Attch 1 LI SOW_01.31.2023.docx

U.S. Department of Homeland Security Transportation Security Administration

Statement of Work For

Office of Training and Development TSA Leadership Institute

ATTACHMENT 1

Table of Contents

Background Transportation Security Administration (TSA)[footnoteRef:2] within the Department of Homeland Security (DHS)[footnoteRef:3] protects the nation’s transportation systems to ensure freedom of movement for people and commerce. TSA created the 2018-2026 TSA Strategy that will guide the workforce through TSA’s 25th anniversary. This document identifies the following three strategic priorities: 1) Improve Security and Safeguard the Transportation System 2) Accelerate Action and 3) Commit to Our People. [2: https://www.tsa.gov/about/tsa-mission] [3: http://www.dhs.gov/about-dhs]

While the TSA Strategy clearly establishes the TSA mission, vision, values, and priorities, the Administrator’s Intent facilitates the implementation of the Strategy by outlining more specifically how we will work towards our strategic priorities through 2022. Successfully executing our strategy requires the commitment of TSA’s dedicated workforce and partners. The Administrator’s Intent, like the strategy it supports, stems from months of gathering robust feedback from representatives throughout TSA and across the Transportation Systems Sector. Feedback was gathered from all levels of TSA’s workforce and from external surface and aviation industry stakeholders via facilitated working sessions, the TSA Idea Factory, and a survey to field leadership.

In response to the TSA’s Administrator’s Intent 2.0 Strategic Goal 3.3: Foster an environment of continual learning and growth that instills shared organizational values and advances technical, critical thinking, and leadership skills, TSA’s Training and Development (T&D) will provide innovative training and development opportunities that will increase proficiency, improve effectiveness, instill a shared culture, and sharpen leadership skills. T&D established the TSA Leadership Institute (TSA-LI) for newly promoted supervisors, managers and existing executives. The level of government employee and position equate: GS 12/13 equivalent for supervisors, GS 14/15 equivalent for managers and SES equivalent for Executives. Change will be accomplished by preparing participants for increased levels of responsibility through mission-focused leadership training. This transformation will give TSA the opportunity to develop and provide comprehensive, mission-focused required leadership training and enhance leadership development programs. The investment in TSA employees must be achieved because their development and well-being is critical to the success of the mission. TSA will attract, develop, and sustain a professional, capable workforce and empower them to succeed and grow to their fullest potential.

1. Scope The purpose of this Indefinite Delivery Indefinite Quantity (IDIQ) is to procure services for developing and updating TSA-LI. TSA-LI will provide a comprehensive and systematic means of preparing supervisors and managers for increased levels of responsibility within TSA. TSA-LI will support the mission-focused professional development of L-band and TSES members to maintain leadership competencies. TSA-LI will provide progressive academic programs of study designed to strengthen operations. Strong partnerships across governments and industry will be integral to success in this shared transportation security mission to cultivate strong abilities in the Office of Personnel Management’s (OPM) Executive Core Qualifications (ECQs): Leading Change, Leading People, Results Driven, Business Acumen, and Building Coalitions/Communication.[footnoteRef:4] [4: http://www.opm.gov/policy-data-oversight/senior-executive-service/executive-core-qualifications/

The participants in the TSA-LI will be a cross-functional mix of newly promoted supervisors, managers and executives. Each unique program will align with the overall framework yet focus on the application of the competencies from a developmental perspective. This diverse audience enhances the opportunities for implementing change and integration both within and outside the classroom. Participants will be learning and applying the change initiatives across organizational lines, thus spreading the message to the rank and file. The participant mix will also reinforce networking opportunities among top level employees. At the completion of the program, participants will be expected to perform successfully in key leadership positions such as but not limited to: Transportation Security Manager (TSM), Supervisory Transportation Security Inspector (TSI), Assistant Federal Security Director (AFSD), Federal Security Director (FSD), Section Chief, Branch Manager, Division Director, Regional Director, and Assistant Administrator (AA) or Deputy Assistant Administrator (DAA).

The TSA-LI curriculum will be a blended methodology comprised of instructor led training and virtual led training. Virtual training shall be presented utilizing an online platform mutually agreed upon between TSA and the Contractor. This training shall contain all curriculum outlined in Section 2 and 3 of the contract. The Contractor shall hold the virtual platform license. Attendees will join by using a link provided by the Contractor. If the virtual platform is not approved by TSA Information Technology (TSA IT), the virtual platform shall not be installed on TSA provided equipment. This process has been approved by the TSA IT office.

