Questions and Answers.pdf

Section # Page # Solicitation Text OFFEROR COMMENT/QUESTION GOVERNMENT RESPONSE A.2.1 3 Sections A.2.1 states, A.2.1.1 Base Period (Transition) and A.2.1.2

Option Periods 1 Through 8.

Please confirm the Base Period is Transition only, for a 6-months duration; 7 twelve-month Option Periods;

and one additional six-month Option Period for a total of 8 Option Periods.

Confirmed

A.2.1 4-11 Section A.2.1 Pricing Schedule reflects unit quantities for models of equipment that will be beyond EOL during this contract

The Smiths Detection 500DT has been formally declared End of Life (EOL) by the OEM as of 2029. This leaves 3 years of Performance remaining during which Offerors will need to support a model that the OEM may or may not be willing to support for any price. Acquiring the necessary spares to see the TSA through at least three years of usage and transferring the necessary knowledge and technical support to another provider (the Offeror or another party depending on their solution) is a challenging undertaking. Without a clear plan in place TSA risks collapse of the support network for these units if they are not able to procure replacements prior to 2029.

While the 500DT is declared EOL the risks are present for other models as well, given the age of TSA's fleet.

The average age of equipment on the contract is currently 10 years. Over the course of the POP an OEM may declare additional equipment EOL, an OEM may go bankrupt, an OEM may be acquired by private equity, or other scenarios that create risks regarding the level of support provided by the OEM to TSA. Any of these events could disrupt the support required from the OEM which the Offeror will need to address.

As such the TSA should consider adding a Parts Obsolescence Management Plan (POMP) similar to the recen EDS ILS RFP to evaluate the Offeror's plan for managing the 500DT and other units as they age. Given the severity of the risks presented by parts obsolescence during the POP the TSA may also consider adding a Supply Chain Risk Manager (SCRM) as key personnel during the last 4 years of the POP at a minimum. An SCRM would benefit TSA by having the knowledge and expertise to help manage EOL for the 500DT and to address other supply chain issues as they arise.

A Parts Obsolescnce Management Plan will be included in the Peformance Work Statement and sent out with final solicitation to include Contract Data Requirements List (CDRL) and Data Item Description (DID).

A.2.1 11 Section A.2.1 Pricing Schedule for OP8 specifies pricing for 12 months. This conflicts with Section A.3 Period of Performance where OP8 is a 6 month option (p19).

Please confirm if OP8 Pricing Schedule (pg. 11) should be corrected to reflect a POP of 6 months.

NOTE: Currently, column header currently reflects "(366 Days)" and Program Support CLINs reflects "12" Months.

Confirmed, this will be corrected

A.2.1.2 A.2.2.3

A.2.1.2 Provisional CLINs for Ancillary Logistics Services (X0003AA), Catastrophic Response and Additional Support (X0003AB), ThermoFisher Chemical Analysis Device (CAD) Repairs (X0003AC), Preventive Maintenance Consumables (X0003AD), Supplemental Support (X0003AE), Emerging IT Requirements (X0003AF), and Emerging Technologies (X0003AH) are based on Not-To-Exceed (NTE) amounts set by TSA for each Option Year.

Section A.2.2.3 Emerging Technologies references incorrect CLIN number

This CLIN should be “(CLIN X0003AG)”, not “(CLIN X0003AH)”, please update for the final. Confirmed, this will be corrected

A.2.2.2 14 Preventive Maintenance (PM) Consumables, QS-B220 Cotton Swabs is listed twice in the table; the second row with PN 42200165 should have a Description of “Alcohol Wipes, pkg of 100”. Please correct in the final RFP

Confirmed, this will be corrected

A.2.2.2 14 Preventive Maintenance (PM) Consumables, specs Recommend TSA provide specifications for the following general consumables items that do not require testing: alcohol wipes, nitrile gloves, and canned air.

TSA will be updating the consumables table in A.2.2.2 in the final RFP. This table will reflect the current list of approved/tested part numbers for all consumables, which is what TSA is requesting offerors to provide pricing for in their proposals.

