RFP_HSTS05-14-R-STR003_SOW_Final.pdf

Attachment 1: SOW RFP# HSTS05-14-R-STR003 CLM-GPS Reporting Support Services

Last Modified on 8.27.2014 1

STATEMENT OF WORK

Toxic Inhalation Hazard (TIH)/Rail Security-Sensitive Material (RSSM) Railcar

Car Location Message (CLM) and Global Positioning Satellite (GPS) Reporting Support Services

1.0 Purpose

TSA requires a Contractor to provide Toxic Inhalation Hazard (TIH)/Rail Security-Sensitive Material (RSSM) railcar Car Location Message (CLM) and Global Positioning Satellite (GPS) reporting support services. Services will be provided to the TSA Office of Security Operations/Compliance Programs Division, Surface Compliance Branch, in order to identify and locate interchange frequency and locations, waybill information, TIH/RSSM routing to include shipments and destinations and reporting to meet DHS/TSA needs and requirements. This will include an interactive database and web portal for use by TSA personnel (over the life of the contract as many as 500 TSA personnel, not all simultaneously and all within OSO/SCB/OSPIE) to monitor the risk associated with the freight rail transportation of RSSM shipments, as well as create or allow for the creation of reports for forecasting inspection and assessment processes.

As a result of the expiration of the TIHRRVS Task Order, the TSA and Surface Compliance Branch is seeking to contract with an entity that can provide the required data services and reporting. The Office of Security Policy and Industry Engagement will also utilize the data provided by the contractor to meet their specific Congressional and OMB reporting requirements. The means by which TSA will access the data will be via secure web portal, HTML Files, PDF, Excel as well as having the various report requirements deliverable via email through Outlook. The ability to receive data and reports via mobile cellular smart phone will significantly increase the effectiveness and efficiency of the Surface Inspector work force.

1.1 Scope of Service

The Office of Security Operations (OSO), Compliance Programs Division,Surface Compliance Branch (SCB) is interested in establishing pricing criteria with a vendor that can provide specific data with regard to railcar information using car location messages (CLMs) and global positioning satellite (GPS) data within five (5) calendar days of contract award. CLMs alone are much less accurate, as rail cars often take a circuitious route and may change trains between pick up and destination locations.

CLMs are reported at the discretion of each individual railroad, each with varying frequencies that can often result in significant reporting gaps , whereas GPS “pings” are received, on average, every four hours, making inspection and assessment scheduling much easier and far more accurate. *See Deliverables listed in Section 2.0, Technical Requirements* for additional information on requirements.*

1.2 Mission

The Office of Security Operations, Compliance Programs Division, Surface Compliance Branch (SCB) is tasked with utilizing an automated system that collects, collates, organizes and otherwise manages railcar location data for SSM shipments. This system must be accessible by TSA personnel from both headquarters and field locations. The system will be accessed by

Surface Compliance Branch staff, Transportation Security Inspectors-Surface (TSI-S) within OSO and the Office of Security

Policy and Industry Engagement (OSPIE) Freight Rail Division staff.

Last Modified on 8.27.2014 2

The Compliance Programs Division, Surface Compliance Branch (SCB) plans, develops, coordinates and administers the TSA nationwide Surface Transportation Security Inspection and Assessment Programs. The SCB is responsible for developing inspection and assessment processes, issuing guidance as necessary, and enabling and assisting various TSA inspectors with effective and competent databases and reporting mechanisms in order to efficiently carry-out the Agency’s surface transportation security and assessment mission.

To objectively measure the level of risk associated with the transportation of TIH materials through HTUAs, TSA utilizes a formula that accounts for the following variables: railcar dwell time, railcar attendance, HTUA value, and population proximity factor. These factors make up the threat, vulnerability, and consequence components of the security risk evaluation. By calculating this risk, TSA is able to measure and develop metrics that allow the Department to evaluate the national risk reduction in freight rail transportation of TIH.

This measurement of national surface transportation security has been identified by the Office of Management and Budget (OMB) as a primary measure of transportation security improvement. As such, the metric is reported as a management measure as part of the Strategic Context of the Congressional Justification. The TIH Risk Reduction Program will continue to be monitored. TSA is required to report program status to OMB.

