Attachment_2_-_TSA_Pre _10003 _Application_Expansion_High_Level_Requirements_11_24_2015.pdf

Attachment 2 - TSA Pre✓® Application Expansion High Level Requirements_11_24_2015.xlsx

Reqt # Requirement Requirement Type

The TSA Pre✓® Application Expansion Contractor shall provide a secure website for pre-enrollment. However, applicants shall not be required to pre-enroll. Registration and Identification

After completing the optional pre-enrollment process, the applicant shall be required to complete the in-person enrollment process with a Contractor. Registration and Identification

The entire enrollment process may be completed in-person with a Contractor (e.g. pre-enrollment is not a TSA requirement for applicants). Registration and Identification

During both the optional pre-enrollment process and in-person enrollment, applicants must submit voluntary consent to personally identifiable information (PII) usage after being presented with a TSA-approved privacy statement and terms and conditions. Registration and Identification

The Contractor shall collect biographic data from an applicant as part of the in-person enrollment process. Data shall include the data required by the Contractor for the initial Contractor assessment as well as data required by TSA for the TSA security threat assessment. Any other data elements collected by the Contractor shall require TSA approval. Registration and Identification

The Contractor shall collect the required 10-print fingerprint data from an applicant as part of the in-person enrollment process. The Contractor shall provide alternative options for individuals unable to provide fingerprints (similar to other TSA programs).

- Fingerprints captured must be compliant with EBTS 10.0 - please reference https://www.fbibiospecs.cjis.gov/EBTS/Approved

Registration and Identification

The Contractor shall propose an identity assurance process, using the PII submitted by the applicant. For example, one option for identity assurance could include the use of Knowledge Based Authentication (KBA) quizzes.

- Please note that there is a still a required in-person identity verification component of the identity assurance process. Registration and Identification

The Contractor shall collect identity documents from the applicant using the TSA Pre✓® Application Program list of identity documents or a subset of this list available at:

http://www.tsa.gov/sites/default/files/precheckapplicationprogramrequiredid_factsheet_07 1615-508.pdf Registration and Identification

The Contractor shall require the applicant to bring a government-issued photo ID to in-person enrollment. Registration and Identification

The Contractor shall inform the applicant through both the optional pre-enrollment process as well as the in-person enrollment process that the name on the application must exactly match the name on the applicant’s identity and proof of citizenship/immigration documents and be the name used when booking travel reservations. Registration and Identification

The Contractor shall provide the capability for applicants to upload identity documents prior or after the in-person enrollment process. Registration and Identification

If an applicant uploads documents in advance of the in-person enrollment process, then the Contractor shall review the uploaded document during the in-person enrollment process and verify identity of the applicant. then the Contractor shall review and validate the content of the identity documents before processing the application (which could occur after in-person enrollment). Registration and Identification

If an applicant uploads documents after the in-person enrollment process, then the Contractor shall review and validate the content of the identity documents before processing the application. Registration and Identification

The Contractor shall only accept applications from individuals who are US Citizens, US Nationals, or Lawful Permanent Residents (LPRs). Registration and Identification

The Contractor shall use the PII submitted by the applicant to conduct a criminal history records check (CHRC). Initial Contractor Eligibility

If using a FBI-based solution to obtain criminal history, the Contractor shall have the capability to accommodate fingerprint rejection reasons (such as poor quality and segementation errors) and resubmit fingerprints accordingly. Initial Contractor Eligibility

If using a FBI-based solution to obtain criminal history, the Contractor shall have the ability to route criminal history record check results through TSA systems. The results shall then be passed from TSA to the Contractor for adjudication purposes.

- An interface control document related to FBI criminal history results shall be provided after contract award. Initial Contractor Eligibility

The Contractor shall perform a criminal history records check for applicants against Parts A, B, and C of the disqualifying offenses currently used for the TSA Pre✓® Application Program (please refer to the list of current disqualifiers available at http://www.tsa.gov/Disqualifying- Offenses-Factors) Initial Contractor Eligibility

In order for an application to proceed to TSA for a security threat assessment, the applicant must have:

1) successfully completed the identity assurance process (which includes in-person identity verification and possibly online identity analysis) AND

2) passed the Contractor's eligibility evaluation (CHRC) Initial Contractor Eligibility

The Contractor shall generate a unique Known Traveler Number (KTN) based on a numbering configuration provided by TSA, for applicants that proceed forward to TSA for a security threat assessment. Initial Contractor Eligibility

If the applicant is unable to successfully complete the identity assurance process, then the Contractor shall not submit the application to TSA and, instead, shall provide to the applicant other options to receive the TSA Pre✓® benefit.

