Industry_Day_Presentation.pdf

Personnel, Payroll & Benefits (PP&B)

Industry Day

February 29, 2016

• Please silence your phone

• Please note, reading room documents are not publicly available information, therefore, this information shall not be posted or reproduced in any public forum.

Reading Room - Administrative Item

• Rules of Engagement

– Binders must be signed out from a TSA official.

– Each company may sign out one binder at a time.

– Pen and pad note taking is permitted.

– Binders may NOT leave the room.

– No pictures or copying of any material in the binders is permitted.

– No removal of documents and/or pages are permitted.

– Companies may NOT approach Government personnel with questions on the content of the binders.

– Companies may NOT approach Government personnel with general inquiries, business cards or questions of any kind.

– Any company found to violate the reading room conditions may be escorted out and may be disqualified from participating in the Personnel, Payroll and Benefits procurement.

Reading Room Con’t

Reading Room

• Please silence your cell phone

• Facilities

• This presentation, question responses, and attendee list will be provided on www.fbo.gov

Administrative Item Reminders http://www.fbo.gov/

Agenda

• Introductions

• Purpose

• IT Security Overview

• Program Requirements

• Procurement Overview

• Source Selection Process Overview

• Discussion

• Office of Acquisition Points of Contact

Introductions

Purpose

• Pre-Proposal Conference/Industry Day

– FAR 15.201 “Exchanges with Industry before receipt of proposals”

• Exchange information to improve the understanding of the Government’s requirements;

• Enhance Transparency; and

• Enhance the Government’s ability to obtain quality supplies and services at reasonable prices.

– No one-on-one discussions

– Follow-up comments/questions are not allowed

Information Technology (IT) Security Requirements

IT Systems Security Authorization Process

• Security Authorization kickoff ~3-8 months before ATO and use of real data/end of transition

• DHS Hardening Guides, TSA Technical Standards

• Data Dictionary and any Interface Documentation from the existing or legacy system

• Security Control Assessment Execution ~5 to 6 months prior to the ATO expiration

• ATO Package Presentation: ~6 to 8 weeks prior to ATO expiration

Risk Management Framework

Step 1: System Categorization

• FISMA Inventory Change Request Form requires CPIC information and UII code

• Designate the System Owner and ISSO in writing

• System Data Categorization using FIPS 199/NIST SP800-60

Rev 1

– Privacy Threshold Assessment

– E-Authentication workbook

– CFO Designated System

– System of Record Notice (SORN)

Step 2: Select Security Controls

• Common Controls Identification

– Consider FedRAMP or other DHS/TSA Support Systems

• Security Control Identification

• Security Controls baseline and tailoring

• Develop Contingency Plan and Contingency Plan

Test Results

Step 2 continued: Develop Security Plan

• Needed

– Personnel

– Data types

– Network diagrams

– Hardware and software component inventory

– Operating systems

– Network ports and protocols

– Network interfaces

– Access methods

• Documents above help the Security Engineers create

Security Assessment Plan

Step 3: Implement Security Controls

• Security Plan documents the Security Control

Implementation

– Some controls may be defined, but not yet implemented

• Process allows for Planned controls to be documented in the Security Plan

Step 4: Assess Security Controls

• Use NIST SP 800-53A to assess security controls

• Signed Rules of Engagement contains a list of security tools to be used, TSA Security Engineers that will be working on the assessment, and list of user accounts required by the Security Engineers

Step 5: Authorize the Information System

• Assumes no critical Security findings are found

• Signed ATO document from the Authorizing Official

(AO) which means the system is free to process

TSA data

• Anytime before this point the contractor should only be using dummy data with no PII or SSI

• Vendors have 45/60/90 days to remediate any security vulnerabilities found

Step 6: Monitor Security Controls

• All security controls are continuously monitored on a periodic basis from real-time to annually, depending on the control

• Systems may go through reauthorization every three years or enter Ongoing Authorization where a system stays authorized as long as its Security

Metrics remain high

• Possible audits from TSA or DHS

Additional Security Requirements

• DHS PIV card authentication to applications, required by HSPD-12

• System access through DHS Trusted Internet

Connection (TIC) and Einstein3A

• TSA Security Operations Center (SOC) Event Log

Monitoring and Incident Response

Continuous Monitoring

• Continuous Diagnostic and Mitigation Phase 1 tools

– Tools feed data to DHS and into the CDM Dashboard

– Software sensors to be installed on equipment:

• Forescout CounterACT Secure Connector

• McAfee Policy Auditor

• McAfee Application Control

• Vulnerability Scanning tool, DHS will scan the vendor from offsite for less than 500 devices.

