DRAFT_PERFORMANCE_WORK_STATEMENT.pdf

DRAFT PERFORMANCE WORK STATEMENT (PWS)

C.1 Scope

This Performance Work Statement (PWS) defines the requirements for the establishment, implementation, and maintenance of an Integrated Logistics Support (ILS) program to sustain Government Transportation Security Equipment (TSE) owned and operated by the Transportation Security Administration (TSA). The TSE covered by this Contract are deployed at Category X through IV airports and other Government-designated facilities throughout the United States and its territories. This Section includes Program Management, Quality Assurance (QA), Contractor Logistics Support (CLS) services, TSA Service Response Center (TSRC) services, and the associated Information Technology (IT) infrastructure to support all the required services.

C.1.1 Background

TSA was established as a result of Public Law 107-71, Aviation and Transportation Security Act.

TSA is charged with countering threats to security with technologies and procedures that will prevent, deter, or render ineffective any attempt to sabotage domestic public transportation. TSA uses TSE technologies to assist with these responsibilities and must maintain the operational availability of these systems to ensure complete security. The Office of Acquisition Program Management (OAPM) is the TSA office responsible for procurement, deployment, integration, and life-cycle management of the TSE.

Transportation Security Equipment (TSE) for the screening of passengers at airports is deployed at over 440 locations in the United States and its territories. Continually evolving threats and technology result in frequent reviews of TSE capabilities and utilization to provide optimal detection effectiveness.

TSA’s Deployment and Logistics Division (DLD) Integrated Logistics Support (ILS) branch is responsible for the oversight of all aspects of maintenance for out of warranty checkpoint equipment. ILS requires a maintenance program that provides maximum operational capability at all locations; utilizes a flexible approach to support changing TSE deployment and changes in airport federalization status; and employs a robust communications method with local TSA and TSA HQ personnel.

TSE are typically procured with a one-year warranty period, with options to extend the warranty an additional year, during which the Original Equipment Manufacturer (OEM) is responsible for all required logistics support and maintenance activities. Following the expiration of the warranty period, the TSE requires the full logistics and sustainment support under this contract to ensure operational availability of the TSE. This support involves TSE at over 440 locations as described in Attachment 1.

C.1.2 Objective

The objective of this procurement is to obtain a performance based Contractor Logistics Support (CLS) contract with a Maintenance Service Provider (MSP or Contractor), relying on the Contractor’s experience and expertise to determine the best maintenance and support structure that meets or exceeds the performance requirement specified in Paragraphs C.7 and C.8 of this PWS. The Contractor shall be responsible for all elements of TSE sustainment and logistics support, which includes, but is not limited to: radiation surveys and radioactive leak tests;

corrective and preventive maintenance; communications; maintenance planning; supply support;

tools, test equipment and calibration; parts and parts obsolescence; subcontract agreements; and TSRC services.

C.2 Applicable Documents

The documents listed in C.2.1, Government Documents, of this PWS, are provided for reference in performance of the technical requirements herein. While every effort has been made to ensure the completeness of this list, contractors are cautioned that they must meet all requirements of this PWS, whether an invoked reference is listed here or not. The following specifications, standards, handbooks, documents, and drawings of the References listed below form a part of the technical requirements to the extent noted herein. The applicable editions of these documents are those in effect at the time of the release of the RFP.

C.2.1 Government Documents

The following Government documents will provide further guidance for the implementation of the required services.

Reference Title

Title 10 Code of Federal Regulations (CFR), Chapter 1, Part 31 NRC Regulations https://www.nrc.gov/reading-rm/doc-collections/cfr/part031/

General Domestic Licenses for Byproduct Material

Title 21 CFR, Part 1020.40 http://www.accessdata.fda.gov/scripts/cdrh/cf docs/cfcfr/cfrsearch.cfm

Performance Standards for Ionizing Radiation Emitting Products-Cabinet X-ray Systems

American National Standards Institute

ANSI/HPS N43.17-2009

Radiation Safety For Personnel Security Screening Systems Using X-ray

Title 21 CFR Part 1002.20 Manufacturers’ Reports on Accidental Radiation Occurrences

Title 21 CFR Part 1003.10 Discovery of defect or failure of compliance by manufacturer; notice requirements.

Title 40 CFR, Parts 260, 261 and 263 http://www.epa.gov/waste/laws-regs/regs-haz.htm

Hazardous Waste Regulations

Title 49 CFR, Part 15 and 1520 http://ecfr.gpoaccess.gov/ Protection of Sensitive Security Information (SSI) https://www.nrc.gov/reading-rm/doc-collections/cfr/part031/ https://www.nrc.gov/reading-rm/doc-collections/cfr/part031/ http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm http://www.epa.gov/waste/laws-regs/regs-%20haz.htm http://www.epa.gov/waste/laws-regs/regs-%20haz.htm http://ecfr.gpoaccess.gov/

Reference Title

Department of Homeland Security (DHS) Management Directive (MD) 11000-6 Form (08-04)

Sensitive but Unclassified Information Non-Disclosure Agreement (NDA)

DHS MD 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information

DHS MD 11044 Protection of Classified National Security Information Classification Management

