SOW_DHS Strategic Sourcing_X-Ray Systems v.9_09Oct2021 (1).docx

U.S. Department of Homeland Security U.S. Customs and Border Protection

STATEMENT OF WORK

DHS Strategic Sourcing Contract

NON-INTRUSIVE INSPECTION SYSTEMS

X-Ray Baggage/Packages X-Ray Large Parcel X-Ray Pallet

PREPARED BY:

NII PROGRAM MANAGEMENT OFFICE (PMO)

Table of Contents

PURPOSE

The United States (U.S.) Department of Homeland Security (DHS) Customs and Border Protection (CBP), Office of Field Operations (OFO), Cargo and Conveyance Security (CCS), has a requirement for improving inspection of travelers’ baggage and or packages, large parcels, pallets, and mail items. These solutions will provide the capability to detect and interdict contraband from entering the United States at and between Ports of Entry (POEs), Land Border Facilities (LBF), International Airports Clearances, and International Mail Facilities (IMF).

The United States Secret Service (USSS) has a requirement for improving inspections of personal items and packages carried in by individuals and arriving large parcels. These solutions will provide the USSS agents the ability to detect and interdict weapons and suspect items that can cause harm from entering key facilities, including buildings and grounds in which the President, Vice President, and foreign diplomats are located as well as the Treasury Building and grounds.

The United States Citizenship and Immigration Service (USCIS) is required to improve the inspections of personal items and packages, large parcels, and pallets to detect and interdict weapons and suspect items that can cause harm from entering their facilities, and to ensure the protection of Americans and security the homeland.

The US DHS components CBP, USSS and USCIS seek to acquire multiple commercially available Small Scale Non-Intrusive Inspection (NII) systems to inspect personal baggage and packages, large parcels, pallets, and flat and parcel mailing items.

To address the combined needs of the DHS components, CBP will take the role as Executive Agent for the new DHS Strategic Sourcing Contract Vehicle.

The DHS Strategic Sourcing Contract will include the procurement of the system and sub-systems, shipping, installation, testing, documentation verification, and one year of full warranty services coverage starting on the acceptance date of each system.

1.1. Background

CBP, an agency of the Department of Homeland Security (DHS), is responsible for targeting, selecting, and examining cargo that is deemed high risk for terrorist-related activity, smuggled contraband, and cargo that is in violation of trade laws. CBP is also responsible for facilitating the release of low-risk cargo.

CBP’s mission is to secure U.S. ports of entry and the border from items that are prohibited from entry, or which threaten U.S. citizens, infrastructure, resources, and food supply all while efficiently facilitating legitimate trade and travel. This mission includes the interdiction of contraband (i.e., narcotics, currency, weapons, explosives, and harmful chemicals/biological agents).

Within CBP’s Office of Field Operations (OFO), the Cargo and Conveyance Security is the Executive Director Office within OFO Headquarters that oversees Non-Intrusive Inspection, Radiation Portal Monitors, and technology; Cargo Verification, Cargo Control, and Customs Trade Partnership against Terrorism (C-TPAT). This office also oversees the National Targeting Center Cargo (NTCC), the Container Security Initiative (CSI), and the Secure Freight Initiative (SFI). The Non-Intrusive Inspection (NII) Division of U.S. Customs and Border Protection is responsible for acquiring and deploying NII technology to U.S. ports of entry. This technology enables CBP officers to screen commercial traffic for the presence of contraband, including terrorists and the implements of terror, while facilitating the flow of legitimate trade, cargo, and passengers.

The USSS is a federal law enforcement agency under the DHS charged with conducting criminal investigations and protecting U.S. political leaders, their families, and visiting heads of state or government. The USSS plays a critical role in protecting U.S. and visiting world leaders, safeguarding U.S. elections through protection of candidates and nominees, and ensuring the security of key facilities and major national-level events. Using advanced countermeasures, the USSS deter, minimize, and decisively respond to identified threats and vulnerabilities.

The USCIS is the government agency that oversees lawful immigration to the United States. Its mission is to administer the nation’s lawful immigration system, safeguarding its integrity and promise by efficiently and fairly adjudicating requests for immigration benefits while protecting Americans, securing the Homeland, and honoring our values.

1.2. Scope

The Contractor shall provide the delivery and installation of each NII system and applicable subsystems to designated locations specified by each DHS Component. The Contractor shall provide one-year warranty services for each accepted NII system and subsystems. The warranty services shall cover production, installation, and operations of each NII system and sub-systems. Also included in this contract are all required documentation and initial user training for each accepted NII system.

The technical performance and capabilities specifications matrices of each NII system type are described by separate NII Systems Requirements Appendices in this Statement of Work (SOW).

