Final_PreCheck_Expansion_Question_and_Answer_Spreadsheet_12-2-15.pdf

Question # Subject of Question Document/Section (Ex. SoW 4.1, Attachment 1, Pg 3, etc.)

Question and Answer

Column1 Column2 Column3

1 Clarification RFP (HSTS02-16-R-OIA011), Page

4 and 5, Section Proposal Instructions

Question: 1-inch margins are specified. Can document headers and footers occupy the 1-inch margin?

Answer: Yes

Past Performance is

Element # 4 RFP (HSTS02-16-R-OIA011), Page 5, Section Proposal Instructions

Question: The RFP on page 5 section (i)(1) states that "Element 5 [is] "Past Performance."" On page 8 of the RFP and in all the other documents "Past Performance" is listed as "Element 4". We respectfully request that TSA clarify or synchronize the documents.

Answer: RFP on page 5 section (i)(1) to be updated to list Past Performance as Element 4.

3 DHS S&T Testing Data RFP (HSTS02-16-R-OIA011), Page 16, Section Element 5: DHS S&T

Testing

Question: Because offerors proposed solutions may vary, performance testing of identity validation and criminal history disqualifications may be dependent upon using significantly different data inputs. Will high-quality, 10-print finger prints be included in DHS S&T's data sets to allow for FBI channeling testing? Will SSN's be provided in DHS S&T's data sets to test against Social Security Administration Death Master File?

What is the minimum data set to be provided during testing?

Answer: Offerors will be provided with a data set of biographic information such as, but not limited to: Name, Date of Birth, Gender, and Address.

SSNs will not be included in the dataset. This data will be used for identity assurance testing as well as for Offerors who propose to conduct criminal history checks using commercial data.

Offerors who propose to conduct the criminal history check using an FBI channeling solution, will be provided with a set of CHRC results (rap sheets) and will be required to adjudicate those CHRC results according to TSA requirements in the RFP. Biometrics will not be provided to Offerors for the DHS S&T testing.

On-site Tour Clarification

RFP (HSTS02-16-R-OIA011), Page 17, Section Element 6: System

Demonstration

Question: What are the on-site data center tour and system demonstration expectations and the effect on evaluations, if an offeror is using a cloud-based, JAB approved, FedRAMP certified data center?

Answer: For expectations regarding the on-site data tour and system demonstration, please refer to pages 11-12 of the RFP.

Other available channels

Attachment #1 – Statement of Work (SOW), Page 2, Section

Correction of Records (Redress) Based on Contractor's Eligibility

Evaluation

Question: In the paragraph it states that Applicants who are found to be ineligible need to be provided with information on any alternatives.

Can this be limited to only providing information on any other Government available alternatives?

If not, we will likely be providing information on commercial possibilities, which might cause competitive and legal issues between commercial companies. (Same on bottom of SOW page 9)

Answer: As stated in the SOW, applicants unable to complete identity assurance may be directed to other viable government alternatives.

Applicants potentially ineligible based on criminal history shall be notified of the potential ineligibility (identify the criminal record and reporting jurisdiction). It will be incumbent upon the applicant to obtain corrected records for reconsideration by the Contractor. The Contractor shall review information provided by applicants to the Contractor for redress and correction of record for the Contractor’s preliminary eligibility review.

Applicant Identity

Verification, Identity Documents

Attachment #1 – Statement of Work (SOW), Page 7, Section

4.1.3.2

Question: The SOW appears to allow an applicant to upload an identity document (either before or after in-person enrollment) that is different than the Government-issued photo ID that the individual must present at the in-person enrollment. In such circumstances, the Contractor will only be able to view an online scanned image of the uploaded ID documents.

Please explain what TSA means when it states that the contractor must confirm that the uploaded documents (which will not be presented in hard copy) are “certified” and “valid.”

Answer: The Contractor shall confirm that the document uploaded is an original or certified copy of an identity document and the name on the document matches the name provided on the application. For example, if the applicant indicates that a birth certificate has been uploaded, the Contractor shall confirm that a birth certificate with the individual's name has been uploaded.

Security Training

Requirements

Attachment #1 – Statement of Work (SOW), Page 8, Section

4.1.4

Question: Is it acceptable to perform background investigations before hiring then perform security training after hiring but before allowing access to TSA physical and logical resources?

Answer: Yes, it is up to the vendor to perform its own background checks prior to hiring. The vendor must also complete security training of its employees prior to access to TSA physical and logical access. TSA has revised the SOW.

8 TSA PIV Requirements Attachment #1 – Statement of Work (SOW), Page 8, Section

4.1.4

Question: How long does it take to get a TSA PIV card? Can we use an interim solution while we wait for the TSA PIV card to be issued?

Answer: There is no set timeframe for issuance of a TSA PIV card. There are multiple steps involved with obtaining a TSA PIV card, which include the eQIP process, PIV sponsorship, and a physical badging location to receive the card. No interim solution is permitted.

Attachment Clarification

Attachment #1 – Statement of Work (SOW), Page 17, Section 4.7

Question: Please verify that this statement, “Please reference attachment #4 TSA PRECHECK

LICENSE FOR OTA, #5 BRANDING POSITION #6

BRANDING GUIDELINES," should be attachments 5, 6 and 7.

Answer: The Contractor must execute a TSA-approved licensing agreement to abide by all specified TSA Pre✓® branding strategy guidelines.

The attachment references in the SOW will be updated to reflect the appropriate attachments (i.e. #5 TSA Precheck License for OTA, #6 TSA Brand Positioning, #7 TSA Branding Guidelines).

