ETD QPL Announcement.pdf

Transportation Security Administration (TSA)

Explosives Trace Detection (ETD)

Qualified Products List (QPL)

70T04026QPL7672ETD001

Request for Certification Data Packages (CDP) or

Qualification Data Packages (QDP)

December 19, 2025

SECTION 1 – QPL OVERVIEW

1.0 Introduction

ETD systems are desktop devices that are used by the TSA throughout the United States (U.S.)

and its territories to detect and distinguish trace amounts of explosive and chemical compounds.

ETD systems are used by Transportation Security Officers (TSOs) to screen passengers, checked baggage, and carry-on baggage. Currently, there are two systems on the TSA ETD QPL with over 5,800 total systems in operation throughout more than 435 airports nationwide. TSA is opening the ETD QPL to add additional systems to the existing QPL, which will foster opportunity for greater competition on potential future procurements.

This announcement officially requests submissions from applicants to participate in the QPL process. The Qualification Management Plan (QMP) is a supplemental document that defines the work necessary for QPL Applicants to have a proposed system on the TSA ETD QPL. The TSA requires any ETD systems used within the U.S. and its Territories to be certified and qualified as defined in 49 U.S.C. § 44913 and Federal Acquisition Regulation (FAR) section 9.202, respectively. The TSA is subject to the World Trade Organization Government Procurement Agreement as defined in FAR Section 25.003. As such, all ETD systems submitted under this QPL must be in accordance with the applicable Trade Agreements and/or Buy American Act (see Section 3.5 for additional terms and conditions). QPL Applicants interested in having a system qualified by TSA must successfully meet the requirements for each step in the ETD Qualification Process outlined in Section 2 below. TSA will require QPL Applicants to meet the following entrance criteria:

• Present systems that meet one of the TSA Detection Standards (DS) (DS 5.0, 6.2 or 6.3).

• Present systems that demonstrate capabilities based on ETD Functional Requirements

Document (FRD) Version 2.0 (June 2025).

• Although ETD systems will not initially connect to the TSA Network, ETD systems should adhere to applicable Information Technology (IT) security requirements and meet select Security Technology Information Exchange (STIX) compatibility requirements (e.g., resources and protocols).

1.1 Establishment of the ETD Qualification Process

This Announcement establishes a new opportunity to participate in the Qualification Process for ETDs in accordance with the requirements of FAR 9.202. During the Qualification Process, TSA obtains ETDs from the QPL Applicant to test the product’s performance against TSA requirements.

Only those QPL Applicant products that successfully meet the requirements are invited to be added to the TSA ETD QPL. A qualification process is essential to ensure that TSA is buying a proven technology prior to making a significant investment.

Successful qualification and placement on the ETD QPL does not guarantee a contract award for ETD, and TSA has no further obligation to a qualified QPL Applicant. Once qualified, procurement decisions will be made as requirements arise. ETD awards may be made via competition or sole source justification, depending on TSA’s requirements and business practices.

TSA requires that the QPL Applicant must be the Original Equipment Manufacturer (OEM).

Systems already on the current ETD QPL do not need to requalify. QPL Applicants may begin the QPL process at Step 3 CDP Submission, or Step 5 QDP Submission if the Applicant already has an ETD that has been certified. TSA funding is limited to the first five (5) QPL Applicants with an approved and accepted QDP.

Table 1 below, titled “Qualification Process”, provides an overview of the steps in the Qualification Process. The Qualification Process steps are also described in the ETD QMP.

Table 1. Qualification Process1

Step 1.

Announce Qualified Product List

Step 2.

Release the Qualification Management Plan

Step 3.

Certification Data Package Submission

Step 4.

System Testing

Step 5.

Qualification Data Package Submission

Step 6. Integration / Implementation

Step 7.

Initial Operational Test and Evaluation

Step 8.

Component Acquisition Executive Approval and Add Technology to QPL

Step 4a.

QPL

Applicant System

Step 6a.

Qualification

Step 6b.

Cooperative Vulnerability Penetration Assessment

Step 4b.

Certification

1.2 Period of Performance

The ETD QPL will remain open until it is closed by TSA. Department of Homeland Security (DHS) Agencies/Components reserve the right to utilize the list of qualified QPL Applicants to issue their own contracts.

1.3 Bailments

QPL Applicants with an approved CDP (or QDP if the Applicant has already successfully completed Certification testing (CERT)) shall enter into a no-cost bailment agreement with TSA that will address the responsibilities and liabilities of the parties for the equipment while in the custody of the TSA during the Qualification Process. The QPL Contracting Officer (CO) will provide a no-cost bailment agreement to the QPL Applicant for review and signature upon CDP/QDP approval. QPL Applicants will continue to be responsible for meeting all steps of the Qualification Process outlined in this QPL Announcement. TSA will require at least six (6) production representative systems throughout the Qualification Process regardless of which step the QPL Applicant starts at. The QPL Applicant will be required to move the systems as required for each testing activity:

• Three (3) systems will be needed for CERT.

• An additional three (3) systems will be need for Qualification testing (QT).

• Of the six (6) systems mentioned above, four will be used for future field testing after CERT and QT are completed; one (1) system will remain at the Transportation Security Laboratory (TSL) and one (1) system will remain at the TSA System Integration Facility (TSIF) throughout the Qualification Process.

