TALON BPA SOO_DRAFT.docx

Transportation Security Administration

Information Technology

Technology for Applications, Logistics, Operations, and Networks (TALON) Blanket Purchase Agreement (BPA)

Statement of Objectives Solicitation #

October 23, 2025 Version 1

Solicitation # DRAFT TALON BPA SOO

THIS DOCUMENT CONTAINS ACQUISITION-SENSITIVE INFORMATION – See FAR 2.101 and 3.104 This document contains acquisition-sensitive information related to the conduct of a Federal Agency procurement, the disclosure of which is restricted by Section 27 of the Office of Federal Procurement Policy Act (41 U.S.C. §423). The unauthorized disclosure of such information may subject both the discloser and the recipient of the information to contractual, civil and/or criminal penalties as provided by law.

THIS PAGE INTENTIONALLY LEFT BLANK

THIS DOCUMENT CONTAINS ACQUISITION-SENSITIVE INFORMATION – See FAR 2.101 and 3.104 This document contains acquisition-sensitive information related to the conduct of a Federal Agency procurement, the disclosure of which is restricted by Section 27 of the Office of Federal Procurement Policy Act (41 U.S.C. §423). The unauthorized disclosure of such information may subject both the discloser and the recipient of the information to contractual, civil and/or criminal penalties as provided by law.

Table of Contents

Contents

1. Introduction The Transportation Security Administration (TSA) operates a complex and mission-critical information technology (IT) and operational technology (OT) environment that serves approximately 80,000 internal users while meeting extensive public-facing demand. The TSA Chief Information Officer (CIO) is responsible for a comprehensive, mission-critical technology portfolio that includes delivering modern, reliable, and secure engineering solutions that enable seamless across the agency's vast IT and OT environment.

This Statement of Objectives (SOO) outlines the strategic objectives imperative to design, implementation, and operation management of TSA IT infrastructure that meet stringent TSA requirements. These efforts will ensure resilient, scalable, and highly available communication systems that support TSA’s critical mission requirements, operate a resilient, scalable, and highly available IT infrastructure.

Purpose The purpose of TSA Technology for Applications, Logistics, Operations, and Networks (TALON) is to acquire robust engineering and technical services to support TSA’s IT strategic mission goals. These services include architecture, project management, design, integration, testing, training, implementation support, and transition to an Operations & Maintenance (O&M) contractor.

TALON aligns with TSA’s five IT strategic mission goals:

(1) ensuring that the delivery of information resources supports risk-based transportation security.

(2) transforming to a customer-centric business model.

(3) empowering decision-making through technology.

(4) embedding cybersecurity as a mission enabler.

(5) evolving the workforce.

Background Threats to aviation and transportation security continue to evolve in sophistication and complexity. TSA must use every available tool to anticipate, detect, and counter these threats. Innovative information technology—augmented by responsible use of Artificial Intelligence (AI)—helps TSA stay ahead of adversaries and continuously improve mission outcomes.

The CIO evaluates business and operational needs across maritime, surface, and aviation domains to deploy state-of-the-art IT infrastructure, services, and processes. TSA’s IT capabilities have expanded significantly since the agency’s inception. The CIO provides enterprise IT infrastructure, application development, sustainment, and management services at defined performance levels.

The current CIO priorities, presented below, are subject to change.

1. Digital Transformation – Modernizing IT processes and service delivery, utilizing new software applications and cloud services to provide on-demand scalability, increased access, and higher security for all TSA users.

2. Microsoft 365/Mobile Device Management – Enhancing collaboration, productivity, and citizen engagement for a mobile TSA workforce.

3. Cybersecurity – Enable advanced threat awareness, response, and adaptation to evolving threats.

4. Data Operations – Modernize the Agency’s data strategy to streamline processing and create cost efficiencies.

In addition, these priorities are drivers for modernization and enhancement to support the TSA Mission:

5. Operational Technology (OT) – Integrate emerging technologies enhancing passenger processing and customer experience at transportation hubs.

6. Connectivity – Modernizing TSA’s connectivity to realize better performance and availability while reducing costs using alternative forms of connectivity including – internet, satellite, cellular wireless.

7. Artificial Intelligence (AI) – Identify, evaluate, and integrate AI capabilities that augment existing systems and inform future modernization.

8. Mobility – Enable the TSA workforce the flexibility to perform duties without the physical connection to TSA’s infrastructure.

Scope

Scope TALON will provide TSA with engineering, integration, testing, implementation, and transition services. The overarching objectives that the Contractor must meet the implementation of TALON are as follows:

IT Domain Engineering – Provide enterprise engineering across core IT domains—including servers; enterprise and mobile applications; development, test, and production environments; local and wide area networks; hosting and cloud platforms; collaboration and communications; telecommunications; data and analytics; and security architecture and controls—to plan, design, integrate, test, implement, and transition TSA requirements. Coordinate cutovers and handoffs with the O&M contractor. Operation and maintenance of the IT domains is NOT within the scope of this contract.

