FOMCUS BPA SOO_DRAFT.docx

Transportation Security Administration

Information Technology

Federal Operations & Maintenance for Continuous User Support (FOMCUS) Blanket Purchase Agreement (BPA) Statement of Objectives Solicitation #

October 23, 2025 Version 1

DRAFT

Request for Proposal – FOMCUS BPA SOO

Solicitation #

DRAFT

THIS DOCUMENT CONTAINS ACQUISITION-SENSITIVE INFORMATION – See FAR 2.101 and 3.104 This document contains acquisition-sensitive information related to the conduct of a Federal Agency procurement, the disclosure of which is restricted by Section 27 of the Office of Federal Procurement Policy Act (41 U.S.C. §423). The unauthorized disclosure of such information may subject both the discloser and the recipient of the information to contractual, civil and/or criminal penalties as provided by law.

THIS PAGE INTENTIONALLY LEFT BLANK

THIS DOCUMENT CONTAINS ACQUISITION-SENSITIVE INFORMATION – See FAR 2.101 and 3.104 This document contains acquisition-sensitive information related to the conduct of a Federal Agency procurement, the disclosure of which is restricted by Section 27 of the Office of Federal Procurement Policy Act (41 U.S.C. §423). The unauthorized disclosure of such information may subject both the discloser and the recipient of the information to contractual, civil and/or criminal penalties as provided by law.

Table of Contents

1. Introduction The Transportation Security Administration (TSA) is a high-performing counterterrorism organization, providing the most effective security in the most efficient way. In support of TSA’s mission, the TSA Chief Information Officer (CIO) is responsible for providing world-class information technology services.

Purpose The purpose of this Statement of Objectives (SOO) is to establish a multi-award Blanket Purchase Agreement (BPA) for the procurement of robust and scalable IT support services for TSA. These services will advance TSA ITs strategic mission goals to modernize IT operations, enhance service delivery, and strengthen the agency’s ability to meet evolving challenges. The BPA will enable TSA to leverage innovative technologies, improve decision-making through data analytics, and enhance customer experience.

Scope The BPA will cover IT support services across TSA’s enterprise, including approximately 85,000 Federal employees, contractors, and support personnel at various sites. Services will be provided at TSA Headquarters, field sites (airports, Federal Security Director offices, Federal Air Marshal Service offices), training sites, international support sites, Freedom Center, TSA Systems Integration Facility (TSIF), Continuity of Operations (COOP) sites, data centers, cloud environments, and other TSA locations.

The scope will include specialized functional areas to support TSA’s IT infrastructure, operations, and cybersecurity needs. The BPA will allow for the integration of emerging technologies, such as artificial intelligence (AI), machine learning (ML), and automation, to enhance TSA’s IT capabilities.

The scope covers all Operations, Maintenance, and Support for all technologies in the TSA IT environment and end user support. TSA IT is constantly deploying new technologies and decommissioning old technologies to address the ever-changing threats to transportation security.

The BPA will encompass four core functional areas. All task orders issued under this Blanket Purchase Agreement (BPA) shall adhere to industry-standard program and project management practices, including but not limited to ITIL (Information Technology Infrastructure Library) frameworks and ISO/IEC 20000 standards for IT service management. Additionally, all task orders must align with the established enterprise architecture guidelines and incorporate robust data handling and protection measures to ensure compliance with applicable federal regulations and security requirements.

Functional Area Objectives Operations and Engineering Support Services The Operations and Engineering Division (OED) manages and operates TSA's IT enterprise, providing operations and maintenance (O&M) and engineering support for infrastructure across TSA's worldwide enterprise. Key services include data management, fault resolution, patch management, disaster recovery, systems performance monitoring, change management, and IT infrastructure remediation. OED supports computing environments in DHS data centers, TSA sites, and smaller server collections, along with LAN/WAN networks and desktop devices.

Key Objectives:

1. Data Center Services: Provide enterprise systems management, migration, and restoration of services across TSA environments.

2. Email and Messaging Services: Ensure reliable email, messaging, and mobile device services while mitigating malicious software and spam.

