BLS_QPL_Announcement.pdf

Transportation Security Administration (TSA)

Bottle Liquid Scanner (BLS)

Qualified Products List (QPL)

70T04026QPL7672BLS001

Request for Certification Data Packages (CDP) or

Qualification Data Packages (QDP)

March 12, 2026

SECTION 1 – QPL OVERVIEW

1.0 Introduction

BLS systems are devices that are used by the Transportation Security Administration (TSA) throughout the United States (U.S.) and its territories to detect a wide range of hazardous and prohibited substances in liquids, aerosols, and gels that are contained in bottles and other sealed containers. Currently, there are two systems on the TSA BLS QPL with over 1,600 total systems in operation throughout more than 435 airports nationwide. TSA is opening the BLS QPL to add additional systems to the existing QPL, which will foster opportunity for greater competition on potential future procurements.

This announcement officially requests submissions from applicants to participate in the QPL process.

The Qualification Management Plan (QMP) is a supplemental document that defines the work necessary for QPL Applicants to have a proposed system on the TSA BLS QPL. The TSA requires any BLS systems used within the U.S. and its territories to be certified and qualified as defined in 49 U.S.C.§ 44913 and Revolutionary FAR Overhaul (RFO) Federal Acquisition Regulation (FAR) 9.202, respectively1. The TSA is subject to the World Trade Organization Government Procurement Agreement as defined in RFO FAR 25.003. As such, all BLS systems submitted under this QPL must be in accordance with the applicable Trade Agreements and/or Buy American Act (see Section 3.5 for additional terms and conditions). QPL Applicants interested in having a system qualified by TSA must successfully meet the requirements for each step in the BLS Qualification Process outlined in Section 2 below. TSA will require QPL Applicants to meet the following entrance criteria:

• Present systems that demonstrate capabilities based on the BLS Functional Requirements Document (FRD) v2.95 (January 2026) which is aligned with Detection Standard (DS) 2.3 (July 19, 2012) as threshold capabilities.

• Although BLS systems will not initially connect to the TSA Network, BLS systems must adhere to applicable Information Technology (IT) security requirements and meet select Security Technology Integrated Program (STIP) compatibility requirements (e.g., resources and protocols) as defined in the BLS FRD v2.95 (January 2026).

1.1 Establishment of the BLS Qualification Process

This Announcement establishes a new opportunity to participate in the Qualification Process for BLSs in accordance with the requirements of RFO FAR 9.202. The Qualification Process is the means by which products are obtained from the QPL Applicant, and their product’s performance is evaluated against TSA requirements. Only those QPL Applicants that successfully meet the requirements are invited to have their products added to the TSA BLS QPL. A qualification process is essential to ensure that TSA is buying a proven technology prior to making a significant investment.

Successful qualification and placement on the BLS QPL does not guarantee a contract award for BLS, and TSA has no further obligation to a qualified QPL Applicant. Once qualified, procurement decisions will be made as appropriate requirements arise. BLS awards may be made via competition

1 In this document, citations to Revolutionary FAR Overhaul (RFO) Part 6, RFO Part 9 and RFO Part 25 are citations specifically to Federal Acquisition Regulation (FAR) Class Deviation 25-11 for Part 6, FAR Class Deviation 25-27 R2 for FAR Part 9 and FAR Class Deviation 26-09 for FAR Part 25 Revision 1, which were issued as part of the RFO, which was implemented in response to Executive Order 14275, Restoring Common Sense to Federal Procurement, signed April 15, 2025, and will be cited as “RFO FAR” for brevity.

Similarly, Revolutionary FAR Overhaul contract clauses are inserted under the authority of the prescription with the related FAR Part’s Deviation.

or sole source justification, depending on TSA’s requirements and business practices.

TSA has no limitations concerning who may submit as a QPL Applicant in the BLS Qualification Process (e.g., the QPL Applicant does not need to be the Original Equipment Manufacturer (OEM)).

Vendors with qualified TSA BLS systems from previous QPL(s) must submit a formal request to the TSA to be considered for grandfathering onto this QPL. The formal request must be in writing with supporting Certification Letters and Qualification notices to Mike Willette at michael.willette@tsa.dhs.gov no later than thirty (30) days after this QPL is announced.

QPL Applicants begin the QPL process at Step 3 Certification Data Package (CDP) unless the proposed system already has a TSA Certification Letter. The TSA Certification Letter will allow the QPL Applicant to enter at Step 5, QDP Submission. The QPL Applicant must provide a TSA Certification Letter with the QDP submission to enter at Step 5.

TSA funding for the QPL Qualification process is limited to the first three (3) QPL Applicants with an approved and accepted QDP.

Table 1 below, titled “Qualification Process”, provides an overview of the steps in the Qualification Process. The Qualification Process steps are also described in the BLS QMP.

Table 1. Qualification Process2

Step 1.

Announce Qualified Product List

Step 2.

Release the Qualification Management Plan

Step 3.

Certification Data Package Submission

Step 4.

System Testing

Step 5.

Qualification Data Package Submission

Step 6. Integration / Implementation

Step 7.

Initial Operational Test and Evaluation

Step 8.

Component Acquisition Executive Approval and Add Technology to QPL

Step 4a.

Vendor System

Step 6a.

Qualification Testing

Step 6b.