A.2.5 17-18 A.2.5 Labor Categories recommend refresh of titles to consolidate similar positions and add labor categories related to meet the contract scope

In order to allow a more complete range of staffing and to capture lower level positions, recommend modifying the list of T&M Labor Categories. Focus on consolidating similar positions with similar rates and add labor categories for staff that may be required to perform work under Provisional CLINs:

Program Manager Manager / Supervisor Field Service Technician TSRC / Call Center Support Staffing Coordinator Radiation Safety Officer Information System Security Officer Sr-level IT Support Mid/Jr-level IT Support Sr-level Engineer Mid/Jr-level Engineer Sr-level Analyst Mid/Jr-level Analyst

Confirmed. The list will be edited to include IT support and analyst positions.

A.3 18 Section, A.3 Period of Performanc states, The total period of performance of the effort required by this contract shall be one (1) base period and seven (7) option periods from the date of award as described below. The base period shall include the transition period for this contract.

This Section states there is 1 base period and 7 option periods. However, the table exhibits 1 base period of 6-month duration and 7 twelve-month Option Periods, with 1 six-month Option Period for Option Perioid 8.

Please update the text in Section A.3 to reflect 8 option periods not 7 as currently stated.

Confirmed, this will be corrected

B.4.10 64-66 Section B.4.10 Section 508 of the Rehabilitation Act Please confirm that the Section 508 compliance requirements are limited to those elements of the Offeror's solution that are used by Federal employees. This would include reports, email contents, and application screens used by the COR. The increased requirements listed in the RFP, if applied to every portion of a Offeror's solution, add cost, complexity, and schedule to each screen. Most applicatons are already built to accessibility standards; however, those standards are not tailored to DHS' requirements and could be costly or prohibitive.

Confirmed, as stated in Attachment D-12, this language only applies to federal employees and members of the general public

C.8.8 42 C.8.8 Deployed Equipment Will the Government please indicate if the Offeror will have any Cybersecurity responsibility for the servers, switches, and workstations referred to under peripherals in this section? Actions such as patching, loading antivirus, or other related activities are currently not part of the OEM Maintenance Manuals; however there may be a need to ensure that they are managed.

The offeror is required to work with the OEMs to determine preventive maintenance requirements for all deployed TSE and its peripherals. If TSE peripherals include servers, switches, and workstations and it is determined that actions such as patching, loading antivirus, or other related activities are required then the offeror will be required to perform these maintenance functions. Cybersecurity responsibilities will be bilaterally addressed as they are further defined by OIT.

DID APM-ILS-001 PMP 4 10.2.7 b. Staffing. Describe staffing plan for the operation and maintenance of a Medium High High IT System

System should be "Moderate High High" as opposed to Medium. Confirmed

DID APM-ILS-009, 10.2.2 1 ILS, Implementation and Execution Please provide a description of the contents required for this section or delete the header if applicable. Corrected - added language to the header to clarify

DID APM-ILS-011 SAP 2 10.2.1.c System security plan; refer to NIST SP800-53 Security Controls (moderate level)

10.2.3.b System security plan (Information Assurance Compliance System (IACS) submittal); refer to NIST SP800-53 Security Controls (moderate level)

Both of these references should refer to the correct categorization of Moderate High High as opposed to "moderate" which implies a Moderate Moderate Moderate system.

Confirmed, this will be corrected

DID APM-ILS-011 SAP 2 10.1. FORMAT. Contractors are to utilize National Institute of Standards and Technology (NIST) Special Publication 800-37 for direction and guidance in preparing the SA package documentation for submittal to the TSA. In most cases, as identified in section 10.2, the documents shall be directly entered into the Information Assurance Compliance System (IACS)

10.2.3 c-i all contain an IACS reference.

IACS has been replaced by Cyber Security Assessment and Management (CSAM) system. Recommend updating the language as IACS has been decommissioned.

Confirmed, this will be corrected

DID APM-ILS-011 SAP 2 10.3.1. Although the contractor will have an approved Authority to Operate in place at contract start, the contractor shall complete the third party assessment within 120-days of contract award. An extension may be granted by the CO or COR based on DHS/TSA assessor availability.

This statement may be confusing to Offerors without experience working with TSA's Information Assurance Directorate. Recommend the following rewording: "The contractor shall have an approved Authority to Operate in place to complete Transition and the start of OP1. The contractor shall complete the third party assessment by TSA IAD within 120-days of contract award to allow for review and approval by TSA and DHS. An extension may be granted by the CO or COR based on DHS/TSA assessor availability and TSA CISSO concurrence.

