Attachment 02 - Integration Overview 09222025.docx

Large-Scale Fixed Systems

ATTACHMENT 02 – INTEGRATION OVERVIEW

U.S. Department of Homeland Security U.S. Customs and Border Protection

Attachment 02 – Integration Overview

For:

U.S. CUSTOMS AND BORDER PROTECTION

NON-INTRUSIVE INSPECTION SYSTEMS

Large-Scale Fixed Systems High-Energy Rail

PREPARED BY:

OFFICE OF FIELD OPERATIONS

INNOVATION AND STRATEGY DIRECTORATE

NON-INTRUSIVE INSPECTION DIVISION

LAND BORDER INTEGRATION

July 2025

Contents

Integration Overview Background and Deployment CBP employs Non-Intrusive Inspection (NII) systems as part of its layered enforcement strategy to detect contraband, illegal narcotics, weapons of mass destruction, and instruments of terror. These systems include High-Energy Rail (HE Rail) systems, which are deployed at land Ports of Entry (POEs) and at Sea POE for railcars transported via ship or ferry on trains built at the Sea POE or arriving under the CBP Advanced Qualified Unlading Approval (AQUA) Lane program. These deployments aim to enhance CBP's inspection and interdiction capabilities while increasing throughput.

Transition to Cloud-Based Architecture To address the increased image volume and improve operational efficiency, CBP transitioned to a cloud-based architecture. This shift enables the use of machine learning algorithms for image adjudication and facilitates the integration of targeting information. The transition supports CBP's mission to interdict threats more effectively.

Integration Efforts: Key Components Common Integration Platform (CIP)

· Data Aggregation and Transformation: Aggregates raw OEM data, including X-ray images and metadata, and transmits health and status information to CBP IT infrastructure.

· Large Scale X-ray ICD Compliance: Ensures X-ray and ancillary data are in compliance with standards.

· System Interoperability: Ensures interoperability with NII equipment by transmitting configuration data and metadata (e.g., license plates, RFID data).

· Latency and Scalability Requirements: Meets latency requirements for data transmission, ensuring timely processing.

· Data Quality Monitoring: Detects and tags degraded radiographic images, identifies potential system failures, and generates data quality reports.

· Data Transmission and Storage: Ensures non-transmitted files are stored indefinitely until processed.

NII Middle Tier (NMT)

· Integrated Data Package (IDP) Creation: Consolidates updates from CIP, including images, license plate reads, and adjudications, ensuring proper tracking.

· Integration with CBP Data Holdings: Incorporates data from CBP systems including Truck Manifest Primary (TMM) and CBP Targeting Data.

· Advanced Queuing: Makes IDPs available for the Common Viewer (CV) and other stakeholders, including machine learning models.

· Algorithm Integration: Ingests machine learning results and makes them accessible to CBP systems including CV and TMM.

· Health and Status Data Interface: Ensures H&S data is made available to consuming applications (including dashboards).

Common Viewer (CV)

· Analysis Workflow Configuration: Supports workflows for various cargo types (land, rail, air, seaport).

· Health and Status Dashboard: Integrates CIP data for operational visibility.

· Latency and Response Time: Responds to user commands within 1-2 seconds and ensures timely display of IDPs.

· X-ray Image Display: Maintains image quality as received from OEM systems.

· Supervisor Tools: Provides tools for user management, performance monitoring, and adjudication.

· Data Quality Monitoring: Detects degraded images and generates reports.

OEM Contractor Requirements OEM contractors shall transmit X-ray, ancillary sensor, and health and status information to the CIP/NMT in Large-Scale X-ray ICD format within 1 (objective) to 3 (threshold) seconds after the information is collected. For ancillary sensor information, the clock shall start as soon as the information is collected and for X-ray image information this shall start at the completion of the image scan. All transmitted information shall be in compliance with the Large-Scale X-ray ICD. These requirements ensure efficient data exchange, real-time targeting, and a consolidated threat picture.

CBP Network Integration Requirements This section provides procedures and techniques necessary to implement the network integration with CBP infrastructure and network-enabled systems. OEM contractors shall review the following integration areas to ensure integrity, availability, and functionality within the CBP IT infrastructure and operations. CBP policy mandates that all OEM systems connected with the CBP IT infrastructure to be individually accounted as part of an integrated IT system, which embraces the CBP applications and general support systems.

