AIT QPL- 70T04026QPL7672AIT001- Amendment 0002.pdf

Transportation Security Administration (TSA)

Advanced Imaging Technology

Qualified Product List Announcement

70T04026QPL7672AIT001

Functional Category 3

TRACK 0: Dynamic Motion System

TRACK 1: Static Motion System TRACK 2: Flexible Lane System

AMENDMENT 0002

May 12, 2026

SECTION 1 – QPL OVERVIEW

1.0 Introduction

Advanced Imaging Technology (AIT) provides Transportation Security Officers (TSOs) additional threat detection capabilities to locate potential threats concealed from view on a passenger. The AIT program tests, procures, deploys, and sustains equipment that detects threats concealed on passengers as they transit the screening checkpoint.

This announcement officially requests submissions from applicants to participate in the Qualified Product List (QPL) process (also referred to as the “Qualification Process”). The Qualification Process is the means by which the performance of products is evaluated against the Functional Requirements Document (FRD). Only AIT systems that successfully meet the FRD requirements and successfully complete all steps in the QPL process can be added to the QPL.

The Qualification Management Plan (QMP) is a supplemental document that defines the work necessary for QPL Applicants to have a proposed system on the TSA AIT QPL. The TSA requires any AIT systems used within the U.S. and its Territories to be certified and qualified as defined in 49 U.S.C. § 44913 and Revolutionary FAR Overhaul (RFO) Federal Acquisition Regulation (FAR) 9.202, respectively1. The TSA is subject to the World Trade Organization Government Procurement Agreement as defined in RFO FAR 25.003. As such, all AIT systems submitted under this QPL must be in accordance with the applicable Trade Agreements and/or Buy American Act (see Section 3.5 for additional terms and conditions). QPL Applicants interested in having a system qualified by TSA must successfully meet the requirements for each step in the AIT Qualification Process outlined in Section 2 below. TSA will require QPL Applicants to meet the requirements outlined in the following documents:

TSA QMP for the Second-Generation Advanced Imaging Technology v2.0 (For Official Use Only (FOUO))

TSA Functional Requirements Document (FRD) for Second Generation Advanced Imaging Technology Systems for Checkpoint Operations v2.9, (Sensitive Security Information (SSI))

DHS/ST/TSL-17/38A, Management Plan for the Detection Certification Test of Advanced Imaging Technology (AIT-2), Transportation Security Laboratory, Revised 22 Nov 2019 (FOUO)

TSA Acquisition Qualification Policy v1.0 (FOUO)

TSA Test & Evaluation Guidebook, Rev. 6 (FOUO)

TSA Advanced Imaging Technology (AIT) Detection Functional Requirement Document (DFRD), Version 6.3a (CLASSIFIED)

Imaging Technology for Checkpoint Screening Operations, Version 4.1

(CLASSIFIED)

1 In this document, citations to Revolutionary Far Overhaul (RFO) Part 6, RFO Part 9 and RFO Part 25 are citations specifically to Federal Acquisition Regulation (FAR) Class Deviation 25-11 for Part 6, FAR Class Deviation 25-27 R2 for FAR Part 9 and FAR Class Deviation 26-09 for FAR Part 25 Revision 1, which were issued as part of the RFO, which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025, and will be cited as “RFO FAR” for brevity.

Similarly, Revolutionary FAR Overhaul contract clauses are inserted under the authority of the prescription with the related FAR Part’s Deviation.

1.1 Establishment of the AIT Qualification Process

TSA requires all QPL Applicants to be the Original Equipment Manufacturer (OEM) of their product(s). This Announcement establishes a new opportunity to participate in the Qualification Process for AITs in accordance with the requirements of RFO FAR 9.202. During the Qualification Process, TSA obtains AITs from the QPL Applicant to test the product’s performance against TSA requirements. Only those QPL Applicant products that successfully meet the requirements are invited to be added to the TSA AIT QPL. A qualification process is essential to ensure that TSA is buying proven technology prior to making a significant investment.

Successful qualification and placement on the AIT QPL does not guarantee a contract award for AIT, and TSA has no further obligation to a qualified QPL Applicant. Once qualified, procurement decisions will be made as requirements arise. AIT awards may be made via competition or sole source justification, depending on TSA’s requirements and business practices.

1.1.1 Overview of QPL Tracks

This Announcement is opened under AIT Functional Category 3. Functional Categories (synonymously AIT Types) represent the different categories of AIT systems being sought for qualification. Functional Category 3 is based on new AIT requirements from the FRD for Second Generation Advanced Imaging Technology Systems for Checkpoint Operations v2.9 and TSA AIT Detection Functional Requirement Document DFRD, Version 6.3a.

This Announcement includes three Tracks: Track 0, Track 1, and Track 2. Tracks represent the different versions of requirements under a specific Functional Category. An AIT may obtain a scan through various methods of passenger interaction. Track 0 covers AIT “dynamic” motion systems, Track 1 covers AIT “static” motion systems, and Track 2 covers AIT “flexible lane” systems. In a “static” motion system, the passenger must stop within the system and hold a static pose so the system can obtain the data. In a “dynamic” motion system, the passenger does not need to stop or pose for the system to obtain the data. In a “flexible lane” system, modes of operation can be toggled such that the passenger can receive a scan in either static or dynamic motion as defined above.

QPL Applicants may participate in the subject QPL under any of the following Functional Category/Tracks:

Functional Category 3 / Track 0 (“dynamic” motion system): These AIT systems will be used primarily for screening people at TSA PreCheck® Lanes.