10 Clarification Attachment #1 – Statement of Work (SOW), Page 21, Section

4.10.1, 1g

Question: Performance measure says "Application Processing Time for Applicants with Derogatory Information" but the Definition says "Number days between the day that the application of an individual without derogatory information was submitted…" Please confirm what this SLA is for.

Answer: Definition shall be corrected to say "with" instead of "without".

11 Link Correction

Attachment #1 – Statement of Work (SOW), Page 35, Section

4.14.3 IT System Security

Requirements

Question: SOW 4.14.3.C.4.a)2.a contains a dead link for the DHS Sensitive Systems Configuration Guidance web page. Can TSA provide a working link?

Answer: Any links that are not accessible to vendors will be provided as attachments.

12 TSA Form 251

Attachment #1 – Statement of Work (SOW), Page 38, Section

4.14.3 IT System Security

Requirements

Question: Under what circumstances would we (the contractor) ever need to perform the actions listed in 4.14.3.H.4?

Answer: All actions listed are applicable to the contract and provide system security requirements for the PreCheck application.

13 Clarification

Attachment #1 – Statement of Work (SOW), Page 40, Section 4.14.3.N and Page 41, Section

"SECURITY REQUIREMENTS FOR

UNCLASSIFIED INFORMATION

TECHNOLOGY RESOURCES"

Question: Are the terms "System Security Plan (SSP)" and "IT Security Plan" synonymous for the purposes of this OTA?

Answer: Yes

Personnel Security

Requirements

Attachment #1 – Statement of Work (SOW), Page 44-45, Section

4.14.3, Special Information Technology Contract Security

Requirements, (a-e)

Question: To which segment of employees does the "Special Information Technology Contract Security Requirements, " subparts (a) through (e)apply? Does it only apply to privileged access users, as defined in (c)(1), working in TSA facilities with access to IT systems with privileges of Administrator or above and with access to sensitive network infrastructure data, and not to all Contractor personnel?

Answer: The Special Information Technology Contract Security requirements pertain to all contractor employees supporting the contract, but applicability varies based on the access requirements for each employee. For example, Contractor personnel who do not require access to either TSA physical or logical resources are not required to obtain a TSA PIV Card (number 1 Section A) and privileged access (number 1 Section C) is only applicable to users who have administrative access to a system and have access to sensitive network infrastructure data.

15 Clarification

Attachment #1 – Statement of Work (SOW), Page 47, Section

4.14.5 System Security

Requirements

Question: In the fifth bullet from the bottom, the last sentence reads, "Once a Contractor has received clearance to move into operations, the Contractor shall continue red-teaming with the Contractors as part of continuous improvement."

Should it read, "Once a Contractor has received clearance to move into operations, the Government shall continue red-teaming with the Contractors as part of continuous improvement."?

Answer: Yes

OTA Period of Performance

Attachment B – Other Transaction Agreement, Page 4, Section

ARTICLE V - EFFECTIVE DATE AND

TERM

Question: On page 4 of the OTA, Article V states:

"This agreement will continue in effect for a three (3) year base and seven (7) one year option a total period of performance of Ten Years (10) …" On page 58 of 59 in the SOW under Performance/Delivery Period, the SOW states:

"TSA reserves the right to award OTAs with a total period of performance not to exceed five

(5) years in duration". We respectfully request that TSA clarify or synchronize the term statements.

Answer:"This agreement will continue in effect for a three (3) year base and seven (7) one year option a total period of performance of Ten Years (10)

Clarify Last Sentence of

Article

Attachment B – Other Transaction Agreement, Page 5, Section

Article VIII

Question: This sentence seems to be missing a word or two. Can TSA please clarify? Did TSA intended this to read, “TSA does not provide for any government reimbursement …” per a statement similar to that in the SOW.

Answer: OTA corrected to read, “TSA will not provide any Government reimbursement of any cost incurred in making necessary studies or designs for the preparation of the systems or incurred in obtaining services or supplies”.

18 Use/Ownership of PII Attachment B – Other Transaction

Agreement, Page 9 and 10, Section Articles XIX and XXI

Question: Can TSA please confirm that where, following completion of pre-enrollment, an applicant opts into a different program offered by the contractor and agrees to allow the contractor to use, for that program, the applicant’s PII collected during the pre-enrollment process for TSA Pre✓®, the contractor may make a copy of such PII with the result being that such copy of PII constitutes vendor data (and not TSA data) that can be stored in the contractor’s own non-Privacy Act regulated records system? We assume TSA does not want to assume responsibility for the PII of an individual who has opted into another of the Contractor’s programs.

Answer: Yes

Trademark Notice

Inconsistency

Attachment B – Other Transaction Agreement, Page 12, Section

ARTICLE XXVI - THE LICENSING OF

THE TSA PRECHECK TRADEMARK

Question: The trademark notice in the OTA appears to be truncated as compared to the trademark notice in the license agreement. The OTA states "Contractor provides pre-enrollment services for the Transportation Security Administration's TSA Precheck(R)." Attachment # 5, The LICENSE AGREEMENT BETWEEN THE

UNITED STATES DEPARTMENT OF HOMELAND

SECURITY, TRANSPORTATION SECURITY

ADMINISTRATION AND IDENTIFY OTA

PARTICPANT, states on page 3 of 6 "Contractor provides pre-enrollment services for the Transportation Security Administration's TSA Precheck(R) Risk Based Screening program. We respectfully request that TSA clarify or synchronize the trademark notices.

