261103-TSA_Independent_Third-Party_Acceptance_Testing_Policy_v2.0.pdf

TSA Test and Evaluation Division Policy for the

TSA-Approved Independent Third-Party Acceptance Testing of

Donated, Bailed, and Non-TSA-Funded Transportation Security

Equipment

Version: 2.0

November 3, 2026

TSA Independent Third-Party Acceptance Testing Policy version 2.0 i

APPROVAL:

Thomas Tomaiko

Independent Test Agent

Executive Director, Test and Evaluation Division

Security Capabilities

Transportation Security Administration ii

TABLE OF CONTENTS

ACRONYMS

1. PURPOSE

2. SCOPE AND APPLICABILITY

3. AUTHORITIES AND REFERENCES

3.1 GOVERNING REFERENCES

3.2 HISTORICAL REFERENCES

4. POLICY

5. ROLES AND RESPONSIBILITIES

5.1 TRANSPORTATION SECURITY EQUIPMENT (TSE) PORTFOLIO/PROGRAM MANAGEMENT

OFFICE (PMO)

5.2 DEPLOYMENT AND SUSTAINMENT DIVISION (DSD) / CAPABILITY ACCEPTANCE

MANAGEMENT BRANCH (CAMB)

5.3 DEPLOYMENT AND SUSTAINMENT DIVISION (DSD) / REGIONAL DEPLOYMENT

COORDINATOR (RDC)

5.4 DSD INTEGRATED LOGISTICS SUPPORT (ILS) CONFIGURATION MANAGEMENT (CM)

5.5 DSD GOVERNMENT PROPERTY / ACCOUNTABLE PROPERTY OFFICER (APO)

5.6 DONOR, SPONSOR, AIRPORT AUTHORITY, AIRLINE, OR COMMERCIAL ENTITY

5.7 TSA-APPROVED THIRD-PARTY ACCEPTANCE TESTING ORGANIZATION

5.8 OEM, SYSTEM INTEGRATOR, INSTALLER, AND LOCAL TSA

5.9 TEST AND EVALUATION (T&E) DIVISION

6. THIRD-PARTY ACCEPTANCE TESTING ORGANIZATION APPROVAL

LIFECYCLE

7. TESTING EXECUTION AND REPORTING

7.1 ACCEPTANCE TEST READINESS

7.2 ACCEPTANCE TEST EXECUTION

7.3 REPORTING

7.4 RESULT STATUS LANGUAGE

8. TERMS AND CONDITIONS APPLICABILITY

APPENDIX A: TSA-APPROVED THIRD-PARTY ACCEPTANCE TESTING

ORGANIZATION APPROVAL PROCESS

iii

APPENDIX B: TSA-APPROVED THIRD-PARTY ACCEPTANCE TESTING

ORGANIZATION PERFORMANCE ASSESSMENT APPROACH

APPENDIX C: ACCEPTANCE TESTING CATEGORIES FOR DONATED, BAILED,

AND NON-TSA-FUNDED TSE

APPENDIX D: SOURCE DOCUMENT LINEAGE AND DISPOSITION CROSSWALK . 1

APPENDIX E: RETIRED AND UPDATED TERMINOLOGY

APPENDIX F: RESPONSIBLE, ACCOUNTABLE, CONSULTED, AND INFORMED

(RACI) CHART

iv

ACRONYMS

Acronym Definition

APO Accountability Property Officer

ATR Acceptance Test Request

CAMB Capability Acceptance Management Branch

CAP Capability Acceptance Process

CBIS Checked Baggage Inspection System

CIL Configuration Item List

CM Configuration Management

CMP Configuration Management Plan

DHS Department of Homeland Security

DSD Deployment and Sustainment Division

FAT Factory Acceptance Test

FAT&E First Article Acceptance Test and Evaluation

FDRS Field Data Reporting System (from Transportation Security Equipment [TSE])

FRD Functional Requirements Document

GPM Government Property Management

ILS Integrated Logistics Support

ISAT Integrated Site Acceptance Test (for Checked Baggage Inspection Systems only)

ISO/IEC

International Organization for Standardization / International Electrotechnical

Commission

NAT Retired: Network Acceptance Test (now Network Throughput Acceptance Test)

NCIL Network Configuration Item List

NDA Nondisclosure Agreement

NTT Network Throughput Acceptance Test

OEM Original Equipment Manufacturer

ORD Operational Requirements Document

ORT Operational Readiness Acceptance Test

PMO Portfolio/Program Management Office

QLR Quick Look Report (i.e., Acceptance Test Report)

RACI Responsible, Accountable, Consulted, and Informed

RDC Regional Deployment Coordinator

SAT Site Acceptance Test

SI System Integrator

SME Subject Matter Expert v

Acronym Definition

SSI Sensitive Security Information

T&E Test and Evaluation

TED Retired: Test and Evaluation Division (now T&E Division)

TPT

Third Party Tester / Third Party Acceptance Tester (now TSA-approved Third-Party

Acceptance Testing organization)

TRN Acceptance Test Readiness Notification

TSA Transportation Security Administration

TSE Transportation Security Equipment

TSN Acceptance Test Status Notification

VRTM Verification Requirements Traceability Matrix

1. PURPOSE

This policy establishes TSA Test and Evaluation (T&E) Division requirements for approving, using, overseeing, and assessing TSA-approved Third-Party Acceptance Testing organizations.

TSA-approved Third-Party Acceptance Testing organizations conduct acceptance testing of

Transportation Security Equipment (TSE) when a donor, sponsor, commercial entity, airport authority, airline, or other non-TSA entity funds the acceptance testing.

This policy consolidates and updates prior TSA T&E Division guidance on third-party acceptance testing, including guidance on donated TSE acceptance testing, Third-Party Acceptance Testing organizations approval, performance monitoring, and acceptance test reporting.

This policy supersedes the historical guidance and memoranda identified in Appendix D to the extent they address TSA-approved Third-Party Acceptance Testing of donated, bailed, and non-TSA-funded TSE.

