Attachment_4_-_Task_Order_1_SOW_Amdmt_003_20190212.pdf

Task Order 1 Statement of Work (SOW)

Cyberlock Surveys at NIST Gaithersburg and Boulder Campuses

BACKGROUND

The U. S. Department of Commerce, National Institute of Standards and Technology (NIST) Emergency Services Office, administers a Security Systems and Access Controls to physical resources located in multiple building research campuses located in Montgomery County, Maryland. Additional campuses are in Boulder County in Colorado.

In the fall of 2016 and the spring of 2017 NIST constructed a system of wireless locking devices utilizing the existing NIST WIFI (IEEE 802.11 compliant) campus network. Currently there is a Productions system and a Test system located on virtual machines managed by the NIST Office of Information and Systems Management.

The system currently consists of 43 of 50 installed wireless mortise locks in three buildings, herein referred to as cyberlocks. The cyberlocks are ASSA ABLOY IN120 locksets. The cyberlocks utilize the RS2 AccessIT software platform as the management system.

During the 2016/2017 initial system testing, NIST reviewed several different manufacturers and software integrations to evaluate the characteristics of the software systems, lockset interactions, web-based interfaces, system permissions, access control, and many other facets of the interaction that would take place between the locksets, users, and administrators.

At the time of this initial pilot deployment, it was determined that that the ASSA ABLOY IN120/220 was the only lockset capable of traditional 2.4 GHz WIFI communication, meeting encryption requirements, and the only reader that could process the NIST issued PIV card FASC- N as well as supporting a traditional 26 Bit proximity card in a single unit while having enough memory to support a third card type such as PIV-I, which was also tested.

RS2 AccessIT was the chosen platform because of the robustness of the web-based interface, granularity of system permissions, and control that could be exercised when creating the sites, access levels, role-based access, and many other attributes.

Under this task order, NIST requires that existing doors in Gaithersburg, Maryland and Boulder, Colorado are surveyed to determine the requirements to replace the existing locksets and hardware with cyberlocks. Additionally, NIST requires that the new cyberlocks be installed on the doors surveyed.

TASK ORDER SCOPE OF REQUIREMENTS

The contractor shall provide materials and services for the NIST Gaithersburg, MD and Boulder, CO locations. This shall include the following for the NIST locations identified in this SOW:

TO1 SOW Page 2

• Site survey for suitability of doors, including existing WIFI Signal strength/compatibility determination.

• Identify what door modifications are needed (if any) to accept new cyberlocks.

• Identify what (if any) door hardware such as cylinder, housing, core, or tailpiece changes related to new cyberlocks are required.

• Review the existing software licensing suitability for adding additional identified cyberlocks.

• Purchase of all required licensing features for the software as well as the hardware for supporting the Cyberlock doors in Tasks 1-2.

• Installation of new software and licensing upgrades to accommodate the additional hardware.

• Removal of existing locksets.

• Installation and programming of new wireless locksets, including the modification of doors, as needed.

• Programming of the locksets in the software to align with the current configuration and assign locksets under the appropriate OU/ Division.

• Testing of each lockset for proper operability after access assignments are complete.

This is a hybrid, Firm Fixed Price /Time & Materials type task order. Task 1 is a Firm Fixed Price task, to be priced at the proposed and accepted total firm fixed price for Task 1. Task 2 is a Time & Materials task, whose total ceiling (not to exceed) price shall be equal to the Total Budget for Task Order 1 minus the Task 1 Firm Fixed Price. The Total Budget for Task Order 1 is $3,466,000.00. The contractor shall provide the products and services detailed in this task order at the unit prices and labor rates detailed in the pricing schedule of its IDIQ Contract.

SPECIFIC TASKS

The contractor shall be responsible for performing the following tasks, summarized below with details that follow:

• Task 1 (CLIN 0001): Door Surveys for Gaithersburg and Boulder Campuses—Firm Fixed Price Task

• Task 2 (CLIN 0002): Provision/Installation/Testing of Cyberlocks for the Surveyed Doors— Time & Materials Task

1. TASK 1 (CLIN 0001): DOOR SURVEYING

Task 1 is a Firm Fixed Price task. Task 1 shall occur across both the Gaithersburg, MD and Boulder, CO campuses. The contractor shall conduct a site survey for the suitability of doors including the existing WIFI signal strength/compatibility by submitting a Door Survey Schedule within 14 business days of task order award.

TO1 SOW Page 3

Contractor shall provide a Door Survey Inspection Report containing the following items per door within 30 days of the submission of the Door Survey Schedule:

a. Building Number

b. Door Number or methodology for identification if door number is unknown or repeated

c. Photograph of the door – both sides

d. Door characteristics (metal, wood, solid core, etc.)

e. Existing Cylinder/Lock type

f. Door dimensions (width, height, length)

i. Note: if not a single door

g. Existing Handle Type

h. Detail the equipment choices selected for installation on the door.

i. Detail any door modifications needed or the inability to install the cyberlock such as:

(Half Door, Lead Door, Door contains asbestos, etc.)

j. Detail the installation requirements for the cyberlock installation to include all requirements for the cyberlock

k. Estimated time to remove existing affected hardware, address any door modifications when applicable, and provide new cyberlock, to include programming, testing, and resolution of any issues found.

l. Measure the WIFI Signal at each door to ensure that the signal is strong enough and sufficient quality for the new cyberlock. Provide analysis for each door if there are WIFI signal strength concerns.

m. The contractor shall separate section containing any additional software/licenses and, if necessary, server upgrades for all the assumed doors shown in the CLINs that are added to the system. The need for as many as 200 sites (segments) and 3,000+ readers should be anticipated.