Physical Security Requirements

· CBP Policy HB 1400-05D V9 - Section 3.1 Physical Access Control requires the general physical access controls by restricting the entry and exit of personnel from areas such as office buildings, data centers, and rooms containing IT equipment. These controls protect against threats associated with the physical environment. It is important to review the effectiveness of general physical access controls in each area during business hours and at other times.

· The contractor shall keep IT equipment room doors locked (e.g., physical keys, cypher, or preferred PIV access control) to ensure the security of the NII server room and network equipment inside.

· NII Server Room Handover

· NII Server Room Handover shall be performed prior to establishing CBP network (VRF) connection. CBP network connection shall occur approximately two weeks prior to Site Acceptance Test (SAT).

· NII HE Rail Integration Tests: Contractor Witness Testing (CWT) à Confirmation of Infrastructure Readiness à NII Network Room Handover à VRF Router Installation and Configuration à Lower Environment Test à SAT

· Handover does not require the contractors to be on-site to participate. However, the contractor shall return all keys and the codes for cypher locks/PIV access (if available) to the LAN rooms.

· After the handover, the operational access is limited only to CBP authorized/escorted personnel. For contractor access, the contractor shall request and identify the purpose of network equipment access. The contractor must be escorted and monitored by OEM staff to have access to the room. Per OPR guidance, even if the contractors are vetted and obtain clearance, they may not have authorization for access to all facilities (i.e., network rooms). For example, they may be authorized work in the common areas, and work on their equipment, but CBP controls access to the CBP offices/network rooms.

CBP Standard Equipment

· The contractor shall ensure their technology is accessible, secure, and aligned to the CBP Enterprise Architecture (EA) in accordance with CBP Policy - DIRECTIVE NO. 5510-040-122. This Directive institutes the Technical Reference Model (TRM) as the primary tool for obtaining information technology (IT) and operational technology (OT) for use at CBP (e.g., software, hardware, applications, etc.) and includes a repository listing the technology and its associated authorization status for use within CBP.

· CBP initiated the TRM to provide instruction for reviewing, managing, maintaining, and cataloguing CBP technologies that are aligned to cybersecurity standards and the CBP EA. TRM also institutes standards and procedures to support CBP in solving previously identified persistent issues/challenges (i.e., duplicative technology, unnecessary increases in costs, technologies that were procured and implemented outside of coordination with Office of Information and Technology (OIT), identifying innovative new technologies, critical decisions made without considering technical security, and lengthy time and effort negatively impacting technology procurements.)

· When to use TRM:

· TRM serves as our centralized service application, where all CBP employees and vetted contractors can browse a diverse range of hardware, software, software plugins, and third-party mobile applications that have undergone rigorous review and approval for use within CBP.

· How to access TRM?

· OEMs with CBP background investigation (BA) can use the following link to open and review the CBP approved equipment list.

TRM Search - Service Portal:

https://cbpprod.servicenowservices.com/sp?id=trm_search_1

Border Security Deployment Program (BSDP) Network Integration BSDP Network Integration

· The contractor shall provide CAVSS Cameras/CCTV Kit to the NIID Test Directors for verification as approved IP Devices. Final approval will be made by the BSDP/CAVSS team. The approved devices, including cameras, are not to be purchased more than 9 months prior to installation.

· The contractor shall confirm that the cameras have been validated in accordance with the CAVSS Operational Readiness checklist for their functionality during contractor Pre-SAT.

· The cameras shall not be connected to the CBP network by BSDP until full functionality has been validated by the contractor. Cameras with known vulnerabilities shall be replaced prior to connecting to the CBP Network.

· NIID Test Directors and NIID Regional Managers will confirm the approved field of view of the cameras during the government SAT and assist in completing the CAVSS Operational Readiness checklist.

· BSDP Engineer will make the connections to the CBP VLAN 140 switch ports when they deploy the image/program to the CAVSS devices. BSDP will need confirmation from HE Rail contractor and/or Port OIT/FTO that the cable path exists to the designated CBP switch.

CAVSS Workstation Requirement

· CAVSS workstations shall be equipped with a desktop tower form factor with keyboard. This configuration makes Command Center CONOPS consistent and more efficient for the CBP Officers since the Officers will need to interact with the workstation during ongoing operations.

· Two (2) workstations shall display up to 32 cameras, if additional storage capacity is needed, then Network Video Recorder (NVR) would need to be installed to ensure the site meets the 90-day recording requirement.