The Contractor shall provide the following services in compliance with this SOW.

2. Curriculum

2.1 Curriculum Development

2.1.1 Design and implement TSA-LI curriculum for four separate groups 1. School of Professional Leadership Studies, 2. School of Advanced Leadership Studies, 3. School of Senior Leadership Studies, 4. School of Executive Leadership Studies in order for participants to attend in-person and virtual instruction. The principal focus of the academic portion will be to develop a broad perspective on management and leadership issues identified in the TSA Strategy, Administrator’s Intent and to cultivate strong abilities in the OPM Executive Core Qualifications. It is critical that the focus of the program content be at the baccalaureate level for supervisors and graduate level for managers and executives.

2.2 Delivery

2.2.1 Deliver two cohort pilots (1 School of Professional Studies and 1 School of Advanced Leadership Studies) followed by additional cohort sessions over the life of the IDIQ. Each training cohort size will be approximately 30 Supervisors, 30 Managers, 30 Executives from all functions and geographic areas of TSA. The actual number of TSA-LI cohorts and participants will vary depending upon the agency’s workforce analysis and funding.

2.3 Provide all staff for program instruction. Contractor shall be an Institute of Higher Education (IHE). The IHE must be accredited by an accrediting organization recognized by the United States Department of Education or the Council for Higher Education Accreditation. An IHE is defined as an institution or organization that offers post-high school level of education, such as college-level courses, which include career and technical colleges that award academic degrees or professional certifications. Staff shall have experience teaching at the bachelor level for the Supervisor and graduate level at the Manager and Executive.

2.4 Co-facilitate sessions with TSA subject matter experts to deliver course content.

2.5 Provide all program materials for instructors and participants.

2.6 Provide a minimum of two professional coaches for each session who are either certified or master certified by the International Coaching Federation or equivalent in relevant experience. The coaches shall meet with participants during classroom sessions to assist with application activity identification and to help participants apply classroom learning on the job, create a peer coaching process, and facilitate peer coaching sessions which can be conducted via telephone or virtual platform.

2.7 The coaches will serve as advisors to participants in identifying application activities to reinforce the information learned in the classroom.

2.8 Establish and implement an evaluation process, in conjunction with TSA guidelines, for gathering feedback on participant performance, program components and content, instruction, and peer feedback.

3. Specific Requirements

3.1 Overall Course Design and Curriculum

TSA intends to implement a comprehensive, developmental leadership education program that will be a requirement for all newly promoted supervisors and managers and recurrent training for executives. Transportation Security Executives (TSES) will attend recurrent training every 3-5 years and the curriculum must be updated every 3-5 years. Specifically, the program shall focus on the critical management and leadership challenges facing leaders in an intelligence-driven operation.

The TSA-LI will be comprised of a blended delivery (in-person and virtual academic components interspersed with application activities).

3.1.1 Course Design and Curriculum

The TSA-LI curriculum shall be at the supervisor, manager and executive level. The curriculum shall provide a multi-disciplinary approach to leadership issues with emphasis on the TSA Strategy and cultivating strong abilities in the OPM ECQs.

3.1.1.1 The final curriculum shall be developed in consultation with TSA upon contract award to ensure the inclusion of intelligence-driven concepts, TSA Strategy, Administrator’s Intent, TSA Leadership Principles, and core competencies. Each program will be customized for the audience but progress through a planned framework to deliberately and strategically develop strong leaders. The TSA-LI levels of leadership curriculum will be progressive and sequentially developed with courses to build upon each other as the leader progress through their career with no repetitive or duplicative content.

3.1.1.2 Desired Outcomes

Each developed and updated curriculum will serve as the core development experience for their targeted leadership level. The four schools of TSA Leadership Institute will adhere to the DHS requirements and Accountability Guide for Leadership Development Programs. Each curriculum will address the OPM ECQs, TSA Strategy, Administrator’s Intent and TSA’s Leadership Principles.