DHS MD 11050.2 Personnel Security and Suitability Program

DHS MD 11056 Sensitive Security Information (SSI) Policy & Procedures Guide

DHS MD 4300A v9.1 DHS Sensitive System Policy Directive

DHS 4300A v9.1 Sensitive Systems Handbook

DHS 4300B Policy Directive DHS National Security System Policy Directive

DHS 4300B National Security System Handbook

DHS Performance Plan DHS Performance Plan (2013)

Department of Defense (DoD) Military (MIL) Standard (STD) MIL-STD-973

Military Standard: Configuration Management, Interim Notice 3, 13 January 1995

IAD SOP 1402 TSA Information Assurance and Cyber Security Division (IAD) SOP 1402

DoD DD Form 1149 Requisition and Invoice/Shipping Document e-QIP Systems U.S. Office of Personnel Management

Federal Acquisition Regulation (FAR) Federal Acquisition Regulation

National Institute of Standards and Technology (NIST) Special Publication 800-

Guidelines for Security Certification and Accreditation of Federal Information Systems

NIST Special Publication 800-53 Recommended Security Controls for Federal Information Systems and Organizations

NIST Special Publication 800-88 Guidelines for Media Sanitization

SSIDG Security Sensitive Information Identification Guide

(SSIDG)

TSA, Configuration Management Plan Configuration Management Requirements Plan

TSA Management Directive (MD) 1400.3 TSA Information Security Policy

TSA MD 1400.3 Information Technology Security

TSA MD 3700.4 Handling Security Personally Identifiable Information

C.2.2 Other Applicable Documents

American National Standards Institute

ANSI/HPS N43.17-2009

Radiation Safety For Personnel Security Screening Systems Using X-ray

ANSI/ISO/ASQ Q9001:2008 American National Standard Quality Management Systems Requirements.

DHS MD 4300A Sensitive Systems Handbook TSA MD 1400.3 TSA Information Security Policy

DHS IT Security Architecture Guidance Volumes 1, 2 and 3 TSA MD 1400.3 TSA Information Security Policy

DHS/TSA System Development Lifecycle (SDLC) TSA MD 1400.3 TSA Information Security Policy

C.2.3 Document Requests

Requests for copies of Government and Non-Government documents not covered in this PWS should be addressed to the Contracting Officer (CO). Requests should fully identify the material desired and the associated contract number.

Military Standards, Handbooks, and Specifications can be ordered from the Department of Defense Single Stock Point (DODSSP), Building 4/Section D, 700 Robbins Avenue, Philadelphia, PA 19111-5098. Information is also available at http://dodssp.daps.dla.mil/.

Copies of ANSI/ASQ Q9000 series standards can be obtained from the following source:

American Society for Quality Control, 600 North Plankinton Avenue, Milwaukee, Wisconsin 53203. Phones: (414) 272-8575. The Fax is: (414) 272-1734. Information is available at their website, http://asq.org/.

C.2.4 Order of Precedence

In the event of conflict between the text in this PWS and the references cited, the text of this PWS takes precedence. Unless there is a specific written exemption, nothing in this PWS supersedes applicable laws and regulations.

C.3 Document Submission and Compliance

Data items referenced by their Contract Data Requirements List (CDRL) titles shall be performed in accordance with the CDRL of the same name (see Attachment 2). All data http://dodssp.daps.dla.mil/ http://asq.org/ deliverables are to be prepared or updated and delivered in accordance with the corresponding CDRL items specified in this PWS.

In general, the Contractor shall perform in accordance with the documents and other deliverables developed in response to the technical requirements stated in this PWS as approved by the Government. The Contractor shall update as required and submit for approval prior to implementation of any changes. All reference to the "Government" in this PWS will mean by authority of the Contracting Officer.

The Contractor, using the Security Sensitive Information Identification Guide (SSIDG) as guidance, shall make recommendations to TSA regarding any data or information the contractor generates, including deliverables and other submission requirements, which should be considered Security Sensitive Information (SSI). Upon approval by the Government, the Contractor shall label any documents containing SSI as defined in 49 CFR Parts 15 and 1520 as follows:

Warning: This record contains Sensitive Security Information that is controlled under 49 CFR Parts 15 and 1520. No part of this record may be disclosed to persons without a “need-to-know”, as defined in 49 CFR Parts 15 and 1520, except with the written permission of the Administrator of the Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 (U.S. Code) U.S.C. 552 and 49 CFR Parts 15 and 1520.

Electronic version of the deliverables containing SSI shall be submitted on a secure, password-protected Web site; via email; via CD; or as designated by the COR.

The Contractor shall use the following software programs or similar state-of-the-market software that is compatible with TSA software. The following software reflects the minimum standard of compatibility with TSA:

Word Processing Microsoft Word (Version must be compatible with MS Office Suite 2016)

Spreadsheet/Graphs Microsoft Excel (Version must be compatible with MS Office Suite 2016)

Presentations Microsoft PowerPoint (Version must be compatible with MS Office Suite 2016)

Databases Microsoft Access (Version must be compatible with MS Office Suite 2016)

Scheduling Microsoft Project (Version must be compatible with MS Office Suite 2016)

C.4 Government Furnished Information

All Government Furnished Information (GFI) is listed in Attachments 1 through 9 of Part D.

