Cargo_Large_Pallet_X-Ray_SOW_RFQ.docx

U.S. Customs and Border Protection Statement of Work

SMALL SCALE NON-INTRUSIVE INSPECTION (NII)

CARGO / LARGE PALLET X-RAY SYSTEMS

Prepared by

Interdiction Technology Branch

Contents

Interdiction Technology Branch 06/22/2017

PURPOSE

U.S. Customs and Border Protection (CBP) requires Cargo / Large Pallet (CLP) X-Ray Systems. The purpose of this procurement is to provide CBP Officers (CBPOs) with the capability to non-intrusively inspect cargo, including pallets, baggage, mail, and packages, for contraband at various locations, including airports, seaports, checkpoints, and land ports of entry.

Background CBP, an agency of the Department of Homeland Security (DHS), is responsible for targeting, selecting and examining cargo deemed high risk for terrorist-related activity, smuggling of contraband and trade law violation. CBP is also responsible for facilitating the release of low-risk cargo. CBP has a continuing requirement to interdict incoming contraband such as weapons, explosives, illegal drugs or currency through examination of break-bulk cargo, passenger baggage and international mail parcels.

Scope The Contractor shall supply CLP X-Ray Systems to be utilized nationwide. These systems will be used to perform non-intrusive inspection (NII) of conveyances for detection of illegal contraband coming into the United States. The technical performance specifications and service requirements for the CLP X-Ray Systems are contained in the sections below.

Period of Performance

The contemplated contract has a two-year period of performance, with no option periods. The ordering period under this IDIQ will begin at award and continue for two years. The effective period of this IDIQ, however, will begin on the date of award and will continue until completion of the final delivery order on the contract. Orders issued from this contract could have performance periods that extend up to ten (10) years from the Government’s acceptance of the final unit under that order, if all possible options are included on that order and are exercised.

Government and Program Management Organization This program is under the technical direction of the Small Scale (SS)-NII Contracting Officer Representative (COR) assigned to the CBP Laboratories and Scientific Services Directorate (LSSD), Interdiction Technology Branch (ITB) in coordination with CBP Enterprise Services, Integrated Logistics Branch (ILB) – CBP NII Maintenance, Repair, and Operations Support Center (MROSC).

CBP will manage this program through CBP LSSD/ITB for system acquisition, delivery, and acceptance. The Contractor shall coordinate with CBP to ensure successful system integration. CBP NII MROSC will manage the warranty service support, and maintenance services. The CBP Office of Training Development (OTD) will approve training development. CBP OTD and Enterprise Networks and Technology Support Directorate (ENTSD) - Technology Training Support Branch (TTSB) will coordinate operator training subsequent to receiving Train-the-Trainer training from the Contractor. CBP Human Resources Management (HRM) will approve radiation safety.

Contractor Management Organization The Contractor shall provide a Project Management Plan, including the Contractor’s overall management structure, including all major points of contact, for CBP Review. This plan shall include the schedule for completing all tasks required to fabricate, ship, install, test, train, and maintain CLP X-Ray Systems and all major points of contact and an overview of the Contractor’s overall management. The Project Management Plan shall be prepared in accordance with Data Item Description (DID) A001.

APPLICABLE DOCUMENTS

Documents cited shall be referenced and used as called for in this Statement of Work (SOW)/Performance Specification and the DIDs, in their most current version.

Applicable Federal Laws, Regulations and Publications

a. Code of Federal Regulations, 29 CFR Part 1910, Occupational Safety and Health Standards (OSHA)

b. United States Code (29 USC 701 et seq.) Rehabilitation Act of 1973, as amended, Title V, Section 508

c. Office of Management Budget (OMB), Memorandum M-05-22, August 2, 2005

d. Code of Federal Regulations (36 CFR Part 1194) Electronic and Information Technology Accessibility Standards, including 36 CFR 1194.21, Software Applications and Operating Systems

e. United States Code, (44 USC Chapter 35), Federal Information Security Modernization Act (FISMA) of 2014

f. OMB Circular A-130

g. United States Code (5 USC 552a), The Privacy Act, 2010

h. United States Code (6 USC 133), Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act)

i. Code of Federal Regulations (6 CFR Part 29), Protected Critical Infrastructure Information

j. Code of Federal Regulations (49 CFR Part 1520), Protection of Sensitive Security Information

k. Code of Federal Regulations (49 CFR 1544.211(e)), Use of X-ray Systems

l. Code of Federal Regulations (21 CFR 1020.40), Cabinet X-ray Systems

m. Code of Federal Regulations, 49 CFR Part 172, Subpart B, Table of Hazardous Materials and Special Provisions