**A detailed list of door numbers, names, and locations will be provided after award and prior to the start of the door surveys. **

The survey shall identify any door modifications needed to accept the new cyberlocks, such as what cylinder, housing or core changes related to the installation of the new cyberlocks are required and review the existing software suitability for adding additional identified cyberlocks.

The Door Survey Inspection Report should group the items A-M as follows:

A. Gaithersburg, MD

1. Buildings 245, 101, 223, and 301 (approximately 122 locksets) ADMR Funded

2. Buildings 222, and 225 (approximately 58 locksets) ITL Funded

3. Building TBD (approximately 123 locksets) PML Funded

B. Boulder, CO

1. Buildings 3 and 24 (approximately 52 locksets) ADMR Funded

TO1 SOW Page 4

2. Buildings 1 and 24 (approximately 51 locksets) CTL Funded

3. Building 1 (approximately 17 locksets) ITL Funded

C. Overhead costs and other recommendations

1. A quantity of 8 (E-CLIENT-5P Client license 5 packs)

2. Include the Lock License File (LLF) for each lock (unless included in the cost of the lock)

3. Software upgrade to a VU-ESSL255 Access It!® Universal - Enterprise Single Server

Version Upgrade 255 Sites.

4. A DS-ESSL255 Access It!® Universal - Enterprise Single Server Direct Support

Agreement Annual Fee including Version Upgrade Fee should be included to accompany the growth of this system.

Constraints:

In performing Task 1 under this task order, the contractor will be subject to the following constraints:

A. Contractor will be limited to two survey crews per building. Only two concurrent crews are permitted at one time.

B. Contractor will be limited to NIST business hours of 6:00 AM to 7:00 PM to include 1 hour for lunch. No work will occur on Saturdays, Sundays, Federal Holidays, or during a government shutdown.

C. Due to access, the COR/TPOC may have to skip doors due to access restrictions. The

Contractor may have to loop back for doors that the COR/TPOC may not be able to gain access to at the time of the walkthrough and should be captured in the prices quoted.

2. TASK 2 (CLIN 0002): PROVISIONING, INSTALLATION, AND TESTING OF CYBERLOCKS FOR

SURVEYED DOORS

General Description: Task 2 is a Time & Materials task and covers both the Gaithersburg, MD and Boulder, CO campuses. Based on the results of the door surveys performed under Task 1, the contractor shall order the necessary equipment after delivery of the Door Survey Inspection Report and a written approval from the COR and TPOC. Once the approval has been received the contractor shall schedule the installation, configure the locks, install the hardware and software, and test the locksets for as many doors as possible within the ceiling price of CLIN 0002. The contractor shall provide these services, as described in the “Detailed Description” below, for the buildings/doors as agreed upon, in writing, between the contractor and the NIST COR/TPOC.

The doors for which the contractor shall provide/install cyberlocks are split into two groups (A and B) listed in the “Door Groups” section below.

Reporting Requirements: The contractor shall coordinate with the NIST COR/TPOC to determine which doors to complete. The information on the specific doors and the group they fall under will be included in the door list provided to the contractor under Task 1. The contractor may perform Task 2 on doors within the “Door Groups” below concurrently. The contractor shall

TO1 SOW Page 5 accurately track and report on the specific doors that have been completed, including the products required and total price for each door (referred to as the “Installation Completion Report”). The contractor shall provide this tracking and reporting to the NIST COR/TPOC at minimum on a weekly basis.

Door Groups:

A. Gaithersburg, MD

1. Buildings 245, 101, 223, and 301 (approximately 122 locksets) ADMR Funded

2. Buildings 222, and 225 (approximately 58 locksets) ITL Funded

4. Building TBD (approximately 123 locksets) PML Funded

B. Boulder, CO

1. Buildings 3 and 24 (approximately 52 locksets) ADMR Funded

2. Buildings 1 and 24 (approximately 51 locksets) CTL Funded

3. Building 1 (approximately 17 locksets) ITL Funded

Detailed Description: The contractor shall perform the following under Task 2 for as many buildings/doors as possible:

A. Order Equipment

1. Once the door survey is complete and the contractor is confident that all lock, core, configuration, and installation scenarios have been addressed, a precursory approval from the COR/ TPOC as to the validity of the contractor’s review is required.

2. Once those conditions are met, the contractor shall proceed with the ordering of the equipment and licenses shown below unless the contractor has changes or recommendations they would like to discuss.

a. A quantity of 8 (E-CLIENT-5P Client license 5 packs)

b. Include the Lock License File (LLF) for each lock (unless included in the cost of the lock)

c. Software upgrade to a VU-ESSL255 Access It!® Universal - Enterprise Single Server

Version Upgrade 255 Sites.

d. A DS-ESSL255 Access It!® Universal - Enterprise Single Server Direct Support

Agreement Annual Fee including Version Upgrade Fee should be included to accompany the growth of this system.

e. The locksets needed for all of the surveyed doors

f. Any other materials/hardware needed for the installation (Door Wraps, Escutcheon, Astragal, cover plates, etc.)

