CBP NII CIP RFP 70B04C25R00000011 STATEMENT OF WORK.pdf

Statement of Work (SOW)

U.S. Customs and Border Protection

Non-Intrusive Inspection

Common Integration Platform (CIP)

Table of Contents

1. BACKGROUND

1.1 Non-Intrusive Inspection (NII) Program

2. SCOPE

3. APPLICABLE DOCUMENTS

3.1 Critical Compliance Requirements

4.0 REQUIREMENTS

4.1 Common Integration Platform (CIP)

4.2 Common Viewer (CV)

4.3 Technical, Management Support Services

4.4 Management and Training Services

4.5 Program Management and Solution Integration Requirements

4.5.1 Program Management, Systems Engineering Support, and Documentation

4.5.2 Program Management Plan

4.5.3 Management Services

4.5.4 Contractor Staff Training

4.5.5 Collaboration with other CBP, DHS, Other Government Agencies, and commercial organizations including Contractors

4.5.6 Physical and Data Security Requirements

4.5.7 Software Code Maintenance

4.5.8 Change Management

5.0 DELIVERABLES AND DELIVERY SCHEDULE

6.0 GOVERNMENT FURNISHED EQUIPMENT AND INFORMATION

7.0 PLACE OF PERFORMANCE

8.0 PERIOD OF PERFORMANCE

See solicitation

8.1 Hours of Operation

9.0 SECURITY REQUIREMENTS

9.1 Handling Personally Identifiable Information (PII)

9.2 Other Security Requirements

11.0 SPECIAL CONSIDERATIONS

11.1 Government Points of Contact

11.2 Inspection and Acceptance

11.3 Travel

11.4 CBP Requirements

11.4.1 DHS Enterprise Architecture Compliance

11.4.2 Personal Identifiable Information (PII)

1. BACKGROUND

U.S. Customs and Border Protection (CBP) is a large and complex component of the Department of Homeland Security (DHS). The mission of CBP is to safeguard America’s borders, thereby protecting the public from dangerous people and materials while enhancing the nation’s global economic competitiveness by enabling legitimate trade and travel.

CBP’s 2021-2026 Strategy has three (3) overarching goals broken into twelve (12) strategic initiatives that guide its priorities and investments. The Non-Intrusive Inspection Common Integration Platform (NII CIP) contract will provide critical technical capability that directly aligns to multiple CBP strategic initiatives by implementing and maintaining the NII CIP with Common Viewer (CV) capability to:

Enhance data sharing between CBP Non-Intrusive Inspection (NII) systems and CBP Information Technology (IT) infrastructure; and

Provide CBP with a more comprehensive and integrated dataset to improve border security, and operational efficiency.

1.1 Non-Intrusive Inspection (NII) Program

The NII Program is organized within the CBP Office of Field Operations (OFO). The program develops, acquires, deploys, operates and maintains a wide variety of non-intrusive technology detection systems which support operations in all CBP operational vectors. NII systems such as vehicle X-ray, radiation portal monitors (RPM), and chemical detectors provide a more efficient and effective means to screen conveyances and individuals for contraband and threats as compared to manual search techniques.

The NII Program is composed of an NII Division (NIID) business office headed by the NII Division Director / Lead Business Authority, an NII Acquisition Program Management Office (PMO) headed by the NII Acquisition Program Manager (APM) and an Integrated Logistics Division (ILD) organized within Enterprise Infrastructure and Operations Directorate (EIOD) of the Office of Information and Technology (OIT).

The NII Division has a number of distinct business facets, which include 1) Large Scale (LS) NII X-ray imaging systems, 2) Small Scale (SS) NII imaging, handheld devices & scanners, 3) NII Integration, 4) Radiation Detection Equipment (RDE) including RPMs and other devices, 5) NII Training, and 6) NII Business and Requirements. Each of these NIID product teams are stakeholders in the implementation of a commercial-off-the-shelf (COTS) common integration platform (CIP) and sustainment services.

The NII – Integration Program (NII-I) is working to recapitalize and expand coverage of NII scanning technology with modern COTS systems capable of addressing emerging threats and enhancing operational efficiencies. A key goal of this program is to reduce the current NII examination processing time to: (1) increase the number of cargo conveyances, vehicles and individuals examined to improve security, and (2) reduce the number of officer/agent hours used to conduct NII examinations – achieving both goals without impact to the flow of legitimate commerce/travel. These objectives directly align with national priorities to secure the nation’s borders, particularly in the privately owned vehicle (POV) passenger and commercial owned vehicle (COV) truck cargo environments at land border ports of entry (LPOE). These environments represent the primary modes of smuggling for transnational criminal organizations bringing illicit drugs into the United States.

