Bidding Airport Security Systems at O’Hare and Midway: A Guide for Security Integrators and Subs
Chicago’s two big airports run on a security backbone: access control, ID badging, dispatch and video, all tied together as one system. The firm that keeps it running is picked through a City procurement, and teams of integrators, certified small firms and specialty subs form around it. This page explains what the system is, who buys it, how a prime or a sub gets in, which rules shape a bid, and what you still must confirm in the bid documents. Facts are as of October 15, 2026, with a source for each.
I’m The Auditor. I check every claim. Anything I could confirm from an official page has a source number. Anything I could not confirm is tagged verify with the bid documents. The biggest one: I found no open solicitation for this work today. Read those tags before you plan around a date.
The big picture
Big Picture: The City of Chicago Department of Aviation (CDA) runs a set of linked systems called the Integrated Safety, Security and Operations Command and Control Systems, abbreviated ISSOCCS, at O’Hare and Midway.[1][2] The City buys technical support and maintenance for it, plus some consulting and planning and design for upgrades, through a competitive procurement run by the Department of Procurement Services (DPS).[1][5] The current support contract has been extended year by year and now runs through June 29, 2027.[4] The last competitive solicitation, in 2020, was cancelled.[6]
In plain words: Think of ISSOCCS as the airports’ nervous system for doors, badges, cameras and dispatch. One contractor keeps it healthy and helps it grow. Integrators, certified small firms and specialty subs join that contractor’s team. This page shows how that team gets built and what the rules are.
Verify with the bid documents: whether and when the City will re-solicit the ISSOCCS support work. No title, specification number or date is published. Watch the sources in the key dates section below.[8][9][11]
1What the system is
The 2020 City solicitation describes four integrated applications plus a supporting network.[5] It is a living system: it is maintained around the clock and it grows as airport needs, federal rules and technology change.[5]
Access control host
- Doors and gates
- Portals
- Readers
- Alarms
The central system that decides who may open which airport door, gate or portal, and logs it. Readers, door locks, alarms and controllers all report to it.[5]
ID badging
- Badge issuance
- Enrollment
- Compliance reports
- Badge printers
Issues and manages airport ID badges for the people who work at the airports. The City’s own solicitation says these functions are largely mandated and regulated by TSA and FAA.[5]
Computer-aided dispatch
- Incident dispatch
- Responder coordination
- Records
Dispatch software used to send responders to incidents at the airports.[5]
Video management
- Cameras
- Recording
- Viewing
- Video displays
Manages the airport video surveillance and access cameras, their recording and viewing.[5]
Security network and peripherals
Verify with the bid documents: the exact software platforms, versions, device counts and any documents marked as sensitive. This page lists categories only. A new solicitation may describe a different scope than 2020.
2Scope: what the contract buys
This is the scope of the 2020 solicitation, the most recent one with a published description. Treat it as a guide to what a future one may look like, not as a promise.
Included in the 2020 scope
- Installation, maintenance, repair and technical support of the system[1]
- Spare parts management[1]
- Low-voltage and optic-fiber connections and terminations of peripherals such as cameras, printers, monitors and door alarms[1]
- Consulting and planning and design services tied to upgrades, integration and development of new capabilities, as directed by CDA[1]
- Integrating new security technologies as they arrive. The 2020 text names retinal scans, facial recognition, palm vein scanning, biometrics, RFID and newer smart video[5]
- Keeping the system running around the clock, with on-call coverage[5]
Not included, or verify
- Electrical work other than low-voltage and fiber terminations. The City says a separate Citywide electrical contract covers it[1]
- Anything the bid documents carve out. Scope can change from one solicitation to the next (verify)
In plain words: The winner is a long-term support partner, not a one-time installer. That is why teaming, staffing depth and the readiness of your people matter so much. In the 2020 solicitation the City’s own system text said price would not be considered in the evaluation.[5]
3Who buys it: the chain
This work is bought directly by the City, not through a construction manager. DPS is the City’s contracting authority, and CDA is the department that uses the system.[1][2]
In plain words: The City picks one prime. If you are not that prime, your route in is being on the prime’s team before the response is filed, because teams, key people and the MBE/WBE plan are part of what the City scores.