Answer: The terms "Risk Based Screening program" were truncated from the OTA in error, and will be synchronized with the license agreement in the SOW. See revised OTA.

20 PII Incident Attachment B – Other Transaction Agreement, Page 20-21, Section

Article XXXI

Question: : Please confirm that, in the event of a sensitive information incident involving PII, TSA will not direct the Contractor to take or refrain from action in a manner that would cause the Contractor to violate its legal obligations under applicable local, state or federal law.

Answer: TSA is unaware of actions that you believe could be directed that would violate local, state or Federal law.

21 Fees SoW Section 4.4.3

Under TSA’s current PreCheck enrollment plan, does the current provider of enrollment services incur costs on par with what is contemplated in this RFP (specifically, the cost of the FBI background check plus the $20-25 TSA processing fee)? If current costs are below what is contemplated in this RFP, what assurance can TSA give respondents that the current provider will not undercut new market entrants using that cost advantage?

Answer: TSA and FBI operating costs are the same per application, regardless of enrollment provider.

Criminal History Records Check

SoW Section 4.3.1 Based on historical data, what percentage of FBI fingerprints were rejected twice, requiring a name based FBI check?

Answer: TSA will not be providing this information as it is not relevant to the solicitation. This RFP is related to a new expansion effort for the TSA PreCheck program.

Metrics regarding the current TSA PreCheck population are not relevant to this new effort.

23 Eligibility Evaluation SoW Section 4.3 Can you please share the current rejection rate for TSA PreCheck applicants based on results of criminal history?

Answer: TSA will not be providing this information as it is not relevant to the solicitation. This RFP is related to a new expansion effort for the TSA PreCheck program.

Metrics regarding the current TSA PreCheck population are not relevant to this new effort.

24 Fees SoW Section 4.4

In the SoW, page 14, it states that provider will be required to refund applicants’ fee if he/she does not pass initial screening, despite the fact that provider will be out of pocket to perform a background check. Please confirm this would still be a required policy even in the event that applicant knowingly falsified answered questions about disqualifying factors on the initial application process.

Answer: If the applicant does not successfully complete the Contractor's identity assurance and eligibility process and that information is not yet passed to TSA, the Contractor shall refund any fee charged to the applicant that was imposed to cover the TSA fee. The contractor shall not keep such charges and shall not offset such charges with a transaction processing fee.

Criminal History Records Check

SoW Section 4.3.1

Could you confirm the current criminal history records check sources utilized by TSA? As the requirement for ensuring the information is obtained with reduced errors, it is pertinent to ensure like information is obtained.

Answer: TSA uses the FBI to obtain criminal history information.

Criminal History Records Check

SOW 4.3.4

There are countless ways to conduct recurrent eligibility checks. Is there a current method in which TSA is using? Would TSA be more interested in an annual method via fingerprinting, preset intervals of commercial screening or a continuous monitoring program?

Answer: TSA does not have any specific requirements for how the contractor shall conduct recurrent eligibility checks and encourages the contractor to propose innovative solutions for recurrent vetting

Criminal History Records Check

SOW 4.3.4

Are there any performance requirements, or maximum missed error rates for the recurrent eligibility checks? Without clear requirements for this check, it is difficult to understand what types of recurrent investigations are required.

Answer: TSA does not have any specific requirements for how the contractor shall conduct recurrent eligibility checks and encourages the contractor to propose innovative solutions for recurrent vetting. However, Performance Metric 6- General Solution Configuration and Reporting, specifies the Continuous Improvement Techniques success measure as, “The contractor shall document, measure, and report improvements to the identity assurance process and Criminal History Records Check pre-screening process”.

Criminal History Records Check

SOW 4.3.4

As "RapBack" becomes available, would TSA consider supporting the channeler to obtain access on their behalf for this program?

Answer: TSA shall evaluate the proposed use of RapBack as part of the proposal review.

29 PIV Cards SoW Section 4.1.4

How will TSA facilitate issuance of PIV cards to contractor employees? What is the expected timeframe for the processing and issuance of said cards?

Answer: See question #8.

30 Fees SoW Section 4.4.3

The current documentation states that TSA’s fees will be from $20-25 per enrollee. Has TSA yet determined a specific, final fee amount?

Answer: While not yet finalized, TSA estimates the fee that will need to be remitted to TSA to cover TSA costs to process each applicant will range from $20 to $25 per applicant. This fee will cover the 5 year life of the security threat assessment. The contractor has full flexibility to satisfy that fee on behalf of the applicant or pass along all or part of that fee to applicants.

31 PreCheck Providers SoW Section 3 and OTA

Will TSA continue to allow PreCheck enrollment through the Universal Enrollment program once this award is made? If so, will the current provider of that service be permitted to continue in its role operating that program while also participating in this RFP?

Answer: Yes, the current Universal Enrollment Services vendor will continue to operate the TSA PreCheck Application Program until that contract concludes. Furthermore, this RFP is open to all prospective offerors that meet the requirements stated in the RFP.

32 Redress SoW, Attachment 1, P.2

If the contractor uses FBI-issued fingerprint-based CHRI as a background check and an applicant claims the CHRI has invalid data, would proper redress be to inform the applicant to contact the reporting state agency for correction, which is the proper course of action for other civilian FBI fingerprint checks?

Answer: Contractors should propose innovative solutions for conducting redress which shall be evaluated as part of proposal review. Please see SOW Section 4.3.1, 5th paragraph.

