SIMS Draft Performance Work Statement 5-26-2026.pdf

Performance Work Statement Transportation Security Administration Secure Identity Management Support

1. PURPOSE

This Performance Work Statement (PWS) describes the subject matter expertise (SME) support needed by the Transportation Security Administration (TSA) Enrollment Services and Vetting Programs (ESVP) office related to supporting several TSA security programs. The contractor shall provide biometric technical expertise with respect to secure identity management operations and maintenance work that TSA must perform as mandated by the FAA’s Extension Safety and Security Act (FESSA).

Areas of expertise may include, but are not limited to: biometric identification, authentication, and validation for use within vetting and credentialing systems; enrollment services; identity verification;

and authentication technology standards.

2. BACKGROUND

ESVP manages a variety of programs that are critical to U.S. transportation and national security. These programs conduct Security Threat Assessments (STA) for individuals in accordance with the programs’ statutory and regulatory requirements. A key part of these STAs is the collection, processing, and storage of biometrics, that are used to perform the required immigration, terrorism, and Criminal History Records Checks (CHRC) with multiple federal and state agencies to include the Federal Aviation Administration (FAA), Federal Bureau of Investigation (FBI), multiple Department of Homeland Security (DHS) components such as Customs and Border Protection (CBP), US Citizenship and Immigration Services (USCIS), Office of Biometric Identity Management Identification Services (OBIM), the Social Security Administration (SSA), the Department of State (DoS), and Department of Justice (DoJ).

Technical expertise is needed to efficiently and effectively address capabilities, anomalies, and vulnerabilities related to biometric and identity assurance initiatives and requirements across all of the ESVP vetting and credentialing programs. For example, the implementation of recurrent vetting capabilities required by TSA to develop identity resolution guidance and tools to review biometric and biographic source encounter data.

The vetted populations include: Transportation Worker Identification Credential (TWIC®), Flight Training Security Program (FTSP), TSA PreCheck® Application Program (TPAP), Hazardous Materials Endorsement (HME) Threat Assessment Program (HTAP), General Aviation Program, Aviation Worker Program, Indirect Air Carrier Program, and the Certified Cargo Screening Program, and Unmanned Aircraft Systems (UAS) including Beyond Visual Line of Sight (BVLOS).

Currently, there are several ESVP vetting and credentialing support systems in various stages of development that support biometric storage for vetting and reuse purposes. These systems maintain external connectivity across the ESVP security threat assessment portfolio. Specifically, the systems used to support the ESVP vetted populations include the Vetting and Credentialing System (VCS), Consolidated Screening Gateway (CSG), Technology Infrastructure Modernization (TIM) System, Credentialing and Adjudication Application (CAA), Universal Enrollment Services (UES) system, and the Aviation

Channeling and Data Management System (ACDMS). It is anticipated that these vetting and credentialing systems will be consolidated over the next eight years in support of several ESVP initiatives.

As part of its STA enrollment processes, TSA receives biometric data from both contracted enrollment vendors and other outside sources and leverages this data in direct support of initial and recurrent vetting operations.

ESVP manages the TWIC® program. The TWIC® program is a vital national security measure that ensures that individuals who pose a security threat do not gain unescorted access to secure areas of the nation’s maritime transportation system. Jointly administered by TSA and the U.S. Coast Guard (USCG), TWIC® was established by the Maritime Transportation Security Act (MTSA) of 2002 and amended by the Security and Accountability for Every (SAFE) Port Act of 2006. TSA is responsible for TWIC® enrollment, security threat assessments, and system operations and maintenance. The USCG is responsible for enforcement. The TWIC® program is highly visible, involves sensitive issues regarding privacy, is advanced technologically, and is tasked with addressing critical shortfalls in identity management related to transportation security. TWIC® is the only TSA vetting program which issues a physical biometric credential.

ESVP managed FTSP requires assistance to inform known future requirements, especially as they relate to improved identity assurance (via biometrics) with applicants, Certified Flight Instructors, and flight training facilities across the United States. FTSP is a high-visibility program that directly addresses the vulnerabilities that led to the tragic events of September 11, 2001. FTSP relies on stringent identity management processes and a strong chain of trust to ensure all foreign flight students are properly identified and vetted by the U.S. Government; this security threat assessment process includes conduct of a CHRC. Recently, DHS and U.S. Congress expressed interest in FTSP’s identity assurance process, especially the verification of applicants claiming to be U.S. citizens.

ESVP manages the TSA PreCheck Application Program. Pursuant to its authority under Section 109(a)(3) of the Aviation and Transportation Security Act (ATSA), TSA introduced the TSA PreCheck Application Program in December 2013. TSA PreCheck is a voluntary passenger pre-screening initiative that determines whether passengers are low risk and thus eligible to receive expedited screening at participating airport security checkpoints. The TSA PreCheck Application Program permits U.S. citizens/nationals and Lawful Permanent Residents (LPR) to apply for the program through an authorized TSA PreCheck enrollment provider by providing biographic and biometric information that TSA uses to conduct a comprehensive security threat assessment. TSA issues a Known Traveler Number (KTN) to applicants whom TSA deems a low risk to transportation security based on the security threat assessment results. TSA PreCheck enhances aviation security by permitting TSA to better focus its limited security resources on passengers who are not known to TSA, while also facilitating and improving the commercial aviation travel experience for the public.

