TOMCAT SOO v6.4.docx

f

Transportation Security Administration

Information Technology

Trusted Operations, Maintenance, Cybersecurity, Assurance, and Technology (TOMCAT)

Statement of Objectives Solicitation #

February 19, 2026 Version 6.4

DRAFT

Request for Proposal – TOMCAT SOO Solicitation #

THIS DOCUMENT CONTAINS ACQUISITION-SENSITIVE INFORMATION – See FAR 2.101 and 3.104 This document contains acquisition-sensitive information related to the conduct of a Federal Agency procurement, the disclosure of which is restricted by Section 27 of the Office of Federal Procurement Policy Act (41 U.S.C. §423). The unauthorized disclosure of such information may subject both the discloser and the recipient of the information to contractual, civil and/or criminal penalties as provided by law.

THIS PAGE INTENTIONALLY LEFT BLANK

THIS DOCUMENT CONTAINS ACQUISITION-SENSITIVE INFORMATION – See FAR 2.101 and 3.104 This document contains acquisition-sensitive information related to the conduct of a Federal Agency procurement, the disclosure of which is restricted by Section 27 of the Office of Federal Procurement Policy Act (41 U.S.C. §423). The unauthorized disclosure of such information may subject both the discloser and the recipient of the information to contractual, civil and/or criminal penalties as provided by law.

Table of Contents

Introduction The Transportation Security Administration (TSA) is responsible for securing the nation’s transportation systems and ensuring safe, efficient travel. To support its mission, TSA relies on a complex and evolving Information Technology (IT) and Operational Technology (OT) environment that spans headquarters, field sites, airports, training centers, and international locations. The TSA Chief Information Officer (CIO) oversees the delivery of world-class IT/OT services to approximately 85,000 federal employees, contractors, and stakeholders across TSA Headquarters, field sites, airports, training centers, international offices, and other designated locations.

TSA’s IT/OT infrastructure includes a broad range of technologies and systems, such as data centers, networks, cloud platforms, enterprise applications, and security solutions. These systems are critical to TSA’s daily operations, mission readiness, and ability to respond to emerging threats. As technology advances and operational needs change, TSA continuously deploys new solutions and retires legacy systems. This Statement of Objectives (SOO) outlines a critical enabler of TSA’s mission to secure the nation’s transportation systems by ensuring resilient, secure, and innovative IT/OT services that support daily operations and strategic priorities.

Purpose The purpose of TSA’s Trusted Operations, Maintenance, Cybersecurity, Assurance, and Technology (TOMCAT) is to ensure operational continuity, service excellence, and security, TSA requires robust, scalable, and adaptive IT/OT Operations and Maintenance (O&M) support. The TOMCAT contractor will be responsible for operating, maintaining, and optimizing TSA’s IT/OT capabilities, integrating new technologies, and embedding cybersecurity best practices across all environments. This support is essential for uninterrupted mission-critical operations, strategic alignment with TSA priorities, and compliance with federal standards.

Scope and Objectives Scope This contract covers comprehensive, robust, adaptive operations and maintenance (O&M) support for all information and operational technology (IT/OT) systems and services within the Transportation Security Administration (TSA) enterprise.

The Contractor is responsible for the full lifecycle management of TSA’s IT/OT infrastructure, including data centers, networks, cloud environments, enterprise applications, security technologies, and end-user devices. Responsibilities include operating, maintaining, monitoring, and optimizing these systems; refreshing end-of-life or near end-of-life equipment; and supporting all current and future TSA IT/OT systems. The Contractor is also tasked with ensuring the seamless integration and transition of new technologies into the operational environment. A list of current systems is provided in Appendix B – TSA Systems/Technologies Support List.

All requirements and objectives in this SOO apply to both Information Technology (IT) and Operational Technology (OT) environments, and to all TSA-supported platforms, including on-premises, cloud, and hybrid systems.

The scope is broken into two primary functional areas and covered within Section 5 – Functional Area Requirements:

1. Operations and Engineering Support Services (Section 5.1)

2. Information Assurance and Cybersecurity Support Services (Section 5.2)

Appendices The following Appendices provide information that is applicable to TOMCAT:

· Appendix A – Clauses

· Appendix B – TSA Systems/Technologies Support List

· Appendix C – Site List

· Appendix D – Acronym List

General Services Objectives Program Management Services Program Management serves as the cornerstone for facilitating IT/OT services and operations management functions, aligning with TSA’s priorities to enhance efficiency, accountability, and performance. The contractor shall oversee and coordinate all services and operational management activities required under the contract, including the planning, execution, and administration of support services to ensure effective delivery.

The contractor shall deliver comprehensive program management activities, robust reporting, and essential contract management services to achieve cost, schedule, and performance objectives while driving operational excellence and supporting mission-critical outcomes under the contract.

