.e. Task Order #1) shall cover all the existing UES enrollment center operations and IT infrastructure. For a high-level view of these requirements, reference Sections 4.1-4.7 from this SOW. For detailed information of these requirements, reference Attachment J.2 Statement of Work and its associated attachments.

Subsequent TOs, while standalone orders, shall be related to providing services for the OIA, TSA and DHS mission and activities and may include any combination of capabilities outlined in Section 4 of this SOW.

The purpose of this Statement of Work (SOW) is to identify the tasks required to develop, deploy and maintain Universal Enrollment Services (UES) for programs and populations managed, authorized or serviced by the Transportation Security Administration (TSA). The intent of the TSA UES contract is to provide a full suite of enrollment services and the associated technical and operational infrastructure including, but not limited to:

• Information Technology Infrastructure:

o Enrollment system (software/hardware) required to capture and submit applicant data (biographic, biometric, identity and citizenship documentation and authentication) to the government for vetting and case management o Public portal to provide enrollment information, frequently asked questions (FAQs), enrollment center location information and search capability, appointment scheduling, pre/post-enrollment data capture, and post-enrollment customer service including applicant status information and troubleshooting o Non-public portal/tool for reporting and ticket/issue management o Fee collection, submission and reconciliation o Initial deployment of technology including interface development, connectivity, end-to-end system testing, and Security Authorization by the TSA Office of Information

Technology (IT) Authorizing Official granting an Authority to Operate (ATO) o Ongoing operations and maintenance of systems, resources, data centers, and equipment including ongoing IT Security Authorization requirements

• Operational Infrastructure:

o Footprint of nationwide enrollment center facilities and vetted personnel to provide in person enrollment services o Customer service call center, technical help desk and escalated issue support o Operational support for contracts, personnel security and credentialing, deploying and managing enrollment center locations, training, signage, supplies, financial management, overall program management, quality assurance, etc.

2. SCOPE OR MISSION

The scope of this SOW is to provide enrollment services for programs, populations, initiatives or functions required, authorized, serviced by, or partnered with TSA. In addition to TSA core programs and populations, the objectives described in this SOW can be used to support stakeholders, offices, agencies, or entities that are serviced by or partnered with TSA.

3. BACKGROUND

The Transportation Security Administration (TSA) is charged with safeguarding the Nation’s transportation systems and ensuring the freedom of movement for people and commerce. To meet this mission, TSA conducts security threat assessments (STA) for applicants seeking access to transportation environments, critical infrastructure, and sensitive information or materials.

An STA may be any combination of the following three checks:

• Intelligence related checks for ties to terrorism,

• Immigration status or lawful presence check, and/or

• Criminal history records check (CHRC).

Programs and populations using TSA enrollment services may include, but are not limited to, applicants for the Alien Flight Student Program (AFSP), Hazardous Materials Endorsement (HME) Threat Assessment Program (HTAP), Transportation Worker Identification Credential (TWIC), TSA Pre✓® Application Program, and other programs/populations as required by TSA. Applicants requiring enrollment may be located across the United States and its territories and its outlying possessions. TSA envisions that the enrollment services provider shall expand to cover additional programs and populations that require enrollment and/or credentialing related services as they evolve over time.

Depending upon the specific security threat assessment program and the related statutory and regulatory requirements, applicants must provide biographic data and, in some cases, biometric data (e.g. fingerprint, iris, and/or photo) and identity/immigration documentation to TSA in an approved and established format to facilitate the STA process.

Congress has directed that many STA programs be fee-based and self-sustaining. TSA established fees to fund the programs after providing the public an opportunity to comment on proposed fees. The fee per applicant is comprised of a combination of three elements and varies depending on the program and associated costs:

(1) the cost to collect, process and submit applicant information and all associated enrollment services;

(2) the fee the FBI charges to perform a search of applicant fingerprints against FBI criminal history records systems (fee is subject to FBI regulations and requirements can change over time); and

(3) A TSA program fee to cover costs to administer the program and conduct the security threat assessment.

Payment of these fees by applicants is a requirement to undergo the TSA security threat assessment. Fees are established via rulemaking and updated via notice by the Government.

TSA may provide services for some programs funded outside of fees such as via appropriations, interagency agreements or other non-user fee mechanisms.

4. PERFORMANCE OBJECTIVES, GOAL, AND OUTCOMES

TSA seeks to identify a Contractor with the capability to transition, develop, deploy, provide, and maintain enrollment services managed primarily via fees. Enrollment services may also be provided to specific entities being supported by TSA which may pay for services via other cost and fee/payment structures to align with the service and user fee model. TSA is seeking a Contractor that will incorporate multiple private sector capabilities to increase the public's enrollment access and provide best in class enrollment services.