4Key dates and history
The history below is verified against City records. The one thing it cannot tell you is when the next solicitation will appear.
- Jul 6, 2009The City awards the first ISSOCCS technical support contract (Specification 64796, PO 19430), up to $40 million.[2]
- Jan 2, 2015A new multi-year support contract is awarded (Specification 113339, PO 30811), up to $60 million, January 1, 2015 through December 31, 2019.[3]
- Oct 18, 2016The contract is assigned to a new vendor entity under PO 46733. Later modifications extend the term year by year.[4]
- Jul 13 to Aug 12, 2020
- Feb 7, 2023In a written reply to a records request, DPS states that the ISSOCCS solicitation was cancelled and negotiations ceased. The reason and date of cancellation are not stated.[6]
- Jan 14, 2026The latest modification on the record extends the current support contract through June 29, 2027.[4]
- 2026 buying planThe CDA fourth-quarter 2026 buying plan lists no ISSOCCS support solicitation. It does list an Airport Security Consulting and Specialized Safety/Security Services contract at O’Hare and Midway: professional services, estimated $5 to $10 million, 60 months, estimated ad date second quarter 2027. That is an advisory contract, not the system support contract.[8]
- Next ISSOCCS solicitationNot announced. Verify with the bid documents and the sources below. A re-solicitation could carry a new title or specification number, or a letter suffix on an old one.
- Jun 29, 2027Current support contract term ends unless the City extends it again.[4]
Verify with the bid documents: every date for any future solicitation: advertisement, pre-bid or pre-proposal conference, question deadline, response due date and time, and goals. This page publishes none because none are posted.
5Pick your door
There is no single way in. Most integrators who do not lead use door 2 or door 3, and many use both.
Prime or joint-venture lead
You respond to the City directly. In 2020 the City evaluated qualifications inside the response and described no separate prequalification list.[1][5]
- Register in the City’s iSupplier portal before the due date. The 2020 text said to allow three business days for registration.[5][10]
- Responses were uploaded electronically in iSupplier. Paper responses were not accepted.[5]
- The City asked for key personnel, financial capacity, a joint-venture agreement where used, and an MBE/WBE compliance plan.[5]
- When responses were otherwise equal, the City said it might prefer teams that give MBE/WBE firms an equity position in the prime.[5]
Verify with the bid documents: the response format, page limits and evaluation criteria in any new solicitation. The list above is from 2020.
Subcontractor to the prime
You join a prime’s team as a specialist: video, access control, badging, networking, field low-voltage work, spare-parts logistics or application development.[1][5]
- Primes list subcontractors and their shares in the MBE/WBE plan filed with the response.[5][13]
- Be ready before the ad: a one-page capability sheet, staff résumés, references from other airports or critical sites, and your certifications.
- Ask each prime what clearances and background checks they will need for your staff (see the compliance section).
Verify with the bid documents: how any prime will treat subs, pricing and rates, and whether the solicitation limits subcontracting.
Certified teammate (MBE, WBE, DBE)
If you hold City of Chicago MBE or WBE certification in a relevant area of specialty, you are a natural teammate and sometimes a joint-venture partner.[5][14]
- The City’s directory lists certified firms, and primes search it.[15]
- Cook County also certifies MBE and WBE firms and says it has reciprocity with the City.[16]
- Credit depends on the work you perform and on whether you perform a useful function. Pass-through roles do not count.[5][13]
Verify with the bid documents: whether a Cook County or other certification is accepted, and which areas of specialty fit the scope, in the solicitation itself.
6MBE, WBE and DBE rules
Participation goals shape who gets invited onto a team. These cards cover what the City has published.
MBE and WBE participation
The City sets contract-specific MBE/WBE goals for each solicitation. The 2020 ISSOCCS solicitation set 25% MBE and 5% WBE, and it also scored the quality of the participation plan.[5] The City monitors and audits awarded contracts for the goals.[14]
Cook County’s figure is shown for context on certification only. It is not an ISSOCCS rule.[16]
Verify with the bid documents: the goals in any new solicitation. The 2020 numbers are history, not a prediction.
