ETD_QPL_Announcement_Amendment 4.pdf

Transportation Security Administration (TSA)

Explosives Trace Detection (ETD)

Qualified Products List (QPL)

70T04026QPL7672ETD001_Amendment 4

Request for Certification Data Packages (CDP) or

Qualification Data Packages (QDP)

September 1, 2026

SECTION 1 – QPL OVERVIEW

1.0 Introduction

ETD systems are desktop devices that are used by the TSA throughout the United States (U.S.)

and its territories to detect and distinguish trace amounts of explosive and chemical compounds.

ETD systems are used by Transportation Security Officers (TSOs) to screen passengers, checked baggage, and carry-on baggage. Currently, there are two systems on the TSA ETD QPL with over 5,800 total systems in operation throughout more than 435 airports nationwide. TSA is opening the ETD QPL to add additional systems to the existing QPL, which will foster opportunities for greater competition on potential future procurements.

This announcement officially requests submissions from applicants to participate in the QPL process. The Qualification Management Plan (QMP) is a supplemental document that defines the work necessary for QPL Applicants to have a proposed system on the TSA ETD QPL. The TSA requires any ETD systems used within the U.S. and its Territories to be certified and qualified as defined in 49 U.S.C. § 44913 and Revolutionary FAR Overhaul (RFO) Federal Acquisition Regulation (FAR) 9.202, respectively1. The TSA is subject to the World Trade Organization Government Procurement Agreement as defined in RFO FAR 25.003. As such, all ETD systems submitted under this QPL must be in accordance with the applicable Trade Agreements and/or Buy American Act (see Section 3.5 for additional terms and conditions). QPL Applicants interested in having a system qualified by TSA must successfully meet the requirements for each step in the ETD Qualification Process outlined in Section 2 below. TSA will require QPL Applicants to meet the following entrance criteria:

• Present systems that meet one of the TSA Detection Standards (DS) (DS 5.0, 6.2 or 6.3).

• Present systems that demonstrate capabilities based on ETD Functional Requirements

Document (FRD) Version 2.0 (June 2025).

• Although ETD systems will not initially connect to the TSA Network, ETD systems should adhere to applicable Information Technology (IT) security requirements and meet select Security Technology Information Exchange (STIX) compatibility requirements (e.g., resources and protocols).

1.1 Establishment of the ETD Qualification Process

This Announcement establishes a new opportunity to participate in the Qualification Process for ETDs in accordance with the requirements of RFO FAR 9.202. During the Qualification Process, TSA obtains ETDs from the QPL Applicant to test the product’s performance against TSA requirements. Only those QPL Applicant products that successfully meet the requirements are invited to be added to the TSA ETD QPL. A qualification process is essential to ensure that TSA is buying a proven technology prior to making a significant investment.

Successful qualification and placement on the ETD QPL does not guarantee a contract award for ETD, and TSA has no further obligation to a QPL Applicant of a qualified ETD. Once qualified, 1 In this document, citations to Revolutionary Far Overhaul (RFO) Part 6, RFO Part 9 and RFO Part 25 are citations specifically to Federal Acquisition Regulation (FAR) Class Deviation 25-11 for Part 6, FAR Class Deviation 25-27 R2 for FAR Part 9 and FAR Class Deviation 26-09 for FAR Part 25 Revision 1, which were issued as part of the RFO, which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025, and will be cited as “RFO FAR” for brevity.

Similarly, Revolutionary FAR Overhaul contract clauses are inserted under the authority of the prescription with the related FAR Part’s Deviation.

procurement decisions will be made as requirements arise. ETD awards may be made via competition or sole source justification, depending on TSA’s requirements and business practices.

TSA requires that the QPL Applicant must be the Original Equipment Manufacturer (OEM).

Systems already on the current ETD QPL do not need to requalify. QPL Applicants may begin the QPL process at Step 3 CDP Submission, or Step 5 QDP Submission if the Applicant already has an ETD that has been certified. TSA funding is limited to the first five (5) QPL Applicants with an approved and accepted QDP.

Table 1 below, titled “Qualification Process”, provides an overview of the steps in the Qualification Process. The Qualification Process steps are also described in the ETD QMP.

Table 1. Qualification Process2

Step 1.

Announce Qualified Product List

Step 2.

Release the Qualification Management Plan

Step 3.

Certification Data Package Submission

Step 4.

System Testing

Step 5.

Qualification Data Package Submission

Step 6. Integration / Implementation

Step 7.

Initial Operational Test and Evaluation

Step 8.

Component Acquisition Executive Approval and Add Technology to QPL

Step 4a.

QPL

Applicant System

Step 6a.

Qualification

Step 6b.

Cooperative Vulnerability Penetration Assessment

Step 4b.

Certification

1.2 Period of Performance

The ETD QPL will remain open until it is closed by TSA. Department of Homeland Security (DHS) Agencies/Components reserve the right to utilize the list of qualified QPL Applicants to issue their own contracts.

1.3 Bailments

QPL Applicants with an approved CDP (or QDP if the Applicant has already successfully completed Certification testing (CERT)) shall enter into a no-cost bailment agreement with TSA that will address the responsibilities and liabilities of the parties for the equipment while in the custody of the TSA during the Qualification Process. The QPL Contracting Officer (CO) will provide a no-cost bailment agreement to the QPL Applicant for review and signature upon CDP/QDP approval. QPL Applicants will continue to be responsible for meeting all steps of the Qualification Process outlined in this QPL Announcement. TSA will require at least six (6) production representative systems throughout the Qualification Process regardless of which step the QPL Applicant starts at. The QPL Applicant will be required to move the systems as required for each testing activity:

Three (3) systems will be needed for CERT.

