TAA vs NIAP PP 4.0 Secure KVM: What Federal Buyers Must Spec Before FY-End

#TLDR

A TAA compliant KVM is a country-of-origin claim. NIAP PP 4.0 is a Common Criteria isolation evaluation. DISA APL is a DoD network interoperability listing. CAC is a reader and channel-filter feature. Dual-head is a video topology. None of these five gates substitutes for another.

Write the statement of work as five independent shall-statements. Require a live NIAP Product Compliant List (PCL) VID and firmware string, a country-of-origin letter that matches GSA Advantage, and (when the host is on DoDIN) an APL check on aplits.disa.mil. Do not accept "secure," "TEMPEST-style," or "NIAP-ready" as proof.

The federal fiscal year ends 30 September (31 U.S.C. § 1102). Lead times for NIAP-listed SKUs, TAA cables, and CAC readers stretch in August and September. Lock the matrix before the last award week, not during it.

Contents

• Five gates that get collapsed in RFQs
• What TAA actually certifies
• What NIAP PP 4.0 actually certifies
• TAA vs NIAP vs DISA APL vs CAC vs dual-head
• Language to paste into the SOW
• Evidence pack the vendor must deliver
• FY-end timeline (award by 30 September)
• Common protest and ATO failure modes
• FAQ
• Next step

Five gates that get collapsed in RFQs

Most late-year RFQs write one line: "NIAP 4.0 / TAA / CAC KVM." That line fails source selection because it mixes five independent requirements.

1. TAA (FAR / GSA). The end product is U.S.-made or substantially transformed in a designated country. Source: FAR 25.403 and GSA Vendor Support Center, TAA Compliance.
2. NIAP PP 4.0 (PSD PP v4.0). A Common Criteria laboratory evaluated the specific model and firmware against the Protection Profile for Peripheral Sharing Device Version 4.0. The listing lives on the NIAP PCL.
3. DISA APL (DoDIN). The product appears on the Department of Defense Information Network Approved Products List when the installation sits on DoDIN. Search DISA APLITS.
4. CAC / PIV. The switch implements a dedicated smart-card path that satisfies HSPD-12 and FIPS 201-3 card use without bridging HID traffic across isolated computers.
5. Dual-head (or more). Two or more independent video channels per computer, with EDID handling that still meets the PP. This is topology, not a certification.

Browse live secure KVM switches and rackmount KVM switches after the five gates are written, not before. A TAA compliant KVM can be a commercial HDMI switch with no isolation claims. A NIAP-listed switch can fail a GSA Schedule buy if the country of origin is not a designated country. An APL listing does not prove PP 4.0. A CAC port does not prove TAA. Dual-head does not prove any of the above.

CNSS Policy 11 (CNSSP-11) is why NIAP shows up on national security systems: commercial IA and IA-enabled products used on NSS generally require NIAP validation. NSA states that CNSSP-11 requires commercial products used in NSS to be NIAP validated (NSA CNSA 2.0 FAQ). Civilian GSA buys still need TAA even when the system is not NSS.

What TAA actually certifies

The Trade Agreements Act of 1979 (19 U.S.C. §§ 2501 et seq.) and FAR 25.403 restrict covered acquisitions to U.S.-made or designated-country end products, unless no sufficient offers exist.

GSA applies TAA to Schedule contracts unless the solicitation says otherwise. Eligible articles are:

• wholly the growth, product, or manufacture of the United States or a designated country; or
• substantially transformed in the United States or a designated country into a new and different article of commerce (GSA VSC).

TAA does not evaluate:

• unidirectional video paths or USB device filtering
• anti-tamper or always-on chassis sensors
• firmware integrity or Common Criteria assurance
• CAC isolation
• DoDIN interoperability

Country of origin can change when a factory moves. GSA tells Schedule holders to re-check origin over the life of the contract and update Advantage when it changes. For FY-end awards, require a dated manufacturer letter that names the exact SKU, the country of origin, and the substantial-transformation basis. Match that letter to the GSA Advantage record. Do not accept a catalog badge alone.

TAA-compliant cables and accessories are a separate line item. Belkin and other OEMs sell TAA cable kits as complements to NIAP chassis (Belkin Secure KVM). Spec the cable set. A TAA chassis with non-TAA HDMI leads still fails a Schedule audit. Commercial HDMI desks that do not need isolation belong on an HDMI KVM switch, a USB KVM switch, or a KVM drawer, not on a PP 4.0 CLIN. Dual-head EDID and USB issues on commercial desks are covered in DisplayPort vs HDMI KVM for dual-head racks.

What NIAP PP 4.0 actually certifies

NIAP short name PP_PSD_V4.0. Transition date 18 January 2020. Predecessor PP_PSS_V3.0. Tech type: Peripheral Switch. Official record: NIAP PP_PSD_V4.0.

