Draft SOW Passenger Self Screening.pdf

Passenger Self-Screening Solution Draft Statement of Work

DEPARTMENT OF HOMELAND SECURITY (DHS)

STATEMENT OF WORK (SOW)

FOR

Passenger Self-Screening Systems for Aviation Checkpoint

1.0 GENERAL

1.1 BACKGROUND

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) Apex Screening at Speed (SaS) program pursues transformative research and development (R&D) activities that support a future vision for increasing aviation security effectiveness from curb to gate while dramatically reducing wait times and improving the passenger experience. To enable this vision, Apex SaS, in conjunction with the Transportation Security Administration’s (TSA’s) Innovation Task Force, is considering the development of a passenger self-screening solution to transform the TSA Pre® screening experience and concept of operations (CONOPS).

In a similar fashion to self-checkout at grocery stores, self-tagging checked baggage, or ATM machines, many patrons prefer an experience that they can complete without assistance and at their own pace. Development of personal self-service screening stations would allow for a reimagining of traditional checkpoint layouts and could result in increased overall passenger screening throughput capability. Apex SaS and TSA are exploring ideas to bring self-service concepts to the passenger screening process. Apex SaS would like to collaborate with stakeholders to develop a solution that would:

• Enable a self-sufficient checkpoint security screening process that improves the TSA Pre® passenger experience

• Allow for passenger on-person screening and divestment of personal property into a property screening system to occur in a single step, compared to the two distinct steps that exist at airports today

• Enable passengers to directly receive on-person alarm information while divesting, and allow for the passenger self-resolution of alarms through continued divestment to reduce instances where a pat-down/secondary screening procedure would be necessary

• Enable passengers to directly receive certain in-property alarm information after their items are submitted for screening, and allow for passenger self-resolution of alarms through the repositioning of items and/or abandonment of prohibited items (followed by subsequent resubmission of property for screening) to reduce instances where a bag search/secondary screening procedure would be necessary

• Allow passengers to complete the screening process more quickly

• Maintain or improve the current security posture at the airport checkpoint

This effort seeks to rapidly develop a solution to detect weapons and organic threat items hidden on passengers without the same level of Transportation Security Officer (TSO) engagement normally present in the screening process. The solution would be configured with an integrated person and property screening systems, so that a passenger may be screened while they complete the divestiture process for inspection of their accessible property. A successful solution would lead to a passenger friendly, intuitive screening process while improving security, accelerating passenger throughput, and reducing pat-down rates.

1.2 SCOPE

This effort includes the systems engineering, design, development and integration of hardware, software, interfaces, and human systems to implement a passenger-self screening concept. This effort uses a phased approach to develop requirements, monitor progress, and reduce technical risk in a methodical way. If all options are exercised, the final result is the delivery of several field ready prototypes for operational test and evaluation.

1.3 OBJECTIVE

This effort seeks to develop a comprehensive screening solution capable of utilizing the natural motion of the divesting passenger to achieve thorough inspection for concealed items and provide near real-time feedback to the passenger if additional divestiture is necessary. The passenger will only be allowed to leave the divestiture station if they have been cleared by this solution. In instances where an alarm cannot be resolved through passenger divestment, a TSO may be necessary to adjudicate any unresolved alarms.

1.4 APPLICABLE DOCUMENTS

Reference any documents (include date and version) that pertain to the requirement and are necessary for the contractor to perform the contract. If only portions of a document apply, be sure to clearly state the applicable portion(s). Also be sure to cite the document properly using conventional citation formats for statutes, regulations, etc. Be sure to attach, link, or otherwise make the required documents available to contractors.