Cooperative Vulnerability Penetration Assessment

Step 4b.

Certification

1.2 Period of Performance

The BLS QPL will remain open until it is closed by TSA. Department of Homeland Security (DHS) Agencies/Components reserve the right to utilize the list of qualified QPL Applicants to issue their own contracts.

1.3 Bailments

QPL Applicants with an approved CDP (or QDP if the Applicant has already successfully completed Certification (CERT)) shall enter into a no-cost bailment agreement with TSA that will address the responsibilities and liabilities of the parties for the equipment while in the custody of the TSA during the Qualification Process. The QPL Contracting Officer (CO) will provide a no-cost Government bailment agreement to the QPL Applicant for review and signature upon CDP/QDP approval. QPL Applicants will continue to be responsible for meeting all steps of the qualification process outlined in this QPL Announcement. TSA will require at least six (6) production representative systems throughout the qualification process regardless of which step the QPL Applicant starts at. The QPL

2 Vendors may begin at Step 3 or Step 5 as discussed in Section 1.1 “Establishment of the BLS Qualification Process.”

Applicant will be required to move the systems as required for each testing activity:

• Three (3) systems will be needed for CERT.

• An additional three (3) systems will be needed for Qualification testing (QT).

• Of the six (6) systems mentioned above, four (4) will be used for future field testing after CERT and QT are completed; one (1) system will remain at the Transportation Security Laboratory (TSL), and one (1) system will remain at the TSA System Integration Facility (TSIF) throughout the Qualification Process.

SECTION 2 – QPL QUALIFICATION PROCESS

2.0 Qualification Process

The intention of the Qualification Process is to test and qualify systems to TSA standards, verify an executable manufacturing process, ensure operational supportability with particular attention to minimizing the logistics footprint, implement Human Systems Integration (HSI), ensure affordability, and demonstrate system interoperability, safety and utility.

Any QPL Applicant interested in having a system qualified under the BLS Qualification Process must successfully meet both the requirements and the timeline for each step in the BLS Qualification Process outlined in this announcement and as detailed in the BLS QMP.

Systems submitted under the BLS QPL are required to pass multiple levels of testing and receive approval by the TSA. Therefore, all BLS systems proposed by the respective QPL Applicant to meet the identified requirements under the BLS QPL will be required to pass all steps of the Qualification Process. If any of the deadlines in this document are missed, the system will be removed from consideration.

The table below outlines the milestones associated with the qualification process. Details regarding submission requirements are outlined in the sections below, BLS QPL Process Milestones

Activity Due Dates ("Days" refers to calendar days) Submission Instructions Note

QPL Applicants submit questions related to this

QPL

No Later Than (NLT) 20 days after SAM.gov posting

Submit questions to:

Jessica.seay@tsa.dhs.gov and

BLS@tsa.dhs.gov with Subject “BLS QPL Questions”.

QPL Applicant submits a one-page BLS system overview and requests access to Sensitive Security Information (SSI) / Classified Documents

NLT 45 days after SAM.gov posting

See Sections 2.2.1, 2.2.2, and 2.2.3

Limited to 10 employees from each QPL Applicant

Request for Grandfathering

NLT 30 days after SAM.gov posting

Submit BLS TSA Certification Letter and TSA Qualification

Letter to michael.willette@tsa.dhs.gov with Subject “Request for BLS Grandfathering” mailto:Jessica.seay@tsa.dhs.gov mailto:michael.willette@tsa.dhs.gov

CDP Submission Within 120 days from

SAM.gov posting (if not already certified)

Mail two thumb drives.

One in care of Jagdeep Talwar to:

FAA/Frank A. LoBiondo

Technical Center Transportation Security Laboratory, Bldg. 315

Atlantic City International Airport

Atlantic City, NJ 08405

And

One in care of Elaine Jappinga to:

TSIF/TSA Mail Stop 6015

3701 Post Office Rd Arlington, VA 20598–6015

CDP Resubmission 30 days from notification of CDP not being accepted

Same as CDP Submission

A single CDP may be submitted three (3) times, including the initial submission

Bailment Agreement for CERT, QT and IOT&E Systems

TBD To be provided by QPL CO for review and signature

QDP Submission

30 days after passing CERT if not previously certified

Mail one thumb drive in care of Elaine Jappinga to:

3701 Post Office Rd Arlington, VA 20598–6015

Within 180 days from SAM.gov posting (if already certified)

QDP Resubmission 30 days from notification of QDP not being accepted

Same as QDP Submission

A single QDP may be submitted three (3) times, including the initial submission

2.1 Step 1: Announce BLS QPL

The TSA is posting this notice on the System for Award Management (SAM.gov) to initiate the BLS Qualification Process.

To be considered under this Announcement, QPL Applicants must adhere to the Qualification Process Steps outlined in this document and in all supplemental documents. Supplemental documents will be provided separately to those QPL Applicants authorized to obtain access to these documents as outlined in Section 2.2.

2.2 Step 2: Release Requirements Documents

To participate in the BLS Qualification process, QPL Applicants may need access to the below Classified, Sensitive Security Information (SSI), and Unclassified documents. These documents are limited to BLS QPL Applicants. QPL Applicants will be granted access to these documents only after vetting has been completed. However, if a vendor is currently on the BLS QPL and already has these documents, access to these documents does not need to be requested.