Edited

DID APM-ILS-029 Transitio2 10.2.2.1 b. Describe the vetting process and how the Contractor will ensure personnel are processed and cleared through PerSec prior to the start of option year 1.

Will the Government please clarify if personnel already supporting the contract will require re-vetting under Tier 4 prior to the start of OY1? Currently, PerSec is taking an average of 90 days to make initial suitability determinations. With over 800 personnel expected on the new contract it does not seem feasible that this will happen. Will the Government provide a date by which all personnel should have been vetted or a process so that Offerors can assess the risk? With the increased requirements there is a risk that some existing personnel will not qualify, leading to gaps in service if all personnel are pushed through at once.

All personnel that currently hold an active vetting status will be transfered onto the new contract; however, each case is reviewed individually and further vetting may be required by Persec. Personnel will remain active on the new contract until further determination is received.

n/a n/a n/a Under the current contract, the incumbent is tasked to work with the Airport Operations Center and requires the contractor “to track and provide equipment CM maintenance status during the AOC hours of operation.

The CO and COR will work with the Contractor to identify support requirements.”

The scope makes no mention of escalations by local TSA for priority response to tickets affecting passenger wait times or screening operations. We are currently experiencing approximately 4-7 escalations per day since we started tracking them. As TSA is aware, there is currently no scope in the current contract for escalations and Leidos and our OEM subcontractors. Despite this, we collectively respond to these requests when we can and Leidos, as prime, has assigned resources to work those escalations.

By not including this scope in the contract requirements, TSA risks that bidders will not have the resources to support escalations. New bidders may not have the knowledge and those with the knowledge may not be willing to risk the higher price of assigning those resources. This also extends to OEM service networks where an Offeror could write a scope prohibiting responding to escalations in order to reduce the price. This would leave TSA is a position where if they needed to add the capability to escalate in the future, then they would have to modify the contract and negotiate. As long as TSA understands this risk there is no need for a scope addition; however, if TSA expects to be able to escalate then scope should be added to reflect this.

This reporting requirement will be reviewed and updated prior to final RFP release.

Request the government provide historical OEM maintenance data as soon as possible, prior to the release of the RFP.

OEM maintenance data will be available, by request, with the release of the final solicitation. To receive it earlier, please request from the CO.

FAR 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of certain Equipment is not checked as applicable to this procurement.

This RFP is being issued as a commercial contract IAW FAR Part 12 for the acquisition of commercial products and Services. Therefore, request the government consider this clause applicable for that portion of the work that is considered maintenance, calibration or repair of equipment. Inclusion of this exemption will reduce excessive government contract administration to comply with 52.222-44 - Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment. Note - FAR 52.222-51 was applicable in the 2019 RFP.

TSA does not believe that paragraphs (a) and (b) of FAR 52.222-51 apply. Therefore, this clause cannot be included in the RFP.

B.1.4

FAR 52.217-8

B.1.5.c

Please clarify the Period of Performance is 8 full year option periods: Tables for Option years in A.2.1.2 show full eight years of Options for the Sustainment of TSE, Section A.3 Period of Performance states “seven

(7) option periods”, while the table in A.3 shows eight option periods with the last option period having a 6-month length.

Corrected

10.2.2 ILS, Implementation

and Execution 1 Please clarify requirements for Section 10.2.2 ILS, Implementation and Execution. Corrected

10.3 Related Plans

Applicable to the PBL

Program

Please clarify the intent of this section, as there are no requirements in the PWS for the "PBL Program", nor definition of what subordinate plans from the PWS are to be included in this section

This was removed from the DID.

C.8.6 Supply Support 16 Should the requirement to meet "PBL" service level requirements be updated to state "ILS" service level requirements? The reference to "PBL" have been updated to "ILS".

A.2.1.2

4 - 11

Please confirm that for disincentives and other SLAs that ASLs are combined with their AT x-rays, as they are shown grouped together on rows in the tables in A.2.1.2, while the inventory spreadsheet seems to list them on separate rows. Are there combined entries in the TSE Database for this equipment? Since there are two separate suppliers for each system without a system integrator we recommend separating ASLs from the AT xrays in table A.2.1.2.

Disincentives are applied as described in the PWS. There are separate entries in the TSE database for AT and

ASL.