33 Enrollment Activities SoW, Attachment 1, Section 4.1, P.5

Is "in-person enrollment" required or can alternate solutions be proposed for applicants that cannot utilize pre-enrollment?

Answer: Per SOW Section 4.1 on page 5, "Applicants have the option to submit biographic information and identity documents online.

However, all applicants shall be required to complete the in-person enrollment process with the Contractor for identity verification and biometric collection."

34 Enrollment Activities SoW, Attachment 1, Section 4.1, P.5

In the case that an applicant cannot use the pre-enrollment process, can the applicant be required to coordinate with the contractor for registration, payment and expedited appointment scheduling prior to appearing at an appointment processing site? This will allow an applicant to process in an expedited manner and process through all centralized security controls.

Answer: Contractors should propose innovative solutions for maximizing enrollment efficiency.

35 Enrollment Activities SoW, Attachment 1, Section 4.1.2, P.6

Is the acceptance of identity documents required onsite or can the contractor require document submissions prior to a physical appointment and allow for document uploads after the appointment in the event of a correction or update?

Answer: In SOW Section 4.1.2, TSA states that applicants should be allowed to upload identity documents post-enrollment. This process could also be used to support data corrections and updates.

36 Enrollment Activities SoW, Attachment 1, Section 4.1, P.5

Can online enrollment be required without a telephonic enrollment/scheduling option?

Answer: Contractors should propose innovative solutions for maximizing enrollment efficiency.

Identity Document

Collection SoW, Attachment 1, Section 4.1.2, P.6

Please describe the requirements of identity validation and citizenship status verification. Can this process be implemented by reviewing the documentation uploaded through the enrollment site?

Answer: Per SOW Section 4.1.2, the contractor may propose citizenship verification methods that may not require all listed TSA required documents. These alternate identification and proof of citizenship verification methods must be able to effectively verify an applicant’s citizenship status as either a U.S. Citizen or Lawful Permanent Resident.

Identity Document

Collection SoW, Attachment 1, Section 4.1.2, P.6 & Attachment 2 #14

Attachment 2, #14 indicates that we "shall only accept applications from individuals who are US Citizens, US Nationals, or Lawful Permanent Residents (LPRs)." In accordance with this requirement, is the contractor permitted to require that any citizenship documentation be uploaded prior to the fingerprint appointment?

Answer: Per SOW Section 4.1.2, identity documents may be uploaded before, during, or after in-person enrollment. Contractors should propose innovative solutions for maximizing enrollment efficiency.

Enrollment/Collection

Personnel SoW, Attachment 1, Section 4.1.4, P.8

What qualifies as Sensitive PII as outlined in 4.1.4, requiring technicians and vendor staff to complete Management Directive 2800.71 vetting? We limit technicians and staff to have access only to data that is required for their job functions. We are interested to know if all technicians and staff will be required this vetting process?

Answer: SPII is defined in SOW 4.14.6 and OTA Article XXXI. Each employee who requires access to TSA physical and logical resources shall be required to complete the TSA vetting process and shall meet TSA Contractor Personnel Entry on Duty requirements (Management Directive 2800.71). The Contractor may propose alternative vetting and background checks for personnel if they include isolating the employee from the interactive capabilities of the vendor’s enrollment and TSA’s Information Technology systems and no access to Sensitive PII. See SOW Section 4.1.4 for Enrollment/Collection Personnel.

Enrollment/Collection

Personnel SoW, Attachment 1, Section 4.1.4, P.8

If a contractor's fingerprint technician has no access to TSA physical or logical resources, and only access to applicant name and DOB for purposes of validating IDs before collecting fingerprints, would that technician be required to obtain a TSA Personal Identification Verification (PIV) Card?

Answer: Contractor personnel who require access to either TSA physical or logical resources , including “access to an IT system used to process information on behalf of TSA”, are required to obtain a TSA PIV Card. See SOW Section 4.1.4 for Enrollment/Collection Personnel.

41 Identity Assurance SoW, Attachment 1, Section 4.2, P.9

If the required criminal background check is based on biometric information, such as fingerprints, would this qualify as Identity Assurance?

Answer: No, see SOW Section 4.1.3.2 for applicable identity verification processes.

42 Identity Assurance SoW, Attachment 1, Section 4.2, P.9

Can the Identity Assurance Knowledge Based quizzes be restricted to the scheduling website prior to the applicant’s appointment?

Answer: Contractors should propose innovative solutions for maximizing enrollment efficiency.

Criminal History Records Check

SoW, Attachment 1, Section 4.3.1, P.10

Is a FBI fingerprint based background check sufficient as meeting criteria for 4.3.1 Criminal History Check?

Answer: Yes.

Recurrent Eligibility

Checks SoW, Attachment 1, Section 4.3.4, P.14 Please further define the "recurrent eligibility checks" screening process.

Answer: See question #27.

Recurrent Eligibility

Checks SoW, Attachment 1, Section 4.3.4, P.14

What is the time frame and scenario in which an applicant would require recurrent eligibility evaluation?

Answer: See question #27.

Recurrent Eligibility

Checks SoW, Attachment 1, Section 4.3.4, P.14

Is an applicant needing recurrent eligibility required to use the same contractor as used for previous eligibility?

Answer: See question #27.

Notify TSA of Applicant

Data Changes SoW, Attachment 1, Section 4.4.5, P.16

If an applicant's data changes, i.e. address or data corrections, is the applicant required to use original contractor to submit the change? What is the scope of an applicant account at the contractor after eligibility is determined?