The contract also includes training services requirements, optional extended warranty, optional yearly maintenance and corrective maintenance services at the discretion of each DHS Component.

Independent service contracts will be established by each DHS Component and applicable additional services requirements will be included in this SOW as identified by each DHS component.

1.3. Ordering Period

The DHS Strategic Sourcing contract Ordering Period is for one (1) year ordering period, and four (4) optional ordering years from the date of the award.

1.4. Acceptability

The Contractor shall support First Article Test (FAT), Factory Test (FT), and Site Acceptance Tests (SAT).

1.5. Shipping

After contract award, each DHS component will identify the physical addresses and delivery instructions for each system.

The Contractor shall deliver complete operational systems, including ancillary equipment and specified documentation within nine (9) months from the contract award date.

The Contractor shall ensure proper testing, inventory, and operation of all items prior to delivery.

The Contractor shall retain ownership of the systems until the Government accepts delivery Free on Board (FOB) Destination.

1.6. Government Furnished Materials, Property, and Information The Contractor shall coordinate with the CBP Contracting Officer Representative (COR) for the specific locations for information associated with any environmental operating limits. The Government will provide phone lines, electrical power, and exterior lighting as required for installations at each site.

1.7. Program Organization

This procurement is under the technical direction of the Contracting Officer Representative (COR) assigned to the CBP Office of Field Operations (OFO) Cargo and Container Security (CCS) NII Program Management Office (NII PMO).

The warranty, repair, on-demand training, and logistic support will be managed as described by each DHS Component, as outlined in both Appendix D & Appendix E.

1.8. Government Management Organization

CBP management of this procurement will be accomplished through the CBP OFO/CCS/NII PMO for system acquisition, delivery, and acceptance.

1.9. Contractor Management Organization

The Contractor shall provide a Project Management Plan for CBP Review including all major points of contact and the Contractor overall management structure. This plan shall include the schedule for completing all tasks required to fabricate, ship, install, test, train, and maintain the NII Systems and all major points of contact and the Contractors’ overall management.

APPLICABLE DOCUMENTS

The current versions of the following Applicable Documents shall be referenced and used as called for in this Statement of Work and in the Data Item Descriptions (DIDs)

2.1. Federal Regulations

a. Code of Federal Regulations (CRF), 10 CFR Part 20, Standards for Protection against Radiation- Nuclear Regulatory Commission (NRC)

b. 10 CFR 39.35, Leak Testing of Sealed Sources (NRC)

c. 10 CFR Part 71, Packaging and Transportation of Radioactive Material, 2012, (NRC)

d. 21 CFR Part 179, Irradiation in the Production, Processing and Handling of Food - Food and Drug Administration (FDA)

e. 21 CFR1020.40, Cabinet X-Ray systems (FDA)

f. 29 CFR Part 1910, Occupational Safety and Health Standards (Occupational Safety and Health Administration (OSHA))

g. 49 CFR Part 172, Hazardous Materials - Table, Special Provisions, Hazardous Materials Communications, Emergency Response Information, Training Requirements, and Security Plans (Department of Transportation (DOT)

h. 49 CFR 1544.211 (e) (3), Use of X-Ray systems

Note: These regulations can be accessed by going to https://www.ecfr.gov

2.2. National Standards

a. American National Standards Institute, ANSI/IEEE N42.41, Minimum Performance Criteria for Active Interrogation Systems Used for Homeland Security, 2007

b. American National Standards Institute, ANSI/IEEE N42.46, Determination of the Imaging Performance of X-Ray and Gamma-Ray Systems for Cargo and Vehicle Security Screening, 2008

c. American National Standards Institute, ANSI/HPS N43.3, General Radiation Safety - Installations Using Non-Medical X-Ray and Sealed Gamma-Ray Sources, Energies up to 10 MeV, 2008

d. American National Standards Institute, ANSI/HPS N43.14, Radiation Safety for Active Interrogation Systems for Security Screening of Cargo, Energies up to 100 MeV, 2011

e. National Fire Protection Association, NFPA 79, Electrical Standard for Industrial Machinery, 2018

f. National Fire Protection Association, NFPA 70B, Recommended Practice for Electrical Equipment Maintenance, 2019

g. Federal Information Processing Standards Publication (FIPS PUB), Number 140-3, Equipment, 2019

2.3. DHS/CBP Documents

a. CBP Information Systems Security Policies and Procedures Handbook, HB 1400-05D, Version 7.0

b. DHS-CBP N.25, Standard Messaging Protocol, Version 1.5.0.6, 2009

c. CBP Interface Control Document, Version 4, 2010

d. DHS Sensitive Systems Policy Directive 4300A, Latest Version.

e. Federal Information Processing Standards Publication (FIPS PUB), Number 140-2, Security Requirements for Cryptographic Modules, 2001

f. U.S. Land Port of Entry Design Standard, 2018.

