1333ND24QNB130120_05022024.pdf

RFQ IFB RFP

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODEFACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

DATED . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

17a CONTRACTOR/

OFFEROR.

CODE

8 (A)

SIZE STANDARD:

NAICS:

% FOR:SET ASIDE:UNRESTRICTED OR

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

10. THIS ACQUISITION IS

EDWOSB

SMALL BUSINESS PROGRAM

STANDARD FORM 1449 (REV. 2/2012) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

SCHEDULE Continued

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Base Year

NTE NTE

0001 The Contractor shall provide support for both existing and new security infrastructures at NIST campuses in accordance with the attached Statement of Work.

Billing rates will be added a the time of award.

Period of Performance: 08/08/2024 to 08/07/2025

1.00 LO

Option Year 1

NTE NTE/OPT

0002 The Contractor shall provide support for both existing and new security infrastructures at NIST campuses in accordance with the attached Statement of Work.

Billing rates will be added a the time of award.

Period of Performance: 08/08/2025 to 08/07/2026

Option Year 2

0003 The Contractor shall provide support for both existing and new security infrastructures at NIST campuses in accordance with the attached Statement of Work.

Billing rates will be added a the time of award.

Period of Performance: 08/08/2026 to 08/07/2027

Option Year 3

0004 The Contractor shall provide support for both existing and new security infrastructures at NIST campuses in accordance with the attached Statement of Work.

Billing rates will be added a the time of award.

Period of Performance: 08/08/2027 to 08/07/2028

Option Year 4

0005 The Contractor shall provide support for both existing and new security infrastructures at NIST campuses in accordance with the attached Statement of Work.

Billing rates will be added a the time of award.

Period of Performance: 08/08/2028 to 08/07/2029

PAGE 3 OF 82 1333ND24QNB130120

Table of Contents

Statement of Work

Task Order Procedures

Attachment 1 - Statement of Work - Mock Task Order

Attachment 1A - Mock Task Order Drawings

Attachment 1B - Mock Task Order Drawings

Attachment 1C - Mock Task Order - Drawings

Attachment 2-Wage Determination - Gaithersburg MD

Attachment 3-Wage Determination - Boulder CO

52.202-1DEFINITIONS (JUN 2020)

52.203-3 GRATUITIES (APR 1984)

52.203-5 COVENANT AGAINST CONTINGENT FEES (MAY 2014)

52.203-11 CERTIFICATION AND DISCLOSURE REGARDING PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (SEP

2007)

52.203-12LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (JUN 2020)

52.204-4 PRINTED OR COPIED DOUBLE-SIDED ON POSTCONSUMER FIBER CONTENT PAPER (MAY 2011)

52.204-7 SYSTEM FOR AWARD MANAGEMENT (OCT 2018)

52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (JAN 2011)

52.204-13SYSTEM FOR AWARD MANAGEMENT MAINTENANCE (OCT 2018)

52.204-16COMMERCIAL AND GOVERNMENT ENTITY CODE REPORTING (AUG 2020)

52.204-17OWNERSHIP OR CONTROL OF OFFEROR (AUG 2020)

52.204-18COMMERCIAL AND GOVERNMENT ENTITY CODE MAINTENANCE (AUG 2020)

52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS (DEC 2014)

52.204-20PREDECESSOR OF OFFEROR (AUG 2020)

52.204-24REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT

(NOV 2021)

52.204-25PROHIBITION ON CONTRACTING FOR CERTAIN TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR

EQUIPMENT (NOV 2021)

52.204-26COVERED TELECOMMUNICATIONS EQUIPMENT OR SERVICES--REPRESENTATION (OCT 2020)

52.204-29FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS--REPRESENTATION AND DISCLOSURES (DEC

2023)

52.209-2 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS-REPRESENTATION (NOV 2015)... 55

52.209-5CERTIFICATION REGARDING RESPONSIBILITY MATTERS (AUG 2020)

52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A FELONY CONVICTION UNDER

ANY FEDERAL LAW (FEB 2016)

52.212-1INSTRUCTIONS TO OFFERORS--COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (SEP 2023)

52.212-2EVALUATION--COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV 2021)

Addendum to 52212-1 and 52.212-2

52.212-3OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (FEB

2024)

52.212-4CONTRACT TERMS AND CONDITIONS--COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV 2023)

52.212-5CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS--COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES (FEB 2024)

52.216-1 TYPE OF CONTRACT (APR 1984)

52.216-18ORDERING (AUG 2020)

52.216-19 ORDER LIMITATIONS (OCT 1995)

52.216-22 INDEFINITE QUANTITY (OCT 1995)

52.216-27 SINGLE OR MULTIPLE AWARDS (OCT 1995)

52.216-31TIME-AND-MATERIALS/LABOR-HOUR PROPOSAL REQUIREMENTS -- COMMERCIAL ACQUISITION (NOV 2021)... 71

52.216-32 TASK-ORDER AND DELIVERY-ORDER OMBUDSMAN (SEPT 2019)

52.217-5 EVALUATION OF OPTIONS (JUL 1990)

PAGE 4 OF 82 1333ND24QNB130120

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

52.219-1SMALL BUSINESS PROGRAM REPRESENTATIONS (FEB 2024)

52.223-5 POLLUTION PREVENTION AND RIGHT-TO-KNOW INFORMATION (MAY 2011)

