APSS_T-BAA_Window_1-_CT.pdf

Accessible Property Screening System Targeted Broad Agency Announcement (BAA)

HSTS04-17-R-BAA226

Window 1- Computed Tomography (CT)

1.0 Background

The Transportation Security Administration (TSA), Office of Requirements and Capabilities Analysis (ORCA) is opening Window 1 and requesting submissions for mature Computed Tomography (CT) based systems (“prototypes”) that provide the operator with a 3D view of scanned images to assist with the detection of explosive and prohibited item threats under the Accessible Property Screening System (APSS) Targeted Broad Agency Announcement (T-BAA) HSTS04-17-R-BAA226. The T-BAA contains multiple “Tasks”, but, TSA is only currently interested in submissions for the following tasks under this Window: X-Ray Equipment Development and Design - Mature CT based systems, Prototype Build and Test, Stream of Commerce Data Collection at Airports, CT and Automated Screening Lane Design and Integration, and Common Graphical User Interface.

This document is supporting a T-BAA as contemplated under Federal Acquisition Regulation (FAR) 6.102(d)(2) and 35.016. Contracts based on responses to this T-BAA are considered to be the result of full and open competition and in full compliance with the provisions of Public Law (PL) 98-369, “The Competition in Contracting Act of 1984.”

TSA will not issue paper copies of this announcement. TSA reserves the right to select for award and fund all, some, or none of the submissions received in response to this Window. TSA will not provide funding or reimbursement for proposal development costs. Full submissions or any other material submitted in response to this T-BAA will not be returned. All submissions shall be unclassified.

2.0 Statement of Work

2.1 Opportunity Description

The emergence of improvised explosive threats and their use by terrorists has placed many challenges on the aviation security screening layers. Due to these emerging threats, TSA is interested in further maturing CT based systems for the checkpoint that have a 3D display. As a result, TSA is opening Window 1 for the T-BAA for CT based systems that are capable of providing multiple image slices for the display of 3-dimensional views of scanned objects and can be used at the Aviation Security Checkpoints for tasks outlined in this window.

The following table outlines the tasks associated with Window 1:

CLIN TITLE TYPE UNIT QTY

0001 Project Support FFP LOT 1 0002 Prototype Checkpoint CT Based System FFP EA 3 0002A Optional Prototype Checkpoint CT Based System FFP EA 5 0003 Detection Algorithm Development T&M LOT 1 0004 Stream of Commerce Data Collection FFP LOT 1

0005 Automated Screening Lane Integrated or Ingress/Egress Integrated FFP EA 2

0005A Optional CLIN for Automated Screening Lane Integrated or Ingress/Egress Integrated FFP EA 5

0006 Common Graphical User Interface Integration Support FFP LOT 1 0007 Emulator FFP EA 6 0008 Prototype Installation and Support T&M NTE 1 0008A Optional Prototype Installation and Support T&M NTE 1 *Final quantities for all FFP CLINs may differ from the table above. All final quantities will be agreed upon by both parties prior to award.

*For all optional CLINs, the Government reserves the right to partially exercise and re-state quantities of CLINs.

2.2 Applicable Documents

The following specifications, handbooks, orders, standards, and drawings form a part of this SOW and are applicable to the extent specified herein. The latest version of these documents as of the contract date shall apply, unless a specific date for the document is specified below.

Reference Document Location

DD Form 254 Contract Security Classification Specification http://www.dtic.mil/whs/directives

49 CFR Parts 15 and 1520

Protection of Sensitive Security Information http://ecfr.gpoaccess.gov

Department of Homeland Security

Safeguarding Sensitive But Unclassified (For Official Use Only) Information http://www.dhs.gov/xfoia/gc_1254501589 035.shtm http://www.dtic.mil/whs/directives http://ecfr.gpoaccess.gov/ http://www.dhs.gov/xfoia/gc_1254501589035.shtm http://www.dhs.gov/xfoia/gc_1254501589035.shtm

(DHS)

Management Directive

(MD) 11042.1

DHS MD

11044

Protection of Classified National Security Information Classification Management http://www.dhs.gov/xfoia/gc_1254501589 035.shtm

DHS SCG

TSA-002

July 2, 2014

DHS Explosives Detection Systems Information and Data, Security Classification Guide

Available upon request

OST-

Configuration Management Plan (Rev D)

Transportation Security Administration Office of Security Technology Configuration Management Plan, 14 June 2011

Available upon request

OSC

Configuration Management Guidance Version 1

TSA Configuration Management Guidance, 30 Jun

Available upon request

29 CFR, Part 1910.1096

January 1, Occupational Safety and Health Standards: Ionizing Radiation, Available upon request

29 CFR, Part 1910.97

Occupational Safety and Health Standards:

Nonionizing Radiation

Available upon request

(ANSI/HPS)

N43.17-2009

August 2009

American National Standard Radiation Safety for Personnel Security Screening Systems Using X- Ray or Gamma Radiation

Available upon request

Title 21 CFR 1002.20

Reporting of accidental radiation occurrences

Available upon request

IEEE C95.1-

Safety Levels with Respect to Human Exposure to Radio Frequency Electromagnetic

Available upon request http://www.dhs.gov/xfoia/gc_1254501589035.shtm http://www.dhs.gov/xfoia/gc_1254501589035.shtm http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=1002.20

Fields, 3 KHz to 300 GHz, revision of C95.1-1991 (Active)

ICNIRP

Guideline

April 1998

Guidelines for Limiting Exposure to Time-Varying Electric, Magnetic, and Electromagnetic Fields (Up to 300 GHz) Health Physics 74 (4): 494-522

Available upon request

Title 21 CFR 1003.10

Discovery of defect or failure of compliance by manufacturer; notice requirements.