– Vulnerability Scanner is being determined by DHS.

• Future CDM phases will also have additional tools (to be determined).

• Tanium scans devices for Indicators of Compromise (IoCs)

• Invincea anti-phishing software

• Encase Incident Response and Forensic Analysis software

NIST 800-53 Rev4 CM-7 Least Functionality

• NIST recommends two technologies

– Application Blacklisting

– Applications Whitelisting

• Blacklisting technologies like Anti-Virus look at 300 million known bad files and only detect 30% of new malware

• Whitelisting technologies only need to know 100 thousand known good files and have a much higher success rate at blocking new malware

TS-70 Secure Code and Software Assurance

Development

• Every code release shall be submitted to TSA IAD for security testing prior to implementation in a production environment

• Security testing shall be conducted by TSA IAD or an

IAD- approved tester prior to promotion from one environment to another

• Code developed for use in TSA systems shall undergo pairwise combinatorial testing as defined by NIST SP

800-142, at a minimum

Program Requirements

TSA Office of Human Capital

• Mission

– Office of Human Capital provides strategic, sustainable, and comprehensive programs and services that attract, build and inspire a talented workforce through positive customer engagements

• Vision

– The Office of Human Capital; a trusted and forward-thinking provider of innovative workforce solutions;

putting people first, staying mission-focused and making TSA “the best place to work.”

TSA Authority

• Aviation and Transportation Security Act (ATSA) of

2001; PL 107-71

– ATSA section 111(d) – “(d) Screener Personnel. -- Notwithstanding any other provision of law, the Under Secretary of Transportation for Security may employ, appoint, discipline, terminate, and fix the compensation, terms, and conditions of employment of Federal service for such a number of individuals as the Under Secretary determines to be necessary to carry out the screening functions of the Under Secretary under section 44901 of title 49, United States Code.

The Under Secretary shall establish levels of compensation and other benefits for individuals so employed.”

• In the beginning, TSA adopted FAA’s policies

• In 2003, TSA moved from DOT/FAA to DHS

– Applicable DHS Delegations of authority

2/29/2016

Aviation and Transportation Security Act

(ATSA), Pub. L. 107-71

• TSA is an excepted service agency established under the authority of ATSA in 2001

• TSA is not excepted service under Title 5 CFR 302

• Notwithstanding any other provision of the law, ATSA provides that the Administrator can “employ, appoint, discipline, terminate, and fix the compensation, terms, and conditions of employment of Federal service” for the screener workforce (ATSA Section 111(d))

• TSA was covered under FAA’s policies until we could establish our own (49 USC 114(n))

• Title 5 does not apply except for provisions relating to: whistleblower protection; veterans’ preference;

antidiscrimination; suitability, compensation for work injury; retirement, unemployment compensation, and insurance coverage; and MSPB appeal rights (for the non-TSO workforce)

• In 2003, TSA became a component of DHS and was no longer under DOT

• TSA has an Interchange Agreement with OPM for non-TSES and TSES employees

• TSA is unique in:

– Core Compensation System

– Flexibility to establish compensation and leave policies

– Ability to provide the broadest application of veterans’ preference in the Federal Government

TSA Human Capital Management

Flexibility

• Excepted Service -outside Title 5

• Our authority (ATSA) gives us flexibilities that other agencies don’t have

• Core compensation system (pay bands)

Within a Framework

• Merit Principles

• Prohibited Personnel Practices

• Veterans’ Preference

• Civil Service Interchange Agreement (requires similarity to other Federal agency practices)

• TSA Policies (MDs, HCMs)

• FAA Policies (ATSA defaults us to FAA policies where TSA has not yet established its own)

Personnel Services Division

• Benefits

– Follow Title 5 except:

