Transportation Security Administration (TSA)

Advanced Imaging Technology

Qualified Product List Announcement

70T04026QPL7672AIT001

Functional Category 3

TRACK 0

Request for Vendor Data Package and

TRACK 1

Request for Qualification Data Package

January 30, 2026

SECTION 1 – QPL OVERVIEW

1.0 Introduction

Advanced Imaging Technology (AIT) provides Transportation Security Officers (TSOs) additional threat detection capabilities to locate potential threats concealed from view on a passenger. The AIT program tests, procures, deploys, and sustains equipment that detects threats concealed on passengers as they enter the screening checkpoint.

This announcement officially requests submissions from applicants to participate in the Qualification Product List (QPL) process. The Qualification Process is the means by which the performance of products is evaluated against the Functional Requirements Document (FRD). Only AIT systems that successfully meet the FRD requirements and successfully complete all steps in the QPL process will be added to the QPL.

The Qualification Management Plan (QMP) is a supplemental document that defines the work necessary for QPL Applicants to have a proposed system on the TSA AIT QPL. The TSA requires any AIT systems used within the U.S. and its Territories to be certified and qualified as defined in 49 U.S.C. § 44913 and Revolutionary FAR Overhaul (RFO) Federal Acquisition Regulation (FAR) 9.202, respectively1. The TSA is subject to the World Trade Organization Government Procurement Agreement as defined in RFO FAR 25.003. As such, all AIT systems submitted under this QPL must be in accordance with the applicable Trade Agreements and/or Buy American Act (see Section 3.5 for additional terms and conditions). QPL Applicants interested in having a system qualified by TSA must successfully meet the requirements for each step in the AIT Qualification Process outlined in Section 2 below. TSA will require QPL Applicants to meet the requirements outlined in the following documents:

TSA QMP for the Second-Generation Advanced Imaging Technology v2.0 (For Official Use Only)

TSA Functional Requirements Document for Second Generation Advanced Imaging Technology Systems for Checkpoint Operations v2.9, (FRD) (Sensitive Security Information (SSI))

TSA classified detection appendix, Imaging Technology for Checkpoint Screening Operations Section 3.0 (SECRET)

DHS/ST/TSL-17/38A, Management Plan for the Detection Certification Test of Advanced Imaging Technology (AIT-2), Transportation Security Laboratory, Revised 22 Nov 2019

TSA Acquisition Qualification Policy v1.0

TSA Test & Evaluation Guidebook, Rev. 6

Enhanced Metal Detection-2 (EMD-2) Detection Performance Requirements, V5.0a

(SECRET)

Imaging Technology for Checkpoint Screening Operations, Version 4.1 (SECRET)

1 In this document, citations to Revolutionary Far Overhaul (RFO) Part 6, RFO Part 9 and RFO Part 25 are citations specifically to Federal Acquisition Regulation (FAR) Class Deviation 25-11 for Part 6, FAR Class Deviation 25-27 R2 for FAR Part 9 and FAR Class Deviation 26-09 for FAR Part 25 Revision 1, which were issued as part of the RFO, which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025, and will be cited as “RFO FAR” for brevity.

Similarly, Revolutionary FAR Overhaul contract clauses are inserted under the authority of the prescription with the related FAR Part’s Deviation.

1.1 Establishment of the AIT Qualification Process

This Announcement establishes a new opportunity to participate in the Qualification Process for AITs in accordance with the requirements of RFO FAR 9.202. During the Qualification Process, TSA obtains AITs from the QPL Applicant to test the product’s performance against TSA requirements. Only those QPL Applicant products that successfully meet the requirements are invited to be added to the TSA AIT QPL. A qualification process is essential to ensure that TSA is buying a proven technology prior to making a significant investment.

Successful qualification and placement on the AIT QPL does not guarantee a contract award for AIT, and TSA has no further obligation to a qualified QPL Applicant. Once qualified, procurement decisions will be made as requirements arise. AIT awards may be made via competition or sole source justification, depending on TSA’s requirements and business practices.

TSA requires that the QPL Applicant must be the Original Equipment Manufacturer (OEM).

Vendors with qualified TSA AIT systems from previous QPL(s) must submit a formal request to the TSA to be considered for grandfathering into Functional Category 3 Track 0 or Track 1. The formal request must be in writing with supporting Certification Letters and Qualification notices to David Bryant at david.b.bryant@tsa.dhs.gov and Thi Nguyen at Thi.Nguyen@tsa.dhs.gov no later than thirty (30) days after this QPL is announced.

1.1.1 Overview of QPL Tracks

This Announcement is opened under AIT Functional Category 3. Functional Categories (synonymously AIT Types) represent the different categories of AIT systems being sought for qualification. Functional Category 3 is based on new AIT requirements from the TSA Functional Requirements Document for Second Generation Advanced Imaging Technology Systems for Checkpoint Operations v2.9.

This Announcement includes two Tracks: Track 0 and Track 1. Tracks represent the different versions of requirements under a specific Functional Category. An AIT may obtain a scan through two (2) different methods of passenger interaction. Track 0 covers AIT “static” motion systems and Track 1 covers AIT “dynamic” motion systems. In a “static” system, the passenger must stop within the system and hold a static pose so the system can obtain the data; in a dynamic linear motion, or “dynamic” system, the passenger does not need to stop or pose for the system to obtain the data.