An additional three (3) systems will be needed for Qualification Testing (QT).

Of the six (6) systems mentioned above, four will be used for future field testing after

2 Vendors may begin at Step 3 or Step 5 as discussed in Section 1.1 “Establishment of the ETD Qualification Process.”

CERT and QT are completed; one (1) system will remain at the Transportation Security Laboratory (TSL) and one (1) system will remain at the TSA System Integration Facility (TSIF) throughout the Qualification Process.

SECTION 2 – QPL QUALIFICATION PROCESS

2.0 Qualification Process

The intention of the Qualification Process is to test and qualify systems to TSA standards, verify an executable manufacturing process, ensure operational supportability with particular attention to minimizing the logistics footprint, implement Human Systems Integration (HSI), ensure affordability, and demonstrate system interoperability, safety, and utility.

Any QPL Applicant interested in having a system qualified under the ETD Qualification Process must successfully meet both the requirements and the timeline for each step in the ETD Qualification Process outlined in this announcement and as detailed in the ETD QMP.

Systems submitted under the ETD QPL are required to pass multiple levels of testing and receive approval by the TSA. All ETD systems proposed by the respective QPL Applicant to meet the identified requirements under the ETD QPL will be required to pass all steps of the Qualification Process. If any of the deadlines in this document are missed, the system will be removed from consideration.

The table below outlines the milestones associated with the Qualification Process. Details regarding submission requirements are outlined in the sections below:

ETD QPL Process Milestones

Activity

Due Dates (Days refers to calendar days)

Submission Instructions Note

QPL Applicant requests access to Sensitive Security Information (SSI) / Classified Documents

No Later Than

(NLT) 3PM

ET on April 30, 2026

See Sections 2.2.1 and 2.2.2 Limited to 10 employees

QPL Applicants submit questions related to this QPL Announcement

NLT 12PM

ET on January 30, 2026

Submit questions to:

Jessica.seay@tsa.dhs.gov, marilyn.gray@tsa.dhs.gov and jeanette.man@tsa.dhs.gov with Subject “ETD QPL Questions”.

CDP Submission

NLT 12PM

ET on April 30, 2027.

(N/A if vendor is already certified)

Mail two thumb drives.

One in care of Jagdeep Talwar to:

FAA/Frank A. LoBiondo Technical Center Transportation Security Laboratory, Bldg. 315 Atlantic City International Airport Atlantic City, NJ 08405

Activity

Due Dates (Days refers to calendar days)

Submission Instructions Note

And

One in care of Elaine Jappinga to:

TSIF/TSA Mail Stop 6015 3701 Post Office Rd Arlington, VA 20598–6015

CDP Resubmission

30 days from notification of CDP not being accepted

Same as CDP Submission A single CDP may be submitted three (3) times, including the initial submission

Bailment Agreement for CERT, QT and Initial Operational Test and Evaluation (IOT&E) Systems

TBD

To be provided by QPL CO for review and signature.

QDP Submission

30 days after passing CERT if not previously certified

Mail one thumb drive in care of Elaine Jappinga to:

TSIF/TSA Mail Stop 6015 3701 Post Office Rd Arlington, VA 20598–6015

NLT 12PM

ET on April 30, 2027 (if already certified)

QDP Resubmission

30 days from notification of QDP not being accepted

Same as QDP Submission A single QDP may be submitted three (3) times, including the initial submission

2.1 Step 1: Announce ETD QPL

The TSA is posting this notice on the System for Award Management (SAM.gov) to initiate the ETD Qualification Process.

To be considered under this Announcement, QPL Applicants must adhere to the Qualification Process Steps outlined in this document and in all supplemental documents and be able to meet the TSA Classified and SSI vetting requirements. Supplemental documents will be provided separately to those QPL Applicants authorized to obtain access to these documents as outlined in Section 2.2.

2.2 Step 2: Release Requirements Documents

To participate in the ETD Qualification Process, QPL Applicants may need access to the below Classified, SSI, and Unclassified documents. These documents are limited to QPL Applicants who are ETD OEMs. QPL Applicants will be granted access to these documents only after vetting has been completed. However, if an ETD OEM is currently on the ETD QPL and already has these documents, access to these documents does not need to be requested.

ETD QMP – Unclassified. The QMP will provide the following information:

• Instructions for CDP submission

• Instructions for QDP submission

• CDP Evaluation Process Overview

• QDP Evaluation Process Overview

• Overview for the Qualification Process

Configuration Management Plan (CMP) for Office of Acquisition Program Management, Version E, August 31, 2018 - Unclassified

DHS/ST/TSL-20/05 Certification Management Plan for Test and Evaluation of Explosives Trace Detector for Checkpoint and Checked Baggage Screening, Version 2.0, June 28, 2023

- SSI

ETD Functional Requirements Document (FRD) 2.0 - SSI ETD Memo.AD-6.2-6.3 Modification_SSI_FINAL_02.22.2021_Component Acquisition

Executive (CAE) signed - SSI ETD Detection Standard 5.0 - Classified ETD Detection Standard 6.2 - Classified ETD Detection Standard 6.3 - Classified

Due to the sensitivity of this information, these documents cannot be posted to SAM.gov. To access Classified documents, QPL Applicants must have a Facility Clearance Level (FCL), also known as an industrial security facility clearance. In addition, QPL Applicants also must obtain an administrative determination by the Defense Security Service (DSS) indicating that a QPL Applicant’s facility is eligible for access to classified information of a certain category and all lower categories. Department of Defense (DD) Form 254 applies to the cleared facility. Lastly, QPL Applicants must provide verification they are an ETD OEM. See Section 2.2.2 for instructions. To access SSI, QPL Applicants must obtain TSA authorization. The process to gain access to SSI is provided in Section 2.2.1 below.