Answer: Yes, the applicant is required to use the original contractor to submit data changes per Section 4.4.5. See SOW Section 4.5 and 4.6 for applicant customer service and communication capabilities.

48 Data Storage and Usage SoW, Attachment 1, Section 4.8, P.18 Would a logical partition meet the requirements for a separate TSA database?

Answer: Yes

49 Data Storage and Usage SoW, Attachment 1, Section 4.8, P.18

Is it acceptable for the contractor to hold TSA data in an existing database using logical separation, such that the TSA data is only available to TSA resources and configured TSA retention requirements are applied to the TSA data?

Answer: Yes

50 SLAs SoW, Attachment 1, Section

4.10.1, P.20-21

Please clarify the requirements of SLA items D and E. Item D states a fingerprint image quality rate of 96 percent, whereas item E, states illegible rate no higher than 2 percent. Please advise which requirement is correct.

Answer: 96% refers to the NFIQ scores associated with the ten prints, which is calculated separately and does not direct correlate to the FBI rejection rate.

System Security Requirements

SoW, Attachment 1, Section 4.14.5, P.47

If the contractor has a proprietary non-cloud environment and has obtained FISMA documentation required for an ATO, can TSA be the Federal Entity to provide the ATO?

Answer: Yes, TSA will provide the official authority to operate (ATO)

52 Past Performance RFP, Page 8

Question: Is the Offeror permitted to utilize references from its subcontractors to fulfill this requirement for certain SOW elements?

Answer: Yes, however any references from its subcontractors must relate to requirements defined in the SOW as applicable.

53 Cost Reimbursement RFP, Page 2

Question: In the Commonly Asked Questions, an estimate of $20-$25 was provided for the TSA fee. Is that the estimate Offerors should utilize for the "nominal fee per applicant" that will be reimbursed to TSA?

Answer: See question #30.

54 TSA Vetting SOW 4.1.4, Page 8 Question: What is the estimated timeline for the TSA Vetting process and receipt of PIV card?

Answer: See question #8.

55 TSA Vetting SOW 4.1.4, Page 8

Question: Given the access that customer service and enrollment personnel have to applicant information and Sensitive PII, is it that case that these individuals are required to complete TSA Vetting and receive a PIV card?

Answer: See question #39

56 Identity Assurance SOW 4.2, Page 9

Question: A KBA quiz is provided as an example of one option that could be utilized for identity assurance. Later, the KBA quiz is characterized as an "additional layer of verification" in addition to the "digital footprint." Please explain.

Answer: A KBA quiz was provided as an example.

The Contractor may propose innovative solutions for identity assurance.

57 Fee/Pricing RFP, Page 2

Question: Is the Offeror free to change its price at any time during the duration of the OTA?

Offerors may wish to decrease/increase their price based on actual volumes, costs, market conditions, or other factors. Additionally, TSA indicates that new requirements, such as for information assurance, may be required in the future, which could significantly increase an Offeror's costs.

Answer: Contractors are free to establish novel business models and pricing mechanisms, but will need to communicate with TSA prior to any pricing changes. The standard TSA fee for the STA will not be impacted by any pricing changes made by contractors.

58 Termination Attachment B, OTA, page 7

Question: Will the Government consider a longer period (e.g., 3-6 months) for contract termination/wind-down to allow Offerors to minimize financial impact for early termination of subcontracts and other agreements and to have time to conduct a reduction in force for employees on the contract?

Answer: The 30-day notice will period will remain as stated and the OTA revised to provide for a 90 day to 120 days wind-down/shutdown after the 30-day notice period.

59 Proposal Instructions RFP, Page 5

Question: Are Offerors free to use fonts other than Times New Roman in the Oral Presentation slides as long as they maintain the requirement for 12-point font for text and 9-point font for tables/diagrams?

Answer: Yes, see RFP page 4 for Proposal Instructions.

60 S&T Testing RFP, Page 9

Question: Will the Government be able to provide a Test and Evaluation Plan for the S&T testing that is contemplated for this effort so that Offerors may be adequately prepared to begin the testing within 10 days of notification?

Answer: Yes, a test plan will be provided 10 days prior to the start of testing.

61 S&T Testing RFP, Page 9

Question: Will S&T perform any load testing on the enrollment, eligibility vetting, and customer service systems to ensure that Offerors can support the daily volumes expected?

Answer: No. During the Oral Presentation Phase, however, TSA will evaluate the vendor's proposed daily volume capability and capacity.

62 Element 6: On-Site Visit RFP, Page 17

Question: The RFP states that if a vendor's system cannot demonstrate the TSA-required capabilities on page 17 (above the 2 minimum requirements on page 16), a neutral score will be assessed. Are there minimum qualifications to receive a pass?

Answer: Answer: Element 6, Operational Systems Demonstration (on site) is not a pass/fail evaluation. An Offeror's system will be objectively evaluated for what it demonstrates.

TSA will revise its RFP language.

63 Element 6: On-Site Visit RFP, Page 17

Question: Are there any situations in which an Offeror would be deemed to fail the On-Site Visit, e.g., not being able to correctly enroll a person, insufficient physical security at a data center, no documentation of ATO/JAB, etc.?

Answer: See Question #62.

64 Enrollment General Question

Question: Will applicants be allowed to enroll with more than one vendor? Will there be any measures required so that applicants don't "game the system"?

Answer: All vendors are subject to the same requirements regarding identity assurance and criminal history eligibility. Additionally, vendors are required to submit a list of ineligible applicants to TSA.