• BLS QMP – Unclassified. The QMP will provide the following information:

• Instructions for CDP submission

• Instructions for QDP submission

• CDP Evaluation Process Overview

• QDP Evaluation Process Overview

• Overview for the Qualification Process

• Acquisition Program Management (APM) Configuration Management Plan (CMP) (Rev E) and Office Security Capabilities (OSC) Configuration Management Guidance Version 2, June 30, 2015 - Unclassified

• DHS/STD/TSL-08/06 Management Plan for Bottle Liquid Scanner Qualification Test and Evaluation, April 23, 2008 - SSI

• BLS Functional Requirements Document (FRD) v2.95 – SSI

• BLS Memo.AD-6.2-6.3 Modification_SSI_FINAL_02.22.2021_CAE signed – SSI

• BLS Detection Standard 2.3, Tier II – Classified

• BLS Threat Alignment Group (TAG) /Liquid Explosive Detections Systems (LEDS) Detection

Requirements, v1.0, January 14, 2025 – Classified

• TSA Bulk Resolution Tool (BRT) Detection Functional Requirements, v.8.1a, October 17, 2024, Level 1 - Classified

Due to the sensitivity of this information, these documents cannot be posted to SAM.gov. To access Classified documents, QPL Applicants must have a Facility Clearance Level (FCL), also known as an industrial security facility clearance. In addition, an administrative determination by the Defense Security Service (DSS) is necessary indicating that a QPL Applicant’s facility is eligible for access to classified information of a certain category and all lower categories. Department of Defense (DD) Form 254 applies to the cleared facility. See below Section 2.2.2 for instructions. To access SSI, QPL Applicants must obtain TSA authorization. The process to gain access to SSI is provided in Section

2.2.1 below.

QPL Applicant Vetting is anticipated to take approximately three (3) weeks (additional time is required for vetting Foreign Nationals). TSA requests vetting submissions to be limited to no more than 10 employees per QPL Applicant. QPL Applicants are required to submit their SSI vetting request to review the applicable requirements documents no later than 45 days after the SAM.gov posting. Another opportunity to request authorization to access these documents will not be offered during this QPL Application Process. QPL Applicants may add or remove a total of two (2) people from the SSI approval list anytime throughout the Qualification Process. However, any requests for individuals to be added must first be approved by the CO prior to initiation, and these individuals will be required to be vetted in accordance with the process stated within this announcement.

2.2.1 Request for SSI

A. As part of the qualification process, TSA may allow QPL Applicants access to SSI. SSI is information that, if publicly released, would be detrimental to transportation security, as defined by Federal Regulation 49 C.F.R. Part 1520. SSI may be available to QPL Applicants in preparing responses to this announcement. Potential applicants must obtain specific authorization in order to obtain SSI. SSI will not be available, provided or disclosed to any person not specifically authorized to receive it. SSI provided under this solicitation may only be used to satisfy acquisition requirements.

B. TSA will review the System for Award Management (SAM) to ensure that the corporate entity would not otherwise be precluded from receiving a potential future contract award. While this review does not replace the responsibility determination required by RFO FAR part 9, it may prohibit QPL Applicants from receiving SSI during the qualification process.

C. As part of this process, SSI may only be accessed by individuals who have successfully passed a Security Threat Assessment. This assessment may include a verification of site facility clearance in the National Industrial Security Program (NISP), contractor suitability determination or other federal background investigation, individual security clearance(s), and, if required, a criminal history records check (CHRC) and/or a check against terrorism databases.

D. QPL Applicant Responsibilities.

1. Senior Official (SO). Each company needing access to SSI under this announcement must separately identify in writing to the Contracting Officer3 a single, corporate official who will serve as the single point of contact for the sensitive information. The SO must attest that: all appropriate protections will be followed; only authorized individuals will have access to the sensitive information; and that those individuals provided access to the SSI adequately understand their responsibilities to protect the information. The SO must also attest to the Contracting Officer every 60 days that all appropriate protections have been followed, only authorized individuals have access to the sensitive information, and that those individuals with access adequately understand their responsibilities to protect the information. A copy of each attestation shall also be emailed to RFP.Access@tsa.dhs.gov and include the applicable solicitation number. The SO shall also ensure that the Contracting Officer is notified of staffing changes or circumstances in which any individual previously authorized access to Sensitive Compartmented Information (SCI) under this announcement no longer needs that access.

2. Information Requirements. The SO must provide the following information via email to RFP.Access@tsa.dhs.gov with a Courtesy Copy (cc) to the Contracting Officer:

a. The Commercial and Government Entity (CAGE) code of the QPL Applicant’s facility that will manage the proposal, company Unique Entity Identifier (UEI), and corporate address; and

b. In a single password protected Microsoft Excel spreadsheet emailed to the Contracting Officer, with the password for the password protected spreadsheet sent separately but at the same time:

• Employee Full Name

• Employee Birth Date

• Employee Citizenship

• Indication of whether each nominated employee has:

o Previously received a TSA suitability determination; or o Undergone a federal background investigation; or, o An individual Federal Government security clearance.

c. While not required in the original information provided by the SO, in rare instances an

3 All references to the Contracting Officer refer to Jessica Seay and all submissions shall be provided via email to Jessica.seay@tsa.dhs.gov.

mailto:RFP.Access@tsa.dhs.gov mailto:RFP.Access@tsa.dhs.gov individual’s Social Security Number may be required. In those instances, the SO will receive an email from RFP.Access@tsa.dhs.gov requesting the Social Security Number for the select individual(s) and the SO must provide the requested information back to RFP.Access@tsa.dhs.gov in a password protected document using the same password previously provided.