B. Installation Scheduling

1. The contractor shall notify the COR/TPOC by email once a week to alert to any updates on equipment shipping/backorders/delays, etc. Any delays, backorders, receipt of incorrect/damaged/defective products, etc. shall be communicated in email to the COR/TPOC for our records. The contractor is responsible for correcting any of these conditions with the supplier as quickly as possible without incurring additional costs.

Because of the environment in which this work will need to be performed, some lead

TO1 SOW Page 6 time will be needed to ensure all parties are able to accommodate the required effort.

The Office of Information and Systems Management (OISM) as well as the Security Systems and Access Control Group (SSACG) and the room occupants will review the installation schedule and resolve any access arrangements. Because of the coordination involved, all stakeholders need to be ready to move forward to avoid project delays.

C. License and Software Installation (Production Server)

A government furnished equipment (GFE) laptop shall be used to program the locks because of the strict network requirements and encryption standards.

The contractor shall perform the following:

1. All license files or disc images shall be downloaded on the GFE laptop or directly on to the server with the help of the OISM system administrator.

2. The contractor shall install and activate all licensing purchased onto the VM instance in which the production or test environment software is loaded.

3. The contractor shall use the GFE laptop and GFE USB to mini-USB cable to configure the locks in the following manner:

a) Card Format 0 = Format selection to support the 13.56MHz PIV smart card read of the correctly formatted FASC-N. In support of the PIV and PIV-I (if necessary) card reads.

b) Card Format 1 = Format selection of the 26BIT 125KHz prox card format to support already existing NIST Site cards.

c) If the formats are not available on the unit, the firmware may need to be updated and must be obtained from the lock manufacturer (ASSA ABLOY). The firmware can only be applied using a laptop and the Lock Configuration Tool via USB connection to the IP controller within each lock itself.

d) Assign DHCP as the IP Address being used.

e) The contractor shall provide a report containing the MAC address, Serial Number, and any other pertinent information needed for warranty or troubleshooting onto a spreadsheet so that the data can be transposed into Automated NIST Tracking System(ANTS) known as the Lock Installation Information Report. The contractor shall provide the spreadsheet to the COR/ TPOC for distribution to the NIST IT Security Officer (ITSO) responsible for this system.

f) Any other information concerning the lock profile, secure certificates, usernames, and passwords will be provided by the government and cannot not be disclosed to those without a need to know in support of this project.

TO1 SOW Page 7

D. Hardware Installation (Production Server)

1. The contractor will be provided the name of the Wireless Network SSID that the lock will need to join.

2. The contractor will be provided the IP address of the primary server VM and any other settings for use in the lock configuration.

3. The contractor shall record all issues related to the installation, configuration, communication, and completion of the wireless locking system and communicate those issues to the COR/TPOC as issues are encountered (Installation Issues Update).

This is requested so that any issues that have not been resolved can be addressed and brought to everyone’s attention.

E. Software Installation and Lockset Configuration

1. The contractor shall create a new site (segment) for each NIST OU/Division. Since the room owners may vary from the room occupants this information will have been provided on the door/ location list used during the door surveys. Another copy of the documents can be requested if needed.

2. The contractor shall re-create the access levels for each lock by mirroring the existing access levels. These will be named following the naming convention shown.

a. (Building Number) Rm (Room Number) 01 Employee Always

b. (Building Number) Rm (Room Number) 03 Associate 6am-7pm M-F

c. (Building Number) Rm (Room Number) 04 Associate 24/7

d. (Building Number) Rm (Room Number) 05 Associate 6am-10pm M-F

3. For each OU/ Division that locks are added to there needs to be one extra access level that will be utilized by Emergency Response staff. These will be named following the naming convention shown.

a. (OU/ Division Number) (OU/ Division Abbreviated Name) All Readers 02 Employee

Always.

4. The contractor shall install the lock and reader device onto the doors as shown on the templates contained within the product packaging following the manufacturers recommended installation practices.

5. The contractor shall configure email alerts for each lock. The alarms such as Door

Forced Open, Door Held Open, Access Denied, Manual Key Override shall be sent to the division administrators. All alerts such as Battery Dead, Battery Low, and Communication Exception shall be sent to the responsible division of the Security Systems and Access Control Group. For locks located in the Gaithersburg campus the

TO1 SOW Page 8 email address will be wirelesslockg@nist.gov. For Boulder wireless locks the email address will be wirelesslockb@bist.gov.

6. When the original locking components are removed from a door they shall be bagged/ boxed and labeled with the door number in which they were removed from for easy identification for the COR/TPOC. All removed locking materials, and any materials (manuals, tools, parts, screws, etc.) left over from the installation of the new lockset shall be labeled in the same manner. These materials shall be released back to the COR/TPOC once the installation is complete.

7. Development and Assignment of OU/Division based roles.

8. The contractor shall mirror one of the existing OU/Division based roles to create the additional roles needed for the lock additions.