1.4.1 Compliance Documents

The following documents provide specifications, standards, or guidelines that must be complied with in order to meet the requirements of this contract:

TBD

1.4.2 Reference Documents

The following documents may be helpful to the Contractor in performing the work described in this document:

2.0 SPECIFIC REQUIREMENTS/TASKS

TASK ONE. PROGRAM MANAGEMENT

The contractor shall be responsible for project management activities that include: technical direction of the project; program direction and task execution; partner company interface;

file://hqnas/SHARED/G-A/G-ACS/CAAT%20Team/TOOLBOX/SCOPE%20PARAGRAPHS.doc interaction with DHS S&T; resource planning and assignment; data and records management;

risk mitigation and planning; compliance management; and security management. The contractor shall coordinate among hardware, algorithm, and software teams. The contractor shall develop solutions and/or mitigations to address emerging issues.

For all formal meetings with DHS S&T, the contractor shall submit a meeting agenda and briefing package to the Contracting Officer’s Representative (COR). The meeting agenda and draft briefing package shall be provided at least three (3) business days prior to the meeting. The contractor shall submit the final briefing package (including meeting minutes) no later than five

(5) business days after execution of the meeting.

SUBTASK 1.1 Kickoff Meeting A post-award kick-off review shall be held within 30 days of contract award. This formal meeting will address: Project overview; Data Collection & Test overview; Team Organization and Key Personnel; Program Schedule; SOW overview; and, System Concept Review (including an overview of the subsystem performance objectives, initial design concept, development strategy and risk identification and mitigation planning). In addition to the agenda, briefing packages, and minutes, the contractor shall provide a One-Page Non-Proprietary Program Summary Sheet, and a Non-Proprietary Quad Chart in accord with DHS S&T instructions/templates.

SUBTASK 1.2 Monthly Status Report Reports of project status shall be required on a monthly basis. A template of the Monthly Status Report shall be provided to the contractor upon contract award. These reports shall be electronically submitted to the program manager within five working days after the last day of each month. The Monthly Status Report Templates provide a standardized format to collect the following information at a minimum:

Static information (information that does not change monthly over the project):

• Project Title and Contract Number

• Period of performance

• Principal investigator’s name, telephone number, e-mail and unclassified/secure facsimile number(s)

• Contractor’s financial contact name and telephone number

Monthly update Information to be provided in bulleted or short narrative format:

• Activity during the previous reporting period

• Progress achieved against project milestones, tasks, and deliverable(s) during reporting period

• Noteworthy accomplishments (e.g. meetings, presentations, publications, patent filings, etc.)

• Risk Register, Topics of concern/slippage (technical, schedule and/or cost) and recovery plan

• Explicit plans for the upcoming month

• Project budget information, including funds expended by category, significant material purchases, and obligated funds remaining

SUBTASK 1.3 Monthly Teleconference The contractor shall conduct an informal teleconference with the COR to discuss the monthly report and other matters as deemed appropriate, three working days after delivery of the monthly report (subject to COR availability). The contractor shall document any new COR directions that result (e.g., in an email).

SUBTASK 1.4 End of Period Summary The contractor shall provide an End of Period report for the base period and each option period (if exercised) to the DHS S&T COR outlining program progress and expectations for the upcoming contract period.

BASE PERIOD

TASK TWO. SYSTEM CONCEPT

SUBTASK 2.1 Systems Requirements The contractor shall develop and deliver requirements documentation for the passenger self-screening solution. The requirements documents shall include systems level requirements as well as electrical, mechanical, human-interface, software, and cybersecurity requirements.

SUBTASK 2.2 System Concept The contractor shall develop a system concept for the passenger self-screening solution. The contractor shall meet with DHS S&T and other stakeholders to understand the desired CONOPS, and to solicit design feedback and requirements which will feed into the design specification.

The contractor shall conduct the required analysis, trade studies, and evaluations to assess the technical feasibility of its high-level system concept and its ability to meet the system requirements. The solution shall include:

• Specific details for the sensing modalities

• CONOPS

• Anticipated size, weight, and power requirements

• Anticipated passenger throughput

• Anticipated staffing requirements

• Areas of particular technical risks

SUBTASK 2.3 System Concept Review Upon compoletion of the system concept, the contractor shall conduct a system concept review (SCR) with DHS S&T covering all aspects of the solution developed under Subtask 2.2 as well as any tradeoffs required to meet the requirements and associated CONOPS.

