Attachments_2-6_HSSCCG-15-R-00012.pdf

Solicitation HSSCCG-15-R-00012 Attachment 2 Next Generation Card Consumables Security Requirements

p. 1 of 9

Next Generation Card Consumables Security Requirements

09/17/2014

1 GENERAL

U.S. Citizenship and Immigration Services (USCIS) has determined that performance of this contract requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor), requires access to sensitive but unclassified information, and that the Contractor will adhere to the following.

2 SUITABILITY DETERMINATION

USCIS shall have and exercise full control over granting, denying, withholding or terminating access of unescorted Contractor employees to government facilities and/or access of Contractor employees to sensitive but unclassified information based upon the results of a background investigation. USCIS may, as it deems appropriate, authorize and make a favorable entry on duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment suitability authorization will follow as a result thereof. The granting of a favorable EOD decision or a full employment suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by USCIS, at any time during the term of the contract. No Contractor employee shall be allowed unescorted access to a Government facility without a favorable EOD decision or suitability determination by the Office of Security & Integrity Personnel Security Division (OSI PSD).

3 BACKGROUND INVESTIGATIONS

Contractor employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive but unclassified information shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract as outlined in the Position Designation Determination (PDD) for Contractor Personnel. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. All background investigations will be processed through OSI PSD.

Next Generation Card Consumables Security Requirements

p. 2 of 9

To the extent the Position Designation Determination form reveals that the Contractor will not require access to sensitive but unclassified information or access to USCIS IT systems, OSI PSD may determine that preliminary security screening and or a complete background investigation is not required for performance on this contract.

Completed packages must be submitted to OSI PSD for prospective Contractor employees no less than 30 days before the starting date of the contract or 30 days prior to EOD of any employees, whether a replacement, addition, subcontractor employee, or vendor. The Contractor shall follow guidelines for package submission as set forth by OSI PSD. A complete package will include the following forms, in conjunction with security questionnaire submission of the SF-85P, “Security Questionnaire for Public Trust Positions” via e-QIP:

1. DHS Form 11000-6, “Conditional Access to Sensitive But Unclassified

Information Non-Disclosure Agreement”

2. FD Form 258, “Fingerprint Card” (2 copies)

3. Form DHS 11000-9, “Disclosure and Authorization Pertaining to Consumer

Reports Pursuant to the Fair Credit Reporting Act”

4. Position Designation Determination for Contract Personnel Form

5. Foreign National Relatives or Associates Statement

6. OF 306, Declaration for Federal Employment (approved use for Federal Contract

Employment)

7. ER-856, “Contract Employee Code Sheet”

4 EMPLOYMENT ELIGIBILITY

Be advised that unless an applicant requiring access to sensitive but unclassified information has resided in the U.S. for three of the past five years, OSI PSD may not be able to complete a satisfactory background investigation. In such cases, USCIS retains the right to deem an applicant as ineligible due to insufficient background information.

Only U.S. citizens are eligible for employment on contracts requiring access to Department of Homeland Security (DHS) Information Technology (IT) systems or involvement in the development, operation, management, or maintenance of DHS IT systems, unless a waiver has been granted by the Director of USCIS, or designee, with the concurrence of both the DHS Chief Security Officer and the Chief Information Officer or their designees. In instances where non-IT requirements contained in the contract can be met by using Legal Permanent Residents, those requirements shall be clearly described.

p. 3 of 9

The Contractor must agree that each employee working on this contract will have a Social Security Card issued by the Social Security Administration.

5 CONTINUED ELIGIBILITY

If a prospective employee is found to be ineligible for access to USCIS facilities or information, the Contracting Officer’s Representative (COR) will advise the Contractor that the employee shall not continue to work or to be assigned to work under the contract.

In accordance with USCIS policy, contractors are required to undergo a periodic reinvestigation every five years. Security documents will be submitted to OSI PSD within ten business days following notification of a contractor’s reinvestigation requirement.

In support of the overall USCIS mission, Contractor employees are required to complete one-time or annual DHS/USCIS mandatory trainings. The Contractor shall certify annually, but no later than December 31st each year, that required trainings have been completed. The certification of the completion of the trainings by all contractors shall be provided to both the COR and Contracting Officer.

