CIO486 LEDA Solicitation.pdf

Synopsis/Solicitation No. HSTS03-11-R-CIO486

Transportation Security Administration (TSA) Law Enforcement Database Access (LEDA)

SECTION 1 – Solicitation Information

Section 1.1- Type of Contract: The TSA contemplates the award of a contract on a Firm-Fixed Price (FFP) basis. Orders under this contract shall be placed for the supplies and services identified in Section 2 of the contract, and shall be placed in accordance with the procedures and limitations identified in the applicable clauses of the contract.

Section 1.2- General Information and Response Date: This combined synopsis/solicitation for commercial supplies and services is prepared in accordance with Federal Acquisition Regulation (FAR) Part 12, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a separate written solicitation will not be issued.

All questions or requests for clarifications shall be submitted by email to the Contract Specialist at Yague.Ngom@dhs.gov no later than Tuesday, June 28, 2011 at 11:00AM EST. If any question(s) are received after this time and date, the Government reserves the right not to provide an answer. Answers to all questions submitted will be emailed to all potential Offerors.

This notice is issued as a Request for Proposal (RFP). Interested Offerors must respond to this combined synopsis/solicitation. Proposals in response to this combined synopsis/solicitation must be received by the Government no later than 11:00 A.M. Eastern Standard Time (EST) on Wednesday, July 6th, 2011.

Section 1.3- Issuing Office:

Transportation Security Administration Office of Acquisition 601 South 12th Street Arlington, VA 20598-6025

Section 1.4- Point of Contact (POC): Questions regarding this notice shall be directed to the following point of contact. In addition, proposals shall be submitted electronically via email also to the following point of contact by the closing date and time listed above:

Yague Ngom Contract Specialist 571.227.2252(office) Yague.ngom@tsa.dhs.gov

Section 1.5- Set-Aside Status: This acquisition is set aside 100% for small business concerns.

(1) The North American Industry Classification System (NAICS) code for this acquisition is 541511.

mailto:Yague.Ngom@dhs.gov�

(2) The small business size standard for a concern which submits an offer in its own name, other than on a construction or service contract, but which proposes to furnish a product which it did not itself manufacture, is $25M average annual receipts.

SECTION 2 – Supplies and Pricing

The Contractor shall provide the TSA LEDA COTS supplies and services as specified in the Description of Supplies/Services below in accordance with the following price schedule. The below Schedule defines the pricing for all four (4) years of the Contract POP.

CLIN Description Qty Unit Extended Price 00001 COTS product Message

Gateway/Switch

1 EA

00002 COTS Product LEDA Web Portal 1000* LO 00003 Implementation Support and

Training

1 LO

00004 Maintenance 1 LO 00005 Option Year 1: Maintenance 1 LO 00006 Option Year 2: Maintenance 1 LO 00007 Option Year 3: Maintenance 1 LO 00008 Option Year 4: Maintenance 1 LO Total

*minimum users

SECTION 3 - Statement of Work / Technical Requirements

Background: TSA has several mandates to vet individuals for various jobs that may pose a security threat. These mandates include the areas of hazardous material (HAZMAT) endorsements for truck drivers, Registered Travelers, aliens that seek flight school admission, transportation workers that can access security sensitive areas, and TSA employees. TSA uses all current means at its disposal to properly verify the identity and check the background of individuals being processed. Also, TSA security offices require access to certain law enforcement databases to perform law enforcement functions. Additionally, the Federal Air Marshall Service (FAMS) has an operational need to provide Law Enforcement Officers (LEOs) with documentation authorizing travel by air while armed. The current process for satisfying this requirement will expire in November 2011 and must be replaced in order to ensure seamless operations.

As a result, TSA has a requirement to obtain access to the Federal Bureau of Investigation (FBI)

National Crime Information Center (NCIC) and the National Law Enforcement Telecommunications System (NLETS). NCIC and NLETs provide the data required to vet individuals for various jobs that may pose a security threat. TSA is seeking to acquire Law Enforcement Database Access (LEDA), a message switch developed specifically to support law enforcement and criminal justice information exchange systems.

