1145PC23Q0137 Amendment 1 Includes Attachments.pdf

Office of Acquisition and Management 1275 First Street, NE

Washington, DC 20526

Date: April 4, 2023

Subject: Request for Quote 1145PC23Q0137, Amendment 1 for Guardian Maintenance Services

The purpose of this amendment is to:

1. Provide responses to questions. See Attachment 6 - Industry Questions and Comments.

2. Provide a revised Performance Work Statement (PWS). See attachment 1 – Revised PWS (tracked changes) 4-3-23.

3. The solicitation close date/time remains unchanged at April 14, 2023, at 1:00 PM Washington, DC local time.

Maria Anguiano Contracting Officer

Number Contract Line Item

Number Contract Section Page # Industry Question/Comment Government Response

PWS

Revised

Yes (Y) or No (N)

Revised

PWS

Section

1 CLIN 0003 Attachment 1 - PWS, Section 3.1 13 Item 3.1 request the installation of a RIM. Are we to assume that the associated enclosure and power supply are inplace and operational?

Yes N

2 CLIN 0003 Attachment 1 - PWS, Section 3.1 13 Are we to assume that this is a standard office door that does not require the installation of any conduit?

Yes N

3 CLIN 0003 Attachment 1 - PWS, Section 3.2 13 Are we to assume the camera instalation is surface wall mount? No. Camera to be ceiling mounted. Y Section 3.2

4 CLIN 0003 Attachment 1 - PWS, Section 3.5 13 Will this be single sided or double sided printing? Are these generic cards, such as Vistor 001 or custom cards with indiviidual photos and details on the card?

Double sided printing. Generic cards with a number in a sequence that will be provided to the contractor prior to printing. Cards will not be uniquely personalized for specific individuals.

Y

Section 3.5

5 CLIN 0003 Attachment 1 - PWS, Section 3.7 13 Is this training with an on-site instructor, remote instructor, or student at a training facility? Remote instructor training provided by the manufacturer. Y Section 3.7

6 CLIN 0003 Attachment 1 - PWS, Section 3.8 13 Does this include at connection to the ACS for door release? Is the door release done through the intercom unit or a remote relay module?

Connection to the ACS for door release is required. Door releases upon entrance of code on desk phone.

N

7 Attachment 1 - PWS, Section 1.2 1 Is the PACS currently fully FICAM compliant? Yes N

8 Attachment 1 - PWS, Section 1.4.1 3 Are all physical servers and workstations under the Guardian system Peace Corps owned? Yes N

9 CLIN 0001 Attachment 1 - PWS, Section 2.2.4 8 What type of communication will be used between the Peace Corps Headquarters facility and the offsite data center at Ashburn, VA? Direct fiber or existing network? If network, what is the availble bandwidth and latency of the connection?

Peace Corps has a dark-fiber/DC-NET between HQ and COLO/Datacenter. 5Gbps x 2, latency 2~5 msec.

N

10 CLIN 0003 Attachment 1 - PWS, Section 3.1 13 Do we assume there are existing power supplies with sufficient available load capacity enough to power the new PACS equipment and locking hardware?

Yes N

11 CLIN 0003 Attachment 1 - PWS, Section 3.1 13 Do we assume there are enough existing device licenses to accept the new door? Yes N

12 CLIN 0003 Attachment 1 - PWS, Section 3.2 13 Do we assume there is enough existing device licenses to accept the new camera? Yes N

13 CLIN 0003 Attachment 1 - PWS, Section 3.3 13 Do we assume there is an available spare input on the IDS to accect the new alarm point or duress button?

Yes N

14 CLIN 0003 Attachment 1 - PWS, Section 3.4 13 Do we assume there is an available spare input on the EAGL system to accect the new indoor ballistic sensor?

Yes N

15 CLIN 0003 Attachment 1 - PWS, Section 3.6 13 Do we assume there is enough existing device licenses to accept the new beacon? Yes N

16 CLIN 0003 Attachment 1 - PWS, Section 3.8 13 Do we assume there is enough existing device licenses to accept the new intercom? Yes N

17 CLIN 0003 Attachment 1 - PWS, Section 3.9.2 14 Please confirm there is no requirement to replace any sensors that are determined to not function properly.

Confirmed. This is correct. N

18 CLIN 0001 Attachment 1 - PWS, Section 2.2.4 7

According to Section 2.2.4, “Guardian is required to apply and maintain an appropriately tailored set of Moderate impact baseline security controls in NIST 800-53, as determined by Peace Corps and consistent with Peace Corps specifications.” What responsibilities does the contractor have, besides hardening & documenting configurations, in maintaining the security controls?

In addition to the hardening and documentation of configurations, the contractor would have to confirm with Peace Corps regarding how to properly implement security controls.

Y

Section 2.2.4

19 CLIN 0001 Attachment 1 - PWS, Section 2.2.6 8 Will the government provide the contractor templates for the documentation submissions stated in Section 2.2 (Corrective Action Plan, Plan of Actions & Milestones, etc.)?