Task 3 is contingent on Task 2 requirements development and passing the SCR milestone.

The contractor shall not begin task 3 without written approval from the COR.

TASK THREE. PRELIMINARY DESIGN

SUBTASK 3.1 Preliminary Design Upon approval of the system design concept and draft design specifications, the contractor shall perform a preliminary system-level design to decompose the system concept into subsystems and components. During the preliminary design phase, the contractor shall develop subsystem requirements and perform appropriate modeling, simulations, or prototyping required to reduce major technical risk areas identified in Task 2. With clear subsystem requirements and effective modeling, the results of the preliminary design should show clear feasibility of the overall self-screening system.

SUBTASK 3.2 Preliminary Design Review Upon completion of the prelminiary design, the contractor shall conduct a preliminary design review (PDR) with DHS S&T covering all aspects of the solution developed under Subtask 3.1 The contractor shall specifically identify any aspects of the design that have changed since the System Concept Review and identify the results of technical risk reduction studies undertaken in Subtask 3.1. Of particular interest in the PDR are the anticipated CONOPS, human systems interfaces, and implementation of the targeted screening modalities. All long lead items necessary for on-time delivery of an engineering prototype in Task 6 (should the option be executed) with associated costs shall be designated at the PDR.

OPTION PERIOD ONE

TASK FOUR. CRITICAL DESIGN

SUBTASK 4.1 Critical Design Approval of the preliminary design will initiate long lead component purchasing unless otherwise directed by the COR at the PDR. In addition, the contractor shall perform the detailed design of the system. Key areas of the design will include:

• Accessible property screening

• On-person screening

• Human-systems interfaces

• CONOPS

• Alarm resolution processes

• Geometry, weight, and power specifications

• Anticipated passenger throughput

• Anticipated staffing requirements

• Software architecture

• Automatic threat recognition approaches

• Cybersecurity

SUBTASK 4.2 Test Plan Development

The contractor shall develop a Test and Evaluation Plan (TEP) documenting the solution validation and verification process based on the requirements defined in Tasks 2, 3, and 4. The TEP shall be submitted to DHS S&T for approval.

SUBTASK 4.3 Critical Design Review Upon completion of the detailed design, the contractor shall hold Critical Design Review (CDR) with DHS S&T to document the design and any tradeoffs required to meet the requirements and CONOPS. The TEP developed in Subtask 4.2 shall also be presented for DHS S&T review.

Task 5 is contingent on passing the CDR milestone. The contractor shall not begin task 5 without written approval from the COR.

TASK FIVE. ENGINEERING PROTOTYPE FABRICATION AND TEST

SUBTASK 5.1 Prototype Fabrication Approval of the critical design will initiate the prototype fabrication process. The contractor shall produce and assemble the solution as documented at the CDR. Any deviations from the detailed designs presented at the CDR shall be appropriately documented. In addition, all software necessary for the CONOPS and threat recognition shall be developed.

SUBTASK 5.2 Factory Acceptance Testing The contractor shall execute the factory acceptance section of the TEP. Any deviations from the requirements shall be documented for review with the COR. The contractor shall propose mitigations for any deviations from the requirements.

SUBTASK 5.3 Test Readiness Review Upon completion of the fabrication and factory acceptance testing, the contractor shall hold a Test Readiness Review (TRR) to document the design and testing results from the factory acceptance process.

SUBTASK 5.4 User Guide and Training Materials The contractor shall document the CONOPS, user interfaces, safety procedures, and other information as necessary for effective operation and maintenance of the system. These materials shall be submitted to DHS S&T for approval.

