Attachment_A_Precheck_Expansion_Final_RFPDec_29.pdf

Version 2.1 December 29, 2015 U.S. Department of Homeland Security Arlington, VA 22202

701 South 12th Street Arlington, VA 20598-6025

Dear Offerors:

In this Request for Proposals (HSTS02-16-R-OIA011), the Transportation Security Administration (TSA) is seeking vendors for the TSA Pre✓® Application Expansion initiative to deploy ready-to-market application capabilities to expand the public’s enrollment opportunities for TSA Pre✓® and provide the ability for TSA to identify known travelers. Key to the success of the TSA Pre✓®

Application Expansion initiative is the Offeror’s ability to successfully enroll and pre-screen a large population of applicants. Furthermore, the Offeror must also demonstrate an ability to effectively market the TSA Pre✓® program to the air travelers, in accordance with the TSA brand and approved licensing agreements, using their own industry partnerships and strategic business approaches.

Background information on the TSA Pre✓® program can be found in Attachment A. Successful Offerors will receive an Other Transaction Agreement (OTA), which can be found in Attachment B that will allow these approved contractors to market, enroll and pre-screen individuals for TSA Pre✓ ® eligibility. TSA will then make the final eligibility determination for actual TSA Pre✓® enrollment upon completion of a Security Threat Assessment (STA).

At a minimum, successful Offerors must have the ability and will be responsible for:

1. offering convenient and accessible enrollment locations and options;

2. reliably performing identity validation and verification to NIST 800-63 Assurance Level 3 standards;

3. conducting a criminal history records check according to TSA disqualifying criteria by either using a designated FBI channeler or using commercially available data solutions;

4. collecting documentation to enable TSA to make final citizenship determinations;

5. providing effective, provisional pre-screening eligibility recommendations in order to allow

TSA to make final TSA Pre ✓® Application eligibility determinations; and

6. executing a marketing strategy for TSA Pre✓® enrollment in alignment with TSA Pre✓® brand identity and positioning.

Depending upon the specific solutions offered in proposals, the Government may also determine that successful Offerors can also use commercially available data to accomplish the following:

1. Pre-screen potential applicants for TSA Pre✓® eligibility by appropriately identifying disqualifying criminal history convictions using commercially available data; and

2. Perform identity validation and verification.

TSA will not permit successful Offerors in the TSA Pre✓® Application Expansion initiative to:

1. Use publically available social media information to perform any type of pre-screening effort;

2. Rely on or evaluate factors such as religion, financial status, health records, constitutionally protected activity, or other records reflecting an individual’s socio-economic status; or

3. Use other individual characteristics, such as race, sex, age, and nationality, beyond what is necessary and appropriate to verify the identity of an applicant.

Further high-level information about these processes is below with more detailed information contained in the OTA, Attachment B, including the Statement of Work (SOW), Attachment B1.

Cost Reimbursement Successful offerors will provide these enrollment services, throughout the life of the resultant agreement, at no cost to the Government. Offerors must provide TSA a nominal fee per applicant to reimburse expenses related to the conduct of Government security threat assessments and make final enrollment determinations. Beyond this fee, Offerors are free to establish novel business models and pricing mechanisms to recover the costs of their efforts and continue to expand enrollments. TSA will not reimburse Offerors for any costs relating to the submission of a proposal. In addition, TSA will not provide any Government reimbursement of any cost incurred in making necessary studies or designs for the preparation of the systems or incurred in obtaining services or supplies.

Award Vehicle The Government contemplates multiple Other Transaction Agreement (OTA) awards (but may limit to three OTAs) to qualified and responsible Offerors whose proposals conform to the solicitation and are deemed to provide the most advantageous approaches to the Government. These OTAs will have a base period of three years, but may at the Government’s discretion be extended on an annual basis for seven additional years from the date of award. At any time, if the Government determined that TSA Pre✓®Application Expansion approach is not in the best interest of the TSA then the Government will provide all TSA Pre✓®Application Expansion Providers with 30 days advanced written notice that the Government will terminate the Provider’s arrangement.

New or Upgraded Technologies, Solutions, and Providers This solicitation will remain valid for a period of 10 years following its issuance, unless replaced by an updated solicitation. At any time, TSA may determine to seek and consider additional proposals and make additional OTA awards during that time period. The Government encourages an OTA awardee to continuously propose to TSA technological and process improvements to further enhance TSA Pre✓®enrollments. To that end, the Government reserves the right to modify the OTAs to incorporate these improvements, if in the best interest of the Government. All changes or modification to this Agreement will be at no cost to the Government. Further, TSA may determine, at any time during the life of the OTAs, to seek/consider additional proposals and award additional OTAs to entities for these services.