The T&E Division will review this policy at least every two (2) years, or sooner if TSA policy, Capability

Acceptance Process (CAP) procedures, acquisition guidance, TSA Security Operations, or TSA Security

Capabilities require it.

2. SCOPE AND APPLICABILITY

This policy applies to TSA-approved Third-Party Acceptance Testing organizations that conduct acceptance testing for the following TSE activities:

1. Donated TSE under the CAP.

2. Bailed TSE when the sponsor, donor, vendor, airport, airline, or other non-TSA entity funds the

TSE acceptance testing.

3. Non-TSA-funded commercial moves or changes involving TSA-owned TSE, including commercially driven checkpoint lane changes, relocations, or integrations requiring acceptance testing.

4. Checkpoint network integration testing, including Network Throughput Acceptance Test

(NTT), when associated with donated, bailed, or non-TSA-funded TSE activities.

This policy applies to the following TSE acceptance testing activities:

• First Article Acceptance Test and Evaluation (FAT&E);

• Factory Acceptance Test (FAT);

• Site Acceptance Test (SAT);

• Operational Readiness Acceptance Test (ORT);

• NTT, when required; and

• Operational Run-In, when the Portfolio/Program Management Office (PMO), Deployment and

Sustainment Division (DSD), or approved acceptance test plan requires Operational Run-In after acceptance testing.

This policy does not apply to T&E Division-led testing to include:

• TSE acceptance testing;

• Checked Baggage Inspection System (CBIS) Integrated Site Acceptance Test (ISAT);

• CBIS ISAT with Operational Run-In;

• Formal qualification testing, algorithm certification testing, operational testing, or system evaluation reporting;

• Third-party testing used in TSA qualification decisions under the TSA Third Party Testing

Framework, except as a reference for broader third-party testing principles; or

• Long-term maintenance, sustainment, or operational monitoring beyond acceptance testing, unless a TSA-approved acceptance test plan or decision authority specifically requires additional acceptance testing.

3. AUTHORITIES AND REFERENCES

Appendix D provides a source document lineage and disposition crosswalk.

3.1 Governing References

The following references govern or support this policy:

1. TSA Test and Evaluation Policy: Establishes TSA T&E roles, responsibilities, and independent acceptance test authority.

2. TSA Test and Evaluation Guidebook: Describes TSA acceptance testing categories, the T&E

Division roles, acceptance testing activities, reporting, and relationships to broader T&E Division evaluation concepts.

3. TSA Acquisition Manual, Appendix C: Capability Acceptance Process: Describes the process for evaluating, accepting, and implementing donated capability, including business case, memorandum of understanding, offer, acceptance, and tracking activities.

4. Capability Acceptance Process Terms and Conditions: Establish terms and conditions that donors and related non-TSA sponsors must follow.

5. T&E Division Acceptance Testing Overall Result Status Guidance: Defines the T&E Division reporting categories, concerns, deficiencies, incomplete acceptance testing, and acceptance test result status language.

6. Configuration Audit Procedure for ILS, Version C, dated July 30, 2013: Defines the procedures for conducting a configuration audit on TSE on behalf of TSA to ensure the accuracy of the identifying documentation.

7. Memorandum: Organizational Alignment of Configuration Management (CM) Roles dated

October 11, 2018: Provides clarification and organizational alignment of CM roles and associated duties.

8. Configuration Management Plan (CMP), Version E, dated August 31, 2018: Defines the CM processes and procedures used throughout the life cycle of TSE developed, integrated, acquired, deployed, and maintained by TSA.

3.2 Historical References

1. T&E Division Support to Third-Party Acceptance Testing for Donated Systems, Version 1.2, September 2023: Historical base document consolidated into this policy.

2. Memorandum for Record: Acceptance Testing of Transportation Security Equipment (TSE), October 2023: Supersedes the prior 2021 acceptance testing category table and establishes applicable tester and funder categories.

3. Memorandum: Policy Direction for Third Party Acceptance Testing of Transportation Security

Equipment Under the Capability Acceptance, October 2021: Historical policy direction for third-party acceptance testing and organization certification.

4. Memorandum for Record: Third Party Acceptance Test Agent Approval Process, October 2021:

Historical approval process consolidated into Appendix A.

5. TSA Third Party Testing Framework, Version 2.0, April 2026: External reference for broader TSA third-party testing data acceptance processes. This framework does not replace this policy for acceptance testing.

4. POLICY

TSA permits the use of TSA-approved Third-Party Acceptance Testing organizations for donated, bailed, or non-TSA-funded commercial TSE acceptance testing when all the following requirements are met:

1. The TSA T&E Division has approved the Third-Party Acceptance Testing organization.

2. The TSA-approved Third-Party Acceptance Testing organization uses the most current TSA

PMO-approved acceptance test plan and procedures.

3. The TSA-approved Third-Party Acceptance Testing organization uses the applicable TSA DSD-

Integrated Logistics Support-Configuration Manager-approved configuration baseline, including the Configuration Item List (CIL), or other PMO/DSD-approved configuration artifacts when performing the acceptance test CIL validation.

4. The TSA-approved Third-Party Acceptance Testing organization submits the acceptance test results and reports to TSA as required.

5. The TSA-approved Third-Party Acceptance Testing organization provides the T&E Division with the opportunity to review the Acceptance Test Status Notification (TSN), Acceptance Test Report

(e.g., Quick Look Report), supporting data, or other required artifacts.

6. The PMO, DSD Capability Acceptance Management Branch (CAMB), DSD Regional

Deployment Coordinator (RDC), or other designated decision authorities use the results to inform acceptance, go-live, deployment, or risk decisions.

The TSA-approved Third-Party Acceptance Testing organizations and the T&E Division do not make final decisions on TSA acceptance, deployment, go-live, or operational use. The PMO, DSD CAMB, DSD RDC, or other TSA decision authority make those decisions.