QPL Applicant Vetting is anticipated to take approximately three (3) weeks (additional time is required for vetting Foreign Nationals). TSA requests that vetting submissions from individual OEMs be limited to no more than 10 employees. QPL Applicants are required to submit their SSI vetting request to review the applicable requirements documents no later than 3PM ET on April 30, 2026. Another opportunity to request authorization to access these documents will not be offered. QPL Applicants may add or remove a total of two (2) people from the SSI approval list anytime throughout the Qualification Process. However, any requests for individuals to be added must first be approved by the CO prior to initiation, and these individuals will be required to be vetted in accordance with the process stated within this announcement.

2.2.1 Request for SSI

A. As part of the Qualification Process, TSA may allow QPL Applicants access to SSI. SSI is information that, if publicly released, would be detrimental to transportation security, as defined by Federal Regulation 49 C.F.R. Part 1520. SSI may be available to QPL Applicants in preparing responses to this announcement. Potential applicants must obtain specific authorization in order to obtain SSI. SSI will not be available, provided, or disclosed to any person not specifically authorized to receive it. SSI provided under this announcement may only be used to satisfy ETD Qualification Process and acquisition requirements.

B. TSA will review SAM.gov to ensure that the QPL Applicant would not otherwise be precluded from receiving a potential future contract award. While this review does not replace the responsibility determination required by RFO FAR 9, it may prohibit QPL Applicants from receiving SSI during the Qualification Process.

C. As part of this process, SSI may only be accessed by individuals who have successfully passed a Security Threat Assessment. This assessment may include a verification of site facility clearance in the National Industrial Security Program (NISP), a contractor suitability determination or other federal background investigation, individual security clearance(s), and, if required, a criminal history records check (CHRC) and/or a check against terrorism databases.

D. QPL Applicant Responsibilities.

1. Senior Official (SO). Each QPL Applicant needing access to SSI under this announcement must separately identify in writing to the Contracting Officer3 a single, senior official who will serve as the single point of contact for the sensitive information. The SO must attest that: all appropriate protections will be followed; only authorized individuals will have access to the sensitive information; and that those individuals provided access to the SSI adequately understand their responsibilities to protect the information. The SO must also attest to the CO every 60 days that all appropriate protections have been followed, only authorized individuals have access to the sensitive information, and that those individuals with access adequately understand their responsibilities to protect the information. A copy of each attestation shall also be emailed to RFP.Access@tsa.dhs.gov and include the applicable solicitation number. The SO shall also ensure that the CO is notified of staffing changes or circumstances in which any individual previously authorized access to SSI under this announcement no longer needs that access.

2. Information Requirements. The SO must provide the following information via email to RFP.Access@tsa.dhs.gov with a Courtesy Copy (Cc) to the Contracting Officer:

a. The Commercial and Government Entity (CAGE) code of the QPL Applicant’s facility that will manage the proposal, the Applicant’s Unique Entity Identifier (UEI), and Applicant’s address; and

b. In a single password protected Microsoft Excel spreadsheet, with the password for the password protected spreadsheet sent separately but at the same time:

Employee Full Name Employee Birth Date Employee Citizenship Indication of whether each nominated employees has:

o Previously received a TSA suitability determination, o Undergone a federal background investigation, or o Undergone a Federal Government security clearance.

c. While not required in the original information provided by the SO, in rare instances an individual’s Social Security Number (SSN) may be required. In those instances, the SO will receive an email from RFP.Access@tsa.dhs.gov requesting the SSN for the select individual(s). The SO must provide the requested information back to

3 All references to the Contracting Officer refer to Jessica Seay and all submissions shall be provided via email to Jessica.seay@tsa.dhs.gov.

RFP.Access@tsa.dhs.gov in a password protected document using the same password previously provided.

3. Non-Disclosure Agreements. Each QPL Applicant employee requesting access to SSI as specified herein will be required to execute a TSA Non-Disclosure Agreement, entitled

“TERMS AND CONDITIONS FOR ACCESS TO SENSITIVE SECURITY

INFORMATION NON-DISCLOSURE AGREEMENT (TSA Form 2815). The executed forms shall be provided with and as part of the submission of information reflected in Paragraph 2 above. The QPL Applicant should understand that employees granted access to SSI and signing a non-disclosure agreement are bound by the terms of that agreement indefinitely, notwithstanding their employment status or any other background checks or clearances granted by any Government agency. Additionally, submission of the Non- Disclosure Form (TSA Form 2815) in the pre-award phase is not a substitute for such a requirement for submission of the Non-Disclosure Form post-award using the DHS Form 11000-6.

