70T04022R7672N007 Questions and Answers Attachment 01 Amendment 0003.pdf

70T04022R7672N007 Questions and Answers

No. RFP Document Name Section No. Section Name Page No. RFP / Document Text Question TSA Response L.5 Instructions for Proposal

Preparation 155 Volume II: Phase II- Oral Presentation and

Demonstration (See Section L.5.2)

• 1. Oral Presentation, NTE 1 hour

• 2. Demonstration, NTE 2 hours 1 - slides NTE 24

L.5.2.2 Submission Requirements 160 The time for oral presentations is limited to one

(1) hour. Offerors may submit PowerPoint Slides to accompany their oral presentations. The slide limit is 25 slides. Offerors are reminded that the oral presentation is time-limited and Offerors are encouraged to consider how many slides can be adequately covered during the oral presentation.

The content of the oral presentation is being evaluated and any material not presented at the oral presentation will not be considered in the evaluation regardless of its inclusion in the slide deck.

2 Request for Proposal L.5 Instructions for Proposal Preparation

155 Volume I: Phase I- Technical (See Section L.5.1)

• Technology Solution (Factor 1) o Tab 1: Self-certification Matrix o Tab 2: Schematics of Technology Solution o Tab 3: Screen Images

Can the TSA please confirm if the Phase 1 submission must be submitted in a Microsoft Excel file due to your requirement of Tab 1, Tab 2, and Tab 3 format? If not, can the TSA please state what format they would prefer Offerors to use?

Offerors may submit the Phase I submission in Microsoft Excel or Adobe PDF format. The RFP has been amended to reflect this guidance.

2.1.5.4 Batteries 16 The system will be able to operate continuously for 2 hours minimum without replacing batteries.

The system will use rechargeable batteries. The rechargeable batteries must have the ability to recharge while the system is in use and plugged into an outlet.

Part C.1 Battery Requirements 40 All CAT systems must be capable of holding and running on a battery for power. The Contractor shall provide batteries and battery chargers in accordance with the CAT FRD.

Requirements of the system with respect to the batteries must include:

• The ability to operate continuously on battery power alone for at least six (6) hours with a replaceable battery(ies) when new.

• The ability to fully recharge the battery in less than the amount of time that it takes to deplete the battery.

• The battery(ies) and the battery charger being non-proprietary and commercially available.

• Designing the battery(ies) to allow for the 5th percentile female through the 95th percentile male (as defined in MIL-STD-1472G) to replace the batteries as needed for operation, without the need for tools. Consideration should be given to battery size and weight.

Note: Continuous operation does not allow for swapping of batteries within four (4) hours.

4 Request for Proposal L.5.1 Instructions - Phase I, Volume I, Technology Solution (Factor 1)

156 b. TAB 2 – Design Schematics of the overall technology solution.

c. TAB 3 – Primary and Secondary screen images [see FRD, Section 3.3.4.2 Graphical User I f (GUI)]

Can Offerors provide a narrative with the images of design schematics and primary and secondary screen images? Yes, offerors may provide a narrative with the images of the design schematics and primary and secondary screen images.

5 Request for Proposal L.5.2.1.2 Demonstration Requirements 160 TSA will provide a Security Technology Integrated Program (STIP) emulator on Compact Disc (CD) to each Offeror participating in Phase

Will the TSA please consider providing the bidders with the STIP emulator via another means than a Compact Disc since most computers no longer come with a CD drive?

The STIP emulator may only be provided in a Compact Disc format.

6 Request for Proposal C.4.2 Elements of System Enhancement

17-18 TSA anticipates system enhancements to include a digital ID authentication capability (such as mobile driver’s license), the ability to biometrically authenticate passenger’s identity against a database, the ability to allow the passenger to insert their own ID into the readers, and the ability to read boarding passes.

1. If the TSA chooses an enhancement that will require additional hardware that alters the design of the CAT-2 system, will the TSA require the vendor to retrofit the CAT-2 systems already in production?

2. If an enhancement is chosen after production, will the TSA require new CLIN 0001 and CLIN 0002?

3. Since the enhancements are not mentioned in the Phase 3 Pricing Proposal, will the TSA raise a change request when an enhancement is chosen?