1.3 Background

The TIHRRVS program was established to accommodate the needs of the RRS program as well as the requirements under 49 CFR 1580. TSNM (now OSPIE) initially conducted manual data analysis on the survey results submitted by Surface TSIs. The location of rail cars, for both TIH and Rail Sensitive Security materials (RSSM), was important for the proper identification and monitoring to ensure regulatory compliance and to ensure the TIH cars were properly attended.

TSA Surface Inspectors conduct the inspections and surveys and report their findings in an internal database known as PARIS.

Data analysis is conducted and the results are provided to DHS. Prior to the use of the TIHRRVS, Surface TSIs often spent many hours either looking for rail cars or waiting for the cars to arrive. In short, it was an extremely inefficient process.The Transportation of Security-Sensitive Materials1 (SSM), which includes materials that are classified as Toxic Inhalation Hazards (TIH), has been identified as a significant security vulnerability in freight rail transportation.

In 2006, Secretary Chertoff acknowledged this vulnerability and tasked TSA with developing a program that would objectively measure the risk associated with the transportation of TIH materials through High Threat Urban Areas (HTUA). Working with freight rail industry stakeholders, TSA crafted a mechanism to measure the amount of time that TIH shipments were physically located in and transiting through the HTUAS. The period of time that railcars are in a particular area is referred to in the industry as “dwell time.” For the purpose of this project, TSA will measure the dwell time of SSM shipments within HTUAs.

On June 23rd, 2006, DHS through TSA issued 24 Security Action Items (SAIs) focusing on security practices at the field level that would provide a measurable reduction in the risk posed by the transportation (by rail) of bulk Toxic Inhalation Materials in High Threat Urban Areas. On November 21, 2006, DHS issued three additional voluntary guidelines, which were called supplemental security action items, augmenting the previously issued 24 SAIs. This became known as the Risk Reduction Survey Program. This program has been extended through 2015.

In March 2007, TSA contracted with an outside vendor to obtain dwell time information on TIH loaded bulk containers in 46 HTUAs. TSA received a one-year baseline report, June 1, 2005 to May 31, 2006, detailing the movement of TIH shipments through HTUAs; follow up monthly and quarterly reports; and a web based application that provided passive tracking of loaded bulk SSM shipments.

In June of 2008, TSA began development of the TIH Risk Reduction Verification System (TIH RRVS). The TIH RRVS was a centrally monitored internet application that provided an inventory of SSM shipments in all TSA designated

1 Security-Sensitive Material is for the purposes of freight rail transportation is a material transported in bulk quantities that falls into one or more of the following classifications: Material poisonous by inhalation (TIH) as defined in CFR 49 Part 171.8;

Explosives Division 1.1, 1.2 and 1.3; and Highway Route Controlled Quantity of radioactive material.

Last Modified on 8.27.2014 3

HTUAs in CONUS. The system processed and displayed car movement data as reported by rail carriers. TIH RRVS calculated dwell times and the corresponding risk associated with the freight rail transportation of SSMs. The TIH RRVS was hosted on the TSA’s Operating Platform (TOP).

The TIHRRVS expired in December, 2013. The TIHRRVS offered the Surface Compliance Branch with the ability to loosely forecast these types of assessments and inspections, thereby reducing the ineffeciencies associated with waiting for a railcar to show up, as times can vary widely. The TIHRRS provided the last reported location tracking of RSSM/TIH shipments, both inside and outside of HTUA’s. This provided the inspectors with inspection intelligence, enabling accurate planning of work and assessment activities. Additionally, since TIHRRVS supported the TIH Risk Reduction Program, the results were reported as one of the TSA Management Measures.

2.0 Technical Requirements

The Contractor shall possess the ability to show the average number of cars at a particular rail yard by date and time. This greatly increases inspection efficiency and effectiveness as the inspectors will know approximately when TIH or RSSM cars will arrive, when the railyard generally has regulated cars in their yards, how many, etc.

2.1 Deliverables

# Deliverable Due Date/ Frequency

Deliverable Recipient (include contact information

Deliver-able Format

Reference

1 Provide availability of CLM and GPS data for TIH/RSSM rail cars both within the United States and forecast the TIH/RSSM scheduled/positioned to enter United States.

