The Transportation Security Administration (TSA) soon expects to issue a solicitation to kick-off a re-competition for a contractor-owned and operated service that enrolls and vets people for various trusted participant programs.

The Request for Proposal (RFP) for the new Universal Enrollment Services (UES) program is expected to be released in late October or early November with bids due in late December and an award made in the spring or summer of 2018, TSA officials said on Monday during an Industry Day to review high level requirements and the rough schedule.UES, universal enrollment

The contract will be for up to 10 years, including a three-year base period, giving the winning bidder an opportunity to recover some of the cost of the upfront investments they will make in their enrollment centers and time to bring new innovations to bear as TSA’s mission evolves over time, Gloria Uria, a contracting officer for the agency, told attendees.

The UES program is part of a larger strategic effort to standardize the policies, processes, technology and infrastructure for conducting security threat assessments, according to one of her slides.

The current contract was awarded in 2012 to MorphoTrust. MorphoTrust was part of France’s Safran Group, which earlier this year sold its Morpho identity solutions and security business units to the private equity firm Advent International. Advent International in turn combined the Morpho businesses with Oberthur Technologies, which provides solutions in embedded digital technology. Last week Oberthur and Morpho renamed their company IDEMIA.

As it is with IDEMIA currently, whoever wins the new UES contract will make their money by collecting fees from applicants seeking to enroll, or re-enroll, in one or more of the current programs that TSA manages for trusted populations. The key programs are PreCheck trusted traveler program, the Transportation Worker Identification Credential (TWIC), the Hazardous Materials Endorsement Threat Assessment, and the Alien Flight Student Program.

IDEMIA collects fees for itself and the TSA, which in turn reimburses the FBI for background checks against that agency’s databases. To enroll in PreCheck, which has more than 5 million members, travelers pay $85 and voluntarily submit personal information, including fingerprints, to initiate the background checks. If accepted into the program, a person maintains PreCheck status for five years unless a disqualifying offense is committed in that period.

PreCheck doesn’t include issuance of a smart credential but the TWIC program does.

The company operates more than 350 UES enrollment centers nationwide.

Once a contract is awarded, TSA expects the winner to be up and running with their UES enrollment centers and connected to the agency’s information technology systems within nine months.

Paul Morris, TSA’s chief information security officer, said that bidders can propose either a cloud-based solution or an on-premise data center. Cloud solutions must use federally-approved cloud service provider, he said.

Some of the high-level IT security requirements include multi-factor authentication for any mobile device management solutions, visibility of the application by TSA’s Security Operations Center, and use of tools provided under the Department of Homeland Security Continuous Diagnostics and Mitigation cyber security program, Morris said.

At the UES centers, individuals applying for the various trusted participant programs typically provide biographic and biometric data, documents to prove their identities and citizenship, and payment for the enrollment and background check services.