TSA approval of a Third-Party Acceptance Testing organization applies at the organization level only. It does not automatically make the organization eligible to perform acceptance testing on every project. For each project, the organization must be independent of the Original Equipment Manufacturers (OEMs), OEM-affiliated organizations, System Integrators, installers, and System Integrator affiliated organizations that performed or materially supported work subject to acceptance testing. The OEM, System Integrator, installer, or any affiliated entity may provide installation, readiness, technical, corrective action, and site support services, but may not perform independent third-party acceptance testing for the same TSE project.

Independence is a required condition for project eligibility. It separates the organization that installs, integrates, commissions, repairs, or corrects the TSE from the organization that determines whether that work meets the acceptance requirements before TSA makes its final TSE acceptance decision. An organization may not perform acceptance testing on work that the organization, its affiliate, or its personnel installed, integrated, commissioned, repaired, corrected, or otherwise materially supported. This prohibition applies even if the organization uses separate personnel, business units, internal firewalls, or quality control processes. This requirement prevents actual, potential, or apparent organizational conflicts of interest, including a financial interest in whether the work is found acceptable.

If a project-specific relationship raises an actual, potential, or apparent independence concern, CAMB, DSD, and PMO will determine the appropriate response.

Possible responses may include additional acceptance testing, retesting by a different third-party acceptance testing organization, corrective action, project-specific disqualification, suspension, or removal. Unless TSA determines otherwise in writing, the donor, sponsor, airport authority, or commercial entity is responsible for funding any additional acceptance testing required to resolve independence concerns.

5. ROLES AND RESPONSIBILITIES

See the Responsible, Accountable, Consulted, and Informed (RACI) Chart in Appendix F which lays out:

• R = Responsible: Performs or coordinates the work

• A = Accountable: Final authority or decision owner

• C = Consulted: Provides input/review

• I = Informed: Kept aware of status/results

Note: Final acceptance of a TSE into TSA inventory is executed by the DSD Government Property /

Accountable Property Officer (APO) upon receipt of required property documentation (e.g., signed TSA

Form 251 or DD-1149). Final “go-live” and deployment decisions depend on the specific project scenario. Therefore, the RACI chart identifies when the PMO, DSD RDC, or DSD CAMB acts as the accountable TSA decision authority.

5.1 Transportation Security Equipment (TSE) Portfolio/Program Management Office (PMO)

Responsibilities:

• Owns the TSE requirements baseline, including applicable Functional Requirements Document

(FRD), Operational Requirements Document (ORD), Verification Requirements Traceability

Matrix (VRTM), and program-specific requirements.

• Coordinates with the T&E Division for review and concurrence on acceptance test plans and procedures.

• Coordinates with DSD ILS CM and the OEM to maintain approved TSE configuration baselines.

• Reviews and submits the official Acceptance Test Readiness Notification (TRN) to the TSA-approved Third-Party Acceptance Testing organization (copying the Acceptance Test Request

[ATR] mailbox ATR@tsa.dhs.gov and other required stakeholders) when acting as the accountable TSA representative for program requirements, configuration, or acceptance decisions. While the OEM, System Integrator, donor, or airport may prepare the TRN information, the PMO must make the official submission to formally authorize the acceptance testing, confirm the applicable TSA-approved plan/procedures, and verify the configuration baseline.

Decision Authority:

• Approves OEM-developed acceptance test plans and procedures as program or contract deliverables mapped to the TSA-approved VRTM.

• Makes risk acceptance decisions for deviations from approved requirements, procedures, or configuration baselines.

• Decides whether to use statistical sampling approaches for acceptance testing, if applicable.

mailto:ATR@tsa.dhs.gov

• Uses TSA-approved Third-Party Acceptance Testing organization results, T&E Division review comments, and stakeholder input to inform acceptance or deployment decisions.

5.2 Deployment and Sustainment Division (DSD) / Capability Acceptance Management Branch

(CAMB)

Responsibilities:

• Manages the CAP for donated TSE.

• Coordinates donor compliance with current CAP Terms and Conditions.

• Coordinates with the donor, PMO, T&E Division, DSD stakeholders, and TSA-approved Third-

Party Acceptance Testing organization.

• Reviews and submits the official TRN to the TSA-approved Third-Party Acceptance Testing organization (copying the ATR@tsa.dhs.gov mailbox and other required stakeholders) when acting as the accountable TSA representative for CAP donation acceptance coordination.

While the OEM, System Integrator, donor, or airport may prepare the TRN information, CAMB must make the official submission to formally authorize the acceptance testing, confirm the applicable TSA-approved plan/procedures, and verify the configuration baseline.

• Receives, logs, and tracks acceptance testing results for donation activities.

• Provides operational performance feedback to T&E Division for Third-Party Acceptance Testing organization performance assessments, including performance concerns or recommended corrective action.

• Does not approve TSA-approved Third-Party Acceptance Testing organizations.

• Uses the TSA-approved Third-Party Acceptance Testing organization provided independent acceptance testing results, T&E Division review and comments of these results when requested and provided, and stakeholder input to make final donation acceptance or go-live decisions.

5.3 Deployment and Sustainment Division (DSD) / Regional Deployment Coordinator (RDC)

Responsibilities:

• Coordinates regional deployment activities and local stakeholder readiness.

• Reviews and submits the official TRN under the approved TSA process to the TSA-approved

Third-Party Acceptance Testing organization (copying the ATR@tsa.dhs.gov mailbox and other required stakeholders) when acting as the accountable TSA representative for deployment or commercial-move activities. While the OEM, System Integrator, donor, or airport may prepare the TRN information, the RDC must make the official submission to formally authorize the acceptance testing, confirm the applicable TSA-approved plan/procedures, and verify the configuration baseline.

• Supports project specific TSA decision authority’s go-live and deployment decisions for assigned projects, as applicable.

• Coordinates with the T&E Division, CAMB, PMO, local TSA, airport authorities, OEMs, and

TSA-approved Third-Party Acceptance Testing organizations.