The Program Management shall:

· Comprehensive Oversight: Provide management and oversight of Operations & Maintenance (O&M) activities ensuring alignment with the administration’s focus on efficiency, accountability, and performance, including oversight of subcontractor contributions.

· Collaboration and Transition Management: Work with contractors and external parties to integrate IT/OT technologies and capabilities, ensuring a formal, seamless transition of operations and maintenance responsibilities to the TOMCAT contract.

· Integrated Master Schedule Management: Develop and maintain a resource-loaded integrated master schedule (RL-IMS) that aligns program activities, projects, milestones, and deliverables, ensuring effective planning, execution, and coordination across all TOMCAT operations. The location and availability of the RL-IMS shall be mutually agreeable between the TOMCAT contractor and TSA and shall adhere to the pertinent security policies.

· Enterprise Oversight: Monitor, report, and track O&M projects in a standardized format agreeable to the government. These activities include closely monitoring the health (i.e. security, OS versions, near end of life (EOL) / end of service life (EOSL)) of the environments and proactively engaging the government for resolution.

· Process Enhancement: Incorporate strategies to enhance processes and drive standardization across business and operational workflows, supporting the administration’s emphasis on streamlined operations and cost-effectiveness.

· Adherence to Best Practices: Adhere to industry best practices as outlined in the Project Management Body of Knowledge (PMBOK), ensuring consistency, quality, and alignment with federal standards.

· Project Management: Manage individual projects with properly skilled project management and technical resources, preparing project documentation and reporting of project status for simple and complex tasks at government request.

· Service Level Agreement (SLA) Monitoring: Clearly communicate methods for monitoring SLAs, including actionable plans to address unmet SLAs and remediate root causes, ensuring accountability and continuous improvement.

· Subcontractor Management: Define the effective utilization and management of subcontractors to optimize service delivery and ensure the achievement of SLAs, supporting the administration’s goals of maximizing operational efficiency and performance outcomes.

· Process Improvement and Continuous Service Enhancement: The contractor shall continuously identify and recommend opportunities for process improvement, automation, and service enhancement to support TSA’s evolving operational needs.

· Reporting: The TOMCAT contractor will report on a weekly schedule the status of projects and other topics related to ongoing O&M activities (e.g. highly visible outages, project impediments, overall ticket status) in a mutually agreed format. Also, a formal Project Management Review will be performed on a monthly basis to report on the health of the TOMCAT program including but not limited to, project/initiative status, service level agreements (SLA), contract data requirements list (CDRL), program/project metrics, and other topics as agreed to by IT Leadership.

Program Management facilitates all TOMCAT services and operations management functions. It involves development, implementation, and administration of services, operations and maintenance core functions. Activities of program management include but are not limited to:

1. Organize management of integrated IT/OT services and projects

2. Provide cost and budget management.

3. Ensure continued service delivery in accordance with the service level requirements, regardless of changing or fluctuating workload or personnel availability.

4. Improve processes by facilitating performance planning and alignment.

5. Drive business and operational process standardization.

6. Document business, operational, and reporting processes.

7. Implement and oversee cybersecurity measures to protect systems, data, and operations, ensuring compliance with TSA cybersecurity policies and federal standards

The contractor will utilize Government-owned systems (e.g. ServiceNow SharePoint) for all TOMCAT work products, processes, procedures, and other artifacts, accessible by the Government.

Note: all documentation created under this contract is Government owned. The Contractor is to ensure that work products or artifacts are not marked “Proprietary”, “Company Confidential”, or with any other non-Government restrictive language, including the use of corporate logos.

Transition-In Management Effective transition-in management results in the cooperative and orderly transition of contractual responsibilities from the incumbent contractual agreements / Contractors to the new contractual agreement / Contractor. The objectives to support this subtask are to:

1. Develop and implement a Transition-In Plan to transition without a break in service from the current contract to TOMCAT.

2. Complete transition-in no later than the effective date of the base period of the replacement contract, taking into consideration that Entrance on Duty (EOD) Fitness Determination for individuals will take on average approximately 90 days from the date the entire package has been submitted.

3. Transition from the current IT Management, Performance, Analysis, and Collaborative Technologies (IMPACT) II contract to TOMCAT with no degradation or breaks in service availability while maintaining existing security, service quality, contract support, and performance levels.

4. Coordinate and integrate the TOMCAT transition-in tasks with the transition-out tasks of the incumbent Contractor.

5. Assume responsibility for and perform all IT/OT services required under the TOMCAT contract.

6. Assume and accept responsibility for all outstanding POA&Ms inherited from the incumbent contractor and continue to support and implement mitigation plans for those POA&Ms until resolution is achieved. Assume and accept responsibility for the TOMCAT Service Level Agreement (SLA), effective on Day 1 (or before) of the Base Period of the contract.

7. Complete mandatory training, receive privileged account passwords, and perform the issuance and accountability measures of Government Furnished Equipment (GFE).