Functional Category 3 / Track 1 (“static” motion system): These AIT systems will be used primarily for screening people at TSA Standard Checkpoint Lanes.

Functional Category 3 / Track 2 (“flexible lane” system): These AIT systems will be used in either TSA PreCheck® Lanes or TSA Standard Checkpoint Lanes.2

The system shall provide an Automated Target Recognition (ATR) capability for detecting the presence of anomalies on an individual, beneath clothes, or otherwise obscured as defined in the TSA classified detection appendix, Imaging Technology for Checkpoint Screening Operations.

2 Qualification under Functional Category 3 / Track 2 (“flexible lane” system) does not automatically qualify a QPL Applicant under Tracks 0 and/or 1. QPL Applicants will only be evaluated for the specific Track they submit documentation for.

1.1.2 QPL Detection and False Alarm Rate Prerequisites and Guidance

To participate in the QPL process, the below detection and false alarm rate certification prerequisites for each track must be met by the deadlines specified in the AIT QPL Process Milestones table in Section 2.0. These Detection Standard (DS) prerequisites are associated with the primary lane placement (TSA PreCheck® or Standard) for each system type. TSA desires to field systems at the Full Requirement listed in the table below. Given DS 6.3a is a recently signed standard that will require additional coordination and technical maturity, TSA is implementing an incremental approach where systems can achieve the QPL prerequisite through certification at the Initial Requirement, with future certification against the Full Requirement (under the same QPL) as discussed below:

Table 1: Detection Standard Prerequisites

Type Initial Requirement Full Requirement

Track 0: Dynamic Motion System DS 4.1 Tier II DS 6.3a Level 1b

Track 1: Static Motion System DS 4.1 Tier IV DS 6.3a Level 3

Track 2: Flexible Lane System Dynamic Motion Mode: DS 6.3a Level 1a

Dynamic Motion Mode: NA

Static Motion Mode: DS 4.1 Tier IV Static Motion Mode: DS 6.3a Level 3

The following guidance applies to the above prerequisites:

A QPL Applicant must demonstrate the capability to achieve the Initial Requirement through acceptance of a Vendor Data Package (VDP) (completion of QPL Process Step 3a) per the timeline specified in the AIT QPL Process Milestones table in Section 2.0. It is allowable for a QPL Applicant to submit a VDP directly for the Full Requirement for their track. In this case, the QPL Applicant would bypass Readiness Testing for the Initial Requirement and proceed directly to testing for the Full Requirement.

QPL Applicants certified against the Initial Requirement will be required to achieve certification against the Full Requirement within two years of the date of the Initial Requirement certification letter. An inability to meet the Full Requirement in this time frame may result in removal of the AIT system from the QPL at TSA’s discretion.

The Initial Requirements listed in Table 1 are based on TSA’s primary lane designation for each system type. TSA maintains discretion to test a system to the requirements of a different lane if TSA believes there is benefit to the Government and travelling public.

This will not delay the QPL Applicant’s ability to obtain Qualification. This activity would result in additional certification test requirements and will be communicated to an individual QPL Applicant on an as-needed basis.

1.1.3 QPL Process

To be placed on the subject AIT QPL, QPL Applicants must successfully complete the Qualification Process as outlined in Figure 1 and further detailed in the AIT QPL QMP.

Figure 1: Qualification Process Step 1.

Announce

QPL

Step 2.

QPL

Applicants Requests SSI and Classified documents

Step 3a.

Submit Vendor Data Package

Step 4a.

Submit Certification Data Package

Step 5.

Qualification Data Package submission

Step 6.

Qualification Testing and Cooperative Vulnerability Penetration Assessment

Step 7.

Independent Operational Test & Evaluation

Step 8.

Component Acquisition Executive Approval and Add Technology to QPL Step 3b.

Readiness Testing at the

TSL

Step 4b.

Certification Testing at TSL

QPL Applicants may begin this process at Step 4a. Submit Vendor Certification Data Package and Step 4b. Certification Testing at TSL if the QPL Applicant has already passed Step 3b. Readiness Testing at the TSL. The QPL Applicant must provide a letter from the TSL confirming Readiness Testing completion.

QPL Applicants may also begin this process at Step 5. Qualification Data Package Submission if the Applicant already has an AIT that has been certified at the required level per Section 1.1.2.

The QPL Applicant must provide a TSA Certification Letter in conjunction with the QDP submission.

1.2 Period of Performance

The AIT QPL will remain open until it is closed by TSA. Department of Homeland Security (DHS) Agencies/Components reserve the right to utilize the list of qualified QPL Applicants to issue their own contracts.

1.3 Bailments

QPL Applicants with an approved QDP shall enter into a no-cost bailment agreement with TSA that will address the responsibilities and liabilities of the parties for the equipment while in custody of the TSA during the Qualification Process. The QPL Contracting Officer (CO) will provide a no-cost bailment agreement to the QPL Applicant for review and signature upon QDP approval.

QPL Applicants will continue to be responsible for meeting all steps of the Qualification Process outlined in this QPL Announcement. TSA will require five (5) production representative systems throughout the Qualification Process regardless of which step the QPL Applicant enters the process. These five systems are in addition to the system placed at the TSL and used for readiness and certification testing.

At least one system will require placement at the TSIF.

Four systems will require placement at two or more airports to support IOT&E. Airport locations will be determined during Operational Test planning.