• Provides performance feedback to the T&E Division on Third-Party Acceptance Testing organization execution, communication, and reporting.

5.4 DSD Integrated Logistics Support (ILS) Configuration Management (CM)

Responsibilities:

• Maintains the approved TSE configuration baseline on behalf of the Portfolio/PMO.

• Maintains or supports the CIL and other configuration control artifacts.

• Coordinates configuration changes through the appropriate Configuration Control Board.

• Coordinates with the OEM, Portfolio/PMO, T&E Division, and other stakeholders to ensure acceptance testing uses the correct configuration baseline.

• Provides configuration verification expectation guidance for FAT&E, FAT, SAT, ORT, and NTT, as applicable per Configuration Audit Procedure for ILS, Version C, dated July 30, 2013;

Memorandum: Organizational Alignment of Configuration Management (CM) Roles, dated

October 11, 2018; and Configuration Management Plan (CMP), Version E, dated August 31, 2018.

5.5 DSD Government Property / Accountable Property Officer (APO)

Responsibilities:

• Performs TSA property accountability actions for TSE accepted into TSA inventory, as applicable.

• Enters TSE into Government Property Management (GPM) and TSA’s property management system of record, Sunflower Assets (Sunflower), after receipt of required property documentation.

• Uses signed TSA Form 251, Vendor Shipping and Receiving Report, or Department of Defense

Requisition and Invoice/Shipping Document DD-1149, as applicable, to support entry of TSE into

TSA property records.

• Coordinates with CAMB, RDCs, PMO/Portfolio, DSD ILS CM, donors, OEMs, System

Integrators, and local TSA, as needed, to obtain information required for accurate asset accountability.

• Supports reconciliation of property documentation, configuration information, serial numbers, asset identifiers, location data, and other required property record information.

• Coordinates with appropriate TSA financial management and property stakeholders, as applicable, when donated, bailed, or non-TSA-funded TSE activities affect asset accountability, capitalization, or financial reporting.

• Determines whether required property documentation is sufficient to enter TSE into GPM and

Sunflower under applicable TSA property management procedures.

• Does not make acceptance testing, go-live, deployment, operational use, or third-party acceptance testing organization approval decisions.

5.6 Donor, Sponsor, Airport Authority, Airline, or Commercial Entity

Responsibilities:

• Funds the services of a TSA-approved Third-Party Acceptance Testing organization when TSA does not fund the acceptance testing.

• Selects and contracts with a TSA-approved Third-Party Acceptance Testing organization. Status as a TSA-approved Third-Party Acceptance Testing organization applies at the organization level only and does not guarantee eligibility for every project.

• Must ensure the selected organization is independent of the OEM, OEM-affiliated organizations, system integrators, installers, and system integrator- or installer-affiliated organizations. The donor must not select any organization to perform acceptance testing on work that the organization, its affiliate, or its personnel installed, integrated, commissioned, repaired, corrected, or otherwise materially supported, even if the organization uses separate personnel, business units, or internal firewalls.

• TSA may require additional acceptance testing, targeted acceptance testing, or retesting by a different TSA-approved Third-Party Acceptance Testing organization before donation acceptance, go-live, deployment, operational use, or risk acceptance if:

o Acceptance testing was incomplete;

o The TSA-approved Third-Party Acceptance Testing organization did not perform acceptance testing in accordance with TSA PMO-approved acceptance test plans and procedures;

o Acceptance testing identified unresolved security effectiveness or safety deficiencies; or o Acceptance testing involved an actual, potential, or apparent conflict of interest affecting independence.

• Ensures the TSA-approved Third-Party Acceptance Testing organization follows OEM-developed

TSA PMO-approved plans and procedures, T&E Division provided templates, and CAMB’s terms and conditions.

• Coordinates project schedule, site access, local support, and acceptance test article logistics.

• Complies with current CAP Terms and Conditions, when applicable.

• Provides feedback to CAMB, DSD, PMO, and the T&E Division on Third-Party Acceptance

Testing organization performance.

• Funds additional acceptance testing, targeted acceptance testing, retesting by a different TSA-approved Third-Party Acceptance Testing organization, or other acceptance testing that TSA requires to resolve actual, potential, or apparent independence concerns, unless TSA determines otherwise in writing.

5.7 TSA-Approved Third-Party Acceptance Testing Organization

Responsibilities:

• Executes independent acceptance testing in accordance with TSA PMO-approved plans and procedures.

• Maintains project-specific independence from the OEM, system integrator, installer, and any affiliated entities. It must not perform acceptance testing on work that the organization, its affiliate, or its personnel installed, integrated, commissioned, repaired, corrected, or otherwise materially supported, regardless of separate personnel, business units, or internal firewalls.

• Accurately and completely follows TSA PMO-approved acceptance test plans and procedures.

• Accurately and completely fills out T&E Division-provided Acceptance Test Report templates, data sheets, reporting formats, and other required test artifacts.

• Verifies the TSE configuration against the approved CIL or other configuration baseline as the

TSA-approved acceptance test plan and procedures require.

• Provides required daily updates, TSNs, Acceptance Test Reports (i.e., QLRs), data sheets, and supporting evidence.

• Maintains SSI, proprietary, and acceptance test data safeguards.

• Maintains auditable records.

• Cooperates with TSA review, observation, and performance assessment.

• Reports issues, deficiencies, incomplete acceptance testing, deviations, and safety/security concerns promptly.

• Complies with current TSA-approved Third-Party Acceptance Testing policy and procedures.

• Does not make final TSA acceptance, deployment, go-live, operational use, or risk acceptance decisions.

5.8 OEM, System Integrator, Installer, and Local TSA

OEMs, system integrators, installers, and local TSA may support third-party acceptance testing by:

• Providing installation and readiness support;

• Providing TSE operation assistance;

• Providing technical information that TSA requests;

• Supporting corrective actions;

• Providing access to TSE logs, configuration information, and TSE Field Data Report System

(FDRS) or other reporting or log data; and

• Supporting site coordination.