• USCIS Security Awareness Training (required within 30 days of entry on duty for new contractors, and annually thereafter)

• USCIS Integrity Training (Annually)

• DHS Continuity of Operations Awareness Training (one-time training for contractors identified as providing an essential service)

• USCIS Office Safety Training (one-time training for contractors working within USCIS facilities; contractor companies may substitute their own training)

• USCIS Fire Prevention and Safety Training (one-time training for contractors working within USCIS facilities; contractor companies may substitute their own training)

USCIS reserves the right and prerogative to deny and/or restrict the facility and information access of any Contractor employee whose actions are in conflict with the standards of conduct or whom USCIS determines to present a risk of compromising sensitive but unclassified information and/or classified information.

Contract employees will report any adverse information concerning their personal conduct to OSI PSD. The report shall include the contractor’s name along with the adverse information being reported. Required reportable adverse information includes, but is not limited to, criminal charges and or arrests, negative change in financial circumstances, and any additional information that requires admission on the SF-85P security questionnaire.

OSI PSD must be notified of all terminations/ resignations within five days of occurrence. The Contractor will return any expired USCIS issued identification cards and HSPD-12 card, or those of terminated employees to the COR. If an identification card or HSPD-12 card is not available

Solicitation HSSCCG-15-R-00012 Attachment 2

p. 4 of 9 to be returned, a report must be submitted to the COR, referencing the card number, name of individual to whom issued, the last known location and disposition of the card.

6 SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OSI through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and OSI shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

The Contractor shall be responsible for all damage or injuries resulting from the acts or omissions of their employees and/or any subcontractor(s) and their employees to include financial responsibility.

7 Physical Security

7.1 General

The COR assisted by OSI Government Field Security Manager have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Moreover, prior to manufacturing or processing USCIS sensitive card items (i.e., cardstocks and holographic images), the Contractor’s facility (or facilities) must be inspected and pre-approved by the Government and the Contracting Officer has issued a Notice to Proceed to the Contractor. The inspection should soon be followed by appropriate training of Contractor personnel charged with carrying out security functions at the facility, to include written standard operating procedures (SOPs) and user manuals to operate/monitor the security systems. Should the COR determine that the Contractor is not complying with the security requirements of this contract, the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

7.2 Security Management

The Contractor is responsible for safeguarding all USCIS sensitive card items in their custody and control. The extent of protection afforded to sensitive card items must be sufficient to reasonably foreclose the possibility of loss or compromise. It is imperative that the Contractor ensure that physical access to the areas where USCIS sensitive card items are developed/processed (hereafter referred to as processing area) and stored are restricted to personnel cleared through the Government’s security process. Personnel visiting or obtaining

p. 5 of 9 access to these areas that have not been cleared by the Government, must be escorted by cleared/authorized personnel at all times.

Violations of any security procedures or requirements must be reported to the CO and COR via email within one (1) hour from time of occurrence. Additionally, any security incidents or threats to the facility or personnel must be reported to the Co and COR to ensure an appropriate response and implementation of security measures to mitigate any potential risk(s) to USCIS sensitive card items.

8 Physical Security Requirements – Controlled Access

8.1 Processing Area

The following construction and equipment specifications are for the area where USCIS sensitive card items are processed:

a) Interior Perimeter Walls. Interior perimeter walls are defined as those walls that separate the processing area from other areas within the facility. Interior perimeter walls must be constructed slab-to-slab.

b) Doors. Limit number to minimum required by fire safety. Solid core wood, minimum 1¾" thick, or hollow metal minimum 1¾" thick, installed in welded steel frame assembly.

Hinges preferred on internal side of door; if external, hinges may need to be pinned based on a joint on-site assessment by the appointed Corporate Security Officer and Government Field Security Manager. Door hardware must be a Grade 1 cylindrical or mortise leverset. The door lock must be a keyed deadbolt with a 1” throw, and a non-hold open door closer must be installed/equipped on the door.

Note: Although not a requirement for this SOW, the Contractor may substitute the keyed deadbolt lock requirement with an electronic Physical Access Control System (PACS) with an electric strike (fail secure) lock with a bypass key at its expense. The system is controlled through the Contractor configured system utilizing a Contractor purchased door access proximity card. If a PACS is employed at the facility, the Corporate Security Officer must review the access list and PACS generated reports of access to the processing and storage area(s) on a monthly basis with the intent to identify unauthorized access or suspicious activity and to remove from the facility access list the names of those personnel who no longer require access.

c) Intrusion Detection System (IDS). Intrusion detection door contact located either in the door frame or on the secure (interior) side of the door.

d) Windows. Due to security concerns with windows being left unlocked or open after hours, operational windows are discouraged in the processing area. However, if they are used or already exist, windows must contain locks that are not susceptible to manipulation from the outside. The lock must be of a type that requires the user to throw a bolt or latch, or to slide a

p. 6 of 9 handle to lock or unlock the window. Spring-loaded latches are not acceptable. During non-duty hours or non-processing hours, the windows must be closed and securely fastened.

