Questions and Answers_0001.docx

Questions and Answers Farmington District Office Security and Access Update 140L2221Q0001 About the Facility Infrastructure:

· How stable is the power? The power is stable

· Is the ceiling a dropped ceiling? In most areas it is a drop ceiling in others it is open

· How high is the ceiling? The ceiling is different heights through out the building

· What type of walls are in the perimeter areas? brick

· What type of walls is inside the offices? drywall

· Are the door frames metal and concrete filled? metal on some doors

· What is the lowest temperature and highest temperature during winter and summer? 15 to 100 Physical Access Control System (PACS):

· Are we to assume based on the SOW that there is a need for access control server, if yes can you tell us if there is a preference with a brand for the server? We do not need a server we need a computer with the security program on it.

· How many of the 25 readers are to be installed in double exit doors? none

· How many of the 25 readers are to be installed in double doors? two

· What type of locksets is there in your doors? Push bars

· Related to FICAM Policy, does your agency need to authenticate the CAK besides the CHUID or FASCN from the PIV or CAC Card? no The CHUID authentication mechanism has been deprecated due to security concerns. For this reason, this publication marks the authentication mechanism as deprecated to signify that it is not a viable authentication mechanism to deploy for physical access control system (PACS). The CHUID data element on the PIV Card, however, remains a mandatory element as the BIO(-A) and SYMCAK authentication mechanisms use the data element as a source for the card’s expiration date. The PIV Card mitigates the risk of collision by defining a unique Federal Agency Smartcard Number (FASC-N) Identifier for the purposes of physical access control decisions. To prevent collisions, all access control decisions based on the FASC-N should be made by comparing the 14-decimal-digit FASC-N Identifier, and optionally the values of additional FASC-N fields, against the ACL entries

· Related to FICAM Policy, the fact the authentication of the PIV or CAC card can present major delay upon presenting the card to the readers, especially in areas such as the main entrances; what is the maximum allowable time expected to authenticate both CAK and CHUID? Is it 3 seconds or less? yes

· Related to FICAM Policy, does the contractor have to be certified as a HSPD-12 by GSA approved vendor?

What acquisition services are available? A. Requirement to use federally approved products and services – To ensure government-wide interoperability, all departments and agencies must acquire products and services that are approved to be compliant with the Standard and included on the approved products list. A forthcoming Federal Acquisition Regulation will require the use of only approved products and services. Departments and agencies are encouraged to use the acquisition services provided by GSA. Any agency making procurements outside of GSA for approved products must certify the products and services procured meet all applicable federal standards and requirements, ensure interoperability and conformance to applicable federal standards for the lifecycle of the components, and maintain a written plan for ensuring ongoing conformance to applicable federal standards for the lifecycle of the components.

· Related to FICAM Policy, does the contractor have to provide certified Security ICAM Engineers as recommended by GSA? no

· Related to FICAM Policy, does the PACS system should be in full FIPS 201-2 compliance? yes

· Since PACS Systems are now considered part of the IT infrastructure, does the proposed PACS System have to comply with the FISMA Requirements? This is for entry into the facility the system has to comply only to the FISMA facility entrance requirements.

Network and Cyber Security:

§ Is the system installed in a secure network provided by the government? Yes § Do we need to be compliant to FISMA? Yes § Is it the responsibility of the security integrator to address the cyber risk of these systems? This is done separately from the entrance system.

§ If yes, are we to provide cyber security to the systems we are proposing? no § Does the proposed system need to demonstrate a cyber security vulnerabilities test, inclusive of controllers and reader interfaces among other peripherals? No This is not new work it is existing work replacement of readers and computer program with a new computer Software must include the following:

· Data connect module V8

· Homeland Professional platform software V8.0.1 license

· HID Federal Identity pivClass Registration Engine Maintenance

This is the software and license for the software for the new computer and it is needed for all the cat v8 cards for entry into the building.