ESVP manages HTAP in accordance with the USA PATRIOT Act of 2001. TSA conducts a security threat assessment of any driver seeking to obtain, renew, or transfer a HME on a State-issued commercial driver’s license. In 2005, HTAP was implemented to meet a statutory requirement that prohibits States from issuing a license to transport hazardous materials (hazmat) in commerce unless a determination has been made that the driver does not pose a security risk. HTAP improves security by requiring individuals who transport hazmat to obtain an endorsement that recognizes they do not pose a security threat based on review of their security threat assessment against several disqualifying offenses. Based on TSA’s determination of eligibility, a State may issue an HME to a driver. The Act requires TSA to include a check of criminal history records, immigration status, and ties to terrorism in the security threat assessment.

ESVP manages several other critical aviation programs (e.g., Aircraft Operators, Air Cargo Aircraft Operators, Airport Workers, Federal Aviation Administration (FAA) certification holders, and General Aviation Aircraft Operators) to ensure individuals who have a known or suspected nexus to terrorism, have a disqualifying criminal offense on their record, or do not meet immigration eligibility requirements are not permitted access to the national airspace or secured areas within the transportation industry. Currently, these aviation programs, TWIC and TSA PreCheck leverage the FBI’s “Rap Back” service. Rap Back is a subscription service offered by the FBI that provides recurrent vetting for criminal history records information (CHRI). This capability is of great interest to TSA, the aviation industry, and others because it helps address a vulnerability in the airport environment, specifically, that there is no current mechanism to update or refresh CHRI.

TSA requires further secure identity expertise to address its day-to-day operational and technical issues of processing existing and new biographic and biometric inputs from a variety of sources, as well as staying abreast of evolving standards (NIST, ISO), technology and industry best practices related to the use of biometrics (e.g. facial, iris, voice, and other biometrics) for identity management. As vetting and credentialing systems are transformed across TSA, DHS, and the federal government, ESVP’s secure identity experts will be essential in providing technical and operational input affecting requirements, policies, and standards.

3. PLACE OF PERFORMANCE

On-site services shall be provided at TSA Headquarters located at 6595 Springfield Center Drive, Springfield, VA 22150.

4. PERIOD OF PERFORMANCE

12-month from award with (four) one-year option periods.

5. SCOPE

This Performance Work Statement provides technical support for ESVP security threat assessment programs. The contractor shall provide Subject Matter Experts (SMEs) who offer, at a minimum, the knowledge, skills, and experience listed below.

Subject matter expertise with the technical development, support, and maintenance of:

• Identity and Biometric-based State and Federal databases and systems

• FBI “Rap Back” Services

• XML Rap Sheet specifications and standards

• Biometric Standards and Biometric Identification and Authentication (National and International)

Working knowledge expertise with:

• Supporting Hardware and Software System Development

• Data Management Systems

• Technical Writing/Editing

• Microsoft Office Expertise (to include facility with Macros and MS Access)

• Extensible Markup Language (XML) formatted rap sheets

• Expert Level Microsoft Excel Programming (VBS, VBA, & SQL)

6. INITIAL AND RECURRENT BIOMETRIC VETTING (CLIN 00001)

The contractor shall provide biometric subject matter expertise for ESVP and its portfolio of security threat assessment programs, including but not limited to those outlined in 2.0. The contractor shall provide analysis, research, and reporting on biometric identification and authentication methods, requirements, technology, and tools. The contractor shall provide support to establish support to initiate new TSA ESVP vetting requirements, technology and tools. Additionally, the contractor shall provide “Best Practices” and implementation guidance for biometric submissions, alternative capture/transmission standards, ‘white papers’ on other DHS/USGOV fingerprint technologies, and position/topic papers addressing current and future biometric capabilities.

Currently, ESVP leverages FBI Rap Back services in support of recurrent vetting operations for the ESVP aviation and transportation populations identified above, TWIC, and TSA PreCheck. The contractor will support ESVP in implementation of FBI Rap Back services throughout its remaining vetting populations.

ESVP uses the DHS IDENT encounter information system as a security measure for security threat assessment programs. IDENT is a DHS Office of Biometric Identity Management (OBIM) processing system that includes biometrics and biographic information. TSA leverages IDENT for security threat assessment populations and has established a multi-phase initiative to integrate criminal, immigration, and terrorist derogatory information from IDENT into the ESVP vetting and adjudication processes.

6.1 Rap Back Biometric Enrollment and Vetting Services

TSA is charged with implementing Rap Back services in the transportation sector and recurrent criminal history vetting for all programs managed by ESVP. S i n c e August 2016, TSA successfully completed its pilot of Rap Back service and has since expanded to five total vetting programs.

Services will include, but may not be limited to, the following:

6.1.1 Perform the following services supporting TSA use of Rap Back:

6.1.2.1 Maintain, update, and replace the user interface design, procedures, processes and tools that support a Rap Back recurrent vetting solution including TSA’s Rap Sheet parsing and scoring tool, among other operational tools.