TASK SIX. PROTOTYPE EVALUATION

SUBTASK 6.1 Engineering Prototype Delivery Upon completion of the TRR, the contractor shall deliver the system to an evaluation facility as directed by the COR. Possible locations include McCarran Interational Airport (Las Vegas, NV), the DHS S&T Transportation Security Laboratory (TSL, Atlantic City, NJ) or the TSA Systems Integration facility (Washington, DC). Upon delivery, the contractor shall setup the system and perform the necessary measurements and adjustments to ensure the system continues to function properly.

SUBTASK 6.2 User Training As directed by the COR, the contractor shall facilitate user training on-site with the prototype and/or at a designated DHS facility in the National Capital Region. This training shall equip attendees with the knowledge necessary to safely and effectively operate and maintain the prototype.

SUBTASK 6.3 Prototype Evaluation The contractor shall provide technical support to DHS S&T evaluation of the prototype system.

The contractor shall work with DHS S&T to resolve any deficiencies that arise during evaluation. The contractor shall also collect data as necessary in order to further train automatic threat recognition algorithms in use by the system. At the conclusion of the evaluation, the contractor shall participate in an evaluation debrief to discuss feedback from the evaluation and to update system requirements for ongoing system development.

TASK 7. SECONDARY PROTOTYPE EVALUATION (OPTIONAL TASK)

SUBTASK 7.1 Engineering Prototype Delivery Upon completion of the TRR, the contractor shall deliver the system to an evaluation facility as directed by the COR. Possible locations include McCarran Interational Airport (Las Vegas, NV), the DHS S&T Transportation Security Laboratory (TSL, Atlantic City, NJ) or the TSA Systems Integration facility (Washington, DC). Upon delivery, the contractor shall setup the system and perform the necessary measurements and adjustments to ensure the system continues to function properly.

SUBTASK 7.2 Prototype Evaluation The contractor shall provide technical support to DHS S&T evaluation of the prototype system.

The contractor shall work with DHS S&T to resolve any deficiencies that arise during evaluation. The contractor shall also collect data as necessary in order to further train automatic threat recognition algorithms in use by the system. At the conclusion of the evaluation, the contractor shall participate in an evaluation debrief to discuss feedback from the evaluation and to update system requirements for ongoing system development.

OPTION PERIOD 2

TASK EIGHT. DESIGN UPDATE

SUBTASK 8.1 Updated Design Based on the results of the prototype evaluation, the contractor shall complete detailed design for an updated prototype to meet the revised requirements. In addition, if appropriate, the contractor shall develop procedures to modify the existing prototype to meet the revised requirements. The TEP shall also be updated to test the updated requirements.

SUBTASK 8.2 Updated CDR

Upon completion of the detailed design, the contractor shall hold a CDR to document the updated design and any tradeoffs required to meet the requirements and CONOPS required. The updated TEP developed in Subtask 8.1 shall also be presented for DHS S&T review.

TASK NINE. UPDATED ENGINEERING PROTOTYPE FABRICATION AND TEST

SUBTASK 9.1 Updated Prototype Fabrication Approval of the critical design will initiate the updated prototype fabrication process. The contractor shall either produce and assemble the updated solution or modify their existing prototype as directed by the COR. Any deviations from the detailed designs presented at the Updated CDR shall be appropriately documented. In addition, all software updates necessary for the CONOPS and threat recognition shall be developed.

SUBTASK 9.2 Updated Factory Acceptance Testing The contractor shall execute the factory acceptance section of the TEP. Any deviations from the requirements shall be documented for review with the COR. The contractor shall propose mitigations for any deviations from the requirements.

SUBTASK 9.3 Updated TRR Upon completion of the fabrication and factory acceptance testing, the contractor shall hold a TRR to document the design and testing results from the factory acceptance process.

SUBTASK 9.4 Updated User Guide and Training Materials The contractor shall update the user documentation and training materials as necessary for effective operation and maintenance of the system. These materials shall be submitted to DHS S&T for approval.

