J063--Upgrade Physical Access Control System:
Statement of Work Upgrade of Facility Physical Access Control System (PACS) The Department of Veterans Affairs, Veterans Benefits Administration (VBA), St. Paul Regional Office, 1 Federal Drive, St. P... Statement of Work Upgrade of Facility Physical Access Control System (PACS) The Department of Veterans Affairs, Veterans Benefits Administration (VBA), St. Paul Regional Office, 1 Federal Drive, St. Paul, Minnesota 55111, has a requirement for a contractor to provide and install a stand-alone Physical Access Control System (PACS) on a closed network utilizing two (2) managed switches. The contractor will provide all labor equipment, materials, software, documentation, and other items and services that are required to replace the PACS at the St. Paul Regional Office. The contractor will acquire, schedule, manage, and supervise all resources to perform these tasks and will coordinate all activities with the Contracting Officer and their designated VA point of contact, and Contracting Officer s Representative (COR) for this project. In addition to providing and installing a PACS, the contractor will provide five years of full warranty coverage which includes all software licensing, on said PACS System. Introduction Background Homeland Security Presidential Directive 12 (HSPD-12) requires federal agencies to issue secure and reliable identification to all employees and contractors. Federal Information Processing Standards (FIPS) Publication 201-1 Personal Identify Verification (PIV) of Federal Employees and Contractors, issued by the National Institute of Standards and Technology (NIST), establishes the technical specifications for the smart cards that respond to this requirement. HSPD-12 requires Federal agencies to provide a common identity (ID) credential system for all federal employees and contractors. PIV badges are electronically verifiable and protected by digital certificates, biometric data, and a Personal Identification Number (PIN) code. These credentials are issued, tracked, and revoked from a central management system and require applicant background checks. On February 3, 2011, the Office of Management and Budget (OMB) released Memorandum 11-11, Continued Identification of HSPD 12 that requires all federal agency systems be enabled to use PIV credentials in accordance with NIST guidelines. OMB directs agencies to use PIV badges in daily operations and integrate centrally managed PIV badge systems with PACS. PACS readers must at a minimum, extract unique token identifier information from the PIV badge and by FY 2022, existing federal physical and logical access control systems must be upgraded to use PIV credentials. In accordance with VA Directive 0730 (12 December 2012) the St. Paul Veterans Administration Regional Office (VARO) is responsible for protecting the lives and property within VA s jurisdiction which includes the safety and security of its employees and visitors as well as the security and access to the facility, equipment, supplies, and personal service records within the St. Paul VARO. St. Paul VARO therefore has a requirement for a PACS. The PACS will encompass an electronic employee identification system that will assign identity, monitor, and grant or restrict access to all offices and parking throughout the VARO facility by use of a PIV badge that will open approved exterior, interior, elevator, and stairwell doors. Objective The objective of this Statement of Work is to specify the tasks the contractor is required to accomplish to replace/upgrade the PACS at the St. Paul VARO to bring the St. Paul VARO into compliance with the aforementioned guidelines and regulations. The contractor will identify the equipment, software, camera software, and data deliverables that are required to deliver and install a CCure 9000 PACS or equivalent PACS if parts are unavailable for CCure 9000. Currently the St. Paul VARO s PACS s ethernet devices are physically connected to the VA network and logically separated by a virtual local area network (VLAN). This has enabled circumvention of secure baseline configurations and has made the current PACS devices susceptible to vulnerability attacks. Having the PACS on the VLAN network does not meet VA security requirements and hampers necessary mitigations of security risks to the St. Paul VARO Network. The contractor will alleviate this issue by ensuring the CCure 9000 PACS or equivalent PACS provided and installed by the contractor is implemented and configured on its own closed network utilizing two (2) managed switches and head units. The contractor will ensure the new PACS is a standalone system. The contractor will acquire two (2) separate switches and head units for installation into the Ground floor and 3rd floor Intermediate Distribution Frame (IDF) closets. The closet network switches are to be interconnected via Small Form-Factor Pluggable (SFP) (mini-GBIC) transceiver modules GigE fiber optic connectors to connect the switches between the closets. All existing cabling pulled and new RS485 Data Cabling installed to panels; PACS and card readers with two twisted pair data cabling. All systems installed will be FICAM Compliant. Applicable Documents The following NIST documents apply