9. The newly created access levels for each OU/Division will need to be added to the role as well.

10. The contractor shall assign the new roles to the OU/Division administrators, if known at the time of installation.

F. Testing

1. The Contractor shall test each door no less than twice on different days for each style of alarm that can be generated from the locks; which include Door Forced Open, Door Held Open, Access Granted, Access Denied, Invalid Badge Format, Badge not known, Low Battery, Dead Battery, etc.

2. This testing along with the results from each round of testing shall be recorded in a spreadsheet as well as any issues, fixes, or problems encountered while installing.

3. The Contractor shall submit the completed spreadsheet and any device documentation to the COR/TPOC weekly as the equipment is being installed.

G. Acceptance

1. Upon completion of the door installations, the confirmed successful testing, and the completion of the licenses on the production virtual machine, the contractor shall obtain acceptance/approval of the products and the installation from the COR or TPOC, depending on location.

H. Training

TO1 SOW Page 9

The contractor shall provide 16 hours of Training total for all administrators and client users.

This training shall be tailored to the objects the user can control by their assigned role and should begin as soon as installations are scheduled to commence. This shall be broken down by 8 hours for the Gaithersburg Campus and 8 Hours for Boulder. This training shall be provided in 2-hour blocks broken out by 2 sessions per day until all available parties have completed the training or the number of hours has been reached.

1. One training session per day shall cover administrative functions and screens for the ESD staff.

2. One training session per day shall cover User functions for OU/Division administrators on adding and navigating the software, adding/removing access, reports, and adding site badges from individual cardholders.

3. All training shall also include a demonstration of the lock access cover/battery removal and re-installation.

4. All training shall accommodate as many as 30 people per session and shall be coordinated with the COR/TPOC to reserve conference room space and access to a laptop that can access the system.

5. All developed training materials shall be provided to the COR/TPOC at the end of the training sessions.

Constraints:

In performing Task 2 under this task order, the contractor will be subject to the following constraints:

A. Contractor will be limited to NIST business hours of 6:00 AM to 7:00 PM to include 1 hour for lunch. No work will occur on Saturdays, Sundays, Federal Holidays, or during a government shutdown.

B. Contractor shall provide a schedule for door installations (Door Installation Schedule).

This schedule shall be provided 14 business days in advance of the installations beginning and agreed to, in writing, by the COR/TPOC.

C. Access restrictions in certain buildings/door locations may cause the COR/TPOC to skip doors in those building/door locations until the COR/TPOC is able to gain the necessary access. Therefore, the Contractor may have to loop back and complete their walkthrough for those buildings/door locations at another time (typically the same day) once notified by the COR/TPOC that access is available. The COR and TPOC will make every effort to ensure a room is available in the time slot contractor provides in the submitted schedule.

TO1 SOW Page 10

DELIVERABLE SCHEDULE

Deliverable Description Quantity/Media Date Completed

Contractor Badge Application (NAIS) – Green

Every onsite contract employee except delivery drivers

Completed forms hard copies

Within 14 days of contract award

2 Contractor activity hazard analysis (job specific health and safety plan)

Electronic PDF Within 14 days of contract award

3 Door Survey Schedule Electronic PDF Within 14 business days of task order award

4 Door Survey Inspection Report Electronic PDF Within 30 days after the submission of the Door Survey Schedule (Deliverable #3)

5 Door Installation Schedule Electronic PDF 14 business days prior to installations beginning.

Correspondence regarding shipping, delays, or backordered material

Email Updates Weekly

7 Installation Issues Report Email Weekly (at a minimum, or as issues are encountered)

8 Lock Installation Information Report Spreadsheet Updates Weekly as the equipment is being installed

Any removed locks/ handles/ components/ or unused equipment after installation of each door. All Removed materials shall be bagged according to the door number in which they are removed and delivered to the COR/ TPOC depending on which location the installation is occurring.

Delivery By the end of each day after the installation of the new locksets.

10 Installation Completion Report Email Weekly

11 Testing Documentation Electronic PDF Updates Weekly as the equipment is being installed

12 Acceptance Documentation Electronic PDF As tasks are completed

13 Training Scheduling Email As tasks are completed for OU and System Administrators

14 Training Presentations Electronic File

To COR/TPOC Prior to Training Classes being held to clarify material to be covered for OU Admins.

TO1 SOW Page 11

15 Training Materials Electronic File To COR/TPOC after the completion of training sessions.

GOVERNMENT-FURNISHED PROPERTY, MATERIAL, EQUIPMENT, OR INFORMATION

(GFP, GFM, GFE, OR GFI):

1. Laptop for programming

2. Encrypted USB flash drive as needed for file transfers from server/workstations for documentation or email

3. USB to mini-USB cable for connecting to locks from the laptop and manufacturer provided

Lock Configuration Tool (LCT)

4. Information pertaining to the programming of the lock profile such as the username, password, secure certificates, as well as the communication and encryption protocols being used.

5. Site specific training, e.g. Gaithersburg Radiation Safety Division (GRSD) training for personnel entering controlled areas.

6. Contractor provided USB drives shall not be used.

SECURITY AND BADGING

Initial Entry for All Individuals to the Campus All contractors will be required to have a background check prior to issuance of any NIST badge.