No. Please see clarification provided in PWS. Y Section

2.2.6 and Section 4

20 CLIN 0001 Attachment 1 - PWS, Section 2.2.6 8 How many days should the contractor allocate for participation in the annual security assessment interviews performed by the Peace Corps Security Control Assessors stated in Section 2.2.6?

2 days N

Guardian Maintenance Services

1145PC23Q0137

Attachment 6 - Industry Questions and Comments

PERFORMANCE WORK

STATEMENT (PWS)

FOR

PEACE CORPS

Guardian Maintenance Services

FOR

Office of Safety and Security

1 GENERAL

1.1 Background

The Peace Corps owns and operates a system (comprehensively referred to herein as Guardian) that supports emergency management and physical security functions at the headquarters building in Washington, D.C. This Performance Work Statement (PWS) defines the requirements of a contract to maintain Guardian.

1.2 Scope

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision and other items as necessary to perform the maintenance required to provide for the continued functionality, integration, and compliance of Guardian as defined in this PWS. Travel will not be reimbursed.

The Contractor shall maintain the entirety of the Guardian system components including but not limited to all doors and door hardware, firmware, controlling equipment, cables, connectors, intermediate devices, and software applications connected to the inputs and outputs listed in Appendix D. Peace Corps is responsible only for the items listed in Section 1.4 Peace Corps Responsibilities.

Guardian is composed of the following subordinate systems and devices.

1. Access control barriers including revolving doors, portal, turnstiles, and standard doors as well as door motorized and non-motorized door openers and closers that control access to Peace Corps spaces throughout the facility.

2. Physical Access Control System (PACS): the PACS (Lenel OnGuard, version 7.5) controls physical access and authenticates the Personal Identification Verification (PIV) / PIV-I Card in accordance with Federal Identity, Credential, and Access Management (FICAM) requirements.

3. Video Surveillance System (VSS): the VSS includes a management system (Milestone version 12.3a) that monitors and records video delivered from cameras (Axis).

Guardian Maintenance Services 1145PC23Q0137, Amendment 1

Attachment 1 - Revised PWS (Tracked Changes) 4-3-23

4. Internal Emergency Notification System (ENS): the internal ENS (Alertus, version 5.16.17) provides notifications to staff members via phones, computers, and beacons, and integrates with an external ENS that is provided under a separate contract to alert staff on work and personal communications devices.

5. All servers, user workstations, and any other computing hardware and software associated with all Guardian subordinate systems.

1.3 Definition of Terms

The term “subordinate system” is a term that applies to each of the separate systems identified in the Section 1.2.

The term “device” shall mean any installed component of any subordinate system.

The term “internal ENS” means the Alertus system that controls the emergency notification system hosted on-site at the headquarters building, activation buttons, and notification output devices such as wall-mounted beacons and the notification software and integration with Peace Corps owned desktop phones and computers.

The term “external ENS” means the web-hosted service (Everbridge) with which Peace Corps has a separate contract to provide emergency notifications to work and personnel communications devices

The term “contracting officer” (CO) means the Federal government representative with final authority to commit Federal funds, award contracts, and modify contracts.

The term “contracting officer representative” (COR) means the Federal government representative that reports to the CO and interacts on their behalf during routine communications with the Contractor. The COR does not have the authority to commit Federal funds or approve modification(s) to this PWS.

The term “facility security representative (FSR)” means the facility physical security subject matter expert appointed by the Peace Corps.

The term “days” refer to business days unless otherwise specified.

The term “normal business hours” refers to 8:00 AM to 5:00 PM Washington, DC local time, Monday through Friday, excluding Federal Government holidays. The recognized Federal Government holidays are: New Year’s Day, Dr. Martin Luther King’s Birthday, George Washington’s Birthday, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day and Christmas Day.

The term “test environment” refers to a server environment where upgrades and patches can be tested before they are deployed into a production environment to verify there are no adverse effects on the production environment.

The term “production environment” refers to a setting where software and other products are actually put into operation for their intended uses by end users.

1.4 Peace Corps Responsibilities

1.4.1 Information Technology

Physical access to Peace Corps segregated security network, including network switch ports and patching cable in local area network (LAN) closets Logical access to Peace Corps segregated security network including network access control (NAC), virtual LAN (VLAN), access control Lists (ACL), internet protocol (IP), firewall policy, internet, inter-connect from the Peace Corps network

Network provisioning requirements and policies

Guardian Maintenance Services

Routing / firewall changes Switch and VLAN configuration External domain name system (DNS) for the peacecorps.gov domain Voice over Internet Protocol (VoIP) system and connectivity Patching and upgrades to operating systems and software operating on Peace Corps owned desktop workstations and servers. Guardian related software updates will be coordinated between the Contractor and the COR.

Maintenance of Peace Corps owned physical workstations and servers, where applicable.

1.4.2 Physical Hardware

Lock cylinders and keys.

1.4.3 External ENS

A separate contract for a web-hosted service (currently Everbridge) to provide emergency notifications to work and personnel communications devices.

A service that allows the external ENS to ingest messages delivered from Guardian.

A service (Everbridge Connector for Alertus) that allows the internal ENS to ingest messages delivered from the external ENS.

1.4.4 National Institute of Standards and Technology (NIST)800-53 Compliant Information Security Information system categorization Selection of security controls Implementation of security controls.