The OEM, System Integrator, installer, or any affiliated organization may provide installation, readiness, technical, corrective action, and site support services, but must not perform independent third-party acceptance testing for the same TSE project.

5.9 Test and Evaluation (T&E) Division

Responsibilities:

• Establishes and maintains approval criteria for organizations seeking TSA-approved Third-Party

Acceptance Testing status and manages the Third-Party Acceptance Testing organization application process.

• Provides recommendations to the T&E Division Executive Director for Third-Party Acceptance

Testing organization approval, reapproval, corrective action, suspension, or removal.

• Reviews and concurs with OEM-developed acceptance test plans and procedures.

• Reviews TSNs, Acceptance Test Reports (e.g., QLRs), data sheets, or supporting artifacts developed by TSA-approved Third-Party Acceptance Testing organizations.

• Maintains acceptance test report templates and acceptance test articles.

• Provides TSA PMO-approved acceptance test plans and procedures, templates, and acceptance test articles to TSA-approved Third-Party Acceptance Testing organizations upon request through the acceptance test planning process (e.g., ATR@tsa.dhs.gov mailbox).

• Performs periodic assessments of TSA-approved Third-Party Acceptance Testing organizations in coordination with DSD/CAMB and other TSA stakeholders.

• Does not provide day-to-day contract administration for donor, airport, or commercial contracts with TSA-approved Third-Party Acceptance Testing organizations.

• Does not make final go-live, acceptance, deployment, or operational use decisions.

• Reviews conflict-of-interest disclosures and recommends appropriate action to the T&E Division

Executive Director or other designated TSA decision authority, as applicable.

6. THIRD-PARTY ACCEPTANCE TESTING ORGANIZATION APPROVAL LIFECYCLE

The T&E Division manages approval of TSA-approved Third-Party Acceptance Testing organizations through a structured lifecycle process with the following target timelines:

1. Application: The applicant submits a complete application package to the T&E Division via the

ATR mailbox (ATR@tsa.dhs.gov). The T&E Division acknowledges receipt and performs an initial completeness check within 5 business days.

2. Technical Review: The T&E Division conducts a technical evaluation of the complete application package (typically within 10 business days of confirming a complete submission, or upon receipt of any requested supplemental information).

3. Approval Decision: The T&E Division prepares a technical recommendation, and the T&E

Division Executive Director issues a written approval, conditional approval, or denial decision

(typically within 5 business days of the technical recommendation, for a total target review time of 20 business days from receipt of a complete package). Approved status is valid for up to two

(2) years.

4. Event-Specific Coordination: For each project, the accountable TSA representative submits the official TRN (at least five [5] business days prior to standard TSE acceptance testing or 15 business days prior to FAT&E and NTT), and the Third-Party Acceptance Testing organization provides at least 72 hours advance notice prior to onsite testing.

5. Performance Monitoring: The T&E Division continuously monitors organizational performance across acceptance test events and conducts periodic performance assessments (see Appendix B).

6. Reapproval: Approval is valid for up to two (2) years. Organizations seeking reapproval must submit a renewal package at least 60 calendar days prior to the expiration of their current approval term.

7. Corrective Action, Suspension, or Removal: Initiated immediately when warranted by performance deficiencies, non-compliance, or compromises to project-specific independence.

When requested, organizations must submit a corrective action plan within 10 business days unless TSA specifies a different timeframe.

The T&E Division Executive Director is the approval authority for initial approval, reapproval, suspension, or removal from the TSA-approved list. The T&E Division prepares technical recommendations for the T&E Division Executive Director. See Appendix A for the detailed approval process and Appendix B for performance assessments.

7. TESTING EXECUTION AND REPORTING

7.1 Acceptance Test Readiness

Before a TSA-approved Third-Party Acceptance Testing organization conducts acceptance testing, the following readiness requirements must be met:

• The accountable TSA representative (i.e., the PMO, DSD RDC, or DSD/CAMB, depending on the project type) must review and submit the official TRN to the TSA-approved Third-Party

Acceptance Testing organization, copying the ATR@tsa.dhs.gov mailbox and required stakeholders. While the OEM, System Integrator, donor, or airport may prepare the TRN information, the accountable TSA representative must make the official submission.

• By submitting the TRN, the accountable TSA office confirms and must include:

o The specific TSA PMO-approved plan and procedures to use;

o The applicable software version, algorithm version, and configurable settings;

o The applicable CIL or other TSA PMO-approved configuration baseline (e.g., software, detection algorithm, and applicable configurable settings impacting security effectiveness); and o Any TSA PMO-approved deviations.

• The OEM must complete its own post-installation readiness review or commissioning before requesting independent Third-Party Acceptance Testing. TSA designed the independent acceptance testing to confirm readiness and shall not serve as the OEM’s initial troubleshooting event.

• The TSA-approved Third-Party Acceptance Testing organization has attained the required acceptance test articles.

• The TSA-approved Third-Party Acceptance Testing organization must work with CAMB, Local

TSA, OEM, and other stakeholders and attain the required site access, escorts, badging, storage, and safety support.

• The TSA-approved Third-Party Acceptance Testing organization has provided the required 72-hour advance notice to TSA.

7.2 Acceptance Test Execution

The TSA-approved Third-Party Acceptance Testing organization must:

• Execute acceptance testing in accordance with the TSA PMO-approved plan and procedures.

• Use the required TSA-approved acceptance test articles, tools, procedures, data sheets, and templates.

• Document configuration, serial numbers, software, firmware, detection algorithm, and other required TSE information per TSA PMO-approved CIL.

• Document deviations, limitations, deficiencies, and concerns.

• Stop or pause acceptance testing when the TSA PMO-approved plan requires (e.g., security effectiveness limitation) or when safety/security concerns arise.

• Notify CAMB, PMO, DSD, T&E Division, or other designated stakeholders of issues according to the approved process.