GENERAL REQUIREMENTS

The NII systems shall conform to OSHA Standards, (29 CFR 1910.120), NFPA 79, Chapter 4, and NFPA 70, Article 110 requirements.

The Contractor shall perform all work necessary to fabricate and deliver the specified NII System.

The Contractor must meet or exceed all technical specifications of each type of NII system as identified on the NII System Requirements (see Appendix A, B and C) in this SOW.

The Contractor shall perform the work necessary to develop, test, and deliver the procured equipment.

The Contractor shall also provide any warranties, training, and documentation in support of each NII system acquired, as outlined in Appendix D and Appendix E.

The Contractor shall also provide sustainment support as identified in the Sustainment Support Requirements required by each DHS component (See appendix D for CBP requirements) in this SOW.

The Contractor shall prepare Monthly Progress Reports in accordance with the attached DID A006 while performing tasks within this SOW.

3.1. Requirement Definitions:

The minimum level of operational performance that the Government is willing to accept is considered a threshold value. A system that does not meet one or more threshold requirements will not be accepted.

3.2. Minimum NII System Requirements

The SOW Appendices as listed below describe the minimum NII system requirements of performance categories for each NII system.

Appendix A: System Requirement NII X-Ray Baggage and packages Appendix B: System Requirement NII X-Ray Large Parcel Appendix C: System Requirement NII X-Ray Pallet Appendix D: CBP Service Requirements (NII Cost-Wise Readiness and Life Cycle Sustainment Support) Appendix E: DHS Service Requirements (Cost-Wise Readiness and Life Cycle Sustainment Support)

3.2.1. NII Minimum Computer Security Requirements

The computer shall be equipped with on-screen color enhancements to illustrate specific materials based on density. The computer shall be equipped with a DHS approved Operating System.

The computer shall have dual Monitors with horizontal and vertical views 19" or better with USB expansion ports.

NII System computers and software programs that allow a User to analyze, enhance, and store an Image Data Set (IDS), and the Data Base computers and programs that store the IDS, shall have the following security features incorporated:

· The system computer shall have a DHS Warning Banner displayed at power up before log on screen. The DHS Warning Banner will be provided by the Government.

· The system shall allow only CBP authorized encrypted thumb drives (Aegis).

· The system computer shall be configured to auto screen lock after 20 minutes of inactivity and auto logout at 60 minutes of inactivity.

· Each user shall have a unique username/password.

Password requirements:

· 12 characters minimum

· Each password shall include an uppercase character, lowercase case character, number, and special character

· Expires every 90 days

· New passwords cannot duplicate past 8 passwords

· CBP policy controlled

· No simple alpha or numeric patterns

· Cannot be same as username/ID

· No blank password

· After 3 unsuccessful logon attempts, 20-minute lockout (Admin can unlock anytime).

· User account shall never be fully locked out of system, e.g., if password is expired. User shall be warned of expired password and be allowed to change the password.

· Printed documents must have “LAW ENFORCEMENT SENSITIVE” in header or footer, on ALL pages.

· Ability to print current screen and print complete Image Data Set (IDS)

· Wireless technology that is DHS 4300A compliant if installed.

· User access shall be configured with Minimum 3 user levels:

· Operator Level 3 – All image analysis functions, except copy/delete; no OS access/no user admin

· Operator Level 2 – All image analysis functions including copy/delete; no OS access/no user admin

· Administrator – All image analysis functions including copy/delete/user administration, OS access

· SuperUser (not required) – Access to OS and diagnostic tools

Records/IDS adjudicated as “SUSPECT” can never be deleted or changed to “NON-SUSPECT.”

Audit Records – System shall retain audit records sufficient in detail to facilitate the reconstruction of events if compromised or if malfunction occurs.

All NII system computer operating systems shall be upgradeable to meet CBP compliance policy guidelines.

· Ensure that all proposed configuration changes to operating systems, operating system security features, applications, critical system files, and system devices are formally approved, tested, and documented prior to the change being implemented

· Only licensed and approved operating systems and applications may be used on DHS workstations

3.2.2. NII Small Scale Systems Software Requirements

Software shall have the DICOS file format for data interchange capability.

DICOS – An Industry Standard for Security Equipment Image Sharing The Digital Imaging and Communication for Security (DICOS), an industry standard developed by the U.S. National Electronics Manufacturers Association (NEMA). DICOS defines an interoperable data format for integration of security screening technologies across multiple vendor platforms. It facilitates the development and use of improved security screening technologies and third-party software.