TASK TEN. UPDATED PROTOTYPE EVALUATION

SUBTASK 10.1 Updated Engineering Prototype Delivery Upon completion of the TRR, the contractor shall deliver the system to an evaluation facility as directed by the COR. Possible locations include McCarran Interational Airport (Las Vegas, NV), the DHS S&T Transportation Security Laboratory (TSL, Atlantic City, NJ) or the TSA Systems Integration facility (Washington, DC). Upon delivery, the contractor shall setup the system and perform the necessary measurements and adjustments to ensure the system continues to function properly.

SUBTASK 10.2 Updated User Training As directed by the COR, the contractor shall facilitate user training on-site with the prototype and/or at a designated DHS facility in the National Capital Region. This training shall equip attendees with the knowledge necessary to safely and effectively operate the prototype.

SUBTASK 10.3 Updated Prototype Evaluation The contractor shall provide technical support to DHS S&T evaluation of the updated prototype system. The contractor shall work with DHS S&T to resolve any deficiencies that arise during evaluation. The contractor shall also collect data as necessary in order to further train automatic threat recognition algorithms in use by the system. At the conclusion of the evaluation, the contractor shall participate in an evaluation debrief to discuss feedback from the evaluation and to update system requirements for ongoing system development.

TASK 11. SECONDARY UPDATED PROTOTYPE EVALUATION (OPTIONAL TASK)

SUBTASK 11.1 Updated Engineering Prototype Delivery Upon completion of the TRR, the contractor shall deliver the system to an evaluation facility as directed by the COR. Possible locations include McCarran Interational Airport (Las Vegas, NV), the DHS S&T Transportation Security Laboratory (TSL, Atlantic City, NJ) or the TSA Systems Integration facility (Washington, DC). Upon delivery, the contractor shall setup the system and perform the necessary measurements and adjustments to ensure the system continues to function properly.

SUBTASK 11.2 Updated Prototype Evaluation The contractor shall provide technical support to DHS S&T evaluation of the updated prototype system. The contractor shall work with DHS S&T to resolve any deficiencies that arise during evaluation. The contractor shall also collect data as necessary in order to further train automatic threat recognition algorithms in use by the system. At the conclusion of the evaluation, the contractor shall participate in an evaluation debrief to discuss feedback from the evaluation and to update system requirements for ongoing system development.

OPTION PERIOD 3

TASK TWELVE. DESIGN FOR MANUFACTURE

SUBTASK 12.1 DESIGN FOR MANUFACTURE

The contractor shall undertake design for manufacture activities intended to ensure future prototypes can be manufactured in an efficient and cost effective manner. All designs, calibration processes, and testing procedures shall be documented. A detailed cost analysis shall be done to identify target prices for future systems in quantities of 10, 100, and 1,000.

SUBTASK 12.2 MANUFACTURING READINESS REVIEW

The contractor shall hold a Manufacturing Readiness Review (MRR) to document the design for manufacture efforts conducted in Subtask 12.1 and demonstrate system maturity suitable for production of field ready prototypes for operational evaluation.

TASK THIRTEEN. FIELD READY PROTOTYPES FOR OPERATIONAL TEST AND

EVALUATION (Optional Task)

The contractor shall produce field ready prototypes for operational test and evaluation (up to twenty) as specified by the COR. Each unit shall be tested according to factory acceptance procedures and delivered to DHS S&T as directed by the COR.

TASK FOURTEEN. CERTIFICATION/QUALIFICATION SUPPORT

SUBTASK 14.1 Data Package Development The contractor shall produce data packages as necessary to submit the design for certification against relevant TSA detection standard(s). These packages shall be delivered to the relevant DHS laboratories as directed by the COR.

SUBTASK 14.2 Formal Test & Evaluation Support The contractor shall execute and support TSA test & evaluation processes as necessary to achieve certification and qualification against relevant TSA standards. This may include system delivery, setup, teardown, and removal. Additional data collection and algorithm development may also be required. At the conclusion of formal test & evaluation, the contractor shall deliver a test and evaluation report documenting the results of the test and evaluation process.

