Performance Work Statement (PWS) Transportation Security Administration (TSA)

Credentialing Management Support

1. Overview Enrollment Services and Vetting Programs (ESVP) requires Credential Management Support (CMS) that will focus on technical expertise for credentials issued using the TSA’s Security Threat Assessment (STA). The technical support will focus on, but is not limited to, the efficiency and effectiveness of the Transportation Worker Identification Credential (TWIC®) program and specifically address supporting the credential production, issuance, and reliability testing of a derived (digital or physical) credential. The support contract will further focus on smart card technology, physical and logical access control systems, including fixed and mobile biometric/credential readers, credential security features, smart card data models and specifications, credential diagnostics and evaluation, certificate authorities and encryption, enrollment services, identity verification, and authentication technology standards. Furthermore, it will explore capabilities, identifying anomalies, and vulnerabilities to the program.

As part of its STA enrollment processes, TSA receives biometric data from outside sources, and TSA has limited direct visibility into the quality of biometric samples collected. The consequence of poor-quality samples and non-conforming biometrics data is delayed or terminated STA applications or enrollments. Also, TSA uses transportation worker biometric information to develop and issue biometric access credentials. Using biometric card reader or access control solution/system, a transportation worker’s identity can be positively validated, verified, and authenticated by matching a credential’s biometric template to a live sample or physical access control system reference biometrics.

The development of credentials requires adherence and alignment to directives, standards, and special publications for use of Federal identity credentials. Based on a transportation facility or vessel’s current or planned access controls, solutions or systems, TSA’s credential(s) may encounter operability issues that require analysis from TSA to ensure that eligible transportation workers can gain access to secure areas, facilities, or vessels. Biometrics expertise is needed to analyze and diagnose these and other related day-to-day biometric issues, and to recommend proactive solutions to manage the quality and completeness of biometric packages being offered by regulated stakeholders to TSA and processed by TSA systems.

ESVP manages the TWIC® program. The TWIC® program is a vital national security measure that ensures that individuals who pose a security threat do not gain unescorted access to secure areas of the nation’s maritime transportation system. Jointly administered by TSA and the U.S. Coast Guard (USCG), TWIC® was established by the Maritime Transportation Security Act (MTSA) of 2002 and amended by the Security and Accountability for Every (SAFE) Port Act of 2006. TSA is responsible for enrollment, security assessments, and system operations and maintenance.

The USCG is responsible for enforcement. The TWIC® program is highly visible, involves sensitive issues regarding privacy, is advanced technologically, and is tasked with addressing critical shortfalls in identity management related to transportation security.

TWIC® is the only TSA vetting program that issues a physical biometric credential. Robust technical expertise, especially in the area of smart card technology, is required to meet the TWIC® program’s mission needs.

1.1 Additional information on ESVP’s TWIC® Program:

• TWIC® Reader Qualified Technology List (QTL) website: https://www.tsa.gov/sites/default/files/4-twic-sc-qtl-list-of-vendor-self-certified-readers.pdf

• TWIC® Program website: https://www.tsa.gov/for-industry/twic

• TWIC®/United States Coast Guard Homeport website: https://www.uscg.mil/Homeport/

• https://www.tsa.gov/twic expand technology drop down

DRAFT

https://www.tsa.gov/sites/default/files/4-twic-sc-qtl-list-of-vendor-self-certified-readers.pdf https://www.tsa.gov/sites/default/files/4-twic-sc-qtl-list-of-vendor-self-certified-readers.pdf http://www.tsa.gov/for-industry/twic https://www.uscg.mil/Homeport/ https://www.tsa.gov/twic

2. Scope

This scope of work describes the subject matter expertise support needed by the Transportation Security Administration (TSA) Enrollment Services and Vetting Programs (ESVP). The contractor shall provide technical expertise with respect to credential management strategy, operations, and testing initiatives. Areas of expertise may include, but are not limited to: biometric identification and authentication, smart card technology, physical and logical access control systems, including fixed and mobile biometric/credential readers, credential security features, smart card data models and specifications, credential diagnostics and evaluation, derived (digital or physical) credentialing, certificate authorities and encryption, enrollment services, identity verification, and authentication technology standards.

This Task Order provides technical support for the ESVP TWIC® program. The contractor shall provide Subject Matter Experts (SMEs) who offer, at a minimum, the knowledge, skills, and experience listed below.

Subject matter expertise with:

• Identity and Biometric-based Federal databases and systems

• Biometric Standards and Biometric Identification and Authentication (National and International)

• Smart Card Specifications and Technology Standards

• Smart Card Production and Personalization

• Physical and Logical Access Control Systems and Reader Technology

• Identity Management

• Credentialing and Card/Credential Management Systems and Certificate Authorities.