4.1 Enrollment Activities

The Contractor shall provide enrollment services for TSA employing innovative solutions for applicant enrollment including online, telephone, and in-person data and fee collection.

The Contractor shall develop, deploy, operate, and maintain an enrollment system that shall collect and store applicant biographic and biometric information and submit that data to TSA systems, the FBI Criminal Justice Information Services Division (CJIS) and/or other systems or entities as specified by TSA.

Depending upon the enrollment service requirements of the program, some applicants may be able to complete their service entirely online or by phone, however most programs require applicants to go to an in-person enrollment center to complete the enrollment process. At the enrollment center, the applicant is typically required to provide identity documents for verification, authentication and capture as well as provide biometrics (e.g., fingerprints, photo, etc.) and associated program fees.

Currently, the TSA programs require that an applicant return to an in-person enrollment center prior to the expiration of their security threat assessment in order to renew their benefit or credential. With the implementation of the UES Recompete contract, the Contractor shall support an online-only renewal process for the TSA Pre✓® population. All other TSA programs shall continue to require in-person enrollment for renewals.

4.2 Credential/Card Issuance

TSA systems initiate and orchestrate the card issuance process. In this card issuance process, personalized cards shall be shipped to the mailing address or Contractor enrollment center that the applicant specified either during enrollment or during the card replacement ordering process.

4.2.1 Enrollment Center Card Pick-Up

The Contractor shall provide card pick-up services in support of TSA’s card issuance process. Services shall include, but are not limited to: receiving, registering, and issuing cards; managing card inventory; conducting identity verification; providing cardholder responsibilities; and initiating card reader validation.

4.2.2 Direct Mailing Support Location

The Contractor shall provide post-issuance support to applicants who have requested that a card be sent to their mailing address. To support post-issuance activities, the Contractor shall establish a location (referred to as a “direct mailing support location”) to process direct mailed cards and PIN mailers that were not deliverable to the applicant.

4.3 Enrollment Center Operations

The Contractor shall have the capability to establish and maintain the infrastructure and framework (including but not limited to personnel, facilities, hardware, and connectivity) necessary to support all aspects of the enrollment process. Transitioning, researching, locating, establishing and deploying secure locations for in-person enrollments using Contractor-provided equipment is required. The Contractor shall work with program stakeholders, in coordination with TSA, to establish in-person enrollment sites, effectively communicate site locations and hours of operations, and collect enrollment applications.

TSA’s objective is to establish enrollment centers and services to support programs including locations in all 50 States, District of Columbia, and US Territories and Outlying Possessions.

In addition to Contractor established enrollment centers, the Contractor may also be required to provide enrollment services at government, quasi-government, or TSA authorized facilities. At these facilities, the Government or authorized entity shall provide the physical space to meet contract requirements, but the Contractor may be required to provide varying levels of enrollment services, including technology/equipment, supplies, training and personnel.

Below is a list containing some of the primary expected activities required of the Contractor when establishing and maintaining enrollment center operations:

• Fixed Enrollment Centers

• Temporary Enrollment Events

• Population-Specific Enrollment Centers

• Opening and Closing of Enrollment Centers

• Authorized Non-Public Enrollment Capability

• Special Considerations (see section 4.3.6 of the Task Order SOW for examples)

Additionally, the Government may request that the Contractor establish a temporary enrollment center for a fixed amount of time at a specific location (city/state). These events are sponsored by the Government and would be issued as a separate task order. Previous Government-initiated temporary enrollment events include:

• Locations established to service applicants located in remote geographic areas. For example, enrollment centers were temporarily established in outlying areas of Alaska to enroll small TWIC® populations that were not able to travel to Alaska’s fixed enrollment centers.

• Locations established to augment fixed enrollment centers during times of high demand (for example, establishment of additional TSA Pre✓® temporary enrollment events during times of high applicant demand)

On a per location basis, the Contractor shall work directly with the Government to determine if appointments are required or if walk-ins are allowed.

4.4 Information Technology System

The Contractor shall provide the technical services needed to develop, test, implement, operate, maintain, and secure per the Government’s requirements, an information technology system, inclusive of all on-line environments and related databases, in a normal, continuously operational state 24 hours per day x 7 days a week. The information technology system shall have the functions required to support enrollment services, which will include website, enrollment, activation, and customer service capabilities (e.g. ticketing tool).

In addition, the Contractor shall develop, implement, and operate the interfaces with external TSA systems and applications necessary to support transmission and receipt of enrollment-related data. In the event that major technological changes are made to the systems, the Contractor shall make necessary information systems changes to direct enrollment, CHRC, and associated information to any and all replacement, enhanced, and/or modernized systems. Process and information system changes will be required to support use of new and updated system(s), interface(s) and processes. Necessary information systems changes may be required to submit and retrieve information from the TSA or authorized/interfacing system(s).