52.223-6 DRUG-FREE WORKPLACE (MAY 2001)

52.224-1 PRIVACY ACT NOTIFICATION (APR 1984)

52.224-2 PRIVACY ACT (APR 1984)

52.227-1AUTHORIZATION AND CONSENT (JUN 2020)

52.227-2NOTICE AND ASSISTANCE REGARDING PATENT AND COPYRIGHT INFRINGEMENT (JUN 2020)

52.227-3 PATENT INDEMNITY (APR 1984)

52.227-14 RIGHTS IN DATA--GENERAL (MAY 2014)

52.227-17 RIGHTS IN DATA--SPECIAL WORKS (DEC 2007)

52.232-7PAYMENTS UNDER TIME-AND-MATERIALS AND LABOR-HOUR CONTRACTS (NOV 2021)

52.232-2 PAYMENTS UNDER FIXED-PRICE RESEARCH AND DEVELOPMENT CONTRACTS (APR 1984)

52.232-8 DISCOUNTS FOR PROMPT PAYMENT (FEB 2002)

52.232-18 AVAILABILITY OF FUNDS (APR 1984)

52.232-23 ASSIGNMENT OF CLAIMS (MAY 2014)

52.232-25 PROMPT PAYMENT (JAN 2017)

52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUNE 2013)

52.232-40PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS (MAR 2023)

52.233-1 DISPUTES (MAY 2014)

52.233-3 PROTEST AFTER AWARD (AUG 1996)

52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (OCT 2004)

52.237-2 PROTECTION OF GOVERNMENT BUILDINGS, EQUIPMENT, AND VEGETATION (APR 1984)

52.237-3 CONTINUITY OF SERVICES (JAN 1991)

52.242-13 BANKRUPTCY (JUL 1995)

52.242-15 STOP-WORK ORDER (AUG 1989)

52.242-17GOVERNMENT DELAY OF WORK (APR 1984)

52.244-2SUBCONTRACTS (JUN 2020)

52.245-1GOVERNMENT PROPERTY (SEP 2021)

52.245-9 USE AND CHARGES (APR 2012)

52.246-4 INSPECTION OF SERVICES--FIXED-PRICE (AUG 1996)

52.246-6 INSPECTION--TIME-AND-MATERIAL AND LABOR-HOUR (MAR 2001)

52.246-15 CERTIFICATE OF CONFORMANCE (APR 1984)

52.249-14 EXCUSABLE DELAYS (APR 1984)

52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

52.253-1 COMPUTER GENERATED FORMS (JAN 1991)

1352.201-70 CONTRACTING OFFICER?s AUTHORITY (APR 2010)

1352.201-72 CONTRACTING OFFICER`S REPRESENTATIVE (COR) (APR 2010)

1352.208-70 RESTRICTIONS ON PRINTING AND DUPLICATING (APR 2010)

1352.209-72 RESTRICTIONS AGAINST DISCLOSURE (APR 2010)

1352.209-73 COMPLIANCE WITH THE LAWS (APR 2010)

1352.209-74 ORGANIZATIONAL CONFLICT OF INTEREST (APR 2010)

1352.215-73 EVALUATION QUANTITIES-INDEFINITE QUANTITY CONTRACT (APR 2010)

1352.216-74 TASK ORDERS (APR 2010)

1352.216-75 MINIMUM AND MAXIMUM CONTRACT AMOUNTS (APR 2010)

1352.216-76 PLACEMENT OF ORDERS (APR 2010)

1352.216-77 CEILING PRICE (APR 2010)

1352.228-70 INSURANCE COVERAGE (APR 2010)

1352.231-71 DUPLICATION OF EFFORT (APR 2010)

PAGE 5 OF 82 1333ND24QNB130120

1352.233-70 AGENCY PROTESTS (APR 2010)

1352.233-71 GAO AND COURT OF FEDERAL CLAIMS PROTESTS (APR 2010)

1352.237-70 SECURITY PROCESSING REQUIREMENTS - HIGH OR MODERATE RISK CONTRACTS (APR 2010)

1352.237-75 KEY PERSONNEL (APR 2010)

1352.239-72 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY RESOURCES (APR 2010)

1352.245-70 GOVERNMENT FURNISHED PROPERTY (APR 2010)

1352.246-70 PLACE OF ACCEPTANCE (APR 2010)

NIST LOCAL-41SOFTWARE LICENSE ADDENDUM

NIST LOCAL-53CONTRACT PERFORMANCE DURING CHANGES IN NIST OPERATING STATUS

NIST LOCAL-55ELECTRONIC BILLING INSTRUCTIONS FOR DELIVERY/TASK ORDERS

NIST LOCAL-56INVOICING PROCESSING PLATFORM-ALTERNATE I (DEC 2022)

PAGE 6 OF 82 1333ND24QNB130120

CLAUSES

Statement of Work

PAGE 7 OF 82 1333ND24QNB130120

STATEMENT OF WORK

Emergency and Security Services

BACKGROUND

The U. S. Department of Commerce, National Institute of Standards and Technology (NIST) has a campus located in Gaithersburg, MD. The Gaithersburg Campus is approximately 578 acres, constructed in the 1960’s, that is a secure federal facility closed to the public, that consists of multiple buildings with a perimeter fence.