Systems Engineering and Technical Assistance: Identify and propose quantifiable improvements to improve TSA’s IT infrastructure and reduce cost and risk, including alternatives analyses, business cases, total cost of ownership (TCO) assessments, and phased implementation and transition.

Major Functional Areas Task orders will span the breadth of engineering and cloud services and encompass the hardware, software, and applications supporting those services. The areas include:

System Design and Architecture (IT/OT) Engineer on-premises, hybrid, and multi-cloud architectures, including security, data, control systems, and integration patterns for interoperability with external partners.

Security Engineering Support for all TALON TSA systems including incorporating DHS and TSA policies and standards, minimizing security risks and vulnerabilities, performing POA&M remediation, providing documentation to demonstrate remediation and mitigation activities, and performing technical support for ISSOs to ensure TALON systems remain in compliance and secure.

Ensure solutions align with DHS and TSA policies and standards for Identity, Credential, and Access Management (ICAM)

Modernization and Migration Architecture redesign, capability insertions, refactoring, cloud migrations, and hybrid integrations; decommission infrastructure and services as directed.

System Upgrades and Lifecycle Engineering Plan and engineer upgrades to hardware, software, network, and service components; develop lifecycle and replacement recommendations and transition packages for O&M execution.

Develop, test, and deploy server and workstation images.

Implementation and Deployment Support Plan and execute pre-production engineering, lab validation, cutover runbooks, and implementation support, complete handoff to O&M with training and documentation.

Communication Systems Upgrades and Integration Engineer upgrades and integrations to voice, video, and data systems aligned with IT/OT architectures and security requirements.

Transition and Restoration Services Contractor conducted Operational Readiness Review to formalize transition.

Limited restoration support for systems post-transition to reinforce technical training pre-transition.

Research, Innovation, and Modernization Conduct research, testing, analyses of alternatives, cost/benefit studies, and demonstrations.

Provide feedback or recommendations for information and operational technology improvements.

System Integration and Optimization Perform engineering analysis to improve reliability, performance, scale, and cyber posture; provide tuning and configuration recommendations to O&M.

Capability Development and Testing Define requirements, design new capabilities, and conduct Verification and Validation (V&V) in lab and pre-production environments (e.g., test environments, cloud dev/stage, labs).

Voice, Video, and Data Communications Engineer and integrate Cellular, Wi-Fi, VoIP, VTC, collaboration platforms (e.g., Teams, WebEx, UCS) across IT/OT environments; ensure reliability, security, and interoperability.

ITSM/ITOM Process Engineering (ServiceNow) Develop standard engineering processes aligned to relevant frameworks (e.g., change/release/configuration from an engineering perspective) to support O&M execution.

ITSM/ITOM platform enhancements focused on increasing automation, standardization, and transparency in IT service delivery and operational management processes.

Potential platform enhancements to support additional organizational functions, such as Governance, Risk, and Compliance (GRC) or Human Resources (HR), to enable broader integration and operational efficiency with ITSM and ITOM platform.

Training and Knowledge Transfer Develop and deliver training materials, updated runbooks, and transition documentation to enable successful O&M execution.

Artificial Intelligence (AI) / Machine Learning Analyze AI/ML where it delivers clear mission value and efficiency gains, including requirements analysis, data preparation, and prototyping. Machine Learning Operations (MLOps) for version control, monitoring, and rollback. Initial focus areas may include anomaly detection, predictive maintenance, document/media processing, and workflow automation. Solutions will incorporate appropriate privacy, security, auditability, operator training, and sustainment plans with measurable outcomes.

Deliver integration with existing systems via secure interfaces and test and evaluation against defined performance baselines.

Integrated Master Schedule TSA Information Technology (IT) has identified a requirement for the development and use of a Resource-Loaded Integrated Master Schedule (RL-IMS) for the tracking and reporting projects and operations and maintenance activities.

The contractor(s) selected within the TALON BPA will be required to integrate task orders into the approved system.

The timelines for required integration and integration requirements will be documented requirements within the individual task orders under this BPA.

Deliverables Specific deliverables for products and services provided by the contractor will be identified at the Task Order level.

Service Level Agreements and Requirements Specific Service Level Agreements and Requirements (SLA/SLR) will be contractor proposed in response to individual Task Orders, unless otherwise specified.

Period of Performance The period of performance (PoP) for this BPA is 10-years. Task Orders may be requested and awarded for varying lengths not to exceed the POP of the BPA.

