A00001_Attachment_02_-_Task_Order_1_SOW.pdf

SECTION J, ATTACHMENT 2: STATEMENT OF WORK FOR

TASK ORDER 1

1. Purpose Product, Service or Outcome Needed: The purpose of this Statement of Work (SOW) is to identify the tasks required to develop, deploy and maintain “Universal Enrollment Services” for programs and populations managed, authorized or serviced by the Transportation Security Administration (TSA). The intent of the TSA Universal Enrollment Services (UES) contract is to provide a full suite of enrollment services and the associated technical and operational infrastructure including, but not limited to:

• Information Technology Infrastructure:

o Enrollment system (software/hardware) required to capture and submit applicant data (biographic, biometric, identity and citizenship documentation and authentication) to the government for vetting and case management o Public portal to provide enrollment information, frequently asked questions (FAQs), enrollment center location information and search capability, appointment scheduling, pre/post-enrollment data capture, and post-enrollment customer service including applicant status information and troubleshooting o Non-public portal/tool for reporting and ticket/issue management o Fee collection, submission and reconciliation o Initial deployment of technology including interface development, connectivity, end-to-end system testing, and security authorization by the TSA Office of Information Technology (IT) Authorizing Official granting Authority to Operate

(ATO)

o Ongoing operations and maintenance of systems, resources, data centers, and equipment including ongoing IT Security authorization requirements

• Operational Infrastructure:

o Footprint of nationwide enrollment center facilities and vetted personnel to provide in person enrollment services o Customer service call center, technical help desk and escalated issue support o Operational support for contracts, personnel security and credentialing, deploying and managing enrollment center locations, training, signage, supplies, financial management, overall program management, quality assurance, etc.

Scope: TSA requests ready-to-market solutions to provide enrollment services for programs, populations, initiatives or functions required, authorized or serviced by or partnered with TSA. In addition to TSA core programs and populations, the enrollment services described in this SOW can be used to support stakeholders, offices, agencies, or entities that are serviced by or partnered with TSA. TSA is seeking solutions that will incorporate multiple private sector capabilities to increase the public's enrollment access and provide best in class enrollment services.

2. Background The Transportation Security Administration (TSA) is charged with safeguarding the nation’s transportation systems and ensuring the freedom of movement for people and commerce. To meet this mission, TSA conducts security threat assessments (STA) for applicants seeking access to transportation environments, critical infrastructure, and sensitive information or materials.

An STA may be any combination of the following three checks:

• Intelligence related checks for ties to terrorism,

• Immigration status or lawful presence check, and/or

• Criminal history records check (CHRC).

In order to conduct security threat assessments, TSA provides end to end program oversight and services from enrollment through vetting and case management.

Programs and populations using TSA enrollment services may include, but are not limited to, applicants for the Alien Flight Student Program (AFSP), Hazardous Materials Endorsement (HME) Threat Assessment Program (HTAP), Transportation Worker Identification Credential (TWIC®), TSA Pre✓® Application Program, and other programs/populations as required by TSA.

Applicants requiring enrollment may be located across the United States and its territories and its outlying possessions. TSA envisions that the enrollment services provider shall expand to cover additional programs and populations that require enrollment and/or credentialing related services as they evolve over time.

Depending upon the specific security threat assessment program and the related statutory and regulatory requirements, applicants must provide biographic data and, in most cases, biometric data (e.g. fingerprint and/or photo) and identity/immigration documentation to TSA in an approved and established format to facilitate the STA process.

Congress has directed that many STA programs be fee-based and self-sustaining. TSA established fees to fund the programs after providing the public an opportunity to comment on proposed fees. The fee per applicant is comprised of a combination of three elements and varies depending on the program and associated costs:

(1) the cost to collect, process and submit applicant information and all associated enrollment services;

(2) the fee the FBI charges to perform a search of applicant fingerprints against

FBI criminal history records systems (fee is subject to FBI regulations and requirements can change over time); and

(3) A TSA program fee to cover costs to administer the program and conduct the security threat assessment.

Payment of these fees by applicants is a requirement to undergo the TSA security threat assessment. Fees are updated via notice by the Government. TSA may provide services for some programs funded outside of fees such as via appropriations, interagency agreements or other non-user fee mechanism.

A description of the current programs/populations serviced by the Universal Enrollment Services (UES) Contractor is listed below. Programs and populations may evolve and change during the period of performance of the UES contract. (See Attachment 04 - UES Volume for details regarding transaction volumes):

Alien Flight Student Program (AFSP) - The Alien Flight Student Program is a program to screen prospective flight student candidates who are not citizens of the United States, before they are allowed to undergo pilot training. The mission of the program is to ensure that foreign students seeking training at flight schools regulated by the Federal Aviation Administration (FAA) do not pose a threat to aviation or national security.