The campus has a Lenel OnGuard Physical Access Control System (PACS) with approximately 600 card readers and various auxiliary alarm points that was installed in 2003. The campus has a Milestone Video Management System (VMS) with 200 cameras that are IP based. Both systems are operating on a separate, isolated security network on Cisco routers and switches placed throughout the buildings on campus. NIST/Office of Information Systems Management (OISM) performs the Security Assessment & Authorization (SA&A) internally and the Security Systems Access Control Group performs all necessary Plan of Action & Milestone (POA&M) remediation.

The NIST Emergency Services Office (ESO) manages and maintains all aspects of the security system. The system consists of the Security Network, Physical Access Control System (PACS) and Video Management Systems (VMS). This is an accredited information technology system certified to operate on-site. The database contains Privacy Act information, as well as controls for the protection of high-value assets and classified material located on-site.

PERIOD OF PERFORMANCE

The period of performance for this contract is one Base Year plus four (4) Option Years, totaling five (5) years as follows:

Base Year: 8/08/2024 – 8/07/2025 Option Year 1: 8/08/2025 – 8/07/2026 Option Year 2: 8/08/2026 – 8/07/2027 Option Year 3: 8/08/2027 – 8/07/2028 Option Year 4: 8/08/2028 – 8/07/2029

OBJECTIVES

The Government requires Contractor’s support for the current and future needs of the Security Systems and Access Controls Group within ESO. This indefinite delivery/indefinite quantity (IDIQ) contract aka “contract” would provide flexibility in the maintenance and other support contracts for the PACS, VMS, Key Management System (KMS), among other primary and secondary systems used on campus.

PAGE 8 OF 82 1333ND24QNB130120

In order to maintain the security infrastructure, some equipment that will be utilized under this contract must be brand-name equipment. The following brand name equipment will be required on an as-needed basis:

Lenel Milestone

AXIS

Broadcom/Symantec

ASSA ABLOY

Microsoft Cypress And others…

The requirement to utilize brand-name-only equipment or approved alternatives includes all the following:

Task Orders issued under this Contract shall be inclusive of wiring, labor, external components, devices, monitors, tools, spare parts, furniture, and the fiber-optic backbone across the campus. To solicit support from any non-approved source could cause a delay in services being restored to working order, could result in putting the existing licensing or warranties at risk, and could obligate the Government to incur additional costs or have additional technical support concerns.

Because of the way IP based devices are assigned MAC addresses, manufacturers utilize MAC addresses that are recognizable by the software systems. NIST security systems are sophisticated enough to know what is and what is not an authorized device. Non-recognized devices or devices that require different or additional licensing will not work on the system and shall not be accepted without prior review and approval from the Contracting Officer’s Representative (COR). New software licensing as well as licensing renewals shall not be purchased from any vendor other than the software manufacturer unless explicitly stated or accepted by the COR. Any purchased equipment must be 100% compatible and interchangeable with existing NIST equipment that is currently in use due to integration efforts with other existing software platforms.

SCOPE

The Contractor must demonstrate that they, including proposed consultants and/or subcontractors, collectively or individually (depending on how the certification is issued), meet all the following mandatory requirements.

The Contractor and/or members of their staff must collectively meet these requirements and maintain them and remain in “Good Standing” over the life of the contract:

Lenel OnGuard Value Added Reseller RS2 Reseller ASSA ABLOY Authorized Channel Partner HSPD-12 Certified Systems Integrator UL 2050 Standards Certification Milestone Reseller

Qualified personnel are responsible for installation, configuration, programming, or troubleshooting of hardware components.

Some or all of the following qualifications shall apply to technicians, engineers, and installers, as applicable to the work everyone is proposed to perform:

PAGE 9 OF 82 1333ND24QNB130120

Security Clearance (minimum SECRET) Certified Lenel OnGuard version 8.0 or later o Lenel Certified Associate o Lenel Certified Professional o Lenel Certified Expert (Access Control) o Lenel Certified Professional (Video) o Lenel Certified Expert (Video) o Current distance learning completion for Lenel OnGuard version 8.0 or later

RS2 (aka ACRE Security) o AccessIT Essentials (minimum)

ASSA ABLOY Certified Integrator HSPD-12 Certified Systems Integrator UL 2050 NISSC Standards Certification o National Industrial Security Systems (CRZH) minimum o National Industrial Monitoring Station (CRZM)

HARDWARE REQUIREMENTS

All hardware/equipment must be Trade Agreement Act (TAA) and/or Defense Authorization Act (DAA) compliant, unless COR’s written approval for a deviation is obtained.

Physical Access Control Systems and components shall be listed under the approved section of the GSA Approved Products List - /FIPS 201/ Approved 13.01 Topology PACS Products List unless COR’s written approval for a deviation is obtained.

https://www.idmanagement.gov/fips201/

Card readers must be GSA Approved Product List (APL) approved (cannot be “awaiting approval”).

GENERAL REQUIREMENTS

This Contract may be utilized by any of the organizations at the NIST Gaithersburg and Boulder campuses, to implement the NIST Special Publication 800; Specifically, the (SP800-116, SP800-53) series of documents, and the Federal Information Processing Standards Publications (FIPS).