to this Statement of Work: FIPS 201-1 Personal Identity Verification (PIV) of Federal Employees & Contractors SP 800-73 Interfaces for Personal Identity Verification SP 800-116 A Recommendation for the Use of PIV Credentials in PACS VA Physical Access Control Systems (PACS) Requirements VA Master Construction Specifications 01 00 00 General Requirements 28 13 00 Physical Access Control Systems (PACS) 28 05 00 Common Work Results for Electronic Safety and Security 28 05 13 Commissioning of Electronic Safety and Security 28 13 00 Physical Access Control System (PACS) 28 13 16 Physical Access Control System and Database Management VHA Directive 2011-036, Safety and Health During Construction Note: Contractor will ensure all work complies with VA departmental construction standards as well as applicable manufacturer's installation anduser manuals. Contractor Personnel & Management Non-Personal Services The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances will the Government assign tasks to or prepare work schedules for individual contractor employees. It will be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it will be the contractor's responsibility to notify the Contracting Officer(CO) immediately. Business Relations The contractor will successfully integrate and coordinate all activity needed to execute the requirement. The contractor will manage the timeliness, completeness, and quality of problem identification. The contractor will provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors. The contractor will seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel. Contractor will ensure daily communication with the COR. Contract Administration and Management The following subsections specify requirements for contract, management, and personnel administration. Subcontract Management The contractor will be responsible for any subcontract management necessary to integrate work performed on this requirement and will be responsible and accountable for subcontractor performance on this requirement. The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Contracting Officer (CO) or Contracting Officer Representative (COR). The Prime General Contractor, whom this contract is awarded to is responsible for coordinating all training and badging requirements of the subcontractor to include subcontractor employees. Location and Hours of Work This requirement exists at the St. Paul VA Regional Office, 1 Federal Drive, St. Paul, MN 55111. Normal workdays for the contractor will be Monday through Friday, except US Federal Holidays, from 8:00 am until 4:30 pm, central standard time. Contractor Extended Warranty Extended Warranty for five (5) full years from the date the PACS is installed and fully operational. Extended Warranty will be provided by installation contractor. Extended Warranty Coverage Includes: Service Labor: 24/7, 7 days/week, 365/year coverage All Material PACS Software upgrades and license renewal Technical Service Desk Support M-F CST Eight (8) hour service responses Electronic security system spare parts inventory The contractor will maintain a spare parts inventory sufficient for specified maintenance and repair requirements to keep the system continuously operational. Badging and Identification Homeland Security Presidential Directive (HSPD) -12 directs all federal agencies and departments to issue identity credentials to provide government workers, contractors, and affiliates with a credential that provides the attributes of security, authentication, trust, and privacy and can be used to verify identities in order to enter federal buildings or gain access to federal computer networks. All contractor employees, to include their direct employees and subcontractor employees, entering the St. Paul VARO are required to have an individual non-PIV badge prior to beginning work inside the VARO. Therefore, it is essential the contractor complete section I of VA Form 0711 for all contractor/subcontractor employees who will be working inside the building and provide the completed form to the COR within five (5) days of being awarded the contract. Once the COR receives the VA Form 0711 it will take approximately two (2) working days before a non-PIV card can be prepared. The contractor will be notified by the COR when each employee is to report to room G831, Support Services Division (SSD) for photographs and issuance of a non-PIV badge. The employee must bring two (2) forms of identification when they report to room G831. The contractor is responsible for the cost of fingerprinting and background investigations (if required). The contractor will include the time necessary to process non-PIV badges in their scheduling. Safety The contractor will comply with all applicable Federal, State, and local legal requirements regarding worker health and safety. The requirements include those found in Federal and State Occupational Safety and Health Act (OSHA) statutes and regulations, such as applicable provisions of Title 29, Code of Federal Regulations (CFR) Parts 1910 and 1926. Contractor is solely responsible for determining the legal requirements that apply to activities and will ensure safe andhealthful working conditions for its employees. Contractor will comply with all applicable codes, laws, rules, regulations, and safety requirements and will erect safety barriers, signs, flagging, and devices as appropriate to warn and protect workers, the public and the existing site and other property. The contractor will remove all demolished materials, debris, waste, and scraps. The waste materials will be disposed of in accordance with all applicable environmental guidelines andstandards. No construction materials to include packaging materials will be left on site. Government Furnished Materials The government will provide no cost parking and access to the VARO loading docks as necessary. 