Transition-Out Management Effective transition-out management results in the cooperative and orderly transition of contractual responsibilities to a different entity(ies). The objectives are to:

1. Develop and implement a Transition-Out Plan aligned to the Transition-In Plan of the successor’s Contractor(s), ensuring effective and timely transition of functions and knowledge from TOMCAT to the successor Contractor(s).

2. Ensure all functions performed under TOMCAT are identified and incorporated into the Transition-Out plan and successfully transitioned to the successor Contractor(s).

3. Coordinate and integrate the TOMCAT transition-out tasks with the transition-in tasks of the successor Contractor(s).

4. Transition transparently and seamlessly with no degradation or breaks in service availability while maintaining existing security, service quality, contract support, and performance levels.

5. Transfer all GFE back to the Government upon completion of the transition-out activities.

IT Service Management / IT Operations Management The contractor shall ensure the effective management and delivery of IT/OT services and operations across the TSA enterprise. The contractor is expected to implement industry best practices to optimize service quality, efficiency, security, and performance, while supporting TSA’s mission and operational requirements leveraging TSA’s current ITSM/ITOM solution, ServiceNow.

Objectives include:

· Achieve consistent, high-quality IT/OT service delivery and operations management throughout the TSA environment.

· Promote ongoing improvement of IT/OT services and processes to enhance efficiency, cybersecurity, and performance, and to reduce risk.

· Support TSA’s compliance with applicable federal standards and policies for IT/OT service management and operations.

· Ensure all IT/OT services and operations are managed in a manner that meets TSA’s requirements for reliability, scalability, and security.

The contractor may propose frameworks and methodologies utilizing existing tools that best support these objectives, subject to TSA review and approval.

Enterprise Architecture and Governance The contractor shall support TSA’s enterprise architecture and governance objectives by ensuring IT/OT systems, processes, and solutions are aligned with TSA and DHS strategies, standards, and requirements. The contractor is responsible for maintaining accurate and up-to-date architecture documentation and supporting the effective management of IT/OT investments across the enterprise.

Objectives include:

· Update enterprise architecture artifacts, including Systems Engineering Life Cycle (SELC) documentation, to reflect system changes.

· Develop and maintain all required architecture artifacts for TOMCAT operations and maintenance activities.

· Ensure continuous accuracy and completeness of information, data, and artifacts in the TSA IT/OT Enterprise Architecture repository as TOMCAT services and systems evolve.

· Submit product updates and technical insertions to the TSA Technology Solutions Portfolio (Tech SP) for software and hardware upgrades or modifications.

· Provide qualified personnel to support the creation, maintenance and ongoing support of the Operations and Engineering Division (OED) Technical Configuration Diagrams (TCD) program. The TCD provides a comprehensive document/drawing for applications and systems and are utilized across the organization.

Functional Area Objectives The Contractor shall provide comprehensive, adaptive, and integrated support services as TSA’s technology landscape evolves. This includes working collaboratively as an integrated team with TSA staff, other TSA contractors, outside vendors, and designated external stakeholders to ensure seamless delivery of IT and OT services.

The Contractor shall coordinate all activities across the TOMCAT functional areas and with TSA staff, other contractors, and external stakeholders to ensure seamless, integrated service delivery and avoid operational silos.

The TOMCAT contract covers the full spectrum of enterprise networks and infrastructure, including routers, switches, servers (virtual and physical), end-user devices (laptops, desktops, tablets), operating system images, and connectivity. Supported technologies span both IT and OT domains, including but not limited to:

· Applications and hardware for airport screening operations

· Email and messaging platforms

· Internet connectivity via the DHS-approved Trusted Internet Connection (TIC)

· Cloud services (e.g., AWS, Azure, Salesforce, Cisco Cloud Calling/Webex)

· Microsoft applications and services (e.g., 365, SharePoint, Teams, Word, Excel)

· Other commercial, contractor, and government-developed applications A comprehensive list of systems is provided in Appendix B – TSA Systems/Technologies Support List. Additional reference materials are available in the Virtual Reading Room (VRR).

Operations and Engineering Support Services The Operations and Engineering Division (OED) is the primary owner and operator of the TSA IT/OT enterprise. The Contractor shall provide comprehensive operations and maintenance (O&M) and engineering support for the TSA IT/OT infrastructure, including but not limited to:

· Data management

· IT/OT infrastructure fault remediation and POA&M (Plan of Action and Milestones) management

· Network Operations Center (NOC) support

· Enterprise incident and restoration management

· Image management for network and end-user devices

· Patch management

· Systems performance monitoring and capacity planning

· Change, configuration, and release management

· Disaster recovery

· Financial and contractual management

· Testing processes, including all tasks related to production deployment These activities encompass the operation and support of computing environments in DHS data centers, other data centers, and smaller collections of servers and systems throughout the worldwide TSA enterprise; Wide Area Networks (WAN) and Local Area Networks (LAN) at all TSA sites; and support for desktop and client devices.