Assessment of security controls.

Authorization to operate at an acceptable level of risk to agency operations Continuous Monitoring

1.5 OPERATING CONSTRAINTS

1.5.1 Key Personnel

All Contractor and subcontractor project personnel are subject to a background investigation in accordance with Peace Corps personnel security policy. The Contractor shall furnish all documentation required to initiate background investigation activities prior to the kick-off meeting.

The Contractor shall assign to this contract the following key personnel: Project Manager and Technical Lead.

The Contractor’s Key Personnel must possess and provide proof of the following experience and qualifications as noted below and reflected in their respective resumes.

The Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, termination of employment or other non-discretionary reason. The Contractor shall notify the COR and the CO within ten days after the occurrence of any of these events and provide the information a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the CO. All proposed substitutes shall possess the same minimum qualifications to those of the persons being replaced. The CO will notify the Contractor within ten days after receipt of all required information of the decision on substitutions.

Guardian Maintenance Services

1.5.1.1 Project Manager

The Project Manager is the Contractor representative responsible for the management and coordination of technical and personnel resources to provide for the smooth operation of the project. The Project Manager leads the project status meetings that occur every month.

Minimum Qualifications: The Project Manager should have a minimum of four years of progressive experience in the security systems field, including at least three years in a management capacity directing security systems implementation and maintenance, preferably on behalf of a Federal client.

The Project Manager should also demonstrate experience managing security systems of similar size and scope to Guardian.

1.5.1.2 Technical Lead

The Technical Lead is the principal technical expert responsible for maintaining all Guardian subordinate systems so that they function properly both independently and as an integrated whole. The Technical Lead is responsible for the day-to-day functioning of the entire Guardian system. The Technical Lead participates in project status meetings that occur every month.

Minimum Qualifications: The Technical Lead should have a minimum of four years of progressive experience installing, integrating, and maintaining security systems and preferably on behalf of Federal clients. The Technical Lead should demonstrate sufficient technical expertise to serve as a Subject Matter Expert (SME) on the design, configuration, maintenance and support of all components of the Guardian system. The Technical Lead should also demonstrate experience in the maintenance and support of systems with a similar size and scope to Guardian.

1.5.2 Contractor Capabilities

The Contractor maintaining the PACS system shall be listed as certified HSPD-12 Certified System

Engineer ICAM PACS (CSEIP) service providers on the General Service Administration’s (GSA) IDManagement.gov website.

The Contractor shall be a certified Lenel OnGuard® authorized value-added reseller (VAR) and technicians servicing the application must have completed, at a minimum, the OnGuard Associate training level.

The Contractor shall be a Bosch intrusion panel certified installer.

The Contractor shall be certified by EAGL technologies.

The Contractor shall have Milestone Certified Integration Technician (MCIT) and Milestone Certified

Integration Engineer (MCIE) certifications from Milestone.

The Contractor shall be a Boon Edam certified and approved vendor.

The Contractor shall be certified by Orion Entrance Control, Inc. to be able to maintain the turnstiles.

1.5.3 Communication and Coordination

The Contractor shall communicate and coordinate with Peace Corps personnel and building management personnel in the performance of the requirements identified in the PWS. Should direction or resolution of issues be required, the Contractor shall immediately notify the COR.

The Contractor shall not post any project related security system image, drawing or document on a non- Peace Corps website or Secure File Transfer Protocol (SFTP) site.

In the event that the Contractor’s technical response has any conflict or discrepancy with the provisions set forth in the PWS, this PWS shall take precedence.

Guardian Maintenance Services

2 Performance Objectives

FFP CLINS

2.1 Project Preparation and Management

2.1.1 Kick-off Meeting

A kick-off meeting, led by the CO/COR, will occur within ten days of the initial contract award. All Contractor key personnel shall attend the project kick-off meeting at which the project plan will be discussed.

2.1.2 Project Plan, Service Level Agreement, and Quality Assurance Plan

1. The Contractor shall submit as a part of their quote a project plan in accordance with this PWS that addresses all work to be performed during the base year plus all option years of the contract to support the components listed in Section 1.2 and Appendix D. The project plan shall include responses to each of the following items within the project plan section of the quote in order to be considered responsive to this RFQ:

a. Information security

i. A description of the Contractor’s strategy for providing subject matter expertise support to Peace Corps Information System Security Officers (ISSOs) during the documentation and annual assessment of security controls for the Guardian system. This strategy should address the Contractor’s approach to remediation of weaknesses identified during annual assessments.

ii. A description of the vulnerability management process the Contractor will use to monitor, communicate, and remediate vulnerabilities in the Guardian system. This process shall include a description of the coordination with Peace Corps’ ISSO and the

COR.

b. Preventative maintenance

i. A description of the process by which the Contractor will test configuration changes, firmware patches and upgrades for all subordinate systems prior to being released into Peace Corps’ production environment in order to verify that these actions will not negatively affect the full functioning of the Guardian system.

ii. A list of all licenses and support agreements that the Peace Corps will have to renew for all systems during the period of performance of the contract.

iii. A list of the preventative maintenance activities required by the manufacturers for subordinate systems and the devices found in Appendix D.

iv. A list of the preventative maintenance activities recommended by the Contractor for all subordinate systems and the devices found in Appendix D.

v. A date for each preventative maintenance activity for which there is a defined frequency.

vi. A description of the process the Contractor will use to verify that subordinate systems remain integrated as described in Section 2.3.

c. Unscheduled service and technical support requests

i. The phone number and email address to which Peace Corps will submit all requests for service and technical support.

ii. Instructions for the Peace Corps to follow in order to escalate an assistance request for service and technical support following an initial request.