3.0 Current Setup The current PACS consists of the following components/peripherals which the contractor will ensure are included in the new PACS: 96 contactless door readers and applicable door hardware to include 21 IT Com Closet door readers as part of the 96 door readers 16 control panels with applicable hardware Statement of Work Installation Plan The contractor will prepare, present, and maintain a detailed installation plan within 21 days of award. The purpose of this plan is to ensure that all facets of the equipment installation are identified, addressed, and coordinated before and during installation. Coordination with Smart Card Distribution VA is producing and distributing FIPS 201-1 smart cards concurrent with the PACS replacement. VA employees and contractors may need to retain legacy access control cards that are compatible with the existing PACS until this PACS replacement is completed. The contractor will coordinate migration from legacy cards to the new FIPS 201-1 smart cards with facility representatives. Transition Approach This plan will specifically identify the approach for transitioning from the installed system to the replacement system in a manner that minimizes disruption to VA facilities and maintains security. The plan will identify how cardholder, configuration, and history event data will be migrated to the new system and how new data or modifications to data are accurately reflected in both the existing PACS and the replacement PACS with minimal redundant data entry. Access control point transition will be addressed by the installation of multi-technology card readers whenever possible. Additionally, the contractor will propose an approach for managing the collection of legacy access control cards once the modified/replaced system has been completely installed. Security The installation plan will include provisions for minimizing disruption to VA s facilities during the installation activities. It will specifically include provisions for maintaining an acceptable level of security during this project. The installation plan will specifically describe how the installation of new hardware and/or software will be performed such that security is maintained at the existing level without requiring additional security operations personnel. Support from Other Organizations The installation plan will identify and describe all support required from the VA, VA contractors, or other organizations not under the direct control of the contractor. The installation schedule will include specific milestones that identify where inputs from external organizations or VA are required and will identify the tasks that will be adversely affected by delays in such support. Facility Access Before or After Normal Working Hours The installation plan will specify any tasks that require access to VA facilities outside normal working hours. Tasks that interfere with, or disrupt, VA operations will be scheduled before or after normal working hours. Work outside normal working hours will be approved by and coordinated with VA at least two weeks in advance and is subject to VA approval. Project Schedule The installation plan will include a detailed schedule of installation activities. This schedule will identify all task dependencies and will highlight those tasks that must be performed by organizations other than the contractor. The schedule willbe prepared in Microsoft Project. The schedule will initially be submitted with the contractor s quote and will be updated on a biweekly, or more frequent, basis until the project is completed. The schedule start date will be the VA estimated date of contract award. Equipment/System Needs The Contractor will include the current listed in Section 3.0 Current Setup, and will provide up to: Two (2) PACS Head units, one (1) for G831 and one (1) for Office 3900 21 PIN Pad Contactless Readers for IT Com Closets as part of the 96 total contactless readers Site Validation The contractor will conduct a site viability validation to confirm the actual numbers and types of readers (contactless, contactless plus keypad, etc.), Server, Server Software and System Boards called for in the System Detail Document as well as the reader mounts (mullion, gang box, outdoor, etc.) and their locations. One (1) business day is allotted for site validation assessments at facilities with a total reader population of 110 or less and two (2) business days for facilities with more than 110 readers. The site validation assessment will also cover the working rules, site access, equipment staging, special access area requirements, and other facility specific conditions under