3. Network Services: Manage and secure TSA's LAN/WAN networks, ensuring seamless connectivity and incident management.

4. Testing Services: Provide operational support for testing environments to sustain development and release schedules.

5. Voice Services: Manage TSA's VOIP, mobile infrastructure, and unified communications for mission-critical availability.

6. Critical Incident Management: Operate a 24/7 command center to manage incidents, execute COOP plans, and improve response communications.

7. Configuration, Change, and Release Management: Ensure lifecycle integrity of TSA systems through standardized processes.

8. Disaster Recovery: Restore IT services to planned levels within specified recovery objectives after disruptions.

9. Identity Credential and Access Management (ICAM): Support secure user authentication, access management, and compliance with HSPD-12.

10. Cloud Services: Manage TSA's cloud environments, including IaaS, PaaS, and SaaS, ensuring secure and efficient operations.

11. Incident Response and Cybersecurity: Mitigate security threats and maintain IT security devices and logs.

12. Risk Management and Compliance: Remediate vulnerabilities, ensure FISMA compliance, and ensure proactive security and compliance of TSA systems.

13. Patch and Upgrade Management: Monitor, test, and apply patches/upgrades to maintain secure and functional systems.

14. On-Premise Services: Manage TSA's on-premise environments, ensuring operational monitoring, migration, and service restoration.

15. Communications and Collaboration Services: Maintain and support enterprise communication tools like Microsoft 365, Teams, WebEx, and SharePoint.

16. Security Technology Integration Program (STIP): Provide O&M engineering support for STIP, including troubleshooting, data verification, user management, incident resolution, and performance monitoring to ensure optimal Transportation Security Equipment (TSE) functionality and connectivity.

These objectives collectively ensure TSA's IT infrastructure operates securely, efficiently, and in compliance with DHS and TSA policies.

Single Point of Contact (SPOC) Services The Single Point of Contact (SPOC) Services provide a centralized IT service desk to manage incidents, service requests, and information inquiries across TSA’s IT enterprise. Operating 24x7x365, the SPOC adheres to industry-standard Information Technology Service Management (ITSM) practices and supports ITIL processes such as incident, problem, change, and configuration management.

Key Objectives:

1. Enterprise Service Desk: Deliver Tier 0 self-service capabilities, Tier 1 support for common issues, and escalation through Tier 3 for complex problems.

2. Incident and Ticket Management: Track, resolve, and close trouble/service tickets, ensuring resolution before closure.

3. Grade of Service Compliance: Meet service standards.

4. VIP and Mission-Critical Support: Minimize operational impact for high-priority users and systems.

5. User Account Management: Handle account creation, updates, monitoring, and removal across TSA-supported systems (e.g., mobile, cloud, data center).

6. Proactive Communication: Manage notifications for outages, maintenance, and major incidents.

7. Automated Call Distribution (ACD): Efficiently route calls to appropriate support personnel or external entities when outside contract scope.

8. First-Contact Resolution: Aim to resolve issues during initial contact to minimize time to restore services.

9. ITSM Tool Utilization: Use TSA’s ITSM tools to execute ITIL processes and expand their capabilities as approved by TSA.

10. Incident Ownership Transfer: Assign incidents to appropriate support entities for areas outside contract scope.

These objectives ensure streamlined IT support, efficient issue resolution, and enhanced user experience across TSA’s IT infrastructure.

Site Support Services Site Support Services provide on-site technical support for TSA users, infrastructure, and equipment across various locations, including airports, Federal Air Marshal Service (FAMS) offices, international sites, training centers, data centers, mission support centers, headquarters, and other TSA facilities. Support includes end-user assistance, infrastructure maintenance, lifecycle equipment refresh, and compliance with TSA and DHS policies.

Key Objectives:

1. Resident On-Site Support: Deploy personnel to specified locations for infrastructure activation, troubleshooting, IT requirements gathering, lifecycle equipment refresh activities, and deskside user support.

2. Travel and Dispatch Support: Provide dispatch support outside normal hours and site without resident on-site support for incident resolution as well as facilitate TSA-directed travel for site projects.

3. Technology Maintenance: Perform installation, moves, adds, changes (IMAC), preventive maintenance, and break-fix repairs for IT and communication equipment such as servers, networks, workstations, printers, phones, and duress alarms.