1.There is no requirement to retrofit systems produced by another vendor, but the offeror will need to retrofit their own systems whether they are deployed or in production in the event of a required enhancement during the IDIQ ordering period.

2. A system enhancement occurring after production may be awarded as a task order utilizing Engineering CLINs 0011 or 0012.

3. Please see response to part 2 of this question.

Request for Proposal Can the TSA please confirm if the slide NTE limit is 24 or 25 slides?1 The slides are NTE 25 pages. The RFP has been amended to reflect that these slides will NOT

BE EVALUATED.

CAT-2 Final Functional Requirements Document

Can the TSA please confirm that batteries are required to operate continuously for 6 hours? The last paragraph in Request for Proposal Part C., Section 11.0 states that the batteries cannot be swapped out within 4 hours, which contradicts the 2-hour minimum requirement in CAT-2 Final Functional Requirements Document Section 2.1.5.4

The requirement is: The system will be able to operate continuously for 4 hours minimum without replacing batteries. The RFP, Section C, 11 has been revised to reflect this.

7 Request for Proposal B.4.1 Pricing Schedule and CLINS 7 The table indicates CLIN12 is funded for $12,000,000 (NTE). Price Attachment B, however, indicates that CLIN12 is funded for $1,200,000 (NTE).Can the government clarify which is the correct funding level?

CLIN 0012 will be awarded with a ceiling of $1,200,000.00. Section B.4.1 of the RFP has been amended to reflect this.

8 Request for Proposal B.4.1 Pricing Schedule and CLINS 7 Are the funding levels for CLINs 11 and 12 annual or do they represent the total the government intends to invest in engineering services per vendor over the 7-year lifetime of the contract vehicle?

The NTE values in CLIN Table B.4.1 are per vendor over the 7 year ordering period.

9 Request for Proposal 3 Applicable Documents and Standards

11 We kindly request that TSA provide the two SSI documents referenced in Table 1, Line 6 “TSE IT Security Requirements, Version 2.0, Sept 23, 2013” and Line 26, “PIPE IRD Attachment 12.”

Attachment 12 was provided as part of the SSI package to vendors vetted to receive SSI under this solicitation as requested.

TSE IT Security Requirements document (SOW Attachment 8) is no longer in use and the RFP has been amended to reflect removal of this attachment. Please refer to DHS 4300A Sensitive Systems Policy Directive, included as SOW Attachment 8A DHS 4300B National Security Systems (NSS) PD for classified systems, included as SOW Attachment 8B, TSA MD 1400.3 Information Technology Security (ITS) included as SOW Attachment 8C and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 standards (http://www.nist.gov)

10 Request for Proposal 3 Applicable Documents and Standards Table 1

14 We note that the ISO standard referenced in line 34 is not the published version of 18013-5. The link in the “location” column is for an earlier draft version. This is the link to the final standard: https://www.iso.org/standard/69084.html. Does TSA intend to reference the published standard or a draft version?

Standard Version ISO/IEC 18013-5:2021 Personal identification — ISO-compliant driving license — Part 5: Mobile driving license (mDL) application is the referenced version applicable to this requirement.

11 Request for Proposal 4.1.8 Supplemental System Requirements

16 Please clarify whether the Personal Identity Verification (PIV) reader is provided by the government or the government only intends to specify manufacturers or models that TSA deems acceptable. If TSA intends only to specify, can TSA provide clarity on that specification so that we may ensure successful integration prior to Phase II due date?

The PIV reader will not be provided. There are only two TSA approved PIV readers:

Identiv SCR3310 Identiv SCR3500A

12 Request for Proposal 4.2 Elements of System Enhancements

17-18 How does TSA anticipate CAT2 will interface with government PKI infrastructure to enable the dissemination and management of keys for a) digital identity credentials (e.g. mDL) and for b) boarding pass scanning?

All certificates are pushed out via Group Policy.

Please refer to SOW Attachment 2, FRD Sections 2.5.5 Operating System and 2.5.6 Obsolescence.

13 Request for Proposal 4.2 Elements of System Enhancements

18 Do any of the documentation deliverables need to be CUI (formerly known as FOUO)? If so, do the personnel who develop the documents (especially design packages) need to hold the TSA CAT2 clearance?