CBP procures and is actively deploying Multi-Energy Portal (MEP), Low Energy Portal (LEP) and High Energy Rail (HE-Rail) X-ray systems via indefinite delivery indefinite quantity (IDIQ) contracts to LPOE and United States Border Patrol (USBP) checkpoints along the southwest border of the United States. (See Attachment 3) CBP also has additional legacy fixed and mobile large-scale NII currently deployed at a variety of ports of entry (POE) and USBP checkpoints. CBP anticipates that as additional funding becomes available, future MEP and LEP awards will expand deployments along the southern and northern land borders, as well as to seaports. As these deployments proceed, the NII-I Program will work to integrate these scanning systems with the CBP IT infrastructure via a CIP and standardized interfaces, to transport NII data from POEs and checkpoints via CBP network infrastructure to the CBP Amazon Web Services (AWS) Cloud. This in turn will support broader integration of NII system data with other CBP law enforcement applications and other CBP technology program solutions. This integration will blend multiple NII systems from different locations into command center operations to consolidate information and staffing to increase inspection effectiveness, decrease POV and COV wait times and facilitate legitimate trade and travel.

2. SCOPE

This Statement of Work (SOW) identifies the requirements necessary to enable the NII Program to acquire COTS CIP/CV software solution licenses and sustainment services that will:

Enable closure of NII system integration gaps, allowing data from different OEM Contractors’ X-ray systems to be sent to CBP NII-I infrastructure where it can be further processed and stored;

Facilitate NII system integration across a wide range of NII systems, while supporting implementation of a variety of innovative concepts of operation (CONOP) to improve operational efficiencies;

Provide Common Viewer capability, to be used by CBP officers to adjudicate X-ray imagery in support of NII scanning at current and future MEP and LEP deployment locations (Attachment 3 – NII MEP and LEP System Site Deployments);

Allow the secure and efficient transfer, storage, analysis, sharing and productive use of large quantities of NII data in accordance with DHS and CBP policies; and

Support operational and maintenance process automation and enable a variety of operational improvements.

3. APPLICABLE DOCUMENTS

The following documents represent CBP, DHS, and other Government agency requirements, policies, and guidance, to which the delivery of system and solution support services must adhere. Many of these documents are not public but they will be made available to all Contractors.

List of Attachments:

Attachment 1 - NII Functional Requirements Document Attachment 2 - NII MEP and LEP System Site Deployments Attachment 3 - Acronym List

List of other applicable documents and industry standards which will be made available to industry bidders via a CBP secure virtual reading room.

NII Technology Demonstrations NII Integration Requirements Version r9+4 LBI ICD Version 5.x NII Sweeper ICD Version 1.1.1 World Customs Organization Unified File Format (UFF) Version 2.0 CBP OIT 2021 Strategic Plan DHS Directive 102-01 DHS Directive 102-01-001 CBP Security Policies and Procedures Handbook CBP Program Lifecycle Process Guide, HB5225- 08 CBP OIT Agile Governance Framework DHS Systems Engineering Life Cycle (SELC), 102-01-103-01 DHS Agile Development and Delivery for IT, DHS102-01-004 CBP Acquisition Management Directive, 5220-041A DHS Instruction Cybersecurity through the ALF, DHS102-01-012 DHS Test and Evaluation Instruction, DHS026-06-001 CBP Technical Review Guide version 3 CBP Acquisition Logistics Supportability and Sustainment, HB5227-07 DHS SELC process CBP SecDevOps Concept of Operations (CONOPS) (draft) Office of Accessible Systems and Technology (OAST) Compliance CBP Section 508 Directive Number 5510-040A DHS MD 4300A, DHS Sensitive Systems Policy and Handbook, CBP Information

Systems DHS Management Directive 140-01, Information Technology Security Program CBP Information Systems Security Policies and Procedures Handbook, HB 1400-05D All applicable National Institute of Standards and Technology (NIST) Special

Publications (800 Series) DHS Enterprise Data Management Policy Directive 103-01 CBP Technical Reference Model (TRM) CBP Enterprise Technical Architecture (ETA) CBP Directive, Infrastructure Services Division Product Testing Federal Data Center Consolidation Initiative FDCCI

BEMSD OIT Change Control Board Instructions BEMSD Change Request Form Template Facilities Standard for Public Building Service PBS-100 U.S. Land Port of Entry Design Guide Supplement 40 CFR (all parts) Code of Federal Regulations, Protection of the Environment Executive Order 12144 Environmental Effects Abroad of Major Federal Actions Council on Environmental Quality (CEQ) regulations National Environmental Policy Act (NEPA) National Electric Code (NEC), Facilities Standard for Public Building Service (PBS-

IOO)

National Information Exchange Model (NIEM) Business Process Modeling Notation

ISO/IEC 11801:2002 2ND ED. 2002-09

ISO 18000-6c GEN 2

IEC 61156-5, -6

ANSI/NIST-ITL 1-2001 Biometric Data Format ANSI/TIA/EIA-568-B Cabling Standards

This listing is not intended to relieve the Contractor of its responsibility to identify and comply with any other current effective applicable regulations and procedures.

3.1 Critical Compliance Requirements

The Contractor shall comply with the following critical compliance requirements,

• Accessibility - Section 508 of the Rehabilitation Act requires federal Government departments and agencies to ensure all Electronic Information and Technology (EIT) is accessible to people with disabilities. The Contractor shall ensure all tasks to design, develop, deploy, operate, and maintain NII CIP equipment or systems and the systems themselves comply with Section 508 requirements.