School of Professional Leadership Studies: Manager Core Development Experience for first time Managers at TSA/DHS Prepares managers to serve as supervisors to subordinate supervisors; set and/or change organizational culture; maximize organizational culture; build and maintain high-performing and diverse teams; represent and champion the organization’s values and mission Must include instruction, discussion, behavior role modeling, case studies tailored to TSA, simulations, action learning and other activities that provide feedback on strengths School of Advanced Leadership Studies: Advanced Managers Core Development Experience for Advanced Managers at TSA/DHS Prepares managers to: advocate for their entire organization while understanding the needs of other organizations; work to secure resources and strategic partnerships Must include instruction, discussion, behavior role modeling, case studies tailored to TSA, simulations, action learning and other activities that provide feedback on strengths School of Senior Leadership Studies: Senior Managers Core Development Experience for Senior Managers at TSA/DHS Provides experience in: increased self-awareness; leadership strategies; peer to peer learning; senior leadership mentoring; and knowledge of TSA component operations Must include instruction, discussion, behavior role modeling, case studies tailored to TSA, simulations, action learning and other activities that provide feedback on strengths School of Executive Level Studies: TSES Members TSA required recurrent leadership development for Senior Managers and TSES members.

Mission-focused professional development designed to reinforce and maintain leadership competencies under TSA analyzed objectives.

Must include instruction, discussion, behavior role modeling, case studies tailored to DHS, simulations, action learning and other activities that provide feedback on strengths.

3.1.1.3 TSA Strategy objectives:

Developing and implementing security policies, in conjunction with strategic partners, to deploy intelligence-driven transportation security measures to counter threats across all modes more effectively and efficiently.

Developing technical capabilities to evaluate key risk indicators; enabling insider threat detection and case management; partnering with stakeholders to create tailored mitigation strategies, and developing long term trends and patterns within the transportation domain.

Developing business and advanced analytic modeling capabilities to support a timely, data-driven decision making process.

Identifying and demonstrating emerging technology solutions that increase security effectiveness, improve passenger experience, and streamline the flow of commerce by quickly identifying, demonstrating, and evaluating new solutions in a live field environment, leading to better requirements, new solutions, and faster acquisitions.

Improving threat awareness for industry and government security operations across all transportation modes.

Evaluating the highest risk scenarios and the effectiveness of layered security counter-measures using advanced computation techniques to apply finite resources commensurate with the risk level.

Embracing innovation to address adaptive adversaries and changing targets. Understanding that innovation requires experimentation and balances the need for timely deployment with appropriate testing.

3.1.2 Program Learning Elements

3.1.2.1 The Contractor shall design and implement the program using a mixture of the following elements. For all of the elements, the greatest emphasis shall be placed on experiential learning towards the objectives of the TSA Strategy.

Classroom instruction/virtual Individual, group/team, intact work team Facilitated peer coaching Case studies/simulations/role playing Assessments of participants; i.e., 360 assessments (pre and post) Application activities

3.1.2.2 The Contractor shall provide a 360 assessment for the schools of TSA-LI participants and Transportation Security Executive Service (TSES) leaders. The 360 assessment will be conducted before the delivery of the first session of each participant’s required training and as required for TSES leaders. The 360 assessments will be accompanied with coaching comparable to each level of leadership.

3.1.3 Application Activities

3.1.3.1 To reinforce application of material learned in the classroom component, supervisor and manager participants will complete an applicable development plan that will be related to their current position at TSA. The Contractor faculty/coaches will serve as advisors to the participants’ activities.

3.1.4 Coaching

3.1.4.1 The Contractor shall provide a minimum of two professional coaches per session who are either certified or master certified by the International Coaching Federation or equivalent in relevant experience.

3.1.4.2 The coaches shall meet with participants during classroom sessions to assist with application activity identification and to help participants apply classroom learning on the job.

3.1.4.3 The coaches shall conduct one-on-one sessions with the TSES personnel via in-person, teleconference, or video conference.

3.1.4.4 A peer coaching plan shall be developed. It shall establish a process to allow participants to share successful practices, develop new skills, collaborate on classroom activities or discover solutions to relevant problems for the duration of the course.

3.1.4.5 Contractor shall facilitate peer coaching sessions and application activities which can be conducted in-person or virtual.

3.2 Evaluation

Contractor shall ensure formative evaluation techniques are applied to product development. Products are piloted, reviewed, and revised in accordance with (IAW) TSA Management Directive (MD) 1900.14, Training Standards, and its handbook.

3.2.1 Program Evaluation and Improvement

3.2.1.1 Contractor shall be constantly evaluating the quality of instruction and content to ensure that it meets the needs of participants and the needs of the organization.

3.2.1.2 Quarterly, the Contractor will present a review using feedback from participants and the organization, survey results, identify trends and provide solutions for improvements to the program. Urgent changes can be made before the quarterly review but must be presented to TSA.