Proposal Evaluation Process All proposals will be examined against the solicitation requirements and if deemed responsive an oral presentation will be scheduled. Those proposals and oral presentations which, when examined against the solicitation requirements, are most advantageous to the Government will be chosen to continue on to the next phase of the evaluation which consists of an Independent Verification and Validation (IV&V) for appropriate security protection within an Offeror’s Information Technology and operating systems (including an Offeror’s subcontractors’ information technology and operating systems) that will process Government test data containing sensitive information such as sensitive Personally Identifiable Information (Sensitive PII). Offerors will either pass or fail the IV&V process. Offerors who pass the IV&V process will proceed to testing by the Department of Homeland Security Science and Technology Directorate with involvement from the DHS Office for Civil Rights and Civil Liberties and the DHS Privacy Office. This testing will assess the ability of the proposed solutions to conduct automated identity assurance and criminal history check capabilities without reliance on data inputs that could potentially present disparate impacts to specific populations, unreasonably intrude upon the personal privacy of the applicant, or are otherwise inappropriate. Offerors will either pass or fail this testing. Offerors who pass this testing will then undergo a systems demonstration. This demonstration will consist of an on-site system demonstration and a data center tour. Following the demonstration, those proposed solutions that are considered most advantageous to the Government may be chosen to be awarded an OTA and receive approval, consistent with their authorized approaches and ready-to-market systems, to enroll and pre-screen applicants. TSA reserves the right not to make an award; may reject any oral submittals;

waive informalities and minor irregularities in offers received; seek proposal clarifications with one or more Offerors without entering discussion and without requesting final proposal revision.

Anticipated Acquisition Milestones The table below highlights the key acquisition phases/events prior to an Offeror deploying services as a TSA Pre® Expansion Provider.

Acquisition Phases/Milestones: Details:

Phase 1: Events Prior to Submission of Written Proposals/Oral Presentation Slides Presentations

• November 9, 2015 – Industry questions due to

TSA

• November 19, 2015 - Government responses to industry questions posted on FedBizOpps.

Phase 2: Written Proposals Due (Volumes I-IV)

January 13, 2015 Written Proposals Due From Offerors

Phase 3: Oral Presentations

TSA will schedule oral presentations with each Offeror considered responsive. (Written documentation/Volume I due on Proposal due date)

Phase 4: TSA Independent Verification and Validation

(IV&V)

Offerors selected to proceed based on oral presentations must be ready to begin Phase 4 (TSA IV&V) within 5 days from TSA notification. (Written documentation/Volume III due on Proposal due date)

Phase 5: DHS Science and Technology (S&T) Testing

Offerors that received a Pass rating from Phase 4 (TSA IV&V) must be ready to begin Phase 5 (DHS S&T Testing) within 10 days from TSA notification.

(Written documentation/Volume IV due on Proposal due date)

Phase 6: On-site Data Center Tour and Operational system demonstration.

Offerors that pass the DHS S&T Testing phase must be ready to begin Phase 6 (System Demonstration) within 10 days from TSA notification.

Phase 7: OTA award TSA will award an OTA to one or more Offerors who are eligible to become TSA Pre® Expansion Providers.

Phase 8: TSA • Awardees must be ready to begin TSA

Interface/Integration testing and Authority to Operate (ATO) Activities

Interface/Integration testing NLT 60 days from OTA award.

• Awardees must be ready to begin ATO activities NLT 60 days from OTA award.

• Awardees must complete TSA Interface/Integration testing NLT 120 days from OTA award.

• Awardees must achieve ATO NLT 120 days from OTA award.

Phase 9: Deploy/Launch Service Before an Awardee may offer TSA Pre® services to the public, TSA must provide Awardee formal approval to proceed, based on an assessment of operational and technical readiness and adherence to TSA requirements.

Proposal Instructions

(a) General: Proposals must be clear, coherent, and prepared in sufficient detail for effective evaluation. Proposals must include convincing rationale and substantiation of all claims. Offerors shall assume that the Government has no prior knowledge of their experience and will base its evaluation on the information presented in the Offeror’s Proposal. Offerors are encouraged to use graphic presentations where such presentations will contribute to the compactness and clarity of the Proposal. For written materials and Oral Presentation slides, all information submitted in response to this solicitation, inclusive of graphics, shall be formatted on 8 ½” x 11” size paper, use at a minimum 12-point sized font, single line spacing, and 1-inch margins (margin restrictions do not apply to slides submission). Tables, figures and graphs may use at a minimum 9 point font. All pages must be numbered.

(b) Proposal Submittal Deadline - Please submit proposal no later than the due date. The written responses must be received by Wednesday, January 13, 2016, by 2:00 PM Washington DC Local Time. Proposals must be submitted electronically via e-mail to: tsaprecheckexpansion@tsa.dhs.gov.

Submittal of E-mail attachment may not exceed 15MB per e-mail. If attachments size is larger than this submit multiple e-mails and indicate as such subject line of the e-mail, i.e. “1 of 2”.

(c) Clarifications: All Offerors questions or requests for clarifications must be submitted in writing not later than 2:00 PM EST, November 9, 2015. For any questions or requests for clarifications received after this date and time, the Government reserves the right not to respond. All questions must be submitted by utilizing Attachment C – Question and Answer spreadsheet. Any questions received in other formats may not be considered by the Government. All answers to questions or requests for clarifications will be provided as soon as possible, at one time via FedBizOpps to all Offerors. Government Clarifications may require a formal Amendment to this Requirement. If the Government issues an Amendment to the Requirement, the Offerors proposal must acknowledge the Amendment(s), to be considered responsive to the Requirement.