4. Network and Cabinet Management: Maintain accurate physical and logical diagrams for racks/cabinets, perform audits, and ensure proper cable management.

5. Asset Management: Conduct inventories of IT assets, update TSA’s asset management system, and comply with TSA/DHS policies for equipment disposal.

6. Specialized Support: Provide tailored services for unique environments such as Freedom Center (24x7 operations), Site W, TSA Headquarters, TSA Warehouse, and TSA Systems Integration Facility (TSIF).

7. Communication and Collaboration Services: Support video teleconferencing (VTC), audio-visual (AV) systems, and web conferencing tools like Microsoft Teams, WebEx, and SharePoint.

8. Software Asset Management (SAM): Manage software licenses, compliance, and cost optimization while ensuring accurate tracking and reporting.

9. Continuity of Operations (COOP): Develop and execute plans to ensure uninterrupted operations during disasters or exercises, including personnel realignment and alternate-site relocation.

Site Support objectives ensure TSA’s IT infrastructure remains operational, secure, and responsive to mission-critical needs across diverse locations.

Information Assurance and Cybersecurity Support Services The Information Assurance and Cybersecurity Division (IAD) manages TSA’s enterprise-wide cybersecurity program to protect personnel, systems, and data, adhering to federal laws, NIST standards, and DHS policies. Key areas of focus include Incident Response, and Risk Management.

Key Objectives:

1. Incident Response and Cybersecurity:

These services mitigate threats and vulnerabilities identified by TSA SOC or authorized personnel, implement remediation actions, and conduct annual reviews to strengthen security infrastructure across networks, firewalls, cloud systems, and airport networks.

2. Risk Management and Compliance:

Risk management supports FISMA compliance through regular vulnerability management, applying necessary patches and configurations, remediating POA&Ms, and assessments of TSA IT systems to identify and mitigate risks. Ensure compliance with DHS and TSA directives through comprehensive analysis, accurate reporting, and timely remediation of identified security concerns.

Deliverables Deliverables will be identified at the Task Order level.

Service Level Agreements and Requirements Service Level Agreements (SLA) and Service Level Requirements (SLR) will be contractor proposed in response to individual task orders.

Period of Performance The period of performance (PoP) for this BPA is 10-years. Task Orders may be requested and awarded for varying lengths not to exceed the POP of the BPA.

Appendix A – Clauses Section 508 Requirements Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

Section 508 Requirements for Technology Services (include in the SOW, PWS, or SOO)

1. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item's level of Section 508 conformance prior to the services being performed.

2. When providing maintenance upgrades, substitutions, and replacements to ICT, the contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed upgrades, substitutions and replacements prior to acceptance. The ACR should be created using the on the Voluntary Product Accessibility Template Version 2.2 508 (or successor versions). The template can be located at https://www.itic.org/policy/accessibility/vpat

3. When providing cloud hosting services (Infrastructure as a Service, Platform as a Service, Software as a Service, etc.) the Contractor shall ensure user administrative screens, dashboards and portals used to configure, and monitor cloud services conform to the Section 508 standards.

4. The Contractor shall ensure cloud hosting services shall not reduce the level of Section 508 conformance for ICT migrated by DHS to the cloud hosting environment.

5. When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

6. When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

7. When developing or modifying web based and electronic content components, except for electronic documents and non-fillable forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria) by conducting testing using the DHS Trusted Tester for Web Methodology Version 5.0 or successor versions, and shall ensure testing is conducted by individuals who are certified by DHS on version 5.0 or successor versions (e.g. “DHS Certified Trusted Testers”). The Contractor shall provide the Trusted Tester Certification IDs to DHS upon request. Information on the DHS Trusted Tester for Web Methodology Version 5.0, related test tools, test reporting, training, and tester certification requirements is published at https://www.dhs.gov/trusted-tester.

8. When developing or modifying electronic documents and forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable to the applicable Section 508 standards (including WCAG Level A and AA Level 2.0 Success Criteria) by conducting testing using the test methods published under “Accessibility Tests for Documents” at https://www.dhs.gov/compliance-test-processes.