Guardian Maintenance Services

iii. A description of the process to resolve system failures based upon the relative criticality defined in Section 2.5.

d. Periodic visits for system modifications

i. Instructions for the COR to schedule a visit to perform system modifications as described in Section 2.6.

e. Documenting and reporting

i. A sample of the maintenance report to be delivered on the fifth business day of each month as described in Section 2.4.

2. The Contractor shall submit as a part of their quote a service level agreement (SLA) defining any services that the Contractor requires or assumes to be performed by the Peace Corps.

3. The Contractor shall submit as a part of their quote a Quality Assurance Plan (QAP) detailing the Contractor’s practices and procedures to verify that quality standards are met, and to identify, mitigate, and manage risks as they relate to the task areas of this PWS.

4. The project plan, SLA, and QAP will become part of the contract.

5. The Contractor shall coordinate scheduling of all work with the COR. The Contractor shall request the approval of the COR prior to performing any work that the Contractor determines is best performed outside of normal “business hours” identified in Section 1.3.

2.1.3 Monthly Project Status Meeting

1. The Contractor Project Manager shall lead a meeting every month to discuss the status of the project.

Meeting participants shall include, at a minimum, the Project Manager, Technical Lead, and FSR.

2. The Contractor shall deliver an agenda for each project status meeting to all participants at least one business day prior to the meeting.

3. The Contractor shall document and deliver all meeting minutes to all participants within one business day following the meeting identifying items that need follow-up action along with the responsible individual(s).

4. The Contractor shall lead all work that has been identified and assigned following all project status meetings.

2.2 Information System Security Requirements

2.2.1 Federal Laws, Regulations, and Guidance

The contractor shall comply with all applicable Federal Laws and Regulations.

40 U.S.C. 11331, “Responsibilities for Federal Information Systems Standards” FISMA of 2014, “The Federal Information Security Modernization Act of 2014” HSPD 12, “Homeland Security Presidential Directive 12 – Policy for a Common Identification Standard for Federal Employees and Contractors” OMB Circular A-130, “Managing Information as a Strategic Resource” OMB M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure (Submission of

Draft Agency Plans Due by September 5, 2008)” OMB M 14-03, “Enhancing the Security of Federal Information and Information Systems” OMB M-10-23, “Guidance for Agency Use of Third-Party Websites and Applications” OMB M-15-13, “Policy to Require Secure Connections across Federal Websites and Web Services” OMB M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” Privacy Act of 1974, “5 USC, § 552a”

Guardian Maintenance Services

OMB Memoranda, location of current fiscal year guidance on Federal Information Security and Privacy Management Requirements, including FISMA reporting

2.2.2 Federal Standards and Guidance

The contractor shall comply with all applicable Federal Information Processing Standards (FIPS). NIST Special Publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems” FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems” FIPS PUB 140-2, “Security Requirements for Cryptographic Modules” NIST SP 800-18, Revision 1, “Guide for Developing Security Plans for Federal Information Systems” NIST SP 800-30, Revision 1, “Guide for Conducting Risk Assessments” NIST SP 800-34, Revision 1, “Contingency Planning Guide for Federal Information Systems” NIST SP 800-37, Revision 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy” NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems” NIST SP 800-53, Revision 4, “Security and Privacy Controls for Federal Information Systems and

Organizations” NIST SP 800-53A, Revision 4, “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans” NIST SP 800-63-3, “Digital Identity Guidelines” NIST SP 800-122, “Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)” NIST SP 800-137, “Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations”.

2.2.3 Peace Corps Policies, Procedures, and Standards

The contractor shall comply with the following Peace Corps Directives/Policies (Appendices A-1, A-2, A3, A-4).

See Appendix portfolio.

MS 542, “Peace Corps Information Security Program” MS 892, “Records Management” MS 897, “Privacy Act Administration” MS 899, “Breach Notification Response Plan”

2.2.4 Information System Security Configuration

FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems,” is a mandatory federal standard that defines the minimum-security requirements for federal information and information systems in seventeen security-related areas. Peace Corps has determined the Guardian system to be a moderate system. Therefore, Guardian is required to apply and maintain an appropriately tailored set of Moderate impact baseline security controls in NIST 800-53, as determined by Peace Corps and consistent with Peace Corps specifications. The contractor shall confirm with Peace Corps regarding proper implementation of any additional security controls.

1. The Contractor shall use Peace Corps technical guidelines, NIST guidelines, Center for Internet Security (CIS) guidelines (Level 1), USGCB, or industry best practice guidelines in hardening Guardian. Where a Peace Corps security hardening benchmark exists, it must be used. Applicable benchmarks will be provided by Peace Corps upon request.