(d) Proposal Validity: The Government requires a minimum acceptance period of at least 180 calendar days from the Proposal due date and as such all proposals must remain valid for at least 180 calendar days. A proposal allowing less than the Government’s minimum acceptance period may be rejected.

(e) Marking: Proposals shall be clearly marked with the solicitation number, “HSTS02-16-R-

OIA011”.

(f) Release of Information: All responders are hereby notified that all information, including questions submitted in response to this Requirement, will be posted publicly and may be considered public records subject to release when a public record request is made in accordance with the law.

Questions submitted in response to this Solicitation will be submitted to all Offerors with the applicable response. Should an Offeror identify the release of the redacted version as confidential financial and proprietary, the Offeror may be provided an opportunity to withdraw the information or questions.

(g) Marking of Confidential information Within Proposal Materials: In the event an Offeror is concerned that information submitted in response to this Requirement contains confidential financial and proprietary information, including trade secrets, then such information must be clearly marked.

In the event an Offeror considers specific information to be confidential it shall provide a written declaration containing supporting rationale for its contention that the information constitutes an exception to release under Federal law. Any information submitted that has not been clearly marked as confidential, financial and proprietary, may be released immediately. Any information that has been clearly marked as confidential financial and proprietary will be considered as potentially constituting an exception to release. In such cases, the Government will attempt to release the information after redacting the specific information identified as confidential financial and proprietary and notify the Offeror. By submitting a proposal, the Offeror agrees that it’s confidential, financial, and proprietary information can be viewed by all Government personnel and any Government-support contractor personnel, the latter category will have signed a Non-Disclosure Agreement prior to receipt of the information. The Offeror agrees that any limitation of Government personnel’s access may result in exclusion of the Offeror’s proposal.

(h) Payment of Proposal Costs: This solicitation does not commit the Government to pay any cost incurred in the submission of the proposal or in making necessary studies or designs for the preparation thereof, nor to contract for services or supplies.

(i) Proposal Content Proposals shall consist of a written response and an Oral Presentation (with slides).

(i)(1) Written Responses - The written response shall consist of a cover letter, a copy of the slides to be used by the Offeror in support of the oral presentation, and the Offeror’s response to Element 4 “Past Performance.”

The written response to this RFP must be in four (4) separate volumes (I. Technical Content, II. Past Performance, III. TSA IV&V materials, and IV. DHS S&T Testing materials) with a cover sheet giving a clear indication of the contents of each volume. The proposal text font will be at a minimum Times New Roman 12-point type on standard 8 ½ inch by 11-inch paper with margins of at least 1” at the top, bottom and both sides (margin restrictions do not apply to slides submission).

Please note that contents on both sides of the paper will be counted as 2 pages. Failure to fully adhere to the prescribed page and format restrictions may result in your firm’s disqualification from the competition.

Written proposals must contain the following organizational structure:

• Volume I

Section A: Cover Letter – 1 Page Limit. Cover Letter shall include the following:

1) Solicitation Number and Solicitation Title

2) Contractor Name

3) DUNS Number

4) Complete Business Mailing Address

5) Point(s) of Contact (Name, title, e-mail address, phone number)

6) Teaming Partners , Subcontractors, and/or Contractor Teaming Arrangements

(CTA)

7) Other Pertinent Information

8) Acknowledgement of all Amendments

Section B: Submit Signed Other Transaction Agreement (OTA) - Please fill in Entity Name throughout the document; Submit Signed Cooperative Researsch and Development Agreement (CRADA), please fill in Offeror Name throughout the document.

Section C: Oral Presentation Slides – No slide page limit, but only slides submitted with proposal and used during the Oral Presentation will be evaluated. In their presentations, Offeror’s should re-state the Element and SOW reference(s), followed by the response. Oral presentation slides must address the following three elements:

Element 1: Technology and Technical Capabilities (SOW 4.1, 4.2, 4.3, 4.4, 4.8, 4.9, and 4.14)

The Offeror’s oral presentation shall demonstrate its technical readiness/capabilities to meet TSA’s requirements. The Offeror’s oral presentation will address the Offeror’s current/existing IT system proposed to meet TSA requirements to the extent which it is comparable with the scope/functions in TSA requirements to include functions, capabilities, and features. The proposal will also identify what specific required capabilities do not currently exist and must be developed by the Offeror, as well as the Offeror’s approach to designing, developing, testing, and deploying the IT system capabilities not currently present in Offeror’s existing IT system. In its presentation, the Offeror must also identify and describe the type(s) of environments (e.g., development, test, staging, production, etc.) available to fully support its development activities.