The contractor shall request, complete, and submit a DN-52 Limited Access Pass Authorization for Release of Information form for each person to be onsite, using their Full Legal Name. The contractor shall submit those applications via secure email or fax. If the documents are being sent by fax they need to have a cover sheet and the COR or TPOC must be successfully contacted first so that they are at the fax machine to receive the transmission. Failure to do so may result in a compromise of PII information and will be reported as a security violation. All personnel must be a U.S. Citizen, Foreign Nationals or Permanent Residents will not be permitted.

The DN-52s will be processed by our Office of Security (OSY). Any approvals or denials will be reported to the COR/TPOC and a subsequent notification will be sent to the contractors POC.

Approvals will need to request a date to pick up their badge from the badge office via email to the COR/TPOC. Once your visit has been authorized you will need to report to the NIST Visitor Center before entering site.

Individuals must provide one (1) form of identification (Real ID Act) and a vehicle registration document if operating a motor vehicle. Branded Commercial vehicles will need to (Gaithersburg

TO1 SOW Page 12 enter through C Gate located on Quince Orchard Road) report to truck inspection whether you have a badge o are scheduled to visit.

The Visitor Center/Truck Inspection staff validates the contractors information and provides a White Visitor Card to the individual. Staff directs individual(s) to the appropriate badge office location for processing.

The contractor’s employees will be provided with a temporary access card. This card will have the persons photo, activation and deactivation dates, and other information that will be visually verified at the gates each morning. Depending on the length of the persons visits they may be required to complete an EQUIP and another background investigation for a PIV card. The contractor will be notified once this factor is established.

Contractor Employees are reminded of the following:

• Ensure the NIST issued badge is physically displayed at all times at or above the waist while on NIST campus and follow the rules of behavior as specified within this procedure.

• Within the timeline provided in the notice complete enrollments, activations, certificate updates, and renewal requests of their PIV card when notified.

• Within 48 hours report the loss, damage, or theft of their badge to their supervisor and the NIST Badge Office (301)975-6010. Complete forms NIST-351 for Human Resources (OHRM) and DN-42 for submission to Emergency Services Office (ESO).

• Report damaged or non-functioning badges to the Badge Office (301)975-6010.

• Upon receipt of their badge, individuals must utilize it to gain access to NIST facilities.

• Except where authorized by ESO, individuals must surrender their Site card upon receipt of their PIV card.

Rules of Behavior for all Card Types:

• The badge must be displayed fully to the Police Officer/Security Officer at all access gates and any other time you are challenged while on the NIST campus.

• All visitors/guests must display their White Visitor Card while on the NIST campus and must remain with their NIST sponsor/host at all times.

• If authorized for "security-hours" access, you must badge in and out of the campus during these hours.

• The NIST badge should only be utilized to access authorized areas.

• You agree not to attempt to access controlled areas unless properly authorized.

• You may NOT piggyback or allow others to piggyback when entering an access-controlled space.

• You may not share your assigned badge or associated PIN (for PIV cards) with anyone and must protect each appropriately. Individuals found in violation of this policy will be escorted off site immediately and denied access to NIST-administered sites.

• You must secure your NIST badge to prevent loss/theft.

• You must immediately report a lost or stolen NIST badge to ESO, x2805. Once reported you will be required to complete a DN-42 form for submission to ESO.

TO1 SOW Page 13

• The NIST badge remains property of the Federal government and must be returned when you depart from NIST (i.e., separation, retirement, transfer, termination). It can be turned in to the Badge Office, the Police Services Group Office, or to one of the PSOs at the gate.

• NIST reserves the right to revoke any badge and/or access given at any time for any reason without notice.

TRAVEL

Travel is not expected to be required. The primary places of performance for this work are NIST’s campuses in Gaithersburg, MD and Boulder, CO. However, should travel costs be required they will be paid in accordance with Federal Travel Regulation.

SPECIAL MATERIAL REQUIREMENTS

This requirement is for the licensing, delivery, installation, programming, and testing of IT-based electronic cyber-lock system to include locksets that will leverage the existing NIST network infrastructure as well as the existing NIST 802.11 b/g/n WIFI network.

A. The existing software system is RS2 AccessIT Universal.NET version 5.5.0.5. The total card count on the server is 9,745 with 5,205 active. On the Production system we currently have:

1. 6 client licenses,

2. 8 Sites,

3. 53 active lock licenses for the wireless readers,

4. Data Exchange,

5. Import/Export,

6. IP Locksets Enabled,

7. Web Client Support,

8. Terminal Server Support,

9. Report Designer,

10. Email/ Paging Integration.

Because the existing Wireless Lock Pilot has been running for almost two years and software changes occur quite frequently, NIST requests that the contractor use the existing software system but would accept alternate software platforms that are able to meet or exceed the list of requirements detailed below. Any system proposed that is unable to meet these requirements will not be considered viable. All costs of an alternate system would include accommodations for the existing 50 locksets and would need to be able to utilize the ASSA ABLOY locksets identified in this SOW.

B. System Requirements if proposing an alternate:

1. The system shall be web based or have a web-based interface.

2. The system shall be capable of utilizing a connection to an authoritative database view and data exchange to import system information, usernames, and other cardholder information such as exists in the current system.

TO1 SOW Page 14

3. The SQL database in the current system would be capable of being imported into the proposed software, ensuring all data migrations were intact and that no record corruption had occurred.