TASK FIFTEEN. EXTENDED OPERATIONAL TEST AND EVALUATION SUPPORT

SUBTASK 15.1 Extended Operational Test and Evaluation Support The contractor shall support an extended operational test and evaluation with one or more qualified prototypes. This may include system delivery, setup, teardown, and removal.

Additional user training may also be required to support this extended operational test and evaluation.

SUBTASK 15.2 Extended Operational Test and Evaluation Review At the conclusion of the extended operational test and evaluation effort, the contractor shall deliver an operational evaluation final report and conduct an operational test and evaluation review documenting results of the evaluation and recommendations for additional system improvements should DHS elect to transition the design to expanded operational use.

3.0 KEY MILESTONES AND DELIVERABLES

SOW

REFERENCE

Sub task EVENT / DELIVERABLES DUE BY

Task 1: Project Management

1.1 1) Kickoff

2) Agendas, draft briefing packages

3) Minutes, final briefing packages

4) Program Summary Sheet, and Non-

Proprietary Quad Chart

1) 30 calendar days after award

2) 3 working days before mtg.

3) 5 working days after mtg.

4) 3 working days before mtg.

1.2 1) Monthly Status Report (MSR)

2) Invoice and Financial Status Report

1) 5th working day of the month for the duration of the Phase

2) 15th calendar day of the month

1.3 Monthly Teleconference 3 working days after

delivery of MSR

1.4 End of Perod Summary Document 15 working days before end

of current contract period

Task 2: Systems Concept

2.1 Systems Requirements Documents

5 working days before SCR

2.2 System Concept Analysis 5 working days before SCR

2.3 System Concept Review (SCR) with

Documentation, Meeting Minutes 4 months after award

Task 3:

Preliminary Design Review

3.1 1) Design Decomposition Document

2) Subsystems Requirements Documents

3) Technical Risk Reduction Modeling

1) 5 working days before

PDR

2) 5 working days before

PDR

3) 5 working days before

PDR

3.2 Prelminary Design Review with

Documentation, Meeting Minutes 8 months afer award

Task 4: Critical Design Review

4.1 Detailed design documents

10 months after award

Sub task EVENT / DELIVERABLES DUE BY

4.2 Test and Evaluation Plan (TEP) 5 working days before

CDR

4.3 Critical Design Review with

Documentation, Meeting Minutes 12 months after award

Task 5:

Engineering Prototype Fabrication and Test

5.1 Prototype Design Documentation

5 working days before TRR

5.2 Factory Acceptance Test Results

5 working days before TRR

5.3 Test Readiness Review with

Documentation, Meeting Minutes 18 months after award

5.4 User Guide and Training Materials

18 months after award

Task 6: Prototype Evaluation

6.1 Engineering Prototype Delivery

20 months after award

6.2 On-site User Training

21 months after award

6.3 1) Prototype evaluation data

2) Prototype evaluation debrief

1) 5 working days before debrief

2) 21 months after award

Task 7:

Secondary Prototype Evaluation (Optional Task)

7.1 Engineering Prototype Transportation

and Setup 1 month after execution of optional task

7.2 1) Secondary evaluation data

2) Secondary evaluation debrief

1) 5 working days before debrief

2) 3 months after execution of optional task

Sub task EVENT / DELIVERABLES DUE BY

Task 8: Design Update

8.1 1) Updated design documents

2) Updated TEP

1) 5 working days before Updated CDR

2) 5 working days before Updated CDR

8.2 Updated Critical Design Review with

Documentation 27 months after award

Task 9: Updated Engineering Prototype Fabrication and Test

9.1 Updated prototype fabrication

5 working days before Updated Prototype TRR

9.2 Updated factory acceptance test results

5 working days before Updated Prototype TRR

9.3 Updated Prototype Test Readiness

Review 30 months after award

9.4 Updated User Guide and Training

Materials 30 months after award

Task 10: Updated Prototype Evaluation

10.1 Updated Engineering Prototype Delivery

31 months after award

10.2 On-Site Updated User Training

31 months after award

10.3 1) Updated Prototype Evaluation Data

2) Updated Prototype Evaluation Debrief

1) 5 working days before Updated Prototype Evaluation Debrief

2) 34 months after award

Task 11: Updated Prototype Secondary Evaluation (Optional Task)