3. Non-Disclosure Agreements. Each QPL Applicant employee requesting access to SSI as specified herein will be required to execute a TSA Non-Disclosure Agreement, entitled

“TERMS AND CONDITIONS FOR ACCESS TO SENSITIVE SECURITY

INFORMATION NON-DISCLOSURE AGREEMENT (TSA Form 2815). The executed forms shall be provided with and as part of the submission of information reflected in Paragraph 2 above. The QPL Applicant should understand that employees granted access to SSI and signing a non-disclosure agreement are bound by the terms of that agreement indefinitely, notwithstanding their employment status or any other background checks or clearances granted by any Government agency. Additionally, submission of the Non- Disclosure Form (TSA Form 2815) in the pre-award phase is not a substitute for such a requirement for submission of the Non-Disclosure Form post-award using the DHS Form 11000-6.

4. Return of SSI. Any SSI provided for purposes of this solicitation must be returned to the

Government or destroyed, and that return or destruction verified by the Government.

Electronic records containing SSI shall be properly destroyed by the QPL Applicant using any method that will preclude recognition or reconstruction, and attestation of destruction shall be provided to the Contracting Officer. For QPL applicants, any SSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

E. Privacy Act Statement. TSA will use the information provided to conduct a security threat assessment of individuals who seek access to SSI. The information will be shared within the Government with personnel who need the information to perform their official duties. Additionally, the Government may share the information with law enforcement, intelligence, or other government agencies as necessary to identify and respond to potential or actual threats to transportation security in accordance with the routine uses identified in the applicable Privacy Act System Of Records Notice (SORN), DHS/TSA 002, Transportation Security Threat Assessment System (T-STAS). This SORN was last published in the Federal Register on August 11, 2014, and can be found at 79 FR 46862- 46866. Authority: 49 USC § 114. Furnishing this information is voluntary. However, failure to furnish the requested information may delay or prevent the completion of an individual’s security threat assessment, without which that person may not be granted access to SSI.

F. Notification of Assessment. Individuals who receive a successful Security Threat Assessment (STA) will be eligible to receive SSI. If it is determined that covered individuals are not eligible to receive access to particular SSI based on the STA, TSA will provide notification to the company point of contact that the individual does not qualify to receive SSI. In the event that an individual is denied access to SSI and believes that the results of the STA are inaccurate, he or she may appeal that determination and petition to have erroneous information corrected with the Transportation Security Redress Branch. However, due to the demanding qualification schedule, TSA will not delay the qualification process to resolve redress issues. Therefore, while an individual may appeal the threat assessment determination, that appeal may not be resolved in time for this qualification process. As an alternative, however, the potential QPL Applicant may nominate another individual to receive SSI access.

mailto:RFP.Access@tsa.dhs.gov mailto:RFP.Access@tsa.dhs.gov https://www.dhs.gov/publication/access-sensitive-security-information-contract-solicitations-ssi https://www.dhs.gov/publication/access-sensitive-security-information-contract-solicitations-ssi https://www.dhs.gov/publication/access-sensitive-security-information-contract-solicitations-ssi

2.2.2 Request for Classified National Security Information (CNSI) o Under this announcement, the QPL Applicant may access classified material at the TSA headquarters and/or at a QPL Applicant’s facility.

o Only QPL Applicants who possess a valid Personnel (Security) Clearance (PCL) will be authorized to discuss or read classified materials at TSA headquarters only.

o Only QPL Applicants who possess a valid Facility (Security) Clearance (FCL) and PCL will be authorized to receive and store CNSI at their facility in order to develop a QDP.

o To access Classified National Security Information (CNSI) a QPL Applicant must have an approved DD Form 254 for each company that will participate in the Qualification Process.

If an existing approved DD Form 254 specific to the TSA is not available, a DD Form 254 approval request must be submitted within 30 days of this posting.

o Information Requirements. The Senior Corporate Officials shall provide the following information via email to the CO (note that this requirement applies likewise to any prospective subcontractor, joint venture partner, or “team” company whose access to the specified CSNI is necessary):

*QPL Applicant Name *QPL Applicant CAGE Code *QPL Applicant Facility Security Officer’s Name *QPL Applicant Facility Security Officers Phone Number *QPL Applicant Facility Security Officer’s Email *Request to access classified material at the TSA headquarters and / or at a QPL Applicant’s facility. This shall include the applicable address(es).

o Issuance of a DD Form 254 is anticipated to take approximately six (6) weeks (additional time for Foreign Nationals). Once the DD Form 254 is approved, the Senior Corporate Official will receive notification of approval and the applicable requirement documents will be provided to the QPL Applicant point of contact.

o The DD Form 254 must be approved for each QPL Applicant before CNSI is available or otherwise provided or disclosed to any QPL Applicant.