8.2 Secure Storage

As mentioned in Section 5.3, Secure Handling, Storage and Disposition, the Contractor must securely store (or arrange for subcontract manufacturers to store) all USCIS-unique or otherwise sensitive card items that are not immediately shipped to the USCIS Card Production Facilities.

At a minimum, the secure storage area must meet the following construction and equipment specifications:

a) Walls. Walls must be true floor to true ceiling and constructed of plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other material offering similar resistance to and evidence of unauthorized entry to the area. If wall barriers do not extend to the true ceiling, the wall must be extended above the false ceiling to the true ceiling or the false ceiling must be reinforced with wire mesh or 18-gauge expanded metal.

b) Doors. Doors must be 1¾” 16-gauge hollow metal or 1¾” solid core wood. Doors must be equipped with a pneumatic door closer and have non-removable hinge pins or locking studs on the hinge edge and into the door frame of out-swinging doors. Out-swinging doors must also be equipped with a latch plate. Entrance/exits must be kept to a minimum. Where there are multiple door openings, only one must be used as the primary entrance/exit and equipped with locking mechanisms as stated below. All other openings must serve as emergency exits only and be equipped with emergency “panic” hardware on the inside and no hardware on the outside. Where the size of the room dictates multiple routine-use doors, all routine-use doors must be equipped with locking mechanisms as stated below.

c) Locks. The door lock must consist of a 6-pin high security lock with approved cylinder housing and a minimum 1” deadbolt. Cipher locks and card readers in and of themselves are not sufficient for securing the area and may be installed as a supplementary measure for access control purposes only.

d) Windows. Windows are not allowed.

e) Other Openings. Ducts, pipes, registers, sewers, etc. in excess of 96 square inches that penetrate the room perimeter must be secured with 18-gauge expanded metal or wire mesh, or by rigid metal bars ½” in diameter extending across their width with a maximum space of 6” between bars.

f) Intrusion Detection System (IDS). As a security best practice, an IDS must be used to supplement the structural requirements identified above. The IDS must be connected to a central monitoring station with an alarm keypad adjacent to the primary entrance/exit on the storage room’s protected side. Additionally, the Contractor will also install and maintain dual

p. 7 of 9 technology motion sensor (infrared and ultrasonic). The motion detector and the alarm keypad will have a 24 hour back-up power source.

g) Signage. There must be signs posted designating secure storage as a “Restricted Area.”

8.3 Intrusion Detection System

As outlined above, the Contractor must secure both the processing and secure storage areas with a 24 hour monitored Intrusion Detection System (IDS) that utilizes dual technology motion sensors (infrared and ultrasonic). The motion sensor detection field must provide complete coverage in both areas to include entrances and windows (if applicable). The motion sensor keypad controller must be located adjacent to the primary entrance doors on the secure (interior) side. Additionally, the motion sensor programming configuration must be zoned separately between the processing and secure storage area. Unique individual keypad combinations must be assigned to all personnel authorized to arm and disarm the areas (e.g., shift supervisor that opens and disarms processing area at beginning of workday must have different combination than employee that arms and secures area at end of workday). A generic “master” keypad combination used by multiple personnel is not allowed.

The Contractor must conduct monthly documented tests of the IDS to ensure all equipment is operating properly. The COR must be notified immediately - both verbally and in writing at any time the IDS is not functioning properly and USCIS sensitive card items are stored on site.

8.4 Operations and Maintenance of Physical Security Countermeasures The Contractor is responsible for all security countermeasures and must ensure they are routinely tested, maintained, and replaced when no longer functional. Maintenance of security systems may be one of two types: preventive or breakdown.

• Preventative maintenance is performed on a regular basis, usually annually or semi-annually (but may be more often depending on the equipment), focused on routine servicing to prevent a system failure or breakdown.