Some of the pre-enrollment and payment processing for AFSP applicants is handled by TSA systems and resources, but UES supports the program with optional domestic fingerprinting locations as well as fingerprint processing (hard card and electronic), channeling of fingerprints to the FBI, and electronic submission to TSA. For hard cards, services include the receipt and tracking of ink-print fingerprints submitted by applicants, digitization of fingerprints, channeling of fingerprints to the FBI for criminal history information, electronic transmission to TSA, and hard card destruction. For already digitized fingerprints, services include the receipt of electronic fingerprints, channeling of fingerprints to the FBI for criminal history information, and electronic transmission to TSA.

Specific enrollment center location requirements are outlined in Attachment 03 – Consolidated Enrollment Center Baseline Locations.

Hazardous Materials Endorsement (HME) Threat Assessment Program (HTAP) –The Hazardous Materials Endorsement Threat Assessment Program conducts a threat assessment for any driver seeking to obtain, renew and transfer a hazardous materials endorsement on a state-issued commercial driver’s license. Under the USA PATRIOT Act, a state cannot issue, renew or transfer an HME unless the driver successfully completes TSA's security threat assessment. TSA developed HTAP to meet the requirements of the Act and to protect against the threat posed by terrorists transporting hazardous materials in commerce.

HTAP enrollment services include applicant pre-enrollment, appointment scheduling, in-person collection and processing of biographic and biometric application information (fingerprints), channeling of fingerprints to the FBI for criminal history information, identity document verification and scanning, fraudulent document analysis and identification, fee collection, fee reconciliation, and payment, help desk services, display of application status information on a public web portal, coordination with State licensing agencies, and electronic transmission of enrollment information to TSA. States utilizing the services of this contract are commonly referred to as “TSA Agent” States for future reference in this SOW. Specific enrollment center location requirements are outlined in Attachment 03 – Consolidated Enrollment Center Baseline Locations.

While the majority of states utilize the full suite of enrollment services provided by the UES Contractor, several states have elected to utilize their own services for collecting and submitting HTAP enrollment data to TSA and are not serviced by the current UES contract.

Non-TSA Agent states are primarily supported via the UES call center for questions regarding application processing. Refer to Attachment 10 – HTAP States and Participation for the list of non-TSA Agent states.

Transportation Worker Identification Credential (TWIC®) Program – A TWIC® is required by the Maritime Transportation Security Act for workers who need access to secure areas of the nation’s maritime facilities/vessels, and other personnel who require a TWIC®. TSA conducts a security threat assessment to determine a person’s eligibility and issues a biometric card to the applicant once approved. U.S. citizens and non-U.S. citizens https://en.wikipedia.org/wiki/Pilot_certification_in_the_United_States https://en.wikipedia.org/wiki/Federal_Aviation_Administration https://en.wikipedia.org/wiki/Federal_Aviation_Administration in certain immigrant/non-immigrant categories may apply for the TWIC®. Most mariners licensed by the U.S. Coast Guard also require a TWIC.

TWIC® enrollment services include applicant pre-enrollment, appointment scheduling, in-person collection and processing of biographic and biometric application information (fingerprints and photo), channeling of fingerprints to the FBI for criminal history record information (CHRI), identity document verification and scanning, fraudulent document analysis and identification, fee collection, fee reconciliation, and payment, help desk services, display of application status information on a public web portal, card management and issuance support, card transfer, coordination with Port stakeholders, temporary enrollment option, Authorized Non-Public enrollment option, and electronic transmission of enrollment information to TSA. Specific enrollment center location requirements are outlined in Attachment 03 – Consolidated Enrollment Center Baseline Locations.

TSA Pre✓® Application Program – TSA Pre✓® is an expedited security screening program for travelers departing from the United States. Passengers can apply for the TSA Pre✓® Application Program to determine if they are low-risk and eligible to receive expedited screening.

TSA Pre✓® Application Program enrollment services include applicant pre-enrollment, appointment scheduling, in-person collection and processing of biographic and biometric application information (fingerprints and potentially additional biometrics), channeling of fingerprints to the FBI for criminal history information, identity document verification and scanning, fraudulent document analysis and identification, fee collection, fee reconciliation, and payment, help desk services, display of application status information on a public web portal, coordination with stakeholders such as airports, and electronic transmission of enrollment information to TSA. Specific enrollment center location requirements are outlined in Attachment 03– Consolidated Enrollment Center Baseline Locations.

Smaller TSA Populations – TSA requires specialized enrollment services for small populations, such as biographic and biometric data capture for the TSA Office of Chief Counsel (OCC)/and other small populations as required. These “small populations” typically service a limited number of applicants, and require in-person enrollment with biometric collection. The Contractor must provide a flexible enrollment workflow that can be easily configured for small populations.

Other Programs/Populations (not confirmed nor guaranteed) – Other and/or Future programs are neither confirmed nor guaranteed but may also include programs, populations, entities and/or applicants from other entities or sponsors that are utilizing TSA services.