Specifically, the Offeror must describe the Offeror’s demonstrated technology and technical capabilities to:

• collect, receive, store, and transmit applicant biographic and biometric information for application processing, SOW 4.1, to include online pre-enrollment services, SOW 4.1.1, identity document collection, SOW 4.1.2, and in-person enrollment for biometrics collection and Applicant Identity Verification, SOW 4.1.3.;

• conduct Identity Assurance Activities, SOW 4.2;

• conduct its proposed criminal history records check and its proposed ability to disqualify applicants based on the current TSA Pre✓® disqualification list; notify applicant of ineligibility and how to apply for redress, SOW 4.3.1;

ο Specifically, the Offeror should describe whether criminal history information shall be obtained commercially or through the FBI.

ο Additionally, the Offeror shall indicate their technical solution’s ability to conduct automated adjudication of criminal disqualifiers and discuss how that automation works to specifically identify disqualifiers from the TSA Pre✓® disqualification list.

ο Finally, the Offeror shall discuss what, if any, manual review of criminal history information is required to determine if applicants should be disqualified and describe how that manual review and adjudication will be accomplished.

• have the ability to adjust their processes for performing the criminal history records check and adjudication, should TSA disqualifying criteria and requirements change and conduct its proposed Recurrent Vetting, SOW 4.3.3 and 4.3.4.

ο In detail, the Offeror should describe how their technical solution could be configured to address the following scenarios and the associated implementation timeline:

Removal of a criminal disqualification Addition of a criminal disqualification

• transmit and reconcile Application Data and Fees SOW 4.4;

• store collected applicant data held in a separate database that can follow TSA prescribed data retention requirements including the interim and final determination for TSA Pre✓®, SOW 4.8; and,

• demonstrate system flexibility and ability to make changes to its information management systems resulting from enhancements to the TSA legacy system or due to the planned future replacement of TSA legacy systems, SOW 4.9.

• implement configuration management, project planning, test readiness, and certification and accreditation, SOW 4.14.3

• meet Fed ramp JAB ATO, Fed ramp Agency ATO, or is a non-cloud environment that has an ATO by another Executive Branch or DOD Entity, SOW 4.14.5.

• comply with Sensitive Information Required Special Contract Terms, SOW 4.14.6

Element 2: Operational Approach and Capabilities (SOW 4.1, 4.3, 4.5, 4.6, and 4.11)

The Offeror’s oral presentation shall address the Offeror’s operational implementation approach as well as its operational infrastructure, capabilities and framework to meet TSA requirements. The Offeror must demonstrate its ability to support all aspects of the enrollment and registration process so that the opportunity to participate is made available to the traveling public across the U.S. Operational infrastructure and framework include, but are not limited to, the necessary business processes, personnel, facilities, resources, timeframe, etc., to support the full requirements of TSA’s enrollment and registration process.

Specifically, the Offeror must describe its implementation approach and associated business processes, personnel, facilities, resources and associated expertise and operational capability to:

• collect, receive, store, and transmit applicant biographic and biometric information for application processing, SOW 4.1, to include online enrollment services, SOW 4.1.1, identity document collection, SOW 4.1.2, and in-person enrollment for biometrics collection and Applicant Identity Verification, SOW 4.1.3.

• conduct adjudication of potentially disqualifying information, and provide/manage applicant redress activities, SOW 4.3.1, 4.3.3 ο Specifically, the Offeror should discuss their staffing approach in regards to making initial determinations of criminal ineligibility and to reviewing redress requests.

• propose an approach for deploying enrollment center locations, demonstrating a phased, low-risk deployment solution that minimizes technical and operational risk to TSA, SOW 4.1.5, 4.1.6

• provide customer service portals and/or mechanisms, proactive applicant communication regarding operational changes or application status, and an overall management approach to meet customer service requirements, SOW 4.5, 4.6

• propose key personnel with the experience and skill sets to implement SOW requirements, SOW 4.11

• demonstrate depth and breadth of experience/capabilities on tasks of similar size, scope and complexity to perform the work as required under this OTA

Element 3: Marketing Approach and Capabilities (SOW- 4.7)

The Offeror’s Oral Presentation shall provide a marketing approach that meets TSA requirements and illustrates how the Contractor plans to offer application opportunities for enrollment into the TSA Pre✓® program. The Contractor shall detail any plan to employ strategic business approaches such as affinity marketing partnerships, etc., and clearly articulate how its marketing efforts and communications align with established TSA Pre✓® brand identity and positioning, including consistency in tone and language.

The Offeror must describe and demonstrate its marketing approach to include:

• agreements in place with offeror’s own vendors for effective market outreach on TSA Pre✓® application, SOW Section 4.7.

• agreements with industry providers (e.g. airlines, travel agents, corporate travel departments, hotels, credit card companies, etc.) that outline commitment to identify, message and encourage the general travelling public’s application to enroll in TSA Pre✓®.

• planned alignment with the established TSA Pre✓® brand including consistency in tone, language, and brand placement. SOW, Attachments 5, 6, and 7.

• pricing/business model for the public enrollment fee.

• demonstrate depth and breadth of experience/capabilities on tasks of similar size, scope and complexity to perform the work as required under this OTA.