Working knowledge expertise with:

• Smart Card design and production (as demonstrated by Certified Smart Card Industry Professional (CSCIP) designation, or similar competency/certification)

• Technical specifications and documentation

• Risk Assessment, Quality Assurance, and Internal Controls

• Test and Evaluation

• User interface design

• Supporting Hardware and Software System Development

• Technical Writing/Editing

• Project Management, planning and project team Mobile App Development

3. Requirements

3.1 ESVP REQUIREMENTS

In accordance with the MTSA, TSA ESVP is responsible for TWIC® enrollment, security assessments, credentialing and system operations and maintenance. The TWIC® Program is the only vetting operation at this time that issues a biometric credential.

Robust technical expertise, especially in the area of physical smart card credentialing, is required to meet the TWIC® program’s mission needs. The contractor shall provide the following specific services under this Task Order:

a. Specifications: The ESVP manages the design of the TWIC® credential and communicates the data structure, formatting, and functional requirements to stakeholders and partners for the proper use, interface, production, and authentication of the credential. The Contractor shall provide credential support to include:

Annual, review, version update, and publication of a formal TWIC® Security Threat Assessment Program Credential Specification document to include sections detailing:

• Modes of operation

• Comparison between PIV, PIV-I, TWIC®, and Next Generation (NEXGEN) TWIC® models

• Card application data model and description

• Card application command set

• Card object identifiers

DRAFT

• Details on TWIC® privacy key processing

• Considerations for the use of the TWIC® card

• Reader requirements, including performance requirements

• Support to TSA during Government Accountability Office (GAO) audits of the program

• Testing of vendor applets in the event TSA seeks a multisource contract for supply of polycarbonate cards

• Access control system requirements, including performance requirements

• Information required to support interface or system control documentation

• Maintenance after product deployment

• Mobile Application production

• Projected maintenance/ update schedule to remain compatible

b. Authentication Publication: The ESVP promotes the secure authentication of TWIC® cards by using qualified biometric and electronic readers or PACS and card validation solutions. At this time, the biometric authentication of TWIC® is not mandated across all MTSA-regulated entities. Absent such requirement(s), the scope of TWIC® inspection may vary based on assessed risk or threats to a regulated entity and the security investments prioritized by the owners/operators of regulated entities. The contractor shall develop enhancements and, maintain a publication for facility security officials and stakeholders about access control solutions that incorporate the TWIC® card or application. This publication shall include, but is not limited to, the following topics, for which the Contractor shall write based on research, interviews with subject matter experts, and/or testing:

• History of PIV and TWIC® for identity management

• Components and types of access control and systems, with focus on physical access

• System modes or types of operation(s) for inspection (validation, verification and authentication)

• Strengths and weaknesses of modes or types of inspection

• Comparison of biometric and electronic inspection

• Key considerations for implementing access control systems

• Guidance for transitioning facilities from requiring PIV PIN access to the TWIC profile in access control systems

c. . Post-Publication/Production TWIC Card: The contractor shall provide support for post-implementation technology matters. The contractor shall be actively involved in the reviewing of code, systems testing, user acceptance testing, providing comments and feedback, and performing quality checks.

d. Reliability Evaluation & Testing: The contractor shall assist in evaluating the use and revocation of ESVP biometric credentials and/or identifiers issued by TSA and support card reliability evaluation and failure testing activities, observations, and methods in the field. The contractor shall provide TSA the following operational and testing services under this task order:

1. The contractor shall provide the Government with technical research and recommendations on security threat assessment program credential design and functionality to provide operational assistance on the use of the credential in the field and revocation. This support shall include, but is not limited to, the activities listed below, for which the contractor shall:

2. Assist with the identification and resolution of card usage, revocation, and functionality issues in the field, including card reader failures and incompatibility issues. This assistance shall include policy guidance and support related to the revocation of the TWIC®, specifically processes associated with the TWIC® Canceled Card List (CCL), Visual Canceled Card List (VCCL), and Certificate Revocation List (CRL).

3. Administer, use, and update the TWIC® program’s card test methodology (i.e., card failure toolkit) to include the conduct of testing activities/steps to review the status of the TWIC® card’s operation and integration with facility and/or vessels access controls and physical access control systems.

4. Analyzes cards using nondestructive techniques to identify potential failure modes and suggest changes to specifications that will minimize future failures and increase the reliability of the cards. Conduct failure analysis and provide statistical analysis to preemptively identify failure trends to reduce the issuance failure rates.