Available upon request

Title 21 CFR 1020.40

Cabinet x-ray systems Available upon request

Cybersecurity Requirements

Outline Summary of Cybersecurity Requirements for TSE Vendors

Available upon request

IA

Requirements for TSA Government Acquisitions

Baseline Cybersecurity Requirements for Transportation Security Equipment, 7 Jan 2015 version 1.0

Available upon request

2.3 General Requirements

The supplies and services described herein shall be performed in accordance with this SOW.

Any subsequent tasks under Accessible Property Screening System (APSS) Targeted Broad Agency Announcement (T-BAA) HSTS04-17-R-BAA226 will be announced by TSA under a separate APSS Window.

Where specific sections are referenced in this SOW, it is intended to also include all subordinate sections. The Contractor shall perform in accordance with deliverables that pertain to this SOW and as approved by the Government. All references to the “Government” in this SOW shall mean “by authority of the Contracting Officer (CO) or designee.” All digital media submitted to the Government in response to this SOW shall be compatible with the Microsoft Office suite of products. Acceptable digital media format includes email, TSA approved secured external drives, Compact Disc-Read Only Memory (CD-ROM) or DVD. The CO may direct the contractor to submit deliverables in another suitable format as needed.

Any documents containing SSI as defined in 49 CFR Parts 15 and 1520 shall contain the following statement:

“WARNING: This record contains Sensitive Security Information that is controlled under 49 CFR Parts 15 and 1520. No part of this record may be disclosed to persons without a “need to know”, as defined in 49 CFR Parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. Government agencies, public disclosure is governed by 5 U.S.C. 552 and 49 CFR Parts 15 and 1520.”

3 Project Support (CLIN 0001)

The Contractor shall establish and maintain a formal organization to manage the requirements in this SOW. The Contractor shall develop and implement a Management Program to efficiently and effectively execute the requirements of this SOW.

3.1 Project Management

The Contractor shall be responsible for project management throughout the entire project period of performance. The Contractor shall provide all labor, materials, planning, managing, and the equipment necessary to complete the installation, integration, and testing requirements in accordance with all applicable State and Federal codes and laws. The Contractor shall be responsible for identifying and obtaining all required and necessary badges needed to accomplish installation requirements throughout all associated project phases and for all required labor personnel.

3.2 Project Manager

The Contractor shall identify a Project Manager who shall be the Contractor’s focal point for all required security technology related project tasks. The Contractor’s Project Manager shall be prepared at all times to present and discuss the status of contract activities, risk management, quality, performance, requirements, and issues. The Project Manager shall notify the COR of all performance cost, financial, personnel, and security problems that, if unresolved, may adversely affect the Contractor’s performance, schedule, or costs related to the Contract. The Contractor shall take appropriate measures to mitigate any adverse impact(s) to the Contract.

The Contractor’s Project Manager shall be responsible for accomplishment of all tasks required by this SOW and shall engage all organizational functions required for Project Management, including preparation and delivery of all deliverables. CLIN 0001 shall include all labor, materials, and other direct costs necessary to meet requirements specified in this SOW. The Contractor's

Project Manager shall be prepared at all times to present and discuss the status of Contract activities, requirements, and issues.

The Project Management Plan shall be delivered within 60 days after award. The Contractor’s Project Manager at minimum shall have the following qualifications:

• Program Management Institute (PMI) certified or equivalent (e.g., DHS Certified Acquisition Professional, Level II; Defense Acquisition University (DAU); DoD Certified Project Manager;

• Seven (7) years of technical experience in a field related to transportation security;

• Additional five (5) years of experience in managing technical projects

3.3 Technical Lead

The Contractor shall be fully responsible for the integration and coordination of the work described in the SOW. A Technical Lead shall be assigned for this contract and serve as the technical Subject Matter Expert (SME) within the Contractor’s activity for all technical aspects.

The Contractor’s Technical Lead shall be ready at all times, given reasonable notice, to present and discuss with the Contracting Officer’s Representative (COR) the status of all technical requirements and problems.

3.3.1 System Engineering Management

The Contractor shall implement a System Engineering Management for the definition, development, verification, integration, and testing of the prototype requirements as allocated to both the Computer Software Configuration Items and Hardware Configuration Items. System engineering efforts shall include all aspects of performance, quality, life cycle costs, maintainability, reliability, schedule, data processing reserves, and future growth requirements.