4.5 Change Control Board Process

With ongoing security threats and evolving Government policies/priorities, the Contractor shall propose an innovative, change control business process that will allow for continued system (hardware/software) and/or operational changes/enhancements, at the request of the Government, as ongoing requirements arise due to program changes and/or the need for operational efficiency and control.

Such a process is targeted at, but not limited to, system/operational changes that are more involved than application maintenance, but of lesser scope than any major technological/operational changes that may require additional time and resources in order to implement such a solution. This process shall include an approach to addressing less complex system changes via a special approval process as well as a streamlined approach for approving and utilizing subject matter expert (SME) hours in research technical and operational solutions and improvements.

System/operational enhancements are defined as any changes or upgrades to existing UES hardware, software, and/or operational capabilities that shall allow for an increase and/or improvement of current capabilities, beyond that of TSA’s original requirement/specifications.

Examples of such requested changes include, but are not limited to:

• Modifying existing applications on enrollment workstations to accommodate new functions/capabilities

• Enhancing security features on all UES related systems

• Updating the public web user interface to add and/or expand new categories (i.e.

new programs, new populations, new policies, additional links, etc.)

• Increasing or decreasing any existing system functionalities and capabilities

• Provide better cross-platform compatibility programs

In order to continue providing an all-around secure and pleasant experience for applicants, UES and all of its associated systems and operations are expected to have continued enhancements/upgrades throughout the life of the contract. TSA envisions the development of a streamlined change control board process will allow for the request and implementation of future system/operational enhancements (as defined in this section) to be done in a quick and efficient matter.

4.6 Customer Support

The Contractor shall provide, establish, and operate a call center, technical help desk, and engineering support capability.

4.6.1 Customer Call Center

The Call Center shall provide general information regarding a customer’s enrollment and provide telephone enrollments in accordance with specific program regulations, statutes and requirements. The Contractor shall have the capability to track all customer and Trusted Agent interactions with the Call Center using a ticketing system or customer relationship management application/system.

4.6.2 Technical Help Desk

The Contractor shall establish a Technical Help Desk to assist with technical inquiries related to Contractor-provided equipment as well as software managed or maintained by the Contractor.

Support activities conducted by the technical help desk shall include, but are not limited to:

• Technical assistance and issue resolution with Contractor-provided enrollment or ticketing tool software

• Troubleshooting issues and resolution with enrollment center hardware

• Troubleshooting and resolving network connectivity issues

• Other enrollment center technical assistance as required

4.6.3 Engineering Support

The Contractor shall establish Engineering Support Services to assist with Research and Development, System Deployment and Integration, Technology updates and fixes, and IT Security Compliance Reviews. The Engineering Support Services will also assist with and resolve inquiries related to software managed or maintained by the Contractor.

Inquiries submitted to Engineering Support shall include, but not be limited to:

• System wide problem that is blocking enrollments

• Hard outage (service blackout)

• Customer escalation by system owner

• Issues preventing some end users from using the system

• Issues preventing processing of enrollments after enrollment capture

• Congressional request

• Support for individual enrollment record issues failing to complete

• Support researching individual enrollment record status

• General business intelligence questions

• General application questions

4.7 Innovation and Service Support

TSA seeks innovative approaches to enrollment services and operations. Any proposed innovation shall require TSA review and approval prior to implementation. Additionally, depending upon the innovation proposed, testing may be required with TSA and/or DHS.

Examples of innovative approaches that Contractors may propose include, but are not limited to:

• Achievement of a convenient fixed enrollment center footprint while maintaining a reasonable cost structure.

• Identity assurance. (see section 4.7.1 of the Task Order SOW for detail)

• Citizenship verification methods that may not require an applicant to present a citizenship proving document from the TSA list of identity documents.

• Enrollment services for applicants that are not part of a large population such as

TWIC, HTAP, or AFSP.

• Enrollment hardware solution that minimizes the required physical footprint and maximizes portability to support efforts such as temporary enrollment activities.

• Wait time capture process that calculates the wait time of an applicant at the enrollment center with the goal of maximizing data accuracy.

• Contingency staffing at all in-person enrollment centers, including sub-contracted enrollment centers so that each enrollment center maintains staffing to meet the required capacity.

• Appointment management.

• Applicant communications approach.

• Enrollment marketing.

4.8 Future Capabilities

The Contractor shall demonstrate and have the capability to perform, provide and support future functions that may be required as the TSA programs evolve or as TSA determines future system or operational requirements. Support may include but not be limited to process, system, help desk/call center, facility, approved hardware/equipment changes, or other infrastructure changes to meet future enrollment requirements. Examples of future functions are listed below but are not inclusive of all possible future enrollment functions.