Vendors may participate in the subject QPL under one or both of the following Functional Category/Tracks:

Functional Category 3/ Track 0 (“static” motion): These AIT systems will be used primarily for screening people at TSA PreCheck Lanes.

Functional Category 3/ Track 1 (“dynamic” motion): These AIT systems will be used primarily for screening people at TSA Standard Checkpoint Lanes.

These AIT systems shall scan passengers without requiring the removal of clothing beyond outerwear. The system shall provide an Automated Target Recognition (ATR) capability for detecting the presence of anomalies on an individual, beneath clothes, or otherwise obscured as defined in Section 3.0 of the TSA classified detection appendix, Imaging Technology for Checkpoint Screening Operations.

1.1.2 QPL Prerequisites

To participate in the QPL process, the below prerequisites for each track (Track 0 and Track 1) must be met no later than the date of this QPL announcement.

Functional Category 3/ Track 0 (“static” motion): QPL Applicants are required to have an AIT system that has either passed Readiness Testing or is currently undergoing this testing at the Transportation Security Laboratory (TSL).

Functional Category 3/ Track 1 (“dynamic” motion): QPL Applicants must have AIT systems with a TSA Certification Letter for Tier IV Detection.

1.1.3 Track 0- QPL Process

To be placed on the subject AIT QPL for Track 0, QPL Applicants must successfully complete the Qualification Process as outlined in Figure 1 and further detailed in the AIT QPL QMP.

As noted in the QPL Prerequisites section 1.1.2 of this document, QPL Applicants are required to have an AIT system that has either passed Readiness Testing or is currently undergoing this testing at the TSL.

Figure 1: Track 0 Qualification Process Step 1.

Announce

QPL

Step 2.

QPL

Applicants Requests SSI and Classified documents

Step 3.

Complete Readiness Testing

Step 4a.

Submit Vendor Data Package

Step 5.

Qualification Data Package submission

Step 6.

Qualification Testing and Cooperative Vulnerability Penetration Assessment

Step 7.

Independent Operational Test & Evaluation

Step 8.

Component Acquisition Executive Approval and Add Technology to

QPL

Step 4b.

Certification Testing at

TSL

QPL Applicants may begin this process at Step 4a. Submit Vendor Data Package and Step 4b.

Certification Testing at TSL if the QPL Applicant has already passed Readiness Testing at TSL.

The QPL Applicant must provide a letter from the TSL confirming Readiness Testing completion.

QPL Applicants may begin this process at Step 5. Qualification Data Package Submission if the Applicant already has an AIT that has been certified. The QPL Applicant must provide a TSA Certification Letter.

1.1.4 Track 1- QPL Process

To be placed on the subject AIT QPL for Track 1, QPL Applicants must successfully complete the Qualification Process as outlined in Figure 2 and further detailed in the AIT QPL QMP.

As noted in the QPL Prerequisites section 1.1.2 of this document, QPL Applicants are required to have an AIT system with a TSA Certification Letter for Tier IV Detection.

Figure 2: Track 1 Qualification Process Step 1.

Announce

QPL

Step 2.

QPL

Applicants Requests SSI and Classified documents

Step 3.

Qualification Data Package submission

Step 4.

Qualification Testing and Cooperative Vulnerability Penetration Assessment

Step 5.

Independent Operational Test & Evaluation

Step 6.

Component Acquisition Executive Approval and Add Technology to QPL

1.2 Period of Performance

The AIT QPL will remain open until it is closed by TSA. Department of Homeland Security (DHS) Agencies/Components reserve the right to utilize the list of qualified QPL Applicants to issue their own contracts.

1.3 Bailments

QPL Applicants with an approved QDP shall enter into a no-cost bailment agreement with TSA that will address the responsibilities and liabilities of the parties for the equipment while in the custody of the TSA during the Qualification Process. The QPL Contracting Officer (CO) will provide a no-cost bailment agreement to the QPL Applicant for review and signature upon QDP approval. QPL Applicants will continue to be responsible for meeting all steps of the Qualification Process outlined in this QPL Announcement. TSA will require five (5) production representative systems throughout the Qualification Process regardless of which step the QPL Applicant starts

at. The QPL Applicant will be required to move the systems as required for each testing activity:

For Track 0, Five (5) systems total (one system at TSIF, four supporting IOT&E)

For Track 1, Five (5) systems total (one system at TSIF, four supporting IOT&E)

SECTION 2 – QPL QUALIFICATION PROCESS

2.0 Qualification Process

The intention of the Qualification Process is to test and qualify systems to TSA standards, verify an executable manufacturing process, ensure operational supportability with particular attention to minimizing the logistics footprint, implement Human Systems Integration (HSI), ensure affordability, and demonstrate system interoperability, safety, and utility.

Any QPL Applicant interested in having a system qualified under the AIT Qualification Process must successfully meet both the requirements and the timeline for each step in the AIT Qualification Process outlined in this announcement and as detailed in the AIT QMP.

Systems submitted under the AIT QPL are required to pass multiple levels of testing and receive approval by the TSA. All AIT systems proposed by the respective QPL Applicant to meet the identified requirements under the AIT QPL will be required to pass all steps of the Qualification Process. If any of the deadlines in this document are missed, the system will be removed from consideration.