65 SAFETY Act Attachment B, OTA, page 12

Question: Does the Government have an estimate of when DHS will make a definitive determination if this program is covered under SAFETY Act? If it is not, will the Government indemnify vendors if they have passed S&T testing and performed their duties according to the standard operating procedures approved by

TSA?

Answer: TSA will not provide indemnification to vendors. See revised OTA language.

66 Suspension Attachment B, OTA, page 7 Question: What is the notification period for the Government to notify a contractor that it must suspend operations?

Answer: There will not be a notification period.

67 Non-Disclosure Attachment B, OTA, page 11

Question: We understand that a DHS NDA will be signed by all TSA contractors providing services.

Third-party vendors would not have privity of contract for any deliberate or inadvertent disclosures of proprietary or other sensitive information of Performer unless there is a 3-way NDA or a direct NDA between the Performer and the other contractor serving TSA. Will TSA facilitate the signing of 3-way NDAs so that Performers may be reassured that their proprietary and other business sensitive information will be protected against improper use or disclosure because of a direct contractual right to enforce the terms of the NDAs against such third-party vendors.

Answer: TSA will not facilitate the signing of 3-way NDAs.TSA has revised the OTA to require vendors to execute NDAs between vendors to protect their information from unauthorized use or disclosure. See revised OTA language.

68 Trademark Attachment B, OTA, page 11

Question: If all vendors must use the same DHS-provided brand materials, how will they differentiate their marketing? Will there be more flexibility allowed in order to enable vendors to be creative within a defined range in order to differentiate and attract the widest possible audience?

Answer: Vendors are not required to use DHS provided materials, but they are required to follow all TSA PreCheck Branding Guidelines (mentioned in Attachment 06 of the RFP package) and review all marketing materials with TSA for approval before using publically. Offerors can use their own brand or marketing materials created by TSA for TSA PreCheck as long as they follow TSA creative content guidelines content.

See SOW Section 4.7.

Registration and

Identification Attachment 2, Item 12

Question: The requirement for the Contractor to review uploaded documents during the in-person enrollment process seems unnecessary if the Contractor has a process for reviewing documentation prior to making an eligibility determination. Request that the requirement be changed to not dictate that documentation review occur during the in-person enrollment.

Answer: Agreed. TSA will update the requirement accordingly.

Identity Document

Collection SOW 4.1.2, page 6

Question: How will alternative citizenship documentation approaches be tested during the S&T testing period? How will TSA approve alternative citizenship checks?

Answer: TSA shall evaluate the proposed citizenship document verification methods as part of the proposal review.

71 Biometrics SOW 4.1.3.1, page 7 Question: If applicants provide consent, may the provided biometrics be used for other purposes?

Answer: TSA recognizes that third party contractors may perform other functions for applicants that rely on utilizing the same applicant data elements. Third party contractors must obtain written authorization from each applicant to use the applicant's biographic or biometric data for any purposes beyond those directly related to TSA PreCheck, and must segregate TSA data from other data that the third party contractor may maintain on the same individual even where the same data element (name, for example) appears. Third party contractors will operate a "system of records" within the Privacy Act of 1974, 5 U.S.C. 552a, that limits the authorized disclosure and use of TSA data.

72 Identity Assurance SOW 4.2, page 9

Question: How would the identity assurance activities, such as a KBA, differ for walk-in applicants who have the TSA-required ID documents, such as drivers license/birth certificate/passport?

Answer: All applicants are subject to the identity assurance requirements in SOW Section 4.2, regardless of whether they present the necessary required identity documents at enrollment.

73 S&T Testing SOW 4.3.2, page 13

Question: What methodology will S&T use to determine if commercial data sets may have a "disparate impact" on some populations?

Answer: Disparate impacts will be evaluated as a quantitative (pass/fail) assessment during S&T proposal evaluations.

74 Transmit Data SOW 4.4 , page 14

Question: If contractors are not able to begin integration testing with TSA within 60 days, will Offerors be prohibited from providing services permanently or for a certain period of time before they can resubmit to become an enroller?

Answer: See RFP, page 2, "New or Upgraded Technologies, Solutions, and Providers".

75 Testing Schedule SOW 4.4, page 14

Question: The SOW states that the testing schedule will be determined by TSA and that it may not align with a contractor's readiness. Will TSA begin testing earlier than 60 days after OTA award? Do contractors need to be ready to integrate on Day 1 of OTA award?

Answer: TSA shall begin testing no earlier than 60 days from OTA award. The Contractors do not need to be ready to integrate on Day 1 of the OTA award.

Criminal History Records Check

SOW 4.3.1, page 10 Question: Are vendors required to disclose to applicants which commercial data sets are used for the CHRC?

Answer: Contractors will have to disclose specific data sources for purposes of redress.

Consolidated Screening

Gateway SOW 4.9, page 19

Question: As this is a $0 OTA, vendors must set their pricing to cover all costs. As the future replacement for the CSG has not been designed, will TSA provide backwards compatibility to minimize interface changes that will add significant cost and risk to Offerors' proposals?

Answer: TSA cannot guarantee backward compatibility of new backend systems.

78 S&T Testing SOW 4.10.2, page 23 Question: Will S&Ts data sets be of live data on actual people - or a set of fictitious people?

Answer: Yes, the intent is to provide real data so identity assurance testing can be performed using real identities, and criminal history testing can be performed using actual commercial data sources if that solution is used. Requirements on protecting the data and deleting the data post-testing will be provided.