All personnel working under this contract will need to be vetted by TSA in accordance with Sections H.2 and H.3 of the RFP.

14 Request for Proposal 5 CAT2 System Development and Production

18-19 Is it TSA's intent to have contractor resources at the TSIF or designated Federal Government facility in support of the prototype system and subsequent testing?

Yes, contractor support will need to be available for both prototype system and subsequent testing.

15 Request for Proposal 5.2 CAT2 Prototype System (Applicable to CLIN 0001)

19 We respectfully request that the delivery of the four (4) Test Articles be modified to 60 days versus the 30 days currently provided. The change would be consistent with the 60-day delivery of the two (2) units after award of the Test Article Systems delivery order.

60 days is acceptable. The RFP Section 5.2 has been revised to reflect 60 days for the delivery of the test article units.

16 Request for Proposal 6.2 Integration Testing 20 Section 6.2 does not mention testing the integration of CAT2 with the PIPE system. Does TSA intend to have vendors integrate with STIP only or are other agents/applications also under consideration?

TSA will only require vendors to integrate with

STIP.

17 Request for Proposal 10.1 Maintenance 29 Last sentence in section references "Deliverable L013 Integrated Support Plan" but the Deliverable Table in Section 17, Data Deliverables notes that Deliverable L013 is the "Maintenance Implementation Plan (MIP)." Please clarify which deliverable is correct for Section 10.1, Maintenance.

This should be "Integrated Support Plan". The RFP has been amended to reflect this.

18 Request for Proposal 14.4 CAT OS Security Patching 61 Does TSA intend to conduct continuous software patching via STIP or another specified method? Software patching will occur through STIP and System Center Configuration Management (SCCM). Please refer to SOW Attachment 2, FRD Section 2.5.2, Remote Maintenance and Monitoring for further information.

19 Request for Proposal Sec. 17 Data Deliverables 71-74 Do the dates identified in the deliverables table reference calendar days or work days (i.e. 20 days after Test Article Unit award, 30 days after contract award, etc.)?

This refers to calendar days.

20 Request for Proposal Sec. 17 Data Deliverables 72 Deliverable L003 Engineering Change Proposal (identified in the table for Section 17 Data Deliverables) has the acronym "DEP." Should this be referenced as the “ECP”?

This should be ECP. The RFP has been amended to reflect this.

21 Request for Proposal Sec. 17 Data Deliverables 73 Is Deliverable L006, Request for Developmental Deviation (identified in the table for Section 17 Data Deliverables) equivalent to the Developmental Engineering Proposal (DEP) referenced in Section 16.5 Configuration Control?

This should be Request for Developmental Deviation (RDD). The RFP has been revised to reflect this.

22 Request for Proposal L.4 Proposal Due Date and Submission

154 Given the complexity of the submission requirements (mapping SOW technical requirements to the Matrix, schematics, and screen images), will TSA kindly consider extending the response due date for two weeks, to October 14, 2022?

TSA issued Amendment 0002 to the RFP on September 22, 2022 which extended the due date for Phase I proposal submissions to October 14, 2022.

23 Request for Proposal L.5.1 Instructions for Proposal Preparation

156 Does TSA expect or require that the screenshots provided in the Phase 1, Tab 3 response must be used for the Oral and Demonstration presentations?

It is not required to use the screenshots provided in the Phase I, Tab 3 response for the Phase II oral presentation and demonstration.

24 Request for Proposal L.5.1 Instructions for Proposal Preparation

156 RFP states: “The information provided in Volume I, Tabs 1, 2 and 3 will be used to assess the technical merit of the Offeror's proposal, specifically in evaluating the proposal under Factor 1, and must address all of the minimum technical requirements of the Statement of Work in Part C.” Can TSA please advise where in Volume I should we address the additional (non-technical) requirements of the SOW, such as Training, Maintenance, Program Requirements,etc.?

This information shall be provided in Phase II of the proposal process. Please refer to Section M.4, Factor 2.