4. Return of SSI. Any SSI provided for purposes of this solicitation must be returned to the

Government or destroyed and verified by the Government. Electronic records shall be properly destroyed by the QPL Applicant using any method that will preclude recognition or reconstruction, and attestation of destruction shall be provided to the Contracting Officer. For QPL applicants, any SSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

E. Privacy Act Statement. TSA will use the information provided to conduct a security threat assessment on individuals who seek access to SSI. The information will be shared within the Government with personnel who need the information to perform their official duties.

Additionally, the Government may share the information with law enforcement, intelligence, or other government agencies as necessary to identify and respond to potential or actual threats to transportation security in accordance with the routine uses identified in the applicable Privacy Act System Of Records Notice (SORN), DHS/TSA 002, Transportation Security Threat Assessment System (T-STAS). This SORN was last published in the Federal Register on August 11, 2014, and can be found at 79 FR 46862-46866. Authority: 49 USC § 114. Furnishing this information is voluntary. However, failure to furnish the requested information may delay or prevent the completion of your security threat assessment, without which you may not be granted access to the SSI.

F. Notification of Assessment. Individuals who receive a successful Security Threat Assessment (STA) will be eligible to receive SSI. If it is determined that covered individuals are not eligible to receive access to particular SSI based on the STA, TSA will provide notification to the company point of contact that the individual does not qualify to receive SSI. In the event that an individual is denied access to SSI and believes that the results of the STA are inaccurate, he or she may appeal that determination and petition to have erroneous information corrected with the Transportation Security Redress Branch. However, due to the demanding qualification schedule, TSA will not delay the Qualification Process to resolve redress issues. Therefore, while an individual may appeal the threat assessment determination, that appeal may not be resolved in time for this Qualification Process. As an alternative, however, the potential QPL Applicant may nominate another individual to receive SSI access.

2.2.2 Request for Classified National Security Information (CNSI) o Under this announcement, the QPL Applicant may access classified material at the TSA headquarters and/or at a QPL Applicant’s facility.

o Only QPL Applicants who possess a valid Personnel (Security) Clearance Level (PCL) will be authorized to discuss or read classified materials at TSA headquarters only.

o Only QPL Applicants who provide verification that they are an ETD OEM, possess a valid Facility (Security) Clearance (FCL) and PCL will be authorized to receive and store CNSI at their facility in order to develop a QDP.

o To access CNSI, a QPL Applicant must have an approved DD Form 254 specific to ETD for each company that will participate in the Qualification Process. If an existing approved DD Form 254 specific to the ETD is not available, a DD Form 254 approval request must be submitted within 30 days of this posting.

o Information Requirements. The Senior Official shall provide the following information via email to the Contracting Officer (note that this requirement applies likewise to any prospective subcontractor, joint venture partner, or “team” entity (collectively, agents) whose access to the specified CSNI is necessary):

*QPL Applicant Name *QPL Applicant CAGE Code *QPL Applicant Facility Security Officer’s Name *QPL Applicant Facility Security Officers Phone Number *QPL Applicant Facility Security Officer’s Email *QPL Applicant ETD product name *Request to access classified material at the TSA headquarters and / or at a QPL Applicant’s facility. This shall include the applicable address(es).

o Issuance of a DD Form 254 is anticipated to take approximately six (6) weeks (additional time for Foreign Nationals). Once the DD Form 254 is approved, the Senior Official will receive notification of approval and the applicable requirement documents will be provided to the QPL Applicant point of contact.

o The DD Form 254 must be approved for each QPL Applicant before CNSI is available or otherwise provided or disclosed to any QPL Applicant.

o The QPL Applicant shall store and safeguard classified material in accordance with Executive Order 13526, Classified National Security Information, and its Implementing Directive 32 CFR Part 2001 at the SECRET level in support of program office requirements. Additionally, in accordance with the Department of Defense (DOD) Manual 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM) for Safeguarding Classified Information,” Chapter 5, Section 5-502, the QPL Applicant is authorized to disclose TSA classified information to cleared agents when access is necessary to perform tasks or services related to the Qualification Process. In accordance with the NISPOM, Chapter 5, Section 5-506, the QPL Applicant shall not disclose classified information received or generated under this TSA Qualification Process to any other Federal agency unless specifically authorized in writing by the TSA Program Office that has classification management jurisdiction over the information and the TSA points of contact Marilyn Gray (marilyn.gray@tsa.dhs.gov) or Jeanette Man (jeanette.man@tsa.dhs.gov).. In accordance with the NISPOM, Chapter 5, Section 5-509, the QPL Applicant shall not disclose classified information to an agent except to support the Qualification Process or for another TSA purpose.

o Any future contract awards to QPL Applicants added to the ETD QPL will be subject to RFO FAR 52.240-92 to the extent the contract involves access to information classified as “Secret.”

o For QPL applicants, any CNSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

2.3 Step 3: CDP Submission

CERT is the formal test that is administered to all candidate systems under the strictest controls possible. QPL Applicants must submit a CDP to be considered for CERT. CERT includes evaluating the detection rates of defined threats in the TSA DS via direct deposit sampling and swabs of test surfaces. Instructions for completing CDP requirements are provided in the QMP and the Certification Management Plan. Testing will be conducted at the TSL against the requirements set forth in the applicable DS. The results from this testing inform the TSA Program Office whether the equipment has met all of the detection performance requirements in the relevant TSA DS. Successful completion of this testing results in a TSA Certification Memorandum which identifies the approved system configuration. After completion of CERT, the QPL Applicant system configuration is established based on those components that may affect detection performance and include, but is not limited to, system hardware, software, and algorithms. No system modifications will be allowed after the completion of CERT without written approval from the Government.