5. Tests are to include, but not limited to:

• Standards Testing - FIPS201, ISO, ANSI, ICAO, and other standard based physical and electrical tests for smart cards

• Compliance Testing - Testing for compliance to existing specifications and preparation of specifications for future iterations of smart cards

• Mechanical, Durability, and Reliability Testing (e.g. Accelerated testing, wear testing, and service life prediction)

• Radio Frequency Tests

• Physical Parameters Testing (e.g. Height, width, thickness, corners, bending stiffness, temperature/humidity stability, etc.)

• Magnetic Encoding and Stripe Parameters testing

• IC Card and ID Device Tests (e.g. Static electricity exposure, Bending properties, Torsion properties, Profile of contacts, etc.)

• Durability/Life Tests (e.g. Abrasion tests, Flexure tests, Embossed character retention, Chemical resistance, and Environmental exposure, among other testing activities.)

• Electrostatic Discharge (ESD)

• Radio Frequency Tests

• Mobile Compatibility ( Android/ iPhone etc.)

• App Compatibility

6. Develop a quarterly report on known/reported TWIC® card failure or reliability issues, including the facility, vessel, or geographic location (or approximation) of card; use/functionality/failure issue(s); point of contact(s); solution(s) or potential solution(s); mitigation plan(s); and the date the issue was identified and resolved

7. Draft, review, revise and publish technical advisories or memoranda (where required) for public and private industry on the proper use of reader technology and access control systems with the TWIC® credential.

8. Support the issuance of TWIC® validation card sets for reader and access control system testing, to include but is not limited to documenting the process, configuring card certificates/profiles, and validating card set production.

9. Assist the Government by providing technical expertise and recommendations in support of the TWIC® Qualified Technology List (QTL) initiative. The QTL will be developed by the TSA with input from stakeholders, such as the U.S.

Coast Guard, and the award recipient. The award recipient will be responsible for the planning, management, implementation and technical support required to implement, operate and maintain the QTL. The Government will advise and support the award recipient with communications and stakeholder engagement associated with the QTL.

a. Self-Certify Qualified Technology List Initiative Maintenance

i. On an annual basis re-verify every device and confirm with vendor of functionality

1. To include TWIC- Self-Certification (scQTL)

2. To include information/maintain documentation of functionality of e-sticker

ii. Self-Certify Qualified Technology List Maintenance Website Locations:

1. On an annual basis based on re-verification above, update information as necessary to locations below:

a. TWIC® | Transportation Security Administration https://www.tsa.gov/twic

b. www.tsa.gov/sites/default/files/4-twic-sc-qtl-list-of-vendor-self-certified-readers.pdf

10. Configure, issue certificates, and test card stock provided by TSA as test cards for the development of QTL-related analysis tools that support the TWIC® reader vendors, QTL labs, and other stakeholders.

11. Provide ongoing technical outreach efforts to support TWIC® reader vendors, QTL labs, and other stakeholders;

this support includes, but is not limited to, providing ad-hoc support and distributing technical bulletins on QTL-related work products (such as test cards, software tools, and any required documentation) for TWIC® reader vendors, QTL labs, and other stakeholders.

12. Provide the ability to personalize test card sets with representative fingerprint minutia.

DRAFT

https://ustsa-my.sharepoint.com/personal/michele_vanskiver_tsa_dhs_gov/Documents/Credentialing%20Management%20Support%20N015/1.%20CMS%20Recompete/PWS/CMS%20PWS%20draft%2003%20November%202025.docx https://ustsa-my.sharepoint.com/personal/michele_vanskiver_tsa_dhs_gov/Documents/Credentialing%20Management%20Support%20N015/1.%20CMS%20Recompete/PWS/CMS%20PWS%20draft%2003%20November%202025.docx https://ustsa-my.sharepoint.com/personal/michele_vanskiver_tsa_dhs_gov/Documents/Credentialing%20Management%20Support%20N015/1.%20CMS%20Recompete/PWS/CMS%20PWS%20draft%2003%20November%202025.docx

13. Manage, track, and report to the Government on an annual basis all QTL-related equipment provided and purchased on behalf of the Government as set forth under this task order, including the inventory and distribution of test cards and equipment to vendors, labs, and other stakeholders.

e. Derived Credential Assessment: The ESVP recognizes that new forms of credentialing for identity validation, verification and authentication exist and are used for physical and logical access control. While ESVP is required to issue a physical “biometric transportation security card” for TWIC®, derived credentials may provide more flexible and secure authentication for transportation workers and the vessels and facilities that perform TWIC® inspections. The contractor shall conduct and develop an assessment on the costs, benefits, and feasibility of derived credentials for the TWIC® program. The contractor shall include, but is not limited to, the following topics, for which the Contractor shall write based on research, interviews with subject matter experts, and/or testing:

• History of derived credentials for physical and logical access, including PIV and PIV-I

• Opportunities and risks associated with derived credential inspection (validation, verification and authentication) compared to current TWIC® inspection

• Cost of derived credential implementation, management, and use for issuing entity, credential holders, and access control facility or vessel and

• Alternatives to derived credentials (where applicable)

Table 1: Requirements Deliverables

Item Task Order Reference Number

Deliverable/ Description

Contractor Submits

PMO

Review Date

Frequency Submitted To Type

1 3.1.a Annual, review, version By COB 120 Within 30 N/A CO/COR/ESVP Submitted update, and publication days after business days electronically of TWIC® Security award or the after receipt Threat Assessment next business Program Credential day

Specification 2 3.1.b Publication for facility By COB 270 Within 30 N/A CO/COR/ESVP Submitted security officials and days after business days electronically stakeholders on access award (initial) after receipt control solutions that or the next incorporate the TWIC® business day card or application

3 3.1.c.5 Develop a quarterly By COB 90 Within 30 Quarterly CO/COR/ESVP Submitted report on known/ days after business days electronically reported TWIC® card award (initial) after receipt;

failure or reliability or the next iterative reviews issues. business day, within 15 business followed by days following quarterly (90 initial review from day) updates Government and by COB on the resubmission by 1st calendar contractor day of the quarter

4 3.1.c.6 Technical advisories TBD by the Within 10 N/A CO/COR/ESVP Submitted or memorandum TSA Program business days electronically (where required) for Manager after receipt public and private industry on the proper use of reader technology and access control systems with the TWIC® credential.

5 3.1.c.7 Document the TWIC® TBD by the Within 30 N/A CO/COR/ESVP Submitted

3.2 Reporting

The Contractor shall provide the following reports to the Government:

1. Monthly Report – The Contractor shall provide to the Program Manager and COR on a monthly basis a report outlining:

• Summary of completed activities for the month

• Schedule of planned activities for the month

• Performance of on-going designated tasks

• Identify major risks

• Current Contractor roster assigned to the program

• Onboarding and Offboarding staffing changes

2. Monthly Touch Points – The Government objectives are to identify and discuss, on a monthly basis, resources utilized, schedule progress, and any performance issue(s) that may arise. The monthly report will be provided as part of the monthly touch points as directed by the Government.

3. Final Report - At the close of this task order, the Contractor shall prepare a final report that summarizes the work they have completed in supporting the ESVP during the period of performance. This report shall include a list of updated deliverables as well as new policies and procedures provided by the Contractor in each of the previous sections.

4. Transition Plan - The Government defines “Transition” as the effective, efficient completion of knowledge transfer (information exchange, document exchange, discussions, training, etc.) to ensure uninterrupted operational capability as one government Contractor assumes responsibilities from another. The Government

Validation card set TSA Program business days electronically process, configure card Manager after receipt certificates and profiles, and validate card production for reader and access control system testing.

6 3.1.c.9 Configure, issue TBD by the Within 10 N/A CO/COR/ESVP Hand certificates, and test TSA Program business days delivered card stock provided by Manager after receipt TSA as test cards for the development of

QTL-related analysis tools that support the TWIC® reader vendors, QTL labs, and other stakeholders.

7 3.1.d Assessment on the By COB 180 Within 30 N/A CO/COR/ESVP Submitted costs, benefits, and days after business days electronically feasibility of derived award (draft) after receipt credentials for the or the next TWIC® program business day;

followed by Final deliverable by COB

330 Days after award or the next business day objective is to minimize, to the maximum extent possible, the adverse impact imposed by the transition process.

The Contractor shall actively participate in all transition activities by providing documents, administrative support, technical support, diagrams, and briefings as required by the Government. This transition process takes place at the end of the contract term or as determined by the Contracting Officer (CO) if terminated during a period of performance or at the end of a period of performance or option period.

Finally, the Contractor shall prepare a Transition Out Plan, which shall outline the steps the Contractor will take during transition.

The following table describes the Contract Deliverable Requirements List (CDRLs) that are required for this PWS. The Contractor requires written approval from the CO before executing any change to the scope, content, and/or delivery schedule of the described work products and tasks in this PWS.

Table 2: Contract Deliverables

The dates shown in the above Deliverables Table are the required initial delivery date which initiates the Government acceptance timeline described below. All plans and documents are intended to provide continuity with previous work performed and to provide a comprehensive set of program management guidance and reporting as well as a comprehensive set of systems development and management documentation. The Contractor shall provide all onboarding and offboarding staffing changes to the COR.