10.2.7.b Staffing 4 Would the government clarify and point to the requirement for a "Medium High High IT System" , as this staffing section under IT System Management is the only reference to that designation in any of the released documents, nor is there an explanation of what this term encompasses.

The categorization of the system is determined by the FIPs 199 rating of the data required to manage the ILS program. Additional information can be found here: chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf

10.2.3. TSA Service

Response Center Functions,

a. Availability & Responsiveness

Paragraph 10.2.3a Availability and Responsiveness states "Describe the Contractor’s approach and methodology for satisfying contract requirements for availability and responsiveness. Field Service Technicia (FST) dispatch, update, and closeout functions must be described." Please clarify if this requirement refers to availability and responsiveness of the system/applications, the staff dispatching or performing the work, ability to meet SLAs related to this or all of the above."

DID is updated for clarification.

PWS C.7.3 Contract Transition

What data will be transferred to the incoming ILS Prime contractor e.g., database schema, current year data only, historical data, entire database and in what format e.g., coma delimited, MS Excel, MS Access etc.?

The incoming contractor will receive all program historical maintenance data and all open work orders. Curren contract requires maintenance data deliverables to be provided via Microsoft Office Suite 2016 products.

Request the government provide historical OEM maintenance data as soon as possible prior between now and the release of the RFP?

OEM maintenance data will be available, by request, with the release of the final solicitation. To receive it earlier, please request from the CO.

Please provide historical data on the TSRC including average and peaks per day and per hour, and average length of a call.

Historical TSRC perfomance data will be available, by request, with the release of the final solicitation. To receive it earlier, please request from the CO.

We recommend changing disincentives to apply per airport per technology per OEM , as there are several locations where multiple OEMs supply the same technology at a site, and would be unfair to penalize one OEM when the other OEM hasn't met their SLA targets

The SLA is for overall contract execution and between TSA and the Prime Contractor. Flowdown of penalties to OEM subconctractors is the responsibility of the Prime Contractor

Who are the approved TSA suppliers for Preventative Maintenance Consumables? The approved TSA suppliers for Preventive Maintenance Consumables will be identified in the updated PWS.

A.2.1.2 A.2.4.3

4-11 16-17

In the Option period tables, recommend changing the CLIN type of Thermo Fisher Chemical Analysis Device (CAD) Repairs to FUP/NTE, based on the FUP table shown in A.2.4.3

The pricing for Thermo Fisher CAD will remain FUP per repair. An updated table is included in A.2.4.3

A.2.5, A.2.4.1, A.2.4.2, A.2.4.4

Will the government clarify whether the Labor rates in A.2.5 should include material and travel costs? A.2.4.4 Supplemental Support (CLIN X003AE) states "The hourly rate proposed by the Contractor in these cases shall be fully burdened and include materials and travel costs", while both A.2.4.1 Ancillary Logistics Service (CLIN X0003AA) and A.2.4.2 Catastrophic Response and Additional Support (CLIN X0003AB) states "The Contractor will be reimbursed for all allowable, allocable and reasonable costs for Materials and Travel." In addition, the unit of measure for CLIN X003AE states "hour" where the other CLINS unit of measure is "NTE". Please clarify.

The rates in A.2.5 should include all travel costs. However, any materials required for performance under these CLINs may be proposed and billed separately. Unlike CLINs Ancillary, Catastrophic, Emerging IT, for Supplemental support there is only one hourly labor rate ,which will be used in conjunction with the NTE to determine how many hours are available under that CLIN. For the other CLINs, each action will utilize the fully burdened labor rates in section A.2.5 and be negotiated case by case.

C.8.8.2.1 TSE Located in Riggers Warehouses and Other Local Storage Locations

Typical storage units are not operational and cannot have PMs, CMs or RSs performed, nor do these locations have the needed power requirements. However, the PWS requires the contractor to make all efforts to continue to service the TSE in storage for up to 90 days. Does TSA anticipate powering up systems while they are located in storage, and if so how will power be provided?

This section has been removed from the PWS and is no longer a requirement

C.13 Personnel Security Suitability Determination 97

This section states, "An assessment from PerSec has determined the need for personnel supporting this contract to be successfully vetted by means of a Tier 4 level investigation which should be facilitated by TSA thru DCSA due to the impact." The EDS PBL requirement was revised to read: “An assessment from PerSec has determined the need for personnel supporting this contract to be successfully vetted by means of a Tier 2 level investigation for Field Service Technicians and Tier 4 for Program Managers and supervisory positions which should be facilitated by TSA thru DCSA due to the impact.” Will TSA update this requirement to match the PBL requirement?