Examples may include but are not limited to other DHS or government components.

3. Technical Requirements/Tasks/Outcomes The Contractor shall provide enrollment services for TSA employing innovative solutions for applicant enrollment including online, telephone and in-person data and fee collection. The Contractor shall develop, deploy, operate and maintain an enrollment system that shall collect and store applicant biographic and biometric information and submit that data to TSA systems, the FBI Criminal Justice Information Services Division (CJIS) and/or other systems or entities as specified by TSA.

The Contractor shall establish in-person enrollment locations to provide enrollment services including biographic data capture, biometric data collection (e.g. fingerprint, iris, photo, etc.), identity verification and identity document authentication, and fee collection using Contractor-provided equipment, which the Contractor shall operate, maintain and replace/refresh/upgrade as needed for the life of the contract.

The Contractor shall work with Maritime Ports, Airports, State Licensing agencies, and other associated program stakeholders as well as understand market demand in coordination with TSA to establish enrollment centers in locations convenient to the populations served. The Contractor shall communicate enrollment center locations and hours of operations to the public and commit to providing convenient, professional, customer service oriented locations that minimize public burden. Specific location requirements are captured in Attachment 03 – Consolidated Enrollment Center Baseline Locations.

Depending upon the enrollment service requirements of the program, some applicants may be able to complete their service entirely online or by phone, but most programs require applicants to go to an in-person enrollment center to complete the enrollment process. At the enrollment center, the applicant is typically required to provide identity documents for verification, authentication and capture as well as provide biometrics (e.g., fingerprints, photo, etc.) and associated program fees.

TSA’s objective is to establish enrollment centers and services to support programs including locations in all 50 States, District of Columbia, and US Territories and Outlying Possessions. In addition to enrollment centers established by the Contractor, the Contractor may also be required to provide enrollment services at government, quasi-government or TSA authorized facilities. At these facilities, the Government or authorized entity shall provide the physical space to meet contract requirements, but the Contractor may be required to provide varying levels of enrollment services, including technology/equipment, supplies, training and personnel. For example, under the current contact, the United States Coast Guard provides physical space for two facilities that help service the TWIC® population, which are staffed and operated by Contractor personnel.

The sections below detail further the tasks required for the Contractor to provide enrollment services (see also Attachment 14 - Universal Enrollment Services Requirements Matrix for further detailed requirements):

• Conduct Enrollment Activities:

o Operate, Maintain, and Update Public Web Portal o Identity/Immigration Document Collection o Comparability o In-Person Enrollment o Enrollment/Collection Personnel

• Credential/Card Issuance o Receipt and Storage of Cards o Enrollment Center Card Issuance Support o Enrollment Center Post-Issuance Card Support o Manage Card Inventory o Provide Direct Mail Back Office Support

• Establish and Maintain Enrollment Center Operations o Fixed Enrollment Centers o Temporary Enrollment Events o Population-Specific Enrollment Centers o Opening and Closing of Enrollment Centers o Authorized Non-Public Enrollment Capability o Special Considerations

• Provide and Maintain an Information Technology System o Applicant Data Transmission o Fingerprint and Criminal History Records Information (CHRI) Transmission o Receipt of Applicant Data o Data Storage and Usage o Fee Reconciliation o Fee Reimbursement o Subject Matter ExpertiseInformation Assurance Support

• Provide Customer Support o Manage and Distribute Phone Calls o Provide Applicant Support o Conduct Telephone Enrollments o Ticketing System o Provide Technical Support o Provide Operational Support o Provide Engineering Support o Metrics Reporting o Send Automated Notifications o Capture Customer Feedback

• Conduct Transition and Migration Activities o Contract Start Up Transition o End Contract/End Service Related Transition and Migration

• Innovations and Service Approaches o Identity Assurance o Citizenship Verification Methods o Enrollment Hardware o Wait Time Capture o Contingency Staffing o Appointment Management o Applicant Communications Strategy o Enrollment Marketing Opportunities

4.1 Conduct Enrollment Activities (CLIN 0001 applies to section unless otherwise noted by sub-heading/sub-section) The Contractor shall deliver and maintain the infrastructure and framework (including but not limited to personnel, facilities, hardware, and connectivity) necessary to support all aspects of the enrollment process. The Contractor shall have the capability to collect, receive, store, and transmit applicant biographic and biometric information for application processing.

The enrollment infrastructure must have the capability to support the enrollment volume indicated in Attachment 04 - UES Volume, as well as be flexible to quickly expand to support new programs/populations. The Contractor shall ensure enrollment services meet enrollment demand according to established service levels in the contract, to include managing throughput, overall physical and system capacity, and scalability. The Contractor shall have the capability to respond to increased enrollment volumes to include surge periods, new populations, and new requirements as defined by the Government.