Applicable National Standards

a. American National Standards Institute, ANSl/HPS N43.3, General Radiation Safety - Installations Using Non-Medical X-Ray and Sealed Gamma-Ray Sources, Energies up to 10 MeV, 2008.

b. American National Standards Institute, ANSl/HPS N43.14, Radiation Safety for Active Interrogation Systems for Security Screening of Cargo, Energies up to 100 MeV, 2011.

c. American National Standards Institute, ANSI/HPS N43.17, Radiation Safety for Personnel Security Screening Systems Using X-Rays, 2009

d. American National Standards Institute, ANSI/IEEE N42.46, Determination of the Imaging Performance of X-Ray and Gamma-Ray Systems for Cargo and Vehicle Security Screening, 2008

e. National Fire Protection Association (NFPA) 79, Electrical Standard for Industrial Machinery, 2015.

f. NFPA 70B, Recommended Practice for Electrical Equipment Maintenance, 2016

g. NISTIR 7889), Section 5.2.9, at http://nvlpubs.nist.gov/nistputs/ir/2014/NIST.IR.7889

h. NIST Special Publication 500-267

i. Federal Information Processing Standards Publications (FIPS PUB), Advanced Encryption Standard (AES), FIPS 197

j. Security Requirements for Cryptographic Modules, FIPS PUB 140-2

k. International Standards Organization (ISO) 9000 series, Quality Management

l. SAE International Standard EIA649B, Configuration Management Standard

m. Personal Identity Verification (PIV) of Federal Employees and Contractors, FIPS PUB 201-2, , August 2013

Applicable DHS/CBP Documents, as may be amended*

a. DHS Enterprise Data Management Policy Directive 103-01, 08/25/2014

b. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information

c. DHS Sensitive Systems Policy Directive 4300A, Version 12.01, February 12, 2016

d. DHS 4300A Sensitive Systems Handbook Version 12.0 November 15, 2015

e. DHS Section 508 Program Management Office and Electronic and Information Technology Accessibility MD 4010.2, 10/26/2005

f. Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors, August 2004

*Current DHS documents may be accessed at https://www.dhs.gov/dhs-security-and-training-requirements-Contractors

GENERAL REQUIREMENTS

The Contractor shall perform all work necessary to fabricate and deliver the specified CLP X-Ray System. The Contractor must meet or exceed all technical specifications set out in Section 3.2 (see also Appendix A). The CLP X-Ray Systems shall conform to OSHA Standards, (29 CFR 1910.120), NFPA 79, Chapter 4, and NFPA 70B, Article 110 requirements. The Contractor shall perform the work necessary to develop, test and deliver the procured equipment. The Contractor shall also provide warranty, maintenance, training, and on-demand services (Section 4.7) in support of these SS-NII Systems. The Contractor shall prepare Monthly Progress Reports in accordance with the attached DID A006 while performing tasks within this SOW.

Requirement Definition:

Threshold: The minimum level of operational performance that the Government is willing to accept is considered a Threshold value. A system that does not meet one or more Threshold requirements will not be accepted.

Performance Requirements Appendix A contains the performance requirements matrix, which identifies Threshold values for each CLP X-Ray System capability required.

Computer Security Requirements All CLP X-Ray System computers shall comply with the IT policies captured in DHS 4300A Sensitive Systems Policy and Sensitive Systems Handbook referenced in Section 2.

All SS-NII System computers and software programs that enable a User to analyze/enhance images and store an Image Data Set (IDS), and the Data Base computers and programs that store an IDS, shall have the following features incorporated: computers and server(s) with enough memory and speed to meet all the requirements of this SOW and its appendices (see Appendix A); computer operating systems shall be an approved Operating System, capable of upgrade (see Technology Reference Module (TRM). The system shall have wireless technology that can be encrypted in accordance with DHS 4300A Section 4.6 Wireless Network Communications, or its replacement. The wireless capability shall have the ability to be disabled when not in use. The System shall have capability to tag each scan with the User ID; and the User ID shall be displayed with the image and the IDS.

See Appendix A for contents of an IDS which shall be created for each system scan.