The Digital Imaging and Communications in Security (DICOS) Standard, designated as NEMA IIC 1 v02A, provides a data interchange protocol and an interoperable, extensible file format to facilitate data information interchange (e.g., demographic information, x-ray radiographs, CT images, material-specific information, trace detection signatures, threat assessment) of objects of inspection (e.g., checked luggage, carry-on luggage, parcels, and personnel) for security screening applications.

3.3. NII Small Scale gamma ray interference

System shall not interfere with radiation portal monitor gamma-ray detection operations. Any shielding structures must be part of the unit cost and not interfere with safe transit of the area. System operation shall not increase the background gamma-ray dose rate at 10 ft. in all directions from the outer sides of the system by more than 1.0 µR/hr. This includes scanning a continuous stream of packages ranging in size from the system minimum to the system maximum. The non-interference requirement will be verified by CBP with an operational Radiation Portal Monitor (RPM) at the Site Acceptance Test (SAT).

NII Systems Services Requirements:

Each NII system shall be maintained to allow for the operational use for no less than 10 years. The NII system shall be capable of exceeding a normal operating period of 16 hours a day, 6 days a week, and 52 weeks a year during an operating life of 10 years and shall be capable of surge operations consisting of 24 hours a day, 7 days a week for 2 weeks (336 hours).

3.4. Warranty

The Contractor shall provide a minimum of one-year total warranty on the system, subsystems, peripherals, fabrication, and installation services of each NII system in accordance with the DID A020.

The warranty period shall begin on the date of the signing of the Site Acceptance Test (SAT) of the NII system. The Contractor shall provide warranty certificate(s) and documentation.

The Contractor shall provide documented warranty terms for the system to include, but not limited to, the NII system, associated generators, accessories, air conditioners, compressors, computers, controls, lights, cameras, electrical boxes, housings, batteries, chargers, power conditioners, etc. Warranty services shall include parts, labor, consumables, travel, shipping, and transportation required to maintain performance standards and design performance requirements.

3.5. Technical Documentation

The Technical Documentation shall consist of all documentation used by the Contractor and all subcontractors in the production of NII systems and any follow-on production or modification. This shall include the Configuration List and any background or supporting documentation used to make design or production decisions. The Contractor shall maintain this documentation past the planned life of NII systems and subsystems in accordance with DIDA017.

3.6. Configuration Management

The Contractor shall establish and maintain a Configuration Baseline for the NII systems.

The Configuration Baseline is:

· An agreed-to description of the attributes of a product, at a point in time, which serves as a basis for defining change.

· An approved and released document, or set of documents, each of a specific revision, the purpose of which is to provide a defined basis for managing change.

· The currently approved and released configuration documentation.

· A released set of files comprising a software version and associated configuration documentation.

All NII system and its components, delivered within a production lot, shall be identical and conform to the Configuration Baseline. The Configuration Baseline shall be incorporated into the Technical Documentation and maintained by the Contractor during the term of the contract. The Government data rights under the contract include all Configuration Baseline documentation. (See DIDA017).

3.7. Management of the Technical Documentation

The Contractor shall maintain a Technical Documentation file at the Contractor's point of manufacture, which contains all relevant data for the design and production of NII systems, produced under this contract. (See DIDA017)

3.8. Engineering Change Proposals

As technological advances occur and become available, the Contractor shall provide recommendations in the form of Engineering Change Proposals (ECPs) for performance enhancements, reliability improvements, and cost savings to the COR for the Government’s review and consideration. ECPs enhance the performance or reliability of the finished goods or services or reduce the cost of the good or services for the Government. ECPs may be proposed by either the Contractor or the Government. All ECPs must be approved by the Government before changes can be made that effect the form, fit, or function of the NII systems or subcomponents, including technology refresh improvements. All approved ECPs shall be incorporated into the Configuration Baseline and Technical Documentation package. (See DIDA017)

3.9. Configuration Changes

The Contractor shall provide an as-built Configuration with the delivery of each NII system and subsystem configuration. All configuration changes require prior approval of the Government or the COR in accordance with DIDA016.

The Contractor shall not substitute equipment or make any modifications to equipment ordered under this contract that would result in any change to the Contractor model number, part number, or series on deliverable equipment unless authorized in writing by the Contracting Officer. COR approval shall be required for changes to the software baseline and after the first delivery of NII systems and subsystems.

3.10. NII Systems Safety

The Contractor shall maintain a NII system safety program that continually identifies all hazards and provides a methodology to either eliminate or control these identified hazards in accordance with DIDA023.