The Contractor shall:

1. Provide a full range of management, technical, and operational support services to OED at all TSA sites, in accordance with TSA methodologies, processes, and procedures.

2. Deliver operational support and timely restoration of services for end users, customers, systems, and IT/OT services, ensuring issues are addressed at all necessary levels of technical expertise.

3. Provide technical support to operate, manage, maintain, and secure the enterprise infrastructure, including centralized O&M for all security devices, applications, and systems, and perform auto-discovery and inventory correlation of devices on the network.

4. Ensure compliance with all FISMA, DHS, and TSA security policies and directives.

5. Create, manage, and maintain documentation for all enterprise processes (e.g., change management), including standard operating procedures, technical schematics, and system support documentation.

6. Provide regular reporting on monitoring, network management, incident management, incident resolution, and problem management activities at intervals mutually agreed upon by the contractor and TSA (currently a Daily Service Review).

7. Provide support for break-fix, restoration of service, and provisioning of services (request fulfillment).

8. Continuously identify opportunities for process improvement and recommend enhancements to O&M practices to increase efficiency, effectiveness, and compliance with TSA objectives.

9. Coordinate with other functional areas (e.g., Security, Change Management, Disaster Recovery, Testing) to ensure seamless integration of O&M activities across the enterprise.

10. Maintain awareness of emerging IT/OT technologies and recommend adoption where appropriate to support TSA’s evolving mission needs.

11. Monitor industry trends and emerging technologies relevant to TSA’s mission, and proactively recommend, pilot, and support the integration of new solutions, subject to TSA approval.

12. The Contractor shall ensure ongoing knowledge transfer to TSA staff and other designated stakeholders through up-to-date documentation, training, and collaborative processes throughout the contract lifecycle, including during personnel transitions.

The list of current systems can be found in Appendix B - TSA Systems/Technologies Support List.

On-Premises and Data Center Services The Contractor shall provide comprehensive operations and maintenance (O&M) support for all TSA on-premises environments, including but not limited to data centers, TSA Headquarters, the Freedom Center, TSIF, and other designated facilities as listed in Appendix D. These environments encompass all technology and facility-related components that support processing, storage, connectivity, identity, management, licensing, and data distribution for the enterprise, across all environments (production, development, test, lab, etc.).

Responsibilities include:

1. Onsite and Remote Support:

· Provide onsite engineering support at designated locations (currently DHS Data Center in Stennis, MS and TSA Headquarters, Springfield, VA) during standard business hours, with after-hours on-call support as required.

· Monitor, manage, and support the health and status of IT/OT systems and infrastructure at all other TSA sites, with 24x7x365 incident management, troubleshooting, and resolution.

2. Operations and Maintenance:

· Perform O&M for all on-premises infrastructure and systems, including hosted application infrastructure, databases, and file services.

· Support for applications/systems operating on TSA infrastructure, including planning, environment builds, test support, and certificate management.

· Provide break-fix, restoration of service, and provisioning of services (request fulfillment) at all covered locations.

3. Migration and Integration:

· Support migration activities for systems and services between platforms, data centers, on-premises locations, and cloud environments.

· Ensure compatibility and minimal disruption during migrations, aligning with TSA’s strategic objectives.

4. Monitoring and Tracking:

· Maintain accurate tracking of the physical and virtual locations of systems and applications within on-premises environments.

· Provide operational and performance monitoring and maintain close coordination and security engineering with on-premises data processing locations.

5. Coordination:

· Coordinate with other contractors, telecommunications carriers, and external federal partners as necessary to fulfill operational and maintenance requirements and ensure seamless service delivery.

All services shall be performed in accordance with TSA and DHS policies, facility requirements, and applicable federal guidelines.

Cloud Services Cloud Services refers to all technology and facility-related components and services that support the projects, transport, integration, and operations of cloud vendor services. TSA’s subscribed cloud services include Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). TSA utilizes Amazon Web Services (AWS) and Microsoft Azure as its primary, but not only, cloud providers. Examples of cloud services include O&M support for virtual application infrastructure, virtual network infrastructure, databases, and cloud features.

The objectives to support these services are to:

1. Cloud Environment Management:

Ensure TSA cloud environments (e.g., production, test, development, sandbox) are managed to maintain compliance with TSA and DHS policies and guidelines, supporting secure and reliable operations.

2. Cloud Service Operations:

Ensure the ongoing reliability, security, and performance of TSA’s virtual infrastructure and systems/services hosted in cloud environments, supporting application development, testing, upgrades, and enhancements.

· Enable secure provisioning, configuration, and lifecycle management of applications, developer environments, systems, and services within TSA’s cloud infrastructure.

· Provide robust identity and access management (IAM) capabilities, network segmentation, security group management, and storage lifecycle management, including backup and restore operations.