Existing plans and documents shall be used in their current form and shall be updated as appropriate to accommodate deficiencies, program and development changes. Documents listed but not currently existing shall be created and delivered at the times specified. The Contractor shall prepare and maintain all documentation in accordance with an industry standard best practice for auditable, repeatable engineering process to assure the availability and accuracy of a comprehensive, complete, and current set of plans, reports, and documents.

The Government will have up to ten (10) business days after receipt of a deliverable to accept or reject any deliverable. If the COR rejects a deliverable, the Contractor will be provided specific written comments detailing the basis for the rejection and the corrective action required. The Contractor shall have up to an additional five (5) business days to address each specific written comment by either incorporating the requested Government change or providing an explanation of why the Government requested change is not being incorporated. Once the Contractor completes this action, the Government will have an additional five (5) calendar days to review and approve the deliverable. Late or non-delivered CDRLs (those not agreed upon between the Contractor and the Government) will be so noted in annual performance evaluations.

CDRL# Deliverable Description Due Date

Monthly Report Monthly report of activities presented in the monthly touch points and highlighting accomplishments. Include any onboard and offboard staffing changes.

On or before the 10th Business Day of the Month.

Program Management Touch Points

PMR to include resources utilized, schedule progress, and any performance issue(s).

TBD

Final Report Summary report of program development and support activities, start- completion schedules, deliverables and results achieved relative to the performance objectives of this PWS.

Draft report - fifteen (15) working days prior to conclusion of work. Final report

- five (5) business days after receipt of comments.

Transition Out Plan A plan outlining the steps the Contractor will take during transition.

Sixty (60) working days prior to the conclusion of the contract.

The Contractor shall deliver all items in Microsoft Office format (including Word, Excel, PowerPoint, Access, Visio, and Project) or other formats accepted by the Government by direction of the COR. Documents submitted by the Contractor shall be professional in content and presentation according to commonly accepted standards of writing and editing in the subject field. The Contractor shall provide electronic copies to the Program Manager, COR, CO and any other specified Government representatives as directed by the Government when due. Contract deliverables, including documents and system implementations, require acceptance by the COR and Program Manager.

All final deliverable documents submitted by the Contractor shall meet professional standards. All documents shall be delivered in a format mutually agreed to between the Contractor and the Government. Previously released documentation will be delivered in current format unless mutually agreed otherwise. Deliverable content may be combined into one delivered document with notification.

4. Security, Personnel Requirements, Privacy Security and Privacy The Contractor shall comply with the Privacy and Security requirements defined in the PWS or elsewhere in the RFQ/contract.

5. Key Personnel The personnel or facilities specified below are considered essential to the work being performed under this contract and may, with the consent of the contracting parties, be changed from time to time during the course of the contract by adding or deleting personnel or facilities, as appropriate.

Before removing or replacing any of the specified individuals or facilities, the Contractor shall notify the Contracting Officer, in writing, before the change becomes effective. The Contractor shall submit sufficient information to support the proposed action and to enable the Contracting Officer to evaluate the potential impact of the change on this contract. The Contractor shall not remove or replace personnel or facilities until the Contracting Officer approves the change.

The Key Personnel or Facilities under this Contract:

Subject Matter Expert Level I Qualifications -

• 3+ years of identity management and/or biometrics consulting and/or industry experience

• Education: Bachelor’s degree in engineering or technical management discipline; ten or more

• years of specific related experience can substitute for a degree

• Hardware and software system development and/or operational testing

• Technical analysis/editing/writing/presentations

• Possesses specific expertise in at least one of the enumerated areas identified in this SOW Section 2.0

• Biometric and identity management standards and best practices

• Credential validation solutions (i.e., mobile applications, desktop applications, or software

• solutions, or equivalent)

• Risk assessment, quality assurance, and internal control(s).

Subject Matter Expert Level II Qualifications -

• 10+ years of identity management and/or biometrics consulting and/or industry experience

• Education: Master’s degree in engineering, technical management discipline or field appropriate

• but not limited to identity management, biometrics, access control, and/or smart card technology

• Identity- and biometric databases/systems development and/or implementation

• Credentialing and Card/Credential Management Systems

• Possesses specific expertise in at least five or more of the enumerated areas identified in this

• SOW Section 2.0

• Previous consulting and/or industry experience with Common Access Credentials (CAC),

• Personnel Identity Verification (PIV), and/or Transportation Worker Identification Credentials

• (TWIC®), or other biometric credentials

• Development and presentation of identity management guidance/training curriculum

• Certified Biometrics Professional (CBP) or equivalency

• Participation/membership in biometric and/or identity management non-profit and/or professional trade organization(s).