3.11. Radiation Safety

The Contractor shall provide a radiation dose map in the Contractor’s format for the NII system that shows the personnel safety zone. All products, designs, and specifications provided, and all construction and installation activities conducted shall comply with all OSHA and NRC regulations, as well as any other applicable laws, regulations, standards, codes, and health and safety guidelines. (See DIDA015)

3.12. Radiological Survey

The Contractor shall be required to conduct a radiological survey prior to the NII system delivery to ensure that radiation emissions are within specified limits. Each NII system delivered shall be accompanied by a report of the radiological survey performed on the NII system, signed by the Radiation Safety Officer of the company. This survey will address both the radiation levels that the NII system’s operators will be exposed to while at their workstations and the level of radiation that is transmitted to the environment as a result of the NII system’s leakage. The report shall show that by means of an outline drawing the levels of emission/scatter radiation measured, the ‘worst case’ operating conditions (i.e., highest energy level, slowest scan speed, greatest scatter range) and the measurement equipment used. The Contractor shall provide a radiological survey report and a Radiation Survey Report or Leak Test Report as applicable for each NII system delivered. (See DIDA015)

3.13. Annual Radiation Survey

The Contractor shall perform Radiation Surveys of the NII system at the delivery site prior to Site Acceptance Test (SAT) and annually thereafter. The NII system shall be in compliance with 21 CFR 1020.31, Radiographic Equipment, (a) Control and indication of technique factors (energy, time, and amperage) and (b) Reproducibility (ability of device to produce consistent radiation doses). The Contractor shall provide a radiation survey report to the ILD Maintenance Dispatch Center within 48 hours of completion. (See DIDA015)

3.14. Hazardous Materials

In accordance with 29 CFR 1910.1200 (e)(2), Occupational Safety and Health Standards (OSHA), the Contractor shall provide a list of all hazardous materials and the corresponding Material Safety Data Sheet (MSDS) for each identified Hazardous Material. The list shall include the material description, quantity of the material, storage and disposal instructions, exposure risks, symptoms, and treatments. The list shall be prepared and shall be maintained in the Technical Documentation Package throughout the life of the NII system. The Contractor shall derive the list from the Hazardous materials identified in the 49 CFR 172.101, Purpose and use of hazardous materials table. (See DIDA004)

3.15. NII systems User’s Manual

A NII system User's Manual is required for each unit developed or produced. The NII system User's Manual shall contain a description of NII system and its operation. The NII system’s limitations, safety information, and other important information shall be highlighted. The NII system User's Manual shall contain a detailed explanation of every task required during the operation of the NII system. All operator-level maintenance tasks shall be fully explained in the NII system User's Manual in accordance with DIDA008.

3.16. Operational/Storage Checklist

The Contractor shall provide a laminated Operators Checklist on a single sheet, for each unit developed or produced under this contract, listing each step in the procedure required: (1) for operating NII system, (2) for preparing an operational NII system for short or long-term storage and, (3) for preparing a stored NII system for operation. The checklist shall only list the sequential steps. The Contractor shall describe each step in detail in the NII system User's Manual, and each step shall reference the appropriate NII system User's Manual page number. The Contractor shall attach the checklist near the Operator's station.

3.17. Project Management Plan

The Contractor shall provide a Project Management Plan for CBP Review including all major points of contact and the Contractor overall management structure. This plan shall include the schedule for completing all tasks required to fabricate, ship, install, test, train, and maintain the NII Systems and all major points of contact and the Contractors overall management.

The Project Management Plan shall be prepared in accordance with DIDA001.

3.18. Quality Assurance/Quality Control Plan

The Contractor shall provide a Quality Assurance (QA) plan based on the most current and applicable certified ISO processes and procedures. The Contractor’s QA plan shall define key performance measures to include traceable metrics, verifiable performance standards, and address risk identification and mitigation processes used to meet the performance requirements in this Statement of Work in accordance with DIDA012.

3.19. Acceptance Test Plan (ATP)

The Contractor shall provide the Acceptance Test Plan (ATP) in accordance with DIDA013. The Acceptance Test Plan will be utilized to establish testing guidelines and support requirements needed for the conduct of the test program.

3.20. Monthly Progress Report

The Contractor shall prepare and submit monthly progress reports detailing efforts completed during the reporting period (calendar month), percent of overall completion, estimated time to completion, and problems encountered with associated risks in accordance with DIDA006.

3.21. Contractor Technical Documentation

The Contractor shall provide the Government with a list of all Contractor technical manuals and software CD/DVDs that will remain with the unit to assist approved technical personnel in the troubleshooting and correction of hardware failures and software faults.

The contractor Technical Documentation will be provided in accordance with DIDA010.

3.22. Equipment Installation Data Package

The Contractor shall provide the Equipment Installation Data. The Equipment Installation Data Package establishes the basic design criteria required to modify/design facilities to accommodate the new equipment. It is used during site surveys as the baseline with which unique site conditions are identified that may alter the basic design criteria. The equipment Installation Data Package shall be provided in accordance with DIDA005.