• Breakdown maintenance is maintenance performed when a system or piece of equipment fails to function. Any [critical] security system component that becomes inoperable for service must be replaced or repaired within 72 hours. If the component is not replaced or repaired within 72 hours (e.g., parts on order), than an equivalent interim countermeasure or procedure must be implemented until the security system component is replaced or repaired. In the event that a security system becomes non-operational, the CO, COR and Government Field Security Manager will be notified immediately. During the period that the system is non-operational, the CO, COR and Government Field Security Manager must be informed of the compensatory measures (in place) until the system is repaired.

8.5 Accountability and Control

p. 8 of 9

The Contractor must establish and maintain a system to deter and detect unauthorized removal of USCIS sensitive card items from the facility. Sensitive card items must also be accounted for in case an imperfection or a mistake is discovered and the contractor assumes the responsibility of destruction. Destruction procedures are outlined in Section 5.3, Secure Handling, Storage and Disposition, while accountability and inventory procedures are covered in Section 7, Plans and Reporting.

What’s more, the Contractor is responsible for the accountability and control of all lock combinations and keys used to secure the processing and storage areas for USCIS sensitive card items.

8.6 Keys

The Contractor must use a key control system and adopt administrative policies that facilitate the enforcement of key management procedures for the processing and secure storage areas of USCIS sensitive card items. The following bullets represent the basic and most critical elements of key control and must be included, at a minimum, in the Contractor’s key control policy or outlined in the Security Plan.

• Method for the issuance and collection of all keys to the processing and secure storage areas for USCIS sensitive card items, and identification of personnel authorized possession of the keys.

• Keys must be stored in a locked cabinet (with a metal key and lock) or security container in a restricted (or secure) area.

Note: Restricted areas are defined as rooms and offices to which access is strictly and tightly controlled. Admittance to a restricted area is limited to personnel assigned to the area or persons who have been specifically authorized access to the area. Visitors to a restricted area and non-cleared personnel are escorted by personnel assigned to the area and all sensitive and classified information is protected from observation, disclosure, or removal.

• Keys must only be issued to individuals who have a legitimate and official requirement for the key.

A requirement for access alone, when access can be accomplished by other means (such as request for entry, prior coordination with the Corporate Security Officer, etc.). must not convey automatic entitlement to a key.

• List of keys to the processing and secure storage areas (further identified by lock and area).

• Method for tagging keys for ready identification.

• Action required if keys are lost, stolen, or misplaced.

p. 9 of 9

• Frequency and method of lock rotation.

• The Contractor must inventory keys and locks on an annual basis.

• Re-key locks whenever:

A key has been lost.

There is the possibility that a key has been compromised.

There is a change of personnel that were previously issued a key.

8.7 End of Day Security Checks

The Contractor must establish a system of security checks at the close of each working day to ensure that all USCIS sensitive card items have been appropriately secured and accounted for.

8.8 Emergency Procedures

The Contractor must develop procedures for safeguarding USCIS sensitive card items in emergency situations. The procedures must be as simple and practical as possible and should be adaptable to any type of emergency that may arise. The Contractor must promptly report to the COR any emergency situation that renders the facility incapable of safeguarding USCIS sensitive card items.

Solicitation HSSCCG-15-R-00012 Attachment 3 Next Generation Card Consumables Corrective Action Process

p. 1 of 2

Corrective Action Process

The following process will be utilized when a problem arises with consumable products identified at any USCIS production site, and is effective for the term of the contract and any orders issued under the contract (including any storage requirements). For purposes of this corrective action process, there are two circumstances under which a corrective action will be initiated: visual inspection and actual card personalization.

VISUAL INSPECTION

The card production operations personnel will receive consumable products at the production facilities. A visual inspection, utilizing the appropriate consumable specifications provided by the vendor, will be performed that includes looking for appropriate characteristics of performance as well as any defects or abnormalities with the consumable products delivered.

ACTUAL CARD PERSONALIZATION

The other circumstance that will initiate the corrective action process is when the consumable passes the visual inspection but incurs problems in actual personalization.

When a problem is identified with a consumable product (see Consumable Definitions herein), the card production operations personnel will test the consumable and complete a corrective action form (see Attachment 2 - Corrective Action Form). Once completed and reviewed by USCIS facility management, an electronic copy of the corrective action form will be sent to the USCIS COR and the Contracting Officer. The Contracting Officer will then forward the report to the prime contractor’s Program Manager. A sample of the consumable will also be sent to the prime contractor, at contractor expense, for review and/or testing. The prime contractor will acknowledge receipt of the sample by signing and returning the G-504, Report of Property Shipped/Received to Corbin, KY or Lee’s Summit, MO, as appropriate, within two days.