6.1.2.2 Participate in the requirements and workflow development of processes and policies to automate Rap Back into TSA vetting programs, accounting for internal and external case management procedures.

6.1.2.3 Provide recommendations on the use of Rap Back in support of recurrent vetting, including challenges, opportunities, risks, best practices, and lessons learned.

6.1.2 Provide technical expertise and recommendations to the Government on a variety of topics covered by this contract. This will include technical discussions, technical briefings, and the development of “white papers” and “decision papers” that address recommended solutions to concerns and issues.

6.1.2.1 All technical feedback, recommendations, and requirements identified during the performance of this contract shall be documented as EPICs and features within established ESVP Business Requirements Prioritization Process framework. Each EPIC and feature must include associated acceptance criteria to facilitate validation and verification. The contractor shall coordinate with the ESVP Business Requirements Product Managers and Business Owners to ensure that EPICs and associated features a prioritized, tracked, and updated throughout the development lifecycle. Documentation shall incorporate technical feedback in ongoing development cycles should be composed in AGILE style and language. Deliverables must be maintained in an approved electronic format and submitted as part of regular deliverable schedule.

6.1.3 Support Rap Back services implementation for all ESVP security threat assessment program populations identified in Section 2.0 above.

6.1.3.1 Provide support where necessary in onboarding of agencies or external engagement in support of Rap Back implementation.

6.1.4 Provide the following contract reports:

6.1.4.1 A monthly status report that includes the previous month’s accomplishments, areas with concerns/risks, recommendations, and other topics as required. Details of the monthly status report will be determined upon award.

6.1.4.2 Review ACDMS OTA holders monthly report to ESVP within 14 days of issuance;

highlight gaps and, provide recommendations to align with ACDMS program objectives.

6.1.4.3. Summary and recommendations of ACDMS OTA holders’ monthly reports should be delivered by SIMS to ESVP in electronic format.

6.1.5 Provide support where necessary to create and maintain implementation and training guides.

6.1.6 Final Report - At the close of this task order, the Contractor shall prepare a final report that summarizes the work they have completed in supporting the ESVP during the period of performance.

This report shall include a list of updated deliverables as well as new policies and procedures provided by the Contractor in each of the previous sections.

6.1.7 Transition Plan - The Government defines “Transition” as the effective, efficient completion of knowledge transfer (information exchange, document exchange, discussions, training, etc.) to ensure uninterrupted operational capability as one government Contractor assumes responsibilities from another. The Government objective is to minimize, to the maximum extent possible, the adverse impact imposed by the transition process.

The Contractor shall actively participate in all transition activities by providing documents, administrative support, technical support, diagrams, and briefings as required by the Government. This transition process takes place at the end of the contract term or as determined by the Contracting Officer (CO) if terminated during a period of performance or at the end of a period of performance or option period.

Finally, the Contractor shall prepare a Transition Out Plan, which shall outline the steps the Contractor will take during transition.

The content of all deliverables shall be determined in conjunction with ESVP and submitted electronically in a format approved by the Government.

6.2 IDENT/HART Biometric Enrollment and Vetting Services

TSA is currently leveraging the IDENT as a backup system in support of recurrent vetting operations for both the TWIC and TSA PreCheck programs. T S A anticipates that other ESVP vetted programs will be enrolled to DHS Automated Biometric Identification System (IDENT)/(HART) over the course of the next 3-5 years in support of both initial and recurrent vetting operations.

Services will include, but may not be limited to, the following:

-Maintain, update, and replace the user interface design, procedures, processes and tools that support a IDENT/HART recurrent vetting solution, including TSA’s Rap Sheet parsing and scoring tool, among other tools.

6.2.1 Use the tools that TSA has developed to support IDENT initial and recurrent vetting.

• Assist in the receipt and review of the monthly IDENT report, using tools to identify those hits that will require a rap sheet from the UES vendor

• Prepare emails/reports on the hits other than criminality

• Send monthly requests to UES vendor for rap sheets

• Parse and score rap sheets for initial and recurrent vetting

• Conduct analyses and identity missing rap sheets

• Coordinate with federal staff on IDENT case creation and QC of data.

• Prepare reports as needed

6.2.2 Manage and update Standard Operating Procedures (SOP) on the use of IDENT/HART for vetting, adjudication, and continuous monitoring.

6.2.3 Participate in the requirements and workflow development of processes and policies to integrate 6.2 IDENT/HART into TSA vetting and case management systems.

6.2.4 Provide recommendations on the use of IDENT/HART for TSA initial and recurrent vetting, including challenges, opportunities, risks, best practices, and lessons learned.

6.2.5 Provide technical expertise and recommendations to the Government on a variety of topics covered by this contract. This will include technical discussions, technical briefings, and the development of “white papers” and “decision papers” that address recommended solutions to concerns and issues.