3. Monitoring & Reporting:

Deliver comprehensive operational and performance monitoring, security engineering, and reporting capabilities to maintain visibility, compliance, and coordination with cloud service providers.

· Implement cloud-native monitoring, logging, and alerting tools to support resource utilization, security event detection, and compliance status reporting.

4. Migration Support:

Support migration planning, environment builds, and coordination for the re-factoring and movement of systems, workloads, data, and services between platforms, data centers, and cloud environments.

· Ensure compatibility with cloud-native services and APIs, minimizing disruption and aligning with TSA’s strategic objectives.

5. Deployment Pipeline Enablement:

Provide support for the management, automation, and monitoring of deployment pipelines for cloud-hosted applications and services, including source code management, CI/CD, version control, and artifact management, in accordance with TSA and DHS policies and best practices.

6. Incident Response & Remediation:

Ensure timely coordination and corrective action to restore service and maintain secure, reliable operations in collaboration with relevant stakeholders.

7. Documentation:

The Contractor shall maintain comprehensive documentation of cloud architectures, configurations, and operations, and support knowledge transfer to TSA personnel as required.

8. Cost and Consumption Management:

Establish and maintain processes to monitor, track, and report on cloud service consumption and associated costs. The Contractor shall provide monthly cost reporting and analysis to support TSA’s budgeting, forecasting, and optimization efforts, ensuring transparency and enabling proactive management of cloud expenditures.

· Establish and maintain operational guardrails, including relevant policies and monitoring mechanisms, to support Cloud cost optimization and management. These guardrails must ensure that Cloud resources are provisioned, utilized, and decommissioned with the objective of preventing unnecessary expenditures, promoting efficient resource utilization, and enabling continuous visibility into Cloud spending.

Critical Incident Management Services A Critical Incident includes any event which disrupts, or which could disrupt, a service. Critical Incident Management is the comprehensive approach to preventing, preparing for, and responding to events effectively and efficiently. This is a detail-oriented role to ensure accuracy in reporting and providing the latest information. Reporting within this area is regularly reviewed by TSA leadership. The objectives to support these services are to:

1. Manage, monitor, coordinate, and communicate status of TSA incidents through a Critical Incident Command (CIC) Center and become the primary Command Center for IT/OT operational incidents.

2. Operate on a 24x7x365 basis.

3. Establish and manage incident bridges (typically via Teams) involving technical staff, contractor operations management, federal personnel, and other necessary resources to coordinate and drive all restoration actions for incidents, outages, and service degradations across the enterprise, maintaining the bridge until full resolution is achieved.

4. Participate in incident bridges managed by other parties (e.g., federal staff, external vendors, or other contractors (e.g. TALON/FOCUS)) by monitoring the bridge, coordinating and providing TOMCAT technical resources as required, and tracking all actions and issues through to closeout.

5. Execute a Continuity of Operations (COOP) plan if the primary CIC is not viable for operations.

6. Assess incident severity through a TSA-approved Standard Operating Procedure (SOP), host incident resolution conference calls, and coordinate necessary resources that are both internal to the contract and external to the contract (other providers, vendors and/or manufacturers).

7. Manage and communicate TSA’s overall operating posture and incident status on an ongoing basis.

8. Standardize all incident status and reporting utilizing TSA systems, currently ServiceNow.

9. Conduct root cause analysis and post-incident reviews for all critical incidents, documenting findings, lessons learned, and recommended corrective actions.

10. Document all incident details, actions taken, and outcomes in TSA-approved systems, and update knowledge bases to support future incident response and continuous improvement.

11. Implement and follow defined escalation procedures for unresolved or high-severity incidents.

12. Employ proactive monitoring, alerting, and trend analysis to detect and address potential incidents before they impact operations.

13. Ensure timely notification and ongoing updates to all relevant stakeholders, in accordance with TSA communication protocols.

14. Track and report incident management metrics and use this data to drive continuous improvement in incident response processes.

15. Monitor, assess, and respond to routine, regular, and emergency changes initiated by DHS OneNet, including those scheduled during business hours, after hours, and weekends.

16. Participate proactively or reactively, as required, in incident bridges or troubleshooting sessions related to DHS OneNet changes, providing Critical Incident Command (CIC) and/or technical resources as needed.

17. Coordinate with DHS OneNet, TSA stakeholders, and other relevant parties to assess potential or actual impacts to TSA operations and take necessary actions to mitigate service disruptions.

18. Maintain situational awareness of all DHS OneNet change notifications and ensure timely communication and escalation to TSA leadership and affected stakeholders.

Network Services Network Services refers to the hardware, software, and communication services that allow data to be exchanged between devices. Examples of services include LAN and WAN, Extranet/Intranet Services, Internet Access, and Remote Access. The objectives to support these services are to:

1. Manage, monitor, maintain, restore, and secure TSA network segments that integrate the transport of voice, video, and data across the TSA enterprise.