Federal Information Processing Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules, specifies the security requirements that must be satisfied by the cryptographic module utilized within a security system protecting sensitive information within computer and telecommunications systems (including voice systems). The standard provides four increasing, qualitative levels of security: Level 1, Level 2, Level 3, and Level 4. These levels are intended to cover the wide range of potential applications and environments in which cryptographic modules may be employed.

Products validated as conforming to FIPS PUB 140-2 are required by the Federal agencies for the protection of sensitive information (United States) or designated information (Canada).

The FIPS Publication Series from NIST is the official series of publications relating to standards and guidelines adopted and promulgated under the provisions of the Federal Information Security Management Act. The FIPS 201-2 documentation specifies the requirements for the common identification standard for Federal employees and Contractors.

PAGE 10 OF 82 1333ND24QNB130120

The FIPS 140-2 document series is geared towards achieving the proper security assurance for the application of verifying the identity of individuals seeking physical access to government facilities and logical information systems.

The Contractor must be familiar with FIPS, and how the implementation of FIPS affects the required work regarding the application of the Homeland Security Presidential Directive 12 (HSPD 12), to comply with FIPS 201-2 processing. The following statement shall apply to work performed under this contract:

“This Standard specifies the architecture and technical requirements for a common identification standard for Federal employees and Contractors. The overall goal is to achieve appropriate security assurance for multiple applications by efficiently verifying the claimed identity of individuals seeking physical access to Federally controlled government facilities, and logical access to government information systems.”

Contractor shall employ staff that have a minimum of a "Secret” clearance for support of UL 2050 CRZH certified supporting/servicing for Secure Compartmented Information Facility (SCIF), in compliance with Intelligence Community Directive (ICD- 705) regulations and methodologies. ICD-705 information can be found at: https://www.dni.gov/files/documents/ICD/ICD 705 SCIFs.pdf

Contractor shall utilize products and services approved for use by the General Services Administration (GSA) Approved Products List (APL).

Should the Contractor be required to have off-site access to NIST-owned data or information that has been determined to carry a low, moderate, or high risk, in accordance with Department of Commerce Regulations, NIST will provide the Contractor with a NIST-owned encrypted laptop to access the data. At no time shall the Contractor download, transfer, or access (in any form), data on a non-Government computer, without the prior written approval of the Contracting Officer.

Should the Contractor be required to have on-site access to hard copy NIST-owned data or information that has been determined to carry a low, moderate, or high risk, in accordance with Department of Commerce Regulations, NIST shall provide the Contractor with a reading room at NIST campus. At no time shall the Contractor remove such data or information from NIST site without the prior written approval of the Contracting Officer.

REQUIRED TRAINING

Specific training must be completed by Key Personnel prior to NIST permitting any key personnel access to the Lenel, Milestone, Traka, Symantec, and other applications. This training shall require a background check, in addition to a determination to be made by authorized NIST personnel providing the training. This training is mandatory for all Key Personnel. This training takes place on-site at the NIST campus and will last less than four (4) hours. More details regarding this training and how to schedule the training shall be provided post award. Key Personnel who do not receive a favorable determination after this training shall not be permitted to access the systems, and a replacement individual shall be provided.

KEY PERSONNEL

Project Manager will be key for the IDIQ and task orders if it Is determined to be necessary. Key personnel requirements for individual task orders will be stated in the respective task order. However, the contractor shall be prepared to provide personnel with the following certifications:

Other Senior, Lead, and technician positions.

PAGE 11 OF 82 1333ND24QNB130120

o TS minimum cleared personnel o Lenel OnGuard 8.2 (or greater) Certified Personnel o ASSA ABLOY Integrated Wiegand and IP Enabled Locksets Certified Personnel o CSEIP Certified Personnel o RS2 Access-IT Certified Personnel o Milestone VMS Certified Personnel

Certifications are cumulative. Every technician does not have to have every certification.

o But all personnel listed as Key Personnel need to have all of those certifications together.

PROJECT MANAGER

Contractor shall assign a Project Manager (PM), who shall have complete authority to act for the Contractor over the life of the contract, including all task orders, and shall be responsible for all matters relating to the contract and task orders. The PM shall be scheduled to ensure his/her presence during normal business hours of the facility as required to meet the terms of any given task order and provide adequate on-site supervision of company employees and projects. The PM shall be available to receive requests for information or special instructions from the COR concerning matters that affect the project.

SAFETY CONCERNS/REQUIRED PERMIT

If any cutting, welding, grinding, or other similar operations are done, measures must be taken to protect near-by equipment from smoke, sparks, grit, and any other residue generated. The Contractor shall not weld or cut prior to the issuance of a Weld and Burn permit from the NIST Fire Department.

The COR will be responsible for obtaining this permit. The Contractor must notify the COR at least one

(1) day in advance of any welding or cutting to ensure the permit is in hand.

ADDITIONAL REQUIREMENTS SPECIFIC TO RADIOACTIVE ENVIRONMENTS

Task orders may require work in a NIST-controlled area. Contractor personnel shall not enter the worksite unless they are approved for unescorted access or escorted by NIST personnel. NIST personnel shall be available to escort Contractor personnel as required. No food or drink shall be permitted in these work areas.

All work must be performed in accordance with applicable specifications from the Occupational Safety and Health Administration (OSHA).

The Contractor shall have the ability to support, install, repair, and troubleshoot devices and countermeasures related to 10 CFR Part 37 with special emphasis of Subparts B and C found at https://www.nrc.gov/reading-rm/doc-collections/cfr/part037/.