Subject Matter Expert Level III Qualifications –

• 15 years of identity management and/or biometrics consulting and/or industry experience

• Education: Bachelors and/or Master’s degree and/or 20+ years in progressive middle and/or

• senior management positions in a field appropriate but not limited to identity management,

• biometrics, access control, and/or smart card technology

• Previous consulting and/or industry experience with Common Access Credentials (CAC),

• Personnel Identity Verification (PIV), and/or Transportation Worker Identification Credentials

• (TWIC®), or other biometric credentials

• Possesses specific expertise in all of the enumerated areas identified in this SOW Section 2.0;

• Biometric and identity management articles, publications, and/or presentations for academic,

• industry or non-profit technical or trade organizations

• Certified Smart Card Industry Professional (CSIP) and/or Certified Smart Card Industry

• Professional Professional/Government (CSIP/G), or equivalency

• Membership/leadership position in biometric and/or identity management non-profit and/or

• professional trade organization(s)

6. Travel The Contractor may be authorized to travel on behalf of the government when required. The Contractor shall obtain approval from the COR at least 48 hours prior to making any travel plans. The contractor shall submit all documentation related to travel expenses to the Government. All associated travel costs incurred by the contractor shall be in accordance with the Federal Travel Regulations and the Transportation Security Administration’s policies. A travel voucher along with all required receipts shall be submitted by the contractor to the Government for reimbursement.

7. Government Points of Contact:

Contracting Officer (CO) Name:

Phone:

E-Mail:

Contracting Officer Representative (COR) Name:

Phone:

E-Mail:

8. Place of Performance:

On-site services shall be provided at TSA Headquarters located at 6595 Springfield Center Drive, Springfield, VA 22150

9. Period of Performance 12-month from date of award with (four) one-year option periods

10. Quality Assurance Surveillance Plan

1. Introduction This Quality Assurance Surveillance Plan (QASP) is pursuant to the Performance Work Statement (PWS). The surveillance and evaluation Quality Assurance (QA) methods identified in the QASP will assure the Government is receiving the standard of service detailed in the PWS.

This plan sets forth the procedures and guidelines the Government will use in ensuring the required performance standards or services levels are achieved by the contractor. The Government retains the right to change the surveillance methods and procedures, and to increase or decrease the degree of surveillance efforts at any time necessary to assure contract compliance.

1.1 Purpose

The purpose of the QASP is to describe the methods used to monitor performance and to identify the required documentation and the resources to be employed. The QASP provides a means for evaluating whether the contractor is meeting the performance standards and quality levels identified in the PWS.

This QASP defines the roles and responsibilities, identifies the performance objectives, defines the methodologies used to monitor and evaluate the contractor’s performance, and describes quality assurance documentation requirements.

The QASP is intended to accomplish the following:

• Identify the procedures and guidelines used to evaluate the performance of the Contractor.

• Define the role and responsibilities of participating officials

• Define the key service levels that will be measured.

• Describe the rating criteria and evaluation methods employed in accessing the Contractors performance.

• Identify the forms, reports and resources used to document monitoring efforts and results.

1.2 Performance Management Approach

This QASP will define the performance management approach used to monitor and manage the contractor’s performance to ensure the expected outcomes or performance objectives communicated in the PWS are achieved.

1.3 QASP Revisions

Revisions to this surveillance plan are the responsibility of the Contracting Officer’s Representative (COR). Changes may be made unilaterally and need not be coordinated with the Contractor; the government may provide informational copies to the Contractor at its option. The COR will discuss with the Contracting Officer (CO) the proposed changes/revisions to ensure they do not change the contractual requirement.

2. Roles and Responsibilities

2.1 Contractor Responsibility

The Contractor is responsible for accomplishing all tasks/services in accordance with the contract.

2.1.1 Program Manager Responsibility

The Contractor Key Personnel is responsible for monitoring quality assurance of the requirement.

2.2 Government Responsibility

The Contracting Officer (CO) and the Contracting Officer’s Representative (COR) are the key Government personnel who will be responsible for QA.

2.2.1 Contracting Officer (CO)

Changes to the QASP that could change the contractual requirement must be submitted to the CO for a modification to the contract before they are incorporated in the QASP. In accordance with Federal Acquisition Regulation (FAR) 42.302(a) (57), the CO also delegates specific surveillance tasks and authorities by formal letter to the COR.

2.2.2 Contracting Officer’s Representative (COR)

The COR represents the CO in all technical functions and is therefore, the Contractor’s initial point-of-contact with TSA.

In turn, the COR may delegate to other qualified Government personnel specific responsibilities in order to ensure that the QA function is properly executed.

The COR is not empowered to make contractual commitments, authorize contractual changes, direct or interfere with the methods of performance by the Contractor, or to issue directions to any Contractor personnel on TSA’s behalf.