o The QPL Applicant shall store and safeguard classified material in accordance with Executive Order 13526, Classified National Security Information, and its Implementing Directive 32 CFR Part 2001 at the SECRET level in support of program office requirements. Additionally, in accordance with the Department of Defense (DOD) Manual 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM) for Safeguarding Classified Information,” Chapter 5, Section 5-502, the QPL Applicant is authorized to disclose TSA classified information to cleared agents when access is necessary to perform tasks or services related to the Qualification Process. In accordance with the NISPOM, Chapter 5, Section 5-506, the QPL Applicant shall not disclose classified information received or generated under this TSA Qualification Process to any other Federal agency unless specifically authorized in writing by the TSA Program Office that has classification management jurisdiction over the information and the TSA point of contact Michael Willette (Michael.Willette@tsa.dhs.gov). In accordance with the NISPOM, Chapter 5, Section 5-509, the QPL Applicant shall not disclose classified information to an agent except to support the Qualification Process or for another TSA purpose.

o Any future contract awards to QPL Applicants added to the BLS QPL will be subject to RFO FAR Clause 52.204-2 to the extent the contract involves access to information classified as “Secret.”

o For QPL applicants, any CNSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

2.2.3 QPL Applicant Prerequisite

QPL Applicants will be granted access to these documents only after vetting has been completed and after TSA has confirmed that the QPL Applicant is a BLS manufacturer and/or a third party BLS manufacturer.

Each QPL Applicant must submit a short summary of the company’s background including any relevant BLS products and other pertinent information. The total page count for this Product List and Summary shall not exceed one (1) page. This shall be submitted to Michael.Willette@tsa.dhs.gov no later than 45 days after the QPL announcement.

2.3 Certification Process

CERT is the formal test that is administered to all candidate systems under the strictest controls possible. QPL Applicants must submit a CDP to be considered for CERT. CERT includes evaluating the detection rates of defined threats in the TSA DS via direct deposit sampling and swabs of test surfaces. Instructions for completing CDP requirements are provided in the QMP and the Certification Management Plan. Testing will be conducted at the TSL against the requirements set forth in the applicable DS. The results from this testing inform the TSA Program Office whether the equipment has met all of the detection performance requirements in the relevant TSA DS. Successful completion of this testing results in a TSA Certification Memorandum which identifies the approved system configuration. After completion of CERT, the QPL Applicant system configuration is established based on those components that may affect detection performance and include, but is not limited to, system hardware, software, and algorithms. No system modifications will be allowed after the completion of CERT without written approval from the Government.

2.3.1: Step 3: Certification Data Package (CDP) Submission

To start, the QPL Applicant shall generate a CDP for submission into the TSA Qualification process.

The CDP shall be submitted within 120 days of the QPL opening. The QPL Applicant must submit two (2) copies of the CDP on two (2), separate thumb drives. One thumb drive should be mailed to each of locations below (two total submissions):

one in care of Jagdeep Talwar to:

FAA/Frank A. LoBiondo Technical Center Transportation Security Laboratory, Bldg. 315 Atlantic City International Airport Atlantic City, NJ 08405 and one in care of Elaine Jappinga, to:

TSIF/TSA Mail Stop 6015 3701 Post Office Rd Arlington, VA 20598–6015

Please send an email with the tracking number to BLS@tsa.dhs.gov with Subject “BLS QPL CDP Submission – Vendor and System Name” to notify TSA you have mailed the CDP thumb drives, and TSA will notify the QPL Applicant once they have been received.

The TSA will evaluate CDPs as noted within the QMP. If the QPL Applicant’s initial CDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within 30 calendar days of when they were informed the CDP was not accepted. The QPL Applicant may resubmit their CDP a maximum of two (2) additional times. The formal acceptance or rejection of the CDP will be provided via email by BLS@tsa.dhs.gov.

Upon approval of the CDP, the QPL Applicant will be required to enter into a bailment agreement as discussed in Section 1.3 above, which will require the delivery and installation of the first three (3) systems to the TSL within 10 business days of execution.

If a QPL Applicant’s system has already passed CERT, they should begin at Step 5 “QDP Submission.”

2.3.2 Step 4: System Testing and Certification Testing

System Testing and CERT are described in the subsections below.

2.3.3 Step 4a: System Testing

System Testing is testing conducted by the QPL Applicant to verify that their system meets technical requirements defined in the QMP. This testing event will determine the maturity of the system design to meet the TSA requirements and will be used to determine system readiness. This testing will be performed at the QPL Applicant’s facilities and/or a third-party test organization’s facility at the QPL Applicant’s cost.

The QPL Applicant shall conduct internal system testing in accordance with the QPL Applicant’s System Test Plans and Procedures and Appendix B of the BLS QMP BLS QPL Applicant Required Substantiation for the Requirements. The QPL Applicant shall procure or fabricate any special test articles and instrumentation for such tests. The QPL Applicant is responsible for contacting, communicating expectations, and acquiring results or reporting documentation for any third-party testing utilized during the System Testing phase. The QPL Applicant must verify that any third-party testers utilized are reputable and industry leaders in the field of verification.

It is the QPL Applicant’s responsibility to ensure the testing adequately verifies the requirement and that the data and documentation provided by the third-party tester is thorough and complete.

2.3.4 Step 4b: Certification Testing

During CERT, the QPL Applicant shall submit three (3) proposed systems for testing at the TSL via the aforementioned bailment and may be called upon for technical and maintenance support, as required. However, the QPL Applicant will not be permitted in the immediate test area unless requested by the TSL Test Director.