Guardian Maintenance Services

2. The Contractor shall submit to the COR a report documenting all initial configuration settings applied to harden all systems and again upon subsequent configuration revisions. The COR will review the document, provide responses as necessary to refine the settings per Peace Corps configuration policy, and provide approval upon completion of the final settings. The Contractor shall apply all configuration settings to all Guardian subordinate systems.

3. The Contractor shall provide to the COR a backup of all data and system configurations associated with all Guardian systems within twenty days of the beginning of the contract.

4. The Contractor shall configure, implement, and enforce all components and operations to meet the security control requirements as defined by the Peace Corps. Where agency security policy is undefined, the Contractor shall bring it to the attention of the COR and implement industry standard security measures based on NIST SP 800-53 for Moderate Impact Systems.

5. Peace Corps requires fault tolerance for the PACS sub-system. Currently, the active PACS server is located at Peace Corps’ Headquarters facility. In order to meet this goal, Peace Corps is requiring that a secondary PACS server be located at its offsite data center location at Ashburn, VA. The Contractor shall assist in the configuration and implementation of this functionality within 60 days of contract award. The Contractor shall verify that it serves as an active redundant copy of the active PACS server at the headquarters building.

2.2.5 Vulnerability Management

1. The Contractor shall maintain awareness of vulnerabilities identified by manufacturers of Guardian components and immediately communicate those vulnerabilities to the COR.

2. The Contractor shall address all vulnerabilities authorized by the COR.

3. The Contractor shall coordinate the application of firmware, patches, and software updates, upon approval of the COR, as soon as possible following the discovery of an emergency or zero-day vulnerability by a software manufacturer, the Peace Corps, or the Department of Homeland Security

(DHS).

4. The Contractor shall notify the COR in writing if a software patch is not available from the software manufacturer and shall propose the application of alternative risk reduction measures for approval by the COR. The Contractor shall apply the alternative risk reduction measures upon receipt of approval from the COR.

5. The Contractor shall propose in writing to the COR any request for a deviation from Peace Corps or DHS patching schedule for approval by the COR. The Contractor shall apply the proposed deviation upon receipt of approval from the COR.

2.2.6 System Security Assessment

1. The Contractor shall participate in annual security assessment interviews performed by Peace Corps

Security Control Assessors (SCA). The results of the assessment area captured in the Security Assessment Report (SAR) produced by the SCA.

2. The Contractor shall remediate all vulnerabilities identified in the SAR within the Contractor’s control and which the Contractor has determined can be fixed within 30 days.

3. The Contractor shall submit to the COR within forty 40 days following submission of the SAR to the COR a Corrective Action Plan (CAP) defining the strategy to remedy vulnerabilities that cannot be remedied within 30 days. The COR will review and approve of the CAP.

Guardian Maintenance Services

4. The Contractor shall submit to the COR within 10 days of the approval of the CAP by the COR a Plan of Actions and Milestones (POA&M) describing the actions that the Contractor will take to implement the CAP. The COR will review and approve of the POA&M.

5. The Contractor shall upon approval of the POA&M by the COR perform all actions defined in the POA&M until all vulnerabilities are successfully remediated.

2.3 Preventative Maintenance

1. The Contractor shall verify that configuration changes, firmware patches and upgrades for all subordinate systems have been tested prior to being released into Peace Corps’ production environment to ensure that these actions do not negatively affect the full functioning of the Guardian system.

2. The Contractor shall identify the preventative maintenance activities recommended by system manufacturers. The list of maintenance activities found in in Appendix C is provided only as an example and is not to be considered definitive nor complete.

3. The Contractor shall perform all work required to identify, schedule, and apply all required licenses for all systems and components. Peace Corps will purchase all licenses required for Peace Corps owned equipment.

4. The Contractor shall upgrade all software to the most current versions provided that the PACS software complies with the General Services Administration’s (GSA) Approved Products List (APL) and that all systems remain integrated and operate as described in this PWS.

5. The Contractor shall perform all work related to all components of the Guardian system that is required in preparation for and recovery from one planned power shutdown at the headquarters facility per year.

6. The Contractor shall perform all work to maintain the internal ENS so that it delivers messages as described in Appendix F.

7. The Contractor shall perform all work to maintain the internal ENS so that it delivers messages received from the external ENS as described in Appendix F.

8. The Contractor shall perform all functions to maintain the integration of the subordinate systems to verify the reliability of the coordinated actions described in Appendix F.

9. The Contractor shall perform all work to maintain the Guardian system so that messages sent to the external ENS are configured as required by the external ENS in order to perform the message deliver functions described in Appendix F.

2.4 Documentation and Reporting

1. The Contractor shall provide to the COR a list and description of maintenance activities that the Contractor has determined may be performed by Peace Corps personnel during periods between on-site visits by the Contractor. The COR will review the list and provide approval for those activities that Peace Corps will perform. The Contractor will provide clear and unambiguous checklists and procedures for the approved activities for approval by the COR.