· The workstation, 27” monitor, keyboard, and mouse shall be placed in the Command Center near the large format CAVSS monitor(s). The link below provides a possible solution to move a current rack mounted workstation out into the Command Center (i.e. allows the workstation to be placed on the wall where the Officers can access for archiving). Using these wall rack brackets the rack mounted workstation can be mounted near the CAVSS operator position. https://www.racksolutions.com/wall-racks.html

· Workstations shall be installed near the CBP officers so that officers have the ability to access the systems on a regular basis. These workstations shall be placed on the CBP Active Director which shall require the system to be logged into every 30 days. If the system is not accessed in 30 days it shall be automatically disabled from the CBP network. BSDP will provide a common user account for daily use and display of the CAVSS camera views.

Video Wall Requirement

· The size of video wall depends on the room size. Larger monitors between 43” and 86” are recommended. Many current HE Rail locations have 50” to 55” monitors installed.

· Note that each workstation can only display up to 16 cameras on a monitor. A virtual matrix display controller (VMDC) can typically get around 20 cameras, but these can be split between two large displays if desired. VMDC does not have the ability to archive video, thus, this can only be done with a workstation.

· The contractor shall select large format monitors listed on the technical reference model (TRM) cited in Section 5.2. Coordinate with the test directors, who have access to the CBP TRM app.

Centralized Area Video Surveillance System (CAVSS) Camera Deployment Process

· Clarification received from the Border Security Deployment Program (BSDP) on nomenclature: BSDP is the Office of Field Operations (OFO) program, CAVSS is the system managed by the Office of Information and Technology (OIT), Enterprise Infrastructure and Operations Directorate (EIOD), Integrated Logistics Division (ILD). The BSDP boundary is the network switch. BSDP is responsible for the cameras, workstation for viewing video, video management system (VMS), network video recorders (NVRs), system administration, configuration, and connection to CBP switch.

· The contractor shall coordinate with the BSDP engineering team to plan the connection of CAVSS to the CBP Network.

· The contractor shall coordinate with the EIOD/Network engineering team (NAED) to support the CBP network design in the lane, so that both VLAN 157 and VLAN 140 can be prepared, tested and validated.

· The contractor shall provide the bandwidth and data transmission requirements to OFO/NIID and BEMSD/EASD, so that the sites will prepare the adequate network infrastructure (circuits, routers/switches, and cabling) while planning the available switch ports, programmed to VLANs and available IP addresses to accommodate the CAVSS devices.

Note: For BSDP CAVSS equipment, the BSDP Engineering Team manages the standard equipment list for each contractor.

1.1. Network Cabling Requirements

Engagement with Local Field Support Staff

· The contractor shall consult with local Field Support (FTS/FTO) and the BSDP engineering team during the initial survey and design phases to:

· Identify the cabling requirements for the connection from/to the Command Center, Intermediate distribution frames (IDFs), and main distribution frames (MDFs).

· Design the cabling scope via use of copper ports, power over ethernet connection, and fiber-optic cables.

· Design the cabling for the connection with BSDP cameras in the lane, NII server room, and IDFs/MDFs for the CBP VRF implementation.

Cabling types

· The contractor shall use fiber-optic cable between the scanners, command center, NII server room, and IDF/MDF LAN rooms.

· The contractor shall install single-mode fiber module with 48 strands recommended between NII server room and IDF/MDF LAN rooms. The minimum number of strands shall be driven by the number of redundant connections.

· The contractor shall ensure there is sufficient “dark” fiber to accommodate potential breaks/damage to production fiber connections and possible expansion of services. Minimum of 24 strand fiber shall be used, with the possibility of 48 strands being required from MCC to first MDF, and, if required, and additional 12 strands up to 24 between MDFs if insufficient fiber exists.

· Related peripherals

· 1100W redundant Power Supply with Power Cable

· Power Card/Interface Card

· Patch Panel Summary The integration of CIP, NMT, CV, and machine learning algorithms within a cloud-based architecture enhances CBP's ability to process high volumes of data, utilize advanced technologies, and maintain operational efficiency. This approach supports CBP's mission to detect and interdict threats effectively while improving the scalability and reliability of NII systems.

Future Exhibits

· Exhibit A: Land Border Initiative Interface Control Document (LBI ICD) - POV ICD v5.9

· Exhibit B: Large Scale X-ray Interface Control Document (LXS ICD)

· Ready by October 31, 2025 image1.jpg image2.jpeg