6.2.6 All technical feedback, recommendations, and requirements identified during the performance of this contract shall be documented as EPICs and features within established ESVP Business Requirements Prioritization Process framework. Each EPIC and feature must include associated acceptance criteria to facilitate validation and verification. The contractor shall coordinate with the ESVP Business Requirements Product Managers and Business Owners to ensure that EPICs and associated features are prioritized, tracked, and updated throughout the development lifecycle. Documentation shall be maintained in an approved electronic format and submitted as part of regular deliverables.

6.2.7 Provide subject matter expert support on identity verification utilizing facial images or iris scans, vetting sources that can be leveraged utilizing facial images or iris scans, and engagement with standards bodies relevant to facial images and iris scans.

6.2.8 Provide a monthly status report that includes the previous month’s accomplishments, areas with concerns/risks, recommendations, and other topics as required. Details of the monthly status report will be determined upon award.

The content of all deliverables shall be determined in conjunction with ESVP and submitted electronically in a format approved by the Government.

7. BIOMETRIC STANDARDS, ACCREDITATION AND REQUIREMENTS

DEVELOPMENT (CLIN 00002)

7.1 Expert Guidance on Technology Integration and Operations

Enrollment Services and Vetting Programs serve multiple populations and must ensure compliance with National Institute of Standards and Technology (NIST) and other applicable industry standards for biometric standards and accreditation (e.g., International Civil Aviation Organizations (ICAO) and Federal Information Processing Standards (FIPS)). In preparation for discussions with stakeholders (internal and external to TSA), the contractor will be required to provide subject matter expertise on industry recognized biometric standards to provide relevant guidance on innovative technology integration and operational use methodologies specific to biometrics. Technology may include screening technology, biometrics, and innovation development. The contractor shall provide support to establish support to initiate new vetting requirements, technology and tools.

7.2 Automated Rap Sheet Parsing and Scoring

ESVP uses the Criminal History Records Information (reported within Rap Sheets) extensively as a component of its security threat assessment programs. The adjudication of Rap Sheets is manual as Rap Sheets are text based, non-machine readable, and not standardized. As part of a research and development effort ESVP is engaging with other entities including Maricopa County, FBI, and NLETS to standardize rap sheets formats and additionally ESVP is undertaking efforts to automate the adjudication of standardized rap sheets. Additionally, ESVP is extensively engaging standards bodies to inform the standardization of rap sheets to enable greater automation.

Services will include, but may not be limited to, the following:

7.2.1 Interface with external stakeholders to identify the technical requirements to implement enhanced automation of criminal history adjudication processes (e.g., machine learning and user interface enhancements).

7.2.2 Work with internal stakeholders to identify technical requirements to enhance the user interface for reviewing rap sheets and to modify rap sheets to enhance the adjudication process.

7.2.3 Provide technical support and subject matter expertise to support TSA’s transition to Extensible Markup Language (XML) formatted rap sheets for enhanced adjudication of vetted populations including:

7.2.4 Provide technical support and subject matter expertise to support TSA’s engagement with the FBI and NLETS in identifying standards and modifications of standards such as National Information Exchange Model (NIEM), Electronic Biometric Transmission Specification (EBTS), and Criminal History Information Exchange Format (CHIEF).

7.2.5 Provide expertise and technical support to TSA’s engagement with external organizations such as the FBI Compact Council and Advisory Policy Board toward gaining approval for FBI implementation of TSA-requested improvements in the FBI Next Generation Identification (NGI) system.

7.2.6 Provide technical support and coordination as TSA engages with external organizations performing research on the feasibility of applying advanced machine learning techniques to the formatting and presentation of XML rap sheets to enhance the efficiency and productivity of adjudication and vetting resources.

7.2.7 Define requirements and business process flows between TSA vetting systems and TSA Adjudication, Vetting, and Intelligence resources (if applicable) to process, manage, and implement enhanced adjudication efficiency and productivity using XML rap sheets and/or other relevant applications.

7.2.8 Provide expertise and technical support to enhancing TSA’s strategic innovation deployment environment with internal and external stakeholders, including coordination among interested parties for deployment of technology utilizing XML rap sheets data interchange, processing and relevant applications.

7.2.9 All technical feedback, recommendations, and requirements identified during the performance of this contract shall be documented as EPICs and features within established ESVP Business Requirements Prioritization Process framework. Each EPIC and feature must include associated acceptance criteria to facilitate validation and verification. The contractor shall coordinate with the ESVP Business Requirements Product Managers and Business Owners to ensure that EPICs and associated features prioritized, tracked, and updated throughout the development lifecycle.

Documentation shall be maintained in an approved electronic format and submitted as part of regular deliverables.

8.0 DATA MANAGEMENT SYSTEM /DATA SCIENCE SUPPORT (CLIN 00003)

The contractor shall provide subject matter expertise and support for data system management, data quality, and data science, including the application of Machine Learning (e.g. Artificial Intelligence-AI) methodologies.

The contractor shall support the DHS Data Quality guidelines and is responsible for assisting ESVP in achieving and maintaining those guidelines for ESVP data management systems.

As ESVP migrates vetted populations across systems, as referenced in Section 2.0, the contractor shall prioritize data integrity and leverage AI-driven tools and techniques to enhance accuracy, consistency, and reliability.