1 Vendors may begin at Step 3 or Step 5 as discussed in Section 1.1 “Establishment of the ETD Qualification Process.”

SECTION 2 – QPL QUALIFICATION PROCESS

2.0 Qualification Process

The intention of the Qualification Process is to test and qualify systems to TSA standards, verify an executable manufacturing process, ensure operational supportability with particular attention to minimizing the logistics footprint, implement Human Systems Integration (HSI), ensure affordability, and demonstrate system interoperability, safety, and utility.

Any QPL Applicant interested in having a system qualified under the ETD Qualification Process must successfully meet both the requirements and the timeline for each step in the ETD Qualification Process outlined in this announcement and as detailed in the ETD QMP.

Systems submitted under the ETD QPL are required to pass multiple levels of testing and receive approval by the TSA. All ETD systems proposed by the respective QPL Applicant to meet the identified requirements under the ETD QPL will be required to pass all steps of the Qualification Process. If any of the deadlines in this document are missed, the system will be removed from consideration.

The table below outlines the milestones associated with the Qualification Process. Details regarding submission requirements are outlined in the sections below:

ETD QPL Process Milestones

Activity

Due Dates (Days refers to calendar days)

Submission Instructions Note

QPL Applicant requests access to Sensitive Security Information (SSI) / Classified Documents

No Later Than (NLT) 20 days after SAM.gov posting

See Sections 2.2.1 and 2.2.2 Limited to 10 employees

QPL Applicants submit questions related to this QPL

NLT 45 days after SAM.gov posting

Submit questions to:

Jessica.seay@tsa.dhs.gov, marilyn.gray@tsa.dhs.gov and jeanette.man@tsa.dhs.gov with Subject “ETD QPL Questions”.

CDP Submission

Within 365 days from SAM.gov posting (N/A if vendor is already certified)

Mail two thumb drives.

One in care of Jagdeep Talwar to:

FAA/Frank A. LoBiondo Technical Center Transportation Security Laboratory, Bldg. 315 Atlantic City International Airport Atlantic City, NJ 08405

And mailto:Jessica.seay@tsa.dhs.gov mailto:marilyn.gray@tsa.dhs.gov mailto:jeanette.man@tsa.dhs.gov

Activity

Due Dates (Days refers to calendar days)

Submission Instructions Note

One in care of Elaine Jappinga to:

TSIF/TSA Mail Stop 6015 3701 Post Office Rd Arlington, VA 20598–6015

CDP Resubmission

30 days from notification of CDP not being accepted

Same as CDP Submission A single CDP may be submitted three (3) times, including the initial submission

Bailment Agreement for CERT, QT and Initial Operational Test and Evaluation (IOT&E) Systems

TBD To be provided by QPL CO for review and signature.

QDP Submission

30 days after passing CERT if not previously certified

Mail one thumb drive in care of Elaine Jappinga to:

TSIF/TSA Mail Stop 6015 3701 Post Office Rd Arlington, VA 20598–6015

Within 365 days from SAM.gov posting (if already certified)

QDP Resubmission

30 days from notification of QDP not being accepted

Same as QDP Submission A single QDP may be submitted three (3) times, including the initial submission

2.1 Step 1: Announce ETD QPL

The TSA is posting this notice on the System for Award Management (SAM.gov) to initiate the ETD Qualification Process.

To be considered under this Announcement, QPL Applicants must adhere to the Qualification Process Steps outlined in this document and in all supplemental documents and be able to meet the TSA Classified and SSI vetting requirements. Supplemental documents will be provided separately to those QPL Applicants authorized to obtain access to these documents as outlined in Section 2.2.

2.2 Step 2: Release Requirements Documents

To participate in the ETD Qualification Process, QPL Applicants will need access to the below Classified, SSI, and Unclassified documents. These documents are limited to QPL Applicants who are ETD OEMs. QPL Applicants will be granted access to these documents only after vetting has been completed.

• ETD QMP – Unclassified. The QMP will provide the following information:

• Instructions for CDP submission

• Instructions for QDP submission

• CDP Evaluation Process Overview

• QDP Evaluation Process Overview

• Overview for the Qualification Process

• Configuration Management Plan (CMP) for Office of Acquisition Program Management, Version E, August 31, 2018 - Unclassified

• DHS/ST/TSL-20/05 Certification Management Plan for Test and Evaluation of Explosives Trace Detector for Checkpoint and Checked Baggage Screening, Version 2.0, June 28, 2023

- SSI

• ETD Functional Requirements Document (FRD) 2.0 - SSI

• ETD Memo.AD-6.2-6.3 Modification_SSI_FINAL_02.22.2021_Component Acquisition

Executive (CAE) signed - SSI

• ETD Detection Standard 5.0 - Classified

• ETD Detection Standard 6.2 - Classified

• ETD Detection Standard 6.3 - Classified

Due to the sensitivity of this information, these documents cannot be posted to SAM.gov. To access Classified documents, QPL Applicants must have a Facility Clearance Level (FCL), also known as an industrial security facility clearance. In addition, QPL Applicants also must obtain an administrative determination by the Defense Security Service (DSS) indicating that a QPL Applicant’s facility is eligible for access to classified information of a certain category and all lower categories. Department of Defense (DD) Form 254 applies to the cleared facility. Lastly, QPL Applicants must provide verification they are an ETD OEM. See Section 2.2.2 for instructions. To access SSI, QPL Applicants must obtain TSA authorization. The process to gain access to SSI is provided in Section 2.2.1 below.