• Volume II – Past Performance (Element 4 - written) - The Offeror shall provide three (3) past performance references on contracts (as a prime contractor or subcontractor) that involved work that is similar to the size, scope, and complexity that is being solicited by the TSA in this RFP (SOW Sections 4.1 – 4.6) and is ongoing or has been completed within the last three (3) years.

There is no page limit to this section. Each reference shall be separated by different sections.

For the past performance portion of the Offeror’s proposal, the Offeror shall identify the following information for each of the past performance references:

• Using the bulleted list in Section 4 of the SOW as a guide, clearly identify which of these activities (e.g., Conduct Eligibility Evaluation, Criminal History Records Check, Recurrent Vetting, etc.) were performed for the past performance

• Name of Agency/Company

• Name, phone number, and e-mail address of two (2) technical points of contact at the entity for which the contract was performed;

• Period of performance;

• Statements relative to performance: i.e., statements describing whether the contract(s) were completed on time, performed satisfactorily while conforming to contract terms and conditions and without degradation in performance or customer satisfaction and any applicable information on problems encountered during performance; Note: include severity of any quantity, delivery or cost problems in performing the contract and the corrective action taken and the effectiveness of the corrective action.

• Volume III – Independent Verification and Validation (IV&V) See Attachment D (Element 5 -written)

• The Offeror shall provide a point of contact for this IV&V process to assist with scheduling of meetings and interviews.

• The Offeror shall provide its Team Composition Table 2 as required in Section 3.0 of RFP

Attachment D.

• The Offeror shall provide security documentation of any of its Information Technology (IT) systems and operating systems (including all Offeror’s subcontractors’ IT and Operating systems) that would handle any test data provided by the Government during the RFP process, that includes the following:

o A list of hardware and software for the Offeror’s systems and the configuration files for firewalls and routers that would handle any Government test data.

o A list of all Offeror’s subcontractor to be used/engaged by the Offeror in any subsequent

DHS S&T Testing in the RFP process.

o Incident Response Plan of the Offeror’s and Offeror’s subcontractors’ systems that would handle any Government test data.

o System Security Plan of the Offeror’s and Offerors’ subcontractors’ systems that would handle any Government test data.

o Standard Operating Procedures of the Offeror’s and Offerors’ subcontractors’ systems that would handle any Government test data o Contingency Plan of the Offeror’s and Offerors’ subcontractors’ systems that would handle any Government test data.

o The Offeror shall complete the Access Methods table 7 as required in Section 5.3.4 of the RFP Attachment D.

o Volume IV – DHS S&T Testing (Element 6 - written) – In addition to providing high-level details of the identity assurance and criminal history records check process as part of Volume I (Element 1: Technology and Technical Capabilities), Offeror’s shall provide written materials with specific details regarding how they shall address all of the requirements in SOW section 4.10.2 – Identity Assurance and Eligibility Evaluation Performance Metrics. The information provided in Volume IV shall be consistent with the approach presented in Volume I. The Volume IV documentation, which should reflect a ready-to–market application and capabilities, shall serve solely as post-award informational purpose of the Offeror’s Technology and Technical Capabilities for the Government and shall not serve as part of the pass/fail criteria for this Element nor as any part of Contract Award selection. Specifically, Volume IV shall contain the following information:

o o Detailed description of the systems, logical methodologies, and processes for identity assurance and criminal history records check.

o Explanation of proposed technical architectures and components for the proposed identity and criminal history records check system including capabilities for information security, privacy protection, and data storage specifically as to how they relate to DHS S&T testing.

o Use case examples that illustrate identity assurance and criminal history records check systems, logical methodologies and processes (to include proposed features [technological, system, and data features] and decision-making information flow).

(I)(2) Oral Presentations - Each Offeror is allowed a maximum total of four (4) hours to present their slides, which may be allocated between the elements at the Offeror’s discretion. Content of this oral presentation is detailed above. Offerors may only present materials within its written materials and briefing slides. Any slides presented which were not submitted to the Government at the time of proposal submission will not be evaluated. For example, if the Offeror provides a nine (9) page presentation at the time of submittal, but the Offeror uses a different presentation during the oral presentation, such as a ten (10) page presentation or a nine (9) page presentation containing different substantive ideas, those differences will not be evaluated. Additionally, information contained in the provided presentation that is not covered during the oral presentation will not be evaluated. For example, if the Offeror provides a ten (10) page presentation at the time of the oral presentation, but only addresses the first nine (9) slides as part of the presentation, the Government will only evaluate slides one (1) through nine (9), and will not evaluate slide number ten (10). These briefing slides will serve as the record of oral presentations to document what the Government relied upon in making the source selection decision. The Government will not accept for evaluation any additional documentation (such as procedures, manuals, administrative handbooks or guides, power point and Microsoft speaker note pages, video, etc.), which may or may not have been referenced during the presentation. The TSA will not audio or video record the presentation.

TSA will schedule the oral presentations through random selection. When scheduling the presentations, TSA will advise Offerors of the date and time of its presentation. TSA reserves the right to reschedule oral presentations at the sole discretion of the Contracting Officer. Submission of video tapes or other forms of media containing the presentation for evaluation, in lieu of the in-person oral presentation, will be rejected. Oral presentations will be held at TSA headquarters in Arlington, VA. All Operational System Demonstrations will occur at the Offeror’s site.