4.8.1 Non-TSA Agent State Transition to TSA Agent Enrollment (HTAP Population)

The Contractor shall support State application transition activities for States that elect to migrate to the TSA Agent enrollment process for HTAP application under HTAP. Transition activities may include, but are not limited to coordination with TSA and the State to transition applications submitted via the State specific application process which were not processed or completed successfully prior to the State’s migration to the TSA Agent enrollment services. In addition, support may include but not be limited to applicant re-enrollment via the TSA Agent services and reconciliation of fee collection for applicants that had previously submitted payment to the State.

4.8.2 Standalone Biometric Submission and Post-Enrollment Biometric Submission

TSA is considering the use of biometrics (e.g. fingerprints, iris, and/or photo) in the future at airport checkpoints for identity verification for individuals that have the TSA Pre✓® benefit.

The TSA Pre✓® benefit is available to individuals who have an approved security threat assessment from TSA, another DHS Trusted Traveler program, or via other mechanisms.

Individuals with TSA Pre✓® through a TSA Security Threat Assessment Program The Contractor shall provide a capability to capture biometric data post-enrollment. This will apply to circumstances such as: individuals who did not provide all three types of biometrics during their initial enrollment. Also due to degraded biometric quality, some applicants may be required to resubmit biometric data at an enrollment center. This type of post-enrollment capture will be provided at no additional cost to the enrollee. The Trusted Agent shall retrieve the applicant’s existing biographic data, capture the applicable biometrics, and submit the data to TSA.

Individuals with TSA Pre✓® not through a TSA Security Threat Assessment Program For those individuals who did not provide biometrics to TSA previously, the Contractor shall provide a capability to capture biometric data. The Trusted Agent shall enter the applicant’s biographic data, capture the applicable biometrics, and submit the data to TSA.

4.8.3 Provide Enrollment Services for Non-TSA Populations

The Department of Homeland Security (DHS) continues to seek efficiencies across components/agencies in areas such as enrollment services. The UES Contractor should be prepared to support requirements that may arise related to this concept of “common enrollment” or “enrollment as a service” across DHS. For example, the UES Contractor may be required to host another component inside their enrollment center space (when logistically possible) for a short/temporary enrollment event managed by another component. In some scenarios, a more permanent “co-location” setup might be required at certain locations.

Future requirements may entail TSA operating as a “servicing agent” to other DHS entities requiring enrollment services, which may require technology integration or could involve training the UES Contractors to use another component’s enrollment technology. Any requirements related to common enrollment would be introduced into the contract via Task Orders.

Furthermore, the Contractor shall provide enrollment services for non-DHS populations.

Examples may include but are not limited to Government, quasi-government or other approved TSA Trusted Agents. The approved TSA Trusted Agents may be required to act as a Trusted Agent to submit enrollment information and/or perform enrollment services using the Contractor’s Enrollment Services infrastructure such as website enrollment and identity assurance. Enrollment services for non-DHS populations would be included in the contract via modification new task order. Enrollment services could include any or all components of the Contractor’s technology and operational infrastructure (ex. facilities, personnel, training) and will be negotiated by TSA as the servicing agency with the requesting external entity/agency as well as via a new task order with the UES Contractor.

4.8.4 Provide Enrollment Services for Smaller TSA Populations The Contractor shall have the ability to provide enrollment services for applicants that are not part of a large population such as AFSP, HTAP, TSA Pre✓®, or TWIC®. For example, TSA may direct the Contractor to provide enrollment services for other DHS components using TSA enrollment services. The Contractor shall provide population-specific information on the web portal for affected applicants. Website requirements for these applicants could include, but is not limited to, accommodation of pre-enrollment, posting of lists of the documents required to complete an enrollment, available enrollment locations, and FAQ. Since the information is not applicable to most TSA applicants, the Contractor may propose an innovative way to handle the publishing of this information that would limit its access to those applicants who need it.

Additionally, the Contractor shall accommodate in-person enrollment of these populations as directed by TSA.

4.8.5 Support Information System and Process Modifications resulting from TSA System Replacement or Enhancements

The Contractor shall demonstrate and have the capability to make changes to information management systems and service procedures resulting from the replacement or enhancement of TSA legacy systems or to meet the evolving requirements of TSA modernized systems.

Additionally, as needed, the Contractor shall be required to support training activities for Contractor personnel to instruct them on the use of new TSA information systems and processes. The Contractor shall develop a flexible and configurable enrollment system as well as an enrollment services infrastructure (including resourcing and processes) to facilitate changes and enhancements made to TSA systems, processes and external interfaces. Some examples which do not constitute a fully inclusive list of potential changes are below.