QPL Applicant Vetting is anticipated to take approximately three (3) weeks (additional time is required for vetting Foreign Nationals). TSA requests that vetting submissions to be limited to no more than 10 employees. QPL Applicants are required to submit their SSI vetting request to review the applicable requirements documents no later than 20 days after the SAM.gov posting.

Another opportunity to request authorization to access these documents will not be offered. QPL Applicants may add or remove a total of two (2) people from the SSI approval list anytime throughout the Qualification Process. However, any requests for individuals to be added must first be approved by the CO prior to initiation, and these individuals will be required to be vetted in accordance with the process stated within this announcement.

2.2.1 Request for SSI

A. As part of the Qualification Process, TSA may allow QPL Applicants access to SSI. SSI is information that, if publicly released, would be detrimental to transportation security, as defined by Federal Regulation 49 C.F.R. Part 1520. SSI may be available to QPL Applicants in preparing responses to this announcement. Potential applicants must obtain specific authorization in order to obtain SSI. SSI will not be available, provided, or disclosed to any person not specifically authorized to receive it. SSI provided under this announcement may only be used to satisfy ETD Qualification Process and acquisition requirements.

B. TSA will review SAM.gov to ensure that the QPL Applicant would not otherwise be precluded from receiving a potential future contract award. While this review does not replace the responsibility determination required by FAR part 9, it may prohibit QPL Applicants from receiving SSI during the Qualification Process.

C. As part of this process, SSI may only be accessed by individuals who have successfully passed a Security Threat Assessment. This assessment may include a verification of site facility clearance in the National Industrial Security Program (NISP), a contractor suitability determination or other federal background investigation, individual security clearance(s), and, if required, a criminal history records check (CHRC) and/or a check against terrorism databases.

D. QPL Applicant Responsibilities.

1. Senior Official (SO). Each QPL Applicant needing access to SSI under this announcement must separately identify in writing to the Contracting Officer a single, senior official who will serve as the single point of contact for the sensitive information. The SO must attest that: all appropriate protections will be followed; only authorized individuals will have access to the sensitive information; and that those individuals provided access to the SSI adequately understand their responsibilities to protect the information. The SO must also attest to the CO every 60 days that all appropriate protections have been followed, only authorized individuals have access to the sensitive information, and that those individuals with access adequately understand their responsibilities to protect the information. A copy of each attestation shall also be emailed to RFP.Access@tsa.dhs.gov and include the applicable solicitation number. The SO shall also ensure that the CO is notified of staffing changes or circumstances in which any individual previously authorized access to SSI under this announcement no longer needs that access.

2. Information Requirements. The SO must provide the following information via email to RFP.Access@tsa.dhs.gov:

a. The Commercial and Government Entity (CAGE) code of the QPL Applicant’s facility that will manage the proposal, the Applicant’s Unique Entity Identifier (UEI), and Applicant’s address; and

b. In a single password protected Microsoft Excel spreadsheet emailed to the Contracting Officer, with the password for the password protected spreadsheet sent separately but at the same time:

• Employee Full Name Employee Birth Date

• Employee Citizenship

• Indication of whether each nominated employees has:

o Previously received a TSA suitability determination, o Undergone a federal background investigation, or o A Federal Government security clearance.

c. While not required in the original information provided by the SO, in rare instances an individual’s Social Security Number may be required. In those instances, the SO will receive an email from RFP.Access@tsa.dhs.gov requesting the Social Security Number for the select individual(s). The SO must provide the requested information back to RFP.Access@tsa.dhs.gov in a password protected document using the same password previously provided.

mailto:RFP.Access@tsa.dhs.gov

3. Non-Disclosure Agreements. Each QPL Applicant employee requesting access to SSI as specified herein will be required to execute a TSA Non-Disclosure Agreement, entitled

“TERMS AND CONDITIONS FOR ACCESS TO SENSITIVE SECURITY

INFORMATION NON-DISCLOSURE AGREEMENT (TSA Form 2815). The executed forms shall be provided with and as part of the submission of information reflected in Paragraph 2 above. The QPL Applicant should understand that employees granted access to SSI and signing a non-disclosure agreement are bound by the terms of that agreement indefinitely, notwithstanding their employment status or any other background checks or clearances granted by any Government agency. Additionally, submission of the Non- Disclosure Form (TSA Form 2815) in the pre-award phase is not a substitute for such a requirement for submission of the Non-Disclosure Form post-award using the DHS Form 11000-6.

4. Return of SSI. Any SSI provided for purposes of this solicitation must be returned to the

Government or destroyed and verified by the Government. Electronic records shall be properly destroyed by the QPL Applicant using any method that will preclude recognition or reconstruction, and attestation of destruction shall be provided to the Contracting Officer. For QPL applicants, any SSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

E. Privacy Act Statement. TSA will use the information provided to conduct a security threat assessment on individuals who seek access to SSI. The information will be shared within the Government with personnel who need the information to perform their official duties.