The table below outlines the milestones associated with the Qualification Process, for each AIT QPL Track. Details regarding submission requirements are outlined in the sections below:

AIT QPL Process Milestones

Submission Instructions and Limitations Due Date

(Days refers to calendar days)

SSI Vetting Request (Tracks 0 and 1)

Limited to no more than ten (10) employees

Applicants shall direct SSI vetting requests to:

RFP.Access@tsa.dhs.gov Jacqueline.Thring@tsa.dhs.gov

All SSI email requests must be titled the following “SSI Request under AIT QPL

70T04026QPL7672AIT001 – [INSERT VENDOR

No Later Than (NLT) ten (10) days after QPL Announcement

Submission Instructions and Limitations Due Date

(Days refers to calendar days) NAME and QPL TRACK]”.

Submission of questions related to this QPL (Tracks 0 and 1)

Submit questions to:

Jacqueline.thring@tsa.dhs.gov Thi.Nguyen@tsa.dhs.gov David.b.bryant@tsa.dhs.gov

All questions must be submitted via email titled the following “Questions under AIT QPL

70T04026QPL7672AIT001 – [INSERT VENDOR

NAME and QPL TRACK]”.

No Later Than (NLT) 20 days after QPL Announcement

Submission of Prerequisites (Tracks 0 and 1)

Track 0:

Applicants must provide a letter from the TSL confirming Readiness Testing completion, or that their AIT system is currently undergoing this testing at the TSL to the following:

Thi.Nguyen@tsa.dhs.gov David.b.bryant@tsa.dhs.gov

Track 1:

Applicants must submit their AIT TSA Certification Letter for Tier IV Detection to the following:

Thi.Nguyen@tsa.dhs.gov David.b.bryant@tsa.dhs.gov

Grandfather track: Applicants must submit their AIT TSA Certification Letter and TSA Qualification Letter.

NLT 30 days after QPL Announcement

Submission of Vendor Data Package (VDP) (Track 0)

Applicants shall submit a Vendor Data Package to the following:

Peter.Kenny@st.dhs.gov

Lauren.Moiso@st.dhs.gov

Vendor Data Package instructions can be found in the QMP Appendix.

NLT 40 days after QPL Announcement

VDP Resubmission (Track 0)

Same as VDP Submission- A single VDP may be submitted two (2) times total (an initial submission plus one (1) resubmission).

30 days from notification of VDP not being accepted

Submission of QDP, (Tracks 0 and 1)

Applicants shall submit a Qualification Data Package to the following:

Thi.Nguyen@tsa.dhs.gov David.b.bryant@tsa.dhs.gov

Qualification Data Package instructions can be found in the QMP Appendix.

30 days after receipt of Certification Approval (Track 0) or approval of Certification verification (Track 1)

QDP Resubmission (Tracks 0 and 1)

Same as QDP Submission- A single QDP may be submitted three (3) times, including the initial submission

30 days from notification of QDP not being accepted

Bailment Agreement (Tracks 0 and 1)

TBD

To be provided by QPL CO for review and signature.

2.1 Track 0 and Track 1 Step 1: Announce AIT QPL

The TSA is posting this notice on the System for Award Management (SAM.gov) to initiate the AIT Qualification Process.

To be considered under this Announcement, QPL Applicants must adhere to the Qualification Process Steps outlined in this document and in all supplemental documents and be able to meet the TSA Classified and SSI vetting requirements. Supplemental documents will be provided separately to those QPL Applicants authorized to obtain access to these documents as outlined in Section 2.2.

2.2 Track 0 and Track 1 Step 2: Release Requirements Documents

To participate in the AIT Qualification Process, QPL Applicants will need access to the below Classified, SSI, and Unclassified documents. These documents are limited to QPL Applicants who are AIT OEMs. QPL Applicants will be granted access to these documents only after vetting has been completed.

TSA QMP for the Second-Generation Advanced Imaging Technology v2.0 (For Official Use Only)

TSA Functional Requirements Document for Second Generation Advanced Imaging Technology Systems for Checkpoint Operations v2.9, (FRD) (Sensitive Security Information (SSI))

TSA classified detection appendix, Imaging Technology for Checkpoint Screening Operations Section 3.0 (SECRET)

DHS/ST/TSL-17/38A, Management Plan for the Detection Certification Test of Advanced Imaging Technology (AIT-2), Transportation Security Laboratory, Revised 22 Nov 2019

TSA Acquisition Qualification Policy v1.0

TSA Test & Evaluation Guidebook, Rev. 6

Enhanced Metal Detection-2 (EMD-2) Detection Performance Requirements, V5.0a

(SECRET)

Imaging Technology for Checkpoint Screening Operations, Version 4.1 (SECRET)

Due to the sensitivity of this information, these documents cannot be posted to SAM.gov. To access Classified documents, QPL Applicants must have a Facility Clearance Level (FCL), also

Submission Instructions and Limitations Due Date

(Days refers to calendar days) Submission of systems in support of Qualification Testing and Cooperative Vulnerability Penetration Assessment (Tracks 0 and 1)

In accordance with the QMP, reference Section Qualification Testing and CVPA at the TSIF

20 days after Bailment Agreement is signed.