At a minimum, the following information will be included on the corrective action form:

(a) Identification of the consumable

Solicitation HSSCCG-15-R-00012 Attachment 3 Next Generation Card Consumables Corrective Action Process

p. 2 of 2

(b) Detailed description of the problem

(c) Lot quality and quantity affected

(d) Impact to operations

(e) Lot number and manufacturing date and,

(f) Facility where the consumable problem originated

The Contractor will review and/or test the sample and determine the condition of the consumable product in question. The Contractor will coordinate with any appropriate vendors/sub-contractors regarding the results of their review and/or test. The Contractor will submit a report to the USCIS COR and the Contracting Officer, who will then send a copy to the Card Production operations project manager within three weeks from the date of receipt of the corrective action form.

If this is an emergency situation the report will be submitted as soon as possible. An emergency situation is one that threatens work stoppage in production.

If the problem(s) identified on the corrective action form are invalidated by the review and/or test performed via the Consumables Contractor ,USCIS and all other parties mentioned above will have the option to re-test the consumable in Corbin, KY upon agreement by all parties (see Attached Test Requisition).

Solicitation HSSCCG-15-R-00012 Attachment 4 Next Generation Card Consumables Corrective Action Form

Corrective Action Form

Solicitation HSSCCG-15-R-00012 Attachment 4 Next Generation Card Consumables Corrective Action Form

Date: Tracking #:

Facility: Corbin Nebraska Lee's Summit Quantity

Problem Description: Product Returned?

Site Mngr/Asst. Site Mngr or Quality Mngr. Resp. Party: Response Due Date:

Target Resp. Actual

Date Person Imp. Date

Management Review (Comments):

Signature

Date Closed

1. To be completed by initiator. 3. To be completed by responsible party and return to QA Mngr. 5. To be completed by Quality Manager.

2. To be completed by management. 4. To be completed by Management.

F-752-901-01 Rev 3

Document Management Division Corrective/Preventive Action

Report

Number:

Operation Impacted:

Confirmed By / Date:

Effectiveness Audit: (How?)

Corrective/Preventive Action Resolution:

Description (RMA# If Needed):

Initiator:

Analysis & Diagnosis of Problem (Root Cause):

Product Name:

Yes No

Justified Unjustified Quality Delivery Preventive

Solicitation HSSCCG-15-R-00012 Attachment 5 Next Generation Card Consumables Current PRC and EAD Card Images

Current PRC and EAD Card Images

PRC Front

PRC Back

Solicitation HSSCCG-15-R-00012 Attachment 5 Next Generation Card Consumables Current PRC and EAD Card Images

EAD Front

EAD Back

Solicitation HSSCCG-15-R-00012 Attachment 6 Next Generation Card Consumables CPSTR System Impacts/Interface

p. 1 of 7

Card Personalization System Technology Refreshment (CPSTR) System Impacts/Interface with Identification

Card Stock

1. Objective The Card Personalization System Technology Refreshment (CPSTR) System was developed to receive data from the USCIS National Production System (NPS), personalize and issue cards, in a manner that assures efficiency and maximizes security and acknowledge production and mailing of the card.

2. Background The USCIS Document Management Division (DMD) manages the secure identification card personalization system to personalize secure USCIS cards in a manner that assures efficiency and maximizes security. The current portfolio of secure cards produced within DMD includes the Permanent Resident Card (PRC) and Employment Authorization Document (EAD) Cards.

3. CPSTR System Components The Contractor shall deliver on an indefinite delivery, indefinite quantity (IDIQ) basis, CPSTR workstation components and software, any available warranties, as required by the USCIS on an IDIQ basis. The delivered workstations shall be compatible with the most recent applications software versions being used in Corbin. The Contractor shall deliver these items per the purchase order.

a. Inventory Control Workstations

b. Card Counter Workstation with RFID reading capability

c. Viewer Workstations

d. Stampers Workstations

e. Optical Card Encoding Workstation

f. Laser Marking Workstations

p. 2 of 7

g. Automatic Inspection Workstations

h. Manual Quality Assurance Workstations

i. Batching Workstations

j. Mailer/Inserter Workstations

I CPSTR SYSTEM PERFORMANCE SPECIFICATION

SECTION 1 - SCOPE

This specification covers the performance and verification requirements for the USCIS/DMD CPSTR system.

1.1 System Overview

The CPSTR addresses the need to have an up-to-date, versatile and reliable identification CPS.