• FEHB premiums are not pro-rated for part-time Transportation

Security Officers (TSOs)

• Personnel Processing

– Authority to process personnel actions comes from ATSA

• Payroll Processing

– Follow Title 5 except

• Employees can donate annual leave, sick leave or comp time for travel to other TSA employees who are participating in the

Voluntary Leave Transfer Program (VLTP)

DHS Data Centers

DC1/DC2

Assessments (Pan/PDRI)

TAP Contract Award

(Nov 2015)

HRIT Migration Complete

(Summer 2016)

<Until Summer 2016>

CSC BPA

(March 2016)

Personnel Futures Migration Architecture

HRIT

Migration

<Until Summer 2016>

IHOP/HRAccess

PP&B

eOrientation

FHR Navigator

CSC-Help Desk IVR & Voice Recording

(Joint - OCRL/OHC)

R&H Med. Assessments (CHS)

Applications (MGS)

<Until Q3 CY 2016>

<CY 2016>

New R&H Contract

New PP&B Contract

<CY 2016>

<Until Q3 CY 2016>

Key

Current Contract

Current Project

DHS Data Centers

New Contracts

<Q3 CY 2016> <Q3 CY 2016>

New CSC Contract

<CY 2016>

<Q3 CY 2016> <Q3 CY 2016>

Solicitation Overview

Procurement Overview

• Full and Open Competition (RFP)

• Contract Type: Firm Fixed Price

• Estimated Milestone Schedule

– Thursday, March 3, 2016 Questions Due

– Wednesday, March 23, 2016 Proposals Due

– Monday, August 8, 2016 Contract Award

– Tuesday, August 8, 2016 60 Day Vetting Period Begins

– Monday, October 31, 2016 Contract Start Date

– Sunday, April 30, 2017 Transition Period Ends

Services and Pricing – Section I

• Transition In

• Contract Line Item (CLIN) Summary

• Surge CLINs

– Processing Requests for Personnel Action Transactions

– Benefits Transactions

– Payroll Processing

• Transition Out

Special Contract Requirements

• Technical Instruction

• Software Licenses and Intellectual Property

• Non-Disclosure Agreements

• Suitability Determination for Contractor Employees

Instructions to Offerors– Section VIII

• Proposal Submission Instructions (Section 8.4)

– Electronic submissions only

– Volumes I and II: PDF or MS Word format

– Volume IV: MS Excel and MS Word format

– 8 MB size limit

• Proposal Preparation Instructions (Section 8.5)

– Four (4) Separate Volumes:

• Volume I – Technical Proposal

• Volume II – Small Business Participation

• Volume III – Past Performance

• Volume IV – Price Proposal

Source Selection Process Overview

Evaluation Factors for Award – Section IX

• Basis for Award

– Anticipates one (1) award

– Best Value Approach

• Award Selection

– Initial Submissions without discussions

– Initial or subsequent submissions with discussions

• Evaluation Factors

1. Technical Approach;

2. Management Approach;

3. Staffing Plan and Resource Approach;

4. Small Business Participation;

5. Past Performance; and

6. Price

• Statement of Relative Importance

Acquisition Points of Contact

Contracting Officer:

Evelyn S. Tyndell

Contract Specialist

Katya D. Cruz

PFPAcqTeam@tsa.dhs.gov mailto:Katya.Cruz@dhs.gov

Thank you for your interest in our requirement.

• Please silence your phone

• Please note, reading room documents are not publicly available information, therefore, this information shall not be posted or reproduced in any public forum.

Reading Room - Administrative Item

– Binders must be signed out from a TSA official.

– Each company may sign out one binder at a time.

– Pen and pad note taking is permitted.

– Binders may NOT leave the room.

– No pictures or copying of any material in the binders is permitted.

– No removal of documents and/or pages are permitted.

– Companies may NOT approach Government personnel with questions on the content of the binders.

– Companies may NOT approach Government personnel with general inquiries, business cards or questions of any kind.

– Any company found to violate the reading room conditions may be escorted out and may be disqualified from participating in the Personnel, Payroll and Benefits procurement.

Reading Room Con’t

Reading Room