25 Request for Proposal L.5.1 Instructions for Proposal Preparation

156 If TSA does provide requirements and guidance on how to address the additional (non-technical) requirements of the SOW, please advise if this must be included as part of Phase I? If yes, kindly consider additional time to prepare and include this portion of the response.

Please see response to question 23.

26 Request for Proposal L.5.1 Instructions for Proposal Preparation

156 RFP states: “The self- certification matrix does not count towards the page limit, but attached evidence shall not exceed 10 pages.” Can you please provide additional guidance about the type and level of substantiation being sought?

Substantiation in the form of test results and certifications should be provided.

27 Request for Proposal L.5.1 Instructions for Proposal Preparation

156 Due to the large number of "Shall" Requirements listed in the self-certification matrix, in order to fully provide substantiation of the requirements, would TSA be willing to increase the page count of the evidence documentation? It is currently limited to 10 pages.

TSA will increase the page limit to 50 pages.

The RFP has been amended to reflect this change.

28 Request for Proposal L.5.3.2 Pricing (Factor IV) 166 Will TSA be providing a template to capture the information requested in the second bullet, Price Assumptions, for the table to map hours by labor category against the WBS?

TSA will not provide a template, the offeror shall develop this for the submission.

29 Request for Proposal Integrated Requirements Document

14 Requirement NR-004 states to define IP addresses using IPv4, but requirement 43 of the FRD states that the system shall use IPv6. Can TSA please clarify which should be used?

The system must meet both IPV4 and IPV6.

TSA currently uses IPV4 but will be moving to IPV6 in the near future.

30 Request for Proposal Attachment A Attmt. The Self-certification Matrix requirements are not fully aligned with the requirements in Version 6.0, April 5, 2022 version of the FRD. Specifically, there seem to be additional Traveler/Non-Travel User Interface requirements and requirements dealing with Audio Cues that are not accounted for in the FRD. Can you ensure the latest version of the FRD referenced in the RFP is provided?

Attachment A aligns with the most recent FRD Version, Version 6.1. All vendors vetted for SSI under this RFP that requested access, should now have the most current version of the FRD.

31 Request for Proposal N/A N/A Is TSA considering the collection of any specific metrics from the CAT2 fleet via the TSA Field Data Reporting System (FDRS) capability?

TSA will be collecting data through FDRS such as alarm rate and authentication rate.

32 Request for Proposal N/A N/A Is it permissible to use Landscape page orientation for Attachment A, Tab 1-Self-Certification Matrix, Tab 2-Schematics of Technology Solution, and Tab 3-Screen Images?

Landscape orientation is acceptable.

33 Request for Proposal 4.1.1 Credential Authentication Capability

Does the CAT2 system also need to be capable of being used without a qualified operator present (e.g., self service by a member of the travelling public)?

The CAT2 is not intended to be used without a qualified TSO present.

34 Request for Proposal 4.1.6 Shipping and Installation Can the TSA please provide any information on its current thinking for CAT2 deployment priorities, in terms of:

(1) Timeframes

(2) Priority installation locations

(3) Decommissioning and disposal of equipment which CAT will be replacing.

(1) and (2) TSA cannot provide that level of detail at this time, but TSA intends to deploy CAT2 systems based on risk and infrastructure.

(3) There are no plans to decommission or replace any existing equipment at this time.

35 Request for Proposal 4.1.6 Shipping and Installation Can the TSA please provide a site list for installation of the CAT2 systems & the anticipated number of systems for each site?

Please see response to question 34.

36 Request for Proposal L.5 Instructions for Proposal Preparation

Can Offers submit additional supporting material, if this is relevant & potentially useful for the TSA, in addition to the requirements stipulated for Volume I: Phase I- Technical?

Please limit additional information to only that information that supports the offeror's response to Phase I requirements.

37 Request for Proposal Not mentioned in RFP N/A N/A Would the TSA be potentially interested in extending the deployment of the CAT2 system (or tailored versions) to other locations (in addition to airports) for which it has security responsibility, including:

- Highways

- Railroads

- Mass transit systems

- Pipelines.

TSA has no plans to extend deployments of CAT beyond airports at this time.

38 Request for Proposal Not mentioned in RFP N/A N/A Please provide a list of current contractor roles involved in running the current CAT platform. Are any of these roles considered by the TSA to be key or critical roles - if so, can you please identify?