7.3 Reporting

Unless TSA directs otherwise, the TSA-approved Third-Party Acceptance Testing organization must provide the following:

• Acceptance testing schedule;

• Daily updates for multi-day events;

• TSN within two (2) hours after completion of the acceptance test;

• Acceptance Test Report (e.g., Quick Look Report) within 48 hours after completion of the acceptance test, unless TSA agreed to another timeframe (e.g., to accommodate weekends or holidays);

• Acceptance Test data sheets;

• Aborted acceptance test report, when applicable;

• Corrective action documentation, when applicable; and

• Supporting evidence.

Unless otherwise directed, reports should identify:

• Acceptance test event;

• Site;

• TSE model and serial number;

• Configuration baseline;

• Acceptance test plan and procedures performed;

• Overall acceptance test status;

• Safety findings;

• Security effectiveness findings;

• Configuration findings;

• Efficiency and functional findings;

• Deficiencies, discrepancies, concerns, and notes;

• Any deviations from the TSA PMO-approved plan and procedures;

• Supporting evidence - T&E Division highly encourages photographs. TSA may require photographs when necessary or useful to properly verify deficiencies, configuration conditions, inspection results, safety concerns, or other findings; and

• Recommended follow-up actions.

7.4 Result Status Language

Acceptance test results must align with the T&E Division Acceptance Testing Overall Result Status

Guidance.

The TSA-approved Third-Party Acceptance Testing organization’s results support, but do not replace, the

TSA decision authority’s acceptance or go-live decision.

The T&E Division may review the TSA-approved Third-Party Acceptance Testing organization’s reports and provide comments such as:

• TSE does not present safety or security effectiveness concerns;

• TSE does not present safety or security effectiveness concerns, with deficiencies identified;

• TSE presents safety or security effectiveness concerns; or

• Incomplete acceptance test.

The TSA decision authority (e.g., PMO or DSD) determines the final acceptance, deployment, go-live, or operational use decision.

8. TERMS AND CONDITIONS APPLICABILITY

DSD/CAMB owns and maintains the current Capability Acceptance Process Terms and Conditions for each donation project.

Donors and non-TSA sponsors must comply with current Capability Acceptance Process Terms and

Conditions.

The donor or sponsor must ensure that its contracts or agreements with TSA-approved Third-Party

Acceptance Testing organizations, at a minimum, require compliance with the following Terms and

Conditions:

• Use of TSA-approved Third-Party Acceptance Testing organizations;

• Project-specific independence from the OEM, System Integrator, installer, and any affiliated entities, including the prohibition against testing work that the organization, its affiliate, or its personnel installed, integrated, commissioned, repaired, corrected, or materially supported (even with separate business units or internal firewalls);

• Compliance with TSA PMO-approved acceptance test plans and procedures;

• Use of TSA-approved acceptance test articles and templates;

• Responsibility for acceptance test article shipping, care, custody, and damage requirements;

• TSA inspection or observation rights;

• TSA reporting requirements, which includes reporting to DSD CAMB, PMO, DSD RDC, and

T&E Division as directed;

• Proper SSI handling and safeguarding requirements;

• Data protection, record retention, storage, and transmission requirements;

• Corrective action requirements; and

• Any additional terms that DSD CAMB, DSD RDC, PMO, or T&E Division require.

DSD CAMB maintains the applicable Terms and Conditions for each donation project.

A-1

APPENDIX A: TSA-APPROVED THIRD-PARTY ACCEPTANCE TESTING ORGANIZATION

APPROVAL PROCESS

A.1 Purpose

This appendix describes the process for approving TSA-approved Third-Party Acceptance Testing organizations.

A.2 Application Submission

A prospective TSA-approved Third-Party Acceptance Testing organization must submit an application package to the T&E Division.

The package must include evidence that the organization can meet the approval criteria in this appendix.

A.3 Review and Decision

1. Completeness Review (Target: Five [5] Business Days): The T&E Division reviews the application package for administrative completeness within five (5) business days of receipt at

ATR@tsa.dhs.gov.

2. Requests for Additional Information: The T&E Division may request clarifying or supplemental information from the applicant. If the T&E Division requests additional information, the technical review timeline pauses until the applicant submits a complete response.

If the applicant does not provide the requested information within five (5) business days, the T&E

Division may close the application without approval.

3. Technical Evaluation and Recommendation (Target: 10 Business Days): Upon confirming a complete application package, the T&E Division evaluates the applicant against the criteria in

Section A.4 and prepares a formal recommendation for approval, conditional approval, or denial within 10 business days.

4. Final Decision and Notification (Target: Five [5] Business Days): The T&E Division

Executive Director makes the final decision, and the T&E Division notifies the applicant in writing within five (5) business days of the recommendation (resulting in an overall target timeframe of 20 business days from receipt of a complete application package, unless TSA requires additional review time).

A.4 Approval Criteria Checklist

Requirement Evidence Required Adjudication Comment /

Recommendation

Independence from OEM, System Integrator, installer, and affiliated entities (including not acceptance testing work installed, integrated, commissioned, repaired, corrected, or materially supported by the organization or its affiliates, regardless of internal firewalls) to mitigate any conflict-of-interest limitations.

Conflict-of-interest disclosure or statement of independence

[ ] Meets

[ ] Does not meet

Maintains independence of judgment and integrity Conflict-of-interest disclosure

[ ] Meets

Safeguards SSI under 49 C.F.R. Part 1520 and TSA policy

SSI procedures, training records

[ ] Meets

A-2

Comment /

Recommendation

Flows SSI requirements to subcontractors, joint ventures, and teaming partners.