The contractor shall also support the management of the Aviation Channeling and Data Management System & Designated Aviation Channelers, who channel biometric and biographic data to TSA for Aviation security programs.

The contractor shall ensure regulated agencies (to include but not limited to aircraft and airport operators) receive high-quality data management services by utilizing advanced data science and AI principles to develop, implement, and verify efficient solutions to technical challenges. The contractor shall assist ESVP in the operation and monitoring of quantifiable performance measures, including AI-enabled analytics, to provide assurance to users, agencies, and TSA that ESVP data assets are actively and effectively managed.

Data Validation Requirements:

The contractor shall support ESVP in meeting data validation requirements by implementing automated and AI-enhanced validation processes. These processes must ensure the delivery of clean, accurate, secure, and consistent data to all programs, applications, and services. The contractor shall develop and apply validation checks and rules, including AI-powered anomaly detection and pattern recognition, to routinely verify data integrity and compliance with established benchmarks.

8.1 Data Management Support/Data Quality Assurance

The contractor shall implement and maintain repeatable procedures and practices to ensure the sustainability and integrity of information throughout the lifecycle of system modernization and data exchange activities. The desired products/deliverables must articulate outcome-based metrics (e.g., biometric match rates, data quality improvements, reduction in adjudication time). The contractor shall support ESVP in the following areas: biometric match rates, data quality improvements, reduction in adjudication time or other measurables as determined to assess the impact of contractor support.

8.1.1 Data Quality Standards and Plan

• Establish and document standards for data quality and integrity to support the modernization of systems, data exchanges, or communities of practice.

• Develop and deliver a comprehensive Data Quality Plan outlining procedures, roles, responsibilities, and ongoing maintenance strategies.

8.1.2 Data Quality Issue Resolution and Migration Support

• Identify, assess, and resolve data quality issues related to system migration, redesign, or data exchange.

• Profile and assess data quality, identify root causes and impacts, and evaluate remediation options.

• Provide a technical report to TSA detailing root causes, impacts, remediation options, and actionable recommendations.

8.1.3 Trusted Data Source Standards

• Establish standards and measures for identifying, validating, and reusing trusted data sources.

• Document criteria and processes for determining trusted sources and ensuring their ongoing reliability.

8.1.4 High-Quality Data and Analytics Support

• Ensure the availability of high-quality data to support advanced analytics and meaningful business outcomes.

• Support ESVP in monitoring the effectiveness of implemented actions and measuring improvements in data quality.

• Provide a technical report to TSA capturing best practices, observed improvements, and recommendations for continued enhancements.

8.1.5 Review ACDMS OTA holders monthly report to ESVP within 14 days of issuance;

highlight gaps and provide recommendations to align with ACDMS program objectives.

8.1.6. Summary and recommendations of ACDMS OTA holders’ monthly reports should be delivered by SIMS to ESVP in electronic format.

9. Other Direct Costs (CLIN 00004)

a. The contractor shall provide equipment to the Government such as other test related items related to the development, support, and maintenance of identity and biometric-based Federal databases and systems and XML Rap Sheet specifications and standards. The contractor shall purchase such equipment on behalf of the Government as other direct costs (ODCs). Said equipment purchased shall become the sole property of the Government. All ODC purchases will be directed and approved by the Contracting Officer’s Representative in writing.

b. Travel - The Contractor may be authorized to travel on behalf of the government when required.

The Contractor shall obtain approval from the COR at least 48 hours prior to making any travel plans. The contractor shall submit all documentation related to travel expenses to the Government.

All associated travel costs incurred by the contractor shall be in accordance with the Federal Travel Regulations and the Transportation Security Administration’s policies. A travel voucher along with all required receipts shall be submitted by the contractor to the Government for reimbursement.

10. Government Points of Contact:

Contracting Officer (CO)

Name:

Phone:

E-Mail:

Contracting Officer Representative (COR) Name:

Phone:

E-Mail:

11. Key Personnel The personnel or facilities specified below are considered essential to the work being performed under this contract and may, with the consent of the contracting parties, be changed from time to time during the course of the contract by adding or deleting personnel or facilities, as appropriate.

Before removing or replacing any of the specified individuals or facilities, the Contractor shall notify the Contracting Officer, in writing, before the change becomes effective. The Contractor shall submit sufficient information to support the proposed action and to enable the Contracting Officer to evaluate the potential impact of the change on this contract.

The Contractor shall not remove or replace personnel or facilities until the Contracting Officer approves the change.

The Key Personnel or Facilities under this Contract:

Subject Matter Expert Level I Qualifications -

• 3+ years of identity management and/or biometrics consulting and/or industry experience

• Education: Bachelor’s degree in engineering or technical management discipline; ten or more

• years of specific related experience can substitute for a degree

• Hardware and software system development and/or operational testing

• Technical analysis/editing/writing/presentations

• Possesses specific expertise in at least one of the enumerated areas identified in this SOW Section 2.0

• Biometric and identity management standards and best practices

• Credential validation solutions (i.e., mobile applications, desktop applications, or software

• solutions, or equivalent)

• Risk assessment, quality assurance, and internal control(s).