RFP Attachment E, Labor Categories and Qualifications provides the suggested contractor roles needed to fulfill the contract requirements.

The RFP has been revised to reflect the roles of Program Manager, Senior Engineer and Information System Security Officer key personnel positions.

39 Request for Proposal Not mentioned in RFP N/A N/A Can you provide the manufacturer, specification & age details of current systems used for the CAT platform? The current vendor is Idemia, TSA cannot provide the specification and age details of currently deployed systems.

40 Request for Proposal 11.0 Battery Requirements Are CAT2 kiosks required to have a maximum of one battery for each unit, or can we have multiple batteries on one unit to power different devices (eg., scanners)?

TSA only requires that batteries meet the requirements as outlined in the RFP and FRD documents. The battery design is per the vendor's discretion.

41 Request for Proposal 14 IT Security Requirements Will the CAT2 provider have access to the private wifi network at each site to manage updates to individual CAT2 kiosks? If so, can ports on the network be enabled appropriately for access by TSA?

The vendor will not have access to the TSA Wi- Fi. Updates will be managed via STIP or System Center Configuration Management except in rare cases where updates will need to be manually installed. Ports will not be enabled per TSA IT system security requirements.

42 Request for Proposal 14 Will data transactions within the CAT2 platform need to be FedRAMP certified? Fed Ramp certification is not required 43 Request for Proposal L.2 Will the Government accept Pre-Award SSI applications after the 9/1/2022 deadline? Can current DHS TS clearances be accepted for access to proposal SSI?

The deadline will not be extended. Current clearances are not accepted to receive SSI documents, a separate request to access SSI must have been made in conjunction with the CAT2 solicitation.

44 Request for Proposal Notice ID 70T04022R7672N007

Description Would the Government consider adding NAICS 541512 to the solicitation as it seems to be a more appropriate NAICS based on the requirements of the RFP Scope and SOW?

No, TSA will not change the NAICS code for this solicitation.

45 Request for Proposal Attachment 15 Will the Government require validated PIV, CAC and PIVI cards to be added to the list of CAT Acceptable Forms of ID for passengers? With PIV cards being on the list of acceptable credentials and Real ID impacting which driver licenses can be accepted, shouldn't the system be forced to support PIV and CAC cards?

Please, refer to the SOW, Attachment 2 FRD Tables 1 and 2. The requirement is to validate the IDs included in the ID List table.

46 Request for Proposal Section 3 & 17 Is PIV card certificate validation a requirement for the qualified TSE operator? Yes, the PIV card certificate validation is a requirement for the qualified TSE operator.

47 Request for Proposal B.2 Type of Contract 6 Contractors have experienced and unprecedented economic environment over the last few years which have contributed to sustained supply chain disruptions and inflationary pressures.

Would TSA consider including an economic price adjustment (EPA) clause as prescribed in FAR 16.203 into this IDIQ given the continued uncertainty during the term of this contract award?

If TSA incorporates an economic price adjustment clause applicable to Firm Fixed Price CLINs, it will be incorporated via a future amendment.

48 Request for Proposal B.4.5 8 TSA will adjust the final value of the CAT Unit CLIN (CLIN 0003) based on the information described in the table below. TSA will calculate the actual CAT average RMA data for systems in operation procured in a given Delivery Order, every month after the said Delivery Order is placed.

The final adjusted CLIN value shall be affected via a contract modification executed unilaterally at the end of an established withholding period.

This withholding period will be determined by delivery Order

This sections states that the average RMA will be calculated “…every month after the said Delivery Order is placed.” Please clarify if the sum of the months TSA is measuring equals the “withholding period” referenced in this section?

While the withholding period will be established by delivery order is it fair to assume that the withholding period will be consistent, i.e. the same period (X# of months) for each DO?

Please clarify if the MDT and MTBCF SLAs and associated disincentives are in addition to and cumulative to the SLA’s and disincentives delineated in Section 10.4.1 of the SOW (Ao and Lev 2 PM).