3.23. Service and Maintenance Manual

The Contractor shall provide the Service and Maintenance manual. The manual shall contain the procedures and steps necessary for trained personnel to maintain the NII System. The Service and Maintenance Manual shall be provided in accordance with DIDA009.

3.24. Classification of Reliability Critical Items

The Reliability Prediction Report is used to identify reliability of critical items and failure mitigation as part of the Contractor’s quote. These Reliability Predictions will be compared to the system’s (Ai) and (Ao). A Critical Item is an identified weak link in a NII system, which has an adverse impact on, or contributes to, failures of the NII system performing its mission, creation of potential safety problems, significant degradation of the scanned image quality, or contributes to other areas of high risk to overall NII system reliability or performance. The Reliability Report Prediction shall be provided in accordance with DIDA002.

3.25. Training

The Contractor shall provide training development and delivery for systems and related items that are designed and built/produced under this contract. The Training shall consist of procedures for installation, setup, image viewer software, operation and maintenance of the NII systems developed or produced as appropriate. Documentation of the Training in the Contractor’s format may include, but is not limited to, a Training Management Plan, Training Design Plan, Outline, Student Guide, Instructor Guide, hand-out materials and other training aids, "hands on" exercises, a training report, and student evaluations of the training.

INFORMATION TECHNOLOGY SECURITY

The Contractor shall adhere to all DHS and CBP IT security policies and the basic requirements, security authorization, encryption compliance, and pass security review.

System shall comply with CBP Information Systems Security Policies and Procedures Handbook, HB 1400-05D (Latest Revision).

System shall comply with DHS Sensitive Systems Policy Directive 4300A, v13.1 or Latest Version.

System shall be equipped with the equivalent functionality of the latest approved version of the CBP Technical Reference Model (TRM) for the System Software Image.

4.1. Basic Requirements

The Contractor shall adhere to all DHS and CBP IT security policies listed in the Applicable Documents section, including the guidelines and policies stated in the DHS Sensitive Systems Policy Directive 4300A, chapters 4 and 5, or any subsequent, replacement or revised publication. This policy mandates DHS organizational elements, including Contractors, follow guidelines outlined in the DHS MD 4300A, DHS Sensitive Systems Handbook, Information Technology Security Program, version 12, 11/15/15 with attachments or any subsequent, replacement, or revised publication.

DHS Directive 4300A, Section 3.2., Basic Requirements outlines the management, operational, and technical baseline security requirements (BLSR) for DHS Components to ensure confidentiality, integrity, availability, authenticity, and non-repudiation of sensitive information systems. The 4300A Handbook provides greater detail of the BLSRs, including the roles and responsibilities associated with each.

CBP will provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Order in accordance with DHS MD 4300A, DHS Sensitive Systems Policy and Handbook, paragraph 4.1.1.d. During all systems development life cycle (SDLC) phases of CBP systems, CBP personnel will develop documentation and provide any required information for all levels of classification in support of the certification/accreditation process. In addition, all security certification/accreditation will be performed using the DHS certification/accreditation process, methodology, and tools.

The Contractor shall provide systems that conform to the following requirements:

Legacy air gapped non-integrated systems shall:

Wi-Fi shall not be used and must be disabled.

All operating systems must use the requisite DHS STIGs for hardening configurations.

All systems shall use required encryption for data at rest.

Contractor shall not remove image data from systems nor store said data on contractor networks.

Ground-truthing or tuning of systems will be performed only on CBP systems and not on Contractor networks unless specifically authorized.

4.2. Security Authorization

a) A Security Authorization of any infrastructure directly in support of the DHS information systems shall be performed by the Contractor as a general support system (GSS) ‘prior to DHS occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results. The Security Authorization shall be performed in accordance with the DHS Security Policy and the controls provided by the hosting provider shall be equal to or stronger than the Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, Section 3, security categorization of the DHS information systems.

b) At the beginning of the contract, and annually thereafter, the Contractor shall provide the results of an independent assessment and verification of security controls in the Contractor’s format. The independent assessment and verification shall apply the same standards that DHS applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the COR for entry into the DHS’ Plan of Action and Milestone (POA&M) Management Process. The Contractor shall use the DHS’ POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS POA&M Management Process. Contractor procedures shall be subject to periodic, unannounced assessments by DHS officials. The physical aspects associated with Contractor activities shall also be subject to such assessments.

c) On a periodic basis, the DHS, and its Components, including the DHS Office of Inspector General, may choose to evaluate any or all the security controls implemented by the Contractor under these clauses. Evaluation could include, but is not limited to, vulnerability scanning. The DHS and its Components reserve the right to conduct audits at their discretion. With ten working days’ notice, at the request of the Government, the Contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein DHS information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of DHS, including those initiated by the Office of the Inspector General. The Government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by DHS in the event of a security incident.

