Appendix B_Terms.pdf

APPENDIX B - SECURITY THREAT ASSESSMENT AND

DISCLOSURE OF SSI

FOR

SPECIAL NOTICE

70T04026SN7573N001

Document: 70T04026SN7573N001

B-2

VENDOR ACCESS TO SENSITIVE SECURITY INFORMATION (SSI) NECESSARY

FOR AIR CARGO SCREENING TECHNOLOGY PROGRAM (ACSTP): AIR CARGO

SCREENING QUALIFICATION TEST (ACSQT) ACTIVITIES AND AIR CARGO

SCREENING TECHNOLOGY LIST (ACSTL) DEVICE SUSTAINMENT ACTIVITIES

A. Background. Sensitive Security Information (SSI) may be available to vendors in support of this program. Vendors must obtain specific authorization in order to obtain SSI. SSI will not be available or otherwise provided or disclosed to any person not specifically authorized to receive it. SSI provided under the ACSTP may only be used to satisfy ACSQT requirements and ACSTL device sustainment.

B. Corporation Vetting. Vendors who do not have current contracts with TSA and do not hold National Industrial Security Program (NISP) facility clearance will have to undergo clearance. Other companies with personnel who require access to program-specific SSI for the purposes of the ACSQT will be reviewed and determined to be accountable parties. TSA will collect fully executed Department of Homeland Security Non-Disclosure Agreements (DHS Form 11000-6) for all individuals who are cleared for access to SSI prior to providing any sensitive information and will provide these individuals a copy of the SSI Quick Reference Guide for DHS Employees and Contractors prior to providing any sensitive information.

C. Senior Corporate Official. Each vendor must designate in writing via OSC_ACSQT@tsa.dhs.gov a single, Senior Corporate Official who will serve as the single point of contact for sensitive information. This individual must certify that all appropriate protections will be followed, only authorized individuals will have access to the sensitive information, and that those individuals adequately understand their responsibilities to protect the information.

This official must also certify via OSC_ACSQT@tsa.dhs.gov annually that all appropriate protections have been followed, only authorized individuals have access to the sensitive information, and that those individuals with access adequately understand their responsibilities to protect the information. This official will also ensure that the TSA is notified of staffing changes or circumstances in which individuals no longer need access to the information.

C. Vendor Responsibility. TSA will review the Excluded Parties List System (www.epls.gov) and the Unique Entity Identifier (UEI) under SAM.gov. While this review does not replace the responsibility determination set forth in FAR part 9, it may prohibit vendors from receiving SSI information.

D. Criteria for Release. As part of the ACSTP, SSI may only be accessed by individuals who have successfully passed a Security Threat Assessment. This assessment may include a verification of site facility clearance in the National Industrial Security Program (NISP), contractor suitability determination or other federal background investigation, individual security clearance(s), and if required, a criminal history records check (CHRC) and/or a check against terrorism databases.

E. Information Requirements. Consistent with the criteria release described above, vendor’s Senior Corporate Officials must provide the appropriate information to TSA as identified below.

mailto:OSC_ACSQT@tsa.dhs.gov mailto:OSC_ACSQT@tsa.dhs.gov http://www.epls.gov/

B-3

To expedite the Security Threat Assessment, the following information shall be submitted at the time of white paper submission, unless a successful STA has already been completed.

(1) Identification of the Senior Corporate Official and a certification by the Senior Corporate Official that addresses the elements outlined in B above;

(2) CAGE code of the Offeror’s facility that will manage the program, and company Unique Entity Identifier (UEI) as registered on SAM.gov, if available, and address;

(3) For U.S. citizens, all information requested in the ACSTP Security Threat Assessment Request spreadsheet must be emailed to RFP.Access@tsa.dhs.gov, as well as, a confirmation email, which should be sent to OSC_ACSQT@tsa.dhs.gov;

(4) For Foreign Nationals, all information requested in the ACSTP Foreign National Security Threat Assessment Request spreadsheet must be emailed to OSC_ACSQT@tsa.dhs.gov, and;

(5) Non-Disclosure Agreements, each vendor employee who is granted access to SSI as specified herein will be required to execute a Non-Disclosure Agreement prior to receiving or reviewing SSI. The vendor should understand that employees granted access to SSI and signing a non-disclosure agreement are bound by the terms of that agreement indefinitely, notwithstanding their employment status or any other background checks or clearances granted by any Government agency.

F. Privacy Act Statement. TSA will use the information provided to conduct a security threat assessment on individuals who seek access to SSI. The information will be shared within DHS with personnel who need the information to perform their official duties. Additionally, DHS may share the information with law enforcement, intelligence, or other government agencies as necessary to identify and respond to potential or actual threats to transportation security in accordance with the routine uses identified in the applicable Privacy Act System of Records Notice (SORN), DHS/TSA 002, Transportation Security Threat Assessment System (T-STAS).

This SORN was last published in the Federal Register on November 8, 2005, and can be found at 70 FR 67731- 67735. Authority: 49 USC 114. Furnishing this information is voluntary.

However, failure to furnish the requested information may delay or prevent the completion of your security threat assessment, without which you may not be granted access to the SSI.

G. Notification of Assessment. If it is determined that covered individuals are not eligible to receive access to particular SSI based on the threat assessment, TSA will provide the individuals and company point of contact a written determination that provides notification that the individual does not qualify to receive SSI. Appeal of the determination will not be permitted due to the time sensitive nature of the ACSQT process; however, the potential offeror may nominate another individual to receive SSI access. In the event that an individual is determined to be a security threat and the individual believes that the results of the screening are inaccurate, he or she will be informed by TSA on how to pursue redress from TSA; however, due to the demanding schedule, TSA will not delay the ACSQT process to resolve redress issues.

H. Return of SSI. Any hard-copy SSI provided to the vendor must be returned to the Government in the event devices do not continue to the next stage (do not successfully complete mailto:RFP.Access@tsa.dhs.gov, mailto:OSC_ACSQT@tsa.dhs.gov.

B-4

Stage I or Stage II activities) or the vendor no longer has devices listed on the ACSTL as Approved, Qualified, or Grandfathered. In the case of SSI provided via email, the Senior Corporate Official can send an email OSC_ACSQT@tsa.dhs.gov certifying that all SSI has been destroyed/deleted. Any vendor not returning or destroying SSI provided directly to them will be subject to penalties as prescribed by law and otherwise rendered ineligible for further consideration in the evaluation.

I. Pass-Through of Security Requirements to Business Associates. The vendor agrees to incorporate the substance of this Appendix, its terms and requirements, into agreements with all business associates. Business associates are individuals and organizations associated with the vendor for the purposes of conducting activities in support of the ACSQT process of sustainment of an ACSTL device. This includes anyone who receives system software for the purposes of installation on an ACSTL device. Violation by a business associate of any provision set forth in this Appendix will be attributed to the vendor.

J. Employee Termination. The vendor shall notify the TSA Contract Specialist within thirty

(30) days when an employee granted access to SSI terminates employment or no longer requires such access.