The System Engineering Management shall be described in the PMP which is due 60 days after award. The description shall include both hardware and software engineering management with plans for acquiring, testing, and integrating the required hardware and software, including firmware, to meet SOW requirements.

To ensure that cost, performance, and schedule requirements are met, to provide early detection and resolution of problems, and to reduce technical risk, the Contractor shall maintain effective control over the system engineering process, including Subcontract items and services. The Contractor shall specify a primary point of contact for system engineering issues in the PMP.

3.3.2 Project Risk Management

The Contractor shall identify cost, schedule, and technical risks, and describe how it will effectively manage these risks throughout the performance of this SOW.

The Contractor shall identify risks and assign a priority for developing a recommended course of action. The Contractor shall develop and maintain a list identifying, analyzing, and classifying project risks. Project risks shall be classified as low, medium, or high priority and include supplier risks. The Contractor shall conduct risk mitigation and contingency planning for risks considered medium or high priority. The Contractor shall quantify risks with respect to their impact on integration, installation, performance, technical parameters, schedule, cost, manufacturing, and maintainability of existing prototype fleet.

All 3.3.2 requirements shall be included in the PMP.

3.3.3 Security Program Plan (SPP)

The Contractor shall implement and maintain a Security Program. Hardware or software configuration changes shall be in accordance with the TSA configuration management Policy and TSA Enterprise and Security Architecture standards. The TSA Chief Information Officer (CIO) or IT Security must be informed of and involved in all configuration changes to the TSA IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The Contractor shall comply with requests to be audited and support audit activities (such as requests for system access for penetration testing, vulnerability scanning, incident response, forensic response, etc.).

The SPP shall address all requirements and document stated in the following documents (Attachment B) due no later than 60 days after award:

• Accessibility Requirements (Section 508)

• DHS Cyber Hygiene Clause TSA Privacy March 2016

• DHS and TSA Enterprise Architecture Compliance

3.3.4 Requirements Management

The Contractor shall document and manage all of the prototype requirements. The Contractor shall include requirements traceability in all design and test documents. The methodology shall be provided to the Government as part of the PMP.

All traceability information shall be maintained in a manner that allows for a historical reference.

The government reserve the right to request evidence or documentation to show compliance during the life of the contract.

3.4 Project Status Reporting

The Contractor shall attend a weekly Project Status Reporting via teleconference at which they will provide updates pertaining to activities that will impact the current period of performance, ceiling, algorithm document, required testing or training activities, equipment installation and deinstallation activities, associated Contractor driven schedules, and equipment movement and logistics activities, and any other project-related activity.

3.5 Post Award Conference

A post-award conference will be conducted at a site specified by the Government, within ten (10) calendar days after award. The TSA will designate Government conference attendees and will identify any unique conference support requirements. The Government will develop an agenda and the Contractor shall provide the minutes for the conference within 2 days after the conference.

During the post award conference, the Contractor shall be prepared to address, at a minimum, a review and status of the following topics:

• Deliverable submission status and projected schedule;

• Invoicing procedures;

• Project milestones;

• Organizational status;

• Cost, schedule, and performance (technical) aspects of the SOW;

• Quality elements;

• Subcontractor's technical progress on all assigned tasks; and

• Lines of communication.

3.6 General Acceptance Test Requirements

The Contractor shall:

a. Plan and conduct Contractor tests,

b. Support Government-conducted testing and continuous assessment, and

c. Prepare and deliver all test plans, procedures, and report deliverables for each prototype as required.

The Contractor's responsibilities for the acceptance test program shall include the following activities:

a. Provide and maintain a single point of contact for the Acceptance Test Team Lead

Program. The single point of contact shall deliver and/or receive all acceptance test reports and schedules to the Government as required. The single point of contact for the Acceptance Test Team Lead shall be responsible for coordinating all test activities and shall relay pertinent reports and schedules to the site specific project managers and internal Contractor stakeholders as required. The single point of contact for the Acceptance Test Team Lead shall participate in all Technical Interchange Meetings (TIMs) and evaluation of all testing criteria.

b. Conduct, or support the Government in conducting, a Test Readiness Notification (TRN) and Test Readiness Review (TRR) prior to performing any formal test.

c. Notify the Government at least ten (10) business days prior to commencement of all formal Contractor conducted Acceptance Testing, and permit the Government to witness the test.

d. Perform all data reduction associated with Contractor testing, and furnish analysis methods and results to support claims of T&E success. If requested by the Government, provide within fifteen (15) days after the completion of a Government-directed and Contractor-conducted test, copies of all original data collected during the Contractor-conducted test implemented under Preventative Maintenance services.

The Contractor shall provide the necessary test equipment and shall ensure its availability, proper calibration, fully operational status, and operation as documented by the test equipment manufacturer. The Contractor shall obtain prior written approval from the Government before using unique or modified commercial test equipment not specified in the approved test plans and procedures. In the event of test equipment failure, test equipment damage, or faulty operation, the Government may require the Contractor to verify calibration of any test equipment provided by the Contractor.