Identification and Authentication A. Levels of Access – The Contractor shall provide three levels of CBP User access: Operator, Supervisor, and Administrator. Operator shall be able to perform all system functions except copying and deleting images or Data Sets. Operator shall not have access to User Accounts. Operator and Supervisor shall not have access to the Graphical User Interface (GUI). Supervisor shall be able to perform all Operator functions plus be able to create Operator accounts and be able to copy and delete images or Data Sets. Supervisor shall have access to Operator Accounts, and reset Operator and Supervisor passwords. The Administrator shall be able to perform all Operator and Supervisor functions plus have access to all Accounts. The Administrator shall be able to create, edit, and/or delete all Level Accounts. The Contractor shall create a simplified procedure for the Administrator and Supervisor to use in order to create, edit, and delete User Accounts. Operator and Supervisor shall not have access to Operating System except for those hard drives that have IDS stored on them or the external drives from which an image may be imported or an image or IDS may be exported or copied. The CBP Administrator Account shall have access to the Operating System.

B. Passwords – All passwords used to access the CLP X-Ray Systems for operation are required to be Strong Passwords. Strong Passwords have the following requirements:

1. Are at least 12 characters in length;

2. Comply with the DHS hardening guidelines for operating systems and the configuration guides for applications. In the absence of guidance, the Information Systems Security Officer (ISSO) will determine the appropriate password complexity based on the level of risk;

3. Must contain at least one (1) Uppercase letter, one (1) Lowercase letter, one (1) base ten (10) number, and one (1) special character;

4. Do not contain any dictionary word;

5. Do not contain any proper noun or the name of any person, pet, child, or fictional character;.

6. Do not contain any employee serial number, Social Security Number, birth date, phone number, or any information that could be readily guessed about the creator of the password;

7. Do not contain any simple pattern of letters or numbers, such as “qwerty” or “xyz123”;

8. Do not contain any word, noun, or name spelled backwards or with a single digit appended, or with a two-digit “year” string, such as 98xyz123;

9. Are not the same as the User Identification (ID); and

10. Are not the same as any of the User’s previous eight (8) passwords.

C. Passphrases – Any Passphrases used instead of or in addition to Passwords must follow the same guidelines set out for Strong Passwords.

D. The CLP X-Ray System must have the ability to:

1. Deactivate unused accounts automatically if they have not been used in forty-five (45) days.

2. Shall not permit users to set to the null string.

3. Require the user to change the user’s password every ninety (90) days.

4. Store all user account passwords in encrypted form.

Access Control A. Unique User Accounts – The CLP X-Ray System shall enable all users to have unique account identifiers, including separate identifiers for operator accounts and administrator accounts.

B. Automatic Account Lockout – CLP X-Ray System shall lock a user account for twenty (20) minutes after three consecutive failed logon attempts.

C. User ID shall be visible User ID at login.

D. Automatic Session Termination – CLP X-Ray System shall lock the user login session after twenty (20) minutes of inactivity. The system shall require the user to authenticate with the user account password to regain system access after the system lock. After sixty (60) minutes of inactivity, the system shall log the user out of the system.

E. Warning Banner – The DHS Chief Information Security Officer (CISO) mandates that a warning banner statement be displayed on all DHS systems during User account logon. The system shall prompt the User to accept the current language before the user can authenticate with the User ID and User password to access the system. The current language required follows:

1. You are accessing a U.S. Government information system, which includes (1) this computer, (2) this computer network, (3) all computers connected to this network and (4) all devices and storage media attached to this network or to a computer on this network. This information system is provided for U.S. Government-authorized use only.

2. Unauthorized or improper use or access of this system may result in disciplinary action, as well as civil and criminal penalties.

3. By using this information system, you understand and consent to the following:

a. You have no reasonable expectation of privacy when you use this information system; this includes any communications or data transiting, stored on, originated from or directed to this information system. At any time, and for any lawful Government purpose, the Government may monitor, intercept, search and seize any communication or data transiting, stored on, originated from or directed to or from this information system.

b. The Government may disclose or use any communications or data transiting, stored on, originated from or directed to or from this information system for any lawful Government purpose.

You are NOT authorized to process classified information on this information system.

Auditing A. Audit Records – CLP X-Ray System will retain audit records sufficient in detail to facilitate the reconstruction of events if compromise or malfunction occurs. Audit records shall contain at least the following information:

1. Identity of each user and device accessing or attempting to access the system

2. Time and date of the access and the logoff

3. Activities that might modify, bypass, or negate information security safeguards

4. Security – relevant actions associated with processing

5. All activities performed using an administrator account/identity B. Audit Record Access – Audit records and audit logs shall be protected from unauthorized access, modification, or destruction.