2. The Contractor shall deliver a report to the COR within one day following any on-site visit in which the Contractor discovers a problem with any Guardian subordinate system. The report shall describe the problem and the solution implemented or to be implemented by the Contractor along with the anticipated time it will take to resolve the problem. The report will also include any event logs that identify error conditions.

3. The Contractor shall submit to the COR by the fifth business day of each month a summary progress

Guardian Maintenance Services report addressing, at a minimum, all of the items listed below that were performed during the previous month and provide a description of the work to be accomplished during the subsequent month. A recommended example format of a report for items (b) and (c) can be found in Appendix B.

a. IT security

i. Vulnerability remediation activities to include POA&M progress

b. Preventative maintenance

i. The relevant dates of all maintenance actions

ii. The specific Guardian subordinate system on which each maintenance action was performed

iii. Detailed information describing the maintenance activities that were performed

iv. Detailed information describing any abnormalities or problems found in any Guardian subordinate system

v. Detailed information describing any changes made to the Guardian system regarding, at a minimum: upgrades or configuration changes to software or firmware, license renewals, parts replaced, actions taken to solve identified problems, and actions take to comply with IT security requirements

vi. Problems discovered

vii. Proposed solutions

c. Unscheduled service and technical support requests

i. The unique identifier associated with the problem

ii. The relative urgency of the problem using the terms described above (“low”, “medium”, “high”, and “critical”)

iii. The date the problem was initially reported

iv. The person who submitted the request

v. A description of the problem

vi. The corrective action plan, including timeframe and defined actions, which the Contractor has determined will be required to remedy the problem

vii. The date on which the problem was remedied

viii. System modifications

ix. A description of all modifications performed to any Guardian subordinate system during or as a result of the visit(s) that were performed during the previous month

d. Maintenance of integrated subordinate systems

i. A description of any challenge(s) encountered regarding the integration of subordinate systems along with recommended solution(s) to return to full integration

ii. A description of the work to be accomplished during the subsequent month

4. The Government has thirty days to review required reports under this contract unless otherwise specified. Once reviewed and returned to the Contractor, any further action require in that response must be resubmitted to the Government within five days. The Government then has five days to approve final resubmission. However, in no circumstance will the Government’s delay in meeting the specified timeframes for action as stated herein be construed as a waiver of rights.

T&M CLINS

2.5 Unscheduled Service and Technical Support Requests

1. The Contractor shall provide a single phone number and a single email address to which Peace Corps staff will submit all requests for service and technical support.

Guardian Maintenance Services

2. The Contractor shall send an email to the FSR and the Peace Corps staff member who submitted the request to confirm receipt within the response timeframes listed in Table 1. The Contractor email shall contain a unique identifier associated with the request and identify when the issue is expected to be resolved.

3. The Contractor shall perform all work to resolve all requests for unscheduled service and technical support according to the timeframes listed in Table 1. The spare parts currently in Peace Corps inventory are available for use by the Contractor and can be applied to the maintenance project. The Contractor will be responsible for acquiring and maintaining all additional parts needed in support of this maintenance contract. The Contractor will be responsible for replenishing depleted inventory of available spare parts. Current available spare parts in the Peace Corps inventory are:

a. PACS

i. Two (2) LNL 1320

ii. One (1) LNL 4420

iii. Two (2) HES electric strike locks

iv. One (1) electromagnetic lock

v. One (1) electrified lever set

vi. Four (4) PIV Card contactless readers

vii. Two (2) door position switch (DPS)

viii. Two (2) request-to-exit (RTE) motion devices

b. CCTV/VSS

i. Four (4) AXIS cameras model M3045-V

ii. One (1) AXIS intercom model A8105-E

iii. Two (2) spare hot-swappable hard drives for the CCTV/VSS Network Attached Storage device

c. ENS

i. Two (2) PoE Alertus alert beacons

Table 1: Response and Resolution Timeframes for Particular Problems

System Problem Urgency Response time Resolution time

PACS

Unable to control access to / from lobby and Peace Corps space on any floor

Critical 30 minutes 2 hours following response

Revolving door, portal

Unable to use all portals / revolving doors on a particular floor

Critical 30 minutes 2 hours following response

PACS Unable to control access to a room with a motion detector High 30 minutes 4 hours following response

Revolving door

Unable to use one of the revolving doors on a particular floor where there are two revolving doors

High 30 minutes 4 hours following response

Internal and external

ENS

Integration between external ENS (Everbridge) and Alertus not working

Medium 1 hour one business day following response

Guardian Maintenance Services

Internal ENS Alertus not working Medium 1 hour one business day following response

VSS Unable to view all recorded video Medium 1 hour one business day following response

PACS Unable to control access to LAN and server rooms Medium 1 hour one business day following response

Turnstiles Unable to use all turnstiles Medium 1 hour one business day following response

Doors Door closer not operating properly to lock door Low 1 hour one business day following response

Internal

ENS

Single component of Alertus (e.g., a beacon, desk phone functionality, desk computer) not working

Low 2 hours two business days following response

VSS Loss of video from a single camera Low 2 hours two business days following response

PACS Unable to control access to other rooms with card readers Low 2 hours two business days following response

Turnstiles Unable to use one turnstile Low 2 hours two business days following response

Other non-urgent problems

Remedies to other software and hardware problems, implementation of functionality that was not performed during initial installation, questions about system functionality, and all other issues that arise with all Guardian system components

Low 2 hours two business days following response

2.6 Periodic Visits for System Modifications

1. The Contractor shall provide periodic site visits at the direction of the COR, as needed, for the purpose of creating or modifying system or user account configurations to accommodate the Peace Corps requested changes in the operation of the Guardian system.