SECTION 2 - APPLICABLE DOCUMENTS

2.1 General

The documents listed in this section are referenced in Section 3 of this specification. This section does not include documents cited in other sections of this specification or recommended for additional information or as examples. While every effort has been made to ensure the completeness of this list, Offerors are cautioned they must meet all specified requirements documents as cited in Section 3.

2.2 Government specifications, standards, or handbooks

The following specifications, standards, and handbooks of the exact revision listed below form a part of this specification to the extent specified herein.

Title – Description Number NIST Special Publication - Information Security 800-73 Federal Information Processing Standard 201-1 FIPS-201-1 Federal Information Processing Standard 140-2 FIPS-140-2

2.3 Non-Government publications

The following documents of the exact revision listed below form a part of this specification to the extent specified herein.

The system shall accommodate card types listed in this specification that meet the following standards:

Title – Description Number Identification Cards - Physical characteristics ISO/IEC 7810 Identification Cards - General characteristics ISO/IEC 11693 Identification Cards - Physical characteristics ISO/IEC 11694-1 Identification Cards - Dimensions and locations of the accessible optical area ISO/IEC 11694-2 Identification Cards - Optical properties and Characteristics ISO/IEC 11694-3 Identification Cards - Logical data structure, Annex B ISO/IEC 11694-4 Identification cards Contactless integrated circuit(s) cards, Vicinity cards ISO/IEC 15693 Information Technology. Radio frequency Identification for Item Management ISO/IEC 18000 -1 through -6 Machine Readable Travel Documents ICAO Document 9303 – Part 3

2.4 Order of precedence

In the event of a conflict between the text of this specification and the references cited herein, the text of this specification takes precedence. Nothing in this specification, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

SECTION 3 – REQUIREMENTS

p. 3 of 7

3.1 Operational Requirements

A system is the equipment, cabling, and software needed to provide a given production site's card personalization volume capability. Different sites could have different volume requirements and sizing requirements, therefore, not always the same number of components.

3.2.1 Identification Card Production and Personalization

The CPSTR system shall personalize various types of blank card stock, leading to mailable identification cards such as Permanent Resident Cards (PRC) with RFID tags and Employment Authorization Document (EAD) cards. The system at any site shall have the identical capability of printing the same card types. The system shall control and coordinate the actions of all system hardware and software components and create all necessary files for printing and encoding optical and non-optical cards.

3.2.1.1 Identification Data Matching

Upon first being processed by the system, the system architecture shall be able to scan and recognize an individual card’s unique identifier (e.g., 1-D barcode, serial number, or chip identifier). The system shall be able to create a match to a card request record and process and track it throughout the personalization process based on that card's unique identifier/database record matching. The identification function shall match a single card’s identifier with the following information in the local database, including but not limited to:

a. Biometric Data

b. Biographic Data

The CPSTR system architecture is based on an “Islands of Automation” approach” where each step in the card personalization process is occurs at a discreet workstation consisting of a combination of a computer or computers, custom developed card personalization or other hardware and software, and in some cases commercial-off-the-shelf (COTS) sub-systems.

The system shall process cards at the various CPSTR workstations at the rates required below for both the CPF and LPF locations. All workstations shall operate using the most recent CPSTR software release:

a. Inventory Workstation – The Inventory workstation shall allow an operator to input a range of card serial numbers, which will be used by the CPSTR data base. The system shall have the functionality to implement a query for cards based on location, card type, and return ranges and perform status actions on those cards. The Inventory Control application shall allow “Uncounted” or “Counted” cards to be checked back to Secure Storage from Staging. Inventory moves will have a confirmation message.

The system shall allow cards to be signed out or signed back in to the facility by ranges as well as individually. The system shall implement a user-friendly confirmation message for the check-in, check-out, and remove-cards buttons. This should prompt the operator to confirm that they want to proceed with the Card Check-In function. The confirmation message-box will list the card type and range(s) of cards to be checked in and ask the operator to confirm the operation.

b. Card Counting - The Card Counting Workstations shall automatically take a stack of up to 500 cards at one time and automatically check the card serial number barcode, convey that data to the CPSTR database, and keep a correct count of the number of cards reviewed. The system shall check the card barcode for format inconsistencies. The counter shall interrogate the RFID chip of RFID enabled cards and add the card’s unique RFID identifier to the database record for that card serial number. A single workstation shall process a total of at least 7,000 cards per hour (+/- 5%). The card counter software shall check each barcode read to ensure the format is <2-digits: recognized card type><2-digits: 01-12 for month><2-digits: 00-99 for year><8-digits: 00000000-99999999 for serial number>.