The Contractor shall record all inputs, outputs, and test results as described in the approved acceptance test procedures. Anomalies, test deviations, test equipment substitutions, members of the test team, any other significant events, and the start and stop time for each test shall be documented in the Contractor's test log book.

3.6.1 Test Readiness Notification and Review

3.6.1.1 Test Readiness Notification

The Test Readiness Notification (TRN) is a notification from the Contractor to the Government stating that the equipment specified therein will be ready for testing on the specified date. The Contractor shall provide the Government a TRN at least ten (10) business days prior to the conduct of each formal test. A formal test includes any test that the Government deems as formal and demonstrates equipment operational capabilities to verify machine functionality, including but not limited to Factory Acceptance Test (FAT) or Site Acceptance Test (SAT). This TRN shall be submitted via email to the Government Independent Verification and Validation (IV&V) contracted representative, the Government COR, and any other representative as designated by the Contracting Officer.

The TRN shall include, but not be limited to the following:

a. Contract number;

b. Serial number of the unit(s) to be tested;

c. Type of test to be conducted;

d. Open test anomalies observed to date;

e. Open ECP(s), RFD(s), RFW(s) or deviations;

f. Test procedure status (version—date);

g. System configuration (i.e., stand-alone, fully integrated, exit-integrated) and part numbers of critical components as identified in the MCIL;

h. Software version;

i. Affirmation that the system will be ready for testing; and

j. Comments.

3.6.1.2 Test Readiness Review (TRR)

The TRR is a formal review of the Contractor’s equipment, as specified in the TRN, and related documentation to verify readiness for test. The Contractor shall conduct a TRR and submit to the Government and designated Government representative at least seven (7) business days prior to the conduct of each formal test and shall include the following information. The Contractor shall deliver the TRR report to the TSA COR.

In the event that the Contractor presents equipment to the Government or designated Government representative without the aforementioned documentation or on account of preventable failures, the Government reserves the right to request the Original Equipment Manufacturer (OEM) to provide additional IV&V testing at no additional cost to the Government.

3.6.2 Acceptance Testing

3.6.2.1 Factory Acceptance Test (FAT) Plans

The Contractor shall prepare and submit a FAT Plans describes methods for testing, evaluating, and accepting the prototypes at the Contractor facility prior to shipment. The FAT Plans shall define the range of tests, system initialization requirements, input data, expected output, and the criteria for evaluating test results. The Contractor shall identify schedules and all test and evaluation resources required, including personnel, equipment, and facility. All FAT schedules must be arranged with TSA or the TSA contractor representative through the use of the TRN that generally lists: the prospective dates of FAT, number of units, location, and Point of Contacts (POCs). The Contractor shall identify all mitigation plans and procedures in the case of failed testing events. The Contractor shall prepare and deliver the FAT Plan within 30 days after award. A FAT plan must be approved prior to any FAT.

3.6.2.2 Factory Acceptance Test (FAT) Procedures

The Contractor shall prepare and submit FAT Procedures. The Contractor shall perform the approved FAT Procedures for each FAT within 30 days after contract award. The Contractor shall ensure that the test procedures indicate traceable paths to the approved Contractor requirements traceability matrix. The Contractor shall deliver the FAT Procedures within 30 days after award and before conducting any FAT.

3.6.2.3 Factory Acceptance Test (FAT) Reports

The Contractor shall perform a FAT for each prototype at the production facility using TSA approved FAT plans, procedures, reports, and Contractor or TSA provided test articles (when needed). The Contractor shall ensure that the test procedures indicate traceable paths to the approved Contractor requirements traceability matrix. In the event that any requirement does not pass, the Contractor shall be given 24 hours to diagnose and correct failures prior to the submission of a failed Quick Look Report (QLR) to TSA. The Government shall only take ownership of the equipment upon successful completion of FAT. The Contractor shall prepare FAT Report at the conclusion of each test no later than 2 weeks after each test.

3.7 Test and Evaluation Planning

The Contractor shall support Government testing of prototype units and prepare the following test plans and procedures for Government approval in advance of initiating the test program.

These plans and procedures shall be designed to ensure the tests are capable of being repeated with substantially similar results. Each plan shall include a detailed schedule for conducting the test. The plan or procedure shall identify specification and lower-level derived requirements to be verified by the test, with general descriptions of methods to be used for verification due within 60 days after award. The Contractor Verification Requirements Traceability Matrix (VRTM) shall be included in each test plan or procedure and list each specification and lower-level derived requirement to be verified in that test with a reference to the appropriate requirement paragraph including test location and test method.

3.7.1 Site Surveys and Test Planning:

The Contractor shall attend and participate in on-site planning meetings, and site surveys at the designated test sites and provide all test site planning documentation to include site planning guides, installation and operational manuals.

3.8 Testing and Operational Assessment

The Contractor shall support Government-conducted test events at Transportation Security Laboratory (TSL) and/or with representative field operators in the intended operational environment at an Operational Assessment (OA) when directed by the Government.