SECTION 2 – QPL QUALIFICATION PROCESS

2.0 Qualification Process

The intention of the Qualification Process is to test and qualify systems to TSA standards, verify an executable manufacturing process, ensure operational supportability with particular attention to minimizing the logistics footprint, implement Human Systems Integration (HSI), ensure affordability, and demonstrate system interoperability, safety, and utility.

Any QPL Applicant interested in having a system qualified under the AIT Qualification Process must successfully meet both the requirements and the timeline for each step in the AIT

Qualification Process outlined in this announcement and as detailed in the AIT QMP.

Systems submitted under the AIT QPL are required to pass multiple levels of testing and receive approval by the TSA. All AIT systems proposed by the respective QPL Applicant to meet the identified requirements under the AIT QPL will be required to pass all steps of the Qualification Process. If any of the deadlines in this document are missed, the system may be removed from consideration.

The table below outlines the milestones associated with the Qualification Process, for each AIT QPL Track. Details regarding submission requirements are outlined in the sections below:

Table 2: AIT QPL Process Milestones

Submission Instructions and Limitations Due Date

(Days refers to calendar days)

Vetting Request (QPL Process Step 2)

SSI vetting request: Limited to no more than ten

(10) employees.

Applicants shall direct SSI vetting requests to:

RFP.Access@tsa.dhs.gov Jacqueline.Thring@tsa.dhs.gov

All SSI email requests must be titled the following “SSI Request under AIT QPL

70T04026QPL7672AIT001 – [INSERT QPL

APPLICANT N A M E and QPL TRACK]”.

See Section 2.2 for further details.

No Later Than (NLT) ten (10) days after QPL Amendment 2 posting.

Submission of questions related to this QPL (QPL Process Steps 1 and 2)

Submit questions to:

Jacqueline.thring@tsa.dhs.gov Thi.Nguyen@tsa.dhs.gov David.b.bryant@tsa.dhs.gov

All questions must be submitted via email titled the following “Questions under AIT QPL

70T04026QPL7672AIT001 – [INSERT QPL

APPLICANT NAME and QPL TRACK]”.

NLT 20 days after QPL Amendment 2 posting.

Notification of Intent

Applicants who intend to submit a VDP, successful Readiness Test, or successful Certification Test must indicate their intent to do so by sending an email to:

Thi.Nguyen@tsa.dhs.gov David.b.bryant@tsa.dhs.gov

TSA will coordinate with the appropriate TSA and TSL stakeholders to schedule a Readiness Test Overview Briefing at this time.

NLT 3 months from the QPL Amendment 2 posting date.

Submission of VDP for TSL Readiness Testing (QPL Process Steps 3a)

Applicants must submit a VDP and receive approval to begin the qualification process. The VDP should be sent to:

Peter.Kenny@st.dhs.gov Lauren.moiso@st.dhs.gov

VDP submission NLT 11 months from the QPL Amendment 2 posting date.

Submission Instructions and Limitations Due Date

(Days refers to calendar days)

VDP Resubmission (QPL Process Step 3a)

A single VDP may be resubmitted one (1) time upon VDP rejection. The VDP resubmission should be sent to:

Peter.Kenny@st.dhs.gov Lauren.moiso@st.dhs.gov

Within 30 days from notification of VDP not being accepted.

Submission of Certification Data Package (CDP) for TSL Certification Testing (QPL Process Step 4a)

Applicants shall submit a Certification Data Package to the following:

Angela.Lundberg@st.dhs.gov

30 days from notification of successful Readiness Test

CDP Resubmission (QPL Process Step 4a)

A single CDP may be resubmitted one (1) time upon CDP rejection. The CDP resubmission should be sent to:

Angela.Lundberg@st.dhs.gov

30 days from notification of CDP not being accepted

Submission of QDP (QPL Process Step 5)

Applicants shall submit a Qualification Data Package to the following:

Thi.Nguyen@tsa.dhs.gov David.b.bryant@tsa.dhs.gov

Qualification Data Package instructions can be found in the QMP Appendix.

30 days after receipt of Certification Approval or approval of Certification verification

QDP Resubmission (QPL Process Step 5)

A single QDP may be resubmitted one (1) time upon QDP rejection. The QDP resubmission should be sent to:

Thi.Nguyen@tsa.dhs.gov David.b.bryant@tsa.dhs.gov

30 days from notification of QDP not being accepted

Bailment Agreement (QPL Process Step 5)

TBD

To be provided by QPL CO for review and signature.

Submission of systems in support of Qualification Testing and Cooperative Vulnerability Penetration Assessment (QPL Process Step 6)

In accordance with the QMP, reference Section Qualification Testing and CVPA at the TSIF

20 days after Bailment Agreement is signed.

Submission of systems in support of Independent Operational Test & Evaluation (QPL Process Step 7)

In accordance with the QMP, reference Section Initial Operational Testing & Evaluation (IOT&E)

Delivery and installation must be completed within 10 days of TSA notification of which field site will be used.

2.1 Step 1: Announce AIT QPL

The TSA is posting this notice on the System for Award Management (SAM.gov) to initiate the AIT Qualification Process.

To be considered under this Announcement, QPL Applicants must adhere to the Qualification Process Steps outlined in this document and in all supplemental documents and be able to meet the TSA Classified and SSI vetting requirements. Supplemental documents will be provided separately to those QPL Applicants authorized to obtain access to these documents as outlined in Section 2.2.