Submission of systems in support of Independent Operational Test & Evaluation (Tracks 0 and 1)

In accordance with the QMP, reference Section Initial Operational Testing & Evaluation (IOT&E)

Delivery and installation must be completed within 10 days of TSA notification of which field site will be used.

known as an industrial security facility clearance. In addition, QPL Applicants also must obtain an administrative determination by the Defense Security Service (DSS) indicating that a QPL Applicant’s facility is eligible for access to classified information of a certain category and all lower categories. Department of Defense (DD) Form 254 applies to the cleared facility. Lastly, QPL Applicants must provide verification they are an AIT OEM. See Section 2.2.2 for instructions. To access SSI, QPL Applicants must obtain TSA authorization. The process to gain access to SSI is provided in Section 2.2.1 below.

QPL Applicant Vetting is anticipated to take approximately three (3) weeks (additional time is required for vetting Foreign Nationals). TSA requests that vetting submissions to be limited to no more than 10 employees. QPL Applicants are required to submit their SSI vetting request to review the applicable requirements documents no later than 10 days after the AIT QPL Announcement. Another opportunity to request authorization to access these documents will not be offered. QPL Applicants may add or remove a total of two (2) people from the SSI approval list anytime throughout the Qualification Process. However, any requests for individuals to be added must first be approved by the CO prior to initiation, and these individuals will be required to be vetted in accordance with the process stated within this announcement.

2.2.1 Request for SSI

A. As part of the Qualification Process, TSA may allow QPL Applicants access to SSI. SSI is information that, if publicly released, would be detrimental to transportation security, as defined by Federal Regulation 49 C.F.R. Part 1520. SSI may be available to QPL Applicants in preparing responses to this announcement. Potential applicants must obtain specific authorization to obtain SSI. SSI will not be available, provided, or disclosed to any person not specifically authorized to receive it. SSI provided under this announcement may only be used to satisfy AIT Qualification Process and acquisition requirements.

B. TSA will review SAM.gov to ensure that the QPL Applicant would not otherwise be precluded from receiving a potential future contract award. While this review does not replace the responsibility determination required by RFO FAR 9, it may prohibit QPL Applicants from receiving SSI during the Qualification Process.

C. As part of this process, SSI may only be accessed by individuals who have successfully passed a Security Threat Assessment. This assessment may include a verification of site facility clearance in the National Industrial Security Program (NISP), a contractor suitability determination or other federal background investigation, individual security clearance(s), and, if required, a criminal history records check (CHRC) and/or a check against terrorism databases.

D. QPL Applicant Responsibilities.

1. Senior Official (SO). Each QPL Applicant needing access to SSI under this announcement must separately identify in writing to the Contracting Officer2 a single, senior official who will serve as the single point of contact for the sensitive information. The SO must attest that: all appropriate protections will be followed; only authorized individuals will have access to the sensitive information; and that those individuals provided access to the SSI adequately understand their responsibilities to protect the information. The SO must also

2 All references to the Contracting Officer refer to Jacqueline Thring and all submissions shall be provided via email to Jacqueline.thring@tsa.dhs.gov.

attest to the CO every 60 days that all appropriate protections have been followed, only authorized individuals have access to the sensitive information, and that those individuals with access adequately understand their responsibilities to protect the information. A copy of each attestation shall also be emailed to RFP.Access@tsa.dhs.gov and include the applicable solicitation number. The SO shall also ensure that the CO is notified of staffing changes or circumstances in which any individual previously authorized access to SSI under this announcement no longer needs that access.

2. Information Requirements. The SO must provide the following information via email to RFP.Access@tsa.dhs.gov with a Courtesy Copy (Cc) to the Contracting Officer:

a. The Commercial and Government Entity (CAGE) code of the QPL Applicant’s facility that will manage the proposal, the Applicant’s Unique Entity Identifier (UEI), and Applicant’s address; and

b. In a single password protected Microsoft Excel spreadsheet, with the password for the password protected spreadsheet sent separately but at the same time:

Employee Full Name Employee Birth Date Employee Citizenship Indication of whether each nominated employees has:

o Previously received a TSA suitability determination, o Undergone a federal background investigation, or o A Federal Government security clearance.

c. While not required in the original information provided by the SO, in rare instances an individual’s Social Security Number may be required. In those instances, the SO will receive an email from RFP.Access@tsa.dhs.gov requesting the Social Security Number for the select individual(s). The SO must provide the requested information back to RFP.Access@tsa.dhs.gov in a password protected document using the same password previously provided.

3. Non-Disclosure Agreements. Each QPL Applicant employee requesting access to SSI as specified herein will be required to execute a TSA Non-Disclosure Agreement, entitled

“TERMS AND CONDITIONS FOR ACCESS TO SENSITIVE SECURITY

INFORMATION NON-DISCLOSURE AGREEMENT (TSA Form 2815). The executed forms shall be provided with and as part of the submission of information reflected in Paragraph 2 above. The QPL Applicant should understand that employees granted access to SSI and signing a non-disclosure agreement are bound by the terms of that agreement indefinitely, notwithstanding their employment status or any other background checks or clearances granted by any Government agency. Additionally, submission of the Non- Disclosure Form (TSA Form 2815) in the pre-award phase is not a substitute for such a requirement for submission of the Non-Disclosure Form post-award using the DHS Form 11000-6.

4. Return of SSI. Any SSI provided for purposes of this solicitation must be returned to the

Government or destroyed and verified by the Government. Electronic records shall be properly destroyed by the QPL Applicant using any method that will preclude recognition or reconstruction, and attestation of destruction shall be provided to the Contracting

Officer. For QPL applicants, any SSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

E. Privacy Act Statement. TSA will use the information provided to conduct a security threat assessment on individuals who seek access to SSI. The information will be shared within the Government with personnel who need the information to perform their official duties.