4. The system shall be capable of utilizing role-based access to the software.

5. The system shall not connect to the Internet except when initiated by a system user with an appropriate role.

6. The system shall be capable of updating access to individual locks via a communication mechanism from the server interface such as a schedule.

7. The system should be capable of updating firmware/software for lock groups.

8. The system shall be capable of producing reports in multiple formats but shall be available to view or print from the interface being used to access the system.

9. The system shall be capable of filtering reports based on lock groups/ devices/ by person.

10. The system shall be capable of creating custom reports.

11. The system shall be capable of delegating control of lock groups to authorized system users.

12. The system shall be capable of organizing locks in lock groups.

13. The system shall be capable of managing 10000 or more cardholders.

14. The system shall be capable of receiving and storing events from locks.

15. The system shall be capable of associating user identities with events when the card identifier is received in a lock event.

16. The system shall be capable of logging low/ dead battery conditions at individual locks.

17. The system shall be capable of logging communication issues with individual locks.

18. The system shall be capable of transferring data from doors within 12 hours of the event occurring at the door.

19. The system shall be capable of storing all system data in a relational database.

20. The system shall be capable of utilizing one or more of the following database systems: Microsoft SQL 2012 or higher, Oracle 12c or higher; MySQL 5.7 or higher.

21. The system shall not create separate archive databases when archiving.

22. The system shall be capable of creating a central archive database that can be searched at any time using reports.

23. The system shall only require 3 databases (max) for a fully functional system, including Active, Archive, Wireless Lock Database (if needed).

24. The system shall comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and specified requirements.

25. The system shall comply with all NIST SP 800-53 controls and enhancements applicable to system components and system CIA ratings (low, low, low) for the revision of NIST SP 800-53 in effect at time of system delivery.

26. The system shall enforce approved authorizations for logical access to the system in accordance with applicable policy as required by NIST SP 800-53 AC-3.

27. The system shall enforce a limit determined by policy on the number of consecutive login attempts by a user during a pre-determined by policy time

TO1 SOW Page 15 period; and shall automatically lock the account for a period of time determined by policy when the maximum number of unsuccessful attempts is exceeded as required by NIST SP 800-53 AC-7.

28. The system shall display an approved system use notification prior to granting access to the system as required by NIST SP 800-53 AC-8.

29. The system shall notify the user, upon successful login (access), of the date and time of the last logon (access) as required by NIST SP 800-53 AC-9.

30. The system shall prevent further access to the system by initiating a session lock after a pre-determined amount of inactivity and shall retain the lock until the user re-establishes access using approved identification and authentication procedures as required by NIST SP 800-53 AC-11.

31. The system shall produce audit records that contain sufficient information to, at a minimum, establish what type of event occurred, when (date and time) the event occurred, where the event occurred, the source of the event, the outcome (success or failure) of the event, and the identity of any user/subject associated with the event as required by NIST SP 800-53 AU-3.

32. The system shall use internal system clocks to generate time stamps for audit records as required by NIST SP 800-53 AU-8.

33. The system shall protect audit information and audit tools from unauthorized access, modification, and deletion as required by NIST SP 800-53 AU-9.

34. The system shall:

a. Provide audit record generation capability for the list of auditable events defined by the organization policy satisfying AU-2;

b. Allow designated organizational personnel to select which auditable events are to be audited by specific components of the system; and

c. Generate audit records for the list of audited events defined in the organizational policy satisfying AU-2 with the content as defined in AU-3 as required by NIST SP 800-53 AU-12.

35. The system shall uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) as required by NIST SP 800-53

IA-2.

36. The system shall obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals as required by NIST SP 800-53 IA-6.

37. The system shall be capable of using mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication as required by NIST SP 800-53 IA-7.

38. The system shall uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users) as required by NIST SP

800-53 IA-8.

39. The system shall separate user functionality (including user interface services) from information system management functionality as required by NIST SP 800-

53 SC-2.

TO1 SOW Page 16

40. The system shall implement required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards and guidance as required by

NIST SP 800-53 SC-13.

41. The system shall check the validity of information inputs as required by NIST SP

800-53 SI-10.

42. The system shall:

a. Identify potentially security-relevant error conditions;

b. Generate error messages that provide information necessary for corrective actions without revealing organizationally defined (both the NIST organization and the business unit) sensitive information in error logs and administrative messages that could be exploited by adversaries;

c. Reveal error messages only to authorized personnel as required by NIST SP

800-53 SI-11.

43. The system shall comply with all requirements related to web accessibility as specified in Section 508 of the Rehabilitation Act of 1973.

44. The system shall be capable of reading the CHUID data object from Federal PIV cards.

45. The system shall be capable of reading the 32-digit FASC-N from Federal PIV cards.

46. The system shall use the first five FASC-N fields (16 binary digits) as the unique identifier for Federally issued PIV cards.

47. The system shall be capable of distinguishing between Federally issued PIV cards and Federally issued PIV-I cards.

48. The system shall distinguish between Federally issued PIV cards and Federally issued PIV-I cards by reading the first 14 digits of the FASC-N and shall interpret the card as PIV-I if all 14 digits are the number nine (9).