Contract clauses or written process

[ ] Meets

Maintains positive suitability determinations for personnel requiring access

Suitability documentation

[ ] Meets

Maintains ISO 9001:2015 or ISO/IEC 17025 quality management system, or TSA-accepted equivalent

Certification or equivalent evidence

[ ] Meets

Demonstrates relevant experience verifying configuration baselines, hardware/software revisions, and configurable settings

Procedures and sample records

[ ] Meets

Demonstrates relevant acceptance testing experience Past performance and resumes

[ ] Meets

Demonstrates qualified key personnel Acceptance Test lead, deputy, SME resumes

[ ] Meets

Maintains data authentication process Data review procedures

[ ] Meets

Maintains secure data storage and access controls IT/security process

[ ] Meets

Executes NDAs with TSA where required NDA records

[ ] Meets

Demonstrates experience working with OEM and TSA to tailor TSA core acceptance test plans to site-specific acceptance test events or provides an overview of proposed tailoring process.

Sample acceptance test plan or process evidence.

[ ] Meets

Demonstrates ability to work with OEM and submit event-specific acceptance test plan at least seven (7) business days before acceptance test

Process evidence

[ ] Meets

Demonstrates ability to execute acceptance testing according to TSA PMO-approved plan Process evidence

[ ] Meets

Demonstrates ability to work with Donor to provide at least 72 hours advance notice and allow TSA observation of acceptance test

Process evidence

[ ] Meets

Inspects acceptance test articles before acceptance testing

Acceptance test article inspection process

[ ] Meets

A-3

Comment /

Recommendation

Allows TSA inspection of acceptance testing process and approval criteria

Written acknowledgment

[ ] Meets

A.5 Approval Duration and Renewal

Initial approval and reapproval are valid for up to two (2) years unless suspended, revoked, or shortened by TSA. To prevent a lapse in approved status, a TSA-approved Third-Party Acceptance Testing organization must submit its reapproval package to ATR@tsa.dhs.gov at least 60 calendar days before its current two-year approval period expires. Approval remains contingent on satisfactory performance and continued compliance with this policy.

B-1

APPENDIX B: TSA-APPROVED THIRD-PARTY ACCEPTANCE TESTING ORGANIZATION

PERFORMANCE ASSESSMENT APPROACH

B.1 Purpose

This appendix establishes how TSA monitors and assesses TSA-approved Third-Party Acceptance Testing organization performance.

B.2 Performance Categories

TSA assesses performance in five (5) categories:

1. Technical Quality;

2. Schedule Timeliness;

3. Reporting Quality;

4. Compliance;

5. Responsiveness.

B.3 Data Sources

Assessments may use:

• TSNs;

• QLRs;

• Acceptance Test Reports;

• Data sheets;

• TSA PMO-approved Acceptance Test Plans and procedures;

• Report revisions and rework;

• Procedural compliance observations;

• Timeliness records;

• CAP documentation;

• Stakeholder feedback;

• T&E Division technical reviews;

• Corrective action records; and

• Prior performance assessments.

TSA should not use one data source as the sole basis for approval, reapproval, suspension, or removal.

B.4 Rating Scale

Rating Definition

5 Exceptional Exceeds expectations and demonstrates proactive improvement

4 Exceeds Expectations Meets all expectations and exceeds some

3 Meets Expectations Meets most expectations with only minor issues

2 Needs Improvement Several expectations not met or moderate issues observed

1 Unsatisfactory Major expectations not met or significant issues observed

B.5 Reapproval Thresholds

Recommendation:

• Average rating of 3.0 or higher across all categories supports reapproval.

B-2

• More than one rating of 1 or 2, or an average below 3.0, should trigger corrective action, at-risk status, suspension, or non-renewal consideration.

• Any serious safety, security, integrity, data handling, or independence issues may trigger immediate review regardless of score.

B.6 Corrective Action

The T&E Division may recommend that the organization submit a corrective action plan when performance issues arise.

A corrective action plan should include:

• Issue description;

• Root cause;

• Corrective action;

• Responsible person;

• Due date;

• Evidence of completion; and

• Prevention measures.

B.7 Suspension or Removal

The T&E Division Executive Director may suspend or remove approval when the organization:

• Fails to follow TSA PMO-approved acceptance test plan and procedures;

• Fails to safeguard SSI or acceptance test data;

• Loses independence;

• Produces unreliable or incomplete acceptance test results;

• Misses reporting deadlines repeatedly;

• Fails to correct identified issues; or

• No longer meets approval criteria.

B.8 Appeal or Reconsideration

Recommendation: A suspended or removed organization may submit a written reconsideration request within 30 calendar days of notification. The request should include corrective actions and supporting evidence. The T&E Division Executive Director makes the final reconsideration decision.

C-1

APPENDIX C: ACCEPTANCE TESTING CATEGORIES FOR DONATED, BAILED, AND

NON-TSA-FUNDED TSE

The October 2023 memorandum supersedes the October 2021 acceptance testing category table. This appendix clarifies the applicable acceptance tester and responsible funder for donated, bailed, and non-

TSA-funded TSE acceptance testing. The following table is the controlling baseline for this policy.

Category Definition Applicable acceptance tester

Responsible funder

Notes

Donated TSE

TSE donated to TSA under CAP or another approved donation pathway

TSA-approved

Third-Party

Acceptance

Testing organization unless TSA directs otherwise

Donor

Donor-funded acceptance testing must use a TSA-approved Third-

Party Acceptance

Testing organization.

Bailed TSE

TSE bailed to TSA under an approved bailment or temporary transfer arrangement where a non-TSA sponsor funds the TSE, use, or acceptance testing.

TSA-approved

Third-Party

Acceptance

Testing organization unless TSA directs otherwise

Vendor, donor, bailment sponsor, or TSA if TSA requirements drive the acceptance testing

The applicable agreement or decision record must document the funding source and acceptance tester.

Non-TSA-funded commercial activity involving TSA-owned TSE

Commercially driven lane changes, moves, upgrades, relocations, or integrations affecting

TSA-owned TSE

TSA-approved

Third-Party

Acceptance

Testing organization unless TSA directs otherwise

Commercial entity or non-TSA sponsor

Applies when non-

TSA activity causes the need for acceptance testing.

TSA activity involving TSA-owned TSE

TSA-funded acquisition, deployment, upgrade, relocation, or other TSA-directed activity

T&E Division TSA

Outside the main scope of this policy except for lineage and comparison.