Additionally, the Government may share the information with law enforcement, intelligence, or other government agencies as necessary to identify and respond to potential or actual threats to transportation security in accordance with the routine uses identified in the applicable Privacy Act System Of Records Notice (SORN), DHS/TSA 002, Transportation Security Threat Assessment System (T-STAS). This SORN was last published in the Federal Register on August 11, 2014, and can be found at 79 FR 46862-46866. Authority: 49 USC114. Furnishing this information is voluntary. However, failure to furnish the requested information may delay or prevent the completion of your security threat assessment, without which you may not be granted access to the SSI.

F. Notification of Assessment. Individuals who receive a successful Security Threat Assessment (STA) will be eligible to receive SSI. If it is determined that covered individuals are not eligible to receive access to particular SSI based on the STA, TSA will provide notification to the company point of contact that the individual does not qualify to receive SSI. If an individual is denied access to SSI and believes that the results of the STA are inaccurate, he or she may appeal that determination and petition to have erroneous information corrected with the Transportation Security Redress Branch. However, due to the demanding qualification schedule, TSA will not delay the Qualification Process to resolve redress issues. Therefore, while an individual may appeal the threat assessment determination, that appeal may not be resolved in time for this Qualification Process. As an alternative, however, the potential QPL Applicant may nominate another individual to receive SSI access.

2.2.2 Request for Classified National Security Information (CNSI) o Under this announcement, the QPL Applicant may access classified material at the TSA headquarters and/or at a QPL Applicant’s facility.

o Only QPL Applicants who possess a valid Personnel (Security) Clearance Level (PCL) will be authorized to discuss or read classified materials at TSA headquarters only.

o Only QPL Applicants who provide verification they are an AIT OEM, possess a valid Facility (Security) Clearance (FCL) and PCL will be authorized to receive and store CNSI at their facility to develop a QDP.

o To access Classified National Security Information (CNSI), a QPL Applicant must have an approved DD Form 254 specific to AIT for each company that will participate in the Qualification Process. If an existing approved DD Form 254 specific to the AIT is not available, a DD Form 254 approval request must be submitted within 10 days of this posting.

o Information Requirements. The Senior Official shall provide the following information via email to the Contracting Officer (note that this requirement applies likewise to any prospective subcontractor, joint venture partner, or “team” entity (collectively, agents) whose access to the specified CSNI is necessary):

*QPL Applicant Name *QPL Applicant CAGE Code

*QPL Applicant Facility Security Officer’s Name *QPL Applicant Facility Security Officers Phone Number *QPL Applicant Facility Security Officer’s Email *QPL Applicant AIT product name *Request to access classified material at the TSA headquarters and / or at a QPL Applicant’s facility. This shall include the applicable address(es).

o Issuance of a DD Form 254 is anticipated to take approximately six (6) weeks (additional time for Foreign Nationals). Once the DD Form 254 is approved, the Senior Official will receive notification of approval and the applicable requirement documents will be provided to the QPL Applicant point of contact.

o The DD Form 254 must be approved for each QPL Applicant before CNSI is available or otherwise provided or disclosed to any QPL Applicant.

o The QPL Applicant shall store and safeguard classified material in accordance with Executive Order 13526, Classified National Security Information, and its Implementing Directive 32 CFR Part 2001 at the SECRET level in support of program office requirements. Additionally, in accordance with the Department of Defense (DOD) Manual 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM) for Safeguarding Classified Information,” Chapter 5, Section 5-502, the QPL Applicant is authorized to disclose TSA classified information to cleared agents when access is necessary to perform tasks or services related to the Qualification Process. In accordance with the NISPOM, Chapter 5, Section 5-506, the QPL Applicant shall not disclose classified information received or generated under this TSA Qualification Process to any other Federal agency unless specifically authorized in writing by the TSA Program Office that has classification management jurisdiction over the information and the TSA points of contact David Bryant (David.b.bryant@tsa.dhs.gov) or Thi Nguyen (thi.nguyen@tsa.dhs.gov). In accordance with the NISPOM, Chapter 5, Section 5-509, the QPL Applicant shall not disclose classified information to an agent except to support the Qualification Process or for another TSA purpose.

o Any future contract awards to QPL Applicants added to the AIT QPL will be subject to RFO FAR 52.240-92 to the extent the contract involves access to information classified as “Secret.”

o For QPL applicants, any CNSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

2.3 Track 0 Step 3: Complete Readiness Testing

As a prerequisite, QPL Applicants are required to have an AIT system that has either passed Readiness Testing or is currently undergoing this testing at the TSL.

QPL Applicants may skip this step and begin the QPL process at Step 4a. Submit Vendor Data Package and Step 4b. Certification Testing at TSL if the QPL Applicant has already passed Readiness Testing at TSL. The QPL Applicant must provide a letter from the TSL confirming Readiness Testing completion.