The paperwork, in plain words
The 2020 solicitation required an Economic Disclosure Statement (EDS) certificate, a joint-venture affidavit (Schedule B) and agreement where a joint venture responded, and an MBE/WBE compliance plan using Schedules D and C with certification letters.[5] The City posts the standard schedules on its forms page.[13]
In plain words: Get your EDS, certifications and iSupplier account in order before a solicitation is posted. Waiting until the ad date leaves too little time.
Verify with the bid documents: the current forms and the response deadline for each schedule.
Federal DBE rules, if federal money is involved
Federal DBE rules in 49 CFR Part 26 apply to airport work financed with U.S. DOT money, and DBE certification runs through the Illinois Unified Certification Program.[17][18][19] The 2020 ISSOCCS solicitation lists City funding.[5] The airport security consulting item in the buying plan is shown as non-federal.[8]
Verify with the bid documents: whether any federal funds or DBE goals apply to a new solicitation.
7Security and privacy compliance
Airport security is regulated. These are the federal and state rules most relevant to an integrator or a sub, with the official text linked. Several are written for airport operators and flow down by contract.
TSA airport security rules (49 CFR Part 1542)
TSA’s airport security rule requires airport operators to run a TSA-approved security program.[21] Several parts touch this system directly. Access control must ensure only authorized people get unescorted entry, deny entry immediately when authority is withdrawn, and tell apart people who may enter the whole secured area from those with limited access.[22] Fingerprint-based criminal history checks apply to people seeking or holding unescorted access.[23] ID media must show a full-face image, name, employer and ID number, indicate the scope of access and show an expiration date.[24]
In plain words: Anything in the system that touches doors, badges or who may enter secured areas lives under these rules. Expect your staff to be badged, and expect the system to be built around them.
Verify with the bid documents: which rules the airport applies to your staff and to contractor access, and whether the work needs escorts or badged staff.
Sensitive security information (49 CFR Part 1520)
Information about airport security programs and measures can be protected as sensitive security information (SSI), with handling and disclosure limits.[25] Bidders and subs should expect restricted documents and written handling rules for some materials.
Verify with the bid documents: which parts of any solicitation or system documentation are restricted, and what handling or non-disclosure steps are required before you see them.
TSA cybersecurity and FAA rules
In March 2023 TSA issued an emergency cybersecurity amendment for certain airport and aircraft operators. It requires network segmentation, access controls for critical cyber systems, continuous monitoring and detection, and timely patching, under an approved implementation plan.[27] The FAA also certifies airports under 14 CFR Part 139.[26] The City’s 2020 text says ID-badging functions are regulated by TSA and FAA.[5]
Verify with the bid documents: which TSA and FAA requirements the airport will flow down to the contractor. These are obligations on airport operators, so the contract language controls.
NIST guidance (reference, not a stated requirement)
NIST publishes widely used security references: SP 800-53 Rev. 5 security and privacy controls,[28] SP 800-82 Rev. 3 for operational technology such as building and security systems,[29] and the Cybersecurity Framework.[30] For identity credentials, FIPS 201-3 sets the federal PIV standard.[31] The public ISSOCCS notices reviewed for this page name none of these as a requirement. Buyers often use them as a yardstick.
Verify with the bid documents: whether any NIST publication is a stated requirement. Say how your practices map to these frameworks anyway.
Illinois biometric privacy (BIPA)
Illinois’ Biometric Information Privacy Act covers retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry. A private entity that collects them must publish a retention and destruction policy, give written notice and get a written release, and protect the data with a reasonable standard of care. The Act’s definition of private entity leaves out State and local government agencies.[32] Section 25(e) says the Act does not apply to a contractor, subcontractor or agent of a State agency or local unit of government when working for that government.[32] Damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation, and a 2024 amendment limits repeat collections from the same person by the same method to one recovery.[32]
In plain words: Work done for the City falls within the wording of the exemption. A firm’s separate private work is a different question. If you offer biometric tools in both worlds, keep the lines clear.
Verify with the bid documents: how the exemption applies to your deployment and the data you hold. This is a summary of the statute, not legal advice. Ask a lawyer.
8What a prime is likely to ask you
This is general industry practice, not a stated requirement of any ISSOCCS solicitation. Your real list is in the bid documents.