All systems seeking qualification under the BLS QPL Window will be required to undergo and pass CERT against the identified BLS Detection Standard. The QPL Applicant must meet all detection requirements in order to pass CERT. If a QPL Applicant’s system fails the detection requirement, the QPL Applicant must resubmit for CERT at a future time as coordinated with the TSL.

Each QPL Applicant will be allowed a maximum of two (2) attempts at CERT once their respective data package has been accepted. A CERT Failure is defined as the presence of deficiencies that warrant correction, as determined by TSA, prior to proceeding to the next phase of the QPL.

Upon successful completion of CERT, the TSA will provide the QPL Applicant with a Certification Letter that identifies the system baseline and level of certification that is achieved.

The systems shall have the same configurations with respect to components that could affect detection performance, including system hardware and software after the completion of CERT. No system modifications will be allowed after the completion of CERT without written approval from TSA.

2.4 Step 5: Qualification Data Package Submission

The QPL Applicant shall generate a QDP for submission into the TSA Qualification process. The QDP shall be submitted within 30 days of notification the system has passed CERT or within 180 days of the QPL opening if the system is already TSA Certified. It shall be submitted on a thumb drive and mailed to:

C/O Elaine Jappinga

3701 Post Office Rd Arlington, VA 20598–6015

Please send an email with the tracking number to BLS@tsa.dhs.gov with Subject “BLS QPL QDP Submission – Vendor and System Name” to notify TSA you have mailed the QDP thumb drive and TSA will notify the QPL Applicant once it has been received.

The TSA will evaluate QDPs as noted within the QMP. If the QPL Applicant’s initial QDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within 30 calendar days of when they were informed the QDP was not accepted. The QPL Applicant may resubmit their QDP a maximum of two (2) additional times. The formal acceptance or rejection of the QDP will be provided via email by BLS@tsa.dhs.gov.

If accepted by TSA, the QPL Applicant’s system will continue into Step 6a: QT and Step 6b:

Cooperative Vulnerability Penetration Assessment (CVPA). The QPL Applicant must be prepared to install the testing systems at TSIF within 10 business days of acceptance notification as stipulated in the aforementioned bailment. If the QPL Applicant is starting at this step, they will need to execute a bailment agreement as outlined in section 1.3, then be prepared to deliver and install one (1) system at TSL and three (3) systems to the TSIF within 10 business days of bailment execution.

In the QDP, the QPL Applicant shall provide all test data and results to TSA for performance evaluation and to assist in the QDP acceptance decision. The QPL Applicant shall document any major issues experienced during System Testing and document any system modifications which could impact previously completed, ongoing, or upcoming test events. TSA will review System Test results as part of reviewing and accepting the QDP.

The QPL Applicant’s QDP must contain the required information as outlined in the QMP and be presented in a manner that is clear, concise and unambiguous. QPL Applicants must use proprietary and SSI markings according to standard marking procedures. SSI must be handled according to the requirements of 49 Part 1520. TSA has instituted procedures to safeguard proprietary data that are used during the BLS QDP evaluation. The QDP will become a part of the official records of compliance testing for each system submitted.

The level of substantiation that needs to be submitted for each requirement is outlined in the BLS QMP. Complete identification of the systems used to collect the substantiation data must be provided in the QDP and match the system being proposed for TSA testing. This includes:

a) Model number(s) of equipment tested.

b) Serial number(s) of equipment tested.

c) Software version(s), including reconstruction and inspection software components.

d) Firmware version(s), if applicable.

e) An inventory of hardware Configuration Items (CIs), software CIs, and firmware CIs with configuration identification as instructed through the Master Configuration Item List (MCIL) section.

f) Identification of all configurable and adjustable parameters and adaptation data used to tailor the system, as well as their settings and values. Adaptation data refers to variables used to configure or adjust the system to specific environments or uses. Unless required by the tests, all tests shall be conducted with the same parameter and adaptation settings. If changes to calibration settings or variable parameters are required, these must be clearly indicated along with an explanation for the changes.

g) Provide the United States equivalent if substantiation calls out European standards.

The QDP shall contain System Requirements, Architecture Documentation, Cybersecurity Documentation, a Life Cycle Support Concept, MCIL, cybersecurity information of the QPL Applicant development/test environment, the system’s technical manuals, maintenance manuals and operator manuals, and additional configuration management documentation, as detailed in the QMP.

As a clarification, the cyber testing scope (CVPA) will assume an adversary with physical access to all BLS systems with varying access to system software. Though cybersecurity information of the QPL Applicant development/test environment is requested, the TSA Test and Evaluation (T&E) scope will not consist of cyber testing in the QPL Applicant facility. The QDP shall also contain the Test Reports from QPL Applicant System Testing as verification of system readiness to proceed into QT.

The system configuration, inclusive of software and algorithms, described in the QDP must match the system configuration that was certified by TSA. The TSA will evaluate QDPs as noted within the QMP. If changes are made to the system after QDP acceptance and QT testing starts, the QPL Applicant will submit a Developmental Engineering Proposal (DEP). The QPL Applicant may submit up to two (2) DEPs per QT attempt. QT testing will not begin until TSA funding has been approved, and TSA funding is limited to the first three (3) QPL Applicants QDPs accepted for QT. TSA will not accept any additional QPL Applicant QDPs after the first three (3) QDPs have been accepted by TSA.