2.2 Step 2: Release of Requirements Documents

To participate in the AIT Qualification Process, QPL Applicants may need access to the below Classified, SSI, and Unclassified documents. These documents are limited to QPL Applicants who are AIT OEMs. QPL Applicants will be granted access to these documents only after vetting has been completed. An inability to access classified documents due to lack of SECRET security clearance or a Facility Clearance (FCL) does not prohibit the OEM from submitting required data packages and participating in this QPL.

TSA QMP for the Second-Generation Advanced Imaging Technology v2.0 (FOUO)

TSA Functional Requirements Document for Second Generation Advanced Imaging Technology Systems for Checkpoint Operations v2.9, (FRD) (SSI)

DHS/ST/TSL-17/38A, Management Plan for the Detection Certification Test of Advanced Imaging Technology (AIT-2), Transportation Security Laboratory, Revised 22 Nov 2019

(FOUO)

TSA Acquisition Qualification Policy v1.0 (FOUO)

TSA Test & Evaluation Guidebook, Rev. 6 (FOUO)

TSA Advanced Imaging Technology (AIT) Detection Functional Requirement Document (DFRD), Version 6.3a (CLASSIFIED)

Imaging Technology for Checkpoint Screening Operations, Version 4.1 (CLASSIFIED)

Due to the sensitivity of this information, these documents cannot be posted to SAM.gov. To access Classified documents, QPL Applicants must have a Facility Clearance Level (FCL), also known as an industrial security facility clearance. In addition, QPL Applicants also must obtain an administrative determination by the Defense Security Service (DSS) indicating that a QPL Applicant’s facility is eligible for access to classified information of a certain category and all lower categories. Department of Defense (DoD) Form 254 applies to the cleared facility. Lastly, QPL Applicants must provide verification they are an AIT OEM. See Section 2.2.2 for instructions. To access SSI, QPL Applicants must obtain TSA authorization. The process to gain access to SSI is provided in Section 2.2.1 below.

QPL Applicant Vetting is expected to take approximately three (3) weeks (additional time is required for vetting Foreign Nationals). TSA requests that vetting submissions to be limited to no more than 10 employees. QPL Applicants are required to submit their SSI vetting request to review the applicable requirements documents in accordance with the AIT QPL Process Milestones Table in Section 2.0. Another opportunity to request authorization to access these documents will not be offered. QPL Applicants may add or remove a total of two (2) people from the SSI approval list anytime throughout the Qualification Process. However, any requests for individuals to be added must first be approved by the CO prior to initiation, and these individuals will be required to be vetted in accordance with the process stated within this announcement.

2.2.1 Request for SSI

A. As part of the Qualification Process, TSA may allow QPL Applicants access to SSI. SSI is information that, if publicly released, would be detrimental to transportation security, as defined by Federal Regulation 49 C.F.R. Part 1520. SSI may be available to QPL Applicants in preparing responses to this announcement. Potential applicants must obtain specific authorization to obtain SSI. SSI will not be available, provided, or disclosed to any person not specifically authorized to receive it. SSI provided under this announcement may only be used to satisfy AIT Qualification

Process and acquisition requirements.

B. TSA will review SAM.gov to ensure that the QPL Applicant would not otherwise be precluded from receiving a potential future contract award. While this review does not replace the responsibility determination required by RFO FAR 9, it may prohibit QPL Applicants from receiving SSI during the Qualification Process.

C. As part of this process, SSI may only be accessed by individuals who have successfully passed a Security Threat Assessment. This assessment may include a verification of site facility clearance in the National Industrial Security Program (NISP), a contractor suitability determination or other federal background investigation, individual security clearance(s), and, if required, a criminal history records check (CHRC) and/or a check against terrorism databases.

D. QPL Applicant Responsibilities.

1. Senior Official (SO). Each QPL Applicant needing access to SSI under this announcement must separately identify in writing to the Contracting Officer3 a single, senior official who will serve as the single point of contact for the sensitive information. The SO must attest that: all appropriate protections will be followed; only authorized individuals will have access to the sensitive information; and that those individuals provided access to the SSI adequately understand their responsibilities to protect the information. The SO must also attest to the CO every 60 days that all appropriate protections have been followed, only authorized individuals have access to the sensitive information, and that those individuals with access adequately understand their responsibilities to protect the information. A copy of each attestation shall also be emailed to RFP.Access@tsa.dhs.gov and include the applicable solicitation number. The SO shall also ensure that the CO is notified of staffing changes or circumstances in which any individual previously authorized access to SSI under this announcement no longer needs that access.

2. Information Requirements. The SO must provide the following information via email to RFP.Access@tsa.dhs.gov with a Courtesy Copy (Cc) to the Contracting Officer:

a. The Commercial and Government Entity (CAGE) code of the QPL Applicant’s facility that will manage the proposal, the Applicant’s Unique Entity Identifier (UEI), and Applicant’s address; and

b. In a single password protected Microsoft Excel spreadsheet, with the password for the password protected spreadsheet sent separately but at the same time:

Employee Full Name Employee Birth Date Employee Citizenship Indication of whether each nominated employees has:

o Previously received a TSA suitability determination, o Undergone a federal background investigation, or o A Federal Government security clearance.

c. While not required in the original information provided by the SO, in rare instances an individual’s Social Security Number may be required. In those instances, the SO will receive an email from RFP.Access@tsa.dhs.gov requesting the Social Security Number for the select individual(s). The SO must provide the requested information back to RFP.Access@tsa.dhs.gov in a password protected document using the same password previously provided.