As needed by the

SCB

TBA at time of award Web format

(HTML), PDF,

Excel and Google Earth formats where requested

2 Specific historical and forecast reports deliverable through a secure web portal and secure email system utilizing last reported CLM and GPS data of TIH/RSSM rail cars.

As needed by the

SCB

TBA at time of award Web format

(HTML), PDF,

Excel and Google Earth

3 Secure web based portal must be accessible to authorized users and allow for user generated historical and forecast TIH/RSSM rail car outputs by sorting on varying data fields.

o Data fields include, but are not limited to:

State(s), AOR(s), HTUA(s), Railroads(s), Receiver(s), Shipper(s) Interchange Location(s), Date Range, Cars in AOR Originating or Terminating within AOR, Overhead or Through TIH/RSSM Cars Inside or Outside AOR, Terminating Standardized AOR specific reports that can be generated via web based portal or delivered by request through secure email system.

o TIH/RSSM cars enroute to AOR or HTUA.

o Ability for users to query specific

TIH/RSSM rail car(s) history and forecast data o TIH/RSSM rail car data must include:

Contents, Railroad, Railcar ID, Waybill #,Origin, Ship Date, Last Reported Location, Next Forecasted Event, Current Status, Destination Location (name and location of interchange to railroad or receiver), Destination ETA, Timestamp.

Origination AOR/HTUA, Destination

Daily as needed by the SCB and Surface Field TSIs

TBA at time of award Standardized AOR specific reports that can be generated via web based portal or delivered by request through secure email system.

Last Modified on 8.27.2014 4

AOR/HTUA, Last AOR/HTUA and current

AOR/HTUA.

o All interchange data must include:

Railroad(s) name and Shipper/Receiver Name. Default GPS Standardized AOR specific reports that can be generated via web based portal or delivered by request through secure email system.

o Coordinate assigned to individual interchange locations to plot the location of interchange in Google Earth. Reports available with customizable date ranges and data fields.

4 Ability to provide routing analysis based on CLM/GPS data points and proximate population.

Daily as needed by the SCB and Surface Field TSIs

TBA at time of award Web format

(HTML), PDF,

Excel and Google Earth

5 Ability to perform external GPS Data Collection and to identify mismatches between railcars and GPS devices.

Daily as needed by the SCB

TBA at time of award Web format

(HTML), PDF,

Excel and Google Earth

6 Able to create Specific and customizable data output

–All rail car data must include: Railroad name (carrier), GPS, CLM, Car Number, car location history and forecast information when available.

Daily as needed TBA at time of award Web format

(HTML), PDF,

Excel and Google Earth

7 The selected vendor will have Google Earth proficiency to graphically display real-time locations of all TIH/RSSM shipments through compatible Google Earth files. Able to track inbound and outbound TIH from international railroad carriers as well as domestic Class I railroads.

Daily as needed by the SCB and Surface Field TSIs

TBA at time of award Customizable data display upon viewing in Google Earth.

8 Provide geo-fenced areas in Google Earth of HTUAs, Rail Yards within HTUAs, RSSM Shipper/Receiver facilities, and Surface Office AORs.

File should be updated semi-annually.

TBA at time of award Customizable data display upon viewing in Google Earth.

9 Provide a quarterly Dwell-time Calculation model on all TIH rail shipments transiting CONUS with a focus on the HTUAs o Data will include dwell hours and shipment counts o Breakdown of dwell hours by rail carrier and time categories o Ability to calculate the dwell time for any quarterly period; compare that dwell time to any quarterly period or a specific date range o Create, recreate or produce report extracts for the entire period of the TIH Risk Reduction Verification Process (not exceed12x per year)

Quarterly TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or Google Earth format.

Detail reports addressing:

*National Interchange reports, with data refreshed weekly, providing location and shipping information of specific RSSM interchanges between Carrier-Carrier, Carrier to Receiver and Shipper to Carrier. Customizable date ranges, customizable locations and customizable data fields. Separate Carrier to Carrier, Carrier to Receiver and Shipper to Carrier with specific location of each RSSM interchange over customized date

Generate a monthly, quarterly and/or annual report. Data refreshed weekly.

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital

Last Modified on 8.27.2014 5 range.