2. Provide support to include break-fix, restoration of service, and provisioning of services (request fulfillment).

3. Ensure comprehensive support for wireless networks, including wireless controllers and access points, as well as other network segments.

4. Support connectivity between TSA and all other external connections to other Government, corporate, and private entities.

5. Coordinate and collaborate with TSA’s technology providers to supply TSA with seamless communication, planning, monitoring, and incident management with all parties associated with TSA’s infrastructure.

6. Perform and report regular bandwidth analysis and utilization.

7. Track and report on key network performance and availability metrics to ensure service levels meet TSA requirements.

8. Conduct capacity planning and make recommendations to ensure the network can scale to support evolving TSA operational requirements.

9. Maintain accurate network configuration documentation and follow change control processes to ensure network integrity and minimize service disruptions.

10. Implement proactive network security monitoring, integrate with TSA’s cybersecurity operations, and respond to detected threats or vulnerabilities.

11. Develop and maintain network disaster recovery and resilience plans to ensure rapid restoration of critical network services in the event of a disruption.

12. Evaluate and support the integration of emerging network technologies as directed by TSA.

13. Provide timely support to end users for network-related issues and communicate planned outages or maintenance in advance.

Testing Services Testing Services supports technology testing, in both a physical and virtual laboratory, for a variety of operating system platforms, applications, and network infrastructure in a secure environment. Examples of services include Test Automation, Performance Testing, and Functionality Testing. The objectives to support these services are to:

1. Establish, maintain, and secure a contractor-provided laboratory environment (physical and virtual) that meets TSA requirements for testing, integration, and evaluation of hardware, software, operating systems, and images.

2. Provide management and operational support for TSA’s Development (DTE and SysTest) and Integration (ITE) environments, including the Contractor-provided Client Access Lab (CAL).

3. Support TSA testing activities, ensuring the appropriate environments are available to sustain development and release schedules.

4. Support production baselines throughout each test environment, with the ability to increase and decrease system instances as needed.

5. Conduct comprehensive testing—including functional, regression, integration, compatibility, performance, security, and compliance testing—of hardware, software, operating systems, and images to validate readiness for deployment.

6. Implement and maintain test automation frameworks and tools, as appropriate, to improve testing efficiency, coverage, and repeatability.

7. Develop and maintain test plans, document test cases and results, and provide timely test reports to TSA stakeholders.

8. Ensure traceability between testing activities, system requirements, and change requests to validate that all changes are properly tested and documented.

9. Track, report, and manage defects identified during testing, and coordinate with relevant stakeholders for resolution and retesting as needed.

10. Provide support to include break-fix, restoration of service, and provisioning of services (request fulfillment).

Configuration, Change, Release Management Services Configuration, Change, and Release Management Services provide the processes needed for TSA to manage software and hardware lifecycles to ensure integrity and stability of TSA’s information systems. The objectives to support these services are to:

1. Provide Configuration, Change, and Release Management Services that conform to the DHS Systems Engineering Life Cycle (SELC), the TSA IT Systems Lifecycle Playbook, and industry standard service management methodologies.

2. Track all TSA IT/OT changes using the TSA-directed Configuration and Change management system through their lifecycle across all TSA locations.

3. Collaborate with TSA federal personnel to ensure effective execution of configuration, change, and release management activities.

4. Utilize TSA-approved tools and adhere to established TSA processes and procedures for all configuration, change, and release management activities.

5. Provide qualified personnel to support configuration, change, and release management functions, ensuring adequate coverage to meet TSA operational needs.

6. Maintain comprehensive documentation of all configuration, change, and release management activities to support transparency, auditability, and compliance with TSA and DHS requirements.

7. Communicate and coordinate planned changes and releases with all relevant stakeholders to minimize operational impact and ensure successful implementation.

8. Regularly review and recommend improvements to configuration, change, and release management processes to enhance efficiency, effectiveness, and compliance.

Disaster Recovery Disaster Recovery (DR) is the ability of an organization to provide critical IT/OT and communications capabilities and services after the services are disrupted by an incident, emergency, or disaster. DR recovers the disrupted IT/OT and communications capabilities to continue at planned levels of operations. The objectives to support these services are to:

1. Maintain TSA’s DR capability, ensuring TSA enterprise IT/OT services are restored to the specified performance levels within the specified Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) as directed by TSA.

2. Develop, maintain, and periodically test disaster recovery plans for all critical IT/OT systems and environments (including on-premises, cloud, and hybrid) to validate effectiveness and readiness.

3. Ensure regular, secure backups of critical systems and data, and periodically test backup integrity and restoration processes.

4. Coordinate disaster recovery planning, testing, and execution with TSA stakeholders, other contractors, and external partners as required.

5. Update disaster recovery plans and procedures based on lessons learned from DR tests, exercises, and actual events.

6. Maintain comprehensive DR documentation and provide regular status updates and test/exercise reports to TSA.

All services shall be performed in accordance with TSA and DHS policies, facility requirements, and applicable federal guidelines.