which the removal and replacement of readers, server, server software and system boards will be performed. A planned date for commencement of necessary PACS system components change outs will also be established with the facility during the visit. The contractor will provide a written report of the results of the site validation to include: Listing of readers, server, server software and system boards by location, type, and form factor. Date of site validation and planned date for start of work. Details of additional readers, server, server software and system boards and/or systems discovered by location, type, and form factor; and Initial schedule for execution readers, server, server software and system boards change out work. Reports will be submitted electronically to the Contracting Officer, with copies to the facility point of contact (POC) and Contracting Officer s Representative(COR) and will be included in the Post Change Out Report. System Preparation The contractor will assist the facility in configuring the appropriate settings in the PACS for the VA PIV card V8. The contractor will, to every extent feasible work in cooperation with any third-party contractor the facility may have providing maintenance and support services for the system. The facility will be responsible for entering cardholder and PIV data into the PACS. Commencement of Work If the reader count is within 20% of the total provided in the system detail document, the contractor will proceed with change out on the date agreed to with the facility unless otherwise directed by the COR. Any direction to delay the start of change out will be given by the COR no less than 5 working days prior to the planned start date. In cases where reader counts exceed the 20% threshold, work will not commence until directed by the COR. The first reader replaced will be used as a check point to verify System Preparation has been performed successfully and the PIV card profile entered into the PACS back end operates correctly at the access control point. Proper configuration will be confirmed prior to continuing with reader change out. All readers, server, server software and system boards, devices, wiring, and components removed by the contractor will be delivered to the VARO or disposed of as directed by the COR. Post Installation Testing Readers, server, server software, and system boards will be tested for proper operation in accordance with manufacturer s procedures in all modes required for their specific locations to verify installation. Post installation testing at access control points where reader to controller operation failed prior to change out will be the responsibility of the facility. Post Change Out Report Contractor will prepare and submit a report that details readers, server, server software and system boards removed and replaced, test results for each reader,server, server software and system boards, and configuration changes made in the PACS for the VA PIV card. The report will include systems and their associated readers, server, server software and system boards that are not on the facility detail document discovered during site validation which were remediated at the option of the COR. All system preparation, change out, and post installation test procedures and requirements will apply. Readers exceeding the 20% limit of the detail document quantity may be changed out at the option of the COR. All change out and post installation test procedures and requirements detailed will apply. Note: Cost on a per reader basis; exercised on a system basis by the COR. Quick Issue Response During the 30 days immediately following the installation, testing, and acceptance of PIV-compliant card readers, server, server software, system boards and any operational issues directly or consequentially arising from such installation will be remediated by the contractor as follows: (1) issue identification, (2) diagnostic procedures, (3) resolution recommendation, (4) COR approval, (5) issue correction, and (6)acceptance by facility. Document Installed PACS and Related Systems The contractor will: Identify all existing PACS components (readers, server, server software and system boards) to ensure the system replacement activity adequately addresses all access control equipment that requires replacement to meet HSPD-12 and FICAM requirements. Identify equipment, systems, and software connected to the existing PACS to ensure that related equipment such as intrusion detection, video, visitor management, and other systems are also replaced. Ensure that external interfaces to IDS, Life Safety, Fire Alarms, and other systems remain operational during and after the installation Identify existing primary and redundant power, communications, and other infrastructures that may be affected by the PACS replacement. Identify the equipment, power supplies, enclosures, cabling, and miscellaneous components the contractor proposes to retain and re-use for the new system and report same to COR for review and approval prior to beginning work; and Identify the equipment, cabling, and miscellaneous components the contractor will remove for disposal once the replaced system is installed, accepted, and operational. The contractor will inspect the St. Paul