- Options could include the TSA Pre✓® Application Program or CBP's Global Entry. Initial Contractor Eligibility

Attachment 2 - TSA Pre✓® Application Expansion High Level Requirements_11_24_2015.xlsx

Reqt # Requirement Requirement Type

If the applicant does not pass the Contractor's eligibility evaluation (the CHRC), then the Contractor shall notify the applicant of their ineligibility and how to apply for redress.

- TSA shall review and approve applicant correspondence templates. Initial Contractor Eligibility

Contractors shall be required to have a correction of records process in place for any necessary redress related to the eligibility evaluation. Initial Contractor Eligibility

If the applicant is unable to successfully provide corrected records, then the Contractor shall

1) submit the information about the denied individual to TSA and 2) provide to the applicant other options to receive the TSA Pre✓® benefit.

- Options could include, but are not limited to, the TSA Pre✓® Application Program or CBP's Global Entry.

- An interface control document for submitting criminally disqualified individuals shall be provided after contract award. Initial Contractor Eligibility

If the Contractor determines the applicant is eligible to move forward for the TSA security threat assessment, then the Contractor shall submit the full enrollment package (which includes the required biographic data, biometric data, Known Traveler Number (KTN), and pay.gov ID) to TSA. Enrollment Submission

The Contractor must remit the TSA fee via U.S. Treasury interfaces on a daily basis for all enrollments submitted to TSA. Enrollment Submission

If the Contractor determines that a full enrollment package was submitted in error (for example, a duplicate submission), then the Contractor shall notify TSA that the enrollment should be disregarded. Enrollment Submission

After the five-year STA validity period has expired for an applicant, the TSA renewal process shall require a new full enrollment package (including payment). Renewal

If an applicant has been denied by TSA and elects to re-enroll, then the Contractor shall be required to submit a new full enrollment package (including payment) with a newly generated KTN.

- The KTN from the previous enrollment cannot be reused. Re-Enrollment

All applicant data collected and stored by the Contractor for the purpose of applying for TSA Pre✓® must be held in a separate database that can follow TSA prescribed data retention requirements. Contractor Data Storage

All applicant data records shall be stored by the Contractor for a TSA prescribed period of time.

- Please note that biometrics will not be stored by the Contractor but instead be passed through to TSA with submitted applications. Contractor Data Storage

The identity record created by the Contractor during enrollment shall be maintained in a secure manner that does not allow PII data to be shared or compromised. Contractor Data Storage

33 Contractors shall participate in data reconciliation/audit activities as required by TSA. Data Reconciliation

The Contractor shall be capable of conducting recurrent eligibility evaluations and propose a strategy. Vetting

The Contractor shall inform TSA when a KTN should be de-activated (is no longer valid) along with a reason with why the KTN is no longer valid. Vetting

Within the five-year STA validity period, the Contractor shall inform TSA when a KTN previously reported as de-activated should be reactivated. Vetting

37 The Contractor shall provide aggregated non-PII data to TSA upon request. Vetting

Contractors shall be capable of receiving application dispositions (to include, but not be limited to, 'application in progress', 'application completed') from TSA.

- Please note that TSA shall make the final determination on acceptance or denial into TSA Pre✓® and notify the applicant of their eligibility or ineligibility as well as any available redress procedures. Vetting

Contractors shall provide an applicant status capability for individuals who want to know the status of their application. Customer Service

Contractors shall have the capability to respond to general TSA Pre✓® Application Program applicant questions. Customer Service

Contractors shall have the capability to respond to applicant questions regarding potential disqualifications identified by the provider. Customer Service

Contractors shall be required to identify and correct any enrollment data captured incorrectly. Customer Service

Contractors shall have the capability to submit applicant updates and capture data corrections and provide to TSA. Customer Service

Sheet1