2. The Contractor shall not combine these site visits with other maintenance-related service visits. The Contractor shall coordinate the dates and times of the visits with the COR. Each visit shall include a sufficient amount of time to incorporate the Peace Corps’ requested changes. The Contractor shall verify the operation of the system with the COR upon completion of work.

3 Optional Tasks and Services

FFP CLINS

Guardian Maintenance Services

3.1 PACS Equipment Installation on one Standard Swing Door

Installation and configuration of PACS equipment on a standard door to include reader interface module (RIM), RK 40 card reader, HES electric strike, DPS, RTE, and 500 feet of cable.

3.2 Installation of One Standard Camera

Installation and configuration of one ceiling-mounted AXIS camera (similar to model M3045-V) and 500 feet of cable.

3.3 Intrusion Detection System Duress Button or Door Contact

Installation and configuration of one IDS alarm point or duress button and 500 feet of cable.

3.4 Gunshot Detection System Sensor

Installation and configuration of one EAGL Firefly indoor ballistic sensor.

3.5 HID Crescendo Cards

Delivery of 100 HID Crescendo cards printed on both sides with a numerical sequence in a style to be as defined by the COR.

3.6 Emergency Notification System Alert Beacon

Installation and configuration of one ALERTUS beacon and 500 feet of cable.

3.7 Lenel OnGuard Training

Remote Lenel administration and management certified training for one person.

3.8 Intercom Installation

Installation and configuration of one AXIS intercom (model A8105-E or similar) and 500 feet of cable.

AS IS FFP CLINS (Optional)

The Peace Corps is intent on obtaining contractor support for the Maintenance Services for the Entire Guardian System (i.e., the system of subordinate systems/components – all control access barriers (revolving doors, portal, turn styles, and standard doors, door motorized and non-motorized door openers and closers; Lenel OnGuard Physical Access Control System (PACS); Bosch B9512G Intrusion Detection System (IDS); Milestone XProtect Video Surveillance System (VSS); EAGL/FIREFLY Gateway Gunshot Detection System (GDS); ALERTUS Internal Emergency Notification System (IENS), and; all services, user workstations, and any other computing hardware and software associated with all subordinated systems/components). The Guardian System is made up of several commercial systems that although have independent roles, are interdependent concerning the comprehensive physical security of the Peace Corps Headquarters building.

The Government acknowledges that four challenges are prevalent in the face of this intent, i.e., 1.) the Gunshot Detection System component of the Guardian System is not 100% completed, nor has it been fully integrated or tested, 2.) the Intrusion Detection System is not 100% completed, nor has it been fully integrated or tested, 3.) a fully integrated Guardian System, therefore, has not been completed or fully integrated or tested, and 4.) the drawings for the entire Guardian System are not yet in the Peace Corps possession.

Guardian Maintenance Services

I

The Government requires the contractor to assist the Peace Corps with quickening the pace of the completion of the two non-integrated/non-tested subordinate systems/components (EAGL and BOSCH) by completing what needs to be completed, integrating, and testing these subordinate systems/components, along with supporting the Peace Corps with a final fully integrated test of the entire Guardian System at one time.

3.9 Gunshot Detection System Sensor Installation, Integration, and Commissioning

3.9.1 Scope

The Contractor shall procure, install, and configure two EAGL Firefly indoor ballistic sensors. These sensors are to be integrated into a system with 90 other Firefly sensors currently in place. The Contractor shall then test the entire system to confirm that all sensors detect a signal delivered from a testing device and register the signal as an alarm in the OnGuard application. Following successful testing, the gunshot detection system will be commissioned as a component of the overall Guardian system (i.e., it will be a subordinate system along with the other subordinate systems listed in Section 1.2). The Contractor shall perform all activities at the Peace Corps headquarters, 1275 First Street, N.E., Washington, D.C. 20002

3.9.2 Description of Work to be Performed

1. The Contractor shall procure, install, and configure two (2) EAGL Firefly indoor ballistic sensors in locations to be defined by the COR in accordance with manufacturer’s specifications.

2. The Contractor shall confirm the placement and proper functioning of 90 other Firefly indoor ballistic sensors that have previously been installed throughout the Peace Corps office space. The Contractor shall remove any Firefly sensor determined not to be functioning properly and deliver it to the COR.

3. The Contractor shall configure each of the Firefly sensors to deliver an alarm to the EAGL application and OnGuard PACS application upon detection of a gunshot. The alarm will clearly and unambiguously identify from which sensor the signal originated.

4. The Contractor shall configure each of the Firefly sensors to deliver an alarm to the EAGL application and OnGuard PACS application in the event that a Firefly sensor has a low battery. The alarm will clearly and unambiguously identify from which sensor the low-battery signal has originated.