TSE manuals (operator, maintenance, etc.) are not considered GFI and must be obtained from the Original Equipment Manufacturers (OEM) as appropriate.

C.5 Contractor Furnished Items

The Contractor shall:

• Provide all equipment, materials, parts, supplies, components, and facilities to perform the requirements of this contract;

• Be responsible for removing and replacing retrograde material, including hazardous material (e.g. lead curtains, batteries, solvents, or chemicals used in the performance of maintenance), at no cost to the Government;

• Not bring materials containing asbestos and polychlorinated biphenyls (PCB) to TSA sites; and

• Use energy efficient tools and equipment when available.

C.6 Standards and Code Requirements

The Contractor shall ensure that all work performed is in compliance with all applicable local, state, and federal standards, codes, and regulations; including obtaining any required licenses, permits, approvals, and/or authorizations.

C.7 Sustainment Support Program (CLIN X001)

Under the requirements of this contract the Contractor provides the full range of program management, quality assurance, and security to meet the requirements of the contract. The Contractor manages the total work effort associated with the services required to meet the performance objectives and standards. Such management includes, but is not limited to, planning, scheduling, cost accounting, report preparation, establishing and maintaining records, quality assurance, and security. The Contractor must establish and maintain an organization to manage this ILS contract and associated subcontracts to efficiently and effectively execute the requirements of this PWS. The Contractor must provide a staff with the necessary management expertise to ensure performance objectives and standards are met.

The Government requires a Program Manager (PM) who:

• Possesses relevant experience at a comparable level of responsibility in projects of similar size, scope, and complexity;

• Has full authority to act for the Contractor on all contract matters relating to this contract;

• Is dedicated to this contract;

• Is responsible for accomplishment of all tasks required by this PWS;

• Serves as technical and programmatic liaison to the Government with the authority to commit the Contractor’s resources as necessary to ensure efficient and timely program execution;

• Organizes, plans, schedules, implements, controls, analyzes, and reports on all elements of the contract; and

• Presents and discusses the status of contract activities, requirements, and problems during program reviews and in response to requests from the Government.

The PM, unless otherwise unavoidable, should not be changed from the designated assignment until at least 12 months from date of award. Unavoidable situations include sudden illness, death or termination of employment.

C.7.1 Program Management Plan

The Contractor shall prepare and deliver an all-inclusive Program Management Plan (PMP) in accordance with the following referenced CDRL and update and deliver as required:

CDRL A001, Program Management Plan

C.7.2 Risk Management/Assessment

The Contractor shall perform risk management throughout the performance of this Contract including:

• Developing and maintaining a list of program risks.

• Classifying program risks as low, moderate, or high, and notifying the Government of high risk items within 24 hours of identification.

• Preparing mitigation plans for risks considered low, moderate, or high.

• Planning and coordinating a recurring meeting with the Government to discuss risks and mitigation status.

The contractor shall include its risk management plan in CDRL A001, Program Management Plan.

C.7.3 Contract Transition Plan

The Contractor shall prepare and include a Transition Plan to address incoming and outgoing transitions in CDRL A001, Program Management Plan.

C.7.4 Program Control

The Contractor shall implement program control procedures that demonstrate a clear line of project authority among organizational elements. This information shall be prepared and delivered each month through a Program Management Review (PMR) and a Program Status Report (PSR) in accordance with the following CDRL:

CDRL A002, Program Status Report

C.7.5 Requirements Traceability

The Contractor shall prepare and deliver a Requirements Traceability Report in accordance with the following CDRL to document and map the status of all contract requirements and resulting deliverable requirements to the underlying processes for implementation

CDRL A003, Requirements Traceability Report

C.7.6 Transportation Security Equipment Database

The Contractor shall establish and maintain a TSE Database which:

• Includes the entire inventory of fielded TSE maintained under this Contract and which will be the basis for computation of performance metrics;

• Uniquely identifies each TSE by OEM, model, serial number, and barcode number

• Includes information on all accumulating Radiation, Preventive Maintenance (PM) and Corrective Maintenance (CM) actions (including warranty if applicable)

• Includes PM start time (at the machine) and stop time (when the Field Service Technician (FST) is finished) for every unit so TSA can monitor the average PM duration time

• Includes Reliability, Maintainability, Availability (RMA) metrics data (high and low level) and provides the full maintenance and performance history

• Reflects all time values reported in local airport location time

• Provides Government access and data rights to all data collected

• Provides designated Government personnel live ‘read-only’ access to a database enabling them to query maintenance actions on work order tickets

• Allows the Government to download data in an excel spreadsheet meeting the requirements of Section C.3, Document Submission and Compliance, of this PWS.

• Ensures Failure Mode Identifier (FMI) codes are in a standard format and used in a consistent manner

• Includes parts replaced data

• Reflects whether ETDs are located in baggage areas or at the checkpoint. For any ETDs in the database received from the incumbent that do not have baggage or checkpoint specified, the Contractor shall add the location as part of the February 2018 Preventive Maintenance.