First-time applicants have the option to submit biographic information online, over the telephone, or in- person at an enrollment center as applicable to the program. However, all applicants shall be required to complete the in-person enrollment process with the Contractor for identity verification and biometric collection.

Currently, the TSA programs require that an applicant return back to an in-person enrollment center prior to their expiration of their security threat assessment in order to renew their benefit or credential. With the implementation of the UES Recompete contract, the Contractor shall support an online-only renewal process for the TSA Pre✓® population. All other TSA programs shall continue to require in-person enrollment for renewals.

During the initial contact, whether it is during either the optional pre-enrollment or in-person enrollment, the Contractor must present a TSA-approved privacy statement and obtain express authorization from the applicant for all uses of personally identifiable information (PII). The Contractor can only collect biometric and biographic data as directed/approved by TSA.

Additionally, the Contractor shall notify the applicant that the name on the application must exactly match the name on the applicant’s identity and proof of citizenship/immigration document(s), subject to rules established by TSA.

As part of enrollment services, the Contractor shall provide Spanish translation services for enrollment functions such as, but not limited to, website translation, enrollment software translation, presentation of signage/documentation at enrollment centers, and automated notifications.

4.1.1 Operate, Maintain, and Update Public Web Portal (CLIN 0004 applies for online-only transactions such as renewals, comparable enrollments, and card replacement orders)

The Contractor shall develop, deploy, operate, and maintain a public facing web portal optimized for all major web browsers and mobile devices, to support applicant activities including, but not limited to:

• General information on enrollment process, programs, FAQs

• Entering biographic data online for new enrollments (e.g., “pre-enrollment”)

• Entering biographic data online for renewals (initially only applicable for the TSA Pre✓® population)

• Enrollment center location search

• Online appointment scheduling and management

• Application status lookup

• Online comparability queries and enrollment/opt-in capability

• Online enrollment/opt in capability when in-person enrollment is not required (e.g., Reduced-fee HME based on TWIC® Comparability)

• Uploading identification/citizenship documents (reference Section 4.1.2

Identity/Immigration Document Collection)

• Customer service support/information

• Updating contact information

• Online payment capability (fee collection) and ability to provide receipts.

• Ordering replacement cards (for applicable populations who receive a physical card/credential, e.g., TWIC®)

Functional requirements related to these activities are contained in Attachment 14 – Universal Enrollment Services Requirements Matrix. Select activities are defined in further detail below.

Viewing General Information The web portal shall provide information to help applicants understand the purpose of TSA programs and readily answer most applicant/enrollment questions. The website shall act as a source of information and as a customer service tool for various populations including, but not limited to, applicants, government personnel, and customer service representatives.

General information shall include, but not be limited to, program descriptions, eligibility requirements, program fees, frequently asked questions, customer support contact information, TSA important documents and TSA.gov URL links. TSA must approve the overall website design, content and functionality and any website changes prior to implementation throughout the life of the contract.

Entering Biographic Data Online for New Enrollments (“Pre-Enrollment”) The Contractor shall establish a secure web-based pre-enrollment interface and process that shall allow applicants the opportunity to provide enrollment data online. The web portal shall allow the applicant to enter biographic information and upload identity documents. The web-based pre-enrollment workflow must include error-checking functionality to eliminate common data quality errors and ensure completeness of the application.

Entering Biographic Data Online and Uploading Documents for Renewals Initially applicable only for the TSA Pre✓® population, the Contractor shall establish a secure web-based interface and process that shall allow applicants with an expiring benefit or credential the opportunity to provide enrollment data online and upload supporting identity/immigration documents. At the beginning of the online renewal process, the web portal shall require the applicant to provide a unique identifier (such as a Known Traveler Number (KTN)). After the unique identifier has been systemically validated, the web portal shall allow the applicant to enter biographic information. The web-based workflow must include error-checking functionality to eliminate common data quality errors and ensure completeness of the application.

Enrollment Center Location Search For those applicants who elect not to schedule an appointment, the web portal shall provide a standalone enrollment center locator capability. The web portal shall allow applicants to search for enrollment centers based on key information such as current location, ZIP code, city/state, or other searchable points of interest (such as airport, metropolitan area, etc.) Results returned from the location search function shall include information such as: enrollment center address, directions and landmarks to ensure applicants can find the center, Contractor branded business name or business partner name if applicable, mileage from searched location, populations/programs serviced, days and hours of operation, parking availability, and other information, such as special openings and closings. The purpose is to ensure applicants are able to select a convenient location.

Online Appointment Scheduling/Management The web portal shall provide the capability for an applicant to schedule an appointment at an enrollment center when in-person enrollment services are required. The appointment function shall allow applicants to schedule, change, or cancel enrollment appointments. To facilitate the scheduling of an appointment at the enrollment center most convenient for an applicant, the web portal shall allow applicants to search for an enrollment center based on key information such as current location, ZIP code, city/state, or other searchable points of interest (such as airport, metropolitan area, etc.).