VARO and document the currently installed access control system to the extent necessary to achieve these objectives and as specified in the following paragraphs. The contractor will produce block diagrams that identify each of these components and their typical interconnections and document each component (type, manufacturer, and revision level, location, condition) in a tabular form that is readily tracked to the block diagrams. The intent of this documentation is not to provide detailed engineering drawings but rather to ensure all components have been identified to a level adequate to ensure they are appropriately addressed during the replacement/upgrade project. The contractor will deliver a completed copy of this list to the COR within 30 days of award. Missing or Inoperative Door Equipment The contractor will specifically identify hardware of this (or similar) type that is missing, inoperative, or installed in violation of local life/safety and/or building codes, and its location. The contractor will replace such missing or inoperative equipment with new equipment that is equivalent in form, fit, and function to other similar equipment in the facility; compatible with the replacement or upgraded PACS; and meets all local building codes, electrical codes, and life/safety requirements. Related Equipment Interfaces The contractor will identify systems, if any, with which the installed access control system is connected. Such systems might include closed circuit television systems, visitor management systems, fire alarm systems, or intrusion detection systems. The contractor will identify the manufacturer and model number of each system and identify the specific interfaces with the existing access control system. The contractor will determine the specific approach for maintaining the functionality and performance of each of these interfaces during and after the installation of the replacement PACS. Data Communications Infrastructure The contractor will identify the existing data communications inter-connections between major equipment components. Major equipment components include servers, workstations, field panels or distributed controllers, door controllers, programmable logic controllers or interconnect points, card readers, and any other components that will be affected by the system replacement. Types of connections include, but are not limited to, twisted pair Ethernet, fiber optic Ethernet, coax Ethernet; RS-232, RS-422 and RS-485 serial, Weigand, and clock/data serial. The contractor will identify whether these connections are routed through dedicated or shared conduits, are (or should be) plenum rated, and other pertinent installation information. Where conduit is missing or inadequate, new raceways will be installed in accordance with Master Construction Specification 28 05 28. Power and Support VA envisions the re-use of existing PACS power and battery infrastructure as well as associated PACS and power equipment enclosures. The contractor will identify the source, capacity, distribution, and condition of primary and back-up power to each of the existing system components as well as all PACS enclosures, security containers, and associated hardware and report their findings to the COR within 30 days of award. Design Proposal for System Replacement The contractor will prepare and submit within 30 days of award a detailed design for system replacement. This design will include provisions for coordinating the installation of the PACS in a manner that minimizes disruption of facility operation while maintaining an acceptable level of security. 4.19 Acceptance Testing and Turnover The contractor will demonstrate the installed system functions in accordance with VA requirements by performing the acceptance procedures specified in Master Construction Specification 28 08 00 Commissioning of Electronic Safety and Security. The contractor is responsible for tailoring test procedures as required for the specific installation. The contractor will identify all software and equipment warranties and provide all warranty documentation to VA. Approved Products The contractor will use equipment and software selected from the approved products listed in Appendix A. Readers, server, server software and system boards are to be on the GSA Approved Products List, as applicable to the specific PACS manufacturer. VA may recommend or direct a specific product from Appendix A to fulfill PACS Enterprise roadmap requirements beyond the direct scope of the project. The contractor will be responsible for ensuring the upgraded/replacement system selected from the Approved Products Listing in Appendix A, is designed, and configured in such a manner to meet manufacturer specifications and FIPS 201- 1 requirements, and is acquired, installed, and configured to meet, at a minimum, the requirements identified in the VA Physical Access Control Requirements document and VA Master Construction Specifications Division 28 Electronic Safety and Security. VA will review and approve the contractor s proposed design and the installation plan prior to the contractor procuring and installing any equipment or software. VA approval addresses the scope of the project installation (i.e., the number and location of devices) and, where