3 All references to the Contracting Officer refer to Jacqueline Thring and all submissions shall be provided via email to Jacqueline.thring@tsa.dhs.gov.

3. Non-Disclosure Agreements. Each QPL Applicant employee requesting access to SSI as specified herein will be required to execute a TSA Non-Disclosure Agreement, entitled

“TERMS AND CONDITIONS FOR ACCESS TO SENSITIVE SECURITY

INFORMATION NON-DISCLOSURE AGREEMENT (TSA Form 2815). The executed forms shall be provided with and as part of the submission of information reflected in Paragraph 2 above. The QPL Applicant should understand that employees granted access to SSI and signing a non-disclosure agreement are bound by the terms of that agreement indefinitely, notwithstanding their employment status or any other background checks or clearances granted by any Government agency. Additionally, submission of the Non- Disclosure Form (TSA Form 2815) in the pre-award phase is not a substitute for such a requirement for submission of the Non-Disclosure Form post-award using the DHS Form 11000-6.

4. Return of SSI. Any SSI provided for purposes of this solicitation must be returned to the Government or destroyed and verified by the Government. Electronic records shall be properly destroyed by the QPL Applicant using any method that will preclude recognition or reconstruction, and attestation of destruction shall be provided to the Contracting Officer. For QPL applicants, any SSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

E. Privacy Act Statement. TSA will use the information provided to conduct a security threat assessment on individuals who seek access to SSI. The information will be shared within the Government with personnel who need the information to perform their official duties.

Additionally, the Government may share the information with law enforcement, intelligence, or other government agencies as necessary to identify and respond to potential or actual threats to transportation security in accordance with the routine uses identified in the applicable Privacy Act System Of Records Notice (SORN), DHS/TSA 002, Transportation Security Threat Assessment System (T-STAS). This SORN was last published in the Federal Register on August 11, 2014, and can be found at 79 FR 46862-46866. Authority: 49 USC114. Furnishing this information is voluntary. However, failure to furnish the requested information may delay or prevent the completion of your security threat assessment, without which you may not be granted access to the SSI.

F. Notification of Assessment. Individuals who receive a successful Security Threat Assessment (STA) will be eligible to receive SSI. If it is determined that covered individuals are not eligible to receive access to particular SSI based on the STA, TSA will provide notification to the company point of contact that the individual does not qualify to receive SSI. If an individual is denied access to SSI and believes that the results of the STA are inaccurate, he or she may appeal that determination and petition to have erroneous information corrected with the Transportation Security Redress Branch. However, due to the demanding qualification schedule, TSA will not delay the Qualification Process to resolve redress issues. Therefore, while an individual may appeal the threat assessment determination, that appeal may not be resolved in time for this Qualification Process. As an alternative, however, the potential QPL Applicant may nominate another individual to receive SSI access.

2.2.2 Request for Classified National Security Information (CNSI)

Under this announcement, the QPL Applicant may access classified material at the TSA headquarters and/or at a QPL Applicant’s facility.

Only QPL Applicants who possess a valid Personnel (Security) Clearance Level (PCL) will be authorized to discuss or read classified materials at TSA headquarters only.

Only QPL Applicants who provide verification they are an AIT OEM, possess a valid

Facility (Security) Clearance (FCL) and PCL will be authorized to receive and store CNSI at their facility to develop a QDP.

To access Classified National Security Information (CNSI), a QPL Applicant must have an approved DD Form 254 specific to AIT for each company that will participate in the Qualification Process. If an existing approved DD Form 254 specific to the AIT is not available, a DD Form 254 approval request must be submitted within 10 days of this posting.

Information Requirements. The Senior Official shall provide the following information via email to the Contracting Officer (note that this requirement applies likewise to any prospective subcontractor, joint venture partner, or “team” entity (collectively, agents) whose access to the specified CSNI is necessary):

o QPL Applicant Name o QPL Applicant CAGE Code o QPL Applicant Facility Security Officer’s Name o QPL Applicant Facility Security Officers Phone Number o QPL Applicant Facility Security Officer’s Email o QPL Applicant AIT product name o Request to access classified material at the TSA headquarters and / or at a QPL

Applicant’s facility. This shall include the applicable address(es).

Issuance of a DD Form 254 is anticipated to take approximately six (6) weeks (additional time for Foreign Nationals). Once the DD Form 254 is approved, the Senior Official will receive notification of approval and the applicable requirement documents will be provided to the QPL Applicant point of contact.

The DD Form 254 must be approved for each QPL Applicant before CNSI is available or otherwise provided or disclosed to any QPL Applicant.

The QPL Applicant shall store and safeguard classified material in accordance with Executive Order 13526, Classified National Security Information, and its Implementing Directive 32 CFR Part 2001 at the SECRET level in support of program office requirements. Additionally, in accordance with the Department of Defense (DOD) Manual 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM) for Safeguarding Classified Information,” Chapter 5, Section 5-502, the QPL Applicant is authorized to disclose TSA classified information to cleared agents/company personnel when clearance level is verified and “need to know” is established and access is necessary to perform tasks or services related to the Qualification Process. In accordance with the NISPOM, Chapter 5, Section 5-506, the QPL Applicant shall not disclose classified information received or generated under this TSA Qualification Process to any other Federal agency unless specifically authorized in writing by the TSA Program Office that has classification management jurisdiction over the information. The TSA points of contact are David Bryant (David.b.bryant@tsa.dhs.gov) or Thi Nguyen (thi.nguyen@tsa.dhs.gov).