Application Status Lookup The Contractor shall provide the capability for applicants to inquire via the web portal regarding applicant enrollment status. The system shall interact with internal TSA systems to display the most current enrollment status on the web portal, using TSA approved status information. Once an applicant’s security threat assessment is complete, the web based portal shall allow applicants to look up information regarding their eligibility such as an approved membership number (ex.

Known Traveler Number (KTN) lookup) or expiration date of their security threat assessment so applicants will know when to renew in advance of STA expiration.

Online Payment Capability For pre-enrollments, the Contractor may collect payment but must establish a policy and process to handle refunds in a timely manner, as fees cannot be retained for services that are not rendered.

If service is not completed within 6 months, then the Contractor shall be required to refund any payment collected. Fees cannot be remitted to TSA until the completed application is submitted to TSA for processing (which shall occur when the in-person portion of the enrollment process is completed). For programs, populations, and services that require an in-person enrollment center transaction, the Contractor must provide the capability for applicants to pay during their in-person enrollment.

For online renewals, the Contractor is required to collect payment from applicants.

If payment is submitted online via the web-based portal, applicants must be provided with an easy way to obtain a receipt for payment. The web portal shall provide a confirmation to the applicant as well as an option to receive an emailed copy of the receipt.

Online Comparability Queries/Enrollment Submissions For programs that allow applicants to enroll based on a comparable security threat assessment (STA), some applications can be supported entirely online without the requirement for in-person enrollment. Please reference Section 4.1.3 for a more detailed description of comparability.

The web portal shall provide the capability for applicants to query online to determine if they can apply for comparability due to enrollment in another program. This query shall be offered as a standalone lookup function as well as embedded into the online enrollment workflow when applicable. After confirming an applicant’s identity and the validity of their reduced fee application request, based on a comparable STA, the web portal shall allow the applicant to pay for the enrollment via credit card. Once the payment has been successfully processed, the web portal shall provide a confirmation to the applicant as well as an option to receive an emailed copy of the receipt. Reference Section 4.1.3 for further details regarding comparability.

Updating Contact Information The web portal shall provide applicants the capability to self-update contact information such as phone number and e-mail. The web portal shall support the capability to allow applicants the ability to “opt-in” and “opt out” of communications.

Ordering Replacement Cards For programs that issue a physical credential, the web portal shall allow an applicant to place a replacement order online. After confirming an applicant’s identity and the validity of their replacement request, the web portal shall prompt the applicant to indicate why the replacement is being requested and where it shall be shipped. Lastly, the web portal shall allow the applicant to pay for the replacement via credit card. Once the payment has been successfully processed, the web portal shall provide a confirmation to the applicant as well as an option to receive an emailed copy of the receipt.

4.1.1.1 Web Portal Content Updates

After the initial deployment of the web portal, the Contractor shall post TSA-approved enrollment center updates that are included in the approval and site survey criteria. Updates to content such as hours of operations, addresses, etc. do not require additional TSA review prior to posting. Any other web portal content that falls outside the criteria must be reviewed and approved by TSA prior to posting to the web portal.

Furthermore, the Contractor shall accommodate ad-hoc updates to the website which include, but are not limited to, addition or modification of frequently asked questions, posting of new reference documents, and updates/replacement of existing reference documents. Due to the operational nature of TSA programs, these changes need to be accommodated or deployed outside of a formal release cycle and in near-real time, with a maximum of a 5 business day turnaround. Separate from the above listed examples of reference information, any “important notices” on the home page of the website shall be updated within 24 hours (during business days) of the request when urgent information is necessary to release to the public (e.g. network outage or program impacts). Lastly, the Contractor shall ensure continuous review of the Web Portal to verify the portal is in good working order and free of broken links, error pages, etc.

4.1.1.2 Web Portal Technical Considerations (See also Section 4.12 IT and System Security Requirements)

The Contractor shall utilize its own resources to host the web portal for all non-private information but shall use a domain name provided by TSA.

The web portal must be developed utilizing TSA approved COTS/GOTS software at the most current version and hardened according to TSA and DHS hardening guidelines as well as other hardening standards as applicable.

The web portal shall store applicant information to the UES system and shall allow system representatives with privileged/authorized access to retrieve and/or update applicant information.

The Contractor shall provide the capability to control information access via authorized user access levels. The authorized user access requirement does not apply to external users accessing the web for status and other data needs.

The web portal must utilize FIPS PUB 140-2 approved encryption methods for transmitting and storing data and require user authentication prior to gaining access. In addition, the web portal must implement multifactor authentication in accordance with NIST, DHS, and TSA policies and guidelines.