All tools and equipment brought into the worksite must be cleared through the NIST Health/Physics office. This clearance could take several hours. Tools and equipment include ALL tools and equipment that will be utilized at the job site that could become contaminated. NIST recommends that the

PAGE 12 OF 82 1333ND24QNB130120

Contractor leave all tools and equipment on-site during the period of performance whenever possible to avoid duplicate inspections and unnecessary delays.

All material removed and leaving buildings must be cleared by the NIST Health/Physics Office before it can leave the site. If any contamination is found, NIST will be responsible for cleaning it. NIST will be responsible for disposal if the item cannot be cleaned, however, will not replace the equipment.

ROUTINE SERVICE CALLS

A routine service call is when an event occurs that may be causing an issue with access, alarms, error messages, failed transactions, etc. with the PACS, VMS, Wireless Locks, or Network that is not causing a degraded monitoring or reporting issue.

Critical Systems at Gaithersburg Campus include:

The Lenel System Servers, databases, RAID configurations

Security Network (fiber and copper)

Domain Controller

Milestone Video Management System (Servers and Workstations)

Traka Key Management System

NIST Cyberlock Project

Cypress Wireless Readers

RMS Systems

The Government reserves the right to add or remove systems and/or equipment within the scope of this statement of work via contract or task order modification.

MEETING AND REPORTING REQUIREMENTS

A project kickoff meeting shall be conducted with the NIST COR, NIST Security Team, and the Contractor to discuss the project requirements. The COR will organize and facilitate the kickoff meeting.

The contractor shall participate in and attend weekly progress meetings online or in-person on the NIST Gaithersburg Campus as a part of awarded task orders. These meetings shall be utilized for scheduling and coordinating with other trades, as well as ensuring the security installation schedule coincides with the General Contractor’s schedule.

TASK ORDERS

Task Orders issued under this Contract shall be on a firm-fixed-price, labor hour and/or time-and-materials basis dependent on which better fits the needs of the agency.

The contractor shall perform a walk through before onsite installation work starts for each Task Order issued. Upon completion of a fixed price repair, the Contractor shall test and guarantee the full system functionality and performance relevant to the repair that was completed. The Contractor shall make necessary arrangements to remove all trash generated in executing task orders. NIST will not provide a dedicated trash dumpster since those are already available on-site.

Any of the following work may be required under any given task order:

PAGE 13 OF 82 1333ND24QNB130120

Maintenance and Support

The Contractor shall provide maintenance and support of the PACS and VMS Systems, including the security network, attached devices, and components located on both campuses.

New Installations

The Contractor shall provide new installations, additions/modifications to the existing infrastructure, additions related to new construction, remodeling, or changes and additions required to address findings and remediation efforts.

Telephone Support

The Contractor shall provide technical and maintenance support, via phone, for products and services for all aspects of the NIST Security Systems. Telephone support shall include responses to questions about operating practices, application use, and service issues that can be diagnosed and resolved using telephone or email communications.

Help Desk Support

The Contractor shall provide help desk support for service calls to be reported. This support shall be available 24/7. The Contractor shall provide instruction to authorized NIST personnel to troubleshoot or perform repairs on software, electrical, electronic, mechanical equipment, and systems connected to the NIST Security Systems.

Routine Service Calls

The Contractor shall be on-site at the NIST Gaithersburg Campus, not later than 24- hours after the time of the telephonic or email notification of the need for a routine service call.

The Contractor shall respond during regular business hours only for routine service calls. However, during weekends, NIST will contact the help desk to schedule a technician to be onsite the next business day.

For a routine service call, the Contractor shall provide as many on-site visits as needed to the NIST site, to evaluate and analyze system equipment failures, as reported, and provide the results of such analysis to the COR and diagnose the problem.

If the diagnosed issue can be repaired at the time of the visit, using parts in the possession of the Security Systems and Access Control Group, the repair shall be made, and a record of the reported issue and the time spent addressing the issue shall be provided to the NIST COR before the technician departs.

If the parts needed to make the repairs are not available, the Contractor shall document their findings and possible solutions. From the diagnosis, the Contractor shall provide a firm-fixed-price quotation for

PAGE 14 OF 82 1333ND24QNB130120

the repair including all parts and labor. Parts and labor shall be itemized separately on the quotation.

The Government will review the quotation provided by the Contractor. If the Government decides to proceed with the repair, the Contracting Officer will issue a task order to complete the repair. The COR will schedule a date and time for the Contractor to return to NIST to complete the repair.

Preventive Maintenance

The Contractor shall provide routine preventative maintenance for the systems. Preventive maintenance may include, at a minimum, production of on-site maintenance logs and telephone service call logs, to ensure all parties involved are aware of the system status.

Any of the following work may be required under preventative maintenance:

Review and Verify:

• Backup routines for the access control systems to ensure they are configured properly and running as intended

• Size of the active database/archive database and backup generation time length

• Database clean-up tasks

• HDD or storage array free space and growth estimates

• Failed or failing hard disk drives, memory, physical drives, fans, printed circuit boards, LED and LCD screens, fiber optics, fiber SFP modules, network switches, routers, computers and all peripherals

• Errors related to service or system crashes stored in the system or application logs

• System connectivity

• Network topology and design for purpose in which it is intended to serve

• All critical patches, firmware releases, licenses, and software updates are valid and current for all installed applications and integrations

• Any and all batteries associated with UPS units, Access Control Panels, Power supplies, etc.