*RSSM Carrier to Carrier Interchange Locations by HTUA or Outside HTUA (OZ) in customizable date ranges.

Displaying: Location, Surface Office AOR, Railroads interchanging, Number of Interchanges, Number of RSSM railcars, and the percentage of interchanges that subsequently transited an HTUA. Available in web format (HTML), PDF, Excel and Google Earth formats.

*RSSM Carrier to Carrier Interchange Locations by Surface Office Area of Responsibility (AOR) in customizable date ranges. Displaying: Location, HTUA or OZ, Railroads interchanging, Number of Interchanges, Number of RSSM railcars, and the percentage of interchanges that subsequently transited an HTUA.

*RSSM Carrier to Carrier Interchange Locations that are not covered by 1580.107 due to cars not subsequently transiting an HTUA in customizable date ranges. Displaying: Location, Surface Office AOR, Railroads, Number of Interchanges, Number of RSSM railcars.

*RSSM Carrier to Receiver Locations in customizable date ranges sorted by HTUA. Displaying HTUA, Location, Surface Office AOR, Railroad, Receiver Name with GPS Coordinates available for Google Earth File, Number of Interchanges, Number of RSSM Railcars interchanged

*RSSM Carrier to Receiver Locations in customizable date ranges sorted by Surface Office AORs. Displaying Surface Office Name, HTUA, Location, Railroad, Receiver Name with GPS Coordinates available for Google Earth File, Number of Interchanges, Number of RSSM Railcars interchanged

*RSSM Carrier to Receiver Locations in customizable date ranges sorted by Surface Office AOR for interchanges outside of the regulated HTUAs. Displaying Surface Office Name, Location, Railroad, Receiver Name with GPS Coordinates available for Google Earth File, Number of Interchanges, Number of RSSM Railcars interchanged.

*RSSM Shipper to Freight Rail Carrier Locations in customizable date ranges sorted by HTUA with those shipments outside of HTUA also being displayed in an outside zone section.

Displaying HTUA, Surface Office Name, Location, Shipper Name with GPS Coordinates utilized for Google Earth File, Number of Interchanges, Number of Railcars interchanged. .

*RSSM Shipper to Freight Rail Carrier Locations in customizable date ranges sorted by Surface Office AOR.

Displaying HTUA or OZ, Surface Office Name, Location, Shipper Name with GPS Coordinates utilized for Google Earth File, Number of Interchanges, Number of Railcars interchanged.

*1580.107 Summary Report in customizable date ranges displaying number of Interchange Locations, Number of Interchange Occurrences and Number of RSSM Rail Cars interchanged by the different classifications.

*Charts of consolidated 1580.107 RSSM Chain of Custody Events utilizing variable data in customizable data ranges.

*1580.107 Summary Reports by each Class 1 Railroad.

*1580.107 Summary Reports customizable by each Surface Office of Region.

*Generate a monthly, quarterly and/or annual report that will aid the SCB in determining High Risk and Low Risk rail yards based on TIH throughput vs. population density surrounding the

File format (PDF), and/or

Last Modified on 8.27.2014 6

TIH rail yard.

Generate a national, regional and HTUA report that reflects a baseline for RSSM interchanges. The SCB would like to understand the % witnessed interchanges against total national, regional and HTUA actual interchanged

11 Maintain a table of all commodity codes reported by rail carriers and via GPS reporting

Maintain and validate all CLM-reported locations and update daily with related location attributes

Reports customizable to specific Areas of Responsibility or Operation (AORs)

Reports customizable to specific railroad entities.

Validate railcar reporting marks against UMLER/OER reference data

Validate railcar reported SCAC codes against ORG and other sources

Validate reported events against the status of events against a master table of valid CLM event codes

Validate route element of waybill data vs. the actual movement of a railcar, particularly with respect to interchanges

Determine Standard Location based on GPS coordinates

Interactive website enables customizable reports based on users search criteria.

Daily as needed by the SCB and Surface Field TSIs

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

12 TIH Reports must include the following capabilities:

o Provide last reported location of all TIH/RSSM cars within specified Areas of Responsibility or Operation (AORs) including a full national report.

o Provide TIH/RSSM forecasting reports for specified AORs.

o Provide real time tracking of individual TIH/RSSM rail cars o Provide alert messages of individual TIH/RSSM rail cars as requested/needed, delivered through email and formatted for mobile devices.

o Ability to create real time and forecasting reports utilizing last reported CLM and GPS data of TIH/RSSM rail cars.

o Specific and customizable data output deliverable through a secure email system and secure web portal.