Additionally, the Government may share the information with law enforcement, intelligence, or other government agencies as necessary to identify and respond to potential or actual threats to transportation security in accordance with the routine uses identified in the applicable Privacy Act System Of Records Notice (SORN), DHS/TSA 002, Transportation Security Threat Assessment System (T-STAS). This SORN was last published in the Federal Register on August 11, 2014, and can be found at 79 FR 46862-46866. Authority: 49 USC114. Furnishing this information is voluntary. However, failure to furnish the requested information may delay or prevent the completion of your security threat assessment, without which you may not be granted access to the SSI.

F. Notification of Assessment. Individuals who receive a successful Security Threat Assessment (STA) will be eligible to receive SSI. If it is determined that covered individuals are not eligible to receive access to particular SSI based on the STA, TSA will provide notification to the company point of contact that the individual does not qualify to receive SSI. In the event that an individual is denied access to SSI and believes that the results of the STA are inaccurate, he or she may appeal that determination and petition to have erroneous information corrected with the Transportation Security Redress Branch. However, due to the demanding qualification schedule, TSA will not delay the Qualification Process to resolve redress issues. Therefore, while an individual may appeal the threat assessment determination, that appeal may not be resolved in time for this Qualification Process. As an alternative, however, the potential QPL Applicant may nominate another individual to receive SSI access.

2.2.2 Request for Classified National Security Information (CNSI) o Under this announcement, the QPL Applicant may access classified material at the TSA headquarters and/or at a QPL Applicant’s facility.

o Only QPL Applicants who possess a valid Personnel (Security) Clearance Level (PCL) https://www.dhs.gov/publication/access-sensitive-security-information-contract-solicitations-ssi https://www.dhs.gov/publication/access-sensitive-security-information-contract-solicitations-ssi https://www.dhs.gov/publication/access-sensitive-security-information-contract-solicitations-ssi https://www.dhs.gov/publication/access-sensitive-security-information-contract-solicitations-ssi will be authorized to discuss or read classified materials at TSA headquarters only.

o Only QPL Applicants who provide verification they are an ETD OEM, possess a valid

Facility (Security) Clearance (FCL) and PCL will be authorized to receive and store CNSI at their facility in order to develop a QDP.

o To access Classified National Security Information (CNSI), a QPL Applicant must have an approved DD Form 254 for each company that will participate in the Qualification Process. If an existing approved DD Form 254 specific to the TSA is not available, a DD Form 254 approval request must be submitted within 30 days of this posting.

o Information Requirements. The Senior Official shall provide the following information via email (note that this requirement applies likewise to any prospective subcontractor, joint venture partner, or “team” entity (collectively, agents) whose access to the specified CSNI is necessary):

*QPL Applicant Name *QPL Applicant CAGE Code *QPL Applicant Facility Security Officer’s Name *QPL Applicant Facility Security Officers Phone Number *QPL Applicant Facility Security Officer’s Email *QPL Applicant ETD product name *Request to access classified material at the TSA headquarters and / or at a QPL Applicant’s facility o Issuance of a DD Form 254 is anticipated to take approximately six (6) weeks (additional time for Foreign Nationals). Once the DD Form 254 is approved, the Senior Official will receive notification of approval and the applicable requirement documents will be provided to the QPL Applicant point of contact.

o The DD Form 254 must be approved for each QPL Applicant before CNSI is available or otherwise provided or disclosed to any QPL Applicant.

o The QPL Applicant shall store and safeguard classified material in accordance with Executive Order 13526, Classified National Security Information, and its Implementing Directive 32 CFR Part 2001 at the SECRET level in support of program office requirements. Additionally, in accordance with the Department of Defense (DOD) Manual 5220.22-M, “National Industrial Security Program Operating Manual (NISPOM) for Safeguarding Classified Information,” Chapter 5, Section 5-502, the QPL Applicant is authorized to disclose TSA classified information to cleared agents when access is necessary to perform tasks or services related to the Qualification Process. In accordance with the NISPOM, Chapter 5, Section 5-506, the QPL Applicant shall not disclose classified information received or generated under this TSA Qualification Process to any other Federal agency unless specifically authorized in writing by the TSA Program Office that has classification management jurisdiction over the information and the TSA points of contact Marilyn Gray (marilyn.gray@tsa.dhs.gov) or Jeanette Man (jeanette.man@tsa.dhs.gov).. In accordance with the NISPOM, Chapter 5, Section 5-509, the QPL Applicant shall not disclose classified information to an agent except to support the Qualification Process or for another TSA purpose.

o Any future contract awards to QPL Applicants added to the ETD QPL will be subject to FAR Clause 52.204-2 to the extent the contract involves access to information classified as “Secret.”

o For QPL applicants, any CNSI shall be returned/destroyed upon notification of either acceptance or rejection to the QPL.

2.3 Step 3: CDP Submission

CERT is the formal test that is administered to all candidate systems under the strictest controls possible. QPL Applicants must submit a CDP to be considered for CERT. CERT includes evaluating the detection rates of defined threats in the TSA DS via direct deposit sampling and swabs of test surfaces. Instructions for completing CDP requirements are provided in the QMP and the Certification Management Plan. Testing will be conducted at the TSL against the requirements set forth in the applicable DS. The results from this testing inform the TSA Program Office whether the equipment has met all of the detection performance requirements in the relevant TSA DS. Successful completion of this testing results in a TSA Certification Memorandum which identifies the approved system configuration. After completion of CERT, the QPL Applicant system configuration is established based on those components that may affect detection performance and include, but is not limited to, system hardware, software, and algorithms. No system modifications will be allowed after the completion of CERT without written approval from the Government.