Any future contract awards to QPL Applicants added to the AIT QPL will be subject to RFO FAR 52.240-92 to the extent the contract involves access to information classified as

“SECRET.”

For QPL applicants, any CNSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

2.3 Step 3a: Submit VDP

QPL Applicants must submit a VDP to be considered for Readiness Testing at the TSL. Readiness Testing provides QPL applicants and TSA with an opportunity to understand the potential detection and false alarm rate performance of the system. QPL applicants must notify TSA with their intent to submit a VDP per the instructions in the AIT QPL Process Milestones Table in Section

2.0. Instructions for completing the VDP will be provided to QPL applicants by the TSL in the form of a Readiness Test Overview Briefing.

The VDP shall be submitted per the timeline specified in the AIT QPL Process Milestones Table in Section 2.0. The QPL Applicant must submit the VDP via email to Peter Kenny (peter.kenny@st.dhs.gov) and Lauren Moiso (lauren.moiso@st.dhs.gov) with Subject “AIT QPL VDP Submission – QPL applicant and System Name”.

The TSA will evaluate VDPs as noted within the Certification Management Plan. If the QPL Applicant’s initial VDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within the timeframe listed in the AIT QPL Process Milestones Table.

The QPL Applicant may submit their VDP a maximum of two (2) times total (an initial submission plus one (1) resubmission). The formal acceptance or rejection of the VDP will be provided by Peter Kenny (peter.kenny@st.dhs.gov) and Lauren Moiso (lauren.moiso@st.dhs.gov).

QPL Applicants may skip this step and begin the QPL process at Step 4a. Certification Data Package Submission if the Applicant already has an AIT that has completed Readiness Testing.

2.4 Step 3b: Readiness Testing at the TSL

As a prerequisite, QPL Applicants are required to have an AIT system that has either passed Readiness Testing or is currently undergoing this testing at the TSL and adhere to any guidance provided in Section 1.1.2.

QPL Applicants may skip this step and begin the QPL process at Step 4a. Submit QPL applicant Certification Data Package and Step 4b. Certification Testing at TSL if the QPL Applicant has already passed Readiness Testing at TSL. The QPL Applicant must provide a letter from the TSL confirming Readiness Testing completion.

2.5 Step 4a: Submit CDP

CERT is the formal test that is administered to all candidate systems under the strictest controls possible. QPL Applicants must submit a CDP to be considered for CERT. The CDP is similar in content to the VDP and also includes Readiness Test findings with recommendation to proceed to CERT. Instructions for completing CDP requirements are provided in the Certification Management Plan. Testing will be conducted at the TSL against the requirements set forth in the applicable DS. The results from this testing inform the TSA Program Office whether the equipment has met all the detection and false alarm rate performance requirements in the relevant TSA DS. Successful completion of this testing results in a TSA Certification Letter which identifies the approved system configuration and CERT level. After completion of CERT, the QPL Applicant system configuration is established based on those components that may affect detection performance and include, but is not limited to, system hardware, software, and algorithms. No system modifications will be allowed after the completion of CERT without written approval from the Government.

The CDP shall be submitted no later than the timeframe outlined in the AIT QPL Process Milestones Table in Section 2.0. The QPL Applicant must submit the CDP via email to Angela Lundberg (angela.lundberg@st.dhs.gov) with Subject “AIT QPL CDP Submission – QPL applicant and System Name”.

The TSA will evaluate CDPs as noted within the Certification Management Plan. If the QPL Applicant’s initial CDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within the timeframe listed in the AIT QPL Process Milestones Table in Section 2.0.

The QPL Applicant may submit their CDP a maximum of two (2) times total (an initial submission plus one (1) resubmission). The formal acceptance or rejection of the CDP will be provided by Angela Lundberg (angela.lundberg@st.dhs.gov).

QPL Applicants may skip this step and begin the QPL process at Step 5. Qualification Data Package Submission if the Applicant already has an AIT that has been certified to the appropriate detection standard described in Section 1.1.2.

2.6 Step 4b: Certification Testing at TSL

During CERT, the QPL Applicant may be called upon for technical and maintenance support, as required. However, the QPL Applicant will not be permitted in the immediate test area unless requested by the TSL Test Director.

All systems seeking qualification under the AIT QPL will be required to undergo and pass CERT against the AIT DS identified in Section 1.1.2. The QPL Applicant must meet all detection requirements to pass CERT. If an QPL Applicant’s system fails the detection requirement, the QPL Applicant must resubmit for CERT at a future time as coordinated with the TSL.

Each QPL Applicant will be allowed a maximum of two (2) attempts at CERT once their respective data package has been accepted. A CERT failure is defined as the presence of deficiencies that warrant correction, as determined by TSA, prior to proceeding to the next phase of the QPL.

Upon successful completion of CERT, the TSA will provide the QPL Applicant a Certification Letter that identifies the system baseline and level of certification that is achieved.

No system modifications will be allowed after the completion of CERT without written approval from the Government.

2.7 Step 5: Qualification Data Package Submission

The QPL Applicant shall generate a QDP for submission into the TSA Qualification Process. The QDP shall be submitted within the timeline listed in the AIT QPL Process Milestones Table in Section 2.0. It shall be submitted via email to David Bryant (David.b.bryant@tsa.dhs.gov) and Thi Nguyen (thi.nguyen@tsa.dhs.gov) with Subject “AIT QPL QDP Submission – QPL applicant, System Name, and QPL Track.”