• IT Security Requirements – Ensuring confidentiality, integrity, availability, and authenticity of sensitive data within the DHS IT infrastructure and operations is a foundational element of the CBP mission. The Contractor shall ensure that all tasks to design, develop, deploy, operate, and maintain NII CIP equipment or systems and the systems themselves are in compliance with DHS-4300. The contractor shall implement multi-factor authentication (Homeland Security Presidential Directive-12, HSPD-12) for network and endpoint device access and ensure that all NII CIP equipment configurations follow DISA STIGs as required by DHS.

• Interconnection Security Agreements (ISA) – are required by DHS policy to establish individual and organizational security responsibilities for the protection and handling of unclassified information. An ISA must be in place to allow connectivity between CBP systems and external participating Government agencies and non-Government entities via the CBP network. The Contractor shall ensure all required ISAs are in compliance with DHS 4300, and NIST Special Publications SP 800-47 and SP 800-53.

• Systems Engineering Life Cycle - The DHS SELC is a technical framework that enables consistent management and supports the efficient and effective delivery of capabilities to end-users. The Contractor shall ensure that all tasks to design, develop, deploy, operate, and maintain NII CIP equipment or systems conform to the requirements of DHS Directive 102-01. The contractor shall adapt all CBP OIT Agile methodologies to comply with DHS SELC requirements, and draft requisite program and technical documentation for all NII CIP projects per NII CIP and SELC requirements.

• CBP Enterprise Architecture – The Contractor shall ensure that all tasks to design, develop, deploy, operate and maintain NII CIP equipment or systems conform to the DHS/CBP Enterprise Architecture (EA), Technical Reference Models (TRM) and other DHS and CBP policies and guidelines including the CBP Information Technology Enterprise Principles and the DHS Service Oriented Architecture - Technical Framework.

• DHS Geospatial Information Systems – The DHS/CBP Geospatial Vision is to achieve a comprehensive geospatial environment that unifies and supports all mission and business operations with a cohesive approach that includes common operating standards and governance. All geospatial implementations shall comply with the policies and requirements set forth for the DHS Geospatial Information Infrastructure (GII). This includes submission to the Enterprise Architecture Board, or their designee, for review and approval of insertion of hardware, software, services, appliances, and/or structural metadata into the Homeland Security Enterprise Architecture HLS EA.

• Ensure that all software developed for the NII CIP Program be digitally signed, compiled, and source controlled in CBP’s DevOps (DOIT) environment and/or CBP Amazon Web Services Cloud East (CACE) environment for Cloud hosted solutions.

• CBP business shall be conducted on the CBP network using CBP issued desktop or laptop computers, and CBP email. All data captured and applications developed under the NII CIP contract shall be stored securely on CBP equipment.

• Change Management – The contractor shall follow and comply with all CBP OIT Change Management processes and procedures to implement software and hardware changes to production systems and applications. (Refer to clauses in Section H.5.1)

4.0 REQUIREMENTS

Under the NII CIP contract, the Contractor shall furnish, implement and sustain two major solution components - the Common Integration Platform (CIP) and the Common Viewer (CV) capability. See Attachment 1 for additional requirements.

4.1 Common Integration Platform (CIP)

The Contractor shall provide a CIP solution which facilitates data aggregation and transfer to/from CBP NII imaging systems at the edge with existing CBP IT enterprise infrastructure and law enforcement applications, utilizing formats defined by CBP Interface Control Documents (ICDs) written to Unified File Format standards.

The following elements are to be integrated by the CIP solution:

X-Ray Imaging: All data elements outlined in applicable CBP ICDs, including high-resolution imaging, material analysis, and geometric data, will be integrated into the data sharing solution. This encompasses both operational data and technical specifications.

Ancillary systems such as traffic control / management and other sensors such as RFID, QR and LPR readers.

Radiation Portal Monitor (RPM): All data elements outlined in applicable CBP ICDs, including radiation levels and signature analysis, vehicle and cargo identification, and operational effectiveness data, will be integrated. This also covers isotope identification, material classification, and safety compliance data.

Health Monitoring: All data elements outlined in applicable CBP ICDs, including system health and maintenance data, safety measures, performance metrics, maintenance data, and environmental monitoring data, will be integrated. The Contactor’s CIP solution will transmit near-real time health status of OEM equipment for monitoring and situational awareness. This enables predictive maintenance capabilities and improved system reliability.

User Data: All data elements outlined in applicable CBP ICDs, adhering to strict privacy regulations and data security best practices, will be shared. This includes personal identification, access control information, operational activity logs, training records, and feedback mechanisms. All data will be anonymized or pseudonymized where appropriate to protect user privacy.

Networking: This encompasses secure communication protocols, data integration methods, real-time data exchange capabilities, security measures, and disaster recovery planning. Integration will include seamless interoperability with existing CBP systems (e.g., PRIDE, Land Border Integration).

4.2 Common Viewer (CV)

The Contractor shall provide a CV solution that will be a web-based application hosted in CBP’s cloud infrastructure, allowing CBP analysts to view and adjudicate X-ray images in near-real time as they are scanned by any of the OEM machines. The CV will allow for the overlay or display of annotations and anomaly detections by third-party (CBP GOTS and other-vendor COTS) AI models hosted and maintained in the CBP cloud environment. The CV will provide tools for officer annotations of the X-ray images, and adjudication thereof. The notes, annotations, drawings and adjudications will then be made available to be saved within CBP’s NII-I platform and shared with downstream systems (ACE TruckMod, Simplified Arrival-Veh).