- Background and badge readiness. Can your people pass fingerprint-based checks and hold airport ID?[23][24]
- Around-the-clock support. The 2020 scope called for continuous coverage and on-call response.[5]
- Experience with similar sites. Other airports, transit systems and government facilities help.
- Cybersecurity practices. Segmentation, patching, access control and monitoring, matched to the NIST references above.[27][28][29]
- Data handling. Biometric data needs a clear policy for retention, protection and destruction.[32]
- Certifications and insurance. MBE/WBE or DBE letters, EDS information and the insurance the City requires.[5][14]
- Key people. The City looked at key personnel and financial capacity in 2020.[5]
9Your six-step path
I’m Commons. Money moves where people show up early, so here is the order I would work in.
Register and certify
Create or update your City iSupplier account, EDS and any MBE/WBE or DBE certification now.[10][14][15]
Set up alerts
Join the City’s bid alerts and CDA bid alerts. Check the Bid Tracker for new specification numbers and letter suffixes.[7][11][12][33]
Read the buying plan
The CDA publishes a quarterly buying plan. Look for support, maintenance and security items.[8]
Choose your door
Prime, sub or certified teammate. Start talks before an ad appears, because teams form early.
10What is confirmed and what is not
Confirmed in official sources
- ISSOCCS is the Department of Aviation’s integrated safety, security and operations command and control system at O’Hare and Midway[1][2]
- The 2020 solicitation was Specification 1187058 and included installation, maintenance, repair, technical support and spare parts[1]
- 2020 dates: advertised July 13, virtual pre-proposal July 22, questions July 29, responses due August 12[1][5]
- 2020 contract-specific goals were 25% MBE and 5% WBE[5]
- DPS stated that the ISSOCCS solicitation was cancelled and negotiations ceased (Feb. 7, 2023)[6]
- The incumbent contract chain runs from 2009 to a current term ending June 29, 2027[2][3][4]
- The CDA fourth-quarter 2026 buying plan lists an airport security consulting solicitation, estimated ad second quarter 2027[8]
- iSupplier registration was required to respond in 2020[5][10]
- TSA rules for access control, criminal history checks and ID media[22][23][24]
- Illinois BIPA text, including the government-contractor exemption in Section 25(e)[32]
Verify with the bid documents
- Whether and when the City will re-solicit ISSOCCS support (nothing posted as of Oct. 15, 2026)
- The title, specification number and every date of any new solicitation
- Goals and forms for any new solicitation
- Why the 2020 solicitation was cancelled
- Scope changes, platforms and device counts in any new solicitation
- Which federal funds and DBE rules apply
- Which TSA, FAA and NIST items the contract names
- Which documents are restricted and how to get them
- How BIPA’s contractor exemption applies to your deployment (ask a lawyer)
- What the airport requires for contractor badging and escorts
11Sources
- CDA Bid Alert: RFQ for Technical Support and Maintenance of ISSOCCS at O'Hare and Midway, Specification 1187058 (advertised July 13, 2020)
- City of Chicago contract record: PO 19430, Specification 64796 (awarded July 6, 2009)
- City of Chicago contract record: PO 30811, Specification 113339 (awarded Jan. 2, 2015)
- City of Chicago contract record: PO 46733, assignment of PO 30811 and extensions through June 29, 2027
- City of Chicago Request for Qualifications, Specification 1187058, eProcurement solicitation #7433 (July 2020). The City's solicitation document; the City's eProcurement system holds the official copy
- City of Chicago Department of Procurement Services, written response to a public-records request dated Feb. 7, 2023 (states the ISSOCCS solicitation was cancelled and negotiations ceased). On file; no public link
- City of Chicago DPS Bid Tracker (search a specification number)
- Chicago Department of Aviation Buying Plan, 4th quarter 2026 (PDF) (PDF)
- City of Chicago DPS: Current Bid Opportunities
- City of Chicago DPS: iSupplier vendor portal (eProcurement)
- CDA Bid Alerts (Department of Aviation)
- City of Chicago procurement information and bid-alert sign-up
- City of Chicago DPS: standard forms and agreements (Schedules C and D, special conditions)
- City of Chicago DPS: M/W/VBE program and certification (MBE, WBE, DBE, ACDBE, BEPD, VBE)
- City of Chicago DPS: directory of certified MBE, WBE, DBE and BEPD firms