Subject Matter Expert Level II Qualifications -

• 10+ years of identity management and/or biometrics consulting and/or industry experience

• Education: Master’s degree in engineering, technical management discipline or field appropriate

• but not limited to identity management, biometrics, access control, and/or smart card technology

• Identity- and biometric databases/systems development and/or implementation

• Credentialing and Card/Credential Management Systems

• Possesses specific expertise in at least five or more of the enumerated areas identified in this

• SOW Section 2.0

• Previous consulting and/or industry experience with Common Access Credentials (CAC),

• Personnel Identity Verification (PIV), and/or Transportation Worker Identification Credentials

• (TWIC®), or other biometric credentials

• Development and presentation of identity management guidance/training curriculum

• Certified Biometrics Professional (CBP) or equivalency

• Participation/membership in biometric and/or identity management non-profit and/or professional trade organization(s).

Subject Matter Expert Level III Qualifications –

• 15 years of identity management and/or biometrics consulting and/or industry experience

• Education: Bachelors and/or Master’s degree and/or 20+ years in progressive middle and/or

• senior management positions in a field appropriate but not limited to identity management,

• biometrics, access control, and/or smart card technology

• Previous consulting and/or industry experience with Common Access Credentials (CAC),

• Personnel Identity Verification (PIV), and/or Transportation Worker Identification Credentials

• (TWIC®), or other biometric credentials

• Possesses specific expertise in all of the enumerated areas identified in this SOW Section 2.0;

• Biometric and identity management articles, publications, and/or presentations for academic,

• industry or non-profit technical or trade organizations

• Certified Smart Card Industry Professional (CSIP) and/or Certified Smart Card Industry

• Professional Professional/Government (CSIP/G), or equivalency

• Membership/leadership position in biometric and/or identity management non-profit and/or

• professional trade organization(s).

Data Scientist II Qualifications:

• 3-5 years of consulting and/or industry experience

• Education: Bachelor’s degree in mathematics, computer science, engineering, technical management discipline or field appropriate, with preferred certification in applied data science or analytics

• Possess experience working with product development, information technology professionals, implementation and management teams

• Develop forecasting models and data traffic patterns

• Leading analytical projects to deliver insight, modeling, trend analysis, and impact

• Develop and maintain project reporting and dashboards

• Develop data visualizations for managers and executives

12. Additional information on ESVP Programs:

TWIC® Program:

• TWIC® TSA website: https://www.tsa.gov/for-industry/twic

• TWIC® U.S. Coast Guard website: https://homeport.uscg.mil/missions/maritime- security/transportation- worker-identification-credential-(twic)/general-information

• TWIC® enrollment website: https://universalenroll.dhs.gov/programs/twic

HTAP Program:

• https://www.tsa.gov/for-industry/hazmat-endorsement

TSA PreCheck Application Program:

• https://www.tsa.gov/precheck

TSA Alien Flight Student Program (AFSP):

• https://www.flightschoolcandidates.gov/afsp2/?acct_type=c&section=WN http://www.tsa.gov/for-industry/twic https://universalenroll.dhs.gov/programs/twic http://www.tsa.gov/for-industry/hazmat-endorsement http://www.tsa.gov/for-industry/hazmat-endorsement https://www.tsa.gov/precheck https://www.flightschoolcandidates.gov/afsp2/?acct_type=c&section=WN

TSA Aviation Programs

• Aviation Programs | Transportation Security Administration

TSA Cargo Programs

• Cargo Programs | Transportation Security Administration

13. DELIVERABLES

Item

PWS

Reference

Deliverable/ Description

Contractor Submits

Branch

Review Date

Frequency

Submitted to

Type

1 6.2.1 Update to the User By COB 60 Within 20 Annually Enrollment Services Submitted Interface Design, Tools, days after business & Vetting Programs, electronically and Procedures for award or the days Vetting Programs – DHS Biometric next business after Branch Manager Identification day receipt System

(IDENT/HART).

2 6.2.4 Update to the By COB 180 Within 20 Annually Enrollment Services & Vetting Programs, Vetting Programs Branch Manager

Submitted Recommendations on days after business electronically the use of IDENT/ award or the days HART for TSA initial next business after and recurrent vetting. day receipt

3 6.1.5.1 Monthly Status Report By COB on 1st Within 20 Monthly Enrollment Services Submitted

6.2.7 that includes the calendar day business & Vetting Programs, electronically previous month’s of each month days Vetting Programs – accomplishments, or next after Branch Manager, COR areas with business day receipt concerns/risks, and prior to the recommendations, and invoice being status of deliverables submitted for all CLINs

4 6.1.2.3 Update the Rap Back By COB 180 Within 20 Bi-annually Enrollment Services Submitted Lessons Learned days after business & Vetting Programs, electronically Document suitable for award or the days after Vetting Programs – TSA vetted next business receipt Branch Manager populations. day

5 6.1.1 Update User/Implementation Guides

By COB on requested day

Within 20 Business days after receipt

Quarterly Enrollment Services & Vetting Programs, Vetting Programs - Branch Manager

Submitted electronically

6. 6.1.6, 6.1.7 Final Report and Transition Plan

By COB on requested day

Sixty (60) working days prior to the conclusion of the contract.