The Contractor shall establish and maintain a TSE Database and deliver an extract of the TSE Database each month in accordance with the following CDRL:

CDRL A004, Transportation Security Equipment Database

C.7.7 Program Document Library

The Contractor shall maintain a Program Document Library (PDL) that is accessible to authorized Government personnel. The library consists of a physical repository of all program documents/data generated by the Contractor that were contract CDRL deliverables to the Government in performance of the contract, other major deliverables requested by the Government in performance of the contract, and documents provided to the Contractor by the Government during the performance of the contract. It also consists of a list of all Contractor internal documents, referred to as a Data Accession List (DAL), required by the Contractor for implementation of this contract. A PDL Index (PDLI) shall be maintained and delivered in accordance with the following CDRL:

CDRL A005, Program Document Library Index

C.7.8 Subcontractor Management

The Contractor shall provide the Government copies of each subcontract or partnering agreement and inform the Government on the status of these agreements during Project Management Reviews in accordance with the following CDRL:

CDRL A006, Subcontractor Management Report

C.7.9 Meeting and Reviews

The Contractor shall conduct meetings and reviews in accordance with the requirements of this PWS and the following CDRLs. Meetings and reviews are not considered final until the Government has approved the minutes.

CDRL A007A, Meeting Agenda and Presentation Materials CDRL A007B, Meeting Minutes

C.7.9.1 Program Management Reviews

The Government requires monthly Program Management Reviews (PMR) which are typically conducted monthly at the Contractor site, TSA, or alternate site(s) specified by the Government.

The Contractor shall submit the proposed agenda and PMR slides four (4) business days prior to the scheduled PMR in accordance with CDRL A007A, Meeting Agenda and Presentation Materials, to include, at a minimum, the following topics:

• A review of all pertinent technical, schedule and cost aspects of the contract.

• Current performance measurement information.

• Current and anticipated technical and implementation problems.

• Risks and mitigation actions taken as addressed in Section C.7.2, Risk Management/Assessment, of this PWS.

• Review of each subcontractor’s technical progress on all assigned tasks.

• Substantiation of assumptions made and methodologies used in arriving at recommendations or conclusions.

• Status summary of:

o Open Provisional Items (CLIN X007) actions o Financial position (obligated, expended, invoiced, remaining) by Option Year o Consumables (top ordering airports, top ordered items, running OY and 12 month totals, etc.)

The Government reserves the right to change the location of the PMR, to increase or decrease the frequency of the PMRs, and/or to require that a PMR be held via teleconference instead of an in-person meeting. The Government will provide the Contractor with sufficient notice of any such changes to the PMR. The Government further reserves the right to add, delete or modify the PMR agenda items at its discretion.

C.7.9.2 Technical Interchange Meetings

When requested by the Government, or when approved by the Government if requested by the Contractor, the Contractor shall conduct and administratively support Technical Interchange Meetings (TIM) at the Contractor's facility or government-designated locations. TIMs may be held by teleconference at the discretion of the Government. During the TIM, the Contractor and the Government will discuss specific technical activities associated with ILS that require attention prior to the next scheduled PMR to ensure continuing Government visibility into the technical progress of the contract.

C.7.10 Continuity of Operations Plans

The Contractor shall develop and maintain a Contingency Plan (CP), to include a Continuity of Operation Plan (COOP), to address circumstances whereby normal operations may be disrupted and thus require activation of the CP and/or COOP are disrupted. The contractor’s CP/COOP responsibility relates only to the system they provide or operate under contract.

The Contractor shall:

• Ensure that contingency plans are consistent with template provided in the DHS IACS Tool. If access has not been provided initially, the contractor shall use the DHS 4300A Sensitive System Handbook, Attachment K IT Contingency Plan Template.

• Identify and train all TSA personnel involved with COOP efforts in the procedures and logistics of the disaster recovery and business continuity plans.

• Ensure the availability of critical resources and facilitate the COOP in an emergency situation.

• Test their CP annually and retain records of the annual CP testing for review during periodic audits.

• Record, track, and correct any CP deficiency; any deficiency correction that cannot be accomplished within one month of the annual test shall be elevated to IAD.

• Ensure the CP addresses emergency response, backup operations, and recovery operations.

• Have an Emergency Response Plan that includes procedures appropriate to fire, flood, civil disorder, disaster, bomb threat, or any other incident or activity that may endanger lives, property, or the capability to perform essential functions.

• Have a Backup Operations Plan that includes procedures and responsibilities to ensure that essential operations can be continued if normal processing or data communications are interrupted for any reason.

• Have a Post-Disaster Recovery Plan that includes procedures and responsibilities to facilitate rapid restoration of normal operations at the primary site or, if necessary, at a new facility following the destruction, major damage, or other major interruption at the primary site.

• Ensure all TSA data (e.g., mail, data servers, etc.) is incrementally backed up on a daily basis.

• Ensure a full backup of all network data occurs as required by the system’s availability security categorization impact rating per TSA Information Assurance policy.