The Government will conduct laboratory testing and/or OA on prototypes, to include various prototype configurations and system components, to assess operational effectiveness and suitability of the prototypes and/or any proposed system modifications. The level of testing effort will be determined by the Government. The Contractor shall support the Government’s operational testing by providing at a minimum the following support:

a. Attend and participate in on-site planning meetings, and site surveys at the designated test sites and provide all test site planning documentation to include site planning guides, installation and operational manuals

b. Configuration Baseline: The Government or its contracted representative will conduct a baseline configuration audit and establish a pre-test baseline in conjunction with the Contractor. The Contractor shall support the Government’s configuration baseline audit with engineering support and allow access to or copies of all documentation and drawings requested by the auditors. The Contractor shall provide results to contracted representatives designated by the Government.

c. Support for site design and system integration, as well as system installation, reconfiguration, and/or SAT on operational test units. The Government, or its contracted representatives, will monitor SAT as required, and accept the unit on behalf of the Government.

d. The Contractor shall conduct Operator Training as directed by the Government.

e. The Contractor shall provide on-site technical support.

f. Support for configuration management activities as required.

g. Preventive and corrective maintenance support over the test period; and until final restoration is completed at the test bed sites (as required).

h. Delivery of system documentation, including operator manuals, "cut sheets," and installation guides.

i. Assistance with all data collection as directed by the Government to include interpretation/analysis of Field Data Reporting System (FDRS) data.

3.9 Configuration Management Requirements

The Contractor is responsible for meeting configuration control requirements from contract award until warranty expires. The Contractor shall establish, implement, and maintain a Configuration Management Program based on the requirements of this SOW. Additional guidance may be found in TSA Configuration Management Guidance. The Contractor shall establish and maintain the configuration baseline for the prototype configuration and establish and maintain the required documentation to support this configuration, referred to as the Developmental Baseline (DBL). The Contractor shall retain all documentation for identification, control and status accounting of any Configuration Item (CI) throughout the program life cycle.

The CI identification shall be available in a Master Configuration Item List (MCIL) which shall be delivered within 30 days after award. All system CIs and top level hardware and software CIs shall be uniquely identified. The Contractor shall prepare and deliver the prototype Master Configuration Item List. The Contractor shall apply configuration change management measures to each baseline CI and its configuration documentation. The Contractor’s configuration change management system shall provide effective means, as applicable, for proposing changes to CIs and ensuring implementation of the approved change. The Contractor shall maintain configuration change management of hardware; software; firmware; and developmental, commercial, and training documentation. The Contractor shall maintain configuration change management of hardware to the Lowest Replaceable Unit (LRU) level and software to the version level.

Changes represent opportunities for improvement or correction of deficiencies. Desired changes are documented in Requests for Change (RFC) in the form of Engineering Change Proposals (ECPs), Requests for Deviation (RFDs), and Requests for Waiver (RFWs), which are uniquely identified. All change requests are entered, tracked, controlled, and documented.

ECPs are requests to incorporate a permanent change to product configuration, which produces a new baseline. RFDs are requests to temporarily incorporate a known departure from product requirements. Authorized deviations are a temporary departure from requirements and do not constitute a permanent change. RFDs must state actions to be taken at the end of the temporary deviation (e.g. restoration to original configuration). RFWs are requests to incorporate a known departure from product requirements. Authorized waivers are for specific quantities of product and do not constitute a change to the baseline configuration or its documentation.

The Contractor shall deliver configuration control data submittals electronically as directed using the following formats on an as required basis:

• ECP DD FORM 1692, AUG 96 (EG), Pages 1-7 as applicable, and

• RFD/RFW: DD FORM 1694, AUG 96 (EG).

3.9.1 Configuration Status Accounting

The Contractor shall maintain a Configuration Status Accounting (CSA) Information System to assure accurate identification of each CI as a monthly Configuration Status Accounting Report (CSAR) to the Government monthly and shall include prototypes purchased and managed from this contract.

3.9.2 Functional Configuration Audit (FCA)

The Contractor shall support Government-conducted FCA on the prototypes. The FCA shall verify system functional performance requirements. Upon successful completion of the FCA, a Physical Configuration Audit (PCA) will be performed.

3.9.3 Physical Configuration Audit (PCA)

The Contractor shall support Government-conducted PCA on the prototypes. The PCA shall be conducted after successful completion of the FCA. The PCA shall verify system physical performance requirements. Successful completion of the PCA shall include, but not be limited to, successful conclusion of FCA.

3.10 Warranty Implementation Plan

Coverage provided by the Contractor will be for all preventive and corrective maintenance, and responsiveness shall be sufficient to meet the minimum maintenance requirements as specified herein respectively. The Contractor shall prepare and deliver a Warranty Implementation plan within 60 days after award.