Technical Requirements: The LEDA and associated support shall provide the following:

• Access to the FBI & National Crime Information Center (NCIC) and the National Law Enforcement Telecommunications System (NLETS)

• Support a variety of message formats and protocols using configurable message processing and interface capabilities

• Provide guaranteed message delivery using message store and forward capabilities

• Support the latest information sharing technologies and standards, such as Web 2.0 for

NLETS processing

• Run on Windows platform (preferred)

• Database access using Oracle (preferred)

• Operate on Web-based, desktop user interface (UI) to access the LEDA system functions

• Submit query requests through the Web UI

a. Currently (PsPortals – Portal 100) serves that function

• Use the existing Administrative Message (AM) capability of NLETS

• Standard Reports

a. Summary audit log, record of login, user access and action

b. Standard system reports

• Provide administrative support tasks, as follows:

a. Add, delete, and update user information

b. Add, delete, and update organization (airport) information

c. Manual status update for mailed RAP sheets

d. View/print audit trail of user access

e. View/print statistical reports

f. Control automated archive/purge of database

• Vendor shall provide installation support and maintenance of the software

a. Support Services to include installation support for the above applications listed.

b. Support Center Service, User Communication Service, Software Maintenance

Release Service, and Electronic Support Service, from 8:00 AM to 5: 00 PM, Monday through Friday excluding Federally designated holidays.

c. For business critical urgent problems (loss of the system or major component), Vendor will provide Support Center Service support seven (7) days per week , twenty –four (24) hours per day.

d. All support will be available via toll-free number or web site

• Vendor shall provide training on the software at TSA HQ

a. TSA requires training for four (4) individuals.

i. User training to include administrative functionality

ii. Train-the-Trainer session to teach the attendees how to instruct others

b. Operational training required for TSA support team, up to five (5) individuals

SECTION 4- Packaging and Marking

This is a Software procurement therefore no special packaging or marking is required.

SECTION 5 – Inspection and acceptance

Shall be in accordance with FAR 52.212-4(a).

SECTION 6 – Deliveries or Performance This procurement is for software therefore no physical delivery is required except for the training. Period of performance is one (1) base year and three (3) twelve (12) month options.

Period of performance begins on date of award.

SECTION 7- Contract Administration Data

7. 1 Contracting Officer (CO)

The Contracting Officer is the only person authorized to make any changes, approve any changes in the requirements of this contract, issue orders, obligate funds and authorize the expenditure of funds, and notwithstanding any term contained elsewhere in this contract, such authority remains vested solely in the Contracting Officer. (For further information, the Contracting Officer is a federal government employee who is specifically authorized and appointed in writing under specified agency procedures and granted the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.) In the event, the Contractor makes any changes at the direction of any person other than the Contracting Officer, the change will be considered to have been without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

The following Primary Contracting Officer is assigned to this contract. Alternate Contracting

Officers may be assigned:

Contracting Officer: Bethany Petrofsky

(571) 227-2545 Bethany.petrofsky@dhs.gov

7.2 Contracting Officer’s Technical Representative (COTR):

The principle role of the COTR is to support the Contracting Officer in managing the contract.

This is done through furnishing technical direction within the confines of the contract, monitoring performance, ensuring requirements are met within the terms of the contract, and maintaining a strong relationship with the Contracting Officer. As a team the Contracting Officer and COTR must ensure that program requirements are clearly communicated and that the agreement is performed to meet them. The principle role of the Technical Monitor (TM) is to support the COTR on all work orders, tasks, deliverables and actions that require immediate attention relating to the approved scope and obligated funding of the contract action.

The Contracting Officer hereby designates the individual(s) named below as the Contracting

Officer's Technical Representative(s) and Technical Monitor(s). Such designations(s) shall specify the scope and limitations of the authority so delegated.

TSA COTR: TBD

The COTR(s) and TM(s) may be changed at any time by the Government without prior notice to the Contractor, but notification of the change, including the name and phone number of the successor COTR, will be promptly provided to the Contractor by the Contracting Officer in writing.

The responsibilities and limitations of the COTR are as follows:

• The COTR is responsible for the technical aspects of the project and technical liaison with the Contractor. The COTR is also responsible for the final inspection and acceptance of all reports and such other responsibilities as may be specified in the contract.