• Ensure all network application assets (e.g., application servers, domain controllers, Information Assurance (IA) tools, etc.) shall be incrementally backed up as required to eliminate loss of critical audit data and allow for restoration and resumption of normal operations within one hour.

• Ensure sufficient backup data to facilitate a full operational recovery within one business day at either the prime operational site or the designated alternate site shall be stored at a secondary location determined by the local element disaster recovery plan.

• Ensure that data at the secondary location is current as required by the system’s availability security categorization impact rating.

• Ensure the location of the local backup repository and the secondary backup repository is clearly defined, and access controlled as an Information Security Restricted Area (ISRA).

• Adhere to the DHS IT Security Architecture Guidance Volume 1: Network and System Infrastructure for the layout of the file systems, or partitions, on a system’s hard disk impacting the security of the data on the resultant system. File system design shall:

• Separate generalized data from operating system (OS) files

• Compartmentalize differing data types

• Restrict dynamic, growing log files or audit trails from crowding other data

• Adhere to the DHS IT Security Architecture Guidance Volume 1: Network and System Infrastructure for the management of mixed data for OS files, user accounts, externally-accesses data files and audit logs.

A COOP plan shall be developed and delivered in accordance with the following CDRL:

CDRL A008, Continuity of Operations Plan (COOP)

C.7.11 Integrated Support Plan

The Contractor shall establish and implement an ILS and Contractor Logistics Support (CLS) organization and program that will be employed to accomplish the contract ILS and CLS requirements, and develop and deliver an Integrated Support Plan (ISP) in accordance with the following CDRL.

CDRL A009, Integrated Support Plan (ISP)

C.7.12 Quality Management Plan

The Contractor shall establish, implement, and maintain a quality management system in accordance with ANSI/ISO/ASQ Q9001:2008 and flow down appropriate contract requirements to its sub-suppliers and subcontractors and ensure they have a documented quality management system that controls the quality of the services and supplies they provide under the contract. The Contractor shall document its quality management system in a Quality Management Plan (QMP) in accordance with the following CDRL:

CDRL A010, Quality Management Plan

C.7.13 Information Technology Security Requirements

C.7.13.1 Controls

The Contractor shall comply with all Federal, Department of Homeland Security (DHS) and Transportation Security Administration (TSA) security and privacy guidelines in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The Contractor shall comply with all DHS and TSA security controls to ensure that the Government's security requirements are met. These controls are described in DHS PD 4300A and TSA MD 1400 series security policy documents and are based on the current National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 standards.

The Contractor shall include this guidance in all subcontracts at any tier where the subcontractor is performing the work defined in this PWS.

C.7.13.2 General Security Responsibilities

The Contractor shall ensure all staff have the required level of security clearance commensurate with the sensitivity of the information being accessed, stored, processed, transmitted or otherwise handled by the System or required to perform the work stipulated by the contract. At a minimum, all Contractor staff shall be subjected to a suitability determination by and through the Office of Security, Personnel Security Division (PerSec), and be granted a favorable determination before access to the System or other TSA resources is granted.

The Contractor shall not release, publish, or disclose agency information to unauthorized personnel, and shall protect such information in accordance with the provisions of the pertinent laws and regulations governing the confidentiality of sensitive information.

The Contractor shall ensure that its staff follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract. Personnel shall be responsible for the physical security of their area and any government furnished equipment (GFE) issued to the contractor under the terms of the contract.

The Contractor shall make all system information and documentation produced in support of the contract available to TSA upon request.

The Contractor shall perform periodic reviews to ensure compliance with all information security and privacy requirements.

C.7.13.3 IT Training Requirements

All Contractor employees, requiring system access, shall receive initial Organizational Security Fundamentals Training within 60 days of assignment to the contract via the Online Learning Center (OLC) and/or TSA provided CD disks. Refresher training shall be completed annually thereafter for Organizational Security Fundamentals and TSA Privacy training. Non-compliance will result in the suspension of user accounts at the Government’s discretion.

Role Based training is required for contract employees with Significant Security Responsibility (SSR), whose job proficiency is required for overall network security within TSA, and shall be in accordance with DHS and TSA policy. The contractor will be notified if they have a position with significant security responsibility.

Individuals with SSR shall have a documented individual training and education plan, which shall ensure currency with position skills requirements, with the first course to be accomplished within 90 days of employment or change of position. The individual training plan shall be refreshed annually or immediately after a change in the individual’s position description requirements.

Information Security and Privacy training supplied by the Contractor shall meet standards established by NIST and set forth in DHS and TSA security policy.

The Contractor shall maintain a list of all employees who have completed training and shall submit this list to the contracting officer representative (COR) upon request, or during DHS/TSA onsite validation visits performed on a periodic basis.

The Contractor shall have its employees review and sign the TSA Form 1403 Computer and Wireless Mobile Device Access Agreement (CAA) prior to accessing IT systems.