4.8.5.1 Usage of and integration with TSA Provided System(s)

TSA Legacy System Enhancements: The Contractor shall develop a flexible and configurable system and enrollment services structure (including resourcing and processes) to facilitate changes and enhancements made to TSA legacy systems, processes, and external interfaces at the Contractor’s expense.

TSA Technology Modernization: Changes shall be required to update information management systems resulting from the replacement of TSA legacy systems with a new, modernized system and processes.

In addition to legacy and modernized system interfaces, the Contractor shall have the ability to support future capabilities and program enhancements as directed by TSA. For example, changes in acceptable identity documentation or citizenship requirements or cybersecurity requirements may necessitate corresponding operational, system, and equipment changes.

4.8.5.2 Support TSA Recurrent Criminal History Vetting

TSA continues to work on technical and operational enhancements to support the ability to recurrently review a program applicant’s criminal history record information (CHRI). TSA is exploring the use of the FBI RapBack solution as well as interfaces with IDENT to support these initiatives. The Contractor may be required to adjust how data is transmitted and received from the FBI, as well as integrating with additional technologies or processes in support of returning CHRI separately from a standard program enrollment.

4.8.5.3 Retrieve Status from Enhanced or New TSA System(s)

As TSA interfacing systems are updated or transitioned to new versions or new components, Universal Enrollment services information systems and process changes may be required to support receiving and/or retrieving information from the new or enhanced system(s).

4.8.5.4 Multiple Program Enrollment

The Contractor shall propose ways to streamline the enrollment process and collect fees for applicants that need to apply for multiple programs with the objective of minimizing applicant burden. Specifically, the Contractor shall support a single data collection per applicant and provide a reduced enrollment fee and ensure applicants are informed of the total cost and duration of the benefit or credential before the application process begins.

4.8.5.5 Training related to TSA legacy system or process/policy changes such as replacements and/or modernization

Enrollment services personnel such as but not limited to Trusted Agents, call center and help desk staff will require training and updated materials and procedures that impact or change enrollment services due to new/modernized TSA provided enrollment systems/components.

Delivery of training may include but is not limited to development and delivery of updated and/or new training and training materials in multiple formats (hard copy, soft copy, web-based, in-person training sessions, other). Required activities include but are not limited to changing/updating initial, on-going and recurrent training that supports and assists with providing enrollment service and may also include updates to security training.

4.8.6 Conduct Criminal History Record Check and Perform Adjudication

The Contractor shall have the ability to use the PII submitted by the applicant to perform an eligibility evaluation based on criminal history records information. The Contractor shall search commercial data or other sources for evidence of convictions for disqualifying crimes.

Commercial data elements used for the criminal history records check must undergo DHS review prior to use. The Contractor- shall describe all data sources, commercial or governmental, utilized to determine that all criminal history associated with an applicant has been evaluated.

The Contractor shall perform a criminal history records check against the disqualifying offenses for the applicable program. The Contractor shall have the ability to disqualify applicants based on the current program disqualification list. The Contractor shall have the ability to comprehensively find and evaluate all pertinent information necessary to achieve an acceptable standard of performance that all criminal history associated with an applicant has been evaluated.

The Contractor shall have the ability to adjust their processes for performing the criminal history records check, based on new criteria for criminal disqualifying information as provided by TSA, within a reasonable period of time to be determined by TSA.

The Contractor shall notify the applicant of their potential ineligibility and how to apply for redress in the event a potentially disqualifying crime is found. The Contractor shall be responsible for providing redress to applicants with potentially disqualifying information; the Contractor shall review information provided by applicants to the Contractor for redress and correction of record for the Contractor’s preliminary eligibility review. It will be incumbent upon the applicant to obtain corrected records for reconsideration by the Contractor. If corrected records are successfully presented by the applicant, then the Contractor shall continue processing of the application. If the individual is ultimately denied based upon criminality, then the Contractor shall provide the denial information to TSA.

4.8.7 Online-Only Enrollment

Currently, the TSA programs require that an applicant visit an in-person enrollment center to complete the enrollment process. In the future, TSA is exploring alternate enrollment methods to include online-only enrollments. The Contractor shall propose an online-only enrollment solution using a mobile device (e.g. phone, tablet, personal computer, etc.).

The Contractor’s solution must address their approach for identity assurance, citizenship verification, accurate biographic and biometrics data collection, IT security, and enrollment footprint.

4.8.8 Iris Collection

There may be a need in the future for the UES Contractor to capture/collect iris as a standard biometric during initial enrollment or post-enrollment. Iris standards shall be provided by TSA upon implementation, as this biometric is not currently captured for TSA programs/populations.

In addition to the in-person biometric capture requirements, the Contractor may also propose, and TSA may consider, equally secure alternatives to in-person enrollment when capturing biometrics. The Contractor must clearly explain how the capture of biometrics that is not conducted in person would be correctly linked to a person’s real identity.