2.4 Track 0 Step 4a. VDP Submission

CERT is the formal test that is administered to all candidate systems under the strictest controls possible. QPL Applicants must submit a VDP to be considered for CERT. CERT includes evaluating the detection rates of defined threats in the TSA AIT Detection Standard (DS) as referenced in the FRD version 2.9. Instructions for completing VDP requirements are provided in the QMP and the Certification Management Plan. Testing will be conducted at the TSL against the requirements set forth in the applicable DS. The results from this testing inform the TSA Program Office whether the equipment has met all the detection performance requirements in the relevant TSA DS. Successful completion of this testing results in a TSA Certification Memorandum which identifies the approved system configuration. After completion of CERT, the QPL Applicant system configuration is established based on those components that may affect detection performance and include, but is not limited to, system hardware, software, and algorithms. No system modifications will be allowed after the completion of CERT without written approval from the Government.

To start, the QPL Applicant shall generate a VDP for submission into the TSA Qualification Process. The VDP shall be submitted no later than forty (40) days after QPL Announcement. The QPL Applicant must submit via email to Peter Kenny (peter.kenny@st.dhs.gov) and Lauren Moiso (lauren.moiso@st.dhs.gov) with Subject “AIT QPL VDP Submission – Vendor and System Name”.

The TSA will evaluate VDPs as noted within the QMP. If the QPL Applicant’s initial VDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within thirty

(30) days of when they were informed the VDP was not accepted. The QPL Applicant may submit their VDP a maximum of two (2) times total (an initial submission plus one (1) resubmission).

The formal acceptance or rejection of the VDP will be provided by Peter Kenny (peter.kenny@st.dhs.gov) and Lauren Moiso (lauren.moiso@st.dhs.gov).

QPL Applicants may skip this step and begin the QPL process at Step 5. Qualification Data Package Submission if the Applicant already has an AIT that has been certified.

2.5 Track 0 Step 4b. Certification Testing

During CERT, the QPL Applicant may be called upon for technical and maintenance support, as required. However, the QPL Applicant will not be permitted in the immediate test area unless requested by the TSL Test Director.

All systems seeking qualification under the AIT QPL will be required to undergo and pass CERT against the identified AIT DS. The QPL Applicant must meet all detection requirements to pass CERT. If an QPL Applicant’s system fails the detection requirement, the QPL Applicant must resubmit for CERT at a future time as coordinated with the TSL.

Each QPL Applicant will be allowed a maximum of two (2) attempts at CERT once their respective data package has been accepted. A CERT failure is defined as the presence of deficiencies that warrant correction, as determined by TSA, prior to proceeding to the next phase of the QPL.

Upon successful completion of CERT, the TSA will provide the QPL Applicant a Certification Letter that identifies the system baseline and level of certification that is achieved.

The systems shall have the same configurations with respect to components that could affect detection performance, including system hardware and software after the completion of CERT.

No system modifications will be allowed after the completion of CERT without written approval from the Government.

2.6 Track 0 Step 5 / Track 1 Step 3: Qualification Data Package Submission

The QPL Applicant shall generate a QDP for submission into the TSA Qualification Process. The QDP shall be submitted within thirty (30) days of notification the system has passed CERT (Track

0) or thirty (30) days upon approval of Certification verification (Track 1). It shall be submitted via email to David Bryant (David.b.bryant@tsa.dhs.gov) and Thi Nguyen (thi.nguyen@tsa.dhs.gov) with Subject “AIT QPL QDP Submission – Vendor, System Name, and QPL Track”

The TSA will evaluate QDPs as noted within the QMP. If the QPL Applicant’s initial QDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within thirty

(30) days of when they were informed the QDP was not accepted. The QPL Applicant may submit their QDP a maximum of two (2) times total (an initial submission plus one (1) resubmission).

The formal acceptance or rejection of the QDP will be provided via email by David Bryant (David.b.bryant@tsa.dhs.gov) or Thi Nguyen (thi.nguyen@tsa.dhs.gov).

If accepted by TSA, the QPL Applicant’s system will continue into Track 0 Step 6 and Track 1 Step 4: Qualification Testing and Cooperative Vulnerability Penetration Assessment (CVPA). The QPL Applicant must be prepared to install five (5) systems total (one (1) system at TSIF, four (4) supporting IOT&E)

In the QDP, the QPL Applicant shall provide all test data and results to TSA for performance evaluation and to assist in the QDP acceptance decision. The QPL Applicant shall document any major issues experienced during System Testing and document any system modifications which could impact previously completed, ongoing, or upcoming test events. TSA will review System Test results as part of reviewing and accepting the QDP.

The QPL Applicant’s QDP must contain the required information as outlined in the QMP and be presented in a manner that is clear, concise and unambiguous. QPL Applicants must use proprietary and SSI markings according to standard marking procedures. SSI must be handled according to the requirements of 49 CFR Part 1520. TSA has instituted procedures to safeguard proprietary data that are used during the AIT QDP evaluation. The QDP will become a part of the official records of compliance testing for each system submitted.

The level of substantiation that needs to be submitted for each requirement is outlined in the AIT QMP. Complete identification of the systems used to collect the substantiation data must be provided in the QDP and match the system being proposed for TSA testing. This includes:

a) Model number(s) of equipment tested.

b) Serial number(s) of equipment tested.

c) Software version(s), including reconstruction and inspection software components.

d) Firmware version(s), if applicable.

e) An inventory of hardware Configuration Items (CIs), software CIs, and firmware CIs with configuration identification as instructed through the Master Configuration Item List (MCIL) section.

f) Identification of all configurable and adjustable parameters and adaptation data used to tailor the system, as well as their settings and values. Adaptation data refers to variables used to configure or adjust the system to specific environments or uses. Unless required by the tests, all tests shall be conducted with the same parameter and adaptation settings.

