Comprehensive IT Governance Document for Acquisition V2.1

Transportation Security Administration (TSA)
Comprehensive Cybersecurity, Information Assurance,
Privacy Requirements and Specifications for OutcomeBased Production Solutions and Vendor/Private Partnership Solutions as well as Sandbox and/or Demonstrations
Mandatory Federal Acquisition Package for Enterprise IT, Cloud, and Emerging SI Technologies — Incorporating Outcome-Based 'Try-Before-You-Buy' Sandbox Operational Demonstrations Document Type:

Section C (PWS/SOO), Section H, Section L (Instructions), Section M, and Attachment J

Acquisition Strategy:

Outcome-Based Phased Down-Select via 100% Vendor-Funded Sandbox Demonstration

Statutory Baselines:

FISMA 2014, NIST SP 800.37 Rev 2, NIST SP 800-53 Rev. 5.2,

NIST SP 800-160 Vol. 1 Rev 1, NIST SP 800-160 Vol. 2 Rev 1, NIST

AI 100-1 (AI RMF 1.0), NIST AI 100-2 (Adversarial ML), NIST SP 800-53 B, NIST SP 800-82 Rev. 3, FIPS 199, FedRAMP, DHS CDM, CISA Zero Trust Architecture, DISA STIGs/SRGs, Prohibited End-ofLife and End-of-Support Technologies, DHS Deprecated Protocols, TSA Approved Operating Systems, OMB A-130, OMB M-26-14,

OMB M-22-09, OMB M-22-18, OMB M-25-21, OMB M24-18, EO

14028, EO 2023, EO 2025

Applicable Technology:

Enterprise IT, Cloud Platforms (FedRAMP), Custom Software, SI/ML, Autonomous Agents

Issuing Authority:

Office of the Chief Information Officer (OCIO) / Information Assurance Division

1.0 PURPOSE, SCOPE, AND OUTCOME-BASED ACQUISITION

STRATEGY

The purpose of these Cybersecurity and privacy requirements is to document the mandatory Transportation Security Administration’s (TSA) minimum TSA Enterprise Cybersecurity super intelligence (SI), data governance, secure software and development security operations (DEVSECOPS) and risk management based Cyber requirements for Fiscal Year (FY) 2027. Meeting the minimum does not guarantee immediate Approval to Operate (ATO), but not meeting the minimum Cybersecurity requirements shows the system “as is” is not ready for an ATO and will be required to undergo additional system hardening and security control configurations. The overarching objective is to safeguard federal information systems, assets, data/information, sensitive operational workflows, (secure)/personally identifiable information (sPII & -PII), Sensitive Security Information (SSI), as well as For Official Use Only (FOUO and Controlled Unclassified Information (CUI) data and national security-adjacent data assets against compromise to include unauthorized access, exfiltration, data manipulation or deletion,