The CIP and CV shall allow for full integration with the CBP’s NII-I infrastructure, sending X-ray and associated data to CBP-maintained Kafka and Google Cloud Storage (GCS) or S3 stores, and producing and consuming AI annotations and officer adjudications to/from the same.

4.3 Technical, Management Support Services

Upon contract award the Contractor shall have the capability and resources to provide engineering and technical services to support the investigation and documentation of requirements, system design, development, integration, deployment and sustainment of new NII integrated technical solutions which enhance the enforcement and facilitation capabilities of CBP. Central to this task is the need to communicate and coordinate with NII system / equipment Contractors, plus other CBP program and OIT representatives to jointly create technical solutions to address NII Program operational requirements. The Contractor’s work scope shall at a minimum include the following:

Provide a Commercial Off the Shelf (COTS) cloud-based software platform designed specifically for integrating non-intrusive inspection (NII) large scale vehicle X-ray systems, while supporting overall solution development, deployment and maintenance of open architected, standard-based technology solutions for the NII Program.

Document and manage all CIP-related functional and technical integration requirements.

Prepare and maintain software, hardware and interface control specifications for all new CIP-related system integration designs, and alterations to such designs, with NII OEM systems based on UFF and/or other agreed standard.

Upon request support the development, documentation, implementation, and maintenance of specifications governing interfaces between the CIP and systems owned by OIT, including other CBP program’s POE and/or AWS cloud-fielded systems and applications.

Support the development, implementation and monitoring of performance SLAs in concert with NII OEMs, CBP OIT and other CBP technical programs to establish performance requirements for the NII system interface to the CIP and from CIP to other CBP systems & applications.

Provide an assessment of CBP-deployed, NII OEM system analyst applications for image analyst functionality, tools and system data types / formats to ensure OEM system capabilities are fully captured and implemented by the CIP common viewer.

Provide recommendation to and support CBP participation in technical working groups associated with the World Customs Organization (WCO) enhancement of the UFF.

Support the assessment of CBP POE site LAN and WAN bandwidth availability in coordination with CBP OIT Network Architecture and Engineering Division (NAED) and Field Support and make design recommendation for CBP internet connection point (ICP) circuit, bandwidth, wireless and LAN upgrades consistent with the overall CIP on-prem / CBP AWS cloud-based deployment plan.

Plan, participate and assist in System Requirements Reviews, Preliminary Design Reviews, Critical Design Reviews and other required Systems Engineering Life Cycle (SELC) gate reviews related to CIP integration with NII and other OIT systems.

Support development, deployment, and evaluation of NII TD projects & related CIP integration scope, and their transition to production systems.

Comply with CBP/DHS OIT software development requirements and processes, including use of Agile methodologies and Atlassian software such as Jira, for all software developed to integrate the deployed equipment / solutions.

Maintain a single current version of all software and firmware in the OIT approved repository and manage the implementation of new software and firmware release versions to ensure consistency and operability across all deployed systems.

Perform timely code maintenance of all software and firmware for maintenance upgrades, equipment upgrades, repairing corrupt files, OEM manufacturer upgrades, defective code patches, and any approved technology refresh.

Comply with and support CBP OIT operational and security processes & practice including but not limited to engineering change management, configuration control, system access control, security (Nessus) vulnerability scans, anti-virus & malware protection, and periodic / urgent security patching.

Remediate all system and network component vulnerabilities within 30 days of discovery and documented in a plan of action and milestones (POAM) if unresolvable within 30 days.

Provide cybersecurity expertise to assist the NII Program in establishing and maintaining CIP compliance with applicable DHS and CBP IT security regulations and ensure the integrity, availability and authenticity of NII system data.

Support the generation, coordination and adjudication of an Interconnection Security Agreement (ISA) prior to establishing communications and sharing CBP-NII data with external entities outside of CBP-DHS.

Support the generation and coordination of the Technical Reference Model (TRM) insertion, ATT, ATO, Privacy Threshold Analysis (PTA), and Privacy Impact Assessment (PIA) processes & document requirements.

Support the development and implementation of a plan to proactively analyze NII integrated system performance data and existing system configurations to then implement improvements to continually meet or exceed performance service level standards and execute periodic technical refresh objectives.

Support the development integration testing objectives and document test case plans for verification of intended system performance including edge test cases covering potential failure conditions and variations to the intended concept of operation.

Support POE deployment and site acceptance test of integrated systems solutions in concert with the NII OEM, other CBP programs, OIT and NII Program representatives.

Support development of a standard, configurable and scalable command center design and support establishment of POE or regional command center facilities in coordination with NII OEM-awarded command center work scope.

4.4 Management and Training Services

Upon contract award, the Contractor shall have the capability and resources to provide management services in support of multiple, simultaneous NII integration projects. The NII Program has its own acquisition PMO and MEP/LEP IDIQ contract task orders in place and will generally acquire, deploy, and maintain major NII systems / equipment from various OEMs independent of this contract. NII Program will supply such systems as Government furnished equipment (GFE) to the overall program integration efforts.