• The COTR may designate assistant COTR(s) to act for him/her by naming such assistant in writing and transmitting a copy of such designation through the Contracting Officer to the Contractor.

• The COTR will maintain communications with the Contractor and the Contracting Officer. The COTR must report any observed fraud, waste, or opportunities to improve performance of cost efficiency to the Contracting Officer.

• The COTR will immediately alert the Contracting Officer to any possible Contractor deficiencies or questionable practices so that corrections can be made before the problems become significant.

• The COTR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes which affect the contract’s price, terms or conditions. Any Contractor request for changes shall be referred to the Contracting Officer directly or through the COTR.

No such changes shall be made without the expressed prior authorization of the Contracting Officer.

• The COTR is not authorized to direct the Contractor on how to perform the work.

• The COTR is not authorized to issue stop-work orders. The COTR may recommend the authorization by the Contracting Officer to issue a stop work order, but the Contracting Officer is the only official authorized to issue such order.

• The COTR is not authorized to discuss new proposed efforts or encourage the Contractor to perform additional efforts on an existing contract or order.

7.3 Submission of Invoices

(a) Background: The Transportation Security Administration (TSA) partners with the United States

Coast Guard Finance Center for financial services in support of TSA operations, including the payment of contractor invoices. Therefore, all contractor invoices must be submitted to, and will be paid by, the U.S. Coast Guard Finance Center (FinCen).

(b) Invoice Submission Method: Invoices may be submitted via facsimile, U.S. Mail, or email.

Contractors shall utilize ONLY ONE method per invoice submission. The submission information for each of the methods is as follows in order of preference:

1) Facsimile number is: 757-413-7314

The facsimile number listed above shall be used by contractors for ORIGINAL invoice submission only. If facsimile submission is utilized, contractors shall not submit hard copies of invoices via the U.S. mail. It is the responsibility of the contractor to verify that invoices are received, regardless of the method of submission used. Contractors may inquire regarding the receipt of invoices by contacting the U.S. Coast Guard Finance Center via the methods listed in subparagraph (e) of this clause.

2) U.S. Mail:

United States Coast Guard Finance Center TSA Commercial Invoices P.O. Box 4111 Chesapeake, VA 23327-4111

3) Email Invoices:

FIN-SMB-TSAInvoices@uscg.mil or www.fincen.uscg.mil

(c) Invoice Process: Upon receipt of contractor invoices, FinCen will electronically route invoices to the appropriate TSA Contracting Officer’s Technical Representative and/or Contracting Officer for review and approval. Upon approval, the TSA will electronically route the invoices back to FinCen. Upon receipt of certified invoices from a Authorized Certifying Official, FinCen will initiate payment of the invoices.

Note for discounts offered:

Discounts on invoices. If desired, the Contractor should offer discounts directly upon the invoice submitted, clearly specifying the terms of the discount. Contractors can structure discounted amounts for payment for any time period less than the usual thirty day payment period specified under Prompt Payment requirements; however the Contractor should not structure terms for payment of net amounts invoiced any sooner than the standard period required under FAR Subpart 32.9 regarding prompt payments for the specified deliverables under contract.

Discounts offered after invoice submission. If the Contractor should wish to offer a discount on a specific invoice after its submission for payment, the Contractor should submit a letter to the Finance Center identifying the specific invoice for which a discount is offered and specify the exact terms of the discount offered and what time period the Government should make payment by in order to receive the discount. The Contractor should clearly indicate the contract number, invoice number and date, and the specific terms of the discount offered. Contractors should not structure terms for net amount payments any sooner than the standard period required under FAR Subpart 32.9 regarding prompt payments for the specified deliverables under contract.

(d) Payment Status: Contractors may inquire on the payment status of an invoice by any of the following means:

(1) Via the internet: https://www.fincen.uscg.mil Contacting the FinCen Customer Service Section via telephone at 1-800-564-5504 or (757) 523- 6940 (Voice Option #1). The hours of operation for the Customer Service line are 8:00 AM to mailto:FIN-SMB-TSAInvoices@uscg.mil�

5:00 PM Eastern Time, Monday through Friday. However, the Customer Service line has a voice-mail feature that is available 24 hours per day, 7 days per week.

