1 Gold_CM Req_Attachment_7.16.26.pdf

Transportation Security Equipment Configuration Management Requirements

Attachment: Configuration Management Requirements

1.1 Configuration Management Program

All Transportation Security Equipment (TSE) systems shall be maintained under strict configuration management. All system Configuration Items (CIs) and hardware and software CIs shall be uniquely identified and map back to the Original Equipment Manufacturer’s (OEM) configuration baseline. The Contractor shall require the equipment manufacturer not to alter these systems in any way without the express approval of the Government.

The Contractor shall require the equipment manufacturer to establish, implement, and maintain a Configuration Management (CM) Program based on the requirements of this statement of work. Should the OEM already have a TSA-approved CM plan, the Contractor shall maintain the TSA-approved CM plan for the life of this contract. The CM program shall provide an organizational structure with configuration identification and control methods, configuration audits, and Configuration Status Accounting (CSA) procedures for system hardware, software, firmware and deliverables. The CM requirements are applicable to all deliverables under this contract and associated task orders.

The Contractor shall require the equipment manufacturer to prepare and deliver the Configuration Management Plan in accordance with the referenced CDRL.

CDRL L001 – Configuration Management Plan

1.1.1 Configuration Baselines

The Contractor shall require the equipment manufacturer to establish and maintain the configuration baseline for each TSE configuration and establish and maintain the required documentation to support this configuration, referred to as the Product Baseline (PBL).

1.1.2 Configuration Identification

The PBL shall retain all documentation for identification, control and status accounting of any Configuration Item (CI) throughout the program life cycle. The CI identification shall be available in a Master Configuration Item List (MCIL). All system CIs and top level hardware and software CIs shall be uniquely identified.

The Contractor shall require the equipment manufacturer to prepare and deliver a MCIL per TSE in accordance with the referenced CDRL. The Contractor shall require the equipment manufacturer to prepare and submit the initial MCIL to the Government thirty (30) business days after contract award;

updated MCILs will be required prior to scheduled configuration audits and ASREQ.

CDRL L002 - Master Configuration Item List

1.1.3 Configuration Control

The Contractor shall require the equipment manufacturer to apply configuration change management measures to each baseline CI and its configuration documentation. The configuration change management system shall provide effective means, as applicable, for proposing changes to CIs and ensuring implementation of the approved change. The Contractor shall require the equipment manufacturer to maintain configuration change management of hardware, software, firmware, and developmental/commercial and training documentation. The Contractor shall require the equipment manufacturer to maintain configuration change management of hardware to the Lowest Replaceable Unit (LRU) level and software to the version level.

Changes represent opportunities for improvement or correction of deficiencies. Desired changes are documented in Requests for Change (RFC) in the form of Engineering Change Proposals (ECP), Requests for Deviation (RFD), and Requests for Waiver (RFW), which are uniquely identified. All change requests are entered, tracked, controlled, and documented and the Contractor shall require the equipment manufacturer to establish and maintain a system for tracking, controlling, and submitting all changes.

The equipment manufacturer is encouraged to voluntarily develop, prepare, and submit Value Engineering Change Proposals (VECP). The VECP shall include a clear description and related schedule on how the Contractor plans on incorporating the VECP into fielded Transportation Security Equipment (TSE) units without adversely affecting operational availability of the EDS.

ECPs are requests to incorporate a permanent change to product configuration, which produces a new baseline. RFDs are requests to temporarily incorporate a known departure from product requirements. Authorized deviations are a temporary departure from requirements and do not constitute a permanent change. RFDs must state actions to be taken at the end of the temporary deviation (e.g. restoration to original configuration). RFWs are requests to incorporate a known departure from product requirements. Authorized waivers are for specific quantities of product and do not constitute a change to the baseline configuration or its documentation.

The Contractor shall require the equipment manufacturer to deliver configuration control data submittals directly to government via email at CTOCM@tsa.dhs.gov using the following formats:

ECP DD FORM1692, AUG 96 (EG), Pages 1-7 as applicable

RFD / RFW: DD FORM 1694, AUG 96 (EG)

The Contractor shall require the equipment manufacturer to deliver all supporting documentation directly to the government via email at CTOCM@tsa.dhs.gov and link it to the appropriate

ECP/RFD/RFW.

1.1.4 Configuration Status Accounting

The Contractor shall require the equipment manufacturer to maintain a Configuration Status Accounting (CSA) Information System to assure accurate identification of each CI. The Contractor shall require the equipment manufacturer to ensure that the CSA information is provided to the Government upon request. The CSA information shall be provided as a monthly Configuration Status Accounting Report (CSAR). Failure to submit the CSAR on a recurring monthly basis will result in a corrective action report against the Contractor that will document the negative performance and may led to Government consideration. The CSA System shall be described in the CMP. The CSAR shall identify all deviations from the MCIL for each unit, i.e. for all serial numbers.

The Contractor shall require the equipment manufacturer to prepare and deliver the CSAR in accordance with the referenced CDRL.

CDRL L007 - Configuration Status Accounting Report

1.1.5 Configuration Audits

The Contractor shall require the equipment manufacturer to support PBL Audits and shall perform internal configuration audits. The Contractor shall require the equipment manufacturer to prepare and submit a Configuration Audit Plan (CAP) that describes procedures for conducting the audit, including Functional Configuration Audit (FCA) and Physical Configuration Audit (PCA). When proposed and approved in the CAP, the Contractor may invite SubContractors, vendors, and suppliers to participate in the configuration audits, as proposed and approved via the CAP.

The FCA shall verify system functional performance requirements; the PCA shall verify system physical performance requirements. The Contractor shall require the equipment manufacturer to prepare and submit a Configuration Audit Summary Report (CASR) documenting the results of each audit and the resolution for each finding.

The Contractor shall require the equipment manufacturer to prepare and deliver the CAP in accordance with the referenced CDRL.

CDRL L008 - Configuration Audit Plan