Clean/Adjust and Inspect:

• Camera Domes, Lenses, and connections

• Computer, VCD, Server, network switch, network switch cabinets, and cooling fans

• All monitors, mice, and keyboards including those used by the dispatchers

• Filters or filter media associated with movable desks and other storage enclosures

The Government will request a quotation for preventive maintenance service and may issue a task order for preventive maintenance service to be performed.

Design/Engineering Services for New Installations

PAGE 15 OF 82 1333ND24QNB130120

The Contractor shall provide system design/engineering services regarding new installations. The Contractor shall provide services for the design and implementation of new access control, video management, network, and other security related installations in buildings that are under construction (as needed).

The effort associated with these activities shall be limited to providing recommendations, or guidance on products and best practices for the type of installation or security level at NIST. This may involve working jointly with the COR on floorplans, conduit drawings, system design documents, power requirements, and UPS calculations.

Assessment and Compliance Reviews

The Contractor shall conduct reviews of the NIST/OISM discovered vulnerabilities which will be sanitized and provided by the COR. The Contractor shall ensure that each project meets or exceeds the minimum standards for Authorization and Accreditation (A&A) that are performed annually by the NIST/OISM. The A&A standards can be reviewed by downloading and reviewing the secure configurations following the USGCB guidelines which can be found at https://usgcb.nist.gov/.

The Contractor shall perform an assessment of the NIST Gaithersburg & Boulder campuses to gather all necessary information pertaining to the NIST Security Systems and current Policies and Procedures currently in place to be able to provide a complete and detailed recommendation for the improvement of NIST's physical security posture.

The Contractor shall review all aspects of the Security System to include, but not be limited to the PACS, VMS & Security Network Infrastructure. The Contractor shall document and identify any system enhancements that the contractor would recommend implementing for designing an Enterprise system solution.

The Contractor shall develop detailed recommendations that shall outline all system enhancements recommended for implementation to improve security posture. All enhancements recommended must cover the PACS, VMS, Security Network & Policies and Procedure documentation, at a minimum.

Software Licenses

Task orders may be issued for any or all the following NIST-owned software packages:

Lenel OnGuard 8.0 (or current)

Milestone

Broadcom/ Symantec

Traka

RS2/ ASSA ABLOY

The above list is subject to change via contract modification based on NIST’s systems needs.

PAGE 16 OF 82 1333ND24QNB130120

WARRANTY

Contractor shall provide a one-year parts and labor warranty from date of project completion unless otherwise agreed to in writing.

HOURS OF OPERATION AND FEDERALLY OBSERVED HOLIDAYS

Services are normally not performed on federal holiday’s unless required. Should NIST require service on a designated federally observed holiday, it would be authorized for the convenience of the Government upon request by the COR and written approval by the Contracting Officer. If the Contractor elects to work on a federal holiday, services shall be rendered to the Government with no additional compensation.

When administrative leave is granted to Government employees as a result of inclement weather, potentially hazardous conditions, or by other special circumstance, etc. the Contractor shall be dismissed without loss of pay.

Normal Hours of Operation: Monday through Friday, 8:00 AM to 4:00 PM.

Federally Observed Holidays:

New Year’s Day

Martin Luther King Birthday

Presidents Day

Memorial Day

Juneteenth

Independence Day

Labor Day

Columbus Day

Veterans’ Day

Thanksgiving Day

Christmas Day

Task Order Procedures

PAGE 17 OF 82 1333ND24QNB130120

This section sets forth procedures and criteria that will be used to award task orders against this indefinite delivery/indefinite quantity (IDIQ) contract.

(a) A request for quotation (RFQ) package will be forwarded to the Contractor. The following documents will be included in the request for quotation package at a minimum:

1. The specifications, statement of work, and/or all associated attachments;

2. The due date for quotations;

3. The anticipated contract type for the intended task order;

4. The period of performance for the required services and/or the timeline for delivery of parts and/or equipment.

(b) Written solicitation packages will be sent, via e-mail, to the Contractor’s Project

Manager. Solicitations will identify a due date & time for quotes. Submission of quotations, via e-mail, shall be acceptable.

When submitting an e-mail response, the Contractor agrees to be bound by the originator of the e-mail the same as if submitted under an original signature.

All submissions must be received on or before the due date and time specified in the RFQ.

Information received after the due date and time will be considered late and will not be considered.

Response times may vary for quotations; however, the Government anticipates that a response time of between three and five days from the date the quotation is forwarded via email, will be permitted, at a minimum.

(c) Upon receipt of the Request for Quotation Package, the Contractor shall prepare a technical quotation and a price quotation. The technical and price quotations must be submitted to the Government on or before the date and time specified in the RFQ.

Technical Quotation

The Contractor shall submit a technical summary of the work to be performed. The

Contractor shall discuss the proposed strategy or strategies that will be utilized to perform the required work and complete the required deliverables.

The Contractor shall submit the name or names of the key personnel that will be performing the required work. Only the individuals that have been designated as key personnel will be authorized to complete the required work.

The technical summary shall be limited to five pages.