The number of Offeror attendees is limited to ten (10) people. Offerors shall have the option of selecting the participants to make the presentation; however, Offerors are encouraged to select from the individuals proposed to fill key roles.

Offeror’s oral presentation will be limited to four (4) hours in duration, exclusive of any question and answer period. Offeror’s set-up of visual aids and Contracting Officer’s remarks made prior to the presentation will not count against the Offeror’s four (4) hour time limit. Following the oral presentation, the Government will take a one hour and 30 minute break to determine whether or not questions and answers are required. The Government will excuse the Offeror from the presentation room during this time. The Contracting Officer will then notify the Offeror’s team to return back to the presentation room where the Contracting Officer will communicate clarification questions to the Offeror. The Offeror’s team will then be provided no more than one hour to prepare its responses, at which time the offeror will have no more than one hour to respond to the questions. The Offeror’s response will constitute a component of the oral presentation.

The Government will upload the presentation slides that were submitted at proposal time and provide a projector, a projector screen, and a laptop for the Offeror to utilize in support of the Offeror’s Oral Presentation. During the designated presentation time, the Government will make available the Offeror’s submitted Power Point Presentation, which was submitted as part of the Offeror’s Written Proposal. No internet access will be available.

(I)(3) Independent Verification and Validation (IV&V). Because Government test data containing sensitive information (such as Personally Identifiable Information (Sensitive PII)) will be provided to Offerors, the Government must initially determine that an Offeror’s information technology and operating systems (including an Offeror’s subcontractor’s information technology and operating systems that will process the Government test data) have appropriate security protections. This IV&V process is an initial analysis only of the information technology and operating systems that will handle Government test data during the RFP process and is used to identify potential vulnerabilities to the system, determine the extent of the potential threat, and assess the risk to the system. The IV&V process will include a site visit and interviews to assess systems that are not presently accounted for in the DHS Information Assurance Compliance System (IACS) and where a Security Authorization (SA) has not been performed on the systems. This IV&V is used to determine if existing countermeasures and safeguards adequately reduce the probability of loss to an acceptable level and help validate the need for additional cost-effective countermeasures.

This Independent Verification and Validation calls for a series of system tests to exercise the security features and procedures of the Offeror’s systems against a targeted set of FISMA security requirements from NIST Special Publication (SP) 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, and DHS 4300A policy. Vulnerability testing of the operational system is also planned, which will be conducted by the Offeror. Additional tests may be required as needed to assess newly identified vulnerabilities during the security assessment, including security risks associated with the system.

(I)(4) DHS Science and Technology (S&T) Testing – For those Offerors found responsive after oral presentations, and have received a “Pass” rating from the IV&V process, then testing will be scheduled with DHS S&T. Using Government provided test data, the DHS S&T testing will focus on the Offeror’s ability to perform identity assurance and criminal history records checks to meet the requirements set forth by TSA in the SOW. Offerors shall have an identity assurance and criminal history records check system, operating in a remote test environment in order to receive and process Government dataset(s).

The Government dataset shall consist of records that represent applicants for TSA Pre✓® in the following categories: 1.) records/applicants with valid identities, 2.) records/applicants with invalid or unverifiable identities, 3.) records/applicants without TSA Pre✓® criminal disqualifiers and 4.)

records/applicants with TSA Pre✓® criminal disqualifiers.

The Offeror shall be responsible for:

• assuring the valid identity of applicants in the Government dataset,

• identifying the invalid identities of the applicants in the Government dataset, and

• determining applicant eligibility based upon the TSA Pre✓® criminal disqualification list, parts

A, B, and C (available at http://www.tsa.gov/Disqualifying-Offenses-Factors).

• Providing detailed test results to include the disqualifying reason(s) for those test data records deemed ineligible due to criminal disqualifiers.

Offerors shall provide results from the government datasets in the form indicated by DHS S&T Cooperative Research and Development Agreement (CRADA) in RFP Attachment E.

Offerors shall have all necessary privacy protections in place with any subcontractors or data sources to ensure that individuals with names used in Government dataset(s) do not receive any commercial notifications (e.g. credit check inquiries) while Offerors are processing Government dataset(s).

Offerors shall also provide documentation to substantiate their ability, in addition to any of their subcontractors or data sources, to purge all Government dataset(s) records and system record searches after the completion of the DHS S&T evaluation or as directed by TSA.

(j)(5) System Demonstration - For those Offerors who pass DHS S&T Testing, an On-Site Data Center Tour and Operational System Demonstration will be scheduled after the Oral Presentation.

The On-Site Data Center Tour and Operational System Demonstration are limited to three (3) hours in duration followed by a 30 minute break and a 30 minute question and response period. The on-site data center tour and operational system demonstration reflecting a production environment shall occur on same day/location or close enough to each other to allow completion of both on the same day. The Government will not be allowed to evaluate any information (See Documentation below) that was not presented during the Offeror’s Oral Presentation.