4.1.2 Identity/Immigration Document Collection

The Contractor shall collect identity documents from the applicant using the relevant program document list as indicated in Attachment 12 - Required Enrollment Documentation.

Applicants may provide identity documents through one of the three options below:

1) Prior to the in-person enrollment process by uploading through the web portal (during pre-enrollment)

2) During the online-only renewal process (initially applicable only for the TSA Pre✓® population)

3) During the in-person enrollment process

4) After the in-person enrollment process by uploading through the web portal*

* If the applicant never uploads the outstanding document(s), the Contractor must be able to process refunds in a timely manner, as fees cannot be retained for services that are not rendered.

Fees cannot be remitted to TSA until the completed application is submitted to TSA for processing. If the Contractor has provided service, the Contractor will be entitled tomay keep their portion of the enrollment fee per the Contractor’s discretion/policy.

Document upload via the web portal shall be available for all TSA programs upon initial deployment of the UES system. However, use of the document upload capability is only required for TSA Pre✓® applicants that are renewing online (per option #2 above).

TSA shall dictate the policy regarding which documents will be allowed to be uploaded before/after enrollment (options #1, 2, and 4 above). This policy will be impacted by the Contractor’s solution regarding authentication of documents. For example, if the Contractor proposes verifying driver’s licenses with the issuing state agency, then a document upload of a driver’s license would not be required.

The Contractor may propose citizenship verification methods that may not require all the relevant documents contained in Attachment 12 - Required Enrollment Documentation. Reference Section 4.7.2 Citizenship Verification Methods.

Quality Assurance of Uploaded Documents (Options #1, 2, and 4) The Contractor shall have a back-office process to conduct quality assurance of documents uploaded before or after the in-person enrollment process. Quality assurance shall include but is not limited to:

• confirmation of document type uploaded (e.g. if an applicant has uploaded a passport, then the Contractor shall confirm that the image is of a passport)

• confirmation that the document is legible/readable

• confirmation that the biographic information on the uploaded document matches the information provided during enrollment

• checks of document authenticity (for example, by verifying document content with the issuing entity)

If (based on the review of uploaded documents) further documentation is required, then the Contractor shall proactively reach out to the applicant for the documentation needed.

In-Person Enrollment Document Capture (Option #3) Qualified and trained contractor personnel responsible with assisting applicants during the in-person enrollment process shall be here on out referred to as “Trusted Agents.” If an applicant uploads documents before the in-person enrollment process, then when the applicant appears at in-person centers to complete the enrollment process, the Trusted Agent shall confirm that the documents uploaded visually match the identity of the applicant appearing at the enrollment center and that the documents are certified, unexpired and valid (as applicable to the document).

If no photo exists on the uploaded document, then the Contractor shall verify that the biographic information on the uploaded document matches the information provided during in-person enrollment (which includes the name and gender on the government-issued photo ID).

Contractors shall allow for data corrections/updates during the in-person enrollment process, ensuring that all applicant data is accurate and the data provided in the application matches exactly with the data listed on the identity documents.

Whether identity documents are uploaded prior to or after the in-person enrollment, the applicant must bring a government-issued photo ID to complete the in-person enrollment process. The photo ID presented must contain the name and gender under which the applicant is enrolling; the Trusted Agent shall enter the name and gender from the photo ID into the application. For specific guidance regarding name entry during the enrollment process, reference Attachment 11 - Name Entry Policy. If the applicant does not have a government issued photo ID with the name and gender under which they wish to enroll, then the Trusted Agent shall stop the enrollment process and request that the applicant return with a government issued photo ID with the preferred name and gender.

4.1.3 Comparability

There are two core types of enrollments the applicant may be able to select from:

1.) New (Full Fee) Enrollments – An applicant is applying to a program for the first time, or re-enrolling after their original security threat assessment has expired (typically after 5 years).

2.) Comparable (Reduced Fee) Enrollments – An applicant is applying for a program, but does not need to undergo a full security threat assessment (STA) based on their enrollment in another program deemed “comparable” by TSA.

The Contractor shall allow applicants enrolling/applying for a program to apply comparability for previously, successfully completed STAs/enrollments for given programs that are unexpired and valid. Eligible comparable programs may extend beyond TSA (e.g. the Customs and Border Protection Free and Secure Trade (FAST) card). TSA will identify all comparable programs at contract award and update the list as changes occur.

Depending upon the program for which the applicant is applying as well as the completed STA/enrollment being used for comparability, the applicant shall either be able to complete the enrollment process entirely online or be required to complete the enrollment process in-person.

The Universal Enrollment Services process and system shall allow applicants the option of applying comparability or applying without comparability. To facilitate the choosing of an option, the system shall show the applicant the projected STA expiration date if comparability is leveraged as well as the STA end date if comparability is not leveraged. If using a Hazardous Materials Endorsement for comparability, the system shall calculate the projected STA expiration date if comparability is leveraged based on which U.S. State the applicant’s CDL is issued by, using rules and logic provided by TSA to compute the expiration date of the STA. See Attachment 10 - HTAP States and Participation for CDL terms. The system shall require the applicant to acknowledge whether they have selected to enroll using a comparable STA.