C. Audit Record Retention – Audit records shall be maintained on the system for a minimum of ninety (90) days. Audit records shall be preserved for a period of seven (7) years as part of managing records for each system to allow audit information to be placed online for analysis with reasonable ease.

D. Audit Reduction / Report Generation – The CLP X-Ray System will provide an audit reduction and report generation capability that:

1. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents

2. Without altering the original content or time ordering of audit records E. The CLP X-Ray System will have the capability to tag each scan with the User ID who conducted it. The User ID and time shall be displayed with the image and the IDS.

F. Any report that is created shall include a User ID field.

Printed Documents All SS-NII Systems shall have the capability of printing all the items of an IDS. All printed documents shall have "FOR OFFICIAL USE ONLY – LAW ENFORCEMENT SENSITIVE" in the header or footer. The footer shall contain system type and location.

System Integration Integration of NII inspection system equipment and its supporting Subsystems shall be the responsibility of the Contractor.

System Installation In order to verify that the SS-NII system can be deployed to the designated CBP deployment location, the Contractor, upon written request, shall support a Site Survey at any designated CBP location. The Contractor shall support the Site Survey at least sixty (60) days prior to the CBP Site Acceptance Test (SAT). Upon completion of the survey, the Contractor shall submit a Site Survey Report in the Contractor’s format (which shall have been CBP-approved) within fifteen (15) days to the CBP-ITB Facilities Coordinator. The Site Survey Report shall, at a minimum, address the items listed in DID A005 Equipment Installation Data Package. Additional system installation information, if required, may be identified in the Performance Requirements Section of this SOW.

Work Center The Contractor shall deliver a work center that is ergonomically designed in accordance with DHS standards found in Human Engineering Design Criteria Standards Part 1: Project Introduction and Existing Standards, DHS S&T TSD Standards project, (NISTIR 7889), Section 5.2.9, at http://nvlpubs.nist.gov/nistpubs/ir/2014/NIST.IR.7889.pdf.

Workstation Integration and Interface The Contractor shall configure and integrate all workstations/servers and computer software/operating systems to include a system Operator Console. The system controls and displays enable a conveyance to be scanned; the conveyance image(s) to be analyzed; a system operator to make a Suspect or Non-suspect decision and storage of all the items associated with the scan into an IDS and the storage/retrieval of the IDS. Operator Console shall have Dynamic Zoom, backspace, and clear functions, all icons to be placed with other functions icons. The Contractor shall meet additional integration requirements such as computer hardware/software technology refresh requirements, if applicable, which are specified within Section 3.2 (see Appendix A).

Integrated Image Capture All SS-NII Systems shall be capable of capturing and displaying all of the items that are contained in an IDS. The IDS shall include, at a minimum, the radiographic image, a Data Sheet or Manifest, operator notes, the operator’s Suspect or Non-suspect decision and the User's name. The Contractor shall meet additional IDS element requirements, specified in Section 3.2 (see Appendix A). All Metadata shall be the sole property of CBP and shall not be released or distributed without explicit consent of the Contracting Officer.

Integrated Image Storage All CLP X-Ray Systems shall be capable of storing all IDS created for a period of ninety (90) Days with up to two (2) Terabytes of hard drive storage. A warning shall be provided when the hard drive used to store the IDS files reaches 85% of its maximum storage capacity. The warning shall alert the Operator for the need to manually archive IDS files. Auto-deletion of Non-Suspect files should occur when storage reaches 90% capacity, but, when such action occurs, it should only delete to 60% of storage capacity.

The system shall provide an option at the Administrator level for auto deletion of Non-Suspect files that are over ninety (90) days old.

Integrated Data Set Download All CLP X-Ray Systems shall be capable of exporting an IDS in its native language to external media via encrypted USB flash drive and encrypted external hard drive. The IDS shall consist of the data specified within section 3.2 (see Appendix A). The consolidated IDS shall encompass all of the data required to perform an offsite scan review and analysis as though the reviewer were stationed at the original data site. The system shall also be capable of creating and exporting a summary scan report for each conveyance scanned – the format of this report shall be PDF. The image data shall be configured in a format that allows the Government to easily transfer the image from one computer containing the image analysis software to another computer containing the image analysis software without the loss of the image analysis functionality.

Safety Interlocks The Contractor shall provide safety interlocks such as operator proximity/presence sensors or "dead man switches" for all systems for the protection of pedestrian traffic and untrained personnel.