3.2.1.3 Contractor shall also provide a written Quarterly Report of Services and Results. The Quarterly Report will provide the status of any pilots conducted recommendations for course improvements.

3.2.2 Participant Evaluation Component

3.2.2.1 The Contractor shall establish and implement a process for gathering feedback from participants concerning the course content and delivery during their classroom sessions. The Contractor shall create session evaluation forms for participants to complete and shall gather completed forms at the end of each session. Survey results shall be provided to the government no later than 10 business days after the event completion. A session will be considered any delivery consisting of multiple days of instruction.

3.3 Staffing Requirements

3.3.1 Institution of Higher Education (IHE)

To ensure the Contractor has the infrastructure and on-board bench strength to adapt quickly to the changing needs of TSA and the participants the Contractor shall be an IHE. See IHE definition at paragraph 2.3.

3.3.1.1 The faculty/staff for the program shall have experience providing training to GS12 or higher level federal employees. Faculty or staff will deliver training at the Bachelor level and Graduate Level.

3.3.2 Experience in leadership and management education at the graduate level As the quality of the course of instruction will depend largely on the quality of the instructors, the Contractor shall assemble a highly qualified faculty/staff with considerable experience in leadership and management education at the Bachelor level and Graduate level.

3.3.3 Familiarity with federal government

While faculty/staff familiar with federal government is preferred, it is seen as secondary to their strengths as leading experts in leadership and management education. However, the faculty/staff shall, at a minimum, have the ability to modify content to frame it in the context of the TSA Strategy.

3.3.4 Attendance of a three day TSA Orientation with site visit All Contractor faculty and staff shall be required to attend up to a three-day orientation of TSA, including a site visit to HQ, and an airport to become familiar with the organization, in preparation for developing and instructing the program.

3.3.5 Staffing Plan

The Contractor shall submit a Staffing Plan to present their approach to staffing. The plan shall contain numbers and categories (i.e., instructors, assistant instructors, coaches) of anticipated staffing and include a narrative to support its rationale for stated quantities and categories.

3.4 Academic Component

Graduate-level instruction shall be delivered in a blended environment. The principal focus of the academic program will be to develop a broad perspective on management, utilizing the objectives of the TSA Strategy, Administrator’s Intent and to cultivate strong abilities in the OPM ECQs.

3.4.1 Baccalaureate Level Content

It is critical that the focus of the supervisor level program content be delivered at an equivalent to a standard bachelor level degree program and address the TSA Strategy with material, examples, case studies, etc. set in this environment (build content with rigor). In addition, the program will be used as a management tool for change, helping top level leadership to institutionalize new behaviors, practices, cultures, and values on an organization-wide basis.

3.4.2 Graduate Level Content

It is critical that the focus of the manager and executive level program content be at an equivalent to a standard graduate level degree program and address the TSA Strategy with material, examples, case studies, etc. set in this environment. In addition, the program will be used as a management tool for change, helping top level leadership to institutionalize new behaviors, practices, cultures, and values on an organization-wide basis.

4. Deliverables

4.1 Number of Programs

The exact number of programs each year will be based on agency’s workforce analysis and funding.

School of Professional Leadership Studies Managers 1 week

School of Advanced Leadership Studies Advanced Managers 2 weeks

School of Senior Leadership Studies Senior Managers 3 weeks

School of Executive Leadership Studies TSES Members 1 week

4.2 Materials Provided

The Contractor shall provide the following materials for all programs. One electronic copy of the materials shall be provided to the Contracting Officer's Representative (COR) ten business days before each session. TSA will provide a site to upload the materials and curricula.

· Classroom materials and handouts will be mailed to the participants using the Postal service

· Books and articles for participants, mentors, TSA staff, and invited guests

· Leadership assessments for all participants

· Other materials needed to support non-classroom learning; e.g., coaching

· The Contractor shall provide virtual connectivity for each attendee when trainings are conducted in a virtual environment.

4.3 Design and Delivery of classroom training

4.3.1 The Contractor shall design and deliver the curriculum agreed-to in-person and virtual sessions.

4.3.2 Sessions shall be up to 40 hours per week in length (excluding lunch).

4.3.3 Class dates will be determined on a yearly basis between the Contractor and the TSA COR. However, class dates may be altered due to holidays or any unforeseen issues in which TSA will notify the Contractor as soon as possible. In the event of a government shutdown Contractor will be notified as soon as possible.