(2) Via the Payment Inquiry Form: https://www.fincen.uscg.mil/secure/payment.htm

(e) Invoice Elements: Invoices will automatically rejected if the information required in subparagraph (a)(2) of the Prompt Payment Clause, contained in this Section of the Contract, including EFT banking information, Taxpayer Identification Number (TIN), and DUNS number are not included in the invoice. All invoices must be clearly correlate invoiced amounts to the corresponding contract line item number and funding citation. The Contractor shall work with the Government to mutually refine the format, content and method of delivery for all invoice submissions during the performance of the Contract.

(f) Supplemental Invoice Documentation: Contractors shall submit all supplemental invoice documentation (e.g. copies of subcontractor invoices, travel vouchers, etc) necessary to approve an invoice along with the original invoice. The Contractor invoice must contain the information stated in the Prompt Payment Clause in order to be received and processed by FinCen.

Supplemental invoice documentation required for review and approval of invoices may, at the written direction of the Contracting Officer, be submitted directly to either the Contracting Officer, or the Contracting Officer’s Technical Representative. Note for “time-and-material” type contracts: The Contractor must submit the following statement with each invoice for labor hours invoiced under a “time-and-materials” type contract, order, or contract line item: “The Contractor hereby certifies in accordance with paragraph (c) of FAR 52.232-7, that each labor hour has been performed by an employee (prime or subcontractor) who meets the contract’s specified requirements for the labor category invoiced.”

(g) Additional Invoice Preparation Instructions for Software Development and/or Hardware. The

Contractor shall clearly include a separate breakdown (by CLIN) for any software development activities (labor costs, subcontractor costs, etc) in accordance with Federal Accounting Standards Advisory Board Statement of Federal Financial Accounting Standards Number 10 (Preliminary design costs, Development costs and post implementation costs) and cite payment terms. The contractor shall provide make and model descriptions as well as serial numbers for purchases of hardware and software (where applicable.)

SECTION 8 - Special Contract Requirements

8.1 Disclosure of Information

Information furnished by the Contractor under this contract may be subject to disclosure under the Freedom of Information Act (FOIA). Therefore, all items that are confidential to business, or contain trade secrets, proprietary, or personally-identifiable information must be clearly marked.

Any information made available to the Contractor by the Government must be used only for the purpose of carrying out the requirements of this contract and must not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract.

https://www.fincen.uscg.mil/secure/payment.htm�

8.2 Publicity and Dissemination of Contract Information

Publicity releases or commercial advertising in connection with or referring to this contract or effort shall not be made by the Contractor unless prior written approval has been received from the Contracting Officer.

The Contractor shall not publish, permit to be published, or distribute for public consumption, any information, oral or written, concerning the results or conclusions made pursuant to the performance of this contract, without the prior written consent of the Contracting Officer. Two copies of any material proposed to be published or distributed shall be submitted to the Contracting Officer.

A minimum of five full business days’ notice is required for requests made in accordance with this provision.

8.3 Advertising of Award

The contractor shall not refer to contract awards in commercial advertising in such a manner as to state or imply that the product or service provided is endorsed or preferred by the Federal Government or is considered by the Government to be superior to other products or services.

8.4 Major Breach of Safety or Security

(a) Safety is the freedom from those conditions that can cause death, injury, occupational illness, damage to or loss of equipment or property, or damage to the environment. Safety is essential to TSA and compliance with safety standards and practices is a material part of this contract. A major breach of safety may constitute a breach of contract that entitles the Government to exercise any of its rights and remedies applicable to material parts of this agreement, including termination for default. A major breach of safety must be related directly to the work on the agreement. A major breach of safety is an act or omission of the Contractor that consists of an accident, incident, or exposure resulting in a fatality, serious injury, or mission failure; or in damage to equipment or property equal to or greater than $1 million; or in any "willful" or "repeat" violation cited by the Occupational Safety and Health Administration (OSHA) or by a state agency operating under an OSHA approved plan.