The Contracting Officer will advise Offerors of the date and time of its demonstration and tour. The number of Offeror attendees is unlimited. Offerors shall have the option of selecting the participants to make the presentation; however, Offerors are encouraged to select from the individuals proposed to fill key roles.

TSA will not permit audio or video recording of the on-site demonstration or data center tour. The Government will not accept for evaluation any additional documentation (such as procedures, manuals, administrative handbooks or guides, note pages, video, etc.), which may or may not have been referenced during the On-Site Demonstration and Data Center Tour.

At the On-Site Operational System Demonstration, the Offeror will demonstrate its System Functionality to include the ability to:

http://www.tsa.gov/Disqualifying-Offenses-Factors

• collect, receive, store, and transmit applicant biographic and biometric information for application processing, SOW 4.1, to include online enrollment services, SOW 4.1.1, identity document collection, SOW 4.1.2, and in-person enrollment for biometrics collection, Applicant Identity Verification, SOW 4.1.3.;

• integrate with TSA and other backend systems to include the submission of applications to

TSA, SOW 4.4.

• comply with cyber security requirements as outlined in IT System Security Requirements, SOW 4.14.3 and Sensitive Information Required Special Contract Terms, SOW 4.14.6

Additionally, during the scheduled demonstration and Tour the Offeror will provide the following:

• explanation, description, and evidence of its Change Control/Configuration Management process used in Systems Management/Maintenance

• explanation, description, and evidence of the Engineering Life Cycle Process/Software Development Life Cycle Processes used by the Offeror

• explanation, description and evidence of the current IT system and the type of environment (e.g., development, test, staging, production, etc.) available to fully support development and production activities.

• Documents describing the JAB, Agency or stand-alone ATO that detail the accreditation of the infrastructure where the TSA enrollment system will be built; and

• A tour of the Offeror’s data center locations highlighting physical security, back up and disaster recovery capabilities, and continuous monitoring capabilities.

The Offeror shall demonstrate the ability to perform the following activities:

• conduct identity assurance activities, SOW 4.2;

• conduct its proposed criminal history records check and its proposed ability to disqualify applicants based on the current TSA Pre✓® disqualification list, SOW 4.3;

• collect and remit payment to TSA, SOW 4.4.3;

• establish a financial collection and reconciliation process, SOW 4.4.2.1;

• receive application status data from TSA, SOW 4.4.4;

• notify TSA applicant data changes, SOW 4.4.5;

• transmit and reconcile application data and fees SOW 4.4;

• provide Customer Service to applicants, SOW 4.5;

Evaluation Elements

The Government shall determine its award of OTAs based on integrated assessment of all elements in each proposal and the proposals that provide the Government with the most flexibility for increasing enrollment applications while ensuring maximum protection of applicant information and compliance with security standards/procedures. The Source Selection Official (SSO) may make a determination to award the OTA to other than the highest technically-rated proposal. The Government intends to award based on initial proposals, but reserves the right engage with offerors and receive revised proposals.

TSA will not assign a weight or score within an element and, other than identified Order of Importance information, TSA will not assign weights or scores to the elements. Element 1 and Element 2 are of equal importance and significantly more important than elements 3 through 7:

• Element 1: Technical Capabilities and Approach (Volume I - Oral Presentation)

• Element 2: Operations Management Capabilities and Approach (Volume I - Oral Presentation)

Elements 1 and 2 are equally important to each other and significantly more important than Elements 3, 4, 5, 6, and 7.

• Element 3: Marketing Capabilities and Approach (Volume I - Oral Presentation) is of less importance than Element 1 and Element 2 but significantly more important than Element 4.

• Element 4: Past Performance (Volume II - Written Response) is of less importance than all other Elements

• Element 5: TSA Independent Verification and Validation (IV&V) (Volume III- Written Response and IV&V Results) – Pass/Fail

• Element 6: DHS S&T Testing (Volume IV - Written Response and Testing Results) - Pass/Fail.

• Element 7: Operational System Demonstration (On-site at Offeror’s Location) is of less importance than Element 1, 2 and 3 but significantly more important than Element 4.

Specifically, for purposes of determining award, the Government intends to consider the evaluation results of each element for those offerors that successfully pass Elements 5 and 6 and have completed Element 7.

Element 1: Technology and Technical Capabilities (Statement of Work) [SOW] 4.1, 4.2, 4.3, 4.4, 4.5, 4.8, 4.9, and 4.14)

The Offeror will be evaluated on its demonstrated system readiness/capabilities that already in place to meet TSA’s requirements. The Offeror will be evaluated on the current/existing IT system proposed to meet TSA requirements and the extent to which it is comparable with the scope/functions in TSA requirements and the extent to which it already includes functions, capabilities, and features contained within TSA requirements. TSA will also evaluate the specific required capabilities that do not currently exist, but must be developed by the Offeror. TSA will evaluate the proposals to determine whether they demonstrate the following key areas, which will not be considered as sub-elements for evaluation purposes:

• Enrollment Capabilities and Approach (SOW 4.1.1, 4.1.2, 4.1.3) - The Government will assess the Offeror’s technical capabilities to fulfill the requirements detailed in the Statement of Work (SOW) including the ability to enhance/customize enrollment systems to conduct online and in person enrollments, collect biographic data, capture and transmit biometrics, and perform identity verification.