49. The system shall be capable of reading the CHUID data object from Federal PIV-I cards.

50. The system shall be capable of reading the 32-digit FASC-N from Federal PIV-I cards.

51. The system shall be capable of reading the 128-bit GUID/ UUID from Federally issued PIV-I cards.

52. The system shall use the 128-bit GUID/ UUID as unique identifier for Federally issued PIV-I cards.

53. The system shall be capable of reading the card format from 36-bit proximity cards.

54. The system shall be capable of utilizing a card only access option.

55. The system shall be capable of requiring PIN lengths of 6-8 digits.

56. The system shall be capable of specifying different access options for each lock.

57. The system shall be capable of recording the date and time of each event in the local log.

58. The system shall be capable of recording the type of event in the local log.

59. The system shall be capable of recording the card identifier for an event in the local log when a card is associated with the event.

TO1 SOW Page 17

60. The system shall be capable of overwriting the oldest events in the local log only when the log is full.

61. The system shall be capable of overwriting the oldest events in the local log without any user interaction.

62. The system shall be capable of logging manual key override events at each lock.

63. The system shall be capable of logging access granted events at each lock.

64. The system shall be capable of logging access denied events at each lock.

65. The system shall be capable of logging held-open events at each lock.

66. The system shall be capable of logging forced-open events at each lock.

67. The system shall be capable of logging low battery events at each lock.

68. The system shall be capable of logging communication issues between the lock and server at individual locks.

69. The system shall be capable of storing access privileges for 5000 users at each individual lock.

70. The system should be capable of wired communication using 802.3 wired

Ethernet specifications.

71. The system shall be capable of utilizing 100BASE-TX or better when using wired communication.

72. The system shall be capable of wireless communication using 802.11 wireless LAN specifications.

73. The system shall be capable of utilizing the 802.11b protocol in the 2.4 GHz band.

74. The system shall be capable of utilizing the 802.11g protocol in the 2.4 GHz band.

75. The system shall be capable of utilizing the 802.11n protocol in the 2.4 GHz band.

76. The system shall be capable of utilizing the 802.11n protocol in the 5 GHz band.

77. The system shall not utilize IR technology.

78. The system shall be able to read the PIV, PIV-I, and 36-Bit Prox card information from a single reader.

C. If an alternate software platform is proposed the alternate must include a system test license with all salient features as the primary license but will only ever need a maximum of 50 lock license files to support already installed IN120/IN220 locksets, 8 Sites (Segments), Data Exchange, Import/Export, IP Locksets Enabled, Web Client Support, Terminal Server Support, Report Designer, Email/ Paging Integration, 6 Client Workstations. A designated COR/ TPOC will be provided post award to gain access to the Production and Test VM instances when onsite.

D. The Wi-Fi access control mortise and cylindrical locks to be used are ASSA ABLOY

Manufacturing IN120/ IN220 models.

1. BHMA certified extra heavy duty, lever type mortise/ cylindrical lock conforming to ANSI 156.13 Series 1000, Grade 1 standard and ANSI A117.1 accessibility guidelines.

Electronic motorized locking control of lever handle trim with 3/4" anti-friction deadlocking. UL listed and labeled for up to 3-hour fire rated openings.

2. WiFi access control locking devices interface using field replaceable IEEE 802.11 b/g/n, 2.4 GHz wireless radio connection to an Ethernet Local Area Network (LAN)

TO1 SOW Page 18 facilitating centralized control via a Software Development Kit (SDK). Locks will continue to operate independent of Ethernet (LAN) wireless connection slowdown or failure.

3. Provide access control products with non-volatile memory.

4. Supports WEP, WPA, WPA2, PEAP, EAP-TLS and 802.1x wireless encryption (IEEE

802.11 b/g/n, 2.4 GHz). AES 128 encrypted communication between IP Enabled lock and electronic access control system platform via SDK. Programmable time zone periods, blocked holidays, automatic unlock with or without first entry, minimum of 2,400 user codes and the ability to audit the last 10,000 transactions (event type, date, time, user ID and name). Distributed intelligence allows standalone functional operation of lock in absence of network communication or slowdown allowing for system operational redundancy.

5. Integrated reader supports HID® 125 kHz proximity credentials or ISO 14443 A/B and ISO 15693 13.56 MHz contactless credentials: HID® iCLASS / iCLASS SE (full authentication, all formats), MIFARE Classic and DESFire EV1 (full authentication, all formats); NFC (Near Field Communications) and HID® SIO-Enabled™.

6. Valid/Invalid credential presentation viewable by means of LED indicators on outside escutcheon.

7. Environmental Conditions: Conformally coated weather resistant electronic controller shall meet the following minimum requirements:

a. Operating temperature: -13°F (-25°C) to 151°F (66°C)

b. Operating humidity: < 85% non-condensing

c. Weatherized design suitable to withstand harsh environments with a certified rating of IP55

8. Configuration: Programming of time zone periods, blocked holidays, automatic unlock with or without first entry, and listing 10,000 event transaction history consisting of event type, date, time, user ID and name is required.

a. Provide lock configuration CD tool kit for initial lock set-up and programming via

USB connection.