c. Viewer Workstation - Operators will be able to “scrap” scanning issue cards using the Viewer application. The system shall allow a search by AppID for Viewer Request Reconciliation and Card Reconciliation. The Viewer application shall ensure the correct number of digits (7 digits of sequence

p. 4 of 7 plus 1 check digit) is generated and subsequently programmatically written to the 3600. The Viewer shall allow the operator to generate a Summary Aging Report and/or a Detail Aging Report by card type. The Viewer application shall allow the 1D barcode reader to be used to click the check boxes for multiple requests on the Request Reconciliation screen so that operators don’t have to scroll and manually find each card in the list (e.g., scrap multiple cards by barcode number). The operator shall be able to change from the current date range selection to three specified date-selectable options allowing the Request Reconciliation searches to bring up request status information.

d. Stamper Workstation - Stamper workstations shall be capable of applying any required holographic stamps to cards at a rate of at least 2500 cards per hour.

e. Optical Memory Card Encoding – Each optical memory encoding workstation (Currently comprised of two optical encoding towers per workstation) shall be capable of encoding at least 130 PRC cards per hour (+/- 5%) based on the results of uninterrupted optical encoding speeds/times.

f. Laser Marking Workstations - The Laser Marking stations shall be capable of marking PRC cards with gray-scale marking for images, black text, and clear text, tactile text markings. The work station shall be capable of producing black laser marking at variable resolutions at up to 1,200 dots per inch resolution. The lasers shall be able to operate at both 30 watts and 20 watts to accommodate different card substrates. The system shall be capable of switching from one card format to another (i.e., changing out card stock, switching card format software, etc.) in less than one hour. The Laser Marking stations shall be capable of marking vertical clear tactile Laser marked date of birth and gender indication data from CLAIMS on each card. The Laser Marking stations shall be capable of marking a machine Readable Zone (3-lines of OCR-B Text) shall be personalized with data from USCIS data systems. The Laser Marker shall allow for independent positional control of all data fields laser marked onto a card for both the front as well as the back of each card.

i. PRC Card Laser Marking: - A laser marking station shall be capable of completely marking at least 300 PRC cards per hour (+/- 5%) based on the results of uninterrupted speeds/times.

ii. EAD Card Laser Marking (4 stations) - A laser marking station shall be capable of completely marking at least 280 EAD cards per hour (+/- 5%) based on the results of uninterrupted speeds/times.

g. Automated Vision Station – The Automated Vision Station shall automatically check the personalized card for correct biometric/biographic data, when compared to the local database record. The Automated Vision Station Workstations will inspect cards at a rate of at least 725 cards per hour (+/- 5%).

h. Manual Quality Workstation – The workstation shall be capable of displaying a screen image automatically selected from the 1D barcode read and the Manual QA configuration file settings (i.e., the user does not need to select the card type when doing the Manual QA process). The Manual QA application shall display all personalized fields on the screen for visual verification by the operator.

The Manual QA workstation shall be able to confirm readability of the RFID tag data, as well as read the RFID from PRC cards that include the Monza ID or Monza 4D chip, as well as reading the Machine Readable Zone (MRZ). Manual QA scanning issue selections shall be translated into code “MAXX” when the request record is returned to NPS.

i. Batching Workstation – The batching workstation shall allow an operator to perform card barcode scans of individual cards in order to form batches of 50 cards each which are ready for mailing. Batches shall consist of only PRCs or EAD cards. The system shall enable selection of batches by card type for SMI reports. A mixture of EADs and PRCs shall not be allowed. Each station shall be configured to allow operators to process at least 1800 cards per hour (+/- 5%).

p. 5 of 7

j. Mailing/Stuffing Workstation – The workstations shall take finished cards and insert them with an associated mailing insert into envelopes ready for mailing. The mailing system shall be able to use standard business envelopes and envelopes measuring 6.0 inches by 9.0 inches, with the flap opening along the long side (top), made from at least 24 pound paper. The system shall be capable of either placing preprinted inserts in envelopes, or individually printing the inserts. The workstations produce shall process at least 1000 cards per hour (+/- 5%) based on the results of uninterrupted mailing/stuffing speeds/times. The system should be capable of printing text and bar codes on either the preprinted or blank inserts. The system shall print the USPS delivery confirmation barcode on the card carrier. The IMpb barcode shall appear in the window of the existing envelope. The system shall support a new IMpb upload file format (per USPS Publication 199, Appendix A, Pages 77-86) including a header record (H1) and detail records (D1). The system shall support USPS barcode standards on the carrier, an eye-readable header, and an eye-readable footer per USPS Publication 199, Section 4.4, Barcode Specifications, page-30. The system shall print a variable return address on the Card Mailer Envelope determined by data from USCIS data systems.