To start, the QPL Applicant shall generate a CDP for submission into the TSA Qualification Process. The CDP shall be submitted by 12PM ET on April 30, 2027. The QPL Applicant must submit two (2) copies of the CDP on two (2), separate thumb drives. One (1) thumb drive should be mailed to each of locations below (two total submissions):

One in care of Jagdeep Talwar to:

FAA/Frank A. LoBiondo Technical Center Transportation Security Laboratory, Bldg. 315 Atlantic City International Airport Atlantic City, NJ 08405

-and-

One in care of Elaine Jappinga to:

TSIF/TSA Mail Stop 6015 3701 Post Office Rd Arlington, VA 20598–6015

Please send an email with the tracking number to marilyn.gray@tsa.dhs.gov and jeanette.man@tsa.dhs.gov with the Subject “ETD QPL CDP Submission – Vendor and System Name” to notify TSA that the CDP thumb drives have been mailed, and TSA will notify the QPL Applicant once they have been received.

The TSA will evaluate CDPs as noted within the QMP. If the QPL Applicant’s initial CDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within 30 calendar days of when they were informed the CDP was not accepted. The QPL Applicant may resubmit their CDP a maximum of two (2) additional times. The formal acceptance or rejection of the CDP will be provided by Marilyn Gray (marilyn.gray@tsa.dhs.gov) or Jeanette Man (jeanette.man@tsa.dhs.gov).

Upon approval of the CDP, the QPL Applicant will be required to enter into a bailment agreement, as discussed in Section 1.3 above, which will require the delivery and installation of the first three

(3) systems to the TSL within 10 business days of execution.

If a QPL Applicant’s system has already passed CERT, they should begin at Step 5 “QDP Submission.”

2.4 Step 4: System Testing and Certification Testing

System Testing and CERT are described in the subsections below.

2.4.1 Step 4a: System Testing

System Testing is conducted by the QPL Applicant to verify that their system meets technical requirements defined in the QMP. This testing event will determine the maturity of the system design to meet the TSA requirements and will be used to determine system readiness. This testing will be performed at the QPL Applicant’s facilities and/or a third-party test organization facility at the QPL Applicant’s cost.

The QPL Applicant shall conduct internal system testing in accordance with the QPL Applicant’s System Test Plans and Procedures and Appendix B of the ETD QMP, ETD QPL Applicant Required Substantiation. The QPL Applicant shall procure or fabricate any special test articles and instrumentation for such tests. The QPL Applicant is responsible for contacting, communicating expectations, and acquiring results or reporting documentation for any third-party testing utilized during the System Testing phase. The QPL Applicant must verify that any third-party testers utilized are reputable and industry leaders in the field of verification.

It is the QPL Applicant’s responsibility to ensure the testing adequately verifies the requirement and that the data and documentation provided by the third-party tester is thorough and complete.

2.4.2 Step 4b: Certification Testing

During CERT, the QPL Applicant shall submit three proposed systems for testing at the TSL via the aforementioned bailment and may be called upon for technical and maintenance support, as required. However, the QPL Applicant will not be permitted in the immediate test area unless requested by the TSL Test Director.

All systems seeking qualification under the ETD QPL Window will be required to undergo and pass CERT against the identified ETD DS. The QPL Applicant must meet all detection requirements in order to pass CERT. If an QPL Applicant’s system fails the detection requirement, the QPL Applicant must resubmit for CERT at a future time as coordinated with the TSL.

Each QPL Applicant will be allowed a maximum of two (2) attempts at CERT once their respective data package has been accepted. A CERT failure is defined as the presence of deficiencies that warrant correction, as determined by TSA, prior to proceeding to the next phase of the QPL.

Upon successful completion of CERT, the TSA will provide the QPL Applicant a Certification Letter that identifies the system baseline and level of certification that is achieved.

The ETD systems that pass CERT shall have the same configurations with respect to components that could affect detection performance, including system hardware and software after the completion of CERT. No system modifications will be allowed after the completion of CERT without written approval from the Government.

2.5 Step 5: Qualification Data Package Submission

The QPL Applicant shall generate a QDP for submission into the TSA Qualification Process.

The QDP shall be submitted within 30 days of notification that the system has passed CERT or by 12PM ET on April 30, 2027 if the system is already TSA Certified. It shall be submitted on a thumb drive and mailed to:

C/O Elaine Jappinga TSIF/TSA Mail Stop 6015

3701 Post Office Rd Arlington, VA 20598–6015

Please send an email with the tracking number to marilyn.gray@tsa.dhs.gov and jeanette.man@tsa.dhs.gov with Subject “ETD QPL QDP Submission – Vendor and System Name” to notify TSA that the QDP thumb drive has been mailed and TSA will notify the QPL Applicant once it has been received.

The TSA will evaluate QDPs as noted within the QMP. If the QPL Applicant’s initial QDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within 30 calendar days of when they were informed the QDP was not accepted. The QPL Applicant may resubmit their QDP a maximum of two (2) additional times. The formal acceptance or rejection of the QDP will be provided via email by Marilyn Gray (marilyn.gray@tsa.dhs.gov) or Jeanette Man (jeanette.man@tsa.dhs.gov).