79 CRADA SOW 4.10.2, page 23

Question: Can TSA provide the CRADA template ahead of time so that Offerors may review it in advance of potentially entering into an agreement with S&T?

Answer: Yes, a CRADA template will be provided 10 days prior to the start of testing.

80 OTA SOW, page 40,bottom of page

Question: If an Offeror is not able to achieve ATO within 120 days of award, will that Offeror be prohibited from being a service provider permanently or for a period of time? Will an Offeror who does not achieve ATO be required to resubmit a new OTA package at the next opportunity to propose for OTAs?

Answer: See Question #74.

81 PIV Cards SOW 4.14.5, page 47

Question: Can TSA provide a list of facilities and hours of operation where TSA PIV cards are issued and, for planning purposes, an estimated time to receive one from the time of EQIP submission to PIV issuance?

Answer: There is no set timeframe for issuance of a TSA PIV card. There are multiple steps involved with obtaining a TSA PIV card, which include the eQIP process, PIV sponsorship, and a physical visit to a badging location to receive the card. To see a list of current locations for PIV cards, please visit https://dhs.authentx.com/dhs/appointments/fr m-appt.html. Please note that you will need to create a profile first.

82 .gov Domain Names SOW 4.14.5, page 47

Question: Will Contractors be able to choose their preferred .GOV domain names? How will TSA deconflict if Offerors want the same/similar domain names?

Answer: The GSA controls the registration and assignment of .GOV domain names. Any concerns regarding the use of a .GOV domain address that is trademarked or confusingly similar to a private right will be addressed by GSA and TSA as part of the approval process.

83 Call Center SOW 4.10.1, 4, page 22

Question: Will inadvertent calls or emails intended for another service provider be omitted from the Customer Service metrics? (i.e., in the event that applicants are confused by multiple application options)

Answer: Yes, the Contractor may omit emails and calls inadvertently directed to them from their metrics.

84 Enterprise Architecture SOW 4.14.2, page 32

Question: Can TSA provide more information on the DHS Enterprise Architecture list of approved segment architecture, reference architectures, IT hardware, IT software, and other IT components?

As this is being offered as a service under a $0 OTA, will TSA allow Offerors to propose their own innovative solutions that may not be included in the DHS Enterprise Architecture? How will vendors have new components approved within the DHS Enterprise Architecture? How long do approvals take and what is the process?

Answer:

Yes TSA EA can answer specific questions with respect to segment architectures, reference architectures, IT hardware, IT software, and other IT components. E.g. is software “xyz” approved in the DHS EA? Vendors can propose their own innovative solutions for which elements may not be currently be included in the DHS EA, however those elements will need to be approved through the DHS EA governance Tech Insertion (TI) process. Normally this process takes several weeks. EA will be happy to review a specific Bill of Materials (BOM) indicating what products are currently in the DHS EA and which ones would require approval.

85 Enterprise Architecture SOW 4.14.2, page 32

Question: What are the proposed timeframes for conducting the Solution Engineering Review (SER), Preliminary Design Review (PDR) and Critical Design Review (CDR)? Are these steps in addition to the steps outlined in other parts of the RFP package?

Answer:

These reviews are part of the DHS Systems Engineering Lifecycle (SELC) and would be conducted if the vendor is building a system.

The timeframes for these reviews is based on the specific project plan for the development/construction of that system.

86 Enterprise Architecture SOW 4.14.2, page 33

Question: Can TSA provide more information on the process for approving data assets, information exchanges, and data standards?

What is the timeframe for TSA EDM approval?

Answer:

Data assets, information exchanges, and data standards are approved as part of the Data Management Plan (DMP) that is submitted to the TSA EDM. There is a standard template for this.

Approval can be accomplished in a week assuming there are no issues/problems.

Applicant Identity

Verification SOW 4.1.3.2, page 7

Question: Section 4.1.3.2 states that identity verification shall be compliant with NIST 800-63 Assurance Level 3 and refers to page 34 of that document. Since a credential is not being supplied as part of the enrollment, do parts a, b, and c of the In-Person column of that table on page 34 apply? In other words, we assume that we don’t have to record an applicant’s voice if s/he provides a phone number.

Answer: Correct, parts a, b, and c of the In- Person column should not apply.

DHS Science &

Technology Testing SOW 4.3.2, page 13

Question: For testing of FBI criminal history record checks, will TSA be providing applicant fingerprint records to be used in the S&T Testing?

Does the FBI have a test system that can be utilized for this purpose, or will the FBI’s production system be utilized? If the production system is used, who will bear the cost of the associated FBI fees and is there an estimate for how many records will be tested?

Answer: If Offerors are authorized direct channelers and elect to utilize the FBI to obtain criminal history information, then no fingerprints shall be provided for S&T testing. Instead, TSA shall provide the criminal history information to these Offerors for adjudication purposes.

System Security Requirements

SOW 4.14.5, page 46-47

Question: Are interfacing systems, such as those used for the identity assurance and criminal history checks, included in the system boundary and thus subject to these requirements?

Answer: The enrollment stations (hardware and software) and other systems used in the field will be part of the system boundary. Interfacing systems must be clearly documented in the system security plan and will be reviewed, per TSA IT security certification and accreditation process, in order to receive the Authority to Operate (ATO).

Enrollment

Opportunities Marketing

SOW 4.7, page 17-18

Question: Given that several companies could be managing the TSA Pre✓® brand as a licensee, what is the process for managing all the competing factions now marketing, selling, distributing and operating the same licensed brand?