The QDP will be evaluated by the Government for thoroughness and adequacy based on the requirements outlined in the QMP to enter QT. Once approved, the QDP is the design basis in which the system baseline is established by the Physical Configuration Audit (PCA) for the remainder of the Qualification Process.

2.5 Step 6: Implementation Testing

The goal of Step 6 is to ensure the system meets requirements specified in the BLS FRD Version 2.95, January 2026, is ready to proceed into Initial Operation Test and Evaluation (IOT&E), and will not pose any operational, safety, or security risks. During Step 6, the Government shall execute testing against requirements, assigned by the QT Test Director and System Evaluator, as a verification test source. Testing for Step 6 will be tailored to these requirements and all efforts will be made to evaluate each System Under Test (SUT) in an identical manner.

2.5.1 Step 6a: Qualification Testing

QT is conducted by the TSA at the TSIF to assess system performance against functional requirements in a laboratory environment.

The QPL Applicant will not be permitted to witness QT. However, the QPL Applicant may be called upon for test team training, on-site technical support, cyber security verification activities (e.g., questions on security controls) and maintenance, or troubleshooting of system malfunctions, as required.

Except for Field Data Reporting System (FDRS) and log files, the QPL Applicant shall not conduct data recording (logging) of test events or test objects. All image files, FDRS and log files generated during QT will be the property of the Government or will be purged from the system upon completion of the tests by the Government. The QPL Applicant will not be permitted to wipe any data from test equipment without the explicit approval of Elaine Jappinga, in writing, during a maintenance visit or at completion of QT.

Each QPL Applicant will only be allowed one (1) attempt at QT once their respective data package has been accepted. A second attempt may be possible if TSA funding is available, and if TSA has not yet already accepted three (3) QDPs.

Installation of the three test (3) systems at the TSIF is inclusive of non-scanner related accessories to support checkpoint operations (e.g., consumables). After installation is complete, the QPL Applicants must provide their signed Test Readiness Notification (TRN) to TSA to begin QT. TRNs shall be sent to TSA via email at BLS@tsa.dhs.gov with the Subject: “BLS QPL TRN TSIF – Vendor and System Name,” whereupon TSA will confirm receipt.

All prospective QPL Applicant systems must successfully complete QT to continue the Qualification Process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. To determine successful completion, in accordance with the QMP, the TSIF Test Branch will produce a QT Report after test completion, after which the TSA will make a determination if the system has successfully passed the tests. The next steps in the process will also be provided and may include termination, deficiency investigation, correction or continuation through the Qualification Process. TSA reserves the right to deny or terminate the qualification process for systems that do not successfully pass QT.

2.5.1.1 Qualification Testing Failures

QT Failure is defined as the presence of deficiencies that warrant correction prior to proceeding to the next phase of the QPL. The TSIF Test Branch will track and document all SUT failures, malfunctions and/or anomalies encountered during QT. The TSIF Test Branch will review observed issues that affect testing activities and will coordinate with the QPL Applicant for resolution of any required corrective actions for critical failures.

QT will be suspended if the SUT malfunctions or has a critical failure that impedes the progress of testing and cannot be repaired or replaced within five (5) calendar days of QPL Applicant notification or a time frame specified by TSA. Repeated critical failures, or a critical failure that remains unresolved, may also result in suspension or termination of testing if the overall QT schedule is negatively impacted. If it is determined at any time during QT that the SUT fails to meet requirements to a degree that prevents the system from proceeding to IOT&E, testing may be suspended or terminated, and the QPL Applicant will be notified by TSA.

TSA may perform a CERT re-test or regression test following a repair or replacement of parts, or after any hardware/software modification if modifications to the system are determined to have an impact on the detection capability.

The Government reserves the right to remove any QPL Applicant from QT and require third party substantiation of QPL Applicant fixes if TSA determines the Transportation Security Equipment (TSE) has significant issues that will prevent passing QT or IOT&E.

2.5.2 Step 6b: Cooperative Vulnerability Penetration Assessment

The CVPA consists of the TSA cyber team scanning the Applicant’s BLS to identify any cybersecurity vulnerabilities associated with the Operating System (OS). They will also conduct a limited manual penetration assessment that will look at the ports and other attack surfaces (physical access), to try to break into the OS via the Graphical User Interface (GUI); and overall determine if there are any vulnerabilities associated with physical access to the system. There will be additional data needed, such as administrative credentials to access root OS, and TSA will work directly with the Applicant to gather the information at this stage.

2.6 Step 7: Conduct Initial Operational Test and Evaluation

After notification of successfully passing QT, the QPL Applicant must successfully complete the shipment and installation of four (4) BLS test systems (two (2) units from TSL and two (2) units from TSIF) to the first selected field site for IOT&E as stipulated in a modification to the aforementioned bailment agreement. Delivery and installation must be completed within 10 business days of TSA notification of which field site will be used. QPL Applicants will be notified via email by TSA of all the finalized field test locations after TSA completes the QDP review and approval process. QPL Applicants should be prepared for up to four (4) testing sites at any airport throughout the 50 states.

