Attachment 20J-11 20Self 20Certification 20Matrix 1

HSTS04-11-R-CT2042

Attachment J-11

Self Certification Matrix

This Attachment includes not only the information that offerors must submit with their proposal in Table 1 for self-verifications; but also how offerors should be prepared to demonstration performance characteristics listed in Table 2.

In Table 1, offerors shall provide the information listed in the Self Certification Matrix with their proposal. If no requirement is included the in the Test/Verification Method column, then they should write “Y” if they can meet the performance characteristics . If they cannot meet the performance requirement they should write “N” for no, of no data requirement is specified.

Performance characteristics 91-95 will be verified during the safety review that will take place before testing starts.Table 2, describes the methods that offerors shall be prepared to use to demonstrate the performance characteristics listed at the TSIF.

Table 1: SELF CERTIFICATION MATRIX

Characteristic Number

Paragraph Number

Procurement Specification

Section

Self-Cert

(S) or Demo

(D)

Test / Verification Method

Offeror Certification Meet/Does Not Meet

3 3.1.1 Document

Types S Offeror certifies Y/N.

11 3.2.1 Operator and Passenger Interface

S

Offeror must provide authorized list of users and evidence of successful logins for those users. Then a failed login for an unauthorized user.

12 3.2.1 Operator and Passenger Interface

S Offeror must provide screenshots of TDC and Supervisor user capabilities.

31 3.2.3 Identifications S

Offeror must provide screenshots of 2-D barcodes and/or provide documentation confirming that they are supported.

51 3.2.5 Privacy S

Provide screenshots of write/read throughput, storage capacity, and model number of drive.

87 3.7.1 Operational Environment

S

Offeror shall bring operating range specifications, certifications or other information for component parts.

Paragraph Number

Procurement Specification

Section

Self-Cert

(S) or Demo

(D)

Test / Verification Method

Offeror Certification Meet/Does Not Meet

88 3.7.1 Operational Environment

S Offeror shall bring operating range specifications.

89 3.7.2 Storage

Environment S

90 3.7.2 Storage

Environment S

91 3.8.1 Electrical

Safety S

Documentation of UL certification.

92 3.8.2 Emissions

Safety S

If applicable, obtain third party documentation confirming that emissions are not hazardous.

93 3.8.2

Safety S

Documentation showing compliance with threshold values.

94 3.8.2

Safety S

If applicable, documentation showing compliance with FDA requirements.

95 3.8.2

Safety S

Documentation showing compliance with 47 CRF 15.

101 3.9.2 Hazardous Materials

S MSDS for system or component parts.

102 3.9.2

Materials

S

103 3.9.2

Materials

S

105 3.10.2 Information

Security S

Besides providing a demo, offerors shall also provide a 5pp write up describing how they plan on integrating these standards into their CAT/BPSS systems.

106 3.10.2

Security S

Provide screenshot of a successful reading of a pass and ID that has been encrypted using public-key cryptology and/or public key certificates.

107 3.10.2

Security S

Provide screen shots of expired CRL stored.

108 3.10.2

Security S

Screenshot of a configuration parameter showing that at least 200 public keys and/or certificates can be stored; or documentation confirming that at least 200 can be stored.

110 3.10.2

Security S

Provide a screen shot of a session timeout after a pre-determined period, then a successful re-login.

Paragraph Number

Procurement Specification

Section

Self-Cert

(S) or Demo

(D)

Test / Verification Method

Offeror Certification Meet/Does Not Meet

116 3.10.2 Information

Security S

Provide screen shots showing that IPv4 and IPv6 can be used; screenshot showing that IPv4 is set as default.

Table 2: OFFEROR DEMONSTRATION MATRIX

Paragraph Number

Procurement Specification

Section

Self-Cert

(S) or Demo

(D)

Demonstration Method

1 3.1.1 Document

Types D

Option 1: Offerors find/create an ID not in their database, develop an update, bring the update and associated ID to the TSIF and demonstrate the update.

Option 2: Offerors find/create an ID not in their database, roll back the database to a previous version, allow us to see that the new ID wasn’t recognized, install the current update and verify the ID then works.

17 3.2.1 Operator and Passenger Interface

D Offeror must successfully show that a separate partition is accessible by an Admin/Supervisor for added functionality.

18 3.2.1 Operator and Passenger Interface

D Offeror must successfully integrate custom code and demonstrate that the functionality of the new code works as intended.

37 3.2.4 Boarding Passes

D

Offerors shall demonstrate their system’s encryption algorithms, and PKI capability to the TSIF; They must clearly show that multiple key pairs can be held/used.

43 3.2.5 Privacy D Offeror must show that no PII/or image data can be stored locally for all user levels.

44 3.2.5 Privacy D Offeror must show that no PII/or image data can be transmitted for all user levels.

45 3.2.5 Privacy D Offeror must show that no image of PII and ID data can be saved.

46 3.2.5 Privacy D Offeror must show that any data is stored in encrypted format and during transmission. The encryption must be FIPS 197 compliant.

49 3.2.5 Privacy D

Offeror must provide a list of necessary drivers and services. Then show that all required components have been preinstalled /preconfigured.

Paragraph Number

Procurement Specification

Section

Self-Cert

(S) or Demo

(D)

Demonstration Method

104 3.10.1 Software Access

D

Option 1: Offerors find/create an ID not in their database, develop an update, bring the update and associated ID to the TSIF and demonstrate the update.

Option 2: Offerors find/create an ID not in their database, roll back the database to a previous version, allow us to see that the new ID wasn’t recognized, install the current update and verify the ID then works.

109 3.10.2 Information

Security D

Offeror must go through the TSE IT Security Requirements document with the ISSO and Security Engineer (from IAD).

112 3.10.2 Information

Security D

Offeror must demonstrate a successful upgrade.

113 3.10.2 Information

Security D

Offeror must successfully upgrade without opening unit.

117 3.10.2 Information

Security D

Offeror must successfully update the OS and programs with required patches.

Appendix

B.1

Field Data Reporting System

D Offeror must show that the FDRS data is in appropriate W3C/XML format.

LEGEND 1

Testing / Verification Methods

Remarks

S Self Certify Offeror will self-certify whether or not they meet a requirement or goal.

D Demonstration /

Inspection Offeror will demonstrate, or TSA-designated lab will verify through inspection of equipment

Environment Certification

In accordance with the Environmental requirements established by the Transportation Security

Administration (TSA), (Name of Company) hereby certifies that its CAT/BPSS system can meet the TSA Environmental requirements referenced below. (Name of Company) understands that by certifying their capability, they will be deemed Unacceptable and will not be eligible to continue in the procurement if the certifications are found to not be met during testing.

Environmental Requirement Vendor

Certification:

Yes/No Operational Environment: between 0° Celsius and 32°

Celsius and 10% to 80% relative non-condensing humidity

Storage Environment: CAT/BPSS and any related consumables be capable of storage between −7 °C and 49

°C and 10% to 90% relative, non-condensing humidity

(Name of Company)

By: _________________________________

__________________________[print title]

_________________________[print name]