3.11 Parts Obsolescence Management Program

The Contractor shall establish and implement a parts obsolescence program. The Contractor shall be responsible for the identification, resolution, and implementation for all Diminishing Manufacturing Sources (DMS), Obsolescence, and Sustainment issues associated with the repair of TSE. The Contractor shall document procedures for identifying and controlling DMS and obsolescent technologies in a Parts Obsolescence Management Plan. The Contractor shall submit a Parts Obsolescence Report that includes identification of obsolete parts, problem resolution, and a recommended approach for mitigating risks associated with obsolete parts over the life of the systems. Changes considered necessary by the Contractor to ensure the continued repair of the TSE shall be made in accordance with the Configuration Management procedures (RFD, RFW, and ECP). The Contractor shall prepare and deliver a Parts Obsolescence Management Plan as part of the PMP.

3.12 Logistics Support Service Level Requirements

For Units under warranty, the Contractor shall provide Logistics Support services for fielded TSE and Network prototypes (servers, software and hardware components) to meet the following Operational Availability Service Level Agreement (SLA) requirements:

Values Operational Availability During Airport Operating Hours

Service Level Agreement Required Ao

Airport Level SLA1 98% Machine Level SLA2 96%

The Contractor shall include only installed units that are expected to be operational in its calculations of Ao.

Ao - The percentage of time, during operational hours, that a security equipment technology is available to perform its required mission. (Uptime/Total Operational Time)

Uptime - The period of time a system is available to perform its required mission during operational hours. The natural cycle of uptime occurs during operational hours.

Operational Time - Period of time within 24-hour day that an airport is operational. Security equipment is required to be available to perform its required mission during operational hours.

3.13 Transportation Security Equipment Maintenance Database

The Contractor shall establish and maintain a TSE maintenance database which:

• Includes the entire inventory of fielded TSE maintained under this SOW and which will be the basis for computation of performance metrics;

• Uniquely identifies each TSE by model and serial number;

• Includes information on all accumulating preventive and corrective maintenance actions;

• Includes Preventive Maintenance (PM) start time (at the machine) and stop time (when the FST is finished) for every unit so TSA can monitor the average PM duration time;

• Includes maintenance metrics data and provides the full maintenance and performance history;

• Will reflect all time values reported in local airport location time;

• Will provide Government access to all data collected;

• Will provide a database summary report that itemizes data errors and calculation corrections made by the Contractor to achieve maintenance statistics;

• Will provide Government personnel upon request detailed maintenance actions on work order tickets; and

• Will ensure FMI codes are in a standard format and used in a consistent manner.

3.13.1 Failure Mode Identifier (FMI)

The Contractor shall create or develop FMI codes. The Contractor shall capture the FMI codes in the TSE Performance Database. One or more FMIs will be assigned for each corrective maintenance action. The FMI shall identify the failure cause; sub-system part(s) consumed in the repair; and detailed resolution or action code(s) that would restore the TSE to operational condition. The Contractor shall submit the proposed FMI codes to the Government within 60 days after award for approval prior to implementation. The Contractor shall ensure only the approved FMI codes are used in maintenance reporting. The Contractor shall supply TSA Service Response Center (TSRC) with a list of standardized problem codes, definitions, and priority ratings for trouble ticket generation and apply the codes in a consistent manner.

3.14 Waste Disposal

The Contractor shall be responsible for the proper disposal of any and all equipment or components removed during preventive and corrective maintenance. With the exception of accountable property with a TSA property bar code, all replaced parts that have been removed from the equipment shall become property of the Contractor and the Contractor shall be responsible for removing said parts from the site. The Contractor shall be responsible for all labor, materials, equipment, and coordination of logistics activities to load, transport, and offload waste materials. The waste materials shall be properly packaged, crated, and prepared for shipment. The Contractor shall, when practicable, take full advantage of reuse, reutilize, and recycle options as the first method of disposition or disposal. The Contractor shall be responsible for proper disposal of any and all hazardous waste in accordance with and as defined by 40 CFR Parts 260, 261, and 263. The Government reserves the right to direct the Contractor to an alternate disposition of removed equipment and components. The contractor shall request disposition of accountable property from the Government Property Manager (GPM).

3.15 Security Requirements

3.15.1 DD-254

Contractor shall develop, apply, and maintain effective security practices for classified contracts in accordance with FAR 52.204-2, Security Requirements, incorporated in full text under Section I of this contract.

3.15.2 Security Practices

The Contractor shall develop, apply, and maintain effective security practices in accordance with the requirements contained in the following documents:

• Protection of Sensitive Security Information, 49 CFR Parts 15 and 1520

• Contract Security Classification Specification, DD Form 254

• Safeguarding Sensitive But Unclassified (For Official Use Only) Information, DHS

MD11042.1

• Protection of Classified National Security Information Classification Management, DHSMD 11044

• Department of Homeland Security, Explosives Detection Systems Information and

Data, Security Classification Guide, July 2, 2014.

The Contractor shall prepare and deliver the Facility Security Certificate in accordance with the referenced deliverables within 30 days after award.