To start, the QPL Applicant shall generate a CDP for submission into the TSA Qualification Process. The CDP shall be submitted within 365 days of the QPL opening. The QPL Applicant must submit two (2) copies of the CDP on two (2), separate thumb drives. One (1) thumb drive should be mailed to each of locations below (two total submissions):

One in care of Jagdeep Talwar to:

FAA/Frank A. LoBiondo Technical Center Transportation Security Laboratory, Bldg. 315 Atlantic City International Airport Atlantic City, NJ 08405

-and-

One in care of Elaine Jappinga to:

TSIF/TSA Mail Stop 6015 3701 Post Office Rd Arlington, VA 20598–6015

Please send an email with the tracking number to marilyn.gray@tsa.dhs.gov and jeanette.man@tsa.dhs.gov with Subject “ETD QPL CDP Submission – Vendor and System Name” to notify TSA you have mailed the CDP thumb drives, and TSA will notify the QPL Applicant once they have been received.

The TSA will evaluate CDPs as noted within the QMP. If the QPL Applicant’s initial CDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within 30 calendar days of when they were informed the CDP was not accepted. The QPL Applicant may resubmit their CDP a maximum of two (2) additional times. The formal acceptance or rejection of the CDP will be provided by Marilyn Gray (marilyn.gray@tsa.dhs.gov) or Jeanette Man (jeanette.man@tsa.dhs.gov).

Upon approval of the CDP the QPL Applicant will be required to enter into a bailment agreement as discussed in Section 1.3 above, which will require the delivery and installation of the first three

(3) systems to the TSL within 10 business days of execution.

If a QPL Applicant’s system has already passed CERT, they should begin at Step 5 “QDP Submission.”

2.4 Step 4: System Testing and Certification Testing

System Testing and CERT are described in the subsections below.

2.4.1 Step 4a: System Testing

System Testing is conducted by the QPL Applicant to verify that their system meets technical requirements defined in the QMP. This testing event will determine the maturity of the system design to meet the TSA requirements and will be used to determine system readiness. This testing will be performed at the QPL Applicant’s facilities and/or a third-party test organization facility at the QPL Applicant’s cost.

The QPL Applicant shall conduct internal system testing in accordance with the QPL Applicant’s System Test Plans and Procedures and Appendix B of the ETD QMP, ETD QPL Applicant Required Substantiation. The QPL Applicant shall procure or fabricate any special test articles and instrumentation for such tests. The QPL Applicant is responsible for contacting, communicating expectations, and acquiring results or reporting documentation for any third-party testing utilized during the System Testing phase. The QPL Applicant must verify that any third-party testers utilized are reputable and industry leaders in the field of verification.

It is the QPL Applicant’s responsibility to ensure the testing adequately verifies the requirement and that the data and documentation provided by the third-party tester is thorough and complete.

2.4.2 Step 4b: Certification Testing

During CERT, the QPL Applicant shall submit three proposed systems for testing at the TSL via the aforementioned bailment and may be called upon for technical and maintenance support, as required. However, the QPL Applicant will not be permitted in the immediate test area unless requested by the TSL Test Director.

All systems seeking qualification under the ETD QPL Window will be required to undergo and pass CERT against the identified ETD DS. The QPL Applicant must meet all detection requirements in order to pass CERT. If an QPL Applicant’s system fails the detection requirement, the QPL Applicant must resubmit for CERT at a future time as coordinated with the TSL.

Each QPL Applicant will be allowed a maximum of two (2) attempts at CERT once their respective data package has been accepted. A CERT failure is defined as the presence of deficiencies that warrant correction, as determined by TSA, prior to proceeding to the next phase of the QPL.

Upon successful completion of CERT, the TSA will provide the QPL Applicant a Certification Letter that identifies the system baseline and level of certification that is achieved.

The systems shall have the same configurations with respect to components that could affect detection performance, including system hardware and software after the completion of CERT.

No system modifications will be allowed after the completion of CERT without written approval from the Government.

2.5 Step 5: Qualification Data Package Submission

The QPL Applicant shall generate a QDP for submission into the TSA Qualification Process.

The QDP shall be submitted within 30 days of notification the system has passed CERT or within one (1) year of the QPL opening if the system is already TSA Certified. It shall be submitted on a thumb drive and mailed to:

C/O Elaine Jappinga TSIF/TSA Mail Stop 6015

3701 Post Office Rd Arlington, VA 20598–6015

Please send an email with the tracking number to marilyn.gray@tsa.dhs.gov and jeanette.man@tsa.dhs.gov with Subject “ETD QPL QDP Submission – Vendor and System Name” to notify TSA you have mailed the QDP thumb drive and TSA will notify the QPL Applicant once it has been received.

The TSA will evaluate QDPs as noted within the QMP. If the QPL Applicant’s initial QDP is not approved, the QPL Applicant will be allowed to update and resubmit their package within 30 calendar days of when they were informed the QDP was not accepted. The QPL Applicant may resubmit their QDP a maximum of two (2) additional times. The formal acceptance or rejection of the QDP will be provided via email by Marilyn Gray (marilyn.gray@tsa.dhs.gov) or Jeanette Man (jeanette.man@tsa.dhs.gov).