Answer: TSA will manage the TSA Pre✓® brand.

As licensor TSA will oversee the use of its brand by the several Licensee's and adjudicate and conflict between licensees in the best interest of the Government.

Enrollment

Opportunities Marketing

SOW 4.7, page 17-18

Question: With multiple companies now competing for market space and share of TSA Pre✓® how will TSA bifurcate the brand marketing such that vendors are not marketing to send customers to a competitor's location?

There will need to be completely separate infrastructures, websites and so forth for each vendor, but how will TSA decide who to send application inquires to?

Answer: TSA will determine how best to communicate enrollment options on TSA.gov.

Offerors are responsible for differentiating their own brand via Offeror's marketing plan and website.

Enrollment

Opportunities Marketing

SOW 4.7, page 17-18

Question: Because TSA Pre✓® is currently a single brand with a set consumer retail price and because price is such an important part of the marketing mix as the brand owner and Licensor, will TSA provide consistent MAP (minimum advertised price) programs for all participants?

Answer: No

Enrollment

Opportunities Marketing

SOW 4.7, page 17-18

Question: It appears as if TSA is moving more to a product and retailer model. Therefore, if the TSA Pre✓® brand is going to have consistent creative and messaging, will the retailer or distributor have the opportunity to expand their brand and message in order to assure that customers know where they can find TSA Pre✓® and to capture market share?

Answer: The TSA Pre✓® brand will have consistent messaging, all creative content produced by OTA partners will be coordinated and approved by TSA. OTA partners may expand their individual marketing and commercial communications to capture market share as long as that expansion is consistent with the brand position as established by TSA for the TSA Pre✓® program. See question 68 for additional context.

94 Evaluation Criteria RFP, pg. 18, 4th bullet at top of page.

The bullet references SOW 4.4.2.1; however, there is no such section in the SOW. We assume the correct reference is 4.4.3.1

Answer: Yes, the correct reference is 4.4.3.1. RFP will be updated.

95 S&T Tests RFP, pg. 10, (i)(3)

Some contractors may rely on FBI criminal record checks as part of applicant processing.

Does the test database contain 10 print fingerprint data for the subject identities. Are these raw images or templates?

Answer: See question #88.

RFP, pg. 9

RFP, pg. 10, (i)(3) Answer: Written results will be provided as part of DHS S&T proposal evaluation phase and should not be included in Volume III. RFP will be updated.

97 Bidder Eligibiilty General

It is our understanding that once the OTA's are issued under this procurement, Morpho Trust will no longer continue to provide PreCheck enrollments under the UES contract. Is that correct?

Answer: See question #31.

Optional Fingerprint based background check SOW, 4.3.1, pg. 11

The RFP provides the ability for offerors to propose full fingerprint based background checks as opposed to name based checks. As fingerprint checks are orders of magnitude higher in cost than name based checks please explain TSA rationale. Will offerors who propose fingerprint background checks be awarded additional evaluation points?

96 S&T Tests

The sub-bullet, under "Volume III.. - ...Offerors shall provide results from processing the Government-provided datasets ...." seems to indicate that the results are due at the time of proposal submission; however, the text at the bottom of page 10 indicates that only those offeror's that successfully make it through the orals phases will be subjected to DHS S&T Testing. When are the written results to the DHS S&T Tests due for submission?

Answer: Contractors should propose innovative solutions for obtaining criminal history information which shall be evaluated as part of proposal review.

99 Pricing General

Will bidders be able to offer a blended products and services to customers? For example buy a bundled travel product that includes PreCheck applicant fee.

Answer: Yes, it is up to each offeror to determine their price and marketing model.

Test and Evaluation

Phase RFP, pg. 10, (i)(3)

Please describe the format of the database DHS will supply for the test and evaluation.

Answer: The dataset format provided for testing will be defined in the test plan provided 10 days prior to the start of testing. The CHRC results data set will be delivered as a separate file(s), but will have a unique identifier that links the CHRC results to the biographic data file.

Existing PreCheck eligible travelers

General

Will existing PreCheck members who received the benefit for free (e.g. certain frequent flyers) be expected to pay an applicant fee to continue to receive the programs benefits? If so will this be aligned with the ATO dates?

Answer: Existing TSA PreCheck benefits are independent of the TSA PreCheck Application Expansion initiative’s ATO.

102 Period of Performance SOW, 4.15, pg. 58

The SOW indicates a period of performance "not to exceed five (5) years in duration" however, the OTA document in the bid package indicates 3 years plus 7 one year options for a total of ten

(10) years. Please clarify the period of performance.

Answer: See question #16.

103 Enrollment Personnel SOW, 4.1.4, pg. 8

In the middle of the 1st paragraph under 4.1.4 it states "..... the Contractor's employee may be issued a TSA PIV card." Are there circumstances under which the successfully vetted employee won't be issued a PIV card? We focused on the word "may" as opposed to "will".

Answer: TSA will revise SOW language to clarify PIV card required if accessing TSA IT systems.

104 Enrollment Personnel SOW, 4.1.4, pg. 8

Must Contractor's enrollment personnel visit a DHS PIV card location or might they be able to visit any PIV location (such as those operated by GSA)? We have many planned enrollment locations that are many hours drive from a DHS PIV location.

Answer: Enrollment personnel must visit DHS PIV card locations. See question #81.

105 Oral Presentation General

For oral presentations we intend to bring a senior executive from one of our marquee brand…