For NII project related tasks the contractor shall at a minimum:

Establish and maintain collaborative working relationships and communications with NII Program-designated NII OEMs including AS&E-Rapiscan (MEP and LEP), Leidos (MEP and LEP), Smiths (MEP) and Astrophysics (LEP), other CBP programs (LBI, BSDP), and OIT Directorates and Offices (Border Enforcement Management Systems Directorate (BEMSD), Enterprise Infrastructure and Operations Directorate (EIOD), Cyber Security Directorate (CSD), Field Support Directorate (FSD), Passenger Systems

Program Directorate (PSPD), Cargo Systems Program Directorate (CSPD), Infrastructure Cloud Services) staff to execute integration tasks and projects.

Participate and assist in NII project planning and control, requirements confirmation, risk assessment, scheduling, status update meetings, milestone/exit gate reviews, and action items in coordination with MEP and LEP OEM Contractors and NII Program stakeholders.

Establish and maintain configuration management of integrated NII systems CIP integration solution components delivered by the Contractor, in coordination with ILD, the NII PMO, OIT and other stakeholders.

Support development of required documentation and participate in CBP OIT Change Management procedures including attending the Change Control Board (CCB) for NII Program change requests (CR).

Provide corrective and preventative maintenance services for CIP solution components delivered by the Contractor and not otherwise covered by other NII PMO contracts and task orders. Support root cause analysis corrective action development for integration failures with OEM NII equipment.

Provide OIT facing dashboard for solution performance and health monitoring of operations and maintenance.

Provide CIP common viewer training services to local POE and field office staff performing NII image analysis including provision of train the trainer curriculum.

4.5 Program Management and Solution Integration Requirements

To enable the implementation and sustainment of the CIP and CV, the Contractor shall provide professional services as described in the following subparagraphs.

4.5.1 Program Management, Systems Engineering Support, and Documentation

The Contractor shall provide Project and Security Management services, engineering support, and project documentation development for activities associated with all aspects of the program including Operation and Maintenance and solution design and deployment requirements.

4.5.1.1 Performance Objectives

The Contractor shall comply with DHS/CBP systems engineering life cycle (SELC) Handbook, DHS Directive 102-01, to structure its project management and SELC services to provide accurate and timely technical, logistics, schedule, and performance information throughout the life cycle of the program.

The Contractor shall:

Provide all the required documentation for all systems in engineering and development, and operations and sustainment, to ensure that the SELC process is fully adhered to; expedite transition to production-ready systems, including documentation of all functional and technical requirements.

Participate and assist in the SELC project planning, program control, risk assessment, scheduling, environmental readiness, meetings and milestone/exit gate reviews, action items, and requirements management tasks.

Plan, provide, participate, and assist in System Requirements Reviews, Preliminary Design Reviews, and Critical Design Reviews chaired by the Government.

Support the preparation of software, hardware, and interface specifications for all new system designs and alterations to such designs.

Support and participate in CBP OIT Change Management procedures, including the Change Control Board (CCB), and develop all required documentation.

Deploy software systems to operate and maintain newly deployed systems.

Support the development of a Test and Acceptance Plan to evaluate system performance for all the operational area systems, as deployed.

Comply with the use of adaptive Agile methodologies.

Support effective collaboration with other CBP, DHS, other Government Agencies, and commercial organizations including other contractors.

Comply with and align to the CBP Technical Reference Model (TRM), which maps and aligns to the DHS TRM.

Support the implementation of a plan to proactively analyze performance data and implement performance improvements, to meet, or exceed, performance service-level standards.

4.5.1.2 Work Plans for New Projects

For each new site deployment, the Contractor shall provide a Work Plan that addresses resources, project schedule, design, communications, and reports, integration, and test and acceptance.

4.5.1.3 Project Plans for Existing Ongoing or Deployed Projects

For each existing or ongoing projects, the Contractor shall update the Project Plan, which addresses resources, project schedule, design, communications, and reports, installation services, integration, and test and acceptance.

4.5.2 Program Management Plan

The Contractor shall provide a Program Management Plan and Master Schedule to include a work breakdown structure (WBS) as a contract deliverable post-award.

4.5.3 Management Services

The Contractor’s management plan shall provide the necessary resources to meet or exceed these requirements. As part of management services, the Contractor shall provide the following plans and documentation:

4.5.3.1 Configuration Management Plan

The Contractor will be responsible for supporting the master configuration file(s) describing, software versions, workflows, up/down status and scheduled maintenance.

The plan shall document the Contractor’s Standard Operating Procedures (SOP) for corrective and/preventative maintenance system downtime (e.g., bug fixes, system patches, security reviews).

The plan shall ensure all Contractor practices are conducted in accordance with CBP OIT policies and procedures.

4.5.3.2 Risk Management Plan

The Contractor shall be responsible for risk management of the NII CIP systems and projects and shall implement a proactive Risk Management Plan (RMP) that assesses, tracks, and reports potential risks and issues, while simultaneously allowing for control and project wide visibility.

4.5.3.3 Close-out Plan

When directed by the contracting officer (CO), the Contractor shall submit a Close-Out Plan for contract completion task areas. The requirements for the plan will be detailed in CO’s tasking document. Incumbent personnel shall remain on site and perform all duties during transition at the end of this contract period.