C.7.13.4 Information Technology Configuration Management (hardware/software)

Hardware or software configuration changes shall be in accordance with the DHS Information Security Performance Plan (current year and any updates thereafter), the DHS Continuous Diagnostics and Mitigation (CDM) Program to include dashboard reporting requirements and TSA’s Configuration Management policy. The TSA Chief Information Security Officer (CISO)/Information Assurance and Cybersecurity Division (IAD) shall be informed of and involved in all configuration changes to the TSA IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The TSA COR shall approve any request for change prior to any development activity occurring for that change and shall define the security requirements for the requested change. The COR will provide access to the DHS Information Security Performance Plan.

The Contractor shall ensure all application or configuration patches and/or Requests for Change (RFC) have approval by the Technical Discussion Forum (TDF), Systems Configuration Control Board (SCCB) and lab regression testing prior to controlled change release under the security policy document, TSA Management Directive (MD) 1400.3 Information Technology Security and TSA Information Assurance (IA) Handbook, unless immediate risk requires immediate intervention. Approval for immediate intervention (emergency change) requires approval of the TSA CISO, SCCB co-chairs, and the appropriate Operations Manager, at a minimum.

The Contractor shall ensure all sites impacted by patching are compliant within 14 days of change approval and release.

The acquisition of commercial-off-the-shelf (COTS) Information Assurance (IA) and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting “sensitive information”) shall be limited to those products that have been evaluated and validated, as appropriate, in accordance with the following:

• The NIST FIPS validation program.

• The National Security Agency (NSA)/NIST, National Information Assurance Partnership (NIAP) Evaluation and Validation Program.

• The International Common Criteria for Information Security Technology Evaluation Mutual Recognition Agreement.

US Government Configuration Baseline and DHS Configuration Guidance

a) The provider of information technology shall certify applications are fully functional and operate correctly as intended on systems using the US Government Configuration Baseline (USGCB) and in accordance with DHS and TSA guidance.

1. USGCB Guidelines:

a. http://usgcb.nist.gov/usgcb_content.html

2. DHS Sensitive Systems Configuration Guidance http://usgcb.nist.gov/usgcb_content.html

a. http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Pages/sscg.aspx

b) The standard installation, operation, maintenance, updates and/or patching of software shall not alter the configuration settings from the approved USGCB configuration. The information technology shall also use the Windows Installer Service for installation to the default “program files” directory and shall be able to discretely install and uninstall.

c) Applications designed for general end users shall run in the general user context without elevated system administration privileges.

The Contractor shall establish processes and procedures for continuous monitoring of Contractor systems that contain TSA data/information by ensuring all such devices are monitored by, and report to, the TSA Security Operations Center (SOC). The Contractor shall perform monthly security scans on servers that contain TSA data, and shall send monthly scan results to the TSA

IAD.

C.7.13.5 Risk Management Framework

The Security Authorization and Ongoing Authorization Process in accordance with NIST SP 800-37 and SP 800-137 (current versions) is a requirement for all IT systems containing TSA data, including General Support Systems (e.g., standard TSA desktop, general network infrastructure, electronic mail), major applications and development systems (if connected to the operational network or processing, storing, or transmitting government data). These processes are documented in the NIST Risk Management Framework (RMF). Ongoing Authorization is part of Step 6 “Monitoring” of the RMF. All NIST guidance is publicly available; TSA and DHS security policy is disclosed upon contract award with some exceptions, which are public facing (i.e., DHS Security and Training Requirements for Contractors).

A written Authorization to Operate (ATO) granted by the TSA Authorizing Official (AO), also known as the TSA CISO, is required prior to processing operational data or connecting to any TSA network. The contractor shall provide all necessary system information for the security authorization effort. If ATO has already been granted by the AO or the Contractor has already provided all necessary system information (Security Authorization (SA) Package documentation) then the contractor shall ensure the SA documentation is maintained in the Information Assurance Compliance System (IACS).

TSA will assign a security category to each IT system compliant with the requirements of Federal Information Processing Standards (FIPS) Pub 199 Standards for Security Categorization of Federal Information and Information Systems impact levels and assign security controls to those systems consistent with FIPS Pub 200 Minimum Security Requirements for Federal Information and Information Systems methodology. Unless the AO specifically states otherwise for an individual system, the duration of any Accreditation shall be dependent on the FIPS 199 rating and overall residual risk of the system; the length can span up to 36 months.

The Security Authorization (SA) Package contains documentation required for Security Authorizations and Ongoing Authorization. The package shall contain the following security documentation: 1) Security Assessment Report (SAR), 2) Security Plan (SP) or System Security Authorization Agreement (SSAA), 3) Contingency Plan, 4) Contingency Plan Test Results, 5) http://dhsconnect.dhs.gov/org/comp/mgmt/cio/iso/Pages/sscg.aspx https://www.dhs.gov/dhs-security-and-training-requirements-contractors

Federal Information Processing Standards (FIPS) 199 Security Categorization, 6) Privacy Threshold Analysis (PTA), 7) E-Authentication, 8) Security Assessment Plan (SAP), 9) Configuration Management Plan, 10) Authorization to Operate (ATO) Letter, 11) Plan of Action and Milestones (POA&M), and 12) Ongoing Authorization Artifacts as required by the DHS Ongoing Authorization Methodology (current version). The SA package shall document the specific procedures, training, and accountability measures in place for systems that process personally identifiable information (PII). All security compliance documents shall be reviewed and approved by the CISO and the IAD, and accepted by the CO upon creation and after any subsequent changes, before they go into effect. Ongoing Authorization artifacts include monthly TRigger Accountability Log (TRAL), monthly operating system scan results, application scans as directed, updated control allocation table (CAT), and associated memos as directed. All steps in the DHS Information Assurance Compliance Systems (IACS) shall be completed correctly, thoroughly and in a timely manner for all steps of the RMF.