If changes to calibration settings or variable parameters are required, these must be clearly indicated along with an explanation for the changes.

g) Provide the United States equivalent if substantiation calls out European standards.

The QDP shall contain System Requirements, Architecture Documentation, Cybersecurity Documentation, a Life Cycle Support Concept, MCIL, cybersecurity information of the QPL Applicant development/test environment, the system’s technical manuals, maintenance manuals and operator manuals, and additional configuration management documentation, as detailed in the QMP. As a clarification, the cyber testing scope (CVPA) will assume an adversary with physical access to all AIT systems with varying access to system software. Though cybersecurity information of the QPL Applicant development/test environment is requested, the TSA Test and Evaluation (T&E) scope will not consist of cyber testing in the QPL Applicant facility. The QDP shall also contain the Test Reports from QPL Applicant System Testing as verification of system readiness to proceed into QT.

The system configuration, inclusive of software and algorithms, described in the QDP must match the system configuration that was certified by TSA. The TSA will evaluate QDPs as noted within the QMP. If changes are made to the system after QDP acceptance and QT testing starting, the QPL Applicant shall submit a Developmental Engineering Proposal (DEP). The QPL Applicant may submit up to two (2) DEPs per QT attempt. QT testing will not begin until TSA funding has been approved, and TSA funding is limited to the first two (2) QPL Applicants with an approved and accepted QDP, per track (Track 0 and Track 1). TSA will not accept any additional QPL Applicant QDPs after the first two (2) QPL Applicants per track.

The QDP will be evaluated by the Government for thoroughness and adequacy based on the requirements outlined in the QMP to enter QT. Once approved, the QDP is the design basis in which the system baseline is established by the Physical Configuration Audit (PCA) for the remainder of the Qualification Process.

2.7 Track 0 Step 6 / Track 1 Step 4: Qualification Testing and Cooperative Vulnerability Penetration Assessment

The goal of this step is to ensure the system meets requirements specified in the AIT FRD Version

2.9 is ready to proceed into IOT&E, and will not pose any operational, safety or security risks.

During this step, the Government shall execute testing against requirements, assigned by the QT Test Director and System Evaluator, as a verification test source. Testing will be tailored to these requirements and all efforts will be made to evaluate each System Under Test (SUT) in an identical manner.

Qualification Testing (QT) is conducted by the TSA at the TSIF to assess system performance against functional requirements in a laboratory environment.

The QPL Applicant will not be permitted to witness QT. However, the QPL Applicant may be called upon for test team training, on-site technical support, cyber security verification activities (e.g., questions on security controls) and maintenance, or troubleshooting of system malfunctions, as required.

Except for Field Data Reporting System (FDRS) and log files, the QPL Applicant shall not conduct data recording (logging) of test events or test objects. All image files, FDRS and log files generated during QT will be the property of the Government or will be purged from the system upon completion of the tests by the Government. The QPL Applicant will not be permitted to wipe any data from test equipment without the explicit approval of either David Bryant (David.b.bryant@tsa.dhs.gov) or Thi Nguyen (thi.nguyen@tsa.dhs.gov) in writing, during a maintenance visit or at completion of QT.

Each QPL Applicant will only be allowed one (1) attempt at QT once their respective data package has been accepted. A second attempt may be possible if TSA funding is available, and if TSA has not yet already accepted two (2) QDPs per QPL Track.

Installation of the test system at the TSIF is inclusive of non-scanner related accessories to support checkpoint operations (e.g., consumables). After installation is complete, the QPL Applicants must provide their signed Test Readiness Notification (TRN) to TSA to begin QT. TRNs shall be sent to TSA via email to David Bryant (David.b.bryant@tsa.dhs.gov) and Thi Nguyen (thi.nguyen@tsa.dhs.gov) with the Subject: “AIT QPL TRN TSIF – Vendor, System Name, and QPL Track” whereupon TSA will confirm receipt.

All prospective QPL Applicant systems must successfully complete QT to continue the Qualification Process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. To determine successful completion, in accordance with the QMP, the TSIF Test Branch will produce a QT Report after test completion, where the TSA will make a determination if the system has successfully passed the tests. The next steps in the process will also be provided and may include termination, deficiency investigation, correction, or continuation through the Qualification Process. TSA reserves the right to deny or terminate the Qualification Process for systems that do not successfully pass QT.

2.7.1 Qualification Testing Failures

QT Failure is defined as the presence of deficiencies that warrant correction prior to proceeding to the next phase of the QPL. The TSIF Test Branch will track and document all SUT failures, malfunctions and/or anomalies encountered during QT. The TSIF Test Branch will review observed issues that affect testing activities and will coordinate with the QPL Applicant for resolution of any required corrective actions for critical failures.

QT will be suspended if the SUT malfunctions or has a critical failure that impedes the progress of testing and cannot be repaired or replaced within five (5) days of QPL Applicant notification or a time frame specified by TSA. Repeated critical failures, or a critical failure that remains unresolved, may also result in suspension or termination of testing if the overall QT schedule is negatively affected. If it is determined at any time during QT that the SUT fails to meet requirements to a degree the prevents the system from proceeding to IOT&E, testing may be suspended or terminated, and the QPL Applicant will be notified by TSA.