4.3. Enterprise Security Architecture

The Contractor shall utilize and adhere to the DHS Enterprise Security Architecture in accordance with applicable laws and DHS policies to the satisfaction of the DHS COR. Areas of consideration could include:

1. Use of multi-tier design (separating web, application, and data base) with policy enforcement between tiers

1. Compliance to DHS Identity Credential and Access Management (ICAM)

1. Security reporting to DHS central control points (i.e., the DHS Enterprise Security Operations Center (ESOC) and integration into DHS Security Incident Response

1. Integration into DHS Change Management (for example, the Infrastructure Change Control Board (ICCB) process)

1. Performance of activities per continuous monitoring requirements

4.4. Product Assurance

Information Assurance (IA) is considered a requirement for all systems used to input, process, store, display, or transmit sensitive or national security information. IA is achieved through the acquisition and appropriate implementation of evaluated or validated commercial-off-the-shelf (COTS) IA and IA-enabled Information Technology (IT) products. These products provide for the availability of systems. The products also ensure the integrity and confidentiality of information and the authentication and nonrepudiation of parties in electronic transactions.

Strong preference is given to the acquisition of COTS IA and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting sensitive information) that have been evaluated and validated by authorized commercial laboratories or by NIST, as appropriate, in accordance with the following:

- The National Institute of Standards and Technology (NIST) FIPS validation program

- The NSA/NIST National Information Assurance Partnership (NIAP) Evaluation and Validation Program

- The International Common Criteria for Information Security Technology Evaluation Mutual Recognition Agreement

4.5. Continuous Monitoring

The Contractor shall participate in DHS’ Continuous Monitoring Strategy and methods, or shall provide a Continuous Monitoring capability that the DHS determines acceptable. The DHS Chief Information Security Officer (CISO) issues annual updates to its Continuous Monitoring requirements via the Annual Information Security Performance Plan. At a minimum, the Contractor shall implement the following processes:

Asset Management Vulnerability Management Configuration Management Malware Management Log Integration Security Information Event Management (SIEM) Integration Patch Management Providing near-real-time security status information to the DHS ESOC. The Contractor shall establish a monitoring scope at least as comprehensive and stringent as described in DHS 4300A Sensitive Systems Handbook, Attachment F, “Incident Response.” Specific Protections.

Specific protections that shall be provided by the Contractor include, but are not limited to the following:

Security Operations The Contractor shall operate a SOC to provide the security services described below. The Contractor shall support regular reviews with the DHS Information Security Office to coordinate and synchronize the security posture of the contractor hosting facility with that of the DHS Data Centers. The SOC personnel shall provide 24x7x365 staff to monitor the network and all of its devices. The Contractor staff shall also analyze the information generated by the devices for security events, respond to real-time events, correlate security device events, and perform continuous monitoring. It is recommended that the Contractor staff shall also maintain a trouble ticket X-Ray Baggage / Parcel system in which incidents and outages are recorded. In the event of an incident, the contractor facility SOC shall adhere to the incident response plan.

Computer Incident Response Services The Contractor shall provide Computer Incident Response Team (CIRT) services. The Contractor shall adhere to the standard Incident Reporting process as determined by the Component and is defined by a DHS-specific incident response plan that adheres to DHS policy and procedure for reporting incidents. The Contractor shall conduct Incident Response Exercises to ensure all personnel are familiar with the plan. The Contractor shall notify the DHS SOC of any incident in accordance with the Incident Response Plan and work with DHS throughout the incident duration.

Firewall Management and Monitoring The Contractor shall provide firewall management services that include the design, configuration, implementation, maintenance, and operation of all firewalls within the hosted DHS infrastructure in accordance with DHS architecture and security policy. The Contractor shall provide all maintenance to include configuration, patching, rule maintenance (add, modify, delete), and comply with DHS’ configuration management / release management requirements when changes are required. Firewalls shall operate 24x7x365. Analysis of the firewall logs shall be reported to DHS COR in weekly status reports. If an abnormality or anomaly is identified, the Contractor shall notify the appropriate DHS point of contact in accordance with the incident response plan.

Intrusion Detection Systems and Monitoring The Contractor shall provide the design, configuration, implementation, and maintenance of the sensors and hardware that are required to support the Network Intrusion Detection Systems (NIDS) solution. The Contractor is responsible for creating and maintaining the NIDS rule sets. The NIDS solution should provide real-time alerts. These alerts and other relevant information shall be located in a central repository. The NIDS shall operate 24x7x365. A summary of alerts shall be reported to the DHS COR in weekly status reports. If an abnormality or anomaly is identified, the Contractor shall notify the appropriate DHS point of contact in accordance with the incident response plan.