4.4 Curriculum Development

5.3

4.4.1 Contractor shall be responsible for developing a graduate level curriculum to give participants a broad perspective on management and leadership issues in intelligence-driven operations. TSA will collaborate with the Contractor to produce the course objectives.

4.4.2 Contractor shall designate a single point of contact responsible for handling all curriculum and course development.

4.4.3 At the conclusion of the agreement all course curriculum and materials developed under the agreement will be the sole property of the government, in accordance with FAR 52.227-4 Rights in Data-General (May 2014).

4.5 Management of Logistics

4.5.1 TSA will manage all logistics related to coordinating identification of, and travel for TSA program participants and TSA provided guest speakers and visitors. TSA will coordinate and secure training locations.

4.5.2 Contractor shall manage all logistics related to coordination of, and travel for Contractor provided instructors, onsite support, coaches, speakers, and visitors.

4.6 Evaluation of Program and Participants

4.6.1 Contractor will conduct a thorough evaluation of program content, instruction, participants, and facility, and collaborate with TSA to make necessary adjustments before the next course offering.

Deliverables Table

Will be delivered 10 days prior to Virtual Delivery

5. Government Furnished Equipment The Contractor will receive the necessary government equipment to submit and present content to TSA secured sites.

6. Place of Performance

6.1 Program Development

During program development, Contractor will meet with TSA subject matter experts as needed by phone, virtual and in-person at 6595 Springfield Center Drive, Springfield, VA 20598. Some meetings may occur at the Contractor’s location.

6.2 Program Delivery

The program of study shall be conducted in a blended learning environment. Individual coaching described in sections 3.1.4.1 and 3.1.4.2 shall be conducted in the classroom session. Any other individual and peer coaching may occur by telephone and/or in person. All programs will be delivered following accepted principles of adult education and adult learning.

The Contractor shall be prepared to deliver the training in one of the following locations:

6.2.1 TSA Hosted Facility

TSA Headquarters, Springfield, Virginia. The TSA training facility which houses modern classrooms and break-out rooms with customized audiovisual capabilities.

TSA Headquarters training facility location:

6595 Springfield Center Drive, Springfield, VA 20598 TSA Academy West, Las Vegas, Nevada. The TSA training facility which houses modern classrooms and break-out rooms with customized audiovisual capabilities.

TSA Academy Central, Texas. The TSA training facility which houses modern classrooms and break-out rooms with customized audiovisual capabilities.

TSA Training Center, Atlantic City, New Jersey The TSA training facility which houses modern classrooms and break-out rooms with customized audiovisual capabilities.

FLETC, Glynco Georgia. The TSA training facility which houses modern classrooms and break-out rooms with customized audiovisual capabilities.

6.2.2 Virtual Hosted Training

The Contractor shall develop and deliver TSA Leadership Institute training on a virtual platform. This platform shall be hosted by the Contractor and will not be installed on a TSA device if not approved by TSA IT. The Contractor shall provide students with all information to access the virtual platform.

7. Period of Performance The exact number of programs each year will be based on agency’s workforce analysis and funding. The Period of Performance (PoP) for this effort is one base year plus 4 option years. The PoP start date will be the date of the contract award. The first course offering will begin within six months of the contract award (exact dates to be negotiated between TSA and Contractor). At least one program per year will be held in each subsequent year if the government elects to exercise an option of the IDIQ with exact dates to be negotiated between TSA and Contractor.

8. Security The Contractor shall comply with the administrative, physical, and technical security controls to ensure that TSA security requirements are met. All faculty members and staff shall be required to sign a non-disclosure agreement.

9. Staffing Requirements The Contractor (including staff and faculty) shall be experienced in instructional systems design, adult learning principles, and facilitation, especially in the fields of leadership development. See also paragraph 3.3.

10. Travel Reimbursement All travel required by the Government outside of a 50-mile local commuting area(s) from the Contractor’s site will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining the Contracting Officer’s Representative (COR) approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

The TSA COR must approve the Contractor’s travel requirements in advance. The Contractor’s contract manager/program manager or alternate shall submit the travel request no later than five days prior to travel to allow for review and approval by the COR To be considered for reimbursement, travel requests must contain:

11. Information Technology Acquisition Review (ITAR) Clauses *The following sections include TSA standard ITAR clauses and contain uniquely numbered paragraphs that are not in sequence with the previous sections of this SOW.