appropriate, the use of equipment and components not subject to the Approved Products List. VA approval will not be interpreted as an endorsement that the contractor s proposed design meets functional or performance requirements; this is the sole responsibility of the contractor. The contractor will procure all equipment, components, software, licenses, and materials and will provide all tools, supplies, and consumables required to install the proposed system replacement in accordance with the requirements of the following paragraphs. Inspections and Acceptance The contractor will perform incoming inspections and tests as required to ensure the equipment and software are complete, functional, and in compliance with manufacturer specifications prior to beginning installation. This will include all parts and components that are required to replace existing inoperative or missing equipment as identified in the proposed design. The contractor will perform all actions necessary to correct or replace defective components and materials prior to installation. Storage Storage space on site is limited or non-existent. Therefore, the contractor will acquire/maintain all required storage for equipment and materials prior to and during installation. Records The contractor will initiate and maintain records of the equipment and software components, manufacturer warranties, licenses, documentation, inspections, and corrective actions. The contractor will provide these records to VA when the upgraded/replacement system is accepted. Contractor Testing The contractor will test all installed equipment and software in accordance with manufacturer recommendations and standard contractor installation practices. The contractor will certify to VA they have performed these inspections and tests and that all installed equipment and software perform in accordance with manufacturer specifications and are installed in accordance with the approved system design. This certification will include, at a minimum, inspection documents, discrepancy reports, and follow up action reports. Removal of Equipment and Materials The contractor will demolish and remove all obsolete, disconnected, or replaced equipment, cabling, and miscellaneous components and materials and deliver it to the Government or dispose of it as directed by the VA COR. No cable runs are to be abandoned or dead-ended unless specifically agreed-to by the COR. In all such instances, both ends of such cables will be clearly marked as dead ended and annotated with the location of the opposite end. 6.0 Functionality & Performance Functionality - The upgraded/replacement system will support all functions provided by the existing access control system except where specifically approved by VA. The contractor will specifically identify any features supported by the currently installed systems that will not be adequately addressed by the proposed design and will identify alternatives for addressing those features. Examples of such functions might include automatic data transfer to data warehouses, automatic transfer of employee data and photographs to other systems, or external interfaces with visitor pre- registration and management systems. The intent of this requirement is to ensure the St. Paul VARO maintains the operational functionality provided by their existing PACS upon completion of the PACS replacement, upgrade, or modification work performed under this Statement of Work. Performance - The upgraded/replacement system will provide performance that is, at a minimum, equivalent to the existing system or that is specified in the VA Physical Access Control Requirements document and VA Master Construction Specifications Division 28 Electronic Safety and Security, tailored to the St. Paul VARO, whichever is greater. Performance specifications include (i) number of cardholders supported, (ii) number of secured areas supported, (iii) number of readers supported, (iv) card holder throughput rate, (v) amount of history data retained, (vi) length of battery operation, and (vii) reliability, operational availability, and maintainability characteristics, (viii) data interchange rates and responsiveness with external systems including the Identity Management System (IDMS) and/or PIV Issuance System. 6.1 Data Conversion The contractor will import cardholder data as required to populate the access control system cardholder database. The primary source of credential data are cardholder PIV cards. Additional data may be available from VA s IDMS and/or PIV Systems. The contractor will extract other cardholder and equipment configuration data, such as demographics, access rights, and door schedules, from the existing access control system. 7.0 Quality This section describes the Quality Control components for this effort. The following sub- sections provide details of various considerations on this effort. 7.1 COR Quality Assurance Plan The Government will monitor the contractor s performance under this project in accordance with the COR s Quality Assurance Plan. 7.0 Deliverables Training & Deadlines The contractor will provide deliverables as described below. Deliverables will be specified by the g...
Links ()
Attachments ()
Data sourced from SAM.gov.
View Official Posting »