The withholding period is calculated for every month of the Period of Performance of an applicable order, and will be applied based on RMA for the prior month and deducted from the following month's invoice. MDT and MTBCF SLAs are thresholds/goals to meet and are not applied as disincentives. The RFP has been amended to reflect this.

49 Request for Proposal C.5.2 19 In addition to the Test Article Systems noted above, TSA will require four (4) bailed test article systems at no cost to the Government.

Bailment Agreements will be executed after contract award

Please clarify the intent/purpose of the four (4) bailed test article systems? How long would TSA need these loaned units for? The bailed test articles are being requested to support initial testing and are expected to remain with TSA for 6 months.

50 Request for Proposal L.5 & L.5.2.1.1 155 & 160 Instructions for Proposal. Preparation, Volume Description Table.

Volume II states: 1 – slides NTE 24 Oral Presentation Requirements.

5th paragraph, states: The slide limit is 25 slides

Please confirm the Oral Presentation slide count of 24, or 25 slides. Please see response to question 1.

51 Request for Proposal L.5 Volume Description Table 155 The solicitation has a page limit of 10 pages to respond to 100 Type B Shall statements with substantiation. Is it intended that all 100 Type B statements get full substantiation or is a compliance statement (Yes/No) desired?

If substantiation of all 100 shall statements is required, we respectfully ask the Volume 1, Tab 1 page count be increased from 10 pages, to 100 pages.

Full substantiation is required for all Type B shall statements. Please see responses to questions 26 and 27.

52 Request for Proposal Attachment A Self Certification Matrix and Functional Requirements Document (FRD) Version 6

The following shall statements in Attachment A are mis referencing paragraph numbers in the FRD received. Can the government correct and adjust shall statements to paragraphs referenced in Attachment A with the correct shall statements and paragraphs in the FRD? Here are the following mis referenced shall statements: (Attachment A shall statement paragraph reference (left) – FRD paragraph reference (right))

• Shall 90 - 2.2.4.1.1 to FRD 2.2.4.2.2 • Shall 93 - 2.2.4.1.2 to FRD 2.2.4.2 • Shall 102 - 1.1.4.2 to FRD 2.2.5

• Shall 103 - 2.2.4.2 to FRD 2.2.5 • Shall 104 – 2.2.5 to FRD 2.2.6 • Shall 105 – 2.2.5 to FRD 2.2.6

• Shall 107 – 2.2.7 to FRD 2.2.7.1 • Shall 108 – 2.2.7 to FRD 2.2.7.2 • Shall 109 – 2.2.7 to FRD 2.2.7.2

• Shall 110 – 2.2.7 to FRD 2.2.7.2 • Shall 111 – 2.2.8.1 to FRD 2.2.7.2 • Shall 112 – 2.2.8.2 to FRD 2.2.7.3

• Shall 113 – 2.2.8.2 to FRD 2.2.7.3 • Shall 114 – 2.2.8.2 to FRD 2.2.7.3 • Shall 115 – 2.2.8.2 to FRD 2.2.7.3

• Shall 116 – 2.2.8.3 to FRD 2.2.7.3 • Shall 117 – 2.2.8.3 to FRD 2.2.7.3 • Shall 118 – 2.2.8.3 to FRD 2.2.7.3

• Shall 119 – 2.2.8.3 to FRD 2.2.7.4 • Shall 120 – 2.2.8.3 to FRD 2.2.8 • Shall 121 – 2.2.8.3 to FRD 2.2.9

• Shall 122 – 2.2.8.3 to FRD 2.3.1 • Shall 123 – 2.2.8.4 to FRD 2.3.2 • Shall 124 – 2.2.9 to FRD 2.3.3

• Shall 125 – 2.2.10 to FRD 2.3.3.1 • Shall 126 – 2.3.1 to FRD 2.3.4 • Shall 127 – 2.3.2 to FRD 2.4.1

• Shall 128 – 2.3.3 to FRD 2.4.2 • Shall 129 – 2.3.3.1 to FRD 2.4.3 • Shall 130 – 2.3.4 to FRD 2.5

• Shall 131 – 2.4.1 to FRD 2.5 • Shall 132 – 2.4.2 to FRD 2.5 • Shall 133 – 2.4.3 to FRD 2.5