SECTION XII: Requirements for Handling Sensitive, Classified, and/or Proprietary Information

H.5200.224.004 SECURITY REQUIREMENTS FOR HANDLING PERSONALLY IDENTIFIABLE INFORMATION AND PRIVACY INCIDENT REPONSE (JULY 2017)

(a) Definitions.

“Breach” (may be used interchangeably with “Privacy Incident’) as used in this clause means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, in usable form whether physical or electronic.

“Personally Identifiable Information (PII)” as used in this clause means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States.

Examples of PII include: name, date of birth, mailing address, telephone number, Social Security Number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), Internet protocol addresses, biometric identifiers (e.g., fingerprints), photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Personally Identifiable Information (Sensitive PII)” as used in this clause is a subset of Personally Identifiable Information, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Complete social security numbers (SSN), alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered Sensitive PII even if they are not coupled with additional PII. Additional examples include any groupings of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

· driver’s license number, passport number, or truncated SSN (such as last 4 digits)

· date of birth (month, day, and year)

· citizenship or immigration status

· financial information such as account numbers or electronic funds transfer (EFT) information

· medical information

· system authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII, but it is not sensitive.

(b) Systems Access. Work to be performed under this contract requires the handling of Sensitive PII. The contractor shall provide the Government access to, and information regarding systems the contractor operates on behalf of the Government under this contract, when requested by the Government, as part of its responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent validation testing of controls, system penetration testing by the Government, Federal Information Security Management Act (FISMA) data reviews, and access by agency Inspectors General for its reviews.

(c) Systems Security. In performing its duties related to management, operation, and/or access of systems containing Sensitive PII under this contract, the contractor, its employees and subcontractors shall comply with applicable security requirements described in DHS Sensitive System Publication 4300A or any replacement publication and rules of conduct as described in TSA MD 3700.4

In addition, use of contractor-owned laptops or other media storage devices to process or store PII is prohibited under this contract until the contractor provides, and the contracting officer in coordination with CISO approves, written certification by the contractor that the following requirements are met:

(1) Laptops employ encryption using a NIST Federal Information Processing Standard (FIPS) 140-2 or successor approved product;

(2) The contractor has developed and implemented a process to ensure that security and other applications software are kept current;

(3) Mobile computing devices utilize anti-viral software and a host-based firewall mechanism;

(4) When no longer needed, all removable media and laptop hard drives shall be processed (i.e., sanitized, degaussed, or destroyed) in accordance with DHS security requirements.

(5) The contractor shall maintain an accurate inventory of devices used in the performance of this contract;

(6) Contractor employee annual training and rules of conduct/behavior shall be developed, conducted/issued, and acknowledged by employees in writing. Training and rules of conduct shall address at minimum:

(i) Authorized and official use

(ii) Prohibition against use of personally-owned equipment to process, access, or store Sensitive PII;

(iii) prohibition against access by unauthorized users and unauthorized use by authorized users; and

(iv) protection of Sensitive PII;

(7) All Sensitive PII obtained under this contract shall be removed from contractor-owned information technology assets upon termination or expiration of contractor work. Removal must be accomplished in accordance with DHS Sensitive System Publication 4300A, which the contracting officer will provide upon request. Certification of data removal will be performed by the contractor’s Project Manager and written notification confirming certification will be delivered to the contracting officer within 15 days of termination/expiration of contractor work.

(d) Data Security. Contractor shall limit access to the data covered by this clause to those employees and subcontractors who require the information in order to perform their official duties under this contract. The contractor, contractor employees, and subcontractors must physically secure Sensitive PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. When Sensitive PII is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed through means that will make the Sensitive PII irretrievable.

The contractor shall only use Sensitive PII obtained under this contract for purposes of the contract, and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall turn over all Sensitive PII obtained under the contract that is in its possession to the Government.

(e) Breach Response. The contractor agrees that in the event of any actual or suspected breach of Sensitive PII (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), it shall immediately, and in no event later than one hour of discovery, report the breach to the contracting officer, the Contracting Officer’s Technical Representative (COTR), and the TSA Director of Privacy Policy & Compliance (TSAprivacy@dhs.gov). The contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government parties.

(f) PII Notification Requirement. The contractor has in place procedures and the capability to promptly notify any individual whose Sensitive PII was, or is reasonably believed to have been, breached, as determined appropriate. The method and content of any notification by the contractor shall be coordinated with, and subject to the prior approval of the Government, based upon a risk-based analysis conducted by the Government in accordance with DHS Privacy Incident Handling Guidance. Notification shall not proceed unless the Government has determined that: (1) notification is appropriate; and (2) would not impede a law enforcement investigation or jeopardize national security.