The testing schedule will be arranged with each QPL Applicant as they reach this step. Schedules will need to be adjusted based on airport need and any testing blackout periods. All QPL Applicants will be tested at the same airports and for the same number of testing days. Installation of these systems is inclusive of accessories to support screening operations (i.e., consumables to run 750 tests, per machine, per site).

QPL Applicants must provide their signed TRN to begin Field Testing. TRNs shall be sent via email to TSA at BLS@tsa.dhs.gov with the Subject: “BLS QPL TRN XXX (airport code) – Vendor and System Name,” whereupon TSA will confirm receipt. All prospective QPL Applicants must successfully complete IOT&E to continue the qualification process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. In accordance with the QMP and after Field Test completion, TSA will make a determination if the system has met all of the field test objectives successfully to ensure the system under test is installed, integrated, and ready to proceed to IOT&E. TSA reserves the right to deny or terminate the Qualification Process for systems that do not successfully pass the Field Test.

2.6.1 Initial Operational Test & Evaluation Failure

In the event the proposed system does not pass testing or is suspended, the system will be removed from the Government test site(s).

2.6.2 Initial Operational Test & Evaluation Reporting

All QPL Applicant systems must successfully complete IOT&E. After IOT&E, and in accordance with the QMP, the TSA will make a determination if the system has successfully met the IOT&E objectives by reviewing the System Evaluation Report (SER) generated by the System Evaluator post IOT&E that will document operational effectiveness, suitability, and resilience and will identify any deficiencies. The System Evaluator will submit the SER to TSA.

The TSA will review the SER and may or may not share details with the QPL Applicant. The QPL Applicant will be notified of test results after the conclusion of the IOT&E reporting period. The TSA will also advise the QPL Applicant of required next steps in the process, which may include termination and/or deficiency investigation/correction.

2.7 Step 8: Placement on the QPL

In accordance with the QMP, systems will be placed on the QPL post successful IOT&E with a satisfactory finding and approval from the CAE. Once a system is added to the QPL, it is considered “Qualified”, and TSA will provide the QPL Applicant with a Qualification Letter.

TSA and other Components within DHS may issue Requests for Proposals (RFPs) for BLS requirements in accordance with RFO FAR Part 6. However, the system proposed must be on the BLS QPL in accordance with RFO FAR 52.209-1 Qualification Requirements.

3.0 Applicable QPL Clauses

Applicable QPL Clauses for Handling Classified, SSI and Controlled Unclassified information are included in the following subsections.

3.1 Additional TSA Security Terms

A. Clearance Level. The BLS Qualification Process requires security clearance at the Secret level.

B. Access to Classified Information. QPL Applicant personnel are required to have access to classified information at the Secret level.

C. Place of Performance. The location of performance where classified information will be accessed, produced, safeguarded, or stored is as identified below:

SSI and Classified information provided via the process noted in Section 2. Document Release Requirements and accessed at QPL Applicant’s facility.

If required, the QPL Applicant will store and safeguard classified material in accordance with DHS Instruction 121-01-011 Department of Security Administrative Security and Executive Order 13526, Classified National Security Information, at the SECRET level in support of program office requirements. Additionally, in accordance with the Department of Defense (DOD) Manual 5220.22- M, “National Industrial Security Program Operating Manual (NISPOM) for Safeguarding Classified Information,” Chapter 5, Section 5-502, the QPL Applicant is authorized to disclose TSA classified information to cleared subcontractors when access is necessary to perform tasks or services for fulfillment of a prime or subcontract. However, prior written approval by the contracting officer or his/her designee is required. Additionally, pursuant to NISPOM, Chapter 5, Section 5-506, the QPL Applicant shall not disclose classified information received or generated under this TSA qualification process to any other Federal agency unless specifically authorized in writing by the TSA Program Office that has classification management jurisdiction over the information and the TSA COR. In accordance with the NISPOM, Chapter 5, Section 5-509, the QPL Applicant shall not disclose classified information to another entity except to support this qualification process or for any other TSA purpose. The QPL Applicant must first obtain written approval from the Contracting Officer or his/her designee before it exercises any actions authorized by NISPOM Chapter 5, Sections 5-502, 5- 506, and 5-509.

(End of Term)

3.2 NOTIFICATION TO QPL APPLICANTS OF TSA CONTRACTOR ACCESS TO

PROPOSAL

QPL Applicants are advised that employees of the firms identified below may have access to CDPs/QDPs submitted under this QPL process. Individuals from these firms will be authorized access to only those portions of CDP/QDP data and discussions that are necessary to enable them to perform their respective duties. Such firms are expressly prohibited from competing on any subsequent BLS acquisitions. Pursuant to RFO FAR 9.505-4, these firms must also execute an agreement with each QPL Applicant that states that they will: (1) protect the QPL Applicant’s information from unauthorized use or disclosure for as long as it remains proprietary, and (2) refrain from using the information for any purpose other than that for which it was furnished.

Information may be provided for each QPL Window to the firms listed below.

• Firm #1: SAIC, 12010 Sunset Hills Rd., Reston, VA 20190, (703) 676-4300

• Firm #2: Acquired Data Solutions, 11900 Parklawn Drive, Suite 205, Rockville, MD 20852,

(301) 984-4193

• Firm #3: Black Diamond Consulting,…