This will be clarified in the solicitation.

A.2.2.3 Emerging Technologies 15

CLIN X0003AH’s Not to Exceed (NTE) value is included in this contract to allow post-warranty maintenance support for new, emerging technologies the TSA may procure, deploy, utilize, and maintain

Please clarify if CLIN X0003AH as stated in the PWS should be CLINX0003AG Emerging Technologies

This will be clarified in the solicitation.

C.9.2 through C.9.4

Will the work under C.9.2 Engineering Support, C.9.3 End of Life Cycle Support, and C.9.4 Maintenance Training for TSA Personnel be compensated through X0003AA Ancillary Logistics Services CLINs or other Provisional Items CLINs?

The work under C.9.2, C.9.3 and C.9.4 will be conpensated through Ancillary Logistics Support or Supplemental Support, as appropriate.

C.7.10 Continuity of Operations Plan 77

Please reconcile the requirement to "Ensure all network application assets (e.g., application servers, domain controllers, Information Assurance (IA) tools, etc.) shall be incrementally backed up as required to eliminate loss of critical audit data and allow for restoration and resumption of normal operations within one hour" and the requirement to "Ensure sufficient backup data to facilitate a full operational recovery within one business day at either the prime operational site or the designated alternate site."

To clarify, critical TSE maintenance data that consists of open work orders and work orders within the last calendar year that are located on network assest shall be incrementally backed up to allow for restoration and resumption of normal operations within one hour.

The contractor is also required to ensure sufficient backup data for historical maintenance data over 1 years old shall be incrementally backed up to facilate a full operational recovery within one business day.

A.2.2.1 Sustainment of TSE

(CLIN X0001) 12

The PWS states, “predictable National Security Special Events (NSSE) designated by the Secretary of Homeland Security that shall be considered within the scope of this contract and covered within CLIN X0001”. Will the government provide a list of NSSE to be used for pricing purposes?

NSSE events change over time. Information on NSSE events is publicly available on numerous government websites.

PWS Section A.2.1.2 4-11

Would TSA add to the inventory spreadsheet the equipment that is not currently under covered ILS but is expected to enter ILS during the execution of this contract due to the OEM warranties expiring, such as the the 2,059 IDEMIA CAT units and the 296 Smiths Detection AT-CT Standalone units listed in the tables in PWS Section A.2.1.2?

TSA will add to the inventory spreadsheet the estimated TSE that is not currently covered under this ILS contract but is expected to be during the life of this contract.

A.2.1.2 3 The Pricing Schedule quantities represent estimated quantity counts for each Period. Payment will be based on actual quantities deployed and operated in the field.

Using estimated TSE quantities without specifying minimum quantities will cause OEMs to "risk up" Fixed Unit Prices as they have to recover their direct labor, material, overhead, and margin for a 7 year period on an uncertain business base.

Concern noted. Thank you

A.2.1.2 3

All Transportation Security Equipment (TSE) maintenance shall be conducted by Original Equipment Manufacturer (OEM) certified technicians using OEM Master Configuration Item List (MCIL) repair parts.

The inclusion of this language in the RFP, without a requirement for the OEMs to provide training to certify 3rd party technicians at market rates, eliminates the potential for any competition in providing the vast majority of maintenance and logistics support on this contract. This sole source situation almost certainly increases FUP costs to TSA through the life of the contract.

OEMs are the certification source for equipment technicians. Offerors are required to coordinate with OEMs to obtain technician certifications.

A.2.6 18

Therefore, performance disincentives will be imposed to ensure tha the Contractor meets the SLA set forth in Section C.8.10, CLS Service Level Agreement (SLA) Performance Requirements. TSA will calculate RMA data as applicable in accordance with Attachment D-3, Reliability, Maintainability, and Availability Terms and Definitions, D-3a, Data Dictionary, and Attachment D- 7, Service Level Agreement Performance Metrics.