The Contractor shall support the successful remediation of all identified system weaknesses and vulnerabilities that are identified as a result of the aforementioned security review process.

The Contractor shall submit and analyze monthly operating system vulnerability scans for the DHS Information Security Performance Plan FISMA Scorecard. Vulnerabilities not remediated are generated into Plan of Action and Milestones (POA&M)s after 30 days.

CDRL A011, Security Authorization Package C.7.13.6 Program Performance

The Contractor shall comply with requests to be audited and provide responses within three business days to requests for data, information, and analysis from the TSA IAD and management, as directed by the Contracting Officer (CO). The Contractor shall provide support during the IAD audit activities and efforts. These audit activities shall include, but are not limited to the following: requests for system access for penetration testing, vulnerability scanning, incident response and forensic review. Upon completion of monthly security scans, findings shall be documented and categorized as High, Moderate, or Low based on their potential impact to the System IT Security posture. The Contractor shall provide TSA with estimates of the total engineering service hours required to support the remediation of open POA&M items. High security findings shall be remediated first in 45 days or less; Moderate security findings shall be remediated in 60 days or less, and Low security findings shall be remediated in 90 days or less. The Contractor shall work with the TSA System ISSO and the respective CO and/or COR, as well as OIT IAD and the System Owner (as required) to prioritize and plan for the remediation of open POA&Ms. The TSA System ISSO shall maintain all security artifacts and perform Ongoing Authorization (per NIST 800-137 and DHS-TSA requirements) and Continuous Diagnostics and Mitigation (CDM) (per OMB M-14-03) activities to ensure active compliance with security requirements. Specific POA&M guidance and information can be found in the SOP 1401 Plan of Action and Milestone (POA&M) Process, as well as the DHS 4300A PD Attachment H Plan of Action and Milestones (POA&M) Process Guide.

C.7.13.7 Federal Risk and Authorization Management Program (FedRAMP)

If a vendor is to host a system with a Cloud Service Provider, the following shall apply:

• FedRAMP Government Cloud Requirements: Private sector solutions shall be hosted by a Joint Authorization Board (JAB)-approved Infrastructure as a Service (IaaS) Government Cloud Service Provider (CSP) (http://cloud.cio.gov/fedramp/cloud-systems) and shall follow the Federal Risk and Authorization Management Program (FedRAMP) requirements. The CSP shall adhere to the following in addition to the FedRAMP requirements:

o Identity and entitlement access management shall be done through Federated

Identity;

o SSI and PII shall be encrypted in storage and in transit as it is dispersed across the cloud;

o Sanitization of all TSA data shall be done as necessary at the IaaS, PaaS or SaaS levels;

o Cloud bursting shall not occur;

o TSA data shall be logically separated from other cloud tenants;

o All system administrators shall be properly cleared and vetted U.S. citizens;

o TSA data shall not leave the United States; and o The cloud internet connection shall be behind a commercial Trusted Internet

Connection (TIC) that has EINSTEIN 3 Accelerated (E3A) capabilities deployed. These include but are not limited to the analysis of network flow records, detecting and alerting to known or suspected cyber threats, intrusion prevention capabilities and under the direction of DHS detecting and blocking known or suspected cyber threats using indicators. The E3A capability shall use the Domain Name Server Sinkholing capability and email filtering capability allowing scans to occur destined for .gov networks for malicious attachments, Uniform Resource Locators and other forms of malware before being delivered to .gov end-users.

• Private Sector System Requirements: TSA shall conduct audits at any time on private sector systems, and the system shall be entered into the TSA FISMA Inventory as a system of record using the Control Implementation Summary (CIS) provided by the Cloud Service Provider. Security artifacts shall be created and maintained in the DHS IACS. The private sector systems are required to go through the Security Authorization Process and the RMF in accordance the Federal Information Systems Management Act (FISMA) and NIST SP 800-37 Rev. 1. The cloud internet connection shall be behind a commercial Trusted Internet Connection (TIC) that has E3A deployed. Security event logs and application logs shall be sent to the TSA SOC. Incidents as defined in the TSA Management Directive 1400.3 and its Attachment 1 (TSA IA Handbook) shall be reported to the TSA SPOC 1-800-253-8571. DHS Information Security Vulnerability Management Alerts and Bulletins shall be patched within the required time frames as dictated by DHS and communicated by the COR or contract security point of contact

(POC).

http://cloud.cio.gov/fedramp/cloud-systems

C.7.13.8 Information Assurance Policy

All services, hardware and/or software provided under this task order shall be compliant with applicable DHS 4300A Sensitive System Policy Directive, DHS 4300A Sensitive Systems Handbook, TSA MD 1400.3 Information Technology Security, TSA IA Handbook, Technical Standards (TSs) and standard operating procedures (SOPs). The contractor solution shall follow all current versions of TSA and DHS policies, procedures, guidelines, and standards, which shall be provided by the Contracting Officer. Authorized access and use of TSA IT systems and resources shall be in accordance with the TSA IA Handbook. The Contractor shall complete TSA Form 251 and TSA Form 251-1 for sensitive or accountable property. The Contractor shall email the completed forms to TSA-Property@dhs.gov and include a hard copy with the shipment.