If accepted by TSA, the QPL Applicant’s system will continue into Step 6a: QT and Step 6b:

Cooperative Vulnerability Penetration Assessment (CVPA). The QPL Applicant must be prepared to install the testing systems at TSIF within 10 business days of acceptance notification, as stipulated in the aforementioned bailment. If the QPL Applicant is starting at this step, they will need to execute a bailment agreement as outlined in section 1.3, then be prepared to deliver and install one (1) system at TSL and three (3) systems to the TSIF within 10 business days of bailment execution.

In the QDP, the QPL Applicant shall provide all test data and results to TSA for performance evaluation and to assist in the QDP acceptance decision. The QPL Applicant shall document any major issues experienced during System Testing and document any system modifications which could impact previously completed, ongoing, or upcoming test events. TSA will review System Test results as part of reviewing and accepting the QDP.

The QPL Applicant’s QDP must contain the required information as outlined in the QMP and be presented in a manner that is clear, concise and unambiguous. QPL Applicants must use proprietary and SSI markings according to standard marking procedures. SSI must be handled according to the requirements of 49 CFR Part 1520. TSA has instituted procedures to safeguard proprietary data that are used during the ETD QDP evaluation. The QDP will become a part of the official records of compliance testing for each system submitted.

The level of substantiation that needs to be submitted for each requirement is outlined in the ETD QMP. Complete identification of the systems used to collect the substantiation data must be provided in the QDP and match the system being proposed for TSA testing. This includes:

a) Model number(s) of equipment tested.

b) Serial number(s) of equipment tested.

c) Software version(s), including reconstruction and inspection software components.

d) Firmware version(s), if applicable.

e) An inventory of hardware Configuration Items (CIs), software CIs, and firmware CIs with configuration identification as instructed through the Master Configuration Item List (MCIL) section.

f) Identification of all configurable and adjustable parameters and adaptation data used to tailor the system, as well as their settings and values. Adaptation data refers to variables used to configure or adjust the system to specific environments or uses. Unless required by the tests, all tests shall be conducted with the same parameter and adaptation settings.

If changes to calibration settings or variable parameters are required, these must be clearly indicated along with an explanation for the changes.

g) Provide the United States equivalent if substantiation calls out European standards.

The QDP shall contain System Requirements, Architecture Documentation, Cybersecurity Documentation, a Life Cycle Support Concept, MCIL, cybersecurity information of the QPL Applicant development/test environment, the system’s technical manuals, maintenance manuals and operator manuals, and additional configuration management documentation, as detailed in the QMP. As a clarification, the cyber testing scope (CVPA) will assume an adversary with physical access to all ETD systems with varying access to system software. Though cybersecurity information of the QPL Applicant development/test environment is requested, the TSA Test and Evaluation (T&E) scope will not consist of cyber testing in the QPL Applicant facility. The QDP shall also contain the Test Reports from QPL Applicant System Testing as verification of system readiness to proceed into QT.

The system configuration, inclusive of software and algorithms, described in the QDP must match the system configuration that was certified by TSA. The TSA will evaluate QDPs as noted within the QMP. If changes are made to the system after QDP acceptance and QT testing starting, the QPL Applicant shall submit a Developmental Engineering Proposal (DEP). The QPL Applicant may submit up to two DEPs per QT attempt. QT testing will not begin until TSA funding has been approved, and TSA funding is limited to the first five (5) QPL Applicants’ QDPs accepted for QT.

TSA will not accept any additional QPL Applicant QDPs after the first five (5) QDPs have been accepted by TSA.

The QDP will be evaluated by the Government for thoroughness and adequacy based on the requirements outlined in the QMP to enter QT. Once approved, the QDP is the design basis in which the system baseline is established by the Physical Configuration Audit (PCA) for the remainder of the Qualification Process.

2.6 Step 6: Implementation Testing

The goal of Step 6 is to ensure the system meets requirements specified in the ETD FRD Version 2.0, is ready to proceed into IOT&E, and will not pose any operational, safety or security risks.

During Step 6, the Government shall execute testing against requirements, assigned by the QT Test Director and System Evaluator, as a verification test source. Testing for Step 6 will be tailored to these requirements and all efforts will be made to evaluate each System Under Test (SUT) in an identical manner.

2.6.1 Step 6a: Qualification Testing

QT is conducted by the TSA at the TSIF to assess system performance against functional requirements in a laboratory environment.

The QPL Applicant will not be permitted to witness QT. However, the QPL Applicant may be called upon for test team training, on-site technical support, cyber security verification activities (e.g., questions on security controls) and maintenance, or troubleshooting of system malfunctions, as required.

Except for Field Data Reporting System (FDRS) and log files, the QPL Applicant shall not conduct data recording (logging) of test events or test objects. All image files, FDRS and log files generated during QT will be the property of the Government or will be purged from the system upon completion of the tests by the Government. The QPL Applicant will not be permitted to wipe any data from test equipment without the explicit approval of either Marilyn Gray (marilyn.gray@tsa.dhs.gov) or Jeanette Man (jeanette.man@tsa.dhs.gov), in writing, during a maintenance visit or at completion of QT.