3.2.4 CPSTR Operation

The system shall store, record and direct data to the appropriate personalization workstation for further card processing. The system shall produce reports on the results of card production to include information on cards completed, rejected, reprinted, and production rates and consumables usage.

3.2.7 Card Bar Code and Serial Number Reading

The overall system architecture shall be designed such that an individual card, with its own unique 1-D bar code serial number, can be scanned into the system, to identify the card type to avoid a mismatch of card type and data. The 1-D bar code is then matched to a local network database record, and processed and tracked throughout the personalization process based on that serial number/database record matching.

3.2.8 Card Barcode Serial Number Checks

The system shall allow card orders to be processed, tracked and have automated quality assurance checks performed throughout the personalization process based on a match of the unique card identifier against the matching local database record.

3.3 Interface Requirements

3.3.1 Card Types

The CPSTR shall accept the following card types:

3.3.1.1 Optical cards

Optical memory cards following the Drexler and International Civil Aviation Organization (ICAO) 9303 standard, and the International Organization of Standardization (ISO) 7810 standard ID-1 size.

3.3.1.2. Non-Optical Cards

Non-Optical memory ISO 7810 ID-1 size cards, both PVC and Polycarbonate.

3.3.1.3 RFID Cards

RFID enabled cards conforming to the sizes described in paragraphs 3.3.1.1 through 3.3.1.3, and complying with ISO/IEC 18000.

p. 6 of 7

II Acronyms and Abbreviations

Acronym Meaning AIS Automatic Inspection System CD Compact Disk CIS Central Index System CLAIMS3 Computer Linked Application Information Management System CME Card Manufacturing Executive CO Contracting Officer COOP Continuity of Operations COR Contracting Officer's Representative COTS Commercial Off-The-Shelf CPE Card Personalization Element CPF Corbin Production Facility CPSTR Card Personalization System Technology Refreshment DB Database DelCon Delivery Confirmation DHS Department Of Homeland Security DMD Document Management Division EA Enterprise Architecture EAD Employment Authorization Document EPA Environmental Protection Administration EVM Earned Value Management FADR Final Architecture and Design Review FAR Federal Acquisition Regulation FIPS Federal Information Processing Standards FIPS-201-1 Federal Information Processing Standards - 201-1 GDIT General Dynamics Information Technology HSPD - 12 Homeland Security Presidential Directive - 12 IBR Integrated Baseline Review ICAO International Civil Aviation Organization ICD Interface Control Document ICPS Integrated Card Production System ID Identity IEC International Electrotechnical Commission INA Immigration And Naturalization Act ISO International Standards Organization IT Information Technology ITLM Information Technology Lifecycle Management

p. 7 of 7

ITSR Information Technology Service Request KPI Key Performance Indicators LCC Life Cycle Cost LPF Lee's Summit Production Facility LV Laser Visa LV/BCC Laser Visa/Border Crossing Card MS Microsoft MTBF Mean Time Between Failures N/A Not Applicable NPF Nebraska Production Facility NPS National Production System NSC Nebraska Service Center O&M Operations And Maintenance OIT Office of Information Technology OMC Optical Memory Card OSI Office Of Security and Integrity PM Project Manager PMP Project Management Plan POEM Portable Optical Encoding Machine PRC Permanent Resident Card PVC Polyvinyl Chloride QA Quality Assurance RFID Radio Frequency Identification RFP Request For Proposal RJ-45 Registered Jack-45 RRR Release Readiness Review SA Security Authorization SLM Systems Lifecycle Management SMI Secure Mail Initiative SOO Statement Of Objectives SWAD System Workload Analysis Document TRM Technical Reference Model TRR Test Readiness Review TSA Transportation Security Administration TWIC Transportation Worker Identification Credential TWP Temporary Worker Program USCIS United States Citizenship And Immigration Services VSC Vermont Service Center WBS Work Breakdown Structure