Enrollment Services & Vetting Programs, Vetting Programs Branch Manager, COR

Submitted electronically

7 7.2.7 XML rap sheet and By COB 270 Within 20 270 days Enrollment Services Submitted enhanced adjudication requirements and process flows among TSA vetting applications, days after award or the next business day

Business days after receipt after award & Vetting Programs, Vetting Programs Branch Manager electronically requirements and intelligence resources https://www.tsa.gov/for-industry/aviation-programs https://www.tsa.gov/for-industry/cargo-screening-program

8 7.1 Biometric standards By COB 60 Within 20 Twice Enrollment Services Submitted technical report – days and 270 business annually & Vetting Programs, electronically summarizing analysis, days after days Vetting Programs – research, requirements award or the after Branch Manager and technology next business day receipt

Item PWS Reference

Deliverable/ Description

Contractor Submits

Branch Review

Date

Frequency

Submitted to

Type

9 7.1 Test plans and tools As Required / Within 20 As Required Enrollment Services Submitted for test implementation When directed business / When & Vetting Programs, electronically of biometric standards days Directed (not Vetting Programs – after to exceed 4 Branch Manager receipt times per year)

10 7.1 Technical report By COB 330 Within 20 Annually Enrollment Services Submitted including findings - days after business & Vetting Programs, electronically Research award or the days Vetting Programs – measurement, next business after Branch Manager evaluation, and day receipt standards to develop and advance the use of biometric technologies including fingerprint, face, iris, voice, multi-modal techniques, and emerging identity technologies

11 7.1 Technical report By COB 270 Within 20 By COB 270 Enrollment Services Submitted including – status of days after business days after & Vetting Programs, electronically common models and award or the days award or the Vetting Programs – metrics for identity next business after next Branch Manager management, critical day receipt business standards, and day, interoperability of Annually electronic identities.

12 8.1.1 Data quality plan By COB 60 Within 20 Quarterly Enrollment Services Submitted days after business & Vetting Programs, electronically award or the days Vetting Programs – next business after Branch Manager day/ Quarterly receipt

13 8.1.2, Technical report By COB 180 & Within 20 Twice, Enrollment Services Submitted 8.1.3, capturing root causes, 360 days after business Annually & Vetting Programs, electronically

8.1.4 impacts and award or after days Vetting Programs – remediation options, the next after Branch Manager as well as business day receipt recommendations to

TSA

14. Quality Assurance Surveillance Plan

1. Introduction

This Quality Assurance Surveillance Plan (QASP) is pursuant to the Performance Work Statement (PWS). The surveillance and evaluation Quality Assurance (QA) methods identified in the QASP will assure the Government is receiving the standard of service detailed in the PWS.

This plan sets forth the procedures and guidelines the Government will use in ensuring the required performance standards or services levels are achieved by the contractor. The Government retains the right to change the surveillance methods and procedures, and to increase or decrease the degree of surveillance efforts at any time necessary to assure contract compliance.

1.1 Purpose

The purpose of the QASP is to describe the methods used to monitor performance and to identify the required documentation and the resources to be employed. The QASP provides a means for evaluating whether the contractor is meeting the performance standards and quality levels identified in the PWS.

This QASP defines the roles and responsibilities, identifies the performance objectives, defines the methodologies used to monitor and evaluate the contractor’s performance, and describes quality assurance documentation requirements.

The QASP is intended to accomplish the following:

• Identify the procedures and guidelines used to evaluate the performance of the Contractor.

• Define the role and responsibilities of participating officials

• Define the key service levels that will be measured.

• Describe the rating criteria and evaluation methods employed in accessing the Contractors performance.

• Identify the forms, reports and resources used to document monitoring efforts and results.

1.2 Performance Management Approach

This QASP will define the performance management approach used to monitor and manage the contractor’s performance to ensure the expected outcomes or performance objectives communicated in the PWS are achieved.

1.3 QASP Revisions

Revisions to this surveillance plan are the responsibility of the Contracting Officer’s Representative (COR). Changes may be made unilaterally and need not be coordinated with the Contractor; the government may provide informational copies to the Contractor at its option. The COR will discuss with the Contracting Officer (CO) the proposed changes/revisions to ensure they do not change the contractual requirement.

2. Roles and Responsibilities

2.1 Contractor Responsibility

The Contractor is responsible for accomplishing all tasks/services in accordance with the contract.

2.1.1 Program Manager Responsibility

The Contractor Key Personnel is responsible for monitoring quality assurance of the requirement.

2.2 Government Responsibility

The Contracting Officer (CO) and the Contracting Officer’s Representative (COR) are the key Government personnel who will be responsible for QA.

2.2.1 Contracting Officer (CO) Changes to the QASP that could change the contractual requirement must be submitted to the CO for a modification to the contract before they are incorporated in the QASP. In accordance with Federal Acquisition Regulation (FAR) 42.302(a) (57), the CO also delegates specific surveillance tasks and authorities by formal letter to the COR.