(b) Security is the condition of safeguarding against espionage, sabotage, crime (including computer crime), or attack. A major breach of security may constitute a breach of contract that entitles the Government to exercise any of its rights and remedies applicable to material parts of this agreement, including termination for default. A major breach of security may occur on or off Government installations, but must be related directly to the work on the agreement. A major breach of security is an act or omission by the Contractor that results in compromise of classified information or sensitive security information or sensitive but unclassified information, including contractor proprietary information, illegal technology transfer, workplace violence resulting in criminal conviction, sabotage, compromise or denial of information technology services, equipment or property damage from vandalism greater than $250,000, or theft greater than $250,000.

NOTE: Breach of Security for the purposes of this definition should not be confused with breach of security in screening operations.

(c) In the event of a major breach of safety or security, the Contractor shall report the breach to the Contracting Officer. If directed by the Contracting Officer, the Contractor shall conduct its own investigation and report the results to the Government. The Contractor shall cooperate with the Government investigation, if conducted.

8.5 Electronic and Information Technology to Accommodate Users with Disabilities (Section 508 of the Rehabilitation Act) Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology, they must ensure that it is accessible to people with disabilities.

Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All Electronic and Information Technology (EIT) deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable standards have been identified:

36 CFR 1194.21 – Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to Government Off the Shelf (GOTS) and Commercial Off the Shelf (COTS) software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 – Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous JavaScript and XML (AJAX) then “1194.21 Software” standards also apply to fulfill functional performance criteria.

36 CFR 1194.24 – Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

36 CFR 1194.31 – Functional Performance Criteria applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 – Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required “1194.31 Functional Performance Criteria”, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer’s Technical Representative (COTR) and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply:

36 CFR 1194.2(b) – COTS/GOTS products. When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meets some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires approval from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

36 CFR 1194.3(b) – Incidental to Contract. All EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

All tasks for testing of functional and/or technical requirements must include specific testing for Section 508 compliance, and must use DHS Office of Accessible Systems and Technology approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov.

8.6 DHS Enterprise Architecture Compliance

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following :Homeland Security Enterprise Architecture (HLS EA) requirements:

• All developed solutions and requirements shall be compliant with the HLS EA.

BLOCKED::mailto:accessibility@dhs.gov�

• All Information Technology (IT) hardware or software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

• Description information of all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the DHS Enterprise Data Management Office (EDMO) for review and insertion into the DHS Data Reference Model.

• In compliance with Office of Management and Budget (OMB) mandates, all network hardware shall be IPv6 compatible without modification, upgrade, or replacement.

• All IT assets being developed, procured, or acquired shall be IPv6 capable.

• Any provided solution should be fully compliant and operational within the TSA network infrastructure.

• Any provided solution should comply with and be in alignment with the ICAM segment architecture supported by TSA.

8.7 Data, Data Management and Data-Pertinent Information

In addition to the Federal Acquisitions Regulations (FAR) Subpart 27.4 – ‘Rights in Data and Copyrights’ and Section 35.011 detailing technical data delivery, the contractor shall provide all TSA-specific data in a format maintaining pre-existing referential integrity and data constraints, as well as data structures in an understandable format to TSA. Examples of data structures can be defined as, but not limited to:

• Data models depicting entity relationships

• Metadata information to define data definitions

• Detailed data formats, type, and size

• Delineations of the referential integrity (primary key/foreign key) of data schemas

All TSA-specific data shall be delivered in a secure and timely manner to TSA. Data security is defined within the ‘Requirements for Handling Sensitive, Classified, and/or Proprietary Information’, section of this SOW. This definition complies with not only the delivery of data, but also maintaining TSA-specific data within a non-TSA or DHS proprietary system.

Alternative data delivery techniques may also be defined by TSA EDM project team.

As part of the necessary data structure, the contractor shall provide an Entity Relationship Diagram (ERD) to explain the business relationships to TSA through graphically and textually detailing the data that is stored per each database and system/application. The preferred format for the ERD is CA Erwin; however other formats, such as Visio, DLL, database scripts or format specified by TSA EDM project team shall be accepted. All additional known data models (e.g., Logical Data Model (LDM) Conceptual Data Model (CDM), Physical Data Model (PDM), Data Flow Diagrams (DFD)) depicting TSA-specific data are required. Referential integrity also needs to be addressed for all parent/child or primary key/foreign key relationships within these models.