Since there is no competition at the subK level as the prime has to contract with OEMs to provide maintenanc and logistics support for their TSE and performance disincentives are tied to staffing level metrics such as Technician Response Time and FST Site Response Time, OEMs can build in expected cost of disincentives into their FUP rates. This limits the effectiveness of performance disincentives as the prime contractor just passes them down to the OEM who has already built them into their pricing structure. A potentially better and more cost effective approach would be to qualify 3rd party vendors to maintain TSE thereby creating competition that will reduce prices. The competition would also incentivize these vendors to meet Ao goals as the prime could replace them with another qualified vendor if they didn't meet SLA metrics.

Offerors are free to propose any approach to fulfillment of the contract, including third party maintenance technicians. Proposals must be executable without intervention by the TSA.

A.3 18 The total period of performance of the effort required by this contract shall be one (1) base period and seven (7) option periods from the date of award as described below.

While generally a longer term contract increases ROI for contractors and thereby reduces overhead resulting in lower total cost to the Government, the unique situation on this program will likely have the opposite effect.

With OEMs being in a sole source position and needing to mitigate financial risks associated with a 7 year contract that causes longer term labor cost increases, additional parts availability/obsolence issues and no quantity commitment from the customer on FUP cost recovery, there will likely be significant price escalation in the out years of the contract.

Noted

B.2.1 B.4.11 C.7.3

33 Supporting key personnel; replace key personnel as necessary.

Provision is included for Key Personnel in B.2.1, B.4.1.1, and C.7.3. Key Personnel are also mentioned for Transition In, though not specifically listed in the Draft PWS. Will the government clarify what Key Personnel are required for the contract, and whether the Offeror can propose additional Key Personnel that will be included in the evaluation criteria? We would also recommend that a Program Manager be required as Key at minimum.

This will be clarified in the solicitation.

B.3.4.6 44 Preventive Maintenance (PM) Disincentive.

PM disincentive focuses on penalizing the contractor if scheduled PM isn't completed. While this may help in ensuring PM based on OEM manual is completed timely, it misses the opportunity to get the contractor to improve the PM program. Recommend adding an incentive to increase PM and reduce CM/DM thereby improving Ao.

H.R. 302 FAA Reauthorization act Sec 198 Maintenance of Secuirty-Related technology requires TSA to:

include penalties for noncompliance when preventative or corrective maintenance has not been completed according to the contractual requirements and manufacturers' specifications.

Therefore, disincentive penalties are required when PM is not performed on-time and/or non-compliance with the CM service level agreement requirement.

Offerors are encouraged in the PWS to propose innovations and changes to PM schedules that would increase reliability

C.1.1 67

TSE is also being procured by airports and stakeholders with four warranty years. Following the expiration of the warranty period, the TSE requires the full logistics and sustainment support under this contract to ensure operational availability of the TSE.

TSA’s Deployment and Sustainment Division (DSD) Integrated Logistics Support (ILS) branch requires full logistics and sustainment support for the TSE out of the warranty period. We recommend TSA provide a list o all the TSE procured by the airports and stakeholders to ensure coverage during this contract's POP.

TSA will add to the inventory spreadsheet the estimated TSE that is not currently covered under this ILS contract but is expected to be during the life of this contract.

C.1.2 68

The objective of this procurement is to obtain a performance based Contractor Logistics Support (CLS) contract with a Maintenance Service Provider (MSP or Contractor), relying on the Contractor’s experience and expertise to determine the best maintenance and support structure that meets or exceeds the performance requirements

Section C and Attachment D-3 of the draft RFP are predicated on terms and conditions that preclude the prime contractor from determining the best maintenance and support structure by focusing maintenance and logistics support on TSE using FUP CLINs. If a system engineering approach was allowed within the RFP, the prime could focus on improving operational support by focusing maintenance and logistics support at the system (PSP lane) and system of systems (airport) level that will yield same Ao at lower total cost.

The offeror is free to propose innovative approaches for the maintenance of checkpoint TSE as long as their approach meets all requirements of the RFP.

C.8 80

The Government requires the Contractor to provide the required sustainment services set forth in this Section for all deployed and operated TSE not under the manufacturer’s warranty located at the federal airports and other designated locations identified in Attachment D-1.

The sustainment services PWS should recognize the different airport categories and allow for flexibility in the delivery of PM and CM sustainment services to meet Ao goals depending on variables within airport category type or even individual airports within a category. For example, if a Cat X airport has more lanes than needed to meet throughput objectives even in high travel periods, TSE SLA maintenance criteria can be adjusted to reflect the additional lane capacity, thereby potentially reducing maintenance costs.