Daily as needed by the SCB and Surface Field TSIs

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

13 Establish and manage Customer Support Services:

o Provide this service to answer questions about the data received by TSI-Surface personnel and HQs staff.

o The Customer Support Services to establish and maintain a ticket system for tracking all correspondences.

o Data/information gleaned from the ticket system to be used as a FAQ and published on the SCBs iShare for field reference

Daily as needed by the SCB and Surface Field TSIs

TBA at time of award The Customer Support Services must be staffed Mon- Fri, Holidays excluded, from 0600 hrs. EST to 2200 hrs.

EST. Hours of operation may be discussed to reduce or increase availability as operational needs are established.

The Customer Support Services will

Last Modified on 8.27.2014 7 have phone and email response capability, as well as the capability to send/receive, messages or requests for assistance, as appropriate.

14 Resolve discrepancies in rail car reporting between and among the multiple carriers handling SSM shipments.

Upon notification of discrepancy or when identified

TBA at time of award Email, Excel or

PDF

15 Daily data “scrubbing” functions to maintain data integrity at prescribed levels.

Daily TBA at time of award

16 Provide continual updated guidance documents for all users.

o Step by step instructions that TSA’s SCB can post on iShare and update as necessary

As systemic changes are made, or additional reporting capabilities identified.

TBA at time of award Email, Excel or

PDF

17 Provide system training for all users via webinar and/or web based training.

Contractor to develop and facilitate the training for all users.

Upon being awarded the contract and implementation of the services.

TBA at time of award Via Webinar and/or Web Computer based training

OSPIE Quarterly Requirements

18 Cumulative National and unique Class I carrier scorecards.

Scorecards will include and contrast dwell time by 46 HTUA’s-A for current time period against correlating time period in FY 2009

Quarterly TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

19 Report listing all carriers that transport RSSM in or through one or more HTUA-A

Quarterly TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

20 Report listing the number of unique RSSM shipments

By State

By HTUA-A

By HTUA-A & B

Quarterly TBA at time of award Deliverable through a secure interactive

Last Modified on 8.27.2014 8 website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or Google Earth format.

21 Report listing dwell hours by State Quarterly TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

22 Report listing dwell hours by STCC within HTUA’s-A Quarterly TBA at time of award Deliverable secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

23 Top 50 Segments-loaded shipment hours by Transit Segment and Time Category

Quarterly TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

24 Calculate Dwell Time by 46 HTUA-A and by all Class I carriers Quarterly TBA at time of award Deliverable secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital

Last Modified on 8.27.2014 9

File format (PDF), and/or Google Earth format.

**OSPIE Data readily available, not to exceed 12 requests per year.

25 RSSM Loaded Shipment Hours by Transit Segments and Time

Category within HTUA's by Descending Hours

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

26 Loaded Rail Shipment Hours by Transit Segment and Time

Category within HTUA's By Commodity

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

27 RSSM Loaded Rail Shipment Hours by Transit Segment and

Time Category by HTUA

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

RSSM Loaded Rail Shipment Hours by HTUA and Railroad

RSSM Loaded Rail Shipment Hours by HTUA

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

Last Modified on 8.27.2014 10

29 RSSM Loaded Rail Shipment Hours by Road Data available, requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

30 RSSM Loaded Rail Shipment Hours by Road - Segments

To/From Class I Railroads

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

31 RSSM Loaded Rail Shipment Hours by “From” Road Data available, requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

32 RSSM Loaded Rail Shipment Hours by Class I Road Data available, requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

33 Top 50 HTUA Segments –Nationally, within HTUA, RSSM

Loaded Shipment Hours by Transit Segment and Time Category

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

Last Modified on 8.27.2014 11

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or Google Earth format.