5.0 Special Delivery Instructions:

Special Delivery requirements will be addressed in the individual Task Orders.

6.0 Performance/ Delivery Period:

This contract shall be for the period beginning from the date of award for 36 months with five (5) additional option periods. The first two option periods shall have a duration of 24 months, and the remaining option periods shall have a duration of twelve months each.

7.0 Place/ Location of Performance/ Delivery:

The specific Place/Location of Performance/Delivery requirements will be addressed in the individual Task Orders. Primary place of performance is the Contractor’s enrollment locations and/or travel site.

8.0 Travel Requirements:

The contractor will be responsible for travel costs associated with the standard course of managing the enrollment operation, including periodic site visits and in-person monthly performance management reviews (PMRs), among other standard business travel required to meet requirements detailed in the IDIQ and Task Order 1. If additional travel is mandated by the Government, the specific travel requirements will be addressed in the individual Task Orders for the related requirements. Any travel that may result in the Contractor claiming reimbursement must be approved by the Contracting Officer or Contracting Officer Representative in accordance with the GSA Federal Travel Regulations.

9.0 Special Requirements:

Special requirements will be addressed in the individual Task Orders.

10.0 Information Assurance Requirements for TSA Government Acquisitions (April 2016)

A. General Security Requirements

A.1. The Contractor shall comply with all Federal, Department of Homeland Security (DHS) and Transportation Security Administration (TSA) security and privacy guidelines in effect at the time of the award of the contract, as well as those requirements that may be discretely added during the contract.

A.2. The Contractor shall perform periodic reviews to ensure compliance with all information security and privacy requirements.

A.3. The Contractor shall comply with all DHS and TSA security controls to ensure that the Government's security requirements are met. These controls are described in DHS PD 4300A and TSA MD 1400 series security policy documents and are based on the current National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 standards.

A.4. The Contractor shall include this guidance in all subcontracts at any tier where the subcontractor is performing the work defined in this statement of work (SOW).

A.5. The Contractor shall ensure all staff have the required level of security clearance commensurate with the sensitivity of the information being accessed, stored, processed, transmitted or otherwise handled by the System or required to perform the work stipulated by the contract. At a minimum, all Contractor staff shall be subjected to a Public Trust background check and be granted a Public Trust clearance before access to the System or other TSA resources is granted.

A.6. The Contractor shall sign a DHS Non-Disclosure Agreement (NDA) within (30) calendar days of the contract start date.

A.7. The Contractor shall not release, publish, or disclose agency information to unauthorized personnel, and shall protect such information in accordance with the provisions of the pertinent laws and regulations governing the confidentiality of sensitive information.

A.8. The Contractor shall ensure that its staff follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract. Personnel shall be responsible for the physical security of their area and government furnished equipment (GFE) issued to the Contractor under the terms of the contract.

A.9. The Contractor shall make all system information and documentation produced in support of the contract available to TSA upon request.

B. Training Requirements

B.1. All Contractor employees, requiring system access, shall receive initial Organizational Security Fundamentals Training within 60 days of assignment to the contract via the Online Learning Center (OLC). Refresher training shall be completed annually thereafter.

B.2. The Contractor shall complete annual online training for Organizational Security Fundamentals and TSA Privacy training.

B.3. Role Based training is required for contract employees with Significant Security Responsibility (SSR), whose job proficiency is required for overall network security within TSA, and shall be in accordance with DHS and TSA policy. The Contractor will be notified if they have a position with significant security responsibility.

B.4. Individuals with SSR shall have a documented individual training and education plan, which shall ensure currency with position skills requirements, with the first course to be accomplished within 90 days of employment or change of position. The individual training plan shall be refreshed annually or immediately after a change in the individual’s position description requirements.

B.5. Information Security and Privacy training supplied by the Contractor shall meet standards established by NIST and set forth in DHS and TSA security policy.

B.6. The Contractor shall maintain a list of all employees who have completed training and shall submit this list to the contracting officer representative (COR) upon request, or during DHS/TSA onsite validation visits performed on a periodic basis.

B.7. The Contractor shall its employees review and sign the TSA Form 1403 Computer and Wireless Mobile Device Access Agreement (CAA) prior to accessing IT systems.

C. Configuration Management (hardware/software)

C.1. Hardware or software configuration changes shall be in accordance with the DHS Information Security Performance Plan (current year and any updates thereafter), the DHS Continuous Diagnostics and Mitigation (CDM) Program to include dashboard reporting requirements and TSA’s Configuration Management policy. The TSA https://team.ishare.tsa.dhs.gov/sites/OTWE3/OLC/OLC%20Home%20Page.aspx

Chief Information Security Officer (CISO)/Information Assurance and Cyber Security Division (IAD) shall be informed of and involved in all configuration changes to the TSA IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The TSA IAD POC shall approve any request for change prior to any development activity occurring for that change and shall define the security requirements for the requested change. The COR will provide access to the DHS Information Security Performance Plan.