If accepted by TSA, the QPL Applicant’s system will continue into Step 6a: QT and Step 6b:

Cooperative Vulnerability Penetration Assessment (CVPA). The QPL Applicant must be prepared to install the testing systems at TSIF within 10 business days of acceptance notification, as stipulated in the aforementioned bailment. If the QPL Applicant is starting at this step, they will need to execute a bailment agreement as outlined in section 1.3, then be prepared to deliver and install one (1) system at TSL and three (3) systems to the TSIF within 10 business days of bailment execution.

In the QDP, the QPL Applicant shall provide all test data and results to TSA for performance evaluation and to assist in the QDP acceptance decision. The QPL Applicant shall document any major issues experienced during System Testing and document any system modifications which could impact previously completed, ongoing, or upcoming test events. TSA will review System Test results as part of reviewing and accepting the QDP.

The QPL Applicant’s QDP must contain the required information as outlined in the QMP and be presented in a manner that is clear, concise and unambiguous. QPL Applicants must use proprietary and SSI markings according to standard marking procedures. SSI must be handled according to the requirements of 49 CFR Part 1520. TSA has instituted procedures to safeguard proprietary data that are used during the ETD QDP evaluation. The QDP will become a part of the official records of compliance testing for each system submitted.

The level of substantiation that needs to be submitted for each requirement is outlined in the ETD QMP. Complete identification of the systems used to collect the substantiation data must be provided in the QDP and match the system being proposed for TSA testing. This includes:

a) Model number(s) of equipment tested.

b) Serial number(s) of equipment tested.

c) Software version(s), including reconstruction and inspection software components.

d) Firmware version(s), if applicable.

e) An inventory of hardware Configuration Items (CIs), software CIs, and firmware CIs with configuration identification as instructed through the Master Configuration Item List (MCIL) section.

f) Identification of all configurable and adjustable parameters and adaptation data used to tailor the system, as well as their settings and values. Adaptation data refers to variables used to configure or adjust the system to specific environments or uses. Unless required by the tests, all tests shall be conducted with the same parameter and adaptation settings.

If changes to calibration settings or variable parameters are required, these must be clearly indicated along with an explanation for the changes.

g) Provision of the United States equivalent standards if substantiation calls out European standards.

The QDP shall contain System Requirements, Architecture Documentation, Cybersecurity Documentation, a Life Cycle Support Concept, MCIL, cybersecurity information of the QPL Applicant development/test environment, the system’s technical manuals, maintenance manuals and operator manuals, and additional configuration management documentation, as detailed in the QMP. As a clarification, the cyber testing scope (CVPA) will assume an adversary with physical access to all ETD systems with varying access to system software. Though cybersecurity information of the QPL Applicant development/test environment is requested, the TSA Test and Evaluation (T&E) scope will not consist of cyber testing in the QPL Applicant facility. The QDP shall also contain the Test Reports from QPL Applicant System Testing as verification of system readiness to proceed into QT.

The system configuration, inclusive of software and algorithms, described in the QDP must match the system configuration that was certified by TSA. The TSA will evaluate QDPs as noted within the QMP. If changes are made to the system after QDP acceptance and QT testing starts, the QPL Applicant shall submit a Developmental Engineering Proposal (DEP). The QPL Applicant may submit up to two DEPs per QT attempt. QT testing will not begin until TSA funding has been approved, and TSA funding is limited to the first five (5) QPL Applicants’ QDPs accepted for QT.

TSA will not accept any additional QPL Applicant QDPs after the first five (5) QDPs have been accepted by TSA.

The QDP will be evaluated by the Government for thoroughness and adequacy based on the requirements outlined in the QMP to enter QT. Once approved, the QDP is the design basis in which the system baseline is established by the Physical Configuration Audit (PCA) for the remainder of the Qualification Process.

2.6 Step 6: Implementation Testing

The goal of Step 6 is to ensure the system meets requirements specified in the ETD FRD Version 2.0, is ready to proceed into IOT&E, and will not pose any operational, safety or security risks.

During Step 6, the Government shall execute testing against requirements, assigned by the QT Test Director and System Evaluator, as a verification test source. Testing for Step 6 will be tailored to these requirements and all efforts will be made to evaluate each System Under Test (SUT) in an identical manner.

2.6.1 Step 6a: Qualification Testing

QT is conducted by the TSA at the TSIF to assess system performance against functional requirements in a laboratory environment.

The QPL Applicant will not be permitted to witness QT. However, the QPL Applicant may be called upon for test team training, on-site technical support, cyber security verification activities (e.g., questions on security controls) and maintenance, or troubleshooting of system malfunctions, as required.

Except for Field Data Reporting System (FDRS) and log files, the QPL Applicant shall not conduct data recording (logging) of test events or test objects. All image files, FDRS and log files generated during QT will be the property of the Government or will be purged from the system upon completion of the tests by the Government. The QPL Applicant will not be permitted to wipe any data from test equipment without the explicit approval of either Marilyn Gray (marilyn.gray@tsa.dhs.gov) or Jeanette Man (jeanette.man@tsa.dhs.gov), in writing, during a maintenance visit or at completion of QT.

Each QPL Applicant will only be allowed one attempt at QT once their respective data package has been accepted. A second attempt may be possible if TSA funding is available, and if TSA has not yet already accepted five (5) QDPs.

Installation of the three test systems at the TSIF is inclusive of non-scanner related accessories to support checkpoint operations (e.g., consumables). After installation is complete, the QPL Applicants must provide their signed Test Readiness Notification (TRN) to TSA to begin QT.