The Contractor shall provide for the capability to capture a reduced fee for enrollment submitted with comparability, using the applicable fee structure to be provided by TSA post-award. The reduced fee amount may vary depending on the type of comparability being requested and the program requirements and regulations as applicable.

The Contractor shall identify reduced fee enrollments when submitting to TSA.

4.1.4 In-Person Enrollment

Applicants have the option to provide biographical information and identity documents via a pre-enrollment web portal and appear in-person at Contractor enrollment centers to complete the enrollment process, or they may complete the entire enrollment process in-person. Note that AFSP applicants do not use the UES web portal for pre-enrollment but instead submit data at www.flightschoolcandidates.gov.

Enrollment procedures at in-person enrollment centers may include but are not limited to any combination of identity verification, confirmation of application/enrollment data, submission of biometrics, and fee collection (if not collected previously during pre-enrollment).

During the in-person enrollment process, the Contractor shall:

1) Capture required Personally Identifiable Information (PII) and/or confirm PII entered during pre-enrollment.

2) Collect the required biometric data (if applicable to program).

3) Verify the applicant’s identity with the identity documents presented. Please note that while the applicant is required to provide identity documents to complete the application process, the documents may be uploaded in advance of the in-person enrollment process or after (as described in Section 4.1.2 Identity/Immigration Document Collection). At a minimum, the applicant must provide a government-issued photo ID to the in-person enrollment.

4) Collect fees.

If applicable to program (e.g. for applicants who request TWIC®s mailed to a specified address), http://www.flightschoolcandidates.gov/ the Contractor shall provide a lanyard, a water-resistant rigid plastic card or badge holder, and documentation (such as an information card and TWIC® Card Holder Responsibilities and Proper Use and Handling Requirements) at the end of the enrollment process. The card protector will protect the TWIC from bending, flexing, or punctures caused by routine use of the card, shield the card from harsh environmental factors, and enable the card to be read by a contactless electronic reader without removing the card.

4.1.4.1 Biometrics Collection

Based on program, the Contractor may be required to collect one or more sets of biometrics to include ten-print fingerprints and photograph.

Electronic Fingerprint Collection Fingerprint collection shall be in accordance with the most current FBI Electronic Biometric Transmission Standards (EBTS) specification. 4-4-2 flat fingerprint capture is required. Roll fingerprint capture is not required.

Reference https://www.fbibiospecs.cjis.gov/EBTS/Approved for details.

Contractor procedures for fingerprint collection and transmission shall be provided to TSA for approval.

Photograph Collection Photos shall comply with standards in the ICAO document 9303 titled “Machine Readable Travel Documents”, Seventh Edition, dated 2015, Part 3 and any updates or similar changes governing such standards. Refer to Section 3.9.1 for detailed photograph capture guidelines.

4.1.4.2 Fee Collection (CLIN 0001, CLIN 0002, CLIN 0003, CLIN 0004) The Contractor shall collect payment/fees as applicable to the program prior to completing the enrollment/application process. For applications requiring in-person enrollment, payment can be collected during pre-enrollment if the Contractor determines this is acceptable, but the Contractor must be able to process refunds in a timely manner, as fees cannot be retained for services that are not rendered. For online-only renewals, the Contractor shall collect the fee during the online renewal process. If an applicant has paid either during pre-enrollment or the online renewal process and not completed the required in-person or document upload component of the application process within 6 months, then the Contractor shall be required to refund any payment collected. Fees cannot be remitted to TSA until the completed application is submitted to TSA for processing.

The Contractor shall remit fees to TSA in form and manner consistent with Attachment 07 - Fee Collection Requirements, describing requirements for the collection of government funds. The Contractor is not authorized to collect cash or collect money for any fees other than those fees approved and authorized by TSA. The Contractor is responsible to establish procedures for the collection and submission of the fee and provide to TSA for approval.

Fee collection and transmission of program fees must be compliant with US Treasury requirements including DAILY transmission of TSA fees as they are collected and include payment confirmation by the government at the application/applicant/transaction level. Bulk transmission of fees (i.e. transmission not at or traceable to the individual application/applicant https://www.fbibiospecs.org/ebts.html transaction level) is NOT permitted). The Contractor shall collect and remit fees daily to TSA via TSA approved processes to include pay.gov.

In addition to collecting fees from an applicant applying for a single program, the Contractor shall have the capability to:

- collect fees for the enrollment of multiple programs as well as to calculate and collect reduced fees based on comparable STA enrollments/applications.