4.5.3.4 Performance Plan and Monthly Reports

The Contractor shall develop a Performance Plan and Monthly Performance Reports that establishes appropriate, effective performance measures and quality assurance program, to ensure the Contractor’s delivered services meet the Program goals and objectives.

4.5.3.5 Operator’s/FTO Training Manual

The Contractor shall develop, provide, and maintain an Operators/FTO Training Manual for each specific existing and newly developed systems, which contains an overview of the system, step-by-step procedures for all normal and emergency procedures, including identifying minor maintenance actions and adjustments, and recommend procedures for each adjustment. The Operators/FTO Training Manual will be used by, and limited to, the following stakeholders:

Operators – CBP Agents and Officers FTO – OIT Field Technology Officer Support Staff – CBP SITROOM personnel and duty officers Data Center – CBP OIT personal NII PMO – Program Office Technical and Deployment Personnel

The Contractor shall provide updates, as required, to appropriate related sections in all Operators/FTO Training Manuals for any new installations or changes that are due to Contractor or OEM related maintenance issues.

The Contractor shall ensure the Operator/FTO Training Manuals identify and provide recommended procedures for the upkeep of system components.

The Contractor shall, if required, support the Technical Integration Division, provide training to all stakeholders in the proper use of refreshed, or newly deployed, systems. Training can be conducted onsite or virtually, as needed.

All Operators/FTO Training Manuals, including updates, will belong to the Government, and will be approved by the COR for completeness, and upon acceptance, will be stored in the System Library prior to use and within ten (10) business days of COR acceptance.

4.5.3.6 IT Security Compliance

The Contractor will be responsible for ensuring that the Contractor’s team complies with contract security requirements and sensitive information protection policies, including ensuring that all personnel have the appropriate level of clearances.

The Contractor shall digitally sign all software code deployed as part of the contract.

4.5.3.7 Status Reports and Meetings

The Contractor will provide regular communication of project status through monthly status reports and every other week status meetings between the team, the COR, the CBP Government leads, and any other stakeholders, as identified by the Government.

The Contractor shall provide the Contracting Office and the COR with a monthly report for each objective, providing an overview of work accomplished the previous period and work scheduled for the upcoming week. This report shall contain the following information, at a minimum, as follows:

Planned activities and desired results for the next reporting, with milestones and deliverables.

Issues and risks affecting technical or schedule elements of the contract, including background, impact, and recommendations for resolution.

Results related to previously identified problem areas, with conclusions and recommendations.

Team organizational chart.

Monthly update call protocols in event of system issues, as well as name/e-mails/phone numbers applicable to parties involved (Prime/Sub/Government).

The contractor shall submit the monthly status report via email and save it to the established CBP status reporting repository.

4.5.4 Contractor Staff Training

All Contractor personnel are required to complete the DHS/CBP mandatory online training courses by the mandatory due date(s). The Contractor is responsible for maintaining records of contracting employees that have completed the mandatory training and provide semimonthly updates to the COR on the 1st and 15th day of each month, or the next business day if the 1st or 15th is a holiday or falls on a weekend. The Contractor is also responsible for providing copies of the training certificates to the COR, when requested.

4.5.5 Collaboration with other CBP, DHS, Other Government Agencies, and commercial organizations including Contractors

OIT requires a collaborative environment where the Contractor effectively works with other CBP, DHS, other Government Agencies, and commercial organizations including other contractors. CBP’s mission achievement is dependent on effective collaboration by many internal and external organizations. OIT is committed to CBP’s “One OIT” goal as described in the CBP OIT 2018 Strategic Plan with the objective of operating as a single transparent organization with a unified mission focused culture. A highly collaborative environment will foster the sharing of information, resources, best practices, and opportunities to streamline processes across all of OIT. OIT requires a Contractor committed to the “One OIT” mindset.

4.5.5.1 Task Requirements

The Contractor shall ensure that they collaborate on all interdependent objectives with other CBP, DHS, other Government Agencies, and commercial organizations including other contractors to ensure that tasks are completed without any duplication of work effort. As a starting point, interdependencies shall be defined at integrated project team meetings or in the interface control documents developed for each task/project.

4.5.6 Physical and Data Security Requirements

The contractor/vendor shall be responsible for implementing and maintaining Information Technology (IT) physical and data security requirements, measures, and controls in accordance with DHS 4300A, HB-1400-05D, NIST SP 800-53 R4, and NIST SP 800-171 R2, such that protection encompasses both physical security and cybersecurity requirements for CBP systems and data to prevent unauthorized access, exposure, or compromise. Maintaining increased security requirements and oversight on contracts that include information technology where contractor / vendor access to physical and digital CBP data, including sensitive PII, is required.

4.5.7 Software Code Maintenance

The Contractor shall be responsible for maintenance of all available middleware, software, and firmware running on all NII CIP systems at CBP field sites. The Contractor shall maintain a single current version of the software and firmware on all systems in the OIT approved repository and manage the implementation of new software and firmware release versions, to ensure consistency and operability across all systems. Additional tasks shall include timely code maintenance of all software and firmware for maintenance upgrades, equipment upgrades, repairing corrupt files, manufacturer upgrades, defect code patches, and any approved technology refresh. The contractor shall adhere to all changes and updates made to software versions and middleware.