Some of the key contract administration duties of COR includes, but not limited to, the following:

• Perform surveillance as required by this QASP and make recommendations to the CO regarding issues of noncompliance, deficiency, or commendation.

• Make recommendation to the CO identifying necessary contract modifications and any changes to the QASP.

3. IDENTIFICATION OF REQUIRED PERFORMANCE STANDARDS/QUALITY LEVELS

3.1 Performance Description

Contractor performance will be monitored through various surveillance techniques described in Section 14 Surveillance Techniques. This plan describes the methodology utilized to make both quantitative and qualitative evaluation of Contractor performance under the contract.

3.2 Acceptable Performance Standards (APS)

The Acceptable Performance Standards (APS) in Section 14 provides the PWS performance standards and levels.

The Contractor will be held responsible for all identified discrepancies, and TSA may require the Contractor to re- perform or correct the work at no additional cost to TSA.

3.3 Documenting Performance

3.3.1 Acceptable Performance

The Government will document positive performance. Any report may become a part of the documentation supporting contract past performance.

3.3.2 Unacceptable performance

When unacceptable performance occurs, the COR will inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the COR will document the discussion and place it in the COR file.

When the COR determines formal written communication is required, the COR shall prepare a letter (via email) from the CO and present it to the contractor's Program Manager.

The contractor shall acknowledge receipt of the letter (via email) in writing. The notification will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The notification will also state how long after receipt the contractor has to present this corrective action plan to the COR. The Government shall review the contractor's corrective action plan to determine acceptability.

Any notifications may become a part of the supporting documentation for contract payment deductions or other actions deemed necessary by the Contracting Officer.

3.3.3 Remedial Actions

The FAR allows for penalties in the event that the Contractor fails to perform the required services. Penalties are defined as those actions taken under the direction of the CO against the Contractor within the general provisions of the contract for noncompliance to the PWS.

In accordance with FAR 46.102 and FAR 46.105, the Government will not accept nonconforming products and/or services.

The Contractor is required to correct products and/or services that fail to meet contract requirements, at no cost to the government. If the Contractor fails to proceed with reasonable promptness to perform the required correction, the Government may take actions to collect consideration for work not accomplished.

4. Performing Quality Assurance The COR and other designated Government personnel perform contract surveillance using various methods and reports results as required.

4.1 Surveillance Techniques

The following performance monitoring methods may be applied individually or in combination. The method or combination of methods used when conducting an inspection must be noted when describing the surveillance.

Task reporting can consist of 100% inspection, random sampling or periodic inspection. When using Contractor-generated reports, this method is best for general surveillance and may need to be supplemented by periodic inspections. The COR may accept Contractor-generated reports, with prior approval by the Government, but may use other methods to investigate problem areas.

1. Direct Observation Direct observation of Contractor performance can be performed periodically or through 100% inspection. Direct Observations may be scheduled or unscheduled. Scheduled Observations are previously scheduled and coordinated with the Contractor. Unscheduled Observations may be conducted at random by TSA personnel.

2. 100% Inspection The 100% inspection method requires complete inspection of a contract requirement and will be used for requirements that are especially critical or where there is some reason for suspecting that the performance standard is not being met and requires more stringent monitoring.

3. Periodic Inspection Periodic inspection, sometimes called “planned sampling,” provides a systematic way of looking at service outputs and forming conclusions about the Contractor’s level of performance in accordance with a planned schedule of surveillance.

Evaluation by periodic inspection is designed to inspect some part but not all of the products and services being monitored.

The levels of evaluation appropriate for periodic inspection are discretionary. In order to perform trend analysis from periodic inspection, criteria for sample selection should be applied consistently from period to period. Observed discrepancies monitored by periodic inspection will be totaled and assessed at the end of each evaluation period. For each requirement, the findings will be compared to the performance standard and APS.

4. Random Sampling Random Sampling is the most appropriate method for recurring tasks. This QA method is designed to evaluate Contractor performance by randomly selecting and inspecting a statistically significant sample. Random sampling is recommended for large quantity repetitive actives with objective and measurable quality attributes. The random sampling procedures consider the APS, the level of the evaluation effort, and the population size.

Random Sampling is based solely on a statistical analysis whereby a conclusion is drawn about a population based on a randomly selected sample of that population. For the conclusion to be valid, the sample selected must be representative of the population.

5. DOCUMENTATION AND REPORTS

Accurate and complete documentation is necessary for QASP administration. The COR will maintain a complete QASP file and provide documentation to the CO when requested. The QASP file will contain copies of all reports, evaluations, recommendations, and any actions related to the quality assurance surveillance function. All such records will be retained for the life of the contract and forwarded to the CO.