The Contractor shall provide an Operator’s Mat and Emergency Stop Switches for all systems that will enable an operator to manually interrupt the scanning process by disabling the emission of X-rays in an emergency or when there is an unauthorized entry inside the system's Radiation Control Area. The number and locations of the emergency stops shall be as specified in the performance requirements Section 3.2 (see Appendix A). See ANSI N43.3-2008, paragraph 7.5.2, and ANSI N43.14-2011, chapter 6.1, for more details on safety interlocks. The SS-NII systems shall also provide audible and visible (flashing lights) alarms when actively radiating.

Reliability, Availability and Maintainability Design Requirements The Contractor shall design the CLP X-Ray System to meet the Reliability, Availability and Maintainability (RAM) requirements for Inherent Availability (Ai) and Operational Availability (Ao) (see section 4.6). The following are minimum requirements for these systems.

Basic System Reliability Requirements – Inherent Availability (Ai) The CLP X-Ray System and all of its components shall be designed to operate satisfactorily at a given point in time when used under the stated conditions in the environment described in this SOW. Ai excludes logistics time, waiting or administrative downtime, and preventative maintenance downtime. Ai includes corrective maintenance downtime. Inherent availability is generally derived from analysis of an engineering design and is calculated as the mean time between failures (MTBF) divided by the MTBF plus the mean time to repair (MTTR).

The Inherent System Availability for each serialized system shall be calculated annually based on a three hundred sixty-five (365) day year. For this Ai, a minimum of 0.9900 must be achieved for each year for the entire ten (10) year life cycle for this system. The Ai is calculated using the following:

Ai = Mean Time Between Failures (MTBF) _ Mean Time Between Failures (MTBF) + Mean Time to Repair (MTTR)

Mean Time Between Failures (MTBF) The time between failures (TBF) is the time duration from the start of when the system is placed into an ‘operational’ status until suffering a failure. A failure is defined as a malfunction that degrades performance or operational capability, which cannot be tolerated for even a brief period before correction. The total time between failure (TTBF) is the sum of all TBFs for the reporting period. The mean time between failures (MTBF) is calculated as the TTBF divided by the total number of failures for that reporting period. The overall system shall be designed to possess a MTBF of no less than one thousand (1000) hours. The Government will calculate the MTBF on an annual basis.

The MTBF for each serialized system shall be calculated annually using a three hundred sixty-five (365)-day (8760 hours) reporting period as follows:

MTBF = Total Time Between Failures (TTBF) Total Number of Failure Incidents

Mean Time to Repair (MTTR) The time to repair (TTR) is the time duration from the start of a repair activity to correct a failure until the system is returned to full performance and capability. The total time to repair (TTTR) is the sum of all TTRs for the reporting period. The mean time to repair (MTTR) is calculated as the TTTR divided by the total number of repair activities for that reporting period. The overall system shall be designed to possess a MTTR to achieve the Ai requirement. The Government will calculate the MTTR on an annual basis.

The MTTR for each serialized system shall be calculated annually using a three hundred sixty-five (365)-day (8760 hours) reporting period as follows:

MTTR = Total Time to Repair (TTTR) Total Number of Repair Activities

Life Cycle Expectation The designed operating life of the system shall be no less than ten (10) years. The system shall be capable of exceeding a normal operating period of sixteen (16) hours a day, six (6) days a week, fifty-two (52) weeks a year during an operating life of ten (10) years and be capable of surge operations consisting of twenty-four (24) hours a day, seven (7) days a week for two (2) weeks (336 hours).

Predictive Reliability, Availability, and Maintainability Analysis The Contractor shall provide predictive Obsolescence Analysis of system components and a Component Replacement Analysis in the Contractor’s format at time of quote submission, see DID A002. The Component Replacement Analysis shall include:

A. Procedures for the procurement of critical items, to include availability and procurement lead times.

B. Criteria and procedures for the design and redesign of critical items C. Procedures for controlling and monitoring of critical items after manufacture to meet the Ai and Ao requirements (e.g., date coding, traceability, assembly techniques, test requirements, acceptance test requirements, control of sub-Contractors’ and manufacturers’ controls, in-process controls, special handling, and storage requirements).