34 RSSM Loaded Rail Shipment Hours by HTUA and OZ, Time

Period Comparison

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

35 RSSM Loaded Rail Shipment Hours – HTUA’s Only- Time

Period Comparison

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

36 RSSM Loaded Rail Shipment Hours by HTUA and Road - Time

Period Comparison

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

37 RSSM Loaded Rail Shipment Hours by State - Time Period

Comparison requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

Last Modified on 8.27.2014 12

RSSM Loaded Rail Shipment Hours by STCC (TIH Commodity)

- Time Period Comparison requests per year for OSPIE

TBA at time of award Deliverable through a secure interactive website or dashboard.

Reportable in

HTML,

Microsoft Excel®, Portable Digital File format (PDF), and/or

39 HTUA_SUMMARY_SORT – Specialty formatted Excel data output for TSA

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Specialty formatted Excel data output for

TSA

40 HTUA_SUMMARY_SORT_ROAD – Specialty formatted Excel data output for TSA

Data available, not to exceed 12 requests per year for OSPIE

TBA at time of award Specialty formatted Excel data output for

TSA

3.0 Special Delivery Instructions

TSA is a Microsoft based environment for office productivity tools. Document deliveries must be in a Microsoft format (where applicable) or as specified in section IV Deliverables table.

4.0 Period of Performance

The period of performance shall consist of a base period of twelve (12) months from date of award, and four (4) twelve-month option periods. The contract shall end in 2019.

5.0 Place of Performance & Travel

Work performance shall be performed at the Contractor’s facilities.

Out of town travel will be not required by the Contractor to accomplish the work contained herein. Any approved travel shall be in accordance with the Federal Travel Regulations (FTR). Local commuting miles will not be reimbursed.

6.0 Special Requirements

Application Support Transition (v1.0 10/26/2009)

This section does not apply.

Section 508 of the Rehabilitation Act Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology, they must ensure that it is accessible to people with disabilities.

Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable standards have been identified:

Last Modified on 8.27.2014 13

36 CFR 1194.21 – Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36 CFR 1194.22.

36 CFR 1194.22 – Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous JavaScript and XML (AJAX) then “1194.21 Software” standards also apply to fulfill functional performance criteria.

36 CFR 1194.24 – Video and Multimedia Products, applies to all video and multimedia products that are procured or developed under this work statement. Any video or multimedia presentation shall also comply with the software standards (1194.21) when the presentation is through the use of a Web or Software application interface having user controls available.

36 CFR 1194.31 – Functional Performance Criteria applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 – Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required “1194.31 Functional Performance Criteria”, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COR and determination will be made in accordance with DHS MD 4010.2.

DHS has identified the following exceptions that may apply:

36 CFR 1194.2(b) – (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards.

When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires approval from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS MD 4010.2.

36 CFR 1194.3(b) – Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

All tasks for testing of functional and/or technical requirements must include specific testing for Section 508 compliance, and must use DHS Office of Accessible Systems and Technology approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov.

DHS Enterprise Architecture Compliance Clause All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security Enterprise Architecture (HLS EA) requirements:

BLOCKED::mailto:accessibility@dhs.gov

Last Modified on 8.27.2014 14

All developed solutions and requirements shall be compliant with the HLS EA.

All IT hardware and/or software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

In compliance with OMB mandates, all network hardware shall be IPv6 compatible without modification, upgrade, or replacement.

CONFIGURATION MANAGEMENT

This section does not apply.

Risk Management Framework

The Security Authorization Process in accordance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 and SP 800-137 (current versions) and the DHS Performance Plan, for unclassified systems, or the Department of Defense (DoD) Information Assurance Certification and Accreditation Process (DIACAP) for classified systems, is a requirement for TSA information systems, including general support systems (e.g., standard TSA desktop, general network infrastructure, electronic mail, etc.), major applications and development systems (if connected to the operational network or processing, storing, or transmitting government data). These processes are documented in the NIST Risk Management Framework. Ongoing Authorization is part of Step 6 “Monitoring” of the Risk Management Framework. All NIST and DIACAP guidance are publicly available; TSA and DHS security policy is disclosed upon contract award. A written authority to operate (ATO), granted by the TSA Authorizing Official (AO), is required prior to processing operational data or connecting to any TSA network. The contractor shall provide all necessary system information for the security authorization effort.