Identity Credential and Access Management (ICAM) Support Services ICAM refers to user authentication systems that enable access to multiple data sources through a single-entry point within an integrated access management framework. This includes access to applications using unified identification and authentication, such as PACS, LACS, PKI, Service Accounts, and PIV. The objectives to support these services are to:

1. Provide account lifecycle management (including reporting, monitoring, disablement, compliance, and removal) for all TOMCAT-managed and supported contractor systems, and coordinate with non-TOMCAT systems as needed.

2. Manage, maintain, and implement organizational directory, federation, and Single Sign-On (SSO) services for internal and external applications. The Contractor shall ensure these services evolve with advancing technologies and changing requirements.

3. Manage role/access management and PIV-based multi-factor authentication (MFA) to ensure secure digital identity and compliance with HSPD-12 for logical and physical access.

4. Manage TSA’s Privileged Account process, including audits and privileged user training.

5. Monitor privileged user access; identify and disable inactive privileged and general user accounts in alignment with TSA and DHS policies.

6. Track service accounts for all IT/OT systems; ensure service account annual password resets and maintain status reports for OED and IAD.

7. Ensure ICAM support encompasses all TSA IT/OT environments, including on-premises, cloud, and hybrid systems.

8. Provision and deprovision user accounts in a timely manner in accordance with TSA policies and security best practices.

9. Implement and enforce role-based access controls (RBAC) and the principle of least privilege for all accounts.

10. Maintain comprehensive audit trails for all ICAM activities and support compliance reporting as required by TSA and DHS.

11. Support identity federation and secure access for external partners and agencies as required by TSA.

12. Plan for technology refresh and lifecycle management of ICAM solutions to ensure continued alignment with TSA requirements and industry best practices.

13. Ensure all ICAM activities are fully integrated with TSA’s cybersecurity operations, incident response, and audit/compliance processes (see Section 5.2).

Patch and Upgrade Management Patch and Upgrade Management refers to the identification, management, testing, and installation of hardware/software patches and upgrades to mitigate vulnerabilities and enhance functionality. The objectives to support these services are to:

1. Monitor sources (e.g. DHS ISVMs, CVEs, KEVs, NIST NVDs, vendor (OEM) alerts, vendor websites) for information regarding vulnerabilities, defects/bugs, patches, upgrades, recommended configurations, and support status (e.g. End of Service Life) of all TSA-owned or utilized TSA software and hardware and report results to TSA.

2. Complete patching of Common Vulnerabilities and Exposures (CVE) in accordance with DHS ISVM guidelines based upon the severity.

3. Identify, analyze, recommend, test, coordinate for approval (TechSP insertion, execute change request (CR) process), and apply recommended configurations, system, software, and hardware patches and upgrades to maintain the most current, stable, and secure configuration of licensed software/firmware in the TSA environment, thus providing the most up-to-date security and functionality.

4. Develop, test, and maintain images and configurations to efficiently manage and support network and end-user equipment (e.g. switches, routers, computers, servers), minimize downtime of systems, expedite implementation of new systems, implement secure configurations / system hardening, reduce vulnerabilities across the enterprise, and reflect the current TSA systems.

5. Recommend mitigation of software/firmware/services vulnerabilities identified but not yet addressed by the vendor.

6. Document, track and report all patching through the change/release management process and associated deliverable(s).

7. Remediate Known Exploited Vulnerability in accordance with the Cybersecurity and Infrastructure Security Agency (CISA) policy, timelines, directives and procedures referencing the CISA KEV Catalog.

8. Ensure patch and upgrade management encompasses all TSA IT/OT environments, including on-premises, cloud, and hybrid systems.

9. Coordinate patch and upgrade activities with TSA’s cybersecurity operations and incident response processes to ensure timely remediation of vulnerabilities.

10. Validate the effectiveness of patches and upgrades post-deployment and monitor for any adverse impacts on system performance or functionality.

11. Adhere to TSA and DHS timelines for the remediation of critical and high-severity vulnerabilities.

12. Develop and maintain rollback and contingency procedures to restore systems to a known good state in the event of patch or upgrade failure.

13. Maintain comprehensive audit trails for all patch and upgrade activities and support compliance reporting as required by TSA and DHS.

14. Communicate planned patching and upgrade activities, including potential impacts and downtime, to affected users and stakeholders in advance.

Communications Services Communications Services encompass the platforms, infrastructure, and support required for secure, reliable, and efficient enterprise-wide communication at TSA. This includes collaboration tools, voice and video services, and email and messaging solutions that enable TSA personnel to connect, share information, and perform mission-critical functions across on-premises, cloud, and hybrid environments. The Contractor is responsible for ensuring all communications services are available, scalable, and aligned with TSA’s operational and security requirements.