The PP covers a Peripheral Sharing Device that connects a shared set of peripherals to one or more computers so that data cannot flow between computers by way of the peripherals or the PSD. In-scope examples: KVM switches, KM switches, and isolators. A compliant multi-computer PSD must show a visible indication of the selected computer and a mechanism to change that selection.

PP 4.0 is a baseline. Optional SFRs (audio filtering, always-on anti-tamper, extenders) appear only if the Security Target claims them. Belkin documents optional analog audio (eighth-order filter against ultrasonic signaling) and always-on anti-tamper on some Universal 2nd Gen units. If the ISSO needs those controls, name them in the SOW. "PP 4.0" alone does not pull every optional SFR.

Validation is model + firmware. The PP page lists assigned VIDs (ATEN, IOGEAR, Belkin, Black Box, Eaton / Tripp Lite, Vertiv Cybex, High Sec Labs, Adder, Raritan, and others). The award file must cite:

• NIAP VID
• exact marketing SKU
• firmware string on the PCL
• CAC or non-CAC family (NIAP lists them as separate VIDs)

"Compliant with PSD PP v4.0" on a reseller page is not a VID. Pull the PCL the week of award. Archived or predecessor PP 3.x listings do not satisfy a PP 4.0 shall-statement.

PP 4.0 also does not certify TAA, Buy American, Section 889, or APL.

TAA vs NIAP vs DISA APL vs CAC vs dual-head

Use this table in the technical evaluation plan. Score each column. A bid that wins four of five still fails if the fifth is a hard shall.

When you need all five

Typical desk: SIPR and NIPR (or two unclassified enclaves) on one operator, GSA Schedule vehicle, DoDIN drop, CAC logon, two 4K heads. Background on SIPR/NIPR switching is in secure KVM switches for government (NIAP, CAC, SIPR/NIPR).

• TAA: Schedule / FAR coverage
• NIAP PP 4.0: isolation between enclaves (CNSSP-11 if NSS)
• APL: DoDIN connection
• CAC: HSPD-12 workstation policy
• Dual-head: two-monitor SOP

Drop APL only when the hosts are off DoDIN. Drop CAC only when the ATO does not require smart-card logon at that seat. Do not drop TAA on a covered Schedule buy. Do not drop PP 4.0 when the KVM sits between different security domains.

When TAA alone is enough

Unclassified lab, single security domain, commercial KVM, GSA cart. Isolation is not the threat. Write TAA and the video/USB feature set. Do not pay the NIAP premium. Size the port count with the KVM port-count sizing guide, then shop a USB KVM switch, an HDMI KVM switch, or a KVM drawer.

When NIAP alone is not enough

A classified or multi-domain desk bought off Schedule still needs TAA. A DoDIN desk still needs APL. Treat NIAP as the isolation gate only. Remote-admin seats that are not isolation desks belong on an IP KVM switch, not on the PP 4.0 CLIN. The decision framework is in KVM over IP in 2026.

Language to paste into the SOW

Replace bracketed text. Keep each shall independent.

TAA. The KVM switch, all included power supplies, and all furnished video, USB, and CAC cables shall be Trade Agreements Act compliant end products as defined in FAR 25.403 and clause 52.225-5. The Contractor shall deliver a manufacturer country-of-origin letter for each SKU, dated within 90 days of delivery, naming the country of substantial transformation. Origin on GSA Advantage shall match the letter.

NIAP PP 4.0. The KVM shall be listed on the NIAP Product Compliant List as conformant to Protection Profile for Peripheral Sharing Device Version 4.0 (PP_PSD_V4.0). The proposal shall cite the NIAP VID, exact model number, and firmware version. Delivered firmware shall match the PCL. Listings under PP_PSS_V3.0 or earlier do not satisfy this requirement.

DISA APL (use when DoDIN). The KVM shall appear as an approved product on the DoDIN Approved Products List at time of delivery. The Contractor shall provide the APLITS identifier and approval memo.

CAC. The KVM shall be the CAC (or equivalent PIV) family of the cited NIAP VID, with a dedicated smart-card reader path that does not share a USB data channel with non-HID peripherals across unselected computers. External USB readers on a shared hub do not satisfy this requirement.

Dual-head. Each computer port shall support two independent video outputs at [resolution / refresh, e.g. 3840×2160 at 60 Hz] without an external splitter. EDID handling shall remain within the evaluated configuration.

Optional PP SFRs (use when the ATO needs them). The Security Target shall claim [always-on active anti-tamper] and/or [filtered analog audio output].

Prohibited substitutions. Marketing terms including "secure KVM," "government KVM," "NIAP-ready," "designed to PP 4.0," or "TEMPEST" do not substitute for a PCL listing or a TAA origin letter.