Price Quotation

The request for quotation will indicate whether a firm fixed price or time and materials type task order will be awarded. The quotation shall include all costs necessary to complete the required work. This includes, at a minimum:

(1) Labor Category;

(2) Labor Rate;

(3) Number of hours;

(4) Other direct costs listed by category with unit prices and total amount(s).

Travel, subsistence and local transportation shall be supported with a breakdown which includes: number of trips anticipated, cost-per-trip-per-person, destination(s) proposed, number of person(s) scheduled for travel, mode of transportation, and mileage allowances if privately-owned vehicles will be used.

(5) Materials: Cost breakdown of materials or equipment must be supported with the methodology used and vendor quotations supplied as requested by the Government.

(6) Consultants: If consultants are proposed, state the amount of service estimated to be required and the consultant's quoted daily or hourly rate.

(7) Subcontracts: If proposed, price information for each subcontractor shall be furnished in the same format and level of detail as prescribed for the prime

PAGE 18 OF 82 1333ND24QNB130120

offeror.

(8) The Government reserves the right to request copies of subcontractor and/or Consultant agreements entered into between the parties, and/or appropriately redacted copies of invoices submitted by the party(ies) for similar services previously provided to the Contractor.

(d) The quotation shall be reviewed by the Contract Specialist, the Contracting

Officer’s Representative (COR), and/or other authorized NIST Technical Personnel. If it is determined to be in the best interest of the Government, the Contract Specialist and/or the Contracting Officer will enter discussion with the Contractor.

If discussions are conducted, a revised quotation will be requested. The revised quotation will be re-evaluated by the Government.

The quoted price will be evaluated for reasonableness and to ensure that the price quotation is consistent with the technical quotation.

The Contractor shall submit its best quotation in responding to individual Requests for

Quotation, as the Government prefers to award without discussions.

(e) Every order placed under the IDIQ will be separately evaluated for price reasonableness by the Contracting Officer.

(f) Upon completion of evaluation, the Contracting Officer may issue a task order.

(g) Upon receipt of an executed task order, the Contractor shall commence work as required by that order.

(END OF CLAUSE)

Attachment 1 - Statement of Work - Mock Task Order

PAGE 19 OF 82 1333ND24QNB130120

STATEMENT OF WORK

INTRODUCTION

The U. S. Department of Commerce, National Institute of Standards and Technology (NIST) has main campus locations in Gaithersburg, MD and in Boulder, CO. The Gaithersburg, MD campus is approximately 578 acres, constructed in the 1960’s, that is a secure federal facility, closed to the general public, that consists of multiple buildings with a perimeter fence with three gates.

The Gaithersburg, MD campus has a Lenel OnGuard Physical Access Control System (PACS) with approximately 600 card readers and various auxiliary alarm points that was installed in 2003. The campus has a Milestone XProtect Video Management System (VMS) with approximately 200 cameras that are primarily IP based. Both systems are running on a separate, isolated Security Network on Cisco Routers/Switches placed throughout the buildings on campus.

NIST’s Office of Information Systems Management (OISM) performs the Security Assessment & Authorization (SA&A) internally and the Security Systems Access Control Group performs all necessary Plan of Action & Milestone (POA&M) remediation for security systems on both campuses.

The NIST Emergency Services Office (ESO) manages and maintains all aspects of the security system. The system consists of the Security Network, Physical Access Control System (PACS) and Video Management Systems (VMS). This is an accredited information technology system certified to operate on site. The database contains Privacy Act information, as well as controls for the protection of high value assets and classified material located on site.

Following a campus security assessment, ESO has identified several security improvements required across multiple buildings on and around the Gaithersburg Campus. The intent of this project is to provide additional security countermeasures to address some of the most critical issues.

PERIOD OF PERFORMANCE

The period of performance is 12 months from August 8, 2024 through August 7, 2025.

OBJECTIVES

1 |

PAGE 20 OF 82 1333ND24QNB130120

NOTE: Throughout this document, the words “Contractor” and “Security Contractor” are used interchangeably.

The Contractor shall install physical security system improvements for Building 33, Building 106, and Building 10 on the NIST Gaithersburg campus.

The Contractor shall provide a turnkey system as described herein and shall be responsible for installing all new security system components and ancillary equipment to support the Physical Access Control System, Video Management System, and Intrusion Detection System (IDS).

The physical security components shall support automated security functions and improve upon the existing policies and procedures for the campus secured areas. All enhancements shall expand upon the existing air-gapped security network that supports the Lenel Physical Access Control System and Milestone XProtect Video Management System.

No additional Lenel OnGuard licensing shall be required to support the additional components and programming needs of this project.

The project will be broken out into the following tasks:

Task 1 – Building 33 Task 2 – Building 106 Task 3 – Building 10

Some liberties will need to be assumed unless stated otherwise such as:

drawing scale.

number of walls or floors needing to be scanned and core drilled.

asbestos and lead paint are not a concern.

SCOPE OF WORK

Installation Specific Requirements

a. Attachments A - C includes drawings detailing new security device locations and pathways for each of the tasks mentioned above. New conduit pathways detailed on these drawings are suggested pathways; however, alternate pathways can be proposed by the contractor as appropriate.

b. Any contractor personnel performing VMS system configuration or programming must be certified for the Milestone XProtect VMS. Contractor shall be responsible for providing copies of these certifications upon request.

c. Any contractor personnel performing Lenel OnGuard configuration or programming as part of this project must be certified for Lenel OnGuard version 8.0 or later.