TRNs shall be sent to TSA via email at jeanette.man@tsa.dhs.gov and marilyn.gray@tsa.dhs.gov with the Subject: “ETD QPL TRN TSIF – Vendor and System Name,” whereupon TSA will confirm receipt.

All prospective QPL Applicant systems must successfully complete QT to continue the Qualification Process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. To determine successful completion, in accordance with the QMP, the TSIF Test Branch will produce a QT Report after test completion, where the TSA will make a determination if the system has successfully passed the tests. The next steps in the process will also be provided and may include termination, deficiency investigation, correction, or continuation through the Qualification Process. TSA reserves the right to deny or terminate the Qualification Process for systems that do not successfully pass QT.

2.6.1.1 Qualification Testing Failures

QT Failure is defined as the presence of deficiencies that warrant correction prior to proceeding to the next phase of the QPL. The TSIF Test Branch will track and document all SUT failures, malfunctions and/or anomalies encountered during QT. The TSIF Test Branch will review observed issues that affect testing activities and will coordinate with the QPL Applicant for resolution of any required corrective actions for critical failures.

QT will be suspended if the SUT malfunctions or has a critical failure that impedes the progress of testing and cannot be repaired or replaced within five calendar days of QPL Applicant notification or a time frame specified by TSA. Repeated critical failures, or a critical failure that remains unresolved, may also result in suspension or termination of testing if the overall QT schedule is negatively affected. If it is determined at any time during QT that the SUT fails to meet requirements to a degree that prevents the system from proceeding to IOT&E, testing may be suspended or terminated, and the QPL Applicant will be notified by TSA.

TSA may perform a CERT re-test or regression test following a repair or replacement of parts, or after any hardware/software modification if modifications to the system are determined to have an impact on the detection capability.

The Government reserves the right to remove any QPL Applicant from QT and require third-party substantiation of QPL Applicant fixes if TSA determines the Transportation Security Equipment (TSE) has significant issues that will prevent passing QT or IOT&E.

2.6.2 Step 6b: Cooperative Vulnerability Penetration Assessment

The CVPA consists of the TSA cyber team scanning the Applicant’s ETD to identify any cybersecurity vulnerabilities associated with the Operating System (OS). The cyber team will also conduct a limited manual penetration assessment that will look at the ports and other attack surfaces (physical access) to try to break into the OS via the Graphical User Interface (GUI); and overall determine if there any vulnerabilities associated with the physical access to the system.

There will be additional data needed such as administrative credentials to access root OS, and TSA will work directly with the Applicant to gather the information at this stage.

2.7 Step 7: Conduct Initial Operational Test and Evaluation

After notification of successfully passing QT, the QPL Applicant must successfully complete the shipment and installation of four (4) ETD test systems (two (2) units from TSL and two (2) units from TSIF) to the first selected field site for IOT&E as stipulated in a modification to the aforementioned bailment agreement. Delivery and installation must be completed within 10 business days of TSA notification of which field site will be used. QPL Applicants will be notified via email by TSA of all the finalized field test locations after TSA completes the QDP review and approval process. QPL Applicants should be prepared for up to five (5) testing sites at any airport throughout the 50 states. The testing schedule will be arranged with each QPL Applicant as they reach this step. Schedules will need to be adjusted based on airport need and any testing blackout periods. All QPL Applicants will be tested at the same airports and for the same number of testing days. Installation of these systems is inclusive of accessories to support screening operations (i.e., consumables to run 750 tests, per machine, per site).

QPL Applicants must provide their signed TRN to begin Field Testing. TRNs shall be sent via email to TSA at jeanette.man@tsa.dhs.gov and marilyn.gray@tsa.dhs.gov with the Subject: “ETD QPL TRN XXX (airport code) – Vendor and System Name,” whereupon TSA will confirm receipt.

All prospective QPL Applicants must successfully complete IOT&E to continue the Qualification Process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. In accordance with the QMP and after Field Test completion, TSA will make a determination if the system has met all of the field test objectives successfully to ensure the system under test is installed, integrated, and ready to proceed to IOT&E. TSA reserves the right to deny or terminate the Qualification Process for systems that do not successfully pass the Field Test.

2.7.1 Initial Operational Test & Evaluation Failure

In the event the proposed system does not pass testing or is suspended, the system will be removed from the Government test site(s).

2.7.2 Initial Operational Test & Evaluation Reporting

All QPL Applicant systems must successfully complete IOT&E. After IOT&E, and in accordance with the QMP, the TSA will make a determination if the system has successfully met the IOT&E objectives by reviewing the System Evaluation Report (SER) generated by the System Evaluator post IOT&E that will document operational effectiveness, suitability, and resilience and will identify any deficiencies. The System Evaluator will submit the SER to TSA.

The TSA will review the SER and may or may not share details with the QPL Applicant. The QPL Applicant will be notified of test results after the conclusion of the IOT&E reporting period. The

TSA will also advise the QPL Applicant of required next steps in the process, which may include termination and/or deficiency investigation/correction.

2.8 Step 8: Placement on the QPL

In accordance with the QMP, systems will be placed on the QPL post successful IOT&E with a satisfactory finding and approval from the CAE. Once a system is added to the QPL, it is considered “Qualified”, and TSA will provide the QPL Applicant with a Qualification Letter.