Appendix A – Clauses Section 508 Requirements Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

Section 508 Requirements for Technology Services (include in the SOW, PWS, or SOO)

1. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item's level of Section 508 conformance prior to the services being performed.

2. When providing maintenance upgrades, substitutions, and replacements to ICT, the contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed upgrades, substitutions and replacements prior to acceptance. The ACR should be created using the on the Voluntary Product Accessibility Template Version 2.2 508 (or successor versions). The template can be located at https://www.itic.org/policy/accessibility/vpat

3. When providing cloud hosting services (Infrastructure as a Service, Platform as a Service, Software as a Service, etc.) the Contractor shall ensure user administrative screens, dashboards and portals used to configure, and monitor cloud services conform to the Section 508 standards.

4. The Contractor shall ensure cloud hosting services shall not reduce the level of Section 508 conformance for ICT migrated by DHS to the cloud hosting environment.

5. When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

6. When modifying, installing, configuring or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

7. When developing or modifying web based and electronic content components, except for electronic documents and non-fillable forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria) by conducting testing using the DHS Trusted Tester for Web Methodology Version 5.0 or successor versions, and shall ensure testing is conducted by individuals who are certified by DHS on version 5.0 or successor versions (e.g. “DHS Certified Trusted Testers”). The Contractor shall provide the Trusted Tester Certification IDs to DHS upon request. Information on the DHS Trusted Tester for Web Methodology Version 5.0, related test tools, test reporting, training, and tester certification requirements is published at https://www.dhs.gov/trusted-tester.

8. When developing or modifying electronic documents and forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable to the applicable Section 508 standards (including WCAG Level A and AA Level 2.0 Success Criteria) by conducting testing using the test methods published under “Accessibility Tests for Documents” at https://www.dhs.gov/compliance-test-processes.

9. When developing or modifying ICT deliverables that contain the ability to automatically generate electronic documents and forms in Microsoft Office and Adobe formats, or when the capability is provided to enable end users to design and author web based electronic content (i.e. surveys, dashboards, charts, data visualizations, etc.), the Contractor shall demonstrate the ability to ensure these outputs conform to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria). The Contractor shall demonstrate conformance by conducting testing and reporting test results based on representative sample outputs. For outputs produced as Microsoft Office and Adobe PDF file formats, the Contractor shall use the test methods published under “Accessibility Tests for Documents”, which are published at https://www.dhs.gov/compliance-test-processes. For outputs produced as web based electronic content, the Contractor shall use the DHS Trusted Tester for Web Methodology Version 5.0, or successor versions. This methodology is published at https://www.dhs.gov/trusted-tester

10. When developing or modifying software functions of ICT, the Contractor shall demonstrate conformance to the applicable Section 508 standards (including the requirements in Chapter 5 and WCAG 2.0 Level A and AA Success Criteria). When the requirements in Chapter 5 do not address one or more software functions, the Contractor shall demonstrate conformance to the Functional Performance Criteria specified in Chapter 3. The Contractor shall use a test process capable of validating conformance to all applicable Section 508 standards for software functionality delivered pursuant to this contract. The Contractor may utilize the DHS Trusted Tester Methodology for Web and Software Version 4.0 as a component of the overall test process used. This version of the test process provides partial test coverage of the Section 508 standards that apply to software. If the Contractor uses this test process, the Contractor shall address the test coverage gaps through additional test procedures. Information on the DHS Trusted Tester Methodology for Web and Software Version 4.0, including coverage against the applicable Section 508 standards for software as well as gaps that need to be addressed through other test methods, related test tools, and training is published at https://www.dhs.gov/trusted-tester.

11. When developing or modifying hardware components of ICT, including closed systems (for example – kiosks), the Contractor shall demonstrate conformance to the applicable Section 508 standards (including the Chapter 4 hardware requirements). Where the requirements in Chapters 4 do not address one or more functions of ICT, the Contractor shall demonstrate conformance to the Functional Performance Criteria specified in Chapter 3. The Contractor shall use a test process capable of validating conformance to all applicable Section 508 standards for hardware functionality delivered pursuant to this contract.

12. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the accessibility requirements in this work statement.

Section 508 Deliverables

1. Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions.

2. Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

3. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

4. Other Section 508 Documentation: The following documentation shall be provided upon request for ICT items offered through this contract:

· Documentation of features provided to help achieve accessibility and usability for people with disabilities.

· Documentation on how to configure and install the ICT Item to support accessibility.

· Documentation of core functions that cannot be accessed by persons with disabilities.

· Documentation of remediation plans to address non-conformance to the Section 508 standards.

THIS PAGE INTENTIONALLY LEFT BLANK

image1.jpeg