2 |

PAGE 21 OF 82 1333ND24QNB130120

d. Contractor shall provide any removed security equipment to NIST ESO Security Systems and Access Control Group (SSACG).

e. All Security hardware panels installed shall be new and shall be the newest version (Series 3), for the Lenel PACS system on version 8.0. The hardware shall be capable of supporting the Lenel embedded “PAM (PIV Authentication Module) in Panel” solutions for future (Federal Identity, Credential, and Access Management) FICAM capabilities.

f. All card readers shall be the HID PIV Class series, shall support a combination of 125 kHz (Proximity) and 13.56 MHz (PIV) cards, and shall be compatible with the Lenel embedded “PAM in Panel” solution for future FICAM capabilities, if additional required software components are purchased. Readers must be configured to read the 14-digit Federal Agency Smart Credential Number (FASC-N) identifier of PIV cards with 200-bit format. Any reader spacers or alternate measures required to ensure proper reader functionality and read range shall be provided and configured by the contractor.

g. All headend panel enclosures shall be secured by key, equipped with tamper switches, and be connected to the Lenel system for monitoring purposes. All cabinet tamper switches shall be terminated to a local Intelligent System Control (ISC) board tamper terminal if present, or to an Input Control Board input point if not present.

h. All security wiring shall be installed in EMT conduit for cabling protection unless otherwise noted within the SOW. The Contractor shall be responsible for installing any conduit and/or junction boxes not already in existence. All conduit installation shall be in accordance with national and local code requirements. Appropriately sized boxes shall, at a minimum, be installed every 100’, within 10’ of connected devices, and at any building penetrations to facilitate installation of future cabling and devices. The contractor shall leave a pull string within any installed conduit after the installation of cabling.

i. End of Line (EOL) supervision shall be installed on all devices that are connected to an input point on the PACS or IDS System. The supervision must be installed at the “End of Line” device location to monitor for tampering of the cabling and wire connections.

j. All input points shall be individually terminated to an address/zone and separately identified.

This includes motion sensors, duress buttons, intrusion alarms, supervisory alarms, emergency egress buttons, power loss, communication failure, etc. The only exceptions to this will be a single set of double doors or glass break sensors within the same room area, which may be zoned as one individual point.

k. PACS and IDS System low voltage power supplies shall have the “Low Battery” & “AC Loss” output alarms wired into the Lenel system for monitoring purposes. These points shall be connected to an Input Control Board. Low voltage power supplies shall also have low voltage cut off regulators to automatically drop voltage in the event of a low battery condition.

l. Where possible, security equipment shall be connected and attached to dedicated electrical circuits connected to building UPS and/or generator backup.

m. The Contractor shall provide and utilize the appropriate Personal Protective Equipment (PPE) for the project within any construction or industrial work zones. At a minimum, the

3 |

PAGE 22 OF 82 1333ND24QNB130120

installation team shall wear hard hats, safety glasses, safety vest, hard toe boots and gloves, as necessary, when working within these areas.

n. The contractor is required to follow all applicable NIST safety requirements and procedures.

o. For any auxiliary input/output device not associated with a card reader door, the contractor shall provide cabling with a spare conductor pair.

SPECIFIC TASKS

TASK 1 BUILDING 33 SECURITY ADDITIONS

The contractor shall provide and install new PACS and VMS equipment within Building 33.

Main Lobby Camera

The contractor shall provide and install a new fixed dome camera (Axis P3267-LVE or Equivalent) at the location shown in the Attachment A Drawing for Building 33, 1st Floor lobby area. This camera shall be aimed and focused to watch the LO-A-1 Lobby A inner entry doors and entry card reader. The contractor shall provide new Milestone XProtect Corporate licensing with 1 year of manufacturer direct support for this camera.

Cabling for this new camera shall be installed within existing open riser pathways between the existing 002-1 Closet up to the 102 AV Closet. From there to the new camera location, the contractor shall install cabling within new conduit. The camera shall be powered via Power over Ethernet (PoE).

Emergency Exit Door Contacts and Sounders

The contractor shall provide and install new security contacts and acoustic sounders at Building 33 basement level ST-13-0 and ST-14-0 exterior doors and the 1st Fl. ST-1A-1 exterior door.

The contractor shall provide and install new LNL-1100-S3 and LNL-1200-S3 within existing 002-1 Signal Closet panel space to support these new devices. The contractor shall also provide and install an Altronix LPD module, and PD8 power distribution board connected to the existing 12VDC power supply at this location.

Cabling for these new devices shall connect back to the 002-1 security panel location through a combination of existing and new conduit as detailed in Attachment A.

TASK 2 BUILDING 106 SECURITY ADDITIONS

The contractor shall provide and install new PACS equipment within Building 106.

A003 Mechanical Room West Entry Door Reader

The contractor shall provide and install card reader door hardware at the basement level A003 Mechanical Room West Entry Door.

4 |

PAGE 23 OF 82 1333ND24QNB130120

Additional panel hardware will be required within the A125 security panel location to support this new door. The contractor shall utilize an available LNL-1320 dual reader control board reader port for this new door. This board is currently poorly anchored to the enclosure door with sticky-back stand-offs.