The TSA will evaluate QDPs as noted within the QMP. If the QPL Applicant’s initial QDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within the timeline listed in the AIT QPL Process Milestones Table in Section 2.0. The QPL Applicant may submit their QDP a maximum of two (2) times total (an initial submission plus one (1) resubmission). The formal acceptance or rejection of the QDP will be provided via email by David Bryant (David.b.bryant@tsa.dhs.gov) or Thi Nguyen (thi.nguyen@tsa.dhs.gov).

If accepted by TSA, the QPL Applicant’s system will continue into Step 6: Qualification Testing and Cooperative Vulnerability Penetration Assessment (CVPA). The QPL Applicant must be prepared to install five (5) systems total (one (1) system at TSIF, four (4) supporting IOT&E).

In the QDP, the QPL Applicant shall provide all test data and results to TSA for performance evaluation and to assist in the QDP acceptance decision. The QPL Applicant shall document any major issues experienced during System Testing and document any system modifications which could impact previously completed, ongoing, or upcoming test events. TSA will review System Test results as part of reviewing and accepting or rejecting the QDP.

The QPL Applicant’s QDP must contain the required information as outlined in the QMP and be presented in a manner that is clear, concise and unambiguous. QPL Applicants must use proprietary and SSI markings according to standard marking procedures. SSI must be handled according to the requirements of 49 CFR Part 1520. TSA has instituted procedures to safeguard proprietary data that are used during the AIT QDP evaluation. The QDP will become a part of the official records of compliance testing for each AIT system submitted.

The level of substantiation to be submitted for each requirement is outlined in the AIT QMP.

Complete identification of the systems used to collect the substantiation data must be provided in the QDP and match the system being proposed for TSA testing. This includes:

a) Model number(s) of equipment tested.

b) Serial number(s) of equipment tested.

c) Software version(s), including reconstruction and inspection software components.

d) Firmware version(s), if applicable.

e) An inventory of hardware Configuration Items (CIs), software CIs, and firmware CIs with configuration identification as instructed through the Master Configuration Item List (MCIL) section.

f) Identification of all configurable and adjustable parameters and adaptation data used to tailor the system, as well as their settings and values. Adaptation data refers to variables used to configure or adjust the system to specific environments or uses. Unless required by the tests, all tests shall be conducted with the same parameter and adaptation settings.

If changes to calibration settings or variable parameters are required, these must be clearly indicated along with an explanation for the changes.

g) Provide the United States equivalent if substantiation calls out European standards.

The QDP shall contain System Requirements, Architecture Documentation, Cybersecurity Documentation, a Life Cycle Support Concept, MCIL, cybersecurity information for the QPL Applicant development/test environment, the system’s technical manuals, maintenance manuals and operator manuals, and additional configuration management documentation, as detailed in the QMP. Though cybersecurity information of the QPL Applicant development/test environment is requested, the TSA Test and Evaluation (T&E) scope will not consist of cyber testing in the QPL Applicant facility. The QDP shall also contain the Test Reports from QPL Applicant System Testing as verification of system readiness to proceed into Qualification Testing (QT).

The system configuration, inclusive of software and algorithms, described in the QDP must match the system configuration that was certified by TSA. The TSA will evaluate QDPs as noted within the QMP. If changes are made to the system after QDP acceptance and QT starting, the QPL Applicant shall submit a Developmental Engineering Proposal (DEP). The QPL Applicant may submit up to two (2) DEPs per QT attempt.

QT testing will not begin until TSA funding has been approved, and TSA testing is limited to the first two (2) QPL Applicants with an approved and accepted QDP per track. TSA will not accept any additional QPL Applicant QDPs after the first two (2) QPL Applicants QDPs are accepted per track.

The QDP will be evaluated on a first-in, first-out basis by the Government for thoroughness and adequacy based on the requirements outlined in the QMP to enter QT. Once approved, the QDP is the design basis in which the system baseline is established by the Physical Configuration Audit (PCA) for the remainder of the Qualification Process.

2.8 Step 6: Qualification Testing and Cooperative Vulnerability Penetration Assessment

The goal of this step is to ensure the system meets requirements specified in the AIT FRD Version 2.9, is ready to proceed into IOT&E, and will not pose any operational, safety or security risks.

During this step, the Government shall execute testing against requirements, assigned by the QT Test Director and System Evaluator, as a verification test source. Testing will be tailored to these requirements and all efforts will be made to evaluate each System Under Test (SUT) in an identical manner.

Qualification Testing is conducted by the TSA at the TSIF to assess system performance against functional requirements in a laboratory environment.

The QPL Applicant will not be permitted to witness QT. However, the QPL Applicant may be called upon for test team training, on-site technical support, cyber security verification activities (e.g., questions on security controls) and maintenance, or troubleshooting of system malfunctions, as required.

Except for Field Data Reporting System (FDRS) and log files, the QPL Applicant shall not conduct data recording (logging) of test events or test objects. All image files, FDRS and log files generated during QT will be the property of the Government or will be purged from the system upon completion of the tests by the Government. The QPL Applicant will not be permitted to wipe any data from test equipment without the explicit written approval of either David Bryant (David.b.bryant@tsa.dhs.gov) or Thi Nguyen (thi.nguyen@tsa.dhs.gov) during a maintenance visit or at completion of QT.