Evidence pack the vendor must deliver

Require this packet with the proposal, then again at receiving:

1. Screenshot or export of the NIAP PCL row (VID, model, firmware) dated the week of proposal.
2. Security Target PDF and certification report for that VID.
3. TAA / country-of-origin letter on manufacturer letterhead.
4. GSA Advantage printout showing TAA / origin for the same SKU (if Schedule).
5. APLITS printout and memo (if DoDIN).
6. Cable and accessory SKU list with TAA origin for each line.
7. CAC reader part number that sits inside the evaluated configuration.
8. Dual-head port map and supported timings.
9. Tamper-evident packaging and serial numbers tied to the firmware string.

Reject a packet that cites a sibling SKU ("same family") without the delivered model on the PCL.

KVMSwitchTech supplies NIAP PP 4.0 and TAA-aligned secure KVM lines from Belkin, Eaton / Tripp Lite, Black Box, ATEN, IOGEAR, and Vertiv. Call (216) 798-7530 with the five-gate matrix and we will map live SKUs to VID, origin letter, and cable kits. Model-by-model comparison stays on the NIAP PP 4.0 secure KVM comparison; this page is the contracting language only. Shop secure KVM switches and KVM switch cables after the shalls are locked.

FY-end timeline (award by 30 September)

31 U.S.C. § 1102 sets the Treasury fiscal year: 1 October through 30 September. Obligation after midnight on 30 September generally uses the next year's money unless the appropriation says otherwise.

If the desk is new construction and APL testing is still open, do not write APL as a same-week shall. Write NIAP + TAA now and APL as a follow-on CLIN, or select a model already on APLITS.

Common protest and ATO failure modes

One adjective, five meanings. "TAA/NIAP KVM" in the salient characteristics invites a protest that a TAA commercial switch is equivalent. Split the shalls.

Firmware drift. The PCL lists a firmware string. A unit that ships a newer build is a different TOE. Put the string on the PO and on the packing slip check.

Cables. Evaluated configurations often require OEM or specified cables. Aftermarket high-speed HDMI leads can void the ST and fail TAA. Keep TAA cable kits on the same CLIN as the chassis; see KVM switch cables and HDMI cables.

CAC as an accessory. A USB CAC reader on the shared console side is not a CAC-family PSD. Require the CAC VID.

Splitters for dual-head. A single-head NIAP KVM plus a DisplayPort MST hub or HDMI splitter is not dual-head isolation. Spec two video channels inside the TOE. Example topology: the 2-port dual-head secure DVI-I KVM keeps both heads inside the switch.

APL assumed from NIAP. Different offices, different tests. Search APLITS.

Origin letter older than the factory move. GSA warns that manufacturers change manufacturing points. Require a 90-day letter.

PP 3.0 leftovers. Predecessor PP_PSS_V3.0 transitioned on 18 January 2020. Do not accept 3.x as 4.0.

FAQ

Does a TAA compliant KVM meet NIAP PP 4.0?

No. TAA is country of origin under the Trade Agreements Act and FAR 25.403. NIAP PP 4.0 is a Common Criteria evaluation of peripheral isolation. A product can hold one, both, or neither.

Does NIAP PP 4.0 listing make a KVM TAA compliant?

No. Check designated-country origin separately. Some NIAP-listed families are TAA; the PCL does not record TAA.

Do we need DISA APL if we already have NIAP?

If the hosts attach to DoDIN, search APLITS. NIAP does not place a product on the APL.

What CAC language belongs in the spec?

Require the CAC (PIV) family of the NIAP VID and a dedicated reader path. Cite HSPD-12 and FIPS 201-3 as the identity policy the workstation must support. Do not treat a generic USB reader as in-scope.

Is "designed to NIAP PP 4.0" acceptable for FY-end award?

No. Accept only a live PCL listing with VID, model, and firmware. Designed-to and in-evaluation are not validated.

Why does FY-end change the buy?

The fiscal year ends 30 September. Stock of listed SKUs, TAA cable kits, and CAC readers tightens. Firmware and origin letters take days to collect. Write the five gates now so award week is a checklist, not a rewrite.

Where do we compare Belkin, Eaton, and Black Box models?

Use the NIAP PP 4.0 secure KVM comparison (CAC, dual-head HDMI, TAA) for ports, video, and CAC SKUs. Use this article for SOW language and evidence. Rack-console seats that share a drawer rather than a desktop PSD sit with rackmount KVM switches.

Next step

Build the five-column matrix for the seat count, enclaves, video heads, and contract vehicle. Call KVMSwitchTech at (216) 798-7530. We will return VID, TAA origin, CAC family, dual-head SKU, and cable kit options that match the shalls above. Start from secure KVM switches, rackmount KVM switches, or the PP 4.0 model comparison. Ask for the evidence pack with the quote so receiving on 30 September is a document check, not a surprise.