Each QPL Applicant will only be allowed one attempt at QT once their respective data package has been accepted. A second attempt may be possible if TSA funding is available, and if TSA has not yet already accepted five (5) QDPs.

Installation of the three test systems at the TSIF is inclusive of non-scanner related accessories to support checkpoint operations (e.g., consumables). After installation is complete, the QPL Applicants must provide their signed Test Readiness Notification (TRN) to TSA to begin QT.

TRNs shall be sent to TSA via email at jeanette.man@tsa.dhs.gov and marilyn.gray@tsa.dhs.gov with the Subject: “ETD QPL TRN TSIF – Vendor and System Name,” whereupon TSA will confirm receipt.

All prospective QPL Applicant systems must successfully complete QT to continue the Qualification Process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. To determine successful completion, in accordance with the QMP, the TSIF Test Branch will produce a QT Report after test completion, where the TSA will make a determination if the system has successfully passed the tests. The next steps in the process will also be provided and may include termination, deficiency investigation, correction, or continuation through the Qualification Process. TSA reserves the right to deny or terminate the Qualification Process for systems that do not successfully pass QT.

2.6.1.1 Qualification Testing Failures

QT Failure is defined as the presence of deficiencies that warrant correction prior to proceeding to the next phase of the QPL. The TSIF Test Branch will track and document all SUT failures, malfunctions and/or anomalies encountered during QT. The TSIF Test Branch will review observed issues that affect testing activities and will coordinate with the QPL Applicant for resolution of any required corrective actions for critical failures.

QT will be suspended if the SUT malfunctions or has a critical failure that impedes the progress of testing and cannot be repaired or replaced within five calendar days of QPL Applicant notification or a time frame specified by TSA. Repeated critical failures, or a critical failure that remains unresolved, may also result in suspension or termination of testing if the overall QT schedule is negatively affected. If it is determined at any time during QT that the SUT fails to meet requirements to a degree the prevents the system from proceeding to IOT&E, testing may be suspended or terminated, and the QPL Applicant will be notified by TSA.

TSA may perform a CERT re-test or regression test following a repair or replacement of parts, or after any hardware/software modification if modifications to the system are determined to have an impact on the detection capability.

The Government reserves the right to remove any QPL Applicant from QT and require third-party substantiation of QPL Applicant fixes if TSA determines the Transportation Security Equipment (TSE) has significant issues that will prevent passing QT or IOT&E.

2.6.2 Step 6b: Cooperative Vulnerability Penetration Assessment The CVPA consists of the TSA cyber team scanning the Applicant’s ETD to identify any cybersecurity vulnerabilities associated with the Operating System (OS). The cyber team will also conduct a limited manual penetration assessment that will look at the ports and other attack surfaces (physical access) to try to break into the OS via the Graphical User Interface (GUI); and overall determine if there any vulnerabilities associated with the physical access to the system.

There will be additional data needed such as administrative credentials to access root OS, and TSA will work directly with the Applicant to gather the information at this stage.

2.7 Step 7: Conduct Initial Operational Test and Evaluation

After notification of successfully passing QT, the QPL Applicant must successfully complete the shipment and installation of four (4) ETD test systems (two (2) units from TSL and two (2) units from TSIF) to the first selected field site for IOT&E as stipulated in a modification to the aforementioned bailment agreement. Delivery and installation must be completed within 10 business days of TSA notification of which field site will be used. QPL Applicants will be notified via email by TSA of all the finalized field test locations after TSA completes the QDP review and approval process. QPL Applicants should be prepared for up to five (5) testing sites at any airport throughout the 50 states. The testing schedule will be arranged with each QPL Applicant as they reach this step. Schedules will need to be adjusted based on airport need and any testing blackout periods. All QPL Applicants will be tested at the same airports and for the same number of testing days. Installation of these systems is inclusive of accessories to support screening operations (i.e., consumables to run 750 tests, per machine, per site).

QPL Applicants must provide their signed TRN to begin Field Testing. TRNs shall be sent via email to TSA at jeanette.man@tsa.dhs.gov and marilyn.gray@tsa.dhs.gov with the Subject: “ETD QPL TRN XXX (airport code) – Vendor and System Name,” whereupon TSA will confirm receipt.

All prospective QPL Applicants must successfully complete IOT&E to continue the Qualification Process. Completion will be documented by the Test Lead signing a confirmation that the QPL Applicant has completed this step. In accordance with the QMP and after Field Test completion, TSA will make a determination if the system has met all of the field test objectives successfully to ensure the system under test is installed, integrated, and ready to proceed to IOT&E. TSA reserves the right to deny or terminate the Qualification Process for systems that do not successfully pass the Field Test.

2.7.1 Initial Operational Test & Evaluation Failure

In the event the proposed system does not pass testing or is suspended, the system will be removed from the Government test site(s).

2.7.2 Initial Operational Test & Evaluation Reporting

All QPL Applicant systems must successfully complete IOT&E. After IOT&E, and in accordance with the QMP, the TSA will make a determination if the system has successfully met the IOT&E objectives by reviewing the System Evaluation Report (SER) generated by the System Evaluator post IOT&E that will document operational effectiveness, suitability, and resilience and will identify any deficiencies. The System Evaluator will submit the SER to TSA.