The offeror is required to meet the 98% Ao requirments of the RFP.

C.8 80

The Contractor shall describe its approach to FST certificationand shall address opportunities for cross-training FSTs to maintain equipment from multiple OEMs in CDRL A009, Integrated Support Plan.

Recommend adding language to this section of C.8 requiring OEMs to provide FST certification training to 3rd party vendors for the maintenance of their TSE. An FFP CLIN should be added to Section A.2.1.2 enabling OEMs to propose their costs to conduct the training.

Offerors are free to propose any approach to fulfillment of the contract, including third party maintenance technicians. Proposals must be executable without intervention by the TSA.

C.8.1 80 The completion of Preventive Maintenance (PM) is integral to the proper operation of TSE.

Recommend adding language to this section of C.8.1 incenitivizing the Prime contractor to work with the OEMs to enhance and expand PM based on failure data analysis to reduce CM/DM.

The offeror is free to propose innovative approaches for the maintenance of checkpoint TSE as long as their approach meets all requirements of the RFP.

C.8.6 86

The Contractor shall establish a robust supply chain management process that includes the appropriate levels of OEM Master Configuration Item List (MCIL) repair parts, distribution procedures, and shipping modes to support the Service Level Agreement (SLA) requirements of this PWS as defined in Paragraph C.8.10 of this PWS.

Recommend adding language to this section to require the Prime and OEMs to develop a fully integrated supply chain solution for the PSP contract. This will serve to help eliminate unnecessary redundancy and increase efficiency that should result in overhead cost savings.

The offeror is free to propose innovative approaches for the maintenance of checkpoint TSE as long as their approach meets all requirements of the RFP.

C.8.10.1 90 The Government will measure overall Contractor performance using Operational Availability (Ao). Ao is the percentage of airport operating hours a TSA system is available to perform its required mission. Ao shall be measured by ‘airport-technology’ monthly, and any applicable disincentives shall be included in that month’s invoice in accordance with Section B.3.4.4, Development of Invoices, of Part B.

Recommend adopting a higher level and more nuanced approach to Ao rather than "one size fits all" 98% Ao for every piece of TSE in all 430+ airports. Specifically adopt a top down approach starting by airport category and the number of lanes within the airport by category to determine required Ao to meet passenger throughput requirements based on utilization and capacity. For example, a Cat X airport with a large number of lanes in a terminal wouldn't require a 98% Ao when utilization is low. The required Ao would be based on historical travel volumes by season, holidays, time of week and day. However, for a Cat IV airport with very few lanes, the Ao would potentially be higher than 98% as having just one or two lanes out of service results in TSO's having to do hand checks resulting in reduced passenger throughput and heightened security concerns.

The offeror is required to meet the 98% Ao requirments of the RFP.

3.1 1 Preventive maintenance (PM) improves the reliability of TSE and is scheduled according to the Original Equipment Manufacturers (OEM) manual.

This view of PM is a missed opportunity to improve the reliability of TSE. As currently structured, PM is based on an OEM manual that may or may not reflect "real world" maintenance experience for TSE in Cat X- IV airports. PM should be based on an analysis of component and sub-component failures within TSE based on actual operational experience, that could have been prevented if they'd been replaced prior to failing. This would reduce CM/DM and result in improved Ao.

The offeror is free to propose innovative approaches for the maintenance of checkpoint TSE as long as their approach meets all requirements of the RFP.

Entire Plan All Preventive Maintenance v. Corrective Maintenance

Only 5 lines of a 26 page RMA plan discusses preventive maintenance. The rest of the plan is focused on CM.

This will result in the contractor being almost completely focused on CM and therefore taking a reactive approach to TSE maintenance. A reactive instead of proactive approach to TSE maintenance will result in more frequent and longer equipment outages as older equipment is harder to support unless an Reliability Centered Maintenance approach is implemented.

The offeror is free to propose innovative approaches for the maintenance of checkpoint TSE as long as their approach meets all requirements of the RFP.

Section 1 Purpose 1

ꞏ To define the process which the Transportation Security Administration (TSA) will use to identify, collect, record, and report each preventive and corrective maintenance activity conducted on Transportation Security Equipment (TSE).