Additionally, the Contractor shall digitally sign the updated version of all applications developed for NII CIP (software code) and store the most recent version of the final code in CBP’s GitLab within ten (10) business days.

4.5.8 Change Management

The Contractor shall support and participate in Change Management procedures, including the OIT CCB. Any changes to in-service systems shall be subject to OIT CCB review and approval.

5.0 DELIVERABLES AND DELIVERY SCHEDULE

Table 5-1 NOTE: Where this document refers to “days,” this means calendar days.

Table 5-1 Deliverables & Delivery Schedule

Description of Deliverable

SOW

Reference Recurring Non-Recurring

Project Orientation and Kick- Off meeting N/A 5 days after award, based on direction by the CO and COR

Compliance Report 3.1 Updated as required 45 days after award Project Management and SELC Documentation 4.5.1 Updated as required As Required Project Plan for New Projects and Ongoing Projects

4.5.1.3 As required per Project Upon project initiation

Security Clearance and CBP BI Packages 4.5.3.6 Updated as required Following kick off after award Configuration Management Plan 4.5.3.1 Updated as required 90 days after award Risk Management Plan 4.5.3.2 monthly 90 days after award

Close-out Transition Plan 4.5.3.3 Updated as required As directed by the CO 180 days prior to the end of the final period of performance

Performance Plan and Monthly Performance Reports

4.5.3.4 By the 15th of each month

Initial plan, 60 days after award

Operator’s/FTO Training Manual 4.5.3.5 N/A 30 days before first site implementation

Status Reports and Meetings 4.5.3.7 Updated as required Monthly status reports Biweekly status meetings

Contract Staff Training Requirements 4.5.4 Updated as required As required. To be reported by the 1st and 15th day of each month.

Ad Hoc Reports As required In accordance with the approved delivery schedule

N/A

6.0 GOVERNMENT FURNISHED EQUIPMENT AND INFORMATION

The Government shall provide to the Contractor portable devices, such as Smart phones or other personal digital assistants (PDA), to designated staff, as required in the performance of their contract duties. DHS/CBP will provide the Contractor with CBP laptop computers or tablets, as required to access the CBP network and perform maintenance of deployed systems.

7.0 PLACE OF PERFORMANCE

The place of performance is the CBP OIT office in Ashburn, VA CBP will provide space in multiple facilities for the on-site contractor staff to perform the required tasks in the Ashburn, VA area. The Ashburn facility is a mobile environment and supports a telework schedule for contractor staff to report on-site multiple days per week. Some local travel to various sites in the Washington, DC metropolitan area will be required for meetings and briefings. Local travel between the contractor’s duty location (either contractor site or alternate worksite) and CBP offices in the Washington D.C. Metro area (i.e., Ronald Reagan Building, Ashburn, and Lorton) for meetings, seminar, conferences or other official business, is not reimbursable.

Travel to sites outside of the Washington, DC area will be required, as approved by the COR.

8.0 PERIOD OF PERFORMANCE

See solicitation.

8.1 Hours of Operation

The normal business hours are 7:00 am to 6:00 pm (Eastern), Monday through Friday, with core business hours between 9:00 am and 3:00 pm each business day. The contractor shall ensure coverage of these core hours for those in direct support of NII. NII and those directly supporting NII, will recognize all official federal holidays. However, all computer and software applications support a 24/7/365 mission requirement, and the contractor shall ensure system NII CIP application performance standards are maintained over the full range of mission operations. The

Contractor must provide a central point of contact to reach the necessary staff in the event of system problems or emergencies. If required by the COR or Government Team Lead, the contractor’s staff shall report on-site after normal hours to address system problems.

9.0 SECURITY REQUIREMENTS

The Contractor shall comply with the CBP administrative, physical, and technical security controls to ensure that the Government’s security requirements are met. The Contractor shall not use, disclose, or reproduce data, which bears a restrictive legend, other than as required in the performance under this TO.

All hardware, software, and services provided under this TO, must be compliant with DHS 4300A DHS Sensitive System Handbook and the DHS Management Directive 140-01, Information Security Program and CBP Information Systems Security Policies and Procedures Handbook, HB 1400-05D.

9.1 Handling Personally Identifiable Information (PII)

When a Contractor, on behalf of CBP, handles, stores, and transmits Sensitive PII data, the Contractor shall Accredit (ATO) this information system to the (HHM) FIPS level. The contractor shall ensure and certify that they will not retain any PII on non CBP systems.

Contractor employees shall satisfy the Privacy Training requirement by completing Privacy at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter, not later than October 31st of each year.

9.2 Other Security Requirements

The contractor shall implement as a minimum a set of security requirements detailed below, All systems shall use the CBP Desktop Management Group (DMG) Authorized Desktop Build (ADB) image.

All systems shall follow DHS/CBP requirements for DISA STIG compliance.

All systems shall be encrypted using Bit Locker encryption or equivalent encryption approved by CBP Security.

All systems shall run with CBP security applications and agents, such as Tenable Nessus, Tanium, Splunk, Digital Guardian, and Symantec Endpoint Protection.

All systems shall use TLS v1.2 or higher to communicate with internal and external systems and components.

All systems shall not use unauthorized programs and unsecure protocols, such as ftp, telnet, http, and peer-to-peer networking.