6. ANALYSIS OF QUALITY ASSURANCE ASSESSMENT

6.1 Determining Performance

The Government shall use the monitoring methods cited in the Acceptable Quality Levels chart determine whether the performance standards have been met. If the contractor has not met the minimum requirements, the contractor may be asked to develop a corrective action plan to show how and by what date it intends to bring performance up to the required levels.

6.2 Reviews and Resolution

The Government representative responsible for overall monitoring of performance (CO or COR) may require the contractor’s Program Manager, or a designated alternate, to meet with the CO, COR, and/or other government personnel as deemed necessary to discuss performance evaluation. The CO or COR will define a frequency of reviews with the contractor, including appropriate self-assessments by the contractor; however, if the need arises, the contractor will meet with the CO or COR as often as required or per the contractor’s request. The agenda of the reviews may include:

1. Monthly performance assessment data and trend analysis

2. Issues and concerns of both parties

3. Projected outlook for upcoming months and progress against expected trends, including a corrective action plan analysis

4. Recommendations for improved efficiency and/or effectiveness

Acceptable Quality Levels Task Performance

Standard Acceptable Quality Level (AQL)

Method of Inspection

Frequency

1.Submission of a Monthly Status Report

(PWS 3.3.2)

The contractor shall submit a Monthly Status Report (MSR)that satisfies PWS 3.3.2 by the 5th business day of each month to the CO and the COR of the task order.

The MSR will contain a status report of the work performed that month by program, the requested deadlines and performance to each deadline. The MSR is received no more than 2 business days after the due date

100% Inspection - The COR will note the date the MSR is received and makes the determination of compliance to the

QASP.

Monthly

2. Submission of an Annual Summary Report (PWS 3.3.1a)

The contractor shall submit an Annual Summary Report that satisfies PWS 3.3.1a no later than one month after the end of the base year or option year period. The Program Office may

The Annual Summary Report (ASR) will contain a summary report of the work performed by the task. The ASR will analyze the programs adherence to the project schedules, risk

100% Inspection - The COR will note the date the ASR is received and makes the determination of compliance to the

QASP.

Annual request for an oral version of this summary report.

mitigation, gate review progress, and contribution towards office and agency priorities. A written version of the ASR will be received no more than 2 business days after the due date. An oral presentation will accompany the submission to be scheduled at the convenience of the government.

4. Program Management Support: Meeting minutes, slide decks, supporting documentation, templates, as needed. (PWS 3.3.2.2)

The contractor shall provide the requested program management support and provided final deliverables prior to or on the program offices previously provided mutually agreed upon due date.

Final deliverables are provided on or before communicated due date.

100% Inspection – work product can be submitted via email to program office. Any late product will be reported to the

COR.

Mutually Agreed Upon Date

6. Staffing Matrix Model (PWS 5.0)

The contractor shall provide a staffing plan that shows dedicated support mapped to requirements prior to kickoff meeting to ensure capacity to meet requirements as listed in

PWS 5.0

Contractor shall provide staffing updates for any key personnel changes and during monthly status meetings.

100% Inspection - The COR will note the date the Staffing Matrix is received and makes the determination of compliance to the

QASP

Prior to Kickoff and Monthly

11. 508 Compliance

1. Section 508 Requirements Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgibin/textidx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5.

In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied.

Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139- 05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

https://uscode.house.gov/view.xhtml?req=(title:29%20section:794d%20edition:prelim)%20OR%20(granuleid:USC-prelim-title29-section794d)&f=treesort&edition=prelim&num=0&jumpTo=true https://www.ecfr.gov/cgibin/textidx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5

1.1 Section 508 Requirements for Technology Services

1. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original

ICT item's level of Section 508 conformance prior to the services being performed.

2. When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

3. When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

4. When developing or modifying electronic documents and forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable to the applicable Section 508 standards (including WCAG Level A and AA Level 2.0 Success Criteria) by conducting testing using the test methods published under “Accessibility Tests for Documents” at https://www.dhs.gov/compliance-test-processes.

5. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the accessibility requirements in this work statement.

1.2 Section 508 Deliverables

1. Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions.

2. Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

3. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

4. Other Section 508 Documentation: The following documentation shall be provided upon request for ICT items offered through this contract:

o Documentation of features provided to help achieve accessibility and usability for people with disabilities.

o Documentation on how to configure and install the ICT Item to support accessibility.

o Documentation of core functions that cannot be accessed by persons with disabilities.

o Documentation of remediation plans to address non-conformance to the Section 508 standards

DRAFT

https://www.dhs.gov/compliance-test-proce…