11.1 Updated Engineering Prototype

Transportation and Setup 1 month after execution of optional task

11.2 1) Secondary evaluation data

2) Secondary evaluation debrief

1) 5 working days before debrief

2) 3 months after execution of optional task

Task 12: Design for Manufacture

(DFM)

12.1 1) DFM Designs, Calibration Processes, Testing Procedures

2) Volume Cost Analysis

1) 42 months after award

2) 44 months after award

Sub task EVENT / DELIVERABLES DUE BY

12.2 Manufacturing Readiness Review

46 months after award

Task 13: Field Ready Prototypes for Operational Test and Evaluation (Optional Task)

Field Ready Prototypes for Operational Test and Evaluation

4 months after execution of optional task

Task 14:

Certification/Qua lification Support

14.1 Certification/Qualification Data Packages

42 months after award

14.2 Test and Evaluation Report

48 months after award

Task 15:

Extended Operational Test and Evaluation

15.1 Extended Operational Test and

Evaluation Support 50 months after award

15.2 Extended Operational Test and

Evaluation Review with Documentation 54 months after award

4.0 PROJECT TIMELINE

5.0 Other Contract Details

A. Period of Performance.

The period of performance for this effort is from date of award to 54 months. The period of performance structure, should all options be awarded is:

Base Period 8 months Option Period One 14 months Option Period Two 12 months Option Period Three 20 months

B. Travel.

Travel will be required in the performance of the duties listed herein. It is anticipated that travel will be limited to the United States’ locations of Washington, DC, Atlantic City, NJ, and Las Vegas, NV. The contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event. All travel and other direct costs associated with the execution of the tasks indicated in this SOW will be reimbursed in accordance with the limits set forth in the Federal Travel Regulations, provided the performer provides appropriate supporting documentation.

C. DHS-Furnished Information.

1. DHS will provide certain DHS information, materials, and forms unique to DHS to the contractor to support certain tasks under this SOW.

2. The DHS S&T COR identified in this SOW shall be the point of contact (POC) for identification of any required information to be supplied by DHS.

3. The contractor shall prepare any documentation according to the guidelines provided by DHS.

D. Place(s) of Performance.

All design, development and assembly work on the project will occur at the contractor facility or the facilities of the respective partners. For testing at Government facility, the contractor team will travel to the Government test facility to conduct data collection and testing as required. Meetings and reviews will be attended as required by the appropriate contractor team personnel at the location to be determined by the DHS S&T COR.

E. DHS-Furnished Property.

DHS property will not be provided to the contractor unless otherwise agreed in writing.

In such instances, DHS will maintain property records.

F. Contractor Purchased Property.

Before purchasing any individual item required to support technical tasks performed pursuant to this SOW not included in the cost proposal that is equal to or exceeds $5,000 or any individual item that was included in the cost proposal where the cost variance to the cost proposal is equal to or exceeds $5,000, the contractor shall obtain the DHS S&T Contracting Officer’s prior written consent. If the DHS S&T Contracting Officer consents to such purchase, such item shall become the property of DHS. The contractor shall maintain any such items according to currently existing property accountability procedures. The DHS S&T Contracting Officer will determine the final disposition of any such items in writing.

G. Deliverables.

The contractor shall provide all deliverables identified in this SOW directly to the DHS S&T COR and DHS S&T Contracting Officer, with a copy of the transmittal letter to the Financial Analyst.