Classification of Reliability Critical Items A Critical Item is an identified weak link in a system, has an adverse impact on, or contributes to failures of the system performing its mission, creates potential safety problems, or contributes to other areas of high risk to overall system reliability. The Contractor shall classify all SS-NII items as critical if one or more of the following conditions are satisfied:

1. Item represents a significant new development or application.

2. Item has critical failure modes.

3. Item has history indicating need for improvement. A Preplanned Product Improvement Plan (PPIP) shall be developed and provided by the Contractor for any item with a history of needing improvement.

4. Item has known operating life, limited shelf life, or environmental sensitivity (e.g., vibration, thermal, etc.) that warrants controlled surveillance.

5. Item whose failure can result in the failure of the system and which is not compensated by redundancy or alternate operational procedures

Control of Reliability Critical Items The Contractor shall be responsible for the control and Quality Control (Contractor shall address in DID number A012 Quality Assurance/Quality Control Plan) of critical items, which shall include at a minimum:

1. Procedures for the procurement of, and availability of, spares of critical items

2. Criteria and procedures for the design and redesign of critical items

3. Procedures for controlling and monitoring of critical items after manufacture (e.g., date coding, traceability, assembly techniques, test requirements, acceptance test requirements, control of sub-contractors' and manufacturers' controls, in-process controls, special handling and storage requirements).

Corrosion Control The Contractor shall apply corrosion control techniques and measures to mitigate and correct corrosion of the system. The Contractor shall visually inspect the equipment for signs of corrosion. The Contractor shall apply best industry standards and practices to remove corrosion or replace parent material, properly treat and prepare surfaces for painting, and apply a color-matched finish and prevent future corrosion.

Quality Assurance/Quality Control Plan The Contractor shall provide a Quality Assurance/Quality Control (QA/QC) plan based on the most current and applicable certified ISO processes and procedures. The Contractor’s QA/QC plan shall define key performance measures to include traceable metrics, verifiable performance standards, and address risk identification and mitigation processes used to meet the performance requirements in this SOW.

The Contractor shall provide a QA/QC Plan in accordance with DID A012.

Testing The Contractor shall prepare and submit an Acceptance Test Plan (ATP) in accordance with the attached DID A013. The Contractor shall perform inspections and tests necessary to ensure that CLP X-Ray Systems conform to CBP approved technical documentation and configuration, to include operational testing of the first article delivery. Using the approved ATP, the Contractor shall conduct verification and validation tests to ensure the system meets all performance requirements and to verify it can be operated as specified in the system’s Operator’s Manual (DID A008). Additional Contractor testing requirements, if applicable, are identified in the performance Section 3.2 (see Appendix A) of this SOW. The Contractor shall provide the test articles as defined in ANSI N42.46, Chapter 4, to perform this level of testing.

Factory Testing A CBP team shall conduct a CBP Factory Test (FT) of all systems at the Contractor’s facility in accordance with the ATP (DID A013) to verify that the system is suitable for shipment to its intended deployment location, including proper assembly, functionality, and operation. The CBP team will conduct an FT in accordance with a CBP FT Plan for all systems. The Contractor shall provide the appropriate test articles for the CBP team in support of the FT.

Site Acceptance Testing A CBP team will conduct a CBP Site Acceptance Test (SAT) for each system at its designated deployment location. The CBP team will conduct the CBP SAT in accordance with a CBP SAT Plan (SATP) for CLP X-Ray system. The CBP SAT shall consist of a review of the Contractor’s pre-SAT documentation and Radiation Survey/Leak Test Report (DID A015), plus an inventory and physical inspection of the system, system component operations and tests of the total integrated system against actual targets. The Contractor shall be required to provide test articles for the SAT as determined by the SATP or the Test Director. This allows CBP to verify that the system has not been physically damaged nor performance impacted due to transport of the system. The CBP SAT will not occur until the Contractor has trained the SAT team members on the SATP, no later than 7 days before the SAT date.

Discrimination Testing In the absence of an ANSI for Material Discrimination, the CBP team will test the following characteristics, using the following or similar test fixtures. Two characteristics must be demonstrated.

The first characteristic is the system’s ability to differentiate and identify the three categories of material (organic, intermediate, and metallic) from each other as a function of color when they are placed in close proximity to one another. The materials suggested are HDPE, Aluminum (Al), Steel, and Lead (Pb). The materials used shall all have the same attenuation, which can be between 20X and 50X. The test fixture used should be able to hold at least two plates of each material. The CBP team will determine success based on the number of plates where at least 50% of the surface is the correct color. Twelve scans will be required and 90% of the plates must display the proper color.