•To establish the process for developing the Reliability, Maintainability, & Availability (RMA) metrics that TSA will use to evaluate the performance of TSE during the Operation and Maintenance (O&M) phase of its life cycle.

•To support the process TSA uses to develop metrics to evaluate the performance of TSE contracted maintenance service providers (MSP) and Original Equipment Manufacturers (OEM).

As written, the stated purpose of the RMA plan is very tactical and entirely oriented towards tracking/reportin on CM/DM for individual pieces of TSE. Typically the purpose of an RMA plan is to to improve RMA for a system taking into account factors such as built in redundancy, Failure Modes, Effects and Criticality Analysis (FMECA), as well as, Mean Time Between Crirical Failures (MTBCF). For this contract the "system" should be defined as the TSE in a passenger checkpoint lane, starting with the CAT device to validate identity and ending with the ETD. By using a system mission oriented approach, the RMA plan will focus on accurately screening as many passengers as possible (throughput) via a checkpoint lane. This would result in better prioritization of PM/CM/DM and flexibility in the application of the various maintenance and logistics metric that has the potential to reduce FUP CLIN pricing for TSE.

Attachment D-3 TSE metrics Terms Definition and RMA Metrics is not a plan, it is a reference document on how to identify, collect, calculate, and report TSE data.

D3 4 TSA assign security category For confidentiality, integrity, and availability purposes, would you please clarify what FIPS-199 security categorization(s) will apply to the systems and data supporting the ILS contract?

Medium High High - The categorization of the system is determined by the FIPs 199 rating of the data required to manage the ILS program. Additional information can be found here: chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf

E14 6 Designated alternate/backup site If the system supporting the TSRC is hosted in a Fedramp GovCloud environment, is a designated alternate/backup site required? 1hr. Recoverability time is a requirement, execution is left up to the offereor.

N1 11 major agency IT infrastructure support contractor shall provide, implement and maintain a Security Program Plan

Is the Security Program Plan mentioned in this provision the same as the documents defined in CDRL A011?

If not, what are the specific differences?

Security Program Plan would only be required if the IT system provided exceeds $100,000,000 or per TSA management request. TSA IT has only requested the Security Authorization Package (A011).

Q4/Q5 12 CMaaS vendor shall provide support for patching Section Q4 indicates the CMaaS vendor will patch via WSUS. Section Q5 states the contractor is responsible for patching using CDM solution patches. These statements appear to conflict. Could the Government clarify which is correct?

Q.4 states that TSA will provide CDM related patches. Q5 states the contractor is required to install the CDM related patches within 2 business days

Summary 22 N/A

Could the Government please provide the following HSAR and TSA clauses:

48 CFR 3052.204–71, CONTRACTOR EMPLOYEE ACCESS (JULY 2023)

HSAR 3052.204-72, SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (July 2023), HSAR 3052.204-73, NOTIFICATION AND CREDIT MONITORING REQUIREMENTS FOR

PERSONALLY IDENTIFIABLE INFORMATION INCIDENTS (JULY 2023),

Information Technology Security Awareness Training (July 2023), FAR 52.224-3 Privacy Training – Alternate I (DEVIATION), TSA RQMTS: REQUIREMENTS FOR HANDLING SENSITIVE SECURITY INFORMATION (SSI), and

TSA-INSTR: PERFORMANCE BY FOREIGN NATIONAL CONTRACTOR EMPLOYEES (SEP 2020).

48 CFR 3052.204–71, HSAR 3052.204-72, HSAR 3052.204-7, TSA-INSTR: PERFORMANCE BY

FOREIGN NATIONAL CONTRACTOR EMPLOYEES, Information Technology Security Awareness Training (July 2023) will be included in full text in the final RFP. FAR 52.224-3 will be included by reference and can be looked up by offerors. TSA-INSTR: PERFORMANCE BY FOREIGN NATIONAL CONTRACTOR EMPLOYEES (SEP 2020) was updated to (JUN 2021) and was included in the draft provided.

OCIO CISO(C-SCRM) 24 Contractor responsibilities for Information and Communications Technology (ICT) products

Is it a correct assumption that, if the TSRC IT support system is hosted in a Fedramp GovCloud, the contractor will only be responsible for the SW ICT products and not the HW?

The Contractor is responsible for the entire system both SW and HW. Regardless of the solution chosen, the offeror will need to be able to report on the entirety of the system.