All metadata shall be pre-defined upon delivery to TSA. Metadata shall be delivered in a format that is readily interpretable by TSA (e.g. metadata shall be extracted from any metadata repository that is not utilized by TSA and delivered in a TSA approved manner). Metadata shall also provide an indication of historical verses the most current data to be used, as well as frequency of data refreshes.

The contractor shall adhere to providing a Data Management Plan (DMP), as defined by the TSA Enterprise Data Management (EDM) project team, which includes conceptual and logical data models, along with a data asset profile. Any data exchanges with other DHS Components shall adhere to DHS data exchange standards using the National Information Exchange Model (NIEM). All required artifacts will be provided to the TSA EDM project team.

Note: The following definitions pertain to the previous paragraphs:

An ERD is a diagram used to identify the topics of interest (entities) and their connections to each other (relationships).

An LDM in systems engineering is a representation of an organization’s data, organized in terms of entities and relationships and is independent of any particular data management technology.

‘A CDM is a high-level model that is considered a useful first step in documenting and describing the fundamental nature of the organization’s data. It serves as the foundation for providing a common vocabulary and for understanding the overall structure of data, and for normalizing data access to support improved information sharing. In a CDM, fundamental things of significance to the business organization are represented. A CDM usually includes data objects and the corresponding core relationships in terms of the business user.

A PDM is a representation of a data asset design which takes into account the facilities and constraints of a given database management system (DBMS). It is typically derived from a logical data model, though it may be reverse-engineered from a given database implementation.

The PDM can usually be used to calculate storage estimates and may include specific storage allocation details for a given database system. There is no sharp dividing line between a CDM and an LDM. Similarly, there is no sharp dividing line between an LDM and a PDM. Depending on the developers and their requirements, details may appear in one model or the other. Each model should be constructed down to the level of detail that makes the model useful to the intended audience.’ 1

A DFD is a diagram depicting the flow of data from the source to the target systems, showing all interactions made in between.

1 These definitions have been defined through the ‘DHS Enterprise Data Management – Data Modeling Methodology Guidelines’ found on the DHS Connect DMWG Portal which can be found at http://dhsconnect.dhs.gov/org/comp/mgmt/cio/aot/Pages/DataManagementWorkingGroup.aspx http://dhsconnect.dhs.gov/org/comp/mgmt/cio/aot/Pages/DataManagementWorkingGroup.aspx�

Referential integrity is a database concept that ensures that relationships between tables remain consistent. When one table has a foreign key to another table, the concept of referential integrity states that you may not add a record to the table that contains the foreign key unless there is a corresponding record in the linked table.

8.8 Security Policy and Architecture

All services, hardware and/or software provided under this task order must be compliant with DHS 4300A DHS Sensitive System Policy Directive, DHS 4300A Sensitive Systems Handbook., TSA MD 1400.3 Information Technology Security Policy, TSA IT Security Policy Handbook and Technical Standards.

8.9 Security of Systems Handling Personally Identifiable Information and Privacy Incident Response

(a) Definitions.

“Breach” (may be used interchangeably with “Privacy Incident’) as used in this clause means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, in usable form whether physical or electronic.

“Personally Identifiable Information (PII)” as used in this clause means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States.

Examples of PII include: name, date of birth, mailing address, telephone number, Social Security Number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), Internet protocol addresses, biometric identifiers (e.g., fingerprints), photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Personally Identifiable Information (Sensitive PII)” as used in this clause is a subset of Personally Identifiable Information, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Complete social security numbers (SSN), alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered Sensitive PII even if they are not coupled with additional PII. Additional examples include any groupings of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

Driver’s license number, passport number, or truncated SSN (such as last 4 digits) Date of birth (month, day, and year) Citizenship or immigration status

Financial information such as account numbers or Electronic Funds Transfer Information Medical Information System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other Personally Identifiable information may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains Personally Identifiable Information but it is not sensitive.

(b) Systems Access. Work to be performed under this contract requires the handling of Sensitive PII. The contractor shall provide the Government access to, and information regarding systems the contractor operates on behalf of the Government under this contract, when requested by the Government, as part of its responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent validation testing of controls, system penetration testing by the Government, Federal Information Security Management Act (FISMA) data reviews, and access by agency Inspectors General for its reviews.