C.7.13.9 Data Stored/Processed at Contractor Site

Unless otherwise directed by TSA, any storage of data shall be contained within the resources allocated by the Contractor to support TSA and may not be on systems that are shared with other commercial or government clients. The Contractor shall utilize the TSA approved Apricorn Aegis Secure Key encrypted thumb drive when removing or transferring TSA data from the TSA Security Equipment (TSE). The Contractor shall provide an inventory of the Apricorn Aegis Secure Key encrypted thumb drives utilized in support of the contract to include make, model, and serial number.

The Contractor shall prepare and deliver the Apricorn Thumb Drive Inventory Report in accordance with the following referenced CDRL:

CDRL A017, Apricorn Thumb Drive Inventory Report

C.7.13.10 Remote Access

The Contractor remote access connection to TSA networks shall be considered a privileged arrangement for both Contractor and the Government to conduct sanctioned TSA business.

Therefore, remote access rights shall be expressly granted, in writing, by the TSA IAD.

The Contractor employee(s) remote access connection to TSA networks shall be terminated immediately for unauthorized use, at the sole discretion of TSA. The Contractor shall use his or her federal issued personal identifiable verification (PIV) badge to access TSA resources to include IT applications and physical facility.

C.7.13.11 Mandatory Public Key Infrastructure Solution

The contractor shall implement a Public Key Infrastructure (PKI) Solution for both Privileged Users and Non-Privileged Users. Privileged users are defined by NIST Special Publication 800- 53; Supplemental Guidance: Privileged roles are organization-defined roles assigned to individuals that allow those individuals to perform certain security-relevant functions that ordinary users are not authorized to perform. These privileged roles include, for example, key management, account management, network and system administration, database administration, and web administration. Non-Privileged users are defined as all other general users who are authorized to access systems connect to the TSA Government network.

mailto:TSA-Property@dhs.gov

The current approved Government Furnished Equipment (GFE) solution for Privileged User is Xceedium. Unless otherwise directed by the Contracting Officer, the contractor shall for the term of the contract require all Privileged Users to utilize the GFE Xceedium solution when accessing systems that process or store TSA data. If Xceedium solution is not currently in place or available upon contract award the contractor shall ensure their IT system access has applied the following countermeasures, until such time as the Xceedium solution is operational within the system.

• Privileged users change password every 48 hours

• Certificate verification required prior to entering user credentials

• Reduce privileged users to 2 accounts

For all Non-Privileged Users for any system processing or storing TSA data, approved PIV solutions can be found at http://www.idmanagement.gov/approved-products-list-apl. Prior to contract award, the contractor shall notify the Contracting Officer and IAD in writing of the selected PIV solution chosen to fulfill the requirement for Non Privileged Users. Unless otherwise directed by the Contracting Officer, the contractor shall for the term of the contract require all Non-Privileged Users to utilize the selected solution when accessing systems that process or store TSA data.

The Government will provide the following GFE to support the implementation of a PKI solution within the system.

• PKI Package – The PIV Package shall include Corestreet PKI software and an Active Client.

• PIV Card Readers

• Xceedium Appliance

Upon implementation of the identified PKI solutions, the contractor shall begin to electronically provide logging information near real time to the TSA SOC for all systems and users processing, storing, or accessing TSA data. The contractor shall retain records of the logging information for a period of seven (7) years after the expiration of its contract.

C.7.13.12 Interconnection Security Agreement

If the service being supplied requires a connection to a non-DHS, Contractor system, or DHS system of different sensitivity, the following shall apply:

• Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers.

• The controlled interfaces shall be accredited at the highest security level of information on the network.

• Connections with other Federal agencies shall be documented using an interagency agreement; memoranda of understanding/agreement, service level agreements or interconnection service agreements.

• ISAs shall be reissued every three (3) years or whenever any significant changes have been made to any of the interconnected systems.

http://www.idmanagement.gov/approved-products-list-apl

• ISAs shall be reviewed and updated as needed as a part of the annual FISMA self-assessment.

C.7.13.13 SBU Data Privacy and Protection

The contractor shall satisfy requirements to work with and safeguard Sensitive Security Information (SSI), Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (Sensitive PII). All support personnel shall understand and rigorously follow DHS and TSA requirements, SSI Policies and Procedures Handbook, and Privacy policies, and procedures for safeguarding SSI, PII and SPII.

The Contractor shall be responsible for the security of: i) all data that is generated by the contractor on behalf of the TSA, ii) TSA data transmitted by the contractor, and iii) TSA data otherwise stored or processed by the contractor regardless of who owns or controls the underlying systems while that data is under the contractor’s control.