All systems and network components shall be scanned for vulnerabilities at frequencies designated by CBP and BEMSD, at 1-week, 2-week, or 1-month intervals. Based on the findings of the scan, the contractor shall remedy the vulnerability within 30 days.

All system and network component vulnerabilities shall be remediated within 30 days of discovery and documented in a plan of action and milestones (POAM) if unresolvable within 30 days.

All systems shall have an adjudicated Privacy Threshold Analysis (PTA), Privacy Impact Assessment (PIA), Authority to Test (ATT) and/or Authority to Operate (ATO) for production deployment and operations.

All systems shall have an adjudicated Interconnection Security Agreement (ISA) prior to establishing communications with and sending data to external entities.

All systems shall not store and maintain local copies of data (images, logs, messages) containing PII for longer than 7-days.

11.0 SPECIAL CONSIDERATIONS

11.1 Government Points of Contact

Notwithstanding the Contractor’s responsibility for management during performance, the administration of this TO will require some coordination between CBP and the contractor. The CO will appoint a COR to assure orderly performance of the tasks and to provide technical direction. The COR is:

Name: Capacine M. Abdul-Aziz Phone: 571-451-4706 E-mail: Capacine.Abdul-Aziz@cbp.dhs.gov

The types of actions within the purview of the COR’s authority, are to assure that the Contractor performs the technical requirements of the contract;

to perform, or cause to be performed, inspections necessary in connection with performance of the contract;

to maintain both written and oral communications with the contractor concerning the aspects of the contract within his/her purview;

to monitor the contractor’s performance under the TO and notify the contractor and CO of any deficiencies observed; and, to coordinate Government-Furnished Property or Data availability and provide for site entry of contractor personnel, if required.

The COR will provide no supervision to contractor personnel. The COR is not empowered to make any commitments or changes that affect the price or other items and conditions. Any such proposed changes must be brought to the immediate attention of the CO for action. The acceptance of any changes by the Contractor, without specific approval and written consent of the CO, shall be at the Contractor’s risk.

Notwithstanding the Contractor’s responsibility for technical management during performance, the technical administration of this TO will require coordination between CBP and the contractor. Task Monitors (TM) for each technical area will be appointed by the NII Program Manager. The Program Manager for NII is:

Name: Christopher Thompson Phone: 571-451-4706 E-mail: chris.c.thompson@cbp.dhs.gov

11.2 Inspection and Acceptance

The Government reserves the right to reject any deliverable based on defects with respect to completeness, correctness, clarity, and consistencies. In the event of a rejection of any deliverable, the CO will notify the contractor in writing within five (5) business days of the receipt of the deliverable of any deficiencies to be corrected. The contractor shall have five (5) business days to correct the deficiencies.

Accuracy: all deliverables shall be accurate in presentation and content and shall adhere to the guidelines set forth in this document. All documentation presented to the Government shall be complete, correct, clear, and consistent.

Clarity: deliverables shall be clear and concise.

Timeliness: deliverables shall be submitted on, or before, the due date specified in the statement of work, or submitted in accordance with a later scheduled date, mutually agreed upon by the Government and Contractor. A deliverable is considered timely if submitted on, or before, the date specified in the Statement of Objectives and, if the Government provides any written notifications of deficiencies, the contractor corrects the deficiencies within five (5) business days.

The cognizant CBP COR and contractor’s representative will meet monthly at the primary place of performance, or via conference call, to review work performance. Overall clarity and accuracy will determine acceptance of services. This is not intended to restrict or limit the Government’s review of contractor performance and the Government, at its option, may perform additional tests and inspections, as it deems necessary.

11.3 Travel

Contractor personnel may be required to travel to support the requirements of this contract. The Government will not reimburse local travel within a fifty (50) mile radius from the Contractor’s primary place of performance. Allowable travel costs will be reimbursed if approved by the COR prior to departure. Such costs include transportation, lodging, subsistence, and incidental expenses, in accordance with the Federal Travel Regulation. The Contractor shall, to the maximum extent practicable, minimize overall travel costs by taking advantage of discounted airfare rates available through advance purchase. Travel performed for personal convenience, or daily travel to and from work at the Contractor’s facility or local Government facility (i.e., designated work site), shall not be reimbursed. Local parking is not covered by this PWS. Long distance travel may be required, both in the Contiguous United States (CONUS) and Outside the Contiguous United States (OCONUS). The Contractor shall coordinate specific travel arrangements with the COR to obtain advance, written approval for the travel about to be conducted. Costs associated with Contractor travel shall be in accordance with FAR 31.205-46, Travel Costs.

11.4 CBP Requirements

11.4.1 DHS Enterprise Architecture Compliance

All systems and services shall meet DHS Enterprise Architecture (EA) policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security (HLS) EA requirements:

All developed systems and requirements shall be compliant with the HLS EA principles.

All IT hardware and software shall be compliant with the HLS EA Technical Reference

Model (TRM) Standards and Products Profile.

All products are subject to DHS EA approval. No products may be utilized in any production environment that are not included in the HLS EA TRM Standards and Products Profile.

Description information for all data assets, information exchanges, and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval, and insertion into the DHS Data Reference Model and EA Information Repository.

Development of data assets, information exchanges, and data standards will comply with the DHS…