(c) Systems Security. In performing its duties related to management, operation, and/or access of systems containing Sensitive PII under this contract, the contractor, its employees and subcontractors shall comply with applicable security requirements described in DHS Sensitive System Publication 4300A or any replacement publication and rules of conduct as described in

TSA MD 3700.4

In addition, use of contractor-owned laptops or other media storage devices to process or store PII is prohibited under this contract until the contractor provides, and the contracting officer in coordination with CISO approves, written certification by the contractor that the following requirements are met:

(1) Laptops employ encryption using a NIST Federal Information Processing Standard (FIPS) 140-2 or successor approved product;

(2) The contractor has developed and implemented a process to ensure that security and other applications software are kept current;

(3) Mobile computing devices utilize anti-viral software and a host-based firewall mechanism;

(4) When no longer needed, all removable media and laptop hard drives shall be processed (i.e., sanitized, degaussed, or destroyed) in accordance with DHS security requirements.

(5) The contractor shall maintain an accurate inventory of devices used in the performance of this contract;

(6) Contractor employee annual training and rules of conduct/behavior shall be developed, conducted/issued, and acknowledged by employees in writing. Training and rules of conduct shall address at minimum:

(i) Authorized and official use;

(ii) Prohibition against use of personally-owned equipment to process, access, or store Sensitive

PII;

Prohibition against access by unauthorized users and unauthorized use by authorized users; and Protection of Sensitive PII;

(7) All Sensitive PII obtained under this contract shall be removed from contractor-owned information technology assets upon termination or expiration of contractor work. Removal must be accomplished in accordance with DHS Sensitive System Publication 4300A, which the contracting officer will provide upon request. Certification of data removal will be performed by the contractor’s Project Manager and written notification confirming certification will be delivered to the contracting officer within 15 days of termination/expiration of contractor work.

(d) Data Security. Contractor shall limit access to the data covered by this clause to those employees and subcontractors who require the information in order to perform their official duties under this contract. The contractor, contractor employees, and subcontractors must physically secure Sensitive PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. When Sensitive PII is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed through means that will make the Sensitive PII irretrievable.

The contractor shall only use Sensitive PII obtained under this contract for purposes of the contract, and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall turn over all Sensitive PII obtained under the contract that is in its possession to the Government.

(e) Breach Response. The contractor agrees that in the event of any actual or suspected breach of Sensitive PII (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), it shall immediately, and in no event later than one hour of discovery, report the breach to the contracting officer, the Contracting Officer’s Technical Representative (COTR), and the TSA Director of Privacy Policy & Compliance (TSAprivacy@dhs.gov). The contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government parties.

(f) Personally Identifiable Information Notification Requirement. The contractor has in place procedures and the capability to promptly notify any individual whose Sensitive PII was, or is reasonably believed to have been, breached, as determined appropriate. The method and content of any notification by the contractor shall be coordinated with, and subject to the prior approval of the Government, based upon a risk-based analysis conducted by the Government in accordance with DHS Privacy incident Handling Guidance. Notification shall not proceed unless the Government has determined that: (1) notification is appropriate; and (2) would not impede a law enforcement investigation or jeopardize national security.

Subject to Government analysis of the breach and the terms of its instructions to the contractor regarding any resulting breach notification, a method of notification may include letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by the Government. At minimum, a notification should include: (1) a brief description of how the breach occurred; (2) a description of the types of personal information involved in the breach; (3) a statement as to whether the information was encrypted or protected by other means;

(4) steps an individual may take to protect themselves; (5) what the agency is doing, if anything, to investigate the breach, to mitigate losses, and to protect against any further breaches; and (6) point of contact information identifying who affected individuals may contact for further information.

In the event that a Sensitive PII breach occurs as a result of the violation of a term of this contract by the contractor or its employees, the contractor shall, as directed by the contracting officer and at no cost to the Government, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected individuals for a period not to exceed 12 months from discovery of the breach. Should the Government elect to provide and/or procure notification or identity protection services in response to a breach, the contractor will be responsible for reimbursing the Government for those expenses.