Each QPL Applicant will only be allowed one (1) attempt at QT once their respective data package has been accepted. A second attempt may be possible if TSA funding is available, and if TSA has not yet already accepted two (2) QDPs per QPL Track.

Installation of the test system at the TSIF is inclusive of non-scanner related accessories to support checkpoint operations (e.g., consumables). After installation is complete, the QPL Applicants must provide their signed Test Readiness Notification (TRN) to TSA to begin QT. TRNs shall be sent to TSA via email to David Bryant (David.b.bryant@tsa.dhs.gov) and Thi Nguyen (thi.nguyen@tsa.dhs.gov) with the Subject: “AIT QPL TRN TSIF – QPL applicant , System Name, and QPL Track” whereupon TSA will confirm receipt.

All prospective QPL Applicant systems must successfully complete QT to continue the Qualification Process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. To determine successful completion, in accordance with the QMP, the TSIF Test Branch will produce a QT Report after test completion.

The QT Report will document TSA’s determination of whether the AIT system has successfully passed the tests. The next steps in the process will also be provided and may include termination, deficiency investigation, correction, or continuation through the Qualification Process. TSA reserves the right to deny or terminate the Qualification Process for AIT systems that do not successfully pass QT.

2.8.1 Qualification Testing Failures

QT Failure is defined as the presence of deficiencies that warrant correction prior to proceeding to the next phase of the QPL. The TSIF Test Branch will track and document all SUT failures, malfunctions and/or anomalies encountered during QT. The TSIF Test Branch will review observed issues that affect testing activities and will coordinate with the QPL Applicant for resolution of any required corrective actions for critical failures.

QT will be suspended if the SUT malfunctions or has a critical failure that impedes the progress of testing and cannot be repaired or replaced within five (5) days of QPL Applicant notification or a time frame specified by TSA. Repeated critical failures, or a critical failure that remains unresolved, may also result in suspension or termination of testing if the overall QT schedule is negatively affected. If it is determined at any time during QT that the SUT fails to meet requirements to a degree that prevents the system from proceeding to IOT&E, testing may be suspended or terminated, and the QPL Applicant will be notified by TSA.

TSA may perform a CERT re-test or regression test following a repair or replacement of parts, or after any hardware/software modification if modifications to the system are determined to have an impact on the detection capability.

The Government reserves the right to remove any QPL Applicant from QT and require third-party substantiation of QPL Applicant fixes if TSA determines the Transportation Security Equipment (TSE) has significant issues that will prevent passing QT or IOT&E.

2.8.2 Cooperative Vulnerability Penetration Assessment

The CVPA consists of the TSA cyber team scanning the Applicant’s AIT to identify any cybersecurity vulnerabilities associated with the Operating System (OS). The cyber team will also conduct a limited manual penetration assessment that will look at the ports and other attack surfaces (physical access) to try to break into the OS via the Graphical User Interface (GUI); and overall determine if there are any vulnerabilities associated with the physical access to the system.

There will be additional data needed such as administrative credentials to access root OS, and TSA will work directly with the Applicant to gather the information at this stage.

2.8.3 Step 7: Independent Operational Test and Evaluation

The QPL Applicant must successfully complete the shipment and installation of up to four (4) AIT test systems to TSA-selected field sites for IOT&E as stipulated in the aforementioned bailment agreement. After notification of successfully passing QT, the QPL Applicant has a limited timeframe – outlined in the AIT QPL Process Milestones Table in Section 2.0 – from the TSA notification specifying which field site will be used for delivery and installation. QPL Applicants will be notified via email by TSA of all the finalized field test locations after TSA completes the QDP review and approval process. QPL Applicants should be prepared for four (4) systems under test to be placed at a minimum of any two (2) airports across the 50 states (e.g., two [2] systems at each airport). Exact system quantities and test sites will be defined during IOT&E planning. The testing schedule will be arranged with each QPL Applicant as they reach this step. Schedules will need to be adjusted based on airport need and any testing blackout periods. All QPL Applicants will be tested at the same airports and for the same number of testing days. Installation of these systems is inclusive of accessories to support screening operations.

QPL Applicants must provide their signed TRN to begin IOT&E. TRNs shall be sent via email to TSA at to David Bryant (David.b.bryant@tsa.dhs.gov) and Thi Nguyen (thi.nguyen@tsa.dhs.gov) with the subject: “AIT QPL TRN XXX (airport code) – QPL applicant , System Name, and QPL Track”. TSA will confirm receipt. All prospective QPL Applicants must successfully complete IOT&E to continue the Qualification Process.

2.8.4 Initial Operational Test & Evaluation Failure

In the event the proposed system does not pass testing or is suspended, the system will be removed from the Government test site(s).

2.8.5 Initial Operational Test & Evaluation Reporting

All QPL Applicant systems must successfully complete IOT&E. After IOT&E, and in accordance with the QMP, the TSA will determine whether the system has successfully met the operational system performance requirements by reviewing the System Evaluation Report (SER) generated by the independent System Evaluator post-IOT&E that will document operational effectiveness, suitability, and resilience and will identify any deficiencies.

The QPL Applicant will be notified of test results after the conclusion of the IOT&E reporting period. The TSA will also advise the QPL Applicant of required next steps in the process, which may include termination and/or deficiency investigation/correction.

2.9 Step 8: Component Acquisition…