3.15.3 Contract Security Classification Specification at the Secret Security Clearance

This SOW requires that the Contractor have access to:

a) Classified information up to SECRET.

b) For Official Use Only

c) Other - Sensitive Security Information (SSI) in accordance with 49 CFR, Part 1520

In performing this SOW, the Contractor will:

a) Receive and generate SECRET classified materials including, but not limited to, TSA

APSS Detection Standard Version 6.0

The Contractor must request written Government approval prior to release of any information text, images or video associated with this SOW.

The Contractor shall document all incidents through the Physical and Communications Security Breach/Incident Report. The Contractor shall notify the COR of such incidents, which include:

1. Actual or suspected unauthorized attempts to penetrate a prototype through the remote workstation or remote functions;

2. Actual or suspected unauthorized attempts to penetrate the prototype through the contractor’s remote maintenance monitoring facility or contractor’s support facility;

3. Actual or suspected unauthorized penetration of the contractor’s prototype support facility or remote maintenance monitoring facility(ies); and

4. Actual or suspected attempt to subvert the prototype.

The Contractor shall prepare and deliver Physical and Communications Security Breach/Incident Reports in accordance with the following referenced deliverable as necessary:

Deliverable: Physical and Communications Security Breach/Incident Report (as required within 24 hours of an incident)

Deliverable: Contractor Information Worksheet (due within 15 days after award)

3.15.4 Use and Sensitivity of Records

All TSA and other Government forms, records, reports, and data to which Contractor personnel shall have access are the property of TSA and are to be used solely for performing the work described in this SOW. Contractor personnel shall not use, disclose, or retain any materials except as described in this SOW or as directed by the Contracting Officer’s Representative (COR).

3.15.5 Security and Privacy

When required, database firewalls and protections shall conform to Federal Information Security standards regarding access and protection of classified information.

Any TSA information made available or to which access is provided, and which is marked or shall be marked “Official Use Only,” shall be used only for the purpose of carrying out the provisions of this SOW and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the SOW. Disclosure to anyone other than an officer or employee of the Contractor or subcontractor at any tier shall require prior written approval of the TSA. Requests to make such disclosure should be addressed to the TSA Contracting Officer.

Each Officer or employee of the Contractor or subcontractor at any tier to whom “Official Use Only” information may be made available or disclosed shall be notified in writing by the Contractor that “Official Use Only” information disclosed to such officer or employee can be used only for the purpose and to the extent authorized herein, and that further disclosure of any such “Official Use Only” information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C.

Sections 641 and 3571. Section 641 of 18 U.S.C. provides, in pertinent part, that whoever knowingly converts to his use or the use of another, or without authority sells, conveys, or disposes of any record of the United States or whoever receives the same with the intent to convert it to his use or gain, knowing it to have been converted, shall be guilty of a crime punishable by a fine or imprisonment of up to ten (10) years or both.

TSA Security Policies shall be adhered to for development of all applications, databases, and data integrity. Additionally, the Contractor must satisfy requirements to work with and safeguard SSI. All support personnel must understand and rigorously follow the DHS and TSA requirements, policies, and procedures for safeguarding SSI. The following policy publications and directives apply:

• National Industrial Security Program;

• Industrial Security Program;

• Protection of Sensitive Security Information;

• Personnel Security Program; and

• Sensitive Security Information (SSI)

These publications shall be adhered to in support of Media Protection, Access Control, Auditing, Network Security, Rules of Behavior, Personnel Security, Physical Security, Training and Awareness, Security Incident Reporting, Contingency Planning, Security Review and Reporting, and Contract Close Out.

3.15.6 Data Security

The Contractor shall be responsible for the security of all data generated by the Contractor on behalf of TSA, TSA data transmitted by the Contractor, and TSA data otherwise stored or processed by the Contractor, regardless of who owns or controls the underlying systems while those data are under the Contractor’s control. All TSA data, including but not limited to Personally Identifiable Information (PII), SSI, Sensitive But Unclassified (SBU), and Critical Infrastructure Information (CII), shall be protected according to DHS and TSA security policies and mandates.

At the expiration of the Contract, the Contractor shall return all TSA information and IT resources provided to the Contractor during the Contract and provide a certification that all assets containing or used to process TSA information have been sanitized or destroyed in accordance with TSA security policy. The Contractor will certify in writing that sanitization and/or destruction has been performed on an as required basis.

3.15.7 Security Policy

The Contractor shall ensure that its employees follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, good business practices, and the specifications, directives, and manuals for conducting work to generate the products as required by this Contract. Personnel will be responsible for the physical security of their area and GFE issued to them under the provisions of the SOW.

The Government will require security clearances up to SECRET for personnel who need access to the Classified material.

Each site may have different security requirements. The Contractor shall coordinate in advance with all sites to ensure all Contractor personnel are familiar with and comply with the security requirements. Work delays that are caused by Contractor personnel security issues will be considered inexcusable delays in performance.