Physical and Information Security and Monitoring The Contractor shall provide a facility using appropriate protective measures to provide for physical security. The facility will be located within the United States and its territories. The Contractor shall maintain a process to control physical access to DHS IT assets. DHS IT Assets shall be monitored 24x7x365. A summary of unauthorized access attempts shall be reported to the appropriate DHS security office.

Vulnerability Assessments The Contractor shall provide all information from any managed device to DHS, as requested, and shall assist, as needed, to perform periodic vulnerability assessments of the network, operating systems, and applications to identify vulnerabilities and propose mitigations. Vulnerability assessments shall be included as part of compliance with the continuous monitoring of the system.

Anti-malware (e.g., virus, spam) The Contractor shall design, implement, monitor, and manage a comprehensive anti-malware service. The Contractor shall provide all maintenance for the system providing the anti-malware capabilities to include configuration, definition updates, and comply with DHS’ configuration management / release management requirements when changes are required. A summary of alerts shall be reported to DHS COR in weekly status reports. If an abnormality or anomaly is identified, the Contractor shall notify the appropriate DHS point of contact in accordance with the incident response plan.

Patch Management The Contractor shall perform patch management services. The Contractor shall push patches that are required by vendors and the DHS system owner. This is to ensure that the infrastructure and applications that directly support the DHS information systems are current in their release and that all security patches are applied. The Contractor shall be informed by DHS which patches are required by DHS through the Information Security Vulnerability Management bulletins and advisories. Core applications, those that DHS utilizes to fulfill its mission, shall be tested by DHS. However, the Contractor shall be responsible for deploying patches as directed by DHS. It is recommended that all other applications (host-based intrusion detection system (HIDS), network intrusion detection systems (NIDS), Anti-malware, and Firewall) shall be tested by the Contractor prior to deployment in a test environment.

Log Retention Log files for all infrastructure devices, physical access, and anti-malware should be retained online for 180 days and offline for three years.

4.6. DHS Security Policy Requirement

All hardware, software, and services provided under this order must be compliant with DHS 4300A DHS Sensitive System Policy, Section 4.8, and the DHS 4300A Sensitive Systems Handbook, Section 4.8.

4.7. Encryption Compliance Requirement

Systems requiring encryption shall comply with FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

Systems requiring encryption shall comply with National Security Agency (NSA) Type 2 or Type 1 encryption.

Only cryptographic modules that are FIPS 197 (AES 256) compliant and have received FIPS 140-2 validation at the level appropriate to their intended use may be used in systems requiring encryption.

Public Key Infrastructure (PKI) (see paragraph 5.5.2.l of the Department of Homeland Security (DHS) Sensitive Systems Policy Directive 4300A).

4.8. Security Review

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this order are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer, Office of Inspector General, the CBP Chief Information Security Officer, authorized Contracting Officer’s Representative (COR), and other Government oversight organizations, access to the Contractor’s and subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of Government oversight organizations external to DHS. The Contractor shall provide access to the extent necessary for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

4.9. Access to Unclassified Facilities, Information Technology (IT) Resources, and Sensitive Information IT resources and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information paragraph 6, describes how Contractors must handle sensitive but unclassified information. DHS Sensitive Systems Policy Directive 4300A, paragraph 3.4, and DHS Sensitive Systems Handbook, MD 4300A Information Technology Security Program, Chapter 4, prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering Contractors specifically for all Orders that require access to DHS facilities, IT resources, or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the Contractor except as specified in the order.

Contractors who require access to the DHS network, such as when conducting remote maintenance, require a background investigation in accordance with DHS Sensitive Systems Handbook, MD 4300.A, paragraph 4.1.1.d.

Personal Identity Verification of Contractor Personnel

a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors, paragraph 3, Office of Management and Budget (OMB) guidance M-05-24, Appendix A, chapters 3 and 4, and Federal Information Processing Standards Publication (FIPS PUB) Number 201-2, Personnel Identity Verification of Federal Employees and Contractors, Section 2.

b) The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have routine physical access to a federally controlled facility or routine access to a Federally controlled information system.

4.10. CBP Contractor Handling PII Level

When a contractor, on behalf of CBP, handles Sensitive PII data, stores and transmits, the Contractor will accredit (ATO) this information system to the FIPS level.

4.11. DHS CBP Enterprise Architecture (EA) Compliance

The Contractor shall ensure that the design conforms to the DHS and CBP EA, the DHS and CBP Technical Reference Models (TRM), and all DHS…