TSA may perform a CERT re-test or regression test following a repair or replacement of parts, or after any hardware/software modification if modifications to the system are determined to have an impact on the detection capability.

The Government reserves the right to remove any QPL Applicant from QT and require third-party substantiation of QPL Applicant fixes if TSA determines the Transportation Security Equipment (TSE) has significant issues that will prevent passing QT or IOT&E.

2.7.2 Cooperative Vulnerability Penetration Assessment

The CVPA consists of the TSA cyber team scanning the Applicant’s AIT to identify any cybersecurity vulnerabilities associated with the Operating System (OS). The cyber team will also conduct a limited manual penetration assessment that will look at the ports and other attack surfaces (physical access) to try to break into the OS via the Graphical User Interface (GUI); and overall determine if there any vulnerabilities associated with the physical access to the system.

There will be additional data needed such as administrative credentials to access root OS, and TSA will work directly with the Applicant to gather the information at this stage.

2.8 Track 0 Step 7 / Track 1 Step 5: Independent Operational Test and Evaluation

The QPL Applicant must successfully complete the shipment and installation of up to four (4) AIT test systems to the first selected field site for IOT&E as stipulated in the aforementioned bailment agreement. After notification of successfully passing QT, the QPL Applicant has 10 days for delivery and installation of TSA notification of which field site will be used. QPL Applicants will be notified via email by TSA of all the finalized field test locations after TSA completes the QDP review and approval process. QPL Applicants should be prepared for up to three (3) testing sites at any airport throughout the 50 states. The testing schedule will be arranged with each QPL Applicant as they reach this step. Schedules will need to be adjusted based on airport need and any testing blackout periods. All QPL Applicants will be tested at the same airports and for the same number of testing days. Installation of these systems is inclusive of accessories to support screening operations.

QPL Applicants must provide their signed TRN to begin Field Testing. TRNs shall be sent via email to TSA at to David Bryant (David.b.bryant@tsa.dhs.gov) and Thi Nguyen (thi.nguyen@tsa.dhs.gov) with the Subject: “AIT QPL TRN XXX (airport code) – Vendor, System Name, and QPL Track,” whereupon TSA will confirm receipt. All prospective QPL Applicants must successfully complete IOT&E to continue the Qualification Process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. In accordance with the QMP and after Field Test completion, TSA will make a determination if the system has met all of the field test objectives successfully to ensure the system under test is installed, integrated, and ready to proceed to IOT&E. TSA reserves the right to deny or terminate the Qualification Process for systems that do not successfully pass the Field Test.

2.8.1 Initial Operational Test & Evaluation Failure

In the event the proposed system does not pass testing or is suspended, the system will be removed from the Government test site(s).

2.8.2 Initial Operational Test & Evaluation Reporting

All QPL Applicant systems must successfully complete IOT&E. After IOT&E, and in accordance with the QMP, the TSA will make a determination if the system has successfully met the IOT&E objectives by reviewing the System Evaluation Report (SER) generated by the System Evaluator post IOT&E that will document operational effectiveness, suitability, and resilience and will identify any deficiencies. The System Evaluator will submit the SER to TSA.

The TSA will review the SER and may or may not share details with the QPL Applicant. The QPL Applicant will be notified of test results after the conclusion of the IOT&E reporting period. The TSA will also advise the QPL Applicant of required next steps in the process, which may include termination and/or deficiency investigation/correction.

2.9 Track 0 Step 8 / Track 1 Step 6: Component Acquisition Executive Approval and Add Technology to QPL

In accordance with the QMP, systems will be placed on the QPL post successful IOT&E with a satisfactory finding and approval from the Component Acquisition Executive (CAE). Once a system is added to the QPL, it is considered “Qualified”, and TSA will provide the QPL Applicant with a Qualification Letter.

TSA and other DHS components may issue Requests for Proposals (RFPs) for AIT requirements in accordance with RFO FAR Part 6. However, the system proposed must be on the AIT QPL in accordance with RFO FAR 52.209-1 Qualification Requirements.

3.0 Applicable QPL Clauses

Applicable QPL Clauses for Handling Classified, SSI, and Controlled Unclassified information are included in the following subsections.

3.1 Additional TSA Security Terms

A. Clearance Level. The AIT Qualification Process requires security clearance at the Secret level.

B. Access to Classified Information. QPL Applicant personnel are required to have access to classified information at the Secret level.

C. Place of Performance. The location of performance where classified information will be accessed, produced, safeguarded, or stored is as identified below:

SSI and Classified information provided via the process noted in Section 2. Document Release Requirements and accessed at QPL Applicant’s facility.

If required, the QPL Applicant will store and safeguard classified material in accordance with DHS Instruction 121-01-011 Department of Security Administrative Security and Executive Order 13526, Classified National Security Information, at the SECRET level in support of program office requirements. Additionally, in accordance with the Department of Defense (DOD) Manual 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM) for Safeguarding Classified Information,” Chapter 5, Section 5-502, the QPL Applicant is authorized to disclose TSA classified information to cleared subcontractors when access is necessary to perform tasks or services for fulfillment of a prime or subcontract. However, prior written approval by the contracting officer or his/her designee is required. Additionally, pursuant to NISPOM, Chapter 5, Section 5-506, the QPL Applicant shall not disclose classified information received or generated under this TSA qualification process to any other Federal agency unless specifically authorized in writing by the TSA Program Office that has classification management jurisdiction over the information and the TSA COR.