- accommodate bulk payments (e.g. payment of enrollment fees by an employer for its employees or by a company for its customers) via a “no cost authorization code” (NCAC) structure. The Contractor shall issue unique alphanumeric NCACs to a requesting organization. NCACs shall have a minimum validity period of one year.

The requesting organization is responsible for allocating and distributing NCACs to individuals for use during enrollment. While the Contractor shall remit payment to TSA once the enrollment has occurred, the Contractor shall work with the requesting organization to invoice the appropriate enrollment fee once the NCAC has been used by an individual.

The Contractor shall accommodate both regularly scheduled distributions of NCACs to requesting organizations as well as ad-hoc requests. To provide optimal customer service, the Contractor shall consider development of a self-service NCAC request capability.

If the NCAC list has been compromised, the Contractor shall have the ability to invalidate the compromised codes.

- accommodate enrollments of applicants designated by TSA at no cost to the applicant via NCACs. Once the NCAC has been used, the Contractor shall invoice TSA for the Contractor and FBI portions of the fee (the Government portion of the fee will be absorbed by TSA).

- accommodate enrollments of applicants designated by Contractor at no cost to the applicant via NCACs (e.g., the Contractor made an error during the initial enrollment and a no-cost re-enrollment is required.) In this case, the Contractor must still pay the TSA and FBI portions of the fee to those entities.

- support loyalty programs, whereby a third party chooses to market and ultimately “fund” their customers’ enrollment in a TSA program. For example, an airline or hotel may allow customers to redeem “loyalty points/miles” for enrollment in a TSA program. In this scenario, the UES Contractor must provide the infrastructure and tracking that supports redemption programs. For example, the UES Contractor could provide the airline/hotel with NCACs that are provided when points are redeemed, and then a mechanism to invoice the airline/hotel as the coupons are used.

The Contractor shall have the flexibility to adjust amounts collected if regulations or requirements change the TSA/program fee amounts.

Reference Section 4.4.5 Fee Reconciliation for corresponding fee reconciliation requirements.

4.1.4.3 Enrollment Hardware

The Contractor shall propose a suite of enrollment hardware that supports all requirements listed in Section 4.1.4 In-Person Enrollment.

The enrollment hardware and any other systems used in the field shall either be part of the System Boundary of the Major Application or connected to a Major Application via a TSA-approved Interconnection Security Agreement (ISA) if allowed by TSA Information Security policy. If allowed via TSA IT Security policy, proposals involving ISA-connected enrollment stations that are considered “outside” the TSA system boundary may require additional lead time in receiving a TSA ATO.

Proposed multi-tenant approaches in which the enrollment software and hardware is used to capture enrollment data for UES and non-UES populations would require an ISA.

The proposed hardware solution shall limit the viewing of biographical information to only the Trusted Agent and applicant within the enrollment center. Furthermore, the proposed hardware solution shall provide the ability for the applicant to self-enter information for a limited set of biographic data fields (such as social security number and weight).

Proctored enrollments (in which a Trusted Agent oversees applicants self-entering required data) are permitted as long as the Trusted Agent conducts the in-person identity verification function.

Regardless of solution, Trusted Agents must login using a TSA approved multi-factor authentication solution, which requires a PIV login as part of the solution.

Upon successful submission of an application to the appropriate TSA systems, all applicant data shall be deleted from the equipment according to security standards.

Hardware at TSA Locations In addition to providing enrollment hardware for enrollment centers, the Contractor shall support the deployment and maintenance at locations designated by TSA. For example, there is currently a suite of enrollment equipment at TSA headquarters to support the enrollment of TSA personnel and applicants designated by TSA. In this instance, there are TSA personnel who have been trained and certified as Trusted Agents; these applicants then perform enrollment duties at TSA headquarters on an as-needed basis.

TSA anticipates that up to 5 sets of enrollment hardware/software would be provided to the Government at no additional cost (the cost for these hardware sets should be built into CLIN transaction pricing). Any additional sets of hardware would be purchased by TSA.

Hardware/Peripheral Spares and Replacement The Contractor shall propose an approach for replacing and upgrading hardware and peripheral equipment at enrollment centers that is failing due to technical reasons or has become obsolete during the life of the contract. The approach shall include consideration of having spare equipment available onsite as well as strategic geographic locations with spare equipment that would minimize disruption to enrollment center operations.

If there is a hardware failure at an enrollment center that is scheduled to be open the following calendar day, then TSA requires that replacement equipment be onsite within 24 hours of the reported failure. If the enrollment center with the hardware failure is not scheduled to open the next calendar day, then the replacement requirement shall be onsite prior to the next business day.

The Contractor shall ensure the equipment used at the in-person enrollment centers encrypts all data, at rest and in transit, according to FIPS PUB 140-2 encryption methods.

4.1.5 Enrollment/Collection Personnel

The Contractor shall staff their locations with qualified and trained personnel, referred to by TSA as “Trusted Agents” (TAs).