0. Collaboration, Voice, and Video Services

Collaboration, Voice, and Video Services provide the platforms and infrastructure that enable real-time and asynchronous communication, information sharing, and teamwork across the TSA enterprise. These services include unified communications, video teleconferencing, voice over IP (VOIP), conference bridges, desktop and office phones, and collaboration platforms such as Microsoft Teams, Webex, and SharePoint. The Contractor is responsible for ensuring these services are reliable, secure, and available to support TSA’s mission needs in both on-premises, cloud, and hybrid environments.

The Contractor shall:

1. Manage, maintain, monitor, repair, and restore collaboration, voice, and video services and platforms (e.g., Microsoft Teams, Webex, SharePoint, Unified Communications, VTC, VOIP, desktop/office phones, conference bridges, fax) in on-premises, cloud, and hybrid environments.

2. Provide operations and maintenance (O&M) and management of TSA physical and virtual infrastructure supporting all collaboration, voice, and video services.

3. Support planning, design, environment builds, test support, implementation, and decommissioning of collaboration, voice, and video services.

4. Provide engineering for design, development, testing, and deployment of new features for collaboration, voice, and video products and services.

5. Ensure integration and interoperability between all collaboration, voice, and video platforms and services for a seamless user experience.

6. Provision services (request fulfillment) and provide break-fix support.

7. Provide timely support and communication to end users, including planned outages, maintenance, documentation, and training.

8. Ensure all collaboration, voice, and video services are accessible and compliant with Section 508 requirements, as detailed in Appendix A.

9. Evaluate and support the integration of emerging collaboration, voice, and video technologies as directed by TSA.

10. Plan and execute upgrades or migrations to minimize disruption to end users and maintain service continuity.

11. Conduct capacity planning and make recommendations to ensure collaboration, voice, and video services can scale to meet evolving TSA operational requirements.

Note:

All collaboration, voice, and video activities shall comply with TSA’s security, change management, disaster recovery, and performance management requirements as detailed in Sections 5.2 (Information Assurance and Cybersecurity Support Services), 5.1.6 (Configuration, Change, Release Management Services), 5.1.7 (Disaster Recovery), and 8 (Service Level Agreements), respectively.

Email and Messaging Services Email and Messaging Services provide secure, enterprise-grade electronic communication capabilities for TSA personnel, supporting both internal and external communications. These services include hybrid solutions leveraging Microsoft 365 Government Community Cloud (GCC) Exchange Online and on-premises Exchange Server infrastructure, as well as mobile device messaging. The Contractor is responsible for ensuring the reliability, security, and availability of all email and messaging services across on-premises, cloud, and hybrid environments.

The Contractor shall:

1. Manage, maintain, monitor, repair, and restore TSA’s enterprise email and messaging services, including hybrid solutions (e.g., Microsoft 365 GCC Exchange Online, on-premises Exchange SE), in on-premises, cloud, and hybrid environments.

2. Perform O&M and management of all infrastructure supporting email and messaging, including mobile device messaging.

3. Support planning, design, environment builds, test support, implementation, and decommissioning of email and messaging services.

4. Provide break-fix, restoration of service, and provisioning of services (request fulfillment).

5. Support the ability to segregate and eliminate suspected email-related malicious software and spam traffic.

6. Provide timely support and communication to end users, including planned outages, maintenance, documentation, and training.

7. Ensure all email and messaging services are accessible and compliant with Section 508 requirements, as detailed in Appendix A.

8. Evaluate and support the integration of emerging email and messaging technologies as directed by TSA.

9. Plan and execute upgrades or migrations to minimize disruption to end users and maintain service continuity.

10. Conduct capacity planning and make recommendations to ensure email and messaging services can scale to meet evolving TSA operational requirements.

11. Support TSA’s email archiving, retention, and e-discovery requirements in accordance with applicable federal policies.

Note:

All email and messaging activities shall comply with TSA’s security, change management, disaster recovery, and performance management requirements as detailed in Sections 5.2 (Information Assurance and Cybersecurity Support Services), 5.1.6 (Configuration, Change, Release Management Services), 5.1.7 (Disaster Recovery), and 8 (Service Level Agreements), respectively.

Mobility Mobile Device Management (MDM)

1. The contractor shall perform Operations and Maintenance (O&M) functions for the TSA’s Mobile Device Management (MDM) and Mobile Thread Detection (MTD) systems to ensure all components operate optimally in support of multiple mobile device hardware models and types as well as multiple mobile operating systems.

2. The contractor shall ensure that TSA’s MDM and MTD solutions comply with all applicable Federal Government Zero Trust requirements and align with DHS and National Institute of Standards (NIST) guidance.

3. The Contractor shall support all security and system related requests for information and artifacts in support of the mobility FISMA.

Information Assurance and Cybersecurity Support Services The Information Assurance and Cybersecurity Division (IAD) is responsible for the development and implementation of an enterprise-wide cybersecurity program which is designed to protect and defend TSA personnel, systems and data.