• Shall 134 – 2.5 to FRD 2.5.1 • Shall 135 – 2.5 to FRD 2.5.3 • Shall 136 – 2.5 to FRD 2.5.3

• Shall 137 – 2.5 to FRD 2.5.3 • Shall 138 – 2.5.1 to FRD 2.5.3 • Shall 141 – 2.5.3 to FRD 2.5.4

• Shall 142 – 2.5.3 to FRD 2.5.5 • Shall 143 – 2.5.3 to FRD 2.5.6

• Shall 144 – 2.5.3 to FRD does not exist

• Shall 145 – 2.5.4 to FRD does not exist

• Shall 146 – 2.5.5 to FRD does not exist

• Shall 147 – 2.5.6 to FRD does not exist

The most current version of the FRD, Version

6.1 was provided to all vendors vetted for SSI.

This version aligns with Attachment A.

53 Request for Proposal Paragraph 2.1.5.3 The monitor dimension may not be larger of (sp) 15 inches (38.1cm) by 15 inchers (38.1cm)

15 A typical 17” display monitor is 15.5 inches wide (including bezel). Please verify that 15.5 inches is allowable as a nominal measurement.

15.5 inches is allowable.

54 Request for Proposal Paragraph 2.2.7.1 The system shall 107) comply with Underwriters’ Laboratories (UL) 60950-1, Information Technology Equipment – Safety – Part 1”

General Requirements, applicable standard, by proving certification by a National Recognized

Test Laboratory (NRTL)

60950-1 has been withdrawn by Underwriters Laboratories and has been replaced by 62368. Please confirm the new standard is required.

UL- 60950-1 was revised May 9, 2022 not withdrawn and is still applicable.

55 Request for Proposal L.5.1 156 The self-certification matrix is synonymous with a requirements traceability matrix (RTM). The

Offeror must state whether or not each requirement (“shall”) has been met or not.

The instructions for the Self-certification matrix allow for wide interpretation of the requirements. We suggest the Government provide a detailed template outlining each specific requirement the offerors are required to self-certify against.

This will ensure all offerors are responding consistently and in compliance with TSA's requirements.

Please refer to FRD 6.1 details for each requirements.

56 Request for Proposal G.5.2 86-87 Invoice Process: Upon receipt of contractor invoices, FinCen will electronically route invoices to the appropriate TSA Contracting Officer’s Representative and/or Contracting

Officer for review and approval. Upon approval, the TSA will electronically route the invoices back to FinCen. Upon receipt 30 of certified invoices from an Authorized Certifying Official, FinCen will initiate payment of the invoices

Please clarify the last sentence, which begins with "Upon receipt 30". It appears as though some words were omitted. The sentence should read: "Upon receipt of certified invoices from an Authorized Certifying Official, FinCen will initiate payment of the invoices." The RFP has been revised to reflect this.

57 Request for Proposal 4.1.8 Supplemental System Requirements

17 The integration of the latest version of the STIP agent per the latest version of the STIP/CAT

Interface Requirements Document (IRD). This will be provided as GFS.

When will the Government make available the latest version of the STIP agent, understanding this is GFS? The latest STIP agent will be provided after award.

58 Request for Proposal 14.1.1 DHS and TSA Enterprise Architecture (February 2022):

57 All solutions and services shall meet DHS and TSA Enterprise Architecture policies, standards, and procedures.

Will the Government make available to Offerors the TSA Enterprise Architecture? TSA Enterprise Architecture policies, standards and procedures will be provide after contract award.

59 L.5.2.1.1 Oral Presentation Requirements

159 The following requirements shall be addressed in the Offeror’s presentation:

• Key Personnel Resume

Does the Government consider any of the Labor Categories described in RFP Attachment E (Labor Categories Descriptions and Minimum Qualifications) to be Key Personnel? If yes, please identify which categories are associated with Key Personnel.

Please see response to Question 38. Attachment E has been revised to incorporate the ISSO position.

60 Request for Proposal 14.1.1 DHS and TSA Enterprise Architecture (February 2022):

57 All solutions and services shall meet DHS and TSA Enterprise Architecture policies, standards, and procedures.

Will the Government provide Offerors with the TSA Approved Product List? The approved product list is provided as Attachment 17 to the SOW. The RFP has been amended to reflect this.