Subject to Government analysis of the breach and the terms of its instructions to the contractor regarding any resulting breach notification, a method of notification may include letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by the Government. At minimum, a notification should include: (1) a brief description of how the breach occurred; (2) a description of the types of personal information involved in the breach; (3) a statement as to whether the information was encrypted or protected by other means; (4) steps an individual may take to protect themselves; (5) what the agency is doing, if anything, to investigate the breach, to mitigate losses, and to protect against any further breaches; and (6) point of contact information identifying who affected individuals may contact for further information.

In the event that a Sensitive PII breach occurs as a result of the violation of a term of this contract by the contractor or its employees, the contractor shall, as directed by the contracting officer and at no cost to the Government, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected individuals for a period not to exceed 12 months from discovery of the breach. Should the Government elect to provide and/or procure notification or identity protection services in response to a breach, the contractor will be responsible for reimbursing the Government for those expenses.

(g) Pass-Through of Security Requirements to Subcontractors. The contractor agrees to incorporate the substance of this clause, its terms and requirements, in all subcontracts under this contract, and to require written subcontractor acknowledgement of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the contractor.

DHS and TSA Enterprise Architecture:

a) The Contractor shall ensure that all architectural artifacts including but not limited to solutions, business, Data, IT elements for legacy Transportation Security Equipment (TSE), Information Systems Security Agreements (ISSAs), System Design documents (SDDs), deliverables, and services are aligned and compliant with the current DHS and TSA Enterprise Architecture, the Common Approach to Federal Enterprise Architecture, the Technology Business Management (TBM) Taxonomy, and Federal Information Technology Acquisition Reform Act (FITARA).

i. All solutions and services shall meet DHS and TSA Enterprise Architecture policies, standards, and procedures. Specifically:

a. DHS and TSA Enterprise Architecture policies, standards, and procedures.

b. Homeland Security Enterprise Architecture (HLS EA) and TSA EA requirements.

c. TSA and DHS IT Security, Cloud, Infrastructure (including Network), Application/Systems, Information/Data, Performance, and Business Architecture policies, directives, guidelines, standards, segment architectures, and reference architectures.

d. TSA functional capabilities

e. TSA operational capabilities

f. TSA lines of business

g. TSA business processes

h. TSA funding sources

i. TBM Taxonomy for IT cost transparency

ii. This includes new Transportation Security Equipment (TSE) and Legacy TSE that utilizes IT software, services, or equipment including embedded IT elements such as network switches, routers, printers, etc.

iii. All solutions shall implement and leverage TSA information and data standards as defined and approved per TSA policy.

iv. All solution architectures and services (e.g., Application, System, Network, Security, Information/Data, Cloud) shall be reviewed and approved by TSA EA as part of the TSA SELC (System Engineering Life Cycle) review process and in accordance with TSA IT Governance Management Directive 1400.20 with applicable DHS and TSA IT governance policies, directives, and processes. This includes the Solution Engineering Review (SER), Preliminary Design Review (PDR) and Critical Design Review (CDR) stage gates. The required design artifacts include solution approach document and System Design Document (SDDs) as directed by EAD, all implementations shall follow the approved solution architecture/design without deviation. Any changes, to either the prior approved solution and/or prior approved design that are identified during subsequent SELC phases, including testing, implementation and deployment, shall undergo additional EA review prior to proceeding.

v. TSA Offices acquiring Enterprise architecture type services at segment or solution levels shall engage and collaborate with the TSA Enterprise Architecture Division (EAD) to ensure strategic alignment of people, process, information, and technology and comply with enterprise level architecture governance, artifacts and standards.

a. The Contractor shall engage domain architect(s) in EAD before SELC Obtain Phase, i.e. during SELC Need or “Analyze and Select” Phase.

b. The Contractors shall collaborate with the EA domain architect(s) to deliver the required design artifacts and desired outcome under the guidance.

c. The Contractor shall provide architecture and system/application data and models in prescribed formats to be stored in TSA’s Enterprise Architecture Repository.

b) In accordance with the TSA Cloud Strategy 2.0, April 2019, TSA’s approach to cloud computing and governance of migration to the cloud, the contractor shall ensure that the cloud solutions utilize the SaaS (Software as a Service) model as its primary approach to cloud implementation, and also, when necessary will use Platform as a Service (PaaS) or Infrastructure as a Service (IaaS). The contractor shall adhere to the principles of cloud strategy to systematically retire or replace legacy applications by use of an integrated approach to cloud planning, architecture, hybrid deployment, and operation.

c) Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-21-07, November 2020) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

Information and Data Governance and Management

d) The Contractor shall develop, use, and dispose of TSA information and data assets following the TSA governance processes established by the Enterprise Information/Data Governance Board (EIDGB), in compliance with the DHS Enterprise Data Governance and Management MD (Management Directive) 103-01.

i. TSA information and data assets include but are not limited to the TSA Data Catalog, TSA information and data standards, TSA Data Management Plan, TSA data sets (including open data sets for public consumption), TSA information and data stored in TSA repositories, TSA information and data in systems and applications (internal and external), and TSA information exchanges.

ii. All TSA information and data, and all solutions that capture, store, use and provide TSA information and data shall comply with the Geospatial Data Act (GDA) of 2018 (P.L. 115-254) that requires agencies to foster efficient management of geospatial data/information, technologies, and infrastructure through enhanced coordination among Federal, state, local, and tribal governments, along with private sector and academia.

iii. Description information for all data assets shall be submitted to the TSA Enterprise Architecture Team, who will be responsible for coordination with DHS, and for review, approval and insertion into the TSA Data Reference Model and Enterprise Architecture Repository.

iv. In addition to the Federal Acquisitions Regulations (FAR) Subpart 27.4 – ‘Rights in Data and Copyrights’ and Section 35.011 detailing technical data delivery, the contractor shall provide all TSA-specific data in a format maintaining pre-existing referential integrity and data constraints, as well as data structures in a format understandable to TSA. Examples of data structures can be defined as, but not limited to:

a. Data models containing entities and attributes, identifying authoritative and trusted data sources, and depicting relationship mapping and, or linkages

b. Metadata information to define data definitions

c. Detailed data formats, type, and size

d. Delineations of the referential integrity (e.g., primary key/foreign key) of data schemas, structures, and or taxonomies

e. Information exchange specifications

v. All TSA-specific data shall be delivered in a secure and timely manner to TSA. Data security is defined within the ‘Requirements for Handling Sensitive, Classified, and/or Proprietary Information’, section of this SOW (Statement of Work), SOO (Statement of Objectives) and PWS (Performance Work Statement). This definition complies with not only the delivery of data, but also maintaining TSA-specific data within a non-TSA or DHS proprietary system.

vi. All metadata shall be pre-defined upon delivery to TSA. Metadata shall be delivered in a format that is readily interpretable by TSA (e.g., metadata shall be extracted from any metadata repository that is not utilized by TSA and delivered in a TSA approved manner). Metadata shall also provide an indication of historical version, the most current data to be used, as well as frequency of data refreshes.

vii. The contractor shall provide a Data Asset Repository Profile (DAR) and Data Management Plan (DMP) to EA using EA provided template before the preliminary/critical design review. The DAR and DMP include conceptual and logical data models, data dictionaries, data asset profile, and other artifacts pertinent to the project’s data.

TSA adheres to the DHS NIEM (National Information Exchange Model) First policy and standards outlined in the DHS Memorandum, “Adoption of the National Information Exchange Model within the Department of Homeland Security,” dated May 3, 2019. All TSA information and data exchanges shall be NIEM compliant. All TSA solutions that leverage TSA information and data exchanges shall be NIEM

Cybersecurity Policy for TSA Government Acquisitions

A. General Security Requirements:

A.1. All authorized, cleared and vetted personnel (i.e., federal employees; and primary, subcontractor, and/or 3rd party vendors or contractors supporting or doing business per agreement with TSA (either directly or indirectly) shall comply with applicable cybersecurity or information assurance (IA) policies as stated in the DHS 4300A Sensitive Systems Policy Directive, DHS 4300B National Security Systems (NSS) PD for classified systems, TSA MD 1400.3 Information Technology Security (ITS), TSA Information Assurance (IA) Handbook & supplemental Technical Standards (TSs) and Standard Operating Procedures (SOPs).

A.2. The Contractor shall comply with Federal, Department of Homeland Security (DHS) and Transportation Security Administration (TSA) security, sensitive information handling, and privacy guidelines in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

A.3. The Contractor shall perform periodic reviews to ensure compliance with cybersecurity, information security and privacy requirements.

A.4. The Contractor shall comply with proper DHS and TSA security controls to ensure that the Government's security requirements are met.