• Pre-Screening and Recurrent Vetting(SOW 4.2, 4.3.1, 4.3.3) - The Government will assess the Offeror’s capabilities to fulfill the requirements detailed in the SOW including demonstrated experience with identity assurance, criminal history records check and access to and processing of identity and criminal history data, and notifying applicant of ineligibility and how to apply for redress. In addition, the Government will evaluate the Offeror’s proposed recurrent vetting approach and ability to adjust their processes for performing the criminal history records check and adjudication, should TSA disqualifying criteria and requirements change.

• Transmit and Reconcile Applicant Data and Fees (SOW 4.4) - The Government will assess the Offeror’s capabilities to fulfill the technical integration requirements detailed in the SOW including the ability to perform data aggregation and consolidation. Topics for evaluation include KTN generation, application submission, payment/financial reconciliation, receipt of applicant status from TSA, and the approach in notifying TSA of application/data modifications.

• TSA IT Security and Technical Management (SOW 4.8, 4.9, 4.14) - The Government will assess the Offeror’s capabilities to fulfill the IT security requirements detailed in the SOW. The Offeror will also be assessed on the overall technical management and governance approach such as available technical environments, technical maturity level, configuration management, and proposed software development life cycle (SDLC).

Finally, the Government will evaluate the Offeror’s approach to data storage, data privacy, and retention ensuring that data is protected and retained according to regulation.

TSA will evaluate these technical areas to determine whether the Offeror demonstrates system readiness, information management systems delivery capability, to include the Federal IT systems certification and accreditation process. The feasibility of the approach for providing required system readiness/capabilities already in place will be assessed to determine if the Offeror’s approach is realistic and provides a high level of confidence for meeting all system requirements and to begin formal interface/integration testing and Authority to Operate (ATO) activities within 60 days of OTA award, complete interface/integration testing and achieve ATO NLT 120 days from OTA award as well as the Offeror’s ability to operate and maintain this system once it is deployed.

Element 2: Operational Implementation Approach and Capabilities of Business Processes, Operations Management, Personnel, Facilities and Resources (SOW 4.1, 4.3, 4.5, 4.6, and 4.11)

The Offeror’s operational implementation approach as well as its operational infrastructure, capabilities and framework that are readily available will be evaluated under Element 2. The Offeror will demonstrate its ability to support all aspects of the enrollment and registration process so that the opportunity to participate is made available to the traveling public across the U.S. Operational infrastructure and framework includes, but is not limited to, the necessary business processes, personnel, facilities, resources, etc., to support the full requirements of TSA’s enrollment and registration process.

The Government will evaluate Element 2 to determine the extent to which the Offeror’s operational implementation approach and capabilities demonstrate a thorough understanding of the requirements, and increase the likelihood of successful performance.

The Government will evaluate the Offeror’s demonstrated depth and breadth of experience/capabilities on tasks of similar size, scope and complexity to perform the work as required under this OTA.

The Government will assess the Offeror’s demonstrated implementation and operational capabilities as well as the ability to meet all requirements listed in Section 4 of the SOW including the following key areas, which will not be considered as sub-elements for evaluation purposes:

Enrollment Center Operations and Management Approach (SOW 4.1) - The Government will assess the Offeror’s approach for establishing and managing the operational capabilities and implementation approach, to determine if the Offeror’s implementation and management approach is realistic and provides a high level of confidence in the Offeror’s business processes, implementation plan, performance measures, estimated resources and required experience/skills, and customer communication and coordination.

Deployment Capability and Approach (SOW 4.1.6) - The Government will assess the adequacy of the Offeror’s implementation approach and capability to determine the extent to which it clearly demonstrates all aspects of enrollment operations as well as the ability to operate and maintain a broad scale of geographic enrollment services to maximize opportunities for access by the travelling public interested in enrolling for TSA Pre®. The feasibility of the approach will be assessed to determine if the Offeror’s implementation approach and operational capabilities realistically addresses TSA’s requirements. The Government will assess the Offeror’s implementation plan to determine the extent to which it demonstrates a phased, low-risk deployment solution that minimizes technical and operational risk to

TSA.

Customer Service Approach and Management (SOW4.3.1, 4.3.3, 4.5, 4.6) - The Government will assess the Offeror’s approach to provide customer service for all applicants. This section should address proposed customer service portals and/or mechanisms, proactive applicant communication regarding operational changes or application status, and an overall management approach to meet the customer service requirements. In addition, the Offeror will be evaluated on how adjudication of redress activities will be conducted in support of the customer’s application.

Key Personnel (SOW 4.11) - The Offeror’s approach will be evaluated to determine the ability to provide key personnel and resources with the expertise and skills to implement the documented requirements and services.

Element 3: Marketing Approach and Capabilities (SOW 4.7)

Th…