61 FRD 2.1.3 “TSE INFORMATION

TECHNOLOGY

SECURITY

REQUIREMENTS.”

13 Which standard should vendors apply for wireless LAN, 802.22 or 802.11 ? Please clarify this wireless LAN requirement for

CAT2.

Please use the FRD reference which describes the requirement to comply with 802.22.

62 Functional Requirements Document

15 Does the reference to requirement #29 include the following paragraph for system dimensions, and if yes, is TSA looking for a square monitor or is a widescreen monitor acceptable?

Either monitor format is acceptable as long as it operates within the overall requirements as stated in the FRD.

63 CAT-2 Final Functional Requirements Document

1.3 Identification Document

Classifications

10 Table 1: Tier I Identification Document List (T) Will the TSA help provide templates for certain documents that might not be in the vendor's document template database?

For example, different versions of the US Visas, DoD Common Access Card, Uniformed Services ID Card, and etc.

Currently, TSA does not have the ability to collect and manage ID templates. The Vendor will be responsible for collecting necessary templates.

64 Functional Requirements Document

16 The requirement in Section 2.1.5.4 for the system to operate continuously for 2 hours without replacing batteries conflicts with the battery requirement to operate for 6 hours in Section 11 of the RFP. Can TSA please clarify which requirement is correct?

Please see response to Question 2.

3.1 TSE Hardening Requirements 10 ...The following DHS OS configuration guidance documents will be used to configure TSEs:

• DHS Linux/SE Linux Configuration Guidance

• DHS Windows Server 2008 Configuration Guidance

• DHS Windows 7 Configuration Guidance

• DHS Windows Server 2003 Configuration Guidance

• DHS Vista Configuration Guidance

• DHS XP Baseline Configuration...

3.3.3 Windows 7 Based TSE

Deviations

11 The following deviations to the DHS Windows 7 Configuration Guidance, Version 2012.6 shall be configured on all TSE running Microsoft Windows 7

OS. …

3.3.4 Windows Server 2008 Based

TSE Deviations

12 The following deviations to the DHS Windows 2008 Configuration Guidance, Version 2012.6 shall be configured on all TSE running Microsoft Windows Server 2008 OS. …

66 Attachment 12 PIPE STIP CAT IRD Addendum

2.2.1 .NET Framework 9 The PIPE API and PIPE-STIP combined API are buil t with the .NET 4.7.2 Framework and requires a .NET runtime version of 4.0 or greater

Are the APIs built using .Net Standard 2.0? STIP uses .NET v4.0 and above (4.0 and 4.7 to be exact) PIPE is built using JAVA, not .NET

67 4.1.1 15 In compliance with the CAT-2 FRD, CAT-2 ORD, and CAT IRD, and TSA Cybersecurity Requirements, the CAT system will...Include hardware that will integrate the ID scanner(s), the Contractor developed IT solution to authenticate ID, the graphical user interface (GUI), the STIP application programming interface (API), and Government Furnished Software (GFS) that supports cyber-security of the system...

Will existing software (OS image and peripheral firmware) be made available to contractors bidding on this solution for purposes of establishing the prototype? If yes, what are the instructions to access the software?

The latest versions of the following software/applications will be provided:

STIP Client Encase Cisco Anyconnect Tanium Client TightVNC Splunk McAfee Agent McAfee Endpoint McAfee DLP Nessus OS image is not provided

68 The TSE requirements document is dated 23 April 2014. Can the Government confirm that this is the most up to date software load, or provide the current software load by functional elements for security-related software so that offerors may appropriately size and power the future CAT2 system?

Please refer to Question 9.

Attachment 8 TSE IT Security Requirements

1. Would the TSA accept Windows 10 and Windows Server 2019?

2. Can the TSA explain what security features are covered by Windows 7, Windows Server 2003 and Windows Server 2008 are not in Windows 10 and Windows Server 2019?

The FRD states " The CAT-2 system shall (146) operate using the latest authorized supported version of Window OS." Currently TSA is supporting Windows 10. Windows Server 2019 Configuration Guidance is also acceptable.

QandA