3.9.3 Acceptance Testing

1. The Contractor shall develop a plan to test each Firefly sensor and submit it to the COR, for review and approval, at least 5 days prior to the commencement of formal testing. Testing shall be performed using a dazer device provided by EAGL.

2. Formal Testing is comprised of two phases: (One) Performance Verification Testing (PVT), and (Two) Final Acceptance Test: (FAT) TBD by Contractor Test Plan. PVT will test the operation and functionality of each device.

3. The Contractor shall submit a notification to the COR confirming successful completion of the PVT and propose a date and timeframe within the next five days to perform FAT. The COR will provide approval of the FAT date and timeframe.

4. A Peace Corps representative shall accompany the Contractor during the FAT to verify that the security system complies with the requirements listed in Section 3.9.2 and testing procedures.

5. The Contractor shall furnish to the COR within 5 days of completion of the FAT a report listing the results for each component tested. The format shall list the device, date, time, type, and result of test.

6. The COR will review the report of test results to determine if all requirements of this CLIN have been met.

Guardian Maintenance Services

3.10 Intrusion Detection System Modification, Integration, and Commissioning

3.10.1 Scope

The Contractor shall modify the existing Bosch intrusion detection system (IDS door contacts to shunt alarms in the IDS and physical access control system upon both (One) the read of an active card and (Two) an authorized exit event. IDS door contacts included in this CLIN are installed on 22 swing or sliding doors, 10 Boon Edam Tourlock 180 revolving doors, and 1 Boon Edam circlelock combi. Following modification, the Contractor shall test door contacts to confirm that alarms are shunted in both the IDS and the PACS. Following successful testing, the IDS will be commissioned as a component of the overall Guardian system (i.e., it will be a subordinate system along with the other subordinate systems listed in Section 1.2). The Contractor shall perform all installation activities at the Peace Corps headquarters, 1275 First Street, N.E., Washington, D.C. 20002

3.10.2 Description of Work to be Performed

1. The Contractor shall provide all hardware, cabling, and system configuration programming to modify the existing IDS hardware and software to meet the following specifications:

a. At doors with card readers, the read of an active and authorized card shall shunt the alarm

b. At doors with a request to exit (RTE), the RTE shall shunt the alarm

2. The Contractor shall configure the PACS to reflect that the shunting of the IDS does not register as an alarm in the PACS.

3.10.3 Acceptance Testing

1. The Contractor shall develop a plan to test each IDS door contact and submit it to the COR, for review and approval, at least 5 days prior to the commencement of formal testing. Testing shall demonstrate that the IDS components conform to the requirements listed above.

2. Formal Testing is comprised of two phases: (One) Performance Verification Testing (PVT), and (Two) Final Acceptance Test: (FAT) TBD by Contractor Test Plan. PVT will test the operation and functionality of each device.

3. The Contractor shall submit a notification to the COR confirming successful completion of the PVT and propose a date and timeframe within the next five days to perform FAT. The COR will provide approval of the FAT date and timeframe.

4. A Peace Corps representative shall accompany the Contractor during the FAT to verify that the security system complies with the requirements listed in Section 3.10.2 and testing procedures.

5. The Contractor shall furnish to the COR within 5 days of completion of the FAT a report listing the results for each component tested. The format shall list the device, date, time, type, and result of test.

6. The COR will review the report of test results to determine if all requirements of this CLIN have been met.

3.11 Gunshot Detection System Maintenance

1. Upon exercise of this option, the gunshot detection system (GDS) is commissioned, becomes part of the scope of the entire Guardian system (i.e., it will be a subordinate system along with the other subordinate systems listed in Section 1.2), and the following additional language becomes part of the

PWS.

2. To Section 1.2 is added: Gunshot Detection System (GDS): the GDS (EAGL, version 2.0.3.12) detects a gunshot fired within Peace Corps space.

3. To Section 2.5 is added:

a. GDS spare parts

i. One (1) EAGL Firefly gunshot detection sensor

ii. One (1) EAGL gateway

Guardian Maintenance Services

b. Table 2

GDS The entire system is not working High 30 minutes 4 hours following response

GDS All sensors on a particular floor are not responding Medium 1 hour one business day following response

GDS A sensor is not working Low 2 hours two business days following response

4. To Appendix F is added:

When a gun is fired in Peace Corps leased space:

a. the GDS will detect the gunshot

b. the event will register as an alarm in the PACS

c. the PACS workstation at the guard desk will display the alarm prominently

d. the PACS will clearly and unambiguously identify the location of the GDS sensor that detected the gunshot

e. the siren/strobe at the guard desk in area 2001 will sound and flash

f. the IDS will alert the FPS megacenter

g. the image from a camera closest to the detected gunshot will be displayed on the monitor at the guard desk

h. the internal ENS will alert all individuals within Peace Corps leased space of the gunshot by taking control of all computer workstations, VoIP phone, alert beacons . Internal ENS output devices with visual displays will display text to be defined by the FSR. Internal ENS output devices with speakers will project an audible message to be defined by the FSR.

i. the external ENS will alert first responders at both the FPS and the Washington, DC Metropolitan Police Department of the gunshot incident.