The TSA will review the SER and may or may not share details with the QPL Applicant. The QPL Applicant will be notified of test results after the conclusion of the IOT&E reporting period. The TSA will also advise the QPL Applicant of required next steps in the process, which may include termination and/or deficiency investigation/correction.

2.8 Step 8: Placement on the QPL

In accordance with the QMP, systems will be placed on the QPL post successful IOT&E with a satisfactory finding and approval from the CAE. Once a system is added to the QPL, it is considered “Qualified”, and TSA will provide the QPL Applicant with a Qualification Letter.

TSA and other DHS components may issue Requests for Proposals (RFPs) for ETD requirements in accordance with FAR Part 6. However, the system proposed must be on the ETD QPL in accordance with FAR 52.209-1 Qualification Requirements.

3.0 Applicable QPL Clauses

Applicable QPL Clauses for Handling Classified, SSI, and Controlled Unclassified information are included in the following subsections.

3.1 Additional TSA Security Terms

A. Clearance Level. The ETD Qualification Process requires security clearance at the Secret level.

B. Access to Classified Information. QPL Applicant personnel are required to have access to classified information at the Secret level.

C. Place of Performance. The location of performance where classified information will be accessed, produced, safeguarded, or stored is as identified below:

SSI and Classified information provided via the process noted in Section 2. Document Release Requirements and accessed at QPL Applicant’s facility.

If the QPL Applicant supports other Federal Government agencies on classified contracts at the same facility, the TSA classified material shall be stored alone in a separate, GSA-approved safe.

Classified information pertaining to other Government agencies shall not be stored with the TSA classified information.

3.2 Requirements and Duties for Handling Sensitive Security Information (SSI) TSA may deliver SSI materials to the QPL Applicant. Also, materials created by the QPL Applicant may require SSI designation and protection; the QPL Applicant has the responsibility to identify such materials to TSA as possible SSI. To ensure regulatory compliance, the QPL Applicant shall be subject to the following requirements and include this entire requirement as flow-down in all subcontracts, etc.:

A. Non-Disclosure Agreements (NDAs). DHS Form 11000-6, NDAs are required to be signed by all QPL Applicant personnel when access to SSI is necessary for performance during the QPL Process. By signing the NDA, the recipient certifies in writing that they will take the necessary steps to prevent the unauthorized disclosure and use of information.

B. Request for Access to SSI materials. Pursuant to 49 C.F.R. § 1520.9(a)(3), the QPL

Applicant must contact SSI@tsa.dhs.gov for guidance on handling requests to access to SSI (before using SSI materials) for any other purpose besides activities falling within the scope of the QPL Process by other persons, including requests from experts, consultants, and legal counsel (“requesters”) hired by the QPL Applicant. The QPL Applicant shall include the Contracting Officer (CO) and Contracting Officer Representative (COR) as a carbon copy “cc” recipient of its contact to SSI@tsa.dhs.gov . The TSA SSI Office must first make a mailto:SSI@tsa.dhs.gov mailto:SSI@tsa.dhs.gov determination as to whether the requesters are a “covered person” with a “need to know” under 49 C.F.R. §§ 1520.7 and 1520.11. Special request processing and handling requirements apply to QPL Applicant employees who may be foreign nationals. The QPL Applicant must clearly identify any employees who are not U.S. citizens who are otherwise requested to have access to SSI; the requirements of TSA Management Directive 2810.3 “Management of Foreign Access to Sensitive Information” apply.

C. Training and Certification. All QPL Applicant personnel who are “covered persons” with a need-to-know must complete the TSA-mandated SSI Awareness Training course prior to accessing SSI, and on an annual basis for the duration of the QPL process or for the duration of the requester’s need for access to SSI, whichever is later. QPL Applicant personnel must also review and adhere to the SSI Quick Reference Guide for DHS Employees and Contractors. The QPL Applicant shall provide an email to the Contracting Officer annually that all covered persons have completed the mandated SSI training, that all SSI policies and procedures have been followed, and that those individuals with access understand their responsibilities to protect the information.

D. Breach. In accordance with 49 C.F.R. § 1520.9(c), the QPL Applicant agrees that in the event of any actual or suspected breach of SSI (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the QPL Applicant shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer and the COR. The QPL Applicant is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government officials.

In the event that an SSI breach occurs as a result of the violation of a term of the QPL process by the QPL Applicant or its employees, or the QPL Applicant’s covered persons, the QPL Applicant shall, as directed by the Contracting Officer, at no cost to the Government, and without delay correct or mitigate the violation.

For unauthorized disclosure of SSI, the QPL Applicant and its employees, agents, or other covered persons may also be subject to civil penalties and other consequences as set forth in 49 CFR § 1520.17.

The QPL Applicant shall include the terms of this special requirement in all subcontracts or other agreements awarded under this QPL process.

3.3 NOTIFICATION TO QPL APPLICANTS OF TSA CONTRACTOR ACCESS

TO PROPOSAL

QPL Applicants are advised that employees of the firms identified below may have access to proposals submitted under this QPL process. These individuals will be authorized access to only those portions of proposal data and discussions that are necessary to enable them to perform their respective duties. Such firms are expressly prohibited from competing on any subsequent acquisitions.