2.2.2 Contracting Officer’s Representative (COR)

The COR represents the CO in all technical functions and is therefore, the Contractor’s initial point-of-contact with TSA.

In turn, the COR may delegate to other qualified Government personnel specific responsibilities in order to ensure that the QA function is properly executed.

The COR is not empowered to make contractual commitments, authorize contractual changes, direct or interfere with the methods of performance by the Contractor, or to issue directions to any Contractor personnel on TSA’s behalf.

Some of the key contract administration duties of COR includes, but not limited to, the following:

• Perform surveillance as required by this QASP and make recommendations to the CO regarding issues of noncompliance, deficiency, or commendation.

• Make recommendation to the CO identifying necessary contract modifications and any changes to the QASP.

3. IDENTIFICATION OF REQUIRED PERFORMANCE STANDARDS/QUALITY LEVELS

3.1 Performance Description

Contractor performance will be monitored through various surveillance techniques described in Section 14 Surveillance Techniques. This plan describes the methodology utilized to make both quantitative and qualitative evaluation of Contractor performance under the contract.

3.2 . Acceptable Performance Standards (APS) The Acceptable Performance Standards (APS) in Section 14 provides the PWS performance standards and levels.

The Contractor will be held responsible for all identified discrepancies, and TSA may require the Contractor to re-perform or correct the work at no additional cost to TSA.

3.3 Documenting Performance

3.3.1 Acceptable Performance

The Government will document positive performance. Any report may become a part of the documentation supporting contract past performance.

3.3.2 Unacceptable performance

When unacceptable performance occurs, the COR will inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the COR will document the discussion and place it in the COR file.

When the COR determines formal written communication is required, the COR shall prepare a letter (via email) from the CO and present it to the contractor's Program Manager.

The contractor shall acknowledge receipt of the letter (via email) in writing. The notification will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The notification will also state how long after receipt the contractor has to present this corrective action plan to the COR. The Government shall review the contractor's corrective action plan to determine acceptability.

Any notifications may become a part of the supporting documentation for contract payment deductions or other actions deemed necessary by the Contracting Officer.

3.3.3 Remedial Actions

The FAR allows for penalties in the event that the Contractor fails to perform the required services. Penalties are defined as those actions taken under the direction of the CO against the Contractor within the general provisions of the contract for noncompliance to the PWS.

In accordance with FAR 46.102 and FAR 46.105, the Government will not accept nonconforming products and/or services. The Contractor is required to correct products and/or services that fail to meet contract requirements, at no cost to the government. If the Contractor fails to proceed with reasonable promptness to perform the required correction, the Government may take actions to collect consideration for work not accomplished.

4. Performing Quality Assurance

The COR and other designated Government personnel perform contract surveillance using various methods and reports results as required.

4.1 Surveillance Techniques

The following performance monitoring methods may be applied individually or in combination. The method or combination of methods used when conducting an inspection must be noted when describing the surveillance.

Task reporting can consist of 100% inspection, random sampling or periodic inspection. When using Contractor-generated reports, this method is best for general surveillance and may need to be supplemented by periodic inspections.

The COR may accept Contractor-generated reports, with prior approval by the Government, but may use other methods to investigate problem areas.

1. Direct Observation Direct observation of Contractor performance can be performed periodically or through 100% inspection. Direct Observations may be scheduled or unscheduled. Scheduled Observations are previously scheduled and coordinated with the Contractor. Unscheduled Observations may be conducted at random by TSA personnel.

2. 100% Inspection The 100% inspection method requires complete inspection of a contract requirement and will be used for requirements that are especially critical or where there is some reason for suspecting that the performance standard is not being met and requires more stringent monitoring.

3. Periodic Inspection Periodic inspection, sometimes called “planned sampling,” provides a systematic way of looking at service outputs and forming conclusions about the Contractor’s level of performance in accordance with a planned schedule of surveillance. Evaluation by periodic inspection is designed to inspect some part but not all of the products and services being monitored. The levels of evaluation appropriate for periodic inspection are discretionary. In order to perform trend analysis from periodic inspection, criteria for sample selection should be applied consistently from period to period. Observed discrepancies monitored by periodic inspection will be totaled and assessed at the end of each evaluation period. For each requirement, the findings will be compared to the performance standard and APS.

4. Random Sampling Random Sampling is the most appropriate method for recurring tasks. This QA method is designed to evaluate Contractor performance by randomly selecting and inspecting a statistically significant sample. Random sampling is recommended for large quantity repetitive actives with objective and measurable quality attributes. The random sampling procedures consider the APS, the level of the evaluation effort, and the population size.

Random Sampling is based solely on a statistical analysis whereby a conclusion is drawn about a population based on a randomly selected sample of that population. For the conclusion to be valid, the sample selected must be representative of the population.

5. DOCUMENTATION AND REPORTS

Accurate and complete documentation is necessary for QASP administration. The COR will maintain a complete QASP file and provide documentation to the CO when requested. The QASP file will contain copies of all reports, evaluations, recommendations, and any actions related to the quality assurance surveillance function.