The second characteristic to be demonstrated is the system’s attenuation range for two of the materials. For a three material category system, the two materials used shall be HDPE and Steel. For a four material category system, the two materials used can be either HDPE & Steel or Al & Pb. There shall be at least 7 different thicknesses (steps) of each material. One step shall be so thin that the system cannot properly identify the material and therefore it appears gray. One other step shall be so thick that the system cannot properly identify the material and therefore it appears black. All the other steps shall vary in color intensity as a function of their thickness (the thicker the step, the more intense the color). Success is based on the number of steps where at least 75% of the surface is the correct color intensity. Twelve (12) scans will be required and 90% of the steps must display the proper color intensity.

System Safety Program The Contractor shall maintain a system safety program that continually identifies all hazards and provides a methodology to either eliminate or control these identified hazards.

Radiation Safety The Contractor shall provide a radiation dose map in the Contractor’s format for the system that shows the personnel safety zone and radiation portal monitor (RPM) interference zone to be provided with initial quote. All products, designs, and specifications provided and all construction and installation activities conducted shall comply with all OSHA, as well as any other appropriate laws, regulations, standards, codes and health and safety guidelines.

Radiation Safety Design Review The Contractor is required to demonstrate, during factory testing, the construction techniques, practices and design of the protective shielding/cabinet interfaces (corner joints, collimator joints, imaging source housing, etc.) and shall be in compliance with ANSI N43.3- 2008, Chapter 7, and N43.14-2011 Chapter 6.0, standards for their system.

The Contractor shall ensure that any movement or shifting that may be associated with shipping will not produce or lead to emission leaks from cracks, stress or misalignment of the structures and shielding devices that are either associated with the primary beam containment or scatter containment scheme.

Radiological Survey and Report The Contractor shall be required to conduct a radiological survey prior to system delivery to ensure that radiation emissions are within specified limits. Each system delivered shall be accompanied with a report of the radiological survey performed on the system, signed by the Contractor’s Radiation Safety Officer. This survey will address both the radiation levels to which system operators will be exposed while at their workstations and the level of radiation that is transmitted to the environment as a result of system leakage. The report shall show this information by means of an outline drawing the levels of emission/scatter radiation measured, the ‘worst case’ operating conditions (i.e., highest energy level, slowest scan speed, greatest scatter range) and the measurement equipment used. The Contractor shall provide a radiological survey report and a Radiation Survey Report or Leak Test Report as applicable in accordance with the attached DID A015 for each system delivered.

Annual Radiation Survey and Report The Contractor shall perform Radiation Surveys at the time of delivery site prior to site acceptance that contain radiation emitting devices (X-Ray systems). The X-ray systems shall be in compliance with 21 CFR 1020.31, Radiographic Equipment, (a) Control and indication of technique factors (energy, time, and amperage) and (b) Reproducibility (ability of device to produce consistent radiation doses). The Contractor shall provide a radiation survey report to the NII Operations Center within forty-eight (48) hours of completion. A representative/sample Radiation Survey Report shall be submitted with the quote and each Site Acceptance Test in accordance with DID A015.

Safety Plan In accordance with 29 CFR 1910.120, Occupational Safety and Health Standards (OSHA), Appendix D, paragraph 8, the Contractor shall develop and implement a safety plan. The Contractor’s safety plan in the Contractor’s format shall also continually identify all safety hazards and provide a methodology to mitigate or eliminate each of the identified hazards, see DID A023.

All products, designs and specifications provided and all construction and installation activities conducted shall comply with all OSHA and General Services Administration (GSA) regulations, as well as any other appropriate laws, regulations, standards, codes and health and safety guidelines.

Hazardous Materials In accordance with 29 CFR1910.1200 (e)(2), Occupational Safety and Health Standards (OSHA), the Contractor shall provide a list of all hazardous materials and the corresponding Material Safety Data Sheet (MSDS) for each identified Hazardous Material. The list shall include the material description, quantity of the material, storage and disposal instructions, exposure risks, symptoms and treatments. The list shall be prepared in accordance with DID A004 and be maintained in the Technical Documentation Package throughout the life of the NII system. The list shall be derived for the Hazardous materials identified in the 49 CFR Part 172, Subpart B - Table of Hazardous Materials and Special Provisions.

Information Technology Security The Contractor shall adhere to all DHS and CBP IT security policies and the basic requirements, security authorization, encryption compliance, and pass security review.