9. When developing or modifying ICT deliverables that contain the ability to automatically generate electronic documents and forms in Microsoft Office and Adobe formats, or when the capability is provided to enable end users to design and author web based electronic content (i.e. surveys, dashboards, charts, data visualizations, etc.), the Contractor shall demonstrate the ability to ensure these outputs conform to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria). The Contractor shall demonstrate conformance by conducting testing and reporting test results based on representative sample outputs. For outputs produced as Microsoft Office and Adobe PDF file formats, the Contractor shall use the test methods published under “Accessibility Tests for Documents”, which are published at https://www.dhs.gov/compliance-test-processes. For outputs produced as web based electronic content, the Contractor shall use the DHS Trusted Tester for Web Methodology Version 5.0, or successor versions. This methodology is published at https://www.dhs.gov/trusted-tester

10. When developing or modifying software functions of ICT, the Contractor shall demonstrate conformance to the applicable Section 508 standards (including the requirements in Chapter 5 and WCAG 2.0 Level A and AA Success Criteria). When the requirements in Chapter 5 do not address one or more software functions, the Contractor shall demonstrate conformance to the Functional Performance Criteria specified in Chapter 3. The Contractor shall use a test process capable of validating conformance to all applicable Section 508 standards for software functionality delivered pursuant to this contract. The Contractor may utilize the DHS Trusted Tester Methodology for Web and Software Version 4.0 as a component of the overall test process used. This version of the test process provides partial test coverage of the Section 508 standards that apply to software. If the Contractor uses this test process, the Contractor shall address the test coverage gaps through additional test procedures. Information on the DHS Trusted Tester Methodology for Web and Software Version 4.0, including coverage against the applicable Section 508 standards for software as well as gaps that need to be addressed through other test methods, related test tools, and training is published at https://www.dhs.gov/trusted-tester.

11. When developing or modifying hardware components of ICT, including closed systems (for example – kiosks), the Contractor shall demonstrate conformance to the applicable Section 508 standards (including the Chapter 4 hardware requirements). Where the requirements in Chapters 4 do not address one or more functions of ICT, the Contractor shall demonstrate conformance to the Functional Performance Criteria specified in Chapter 3. The Contractor shall use a test process capable of validating conformance to all applicable Section 508 standards for hardware functionality delivered pursuant to this contract.

12. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the accessibility requirements in this work statement.

Section 508 Deliverables

1. Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions.

2. Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

3. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

4. Other Section 508 Documentation: The following documentation shall be provided upon request for ICT items offered through this contract:

· Documentation of features provided to help achieve accessibility and usability for people with disabilities.

· Documentation on how to configure and install the ICT Item to support accessibility.

· Documentation of core functions that cannot be accessed by persons with disabilities.

· Documentation of remediation plans to address non-conformance to the Section 508 standards.

Appendix B – Acronyms and Abbreviations ACD - Automated Call Distribution AI - Artificial Intelligence AV - Audio-Visual BPA - Blanket Purchase Agreement CIO - Chief Information Officer COOP - Continuity of Operations DHS - Department of Homeland Security FISMA - Federal Information Security Management Act FOMCUS - Federal Operations & Maintenance for Continuous User Support HSPD-12 - Homeland Security Presidential Directive 12 ICAM - Identity Credential and Access Management ICT - Information and Communications Technology IAD - Information Assurance and Cybersecurity Division IMAC - Installation, Moves, Adds, Changes ISO/IEC - International Organization for Standardization/International Electrotechnical Commission IT - Information Technology ITIL - Information Technology Infrastructure Library ITSM - Information Technology Service Management LAN - Local Area Network ML - Machine Learning NIST - National Institute of Standards and Technology O&M - Operations and Maintenance OED - Operations and Engineering Division PaaS - Platform as a Service PoP - Period of Performance PWS - Performance Work Statement SAM - Software Asset Management SLA - Service Level Agreement SLR - Service Level Requirement SOO - Statement of Objectives SPOC - Single Point of Contact STIP - Security Technology Integration Program TSE - Transportation Security Equipment TSA - Transportation Security Administration TSIF - TSA Systems Integration Facility VIP - Very Important Person VoIP - Voice Over Internet Protocol WAN - Wide Area Network WCAG - Web Content Accessibility Guidelines image1.jpeg