C.2. The Contractor shall ensure all application or configuration patches and/or Requests for Change (RFC) have approval by the Technical Discussion Forum (TDF), Systems Configuration Control Board (SCCB) and lab regression testing prior to controlled change release under the security policy document, TSA Management Directive (MD) 1400.3 Information Technology Security and TSA Information Assurance (IA) Handbook, unless immediate risk requires immediate intervention.

Approval for immediate intervention (emergency change) requires approval of the TSA CISO, SCCB co-chairs, and the appropriate Operations Manager, at a minimum.

C.3. The Contractor shall ensure all sites impacted by patching are compliant within 14 days of change approval and release.

C.4. The acquisition of commercial-off-the-shelf (COTS) Information Assurance (IA) and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting “sensitive information”) shall be limited to those products that have been evaluated and validated, as appropriate, in accordance with the following:

• The NIST FIPS validation program.

• The National Security Agency (NSA)/NIST, National Information Assurance

Partnership (NIAP) Evaluation and Validation Program.

• The International Common Criteria for Information Security Technology

Evaluation Mutual Recognition Agreement.

C.5. US Government Configuration Baseline and DHS Configuration Guidance

a) The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the US Government Configuration Baseline (USGCB) and in accordance with DHS and TSA guidance.

1. USGCB Guidelines:

a. http://usgcb.nist.gov/usgcb_content.html

2. DHS Sensitive Systems Configuration Guidance

a. http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Pages/sscg.aspx

b) The standard installation, operation, maintenance, updates and/or patching of software shall not alter the configuration settings from the approved USGCB configuration. The information technology shall also use the Windows Installer Service for installation to the default “program files” directory and shall be able to discretely install and uninstall.

c) Applications designed for general end users shall run in the general user context without elevated system administration privileges.

C.6. The Contractor shall establish processes and procedures for continuous monitoring of Contractor systems that contain TSA data/information by ensuring all such http://usgcb.nist.gov/usgcb_content.html http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Pages/sscg.aspx devices are monitored by, and report to, the TSA Security Operations Center (SOC).

The Contractor shall perform monthly security scans on servers that contain TSA data, and shall send monthly scan results to the TSA IAD.

D. Risk Management Framework This section is not applicable if contract has DHS Sensitive Information Required Special Contract Terms (MARCH 2015), SAFEGUARDING OF SENSITIVE

INFORMATION (MAR 2015)

D.1. The Security Authorization and Ongoing Authorization Process in accordance with NIST SP 800-37 and SP 800-137 (current versions) is a requirement for all TSA IT systems, including General Support Systems (e.g., standard TSA desktop, general network infrastructure, electronic mail), major applications and development systems (if connected to the operational network or processing, storing, or transmitting government data). These processes are documented in the NIST Risk Management Framework (RMF). Ongoing Authorization is part of Step 6 “Monitoring” of the RMF. All NIST guidance is publicly available; TSA and DHS security policy is disclosed upon contract award with some exceptions, which are public facing (i.e., DHS Security and Training Requirements for Contractors).

D.2. A written Authorization to Operate (ATO) granted by the TSA Authorizing Official (AO) also known as TSA Chief Information Security Officer (CISO) is required prior to processing operational data or connecting to any TSA network. The Contractor shall provide all necessary system information for the security authorization effort.

D.3. TSA shall assign a security category to each IT system compliant with the requirements of Federal Information Processing Standards (FIPS) Pub 199 Standards for Security Categorization of Federal Information and Information Systems impact levels and assign security controls to those systems consistent with FIPS Pub 200 Minimum Security Requirements for Federal Information and Information Systems methodology.

D.4. Unless the AO specifically states otherwise for an individual system, the duration of any Accreditation shall be dependent on the FIPS 199 rating and overall residual risk of the system; the length can span up to 36 months.