(g) Pass-Through of Security Requirements to Subcontractors. The contractor agrees to incorporate the substance of this clause, its terms and requirements, in all subcontracts under this contract, and to require written subcontractor acknowledgement of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the contractor.

(h) Encryption. TSA will identify IT systems transmitting unclassified/SSI information that will require protection based on a risk assessment. If encryption is required, the following methods are acceptable for encrypting sensitive information:

FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2. (current version) National Security Agency (NSA) Type 2 or Type 1 encryption. (current version) Public Key Infrastructure (PKI) (see paragraph 5.5.2 of the Department of Homeland Security (DHS) 4300A Sensitive Systems Handbook). (current version)

8.10 Applicable Documents

The contractor will adhere to all established and approved TSA, DHS, and federal procedures, policies, and standards; including, but not limited to, the specific documents listed below:

Version Document Name Date

Version 7.0.1 TSA Information Technology Security Policy Handbook

June 22, 2010

Version 7.2 DHS 4300A Sensitive Systems Handbook June 21, 2010

SECTION 9 - Contract Clauses

9.1– FAR Clauses and Provisions Incorporated by Reference

52.252-2 Clauses Incorporated by Reference (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

http://farsite.hill.af.mil/.

The following clauses are hereby incorporated by reference with full force and effect:

FAR 52.203-3 Gratuities FAR 52.204-7 Central Contractor Registration FAR 52.212-4 Contract Terms and Conditions—Commercial Items (June 2010) FAR 52.217-5 Evaluation of Options FAR 52.217-6 Option for Increased Quantity FAR 52.227-19 Commercial Computer Software License

9.2 – FAR Clauses and Provisions in Full Text

52.204-1 Approval of Contract (Dec 1989)

This contract is subject to the written approval of the Contracting Officer and shall not be binding until so approved.

(End of clause)

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (Jan 2011)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.222-50, Combating Trafficking in Persons (FEB 2009) (22 U.S.C. 7104(g)).

____ Alternate I (AUG 2007) of 52.222-50 (22 U.S.C. 7104(g)).

(2) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(3) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Pub. L. 108-77, 108-78).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

___ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 253g and 10 U.S.C. 2402).

___ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Apr 2010) (Pub. L.

110-252, Title VI, Chapter 1 (41 U.S.C. 251 note)).

http://farsite.hill.af.mil/�

___ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

X (4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract Awards (Jul 2010) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) 52.204-11, American Recovery and Reinvestment Act—Reporting Requirements (Jul 2010) (Pub. L. 111-5).

____(6) 52.209-6, Protecting the Government’ Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Dec 2010) (31 U.S.C. 6101 note).

(Applies to contracts over $30,000). (Not applicable to subcontracts for the acquisition of commercially available off-the-shelf items).

___ (7) 52.219-3, Notice of Total HUBZone Set-Aside or Sole-Source Award (Jan 2011) (15 U.S.C. 657a).

___ (8) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Jan 2011) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

_X_ (9) 52.219-6, Notice of Total Small Business Set-Aside (June 2003) (15 U.S.C.644) ___ (ii) Alternate I (Oct 1995) of 52.219-6.

___ (iii) Alternate II (Mar 2004) of 52.219-6.

___ (11) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C.

644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

__X_ (12) 52.219-8, Utilization of Small Business Concerns (Jan 2011) (15 U.S.C.

637(d)(2) and (3)).

___ (13) (i) 52.219-9, Small Business Subcontracting Plan (Jan 2011) (15 U.S.C. 637

(d)(4).)

___ (ii) Alternate I (Oct 2001) of 52.219-9.

___ (iii) Alternate II (Oct 2001) of 52.219-9.

___ (iv) Alternate III (July 2010) of 52.219-9.

___ (14) 52.219-14, Limitations on Subcontracting (Dec 1996) (15 U.S.C. 637(a)(14)).

___ (15) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C.

637(d)(4)(F)(i)).

___ (16) (i) 52.219-23, Notice of Price Evaluation Adjustment for Small Disadvantaged

Business Concerns (Oct 2008) (10 U.S.C. 2323) (if the offeror elects to waive the adjustment, it shall so indicate in its offer).

___ (ii) Alternate I (June…