Basic Requirements The Contractor shall adhere to all DHS and CBP IT security policies, including the guidelines and policies stated in the DHS Sensitive Systems Policy Directive 4300A, chapters 4 and 5, or any subsequent, replacement or revised publication. This policy mandates DHS organizational elements, including Contractors, follow guidelines outlined in the DHS 4300A, Sensitive Systems Handbook, Information Technology Security Program, version 12, 11/15/15 with attachments or any subsequent, replacement or revised publication.

DHS Directive 4300A, Section 3.1 Basic Requirements outlines the management, operational and technical baseline security requirements (BLSR) for DHS Components to ensure confidentiality, integrity, availability, authenticity and non-repudiation of sensitive information systems. The 4300A Handbook provides greater detail of the BLSRs, including the roles and responsibilities associated with each.

CBP will provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS MD 4300A, DHS Sensitive Systems Policy and Handbook (2017), paragraph 4.1.1.d. During all systems development life cycle (SDLC) phases of CBP systems, CBP personnel will develop documentation and provide any required information for all levels of classification in support of the certification/accreditation process. In addition, all security certification/accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

Security Authorization

a. A Security Authorization of any infrastructure directly in support of the DHS information system shall be performed by the Contractor as a general support system (GSS) prior to DHS occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results. The Security Authorization shall be performed in accordance with the DHS Security Policy and the controls provided by the hosting provider shall be equal to or stronger than the Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, Section 3, security categorization of the DHS information system.

b. At the beginning of the contractthe Contractor shall provide the results of an independent assessment and verification of security controls in the Contractor’s format. The independent assessment and verification shall apply the same standards that DHS applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the COR for entry into the DHS’ Plan of Action and Milestone (POA&M) Management Process. The Contractor shall use the DHS’ POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS POA&M Management Process. Contractor procedures shall be subject to periodic, unannounced assessments by DHS officials. The physical aspects associated with Contractor activities shall also be subject to such assessments.

c. On a periodic basis, the DHS and its Components, including the DHS Office of Inspector General, may choose to evaluate any or all of the security controls implemented by the Contractor under these clauses. Evaluation could include, but is not limited to vulnerability scanning. The DHS and its Components reserve the right to conduct audits at their discretion. With ten working days’ notice, at the request of the Government, the Contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein DHS information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of DHS, including those initiated by the Office of the Inspector General. The Government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by DHS in the event of a security incident.

DHS Security Policy Requirement All hardware, software, and services provided under this contract must be compliant with DHS Sensitive Systems Policy, Section 4.8, and the DHS 4300A Sensitive Systems Handbook, Section 4.8.

Encryption Compliance Requirement All system drives provided under this contract must be DHS encryption compliant. The following methods are acceptable for encrypting sensitive information:

· Products using FIPS 197 Advanced Encryption Standard (AES), Chapter 5, algorithms with at least 256 bit encryption that has been validated under FIPS 140-2 Security Requirements for Cryptographic Modules, Chapter 4.

· National Security Agency (NSA) Type 2 or Type 1 encryption

Security Review The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS including the organization of the DHS Office of the Chief Information Officer, Office of Inspector General, the CBP Chief Information Security Officer, authorized Contracting Officer’s Representative (COR), and other Government oversight organizations, access to the Contractor’s and subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of Government oversight organizations external to the DHS. The Contractor shall provide access to the extent necessary for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

Access to Unclassified Facilities, Information Technology (IT) Resources, and Sensitive Information IT resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information paragraph 6, describes how Contractors must handle sensitive but unclassified information. DHS Sensitive Systems Policy Directive 4300A, paragraph 3.14, and DHS Sensitive Systems Handbook, MD 4300, an Information Technology Security Program, Chapter 4, prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering Contractors specifically for all task/delivery orders that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the Contractor except as specified in the contract.

Contractors who require access to the DHS network, such as when conducting remote maintenance, require a background investigation in accordance with DHS MD 4300A Sensitive Systems Policy and Handbook (2017), MD 4300.A, paragraph 4.1.1.d.

Personal Identity Verification of Contractor Personnel

a. The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors, paragraph 3, Office of Management and Budget (OMB) guidance M-05-24, Appendix A, chapters 3 and 4, and Federal Information Processing Standards Publication (FIPS PUB) Number 201-2, Personnel Identity Verification of Federal Employees and Contractors, Section 2.

b. The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have routine physical access to a federally controlled facility or routine access to a Federally-controlled information system.

Security Requirements for Unclassified Information Technology Resources

a. The Contractor shall be responsible for…