D.5. The Security Authorization (SA)Package contains documentation required for Security Authorizations and Ongoing Authorization. The package shall contain the following security documentation: 1) Security Assessment Report (SAR), 2) Security Plan (SP) or System Security Authorization Agreement (SSAA), 3) Contingency Plan, 4) Contingency Plan Test Results, 5) Federal Information Processing Standards (FIPS) 199 Security Categorization, 6) Privacy Threshold Analysis (PTA), 7) E- Authentication, 8) Security Assessment Plan (SAP), 9) Authorization to Operate (ATO) Letter, 10) Plan of Action and Milestones (POA&M), and 11) Ongoing Authorization Artifacts as required by the DHS Ongoing Authorization Methodology (current version). The SA package shall document the specific procedures, training, and accountability measures in place for systems that process personally identifiable information (PII). All security compliance documents shall be reviewed and approved by the CISO and the IAD, and accepted by the CO upon creation and after any subsequent changes, before they go into effect. Ongoing Authorization artifacts https://www.dhs.gov/dhs-security-and-training-requirements-contractors include monthly TRigger Accountability Log (TRAL), monthly operating system scan results, application scans as directed, updated control allocation table (CAT), and associated memos as directed. All steps in the DHS Information Assurance Compliance Systems (IACS) shall be completed correctly, thoroughly and in a timely manner for all steps of the RMF.

D.6. The Contractor shall support the successful remediation of all identified system weaknesses and vulnerabilities that are identified as a result of the aforementioned security review process.

D.7. The Contractor shall submit and analyze monthly operating system vulnerability scans for the DHS Information Security Performance Plan FISMA Scorecard.

Vulnerabilities not remediated are generated into Plan of Action and Milestone (POA&M)s after 30 days.

E. Contingency Planning

Special Contract Terms (MARCH 2015), SAFEGUARDING OF SENSITIVE

INFORMATION (MAR 2015)

E.1. The Contractor shall develop and maintain a Contingency Plan (CP), to include a Continuity of Operation Plan (COOP), to address circumstances whereby normal operations may be disrupted and thus require activation of the CP and/or COOP. are disrupted. The Contractor’s CP/COOP responsibility relates only to the system they provide or operate under contract.

E.2. The Contractor shall ensure that contingency plans are consistent with template provided in the DHS IACS Tool. If access has not been provided initially, the Contractor shall use the DHS 4300A Sensitive System Handbook, Attachment K IT Contingency Plan Template.

E.3. The Contractor shall identify and train all TSA personnel involved with COOP efforts in the procedures and logistics of the disaster recovery and business continuity plans.

E.4. The Contractor shall ensure the availability of critical resources and facilitate the COOP in an emergency situation.

E.5. The Contractor shall test their CP annually and retain records of the annual CP testing for review during periodic audits.

E.6. The Contractor shall record, track, and correct any CP deficiency; any deficiency correction that cannot be accomplished within one month of the annual test shall be elevated to IAD.

E.7. The Contractor shall ensure the CP addresses emergency response, backup operations, and recovery operations.

E.8. The Contractor shall have an Emergency Response Plan that includes procedures appropriate to fire, flood, civil disorder, disaster, bomb threat, or any other incident or activity that may endanger lives, property, or the capability to perform essential functions.

E.9. The Contractor shall have a Backup Operations Plan that includes procedures and responsibilities to ensure that essential operations can be continued if normal processing or data communications are interrupted for any reason.

E.10. The Contractor shall have a Post-disaster Recovery Plan that includes procedures and responsibilities to facilitate rapid restoration of normal operations at the primary site or, if necessary, at a new facility following the destruction, major damage, or other major interruption at the primary site.

E.11. The Contractor shall ensure all TSA data (e.g., mail, data servers, etc.) is incrementally backed up on a daily basis.

E.12. The Contractor shall ensure a full backup of all network data occurs as required by the system’s availability security categorization impact rating per TSA Information Assurance policy.

E.13. The Contractor shall ensure all network application assets (e.g., application servers, domain controllers, Information Assurance (IA) tools, etc.) shall be incrementally backed up as required to eliminate loss of critical audit data and allow for restoration and resumption of normal operations within one hour.

E.14. The Contractor shall ensure sufficient backup data to facilitate a full operational recovery within one business day at either the prime operational site or the designated alternate site shall be stored at a secondary location determined by the local element disaster recovery plan.

E.15. The Contractor shall ensure that data at the secondary location is current as required by the system’s availability security categorization impact rating.

E.16. The Contractor shall ensure the location of the local backup repository and the secondary backup repository is clearly defined, and access controlled as an Information Security Restricted Area (ISRA).

E.17. The Contractor shall adhere to the DHS IT Security Architecture Guidance Volume 1: Network and System Infrastructure for the layout of the file systems, or partitions, on a system’s hard disk impacting the security of the data on the resultant system. File system design shall:

a. Separate generalized data from operating system (OS) files

b. Compartmentalize differing data types

c. Restrict dynamic, growing log files or audit trails from crowding other data

E.18. The Contractor shall adhere to the DHS IT Security Architecture Guidance Volume 1: Network and System Infrastructure for the management of mixed data for OS files, user accounts, externally-accesses data files and audit logs.

F. Program Performance

F.1. The Contractor shall comply with requests to be audited and provide responses within three business days to…