D-1

APPENDIX D: SOURCE DOCUMENT LINEAGE AND DISPOSITION CROSSWALK

Source document Date Disposition

Superseded / controlling relationship

Notes

T&E Division Support to

Third-Party Acceptance

Testing for Donated

Systems, Version 1.2

September

Folded into body and appendices

Superseded by this consolidated policy once signed

Base document updated for terminology and scope.

Memorandum for

Record: Acceptance

Testing of TSE

October

Folded into body and Appendix D

Supersedes 2021 acceptance testing category table

Controlling category/funder/tester baseline.

Policy Direction for

Acceptance Testing of

TSE

October

Historical lineage and partial content folded into body

Superseded by

October 2023 table

Retained for origin of category framework.

Third Party Acceptance

Test Agent Approval

Process

October

Folded into

Appendix A

Updated by this consolidated policy Terminology updated.

Policy Direction for

Third Party Acceptance

Testing of TSE Under the

Capability Acceptance

October

Folded into body, Appendix A, Appendix C

Updated by this consolidated policy

Approval criteria and process requirements retained.

TSA Acquisition Manual

Appendix C: Capability

Acceptance Process

August

External reference

Remains governing

CAP process Do not reproduce.

TSA Test and Evaluation

Guidebook, Revision 7 External reference

Remains governing

T&E Guidebook Do not reproduce.

TSA Third Party Testing

Framework, Version 2.0 April 2026

External reference / lineage

Separate framework for third-party test data in qualification

Not the governing acceptance testing policy.

Third-Party Acceptance

Testing Organization

Performance Assessment

Approach

Folded into

Appendix B

Updated by this policy once signed

Used for lifecycle monitoring.

T&E Division

Acceptance Testing

Overall Result Status

Guidance

External reference

Governs result/status reporting

Do not reproduce in full.

E-1

APPENDIX E: RETIRED AND UPDATED TERMINOLOGY

Retired / legacy term Replacement Notes

Third Party

[Acceptance] Tester

(TPT)

TSA-approved Third-Party

Acceptance Testing organization Use updated terms except in historical titles.

Third Party

[Acceptance] Tester

(TPT) Agent

TSA-approved Third-Party

Acceptance Testing organization Use updated term.

Acceptance Testing

(AT) Third Party Tester

TSA-approved Third-Party

Acceptance Testing organization Use updated term.

Third Party

[Acceptance] Testing for Donated Systems

Third-Party Acceptance Testing of

Donated TSE Clarifies scope and terminology.

Acceptance Testing

(AT)

acceptance testing Do not use “AT” as acronym in new policy.

Network Acceptance

Testing (NAT)

Network Throughput Acceptance

Testing (NTT), if applicable

Retire unless a specific legacy document requires historical reference.

ISAT for donated TSE Out of scope

ISAT applies to the T&E Division performed CBIS integrated site acceptance testing (ISAT), not donated TSE third-party acceptance testing.

APM/T&E Division

(TED)

T&E Division

Update to current organizational nomenclature.

Capability Acceptance

Management Division

(CAMD)

Deployment and Sustainment

Division (DSD) Capability

Acceptance Management Branch

(CAMB)

Use Capability Acceptance Management

Branch unless legacy quote requires otherwise.

TSA Independent Third-Party Acceptance Testing Policy version 2.0 F-1

APPENDIX F: RESPONSIBLE, ACCOUNTABLE, CONSULTED, AND INFORMED (RACI) CHART

RACI key:

• R = Responsible: Performs or coordinates the work

• A = Accountable: Final authority or decision owner

• C = Consulted: Provides input/review

• I = Informed: Kept aware of status/results

RACI Chart: TSA-Approved Third-Party Acceptance Testing of Donated, Bailed, and Non-TSA-Funded TSE

Activity / Decision Area

T&E

Division

Executive

Director

T&E

Division

PMO /

Portfolio

DSD /

CAMB

DSD /

RDC

DSD ILS

CM

Donor /

Sponsor /

Airport /

Airline /

Comm.

Entity

TSA-

Approved

Third-

Party

Accept.

Testing

Org.

OEM /

System

Integrator

Local TSA

Establish and maintain TSA third-party acceptance testing policy

A R C C C C I I I I

Submit third-party acceptance testing organization application package

I C I I I I I R I I

Review third-party acceptance testing organization application package

A R C C I C I C I I

Request additional information from applicant A R C C I C I C I I

TSA Independent Third-Party Acceptance Testing Policy version 2.0 F-2

Division

Executive

Director

T&E

Division

PMO /

Portfolio

DSD /

CAMB

DSD /

RDC

DSD ILS

CM

Donor /

Sponsor /

Airport /

Airline /

Comm.

Entity

TSA-

Approved

Third-

Party

Accept.

Testing

Org.

OEM /

System

Integrator

Local TSA

Prepare technical recommendations for approval, conditional approval, denial, suspension, or removal

A R C C C C I C I I

Make initial approval, reapproval, suspension, or removal decision

A R C C I C I I I I

Notify applicants in writing of approval decision A R I I I I I I I I

Maintain TSA-approved third-party acceptance testing organization list

A R C C I I I I I I

Manage Capability Acceptance

Process for donated TSE I C C A/R C C C I C C

Maintain current CAP Terms and Conditions by donation project

I C C A/R C C I I I I

Ensure donor/sponsor compliance with CAP Terms and Conditions

I C C A/R C C R C C C

Select and contract with TSA-approved third-party acceptance testing organization

I I C C I I A/R C I I

TSA Independent Third-Party Acceptance Testing Policy version 2.0 F-3

Division

Executive

Director

T&E

Division

PMO /

Portfolio

DSD /

CAMB

DSD /

RDC

DSD ILS

CM

Donor /

Sponsor /

Airport /

Airline /

Comm.

Entity

TSA-

Approved

Third-

Party

Accept.

Testing

Org.

OEM /

System

I…