9. Monitoring: Software accessible monitoring (via SDK) of inside lever handle (Request-to-Exit), door position switch (DPS) integral to the lock (door open/closed status), forced door, unknown card, door held open, battery and tamper.

a. Privacy function initiated from push button on inside escutcheon and cancelled upon activation of valid Request-To-Exit (REX) or user defined credentials.

i. Activation of privacy function is indicated by LED notification on inside escutcheon.

ii. Redundant actuation of privacy button does not deactivate privacy mode.

10. Emergency override access capability by mechanical key cylinder retraction of lock latch bolt without electronic activation necessary.

11. Inside lever retracts latch bolt.

12. Power Source: Powered by 6 AA alkaline batteries with LED indication of locked, programming mode and low capacity warning status conditions.

TO1 SOW Page 19

OTHER UNIQUE REQUIREMENTS

A. Personnel access to these doors shall be managed by the OU end user assigned as the owner of the room. The NIST SSACG will retain an over-arching umbrella-based role mostly for administrative functions such as receiving battery, non-communication, troubleshooting, custom programming, or programming alterations, and reader/system error types of alarms. All persons in the database shall be searchable and found by anyone authorized to access the application by assigning new users to “All Sites”.

Authorized personnel (determined by role) shall only be able to search for a cardholder, locate their record, add or import a card, and assign or remove the appropriate access level for the rooms/ labs they require access to.

B. System Administrators will be given full application access for performing administrative functions. Any communication, configuration, system features, database issues, script problems, or installation issues with the hardware is the responsibility of the contractor.

NIST SSACG as well as NIST OISM, including the COR and/or TPOC shall be available to work with the contractor to find a potential solution, document the problem, enact the solution, and make it permanent. The contractor shall act as the liaison between the government and the manufacturer should there be an issue that requires the manufacturer to address.

C. OU/ Division System Administrators will be given application access for performing administrative functions associated with door locations assigned to their group. Any communication issues with the hardware is the responsibility of the contractor to correct and will be communicated to them via the NIST SSACG as well as NIST OISM, including the COR and/or TPOC. The NIST SSACG as well as NIST Office of Information Systems Management, including the COR and/or TPOC shall be available to work with the contractor to find a potential solution, document the problem, enact the solution, and make it permanent. The contractor shall act as the liaison between the government and the manufacturer should there be an issue that requires the manufacturer to address.

D. The contractor shall be accountable for the identification and purchase of additional licensing features (Lock License Files, Additional workstation logins, and additional features as needed to ensure the lockset communication can occur in a timely and accurate fashion. This shall include a quantity of 8 (E-CLIENT-5P Client license 5 packs), along with the purchase of the locks and other components the contractor is to include as needed to complete this work such as the Lock License File (LLF) for each lock (unless included in the cost of the lock) that will enable the Electronic Access Control System to communicate with the wireless locksets. As well as a system upgrade to a VU-ESSL255 Access It!® Universal - Enterprise Single Server Version Upgrade 255 Sites. Included with this will also be a DS-ESSL255 Access It!® Universal - Enterprise Single Server Direct Support Agreement Annual Fee including Version Upgrade Fee.

TO1 SOW Page 20

WARRANTY

All software, hardware, parts, and labor shall be warrantied for 2 years from COR acceptance date after the installation and testing are complete.

SERVICE CALLS

The contractor shall respond to service/ warranty calls within two (2) business days. Response can be a call, voicemail, or email to cover the issue and schedule someone to be onsite. The contractor shall make every effort to respond as quickly as possible to calls in Gaithersburg, MD and Boulder, CO.

PLACE OF PERFORMANCE

Work under this task order shall take place at both the NIST Gaithersburg, MD campus and the Boulder, CO campuses.

PERIOD OF PERFORMANCE

Task Order period of performance is 12 months from date of task order award.

CONTRACTOR REQUIREMENTS

• RS2 AccessIT Certified Reseller in good standing or certified reseller of proposed alternate software system. This will be verified with RS2 or alternate software system manufacturer

• ASSA ABLOY Certified Integrator for IP Enabled Products. This will be verified with ASSA

ABLOY

CONTRACTOR PERSONNEL REQUIREMENTS

The contractor shall assign a Project Manager to the task order as key personnel.

The contractor shall provide qualified personnel responsible for installation, configuration, programming, and troubleshooting of software, hardware, or components. The following qualifications shall apply to technicians, engineers, and installers, as applicable to the work each individual is proposed to perform. All personnel must meet the following minimum requirements:

• Secret Security Clearance (at a minimum). This will be verified during badge processing

• RS2 AccessIT! Certified to the current version or latest certification provided by the alternate system manufacturer. This will be verified with RS2 or alternate system manufacturer.

TO1 SOW Page 21

SUBSTITUTE PERSONNEL REQUIREMENTS

Non-Key Personnel: Any substitution of personnel must perform the badging actions in the Security and Badging sections as well as meet the requirements listed under Contractor Personnel Requirements. Notification of upcoming personnel substitutions shall be submitted via email to the COR and TPOC no less than- 48 hours prior to substitution, unless already badged.

Any personnel that arrives less than 48 hours prior to the arrival of the notification email will be denied entry.

Key Personnel: Any substitution of personnel must perform the badging actions in the Security and Badging sections as well as meet the requirements listed under Contractor Personnel Requirements.