3.15.8 Non-Disclosure Agreements

All TSA Contractors and consultants must execute a DHS Form 11000-6, Sensitive but Unclassified Information Non-Disclosure Agreement (NDA), upon initial assignment to TSA and before being provided access to TSA “sensitive and/or mission critical information.” The original NDA will be provided to the TSA COR within 15 days after award for retention for the duration of the Contract.

3.16 Reliability, Maintainability, Availability Metrics

The Contractor shall prepare and deliver a RMA metrics report monthly to the COR via email in a PowerPoint or pdf document.

3.17 Warranty Period Logistics Support Services

The Contractor shall provide logistics support services (maintenance and repair) for in-warranty TSE and peripheral equipment; necessary to meet the logistics support service level Requirements. Logistics support service shall include:

Preventive Maintenance (PM), in accordance and as required with the Original Equipment Manufacturer (OEM) maintenance manuals and state and federal environmental and safety regulations. Tests required at scheduled intervals, such as radiation leak surveys, are to be considered PM. The Contractor shall coordinate all maintenance scheduling with local TSA staff as appropriate. The Contractor shall not perform PM during the calendar month in which a unit is installed. In a month when a unit is being decommissioned, the Contractor shall request COR approval to waive the requirements for performing monthly PM. Otherwise PM shall be performed on all required units.

TSE and peripheral equipment requiring repairs that can only be completed by the OEM at the OEM facility shall be identified by the Contractor in the WIP. The desire of the Government is that components and bearing assemblies, associated with the required rotation of x-ray disk in the gantry area should be an on-site repair. The Contractor shall record and maintain FMI for all corrective maintenance actions performed. If FST are not located on site but are needed to correct a failure, they shall be dispatched within 15 minutes of receipt of a service request.

All labor for TSE preventative maintenance, corrective maintenance and associated logistics support resources shall include repair parts, training, and tools and test equipment. The Contractor shall inform the TSA OEM COR when refurbished parts are initiated into the Contractor’s supply chain for corrective maintenance repairs. The Contractor shall ensure that parts obsolescence during the Contract period of performance does not affect the Contractor’s ability to meet logistics support service level requirements.

Repair part shipment from the Contractor part location to the prototype location shall include shipment, and all associated transportation costs including local logistics transportation to the unit.

Documentation of all maintenance actions (including preventive, corrective, and excepted) in the TSE performance database.

The Contractor shall recommend adjustments to preventative maintenance schedules, with supporting rationale, that have the potential to improve TSE reliability or reduce costs without degrading TSE reliability. The Contractor shall request for CO or COR approval for more (or less) frequent PM for those airports or sites which experience unusual operating conditions.

In the event a scheduled maintenance activity cannot be completed due to factors outside of the Contractor’s control or the performance of corrective maintenance prevents the Contractor from completing preventative maintenance, the Contractor shall reschedule preventative maintenance on the impacted machines during the same month. If unable to reschedule, the Contractor will ask for relief from the preventative maintenance task from the COR. It is at the Governments discretion whether relief is granted or not. If relief is not granted, then the preventative maintenance action must be completed within 48 hours of notice of TSA’s disapproval of the request for relief.

3.18 Preventive Maintenance

Preventative Maintenance is scheduled during nonoperational hours or during nonpeak operational hours with approval of local TSA officials. Nonoperational hours must coincide with Airport Operational Hours. If local TSA officials have approved PM during nonpeak hours, then the Contractor shall submit a list to the COR that identifies the location and the TSA official.

There are two discrete levels of preventative maintenance:

Level I preventative maintenance – This is primarily performed every shift (1–3 times a day), daily, and weekly. Level I preventative maintenance is performed without the need to open the machine. These activities are currently performed by TSA personnel and are not a part of this SOW.

Level II preventative maintenance – This is primarily performed every month, quarter, and/or year. These activities are included under this Logistics Support service level agreement. Monthly Level II preventative maintenance will include verification of the performance of Level I preventative maintenance by TSA personnel. This verification will be accomplished by reviewing airport logs for TSE and through physical observation. TSA will ensure that weekly logs are available to the Contractor for review during monthly Level II preventative maintenance The Contractor shall notify the COR when weekly preventative maintenance logs are unavailable for review. The Contractor shall provide a copy of the radiation survey report for each prototypes to the local TSA POC and be able to provide a copy to authorized Government personnel upon request after the annual survey is completed.

3.19 Corrective Maintenance

The definition of corrective maintenance and the associated Levels are as follows.

Corrective Maintenance consists of unscheduled maintenance activities performed to repair or otherwise restore failed TSE to operational condition. These actions usually expend consumable and repair parts. There are three discrete levels of Corrective Maintenance:

Level I Corrective Maintenance – This is Corrective Maintenance that is performed as needed to effect repairs that do not require trained FSTs (e.g., bag jams, etc.). These activities are currently performed by TSA personnel or their designees and are not part of this SOW.

Level II Corrective Maintenance – This is Corrective Maintenance that is performed as needed to effect repairs that always require trained FSTs. These services are included under this Logistics Support service level agreement.

Level III Depot Maintenance (DM) – This consists of unscheduled…