- Cook County Business Enterprise Development: MBE/WBE certification (notes reciprocity with the City of Chicago)
- IDOT: DBE certification and the Illinois Unified Certification Program
- FAA: Airport Disadvantaged Business Enterprise Program
- eCFR: 49 CFR Part 26, Participation by DBEs in DOT financial assistance programs
- CDA Small Business Resource Centers at Midway and O'Hare
- eCFR: 49 CFR Part 1542, Airport Security (TSA)
- eCFR: 49 CFR 1542.207, Access control systems
- eCFR: 49 CFR 1542.209, Fingerprint-based criminal history records checks
- eCFR: 49 CFR 1542.211, Identification systems
- eCFR: 49 CFR Part 1520, Protection of Sensitive Security Information
- eCFR: 14 CFR Part 139, Certification of airports (FAA)
- TSA press release: new cybersecurity requirements for airport and aircraft operators (Mar. 7, 2023)
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
- NIST Cybersecurity Framework
- NIST FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors
- Illinois General Assembly: Biometric Information Privacy Act, 740 ILCS 14 (official text, including Sections 10, 20 and 25)
- Chicago Department of Aviation: Bids and Contracts
This page summarizes public notices, City records and published rules as of October 15, 2026. It is not an official government publication, not legal advice and not a substitute for the bid documents. Dates, goals and requirements can change by addendum. Confirm each item with the bid documents and the linked source before you rely on it.
About
Meet Michael E. Brown
President and Managing Partner, GOTB Consulting, LLC · Chicago
Michael E. Brown has 20+ years of governmental and municipal consulting and lobbying experience. He was lead contract negotiator on the $8.5B O’Hare 21 program and the $800M O’Hare rail extension, and lead lobbyist and contract negotiator on the $400M Chicago Department of Water Management lateral redevelopment. (Dollar figures are program sizes, not GOTB fees.)
He has worked with the Illinois legislature and public officials on public-private partnership (P3) policy, and has consulted to the Cook County Commission on reducing duplicative administrative offices. He is a frequent speaker at governmental and municipal functions, focuses on good government and healthier social and economic solutions for safe, successful neighborhoods, lives in Chicago, and serves on the Board of the March of Dimes.
- M.S., Psychology (1997), University of Iowa
- B.S., Psychology (1995), University of Iowa
About
Meet Richard Butler
Partner, GOTB Consulting, LLC · Chicago
Richard (Rich) Butler is a partner at GOTB Consulting and a 38-year veteran of Chicago city government. From August 2019 to February 2020 he served as First Deputy Commissioner and Chief Administrative Officer of the Chicago Department of Aviation (CDA), responsible for day-to-day administration and operations of O’Hare and Midway, including finance, contracts, operations, legal, human resources, workforce development, concessions, real estate and vehicle services. CDA manages the two airports with a federally funded budget of $8.5 billion. (Dollar figures are budget and program sizes, not GOTB fees.)
Before that, Rich was First Deputy Procurement Officer at the City’s Department of Procurement Services and Chief Administrative Officer of the Chicago Park District, where he oversaw procurement, audit, finance, warehousing and general administrative services on an estimated annual budget of $385 million and established district-wide policies and procedures. His City career began at the Department of Aviation as Director of Contracts Administration, and he also served as General Superintendent of the Department of Streets and Sanitation.
He completed the Chicago Accounting and Purchasing System Training Program and the City of Chicago Executive Management Program, was a key team member on the design and implementation plan for the City’s new eProcurement system, and is a member of the National Institute of Governmental Purchasing and the Purchasing Management Association of Chicago. He has served on the board of the Chicago Municipal Employees Credit Union and on the US Communities board, representing the City of Chicago, and traveled to South Korea to represent Chicago in the Kotra Alliance to bridge contracting opportunities. A native of Englewood, he attended De La Salle High School.
- B.S., Northern Illinois University
Fictional characters from GOTB’s original stories. Real-world facts always link to public sources.