The Security Authorization Package contains documentation required for Security Authorizations and Ongoing Authorization. The package shall contain the following security documentation: 1) Security Assessment Report (SAR) 2) Security Plan (SP) or System Security Authorization Agreement (SSAA), 3) Contingency Plan, 4) Contingency Plan Test Results, 5) Federal Information Processing Standards (FIPS) 199 Security Categorization, 6) Privacy Threshold Analysis (PTA), 7) E-Authentication,

8) Security Assessment Plan (SAP), 9)Authorization to Operate (ATO) Letter, 10) Plan of Action and Milestones (POA&M), and

11) Ongoing Authorization Artifacts as required by the DHS Ongoing Authorization Methodology (current version). The SA package shall document the specific procedures, training, and accountability measures in place for systems that process personally identifiable information (PII). All security compliance documents will be reviewed and approved by the Chief Information Security Officer (CISO) and the Information Assurance and Cyber Security Division (IAD), and accepted by the Contracting Officer upon creation and after any subsequent changes, before they go into effect.

The Contractor shall comply with requests to be audited and provide responses within three business days to requests for data, information, and analysis from the TSA Information Assurance and Cyber Security Division (IAD) and management, as directed by the Contracting Officer.

6.1 Requirements for Handling Sensitive, Classified, and/or Proprietary Information

This procurement request shall comply with applicable security requirements as stated in DHS MD 4300 and TSA MD 1400.3, IT Security Policy Handbook and Technical Standards.

The Contractor must satisfy requirements to work with and safeguard SSI. All support personnel must understand and rigorously follow DHS and TSA requirements, policies and procedures for safeguarding SSI.

Last Modified on 8.27.2014 15

Contractors shall complete SSI, Information Security and IT Security Awareness courses. All Contractor employees shall receive TSA IT Security Awareness Training within 60 days of assignment to the contract. Refresher training must be completed annually thereafter.

The Contractor shall ensure that its employees follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, good business practices, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract.

Data Security

The Contractor shall be responsible for the security of: i) all data that is generated by the contractor on behalf of the TSA, ii) TSA data transmitted by the contractor, and iii) TSA data otherwise stored or processed by the contractor, regardless of who owns or controls the underlying systems while that data is under the contractor’s control. All TSA data, including but not limited to PII, sensitive security information (SSI), sensitive but unclassified (SBU), and critical infrastructure information (CII), shall be protected according to DHS and TSA security policies and mandates.

At the expiration of the contract, the contractor shall return all TSA information and IT resources provided to the contractor during the contract, and provide a certification that all assets containing or used to process TSA information have been sanitized or destroyed in accordance with TSA Management Directive (MD) 1400.3 Information Technology Security Policy, related TSA Information Assurance Handbook and Technical Standards. The contractor will certify in writing that sanitization or destruction has been performed. Sanitation and destruction methods are outlined in the NIST Special Publication 800-88 Guidelines for Media Sanitization. The contractor shall email signed proof of sanitization to the COTR. In addition, the contractor shall provide a master asset inventory list that reflects all assets, government furnished equipment (GFE) or non-GFE that were used to process TSA information.

Information Assurance Policy

The Contractor shall ensure that its employees follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, good business practices, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract. Personnel will be responsible for the physical security of their area and government furnished equipment (GFE issued to them under the provisions of the contract.

The Contractor solution shall follow all current versions of TSA and DHS policies, procedures, guidelines, and standards including, but not limited to:

DHS Sensitive Systems Policy Directive (PD) 4300A

DHS 4300A Sensitive Systems Handbook

DHS National Security Systems Policy Directive (PD) 4300B

DHS 4300B National Security Systems Handbook·

TSA MD 1400.3 Information Technology Security Policy

TSA Information Assurance Handbook

TSA Technical Standards

DHS IT Security Architecture Guidance Volumes 1, 2 and 3

DHS/TSA Systems Engineering Lifecycle (SELC)

DHS Performance Plan (current fiscal year)

DHS Ongoing Authorization Methodology (current version)

OMB M-10-28, M-14-03

Security Requirements For Unclassified Information Technology Resources (HSAR 3052.204-70) (JUN 2006) (If required for a Task Order)

Last Modified on 8.27.2014 16

This section does not apply, as the contractor will not have access to any DHS or TSA IT systems.