H. Monthly Status Report.

The contractor shall deliver a monthly status report (MSR) to the DHS S&T COR, DHS S&T EXD Business Operations Manager, SandT.Explosives.MSR@dhs.gov, and DHS S&T Financial Analyst on the 15th day of every month containing metrics pertaining to financial, schedule, scope, risk, and performance assessment information in EXD’s provided template. This MSR will describe the previous 30 calendar days’ activity, technical progress achieved against goals, difficulties encountered, recovery plans (if needed), plans for the next 30 calendar day period, and financial status (see Invoices below). The MSR template will be provided by the DHS S&T COR to the Contractor at program kickoff.

I. Rate Changes. All proposed rate changes must be sent to the S&T COR a minimum of 30 days in advance.

J. Invoices. The contractor shall deliver a monthly invoice to invoicesat.consolidation@ice.dhs.gov on the 15th day of each month. Invoices shall contain the following details for both the month invoiced and cumulative: labor hours/person/task, labor cost, travel cost, indirect costs, material costs, other direct costs, and fee, if applicable. The invoice shall include cost per subtask (for the reporting period and the cumulative). Material costs for all hardware and software purchased as part of this contract shall be itemized in the invoice.

K. Funding Requirements. DHS will provide funding to the contractor in accordance with

DHS’s appropriations and available funds.

L. Security Requirements.

Worked performed under this SOW will require access to classified information. The maximum level of classified access will be SECRET.

Classified work is required under this SOW, DHS will provide specific guidance to the contractor as to which work will be conducted in a classified manner and at which mailto:SandT.Explosives.MSR@dhs.gov mailto:invoicesat.consolidation@ice.dhs.gov classification level. The contractor will also adhere to other applicable Government orders, guides and directives pertaining to classified work.

It is anticipated that the contractor will have access to SSI under this contract.

Each individual employed under the contract who will have access to sensitive information shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-551). Any exceptions must be approved by the DHS S&T Chief Security Officer or designee. Contractor personnel on the contract having access to SSI data shall be required to have or obtain a DHS Suitability Clearance. All contractor employees and subcontractors with access to SSI shall sign a DHS Form 11000-6 (Non-Disclosure Agreement) and mark both the sensitive information box and the SSI box.

DHS has and will exercise full control over granting, denying, withholding, or terminating unescorted Government facility and/or sensitive Government information access for Contractor employees, based upon the results of a background investigation.

DHS may, as it deems appropriate, authorize and make a favorable entry of duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the contactor to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment contractor fitness (suitability) authorization will follow as a result thereof. The granting of a favorable EOD decision or a full contractor fitness (suitability) authorization determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the contract. No employee of the contractor shall be allowed unescorted access to a Government facility, access to any sensitive information or access to DHS IT Systems without a favorable EOD decision or contractor fitness (suitability) determination by the DHS Office of Security. Contract employees assigned to the contract not needing access to sensitive DHS information or recurring access to DHS facilities will not be subject to security contractor fitness (suitability) screening. Contract employees awaiting an EOD decision may not begin work on the contract. Limited access to Government buildings is allowable prior to the EOD decision if the contractor is escorted by a Government employee. This limited access is to allow contractors to attend briefings, nonrecurring meetings, and begin transition work. Classified information is Government information which requires protection in accordance with Executive Order 13526, National Security Information (NSI) as amended and supplemental directives. If the contractor has access to classified information at a DHS owned or leased facility, it shall comply with the security requirements of DHS and the facility. If the contractor is required to have access to classified information at another Government Facility, it shall abide by the requirements set forth by the agency.

M. HSAR 15-01 Clauses Safeguarding of Sensitive Information (MAR 2015)

(a) Applicability. This clause applies to the Contractor and its contractors, its subcontractors, and their employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name.

The definition of PII is not anchored to any single category of information or technology.

Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source— that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to:

name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

(3) All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or Component Privacy Officer. Unless otherwise specified in the ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

(1) Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.

(i) Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter.

Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

(iii)Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones.

Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy.

Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years. The Contractor is required to update its SA package as part of the ATO renewal process.