TSA and other DHS components may issue Requests for Proposals (RFPs) for ETD requirements in accordance with RFO FAR Part 6. However, the system proposed must be on the ETD QPL in accordance with RFO FAR 52.209-1 Qualification Requirements.

3.0 Applicable QPL Clauses

Applicable QPL Clauses for Handling Classified, SSI, and Controlled Unclassified information are included in the following subsections.

3.1 Additional TSA Security Terms

A. Clearance Level. The ETD Qualification Process requires security clearance at the Secret level.

B. Access to Classified Information. QPL Applicant personnel are required to have access to classified information at the Secret level.

C. Place of Performance. The location of performance where classified information will be accessed, produced, safeguarded, or stored is as identified below:

SSI and Classified information provided via the process noted in Section 2. Document Release Requirements and accessed at QPL Applicant’s facility.

If required, the QPL Applicant will store and safeguard classified material in accordance with DHS Instruction 121-01-011 Department of Security Administrative Security and Executive Order 13526, Classified National Security Information, at the SECRET level in support of program office requirements. Additionally, in accordance with the Department of Defense (DOD) Manual 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM) for Safeguarding Classified Information,” Chapter 5, Section 5-502, the QPL Applicant is authorized to disclose TSA classified information to cleared subcontractors when access is necessary to perform tasks or services for fulfillment of a prime or subcontract. However, prior written approval by the Contracting Officer or his/her designee is required. Additionally, pursuant to NISPOM, Chapter 5, Section 5-506, the QPL Applicant shall not disclose classified information received or generated under this TSA qualification process to any other Federal agency unless specifically authorized in writing by the TSA Program Office that has classification management jurisdiction over the information and the TSA COR. In accordance with the NISPOM, Chapter 5, Section 5-509, the QPL Applicant shall not disclose classified information to another entity except to support this qualification process or for any other TSA purpose. The QPL Applicant must first obtain written approval from the Contracting Officer or his/her designee before it exercises any actions authorized by NISPOM Chapter 5, Sections 5-502, 5-506, and 5-509.

3.2 RESERVED

3.3 NOTIFICATION TO QPL APPLICANTS OF TSA CONTRACTOR ACCESS

TO PROPOSAL

QPL Applicants are advised that employees of the firms identified below may have access to proposals submitted under this QPL process. These individuals will be authorized access to only those portions of proposal data and discussions that are necessary to enable them to perform their respective duties. Such firms are expressly prohibited from competing on any subsequent acquisitions. Pursuant to RFO FAR 9.505-4, these firms must also execute an agreement with each QPL Applicant that states that they will: (1) protect the QPL Applicant’s information from unauthorized use or disclosure for as long as it remains proprietary, and (2) refrain from using the information for any purpose other than that for which it was furnished.

Firm #1: SAIC, 12010 Sunset Hills Rd., Reston, VA 20190, (703) 676-4300

Firm #2: Acquired Data Solutions, 11900 Parklawn Drive, Suite 205, Rockville, MD 20852, (301) 984-4193

Firm #3: Black Diamond Consulting, 43023 Park Creek Drive, Ashburn, VA 20148,

(703) 767-1886

Firm #4: InQwest, 3100 Clarendon Blvd, Suite 200, Arlington, VA 22201, Walter Watanabe, CTO, Email: wwatanabe@inqwestinc.com, (703) 401-7578 or Katie Lopez, Office Manager, Email: katie.lope@inqwestinc.com, (703) 348-8552

Firm #5: Management and Training Resources, 2127 Larimer Street, Suite 201A, Denver, CO 80205, (303) 587-7576

Firm #6: Strategic Defense Solutions, 8902 N. Dale Mabry Hwy, Suite 111, Tampa, FL 33614, Christina Courson, Customer Representative, Email:

christina.courson@strategicdefensesolutions.com, (813) 443-0658 or Lauren Souders, Email: lauren.souders@strategicdefensesolutions.com, (443) 375-6792

Firm #7: Signature Science, LLC, 8501 North Mopac Expressway, Suite 100, Austin, TX 78759-8309, (877) 474-4724

Firm #8: Battelle Memorial Institute (Prime), 505 King Ave, Columbus, OH 43201,

(800) 201-2011

Firm #9: Chugach Government Solutions, 50 Tech Parkway, Suite 106, Stafford, VA 22556, Jim Lamborn, Email: james.lamborn@chugachgov.com, (814) 881-8501

Firm #10: Syntelligent Analytic Solutions, LLC, 417 West Broad St. Suite 203A, Falls Church, VA 22046, (540) 736-4570

Firm #11: MAG Aerospace, 12730 Fair Lakes Circle, Suite 600, Fairfax, VA 22033,

(703) 376-8993

Firm #12: Battelle Memorial Institute, 505 King Ave, Columbus, OH 43201, (614) 424-3522

Firm #13: Signature Science LLC, 8329 North Mopac Expressway, Austin, TX 78759,

(512) 583-2306

Firm #14: Global Systems Technologies, LLC, 50 Tech Parkway, Suite 211, Stafford, VA 22556, (540) 288-3132

To expedite the evaluation process, each QPL Applicant must contact the above companies to effect execution of such an agreement prior to submission of CDP/QDP. Each QPL Applicant shall submit copies of the agreement with their CDP/QDP.

3.4 RFO FAR 52.240-92 Security Requirements (NOV 2025)

a) This clause applies to the extent…