SECURITY OF SYSTEMS HANDLING PERSONALLY IDENTIFIABLE INFORMATION AND PRIVACY INCIDENT REPONSE

(a) Definitions.

“Breach” (may be used interchangeably with “Privacy Incident’) as used in this clause means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, in usable form whether physical or electronic.

“Personally Identifiable Information (PII)” as used in this clause means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States.

Examples of PII include: name, date of birth, mailing address, telephone number, Social Security Number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), Internet protocol addresses, biometric identifiers (e.g., fingerprints), photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Personally Identifiable Information (Sensitive PII)” as used in this clause is a subset of Personally Identifiable Information, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Complete social security numbers (SSN), alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered Sensitive PII even if they are not coupled with additional PII. Additional examples include any groupings of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(1) Driver’s license number, passport number, or truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Financial information such as account numbers or Electronic Funds Transfer Information

(5) Medical Information

(6) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other Personally Identifiable information may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains Personally Identifiable Information but it is not sensitive.

(b) Systems Access. Work to be performed under this contract requires the handling of Sensitive PII. The contractor shall provide the Government access to, and information regarding systems the contractor operates on behalf of the Government under this contract, when requested by the Government, as part of its responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent validation testing of controls, system penetration testing by the Government, Federal Information Security Management Act (FISMA) data reviews, and access by agency Inspectors General for its reviews.

(c) Systems Security. In performing its duties related to management, operation, and/or access of systems containing Sensitive PII under this contract, the contractor, its employees and subcontractors shall comply with applicable security requirements described in DHS Sensitive System Publication 4300A or any replacement publication and rules of conduct as described in TSA

MD 3700.4

Last Modified on 8.27.2014 17

In addition, use of contractor-owned laptops or other media storage devices to process or store PII is prohibited under this contract until the contractor provides, and the contracting officer in coordination with CISO approves, written certification by the contractor that the following requirements are met:

(1) Laptops employ encryption using a NIST Federal Information Processing Standard (FIPS) 140-2 or successor approved product;

(2) The contractor has developed and implemented a process to ensure that security and other applications software are kept current;

(3) Mobile computing devices utilize anti-viral software and a host-based firewall mechanism;

(4) When no longer needed, all removable media and laptop hard drives shall be processed (i.e., sanitized, degaussed, or destroyed) in accordance with DHS security requirements.

(5) The contractor shall maintain an accurate inventory of devices used in the performance of this contract;

(6) Contractor employee annual training and rules of conduct/behavior shall be developed, conducted/issued, and acknowledged by employees in writing. Training and rules of conduct shall address at minimum:

(i) Authorized and official use;

(ii) Prohibition against use of personally-owned equipment to process, access, or store Sensitive PII;

(iii) Prohibition against access by unauthorized users and unauthorized use by authorized users; and

(iv) Protection of Sensitive PII;

(7) All Sensitive PII obtained under this contract shall be removed from contractor-owned information technology assets upon termination or expiration of contractor work. Removal must be accomplished in accordance with DHS Sensitive System Publication 4300A, which the contracting officer will provide upon request. Certification of data removal will be performed by the contractor’s Project Manager and written notification confirming certification will be delivered to the contracting officer within 15 days of termination/expiration of contractor work.

(d) Data Security. Contractor shall limit access to the data covered by this clause to those employees and subcontractors who require the information in order to perform their official duties under this contract. The contractor, contractor employees, and subcontractors must physically secure Sensitive PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. When Sensitive PII is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed through means that will make the Sensitive PII irretrievable.

The contractor shall only use Sensitive PII obtained under this contract for purposes of the contract, and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall turn over all Sensitive PII obtained under the contract that is in its possession to the Government.

(e) Breach Response. The contractor agrees that in the event of any actual or suspected breach of Sensitive PII (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), it shall immediately, and in no event later than one hour of discovery, report the breach to the contracting officer, the Contracting Officer’s Technical Representative (COTR), and the TSA Director of Privacy Policy & Compliance (TSAprivacy@dhs.gov). The contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government parties.

Last Modified on 8.27.2014 18

(f) Personally Identifiable Information Notification Requirement. The contractor has in place procedures and the capability to promptly notify any individual whose Sensitive PII was, or is reasonably believed to have been, breached, as determined appropriate.