16 AF IDS SOW - 8Jul25.pdf

DEPARTMENT OF THE AIR FORCE

502D AIR BASE WING

JOINT BASE SAN ANTONIO

STATEMENT OF WORK

INTRUSION DETECTION SYSTEM (IDS) AND ACCESS

CONTROL SYSTEM (ACS) INSTALLATION/UPGRADE

FOR HQ 16 AF (Air Forces Cyber)

JBSA-LACKLAND, TX—BLDG 2000, 2001, & 2007

8 July 2025

1. DESCRIPTION OF SERVICE: The headquarters 16 AF requires a delivery and installation upgrade of an Intrusion Detection System (IDS) and Access Control System (ACS) in Buildings 2000, 2001, and 2007, located at 102 Hall Blvd., Joint Base San Antonio (JBSA)– Lackland, TX 78243.

2. SCOPE: The Contractor or subcontractor (henceforth every reference to the contractor) shall provide all equipment, components, and labor for the site-specific installation and repair, as necessary, to support the upgrade of the IDS/ACS. Upgrade an IDS/ACS in accordance with specification and requirements outlined IC Tech Spec for ICD/ICS 705. All equipment, software, and components for this procurement, install, and upgrade of 16 AF’s IDS/ACS shall be on the Non-nuclear Configuration Management Database (CMD) Equipment Approval list. The system shall be capable of being integrated into 802 Security Forces Squadron’s (SFS) Base Defense Operations Center (BDOC) for monitoring and dispatching alarm response forces.

Both 16 AF and 802 SFS currently utilize the Vindicator IDS/ACS platform. All work performed by the Contractor shall be done in accordance with all applicable Department of Defense (DoD), Air Force (AF), Intelligence Community (IC) standards, instructions, and requirements to include applicable laws for commercial practices.

3. Contractor shall coordinate execution of IDS/ACS installation with the 16 AF Project Manager and shall ensure granted access to the installation and facility prior to the scheduled project start.

4. WARRANTY: Contractor shall provide all commercial warranties for product as provided by the manufacturer. The resultant warrantees shall be a minimum of one-year on installations service, and workmanship. Contractor will provide standard man-on-site warranty and services for 365 days upon the completion of the successful installation, testing phases, and acceptance of the IDS/ACS.

5. REFERENCES: The IDS/ACS install shall comply with the following requirements:

a. IC Tech Spec – for ICD/ICS 705 (applicable version)

b. Non-nuclear Configuration Management Database (CMD) Equipment Approval List

6. LOCATION: Project work is to be performed on JBSA-Lackland. Project area is Buildings 2000, 2001, and 2007. The buildings are located at 102 Hall Blvd., Joint Base San Antonio

(JBSA)–

Lackland, TX 78243. The area has sufficient parking and accessibility in the surrounding areas.

Contractor shall coordinate with the Facility Manager(s) to gain access to the facility.

7. INSTALLATION/MATERIALS: Contractor shall provide all new equipment and material and not refurbished equipment. IDS/ACS components shall not have wireless or Wi-Fi capabilities, be on the Non-nuclear CMD Equipment Approval list, and National Defense Authorization Act approved. All material list and design plan must be submitted with quote. All related accessories shall be installed in accordance with industry standards, manufacturer’s recommendations, and call order requirements and per the approved design.

Contractor shall provide system documentation and operation manuals to the government acceptor prior to or at site acceptance. Systems must have the most current software (e.g., Windows 11, etc.), firmware, and control interface features. If Windows 11 is not available on the systems from the vendor at the time of installation, a service contract will be put in place to properly upgrade the systems at a later time once it becomes available. Contractor shall coordinate installation start date no less than one month prior to start of installation. The contractor shall repair any damage caused to government property as a result of installation at no additional cost to the government. System requirements:

a. IDS/ACS installation related components and monitoring stations shall comply with Underwriters Laboratories (UL) Standard for National Industrial Security Systems for the Protection of Classified Material, UL 2050.

b. Alarm Sensors. Upgrade sensors to ICD 705 standards (UL 639 motion sensors and UL 634 High Security Switches (HSS)) that meet UL Level II requirements. Install sensors on all primary, secondary and emergency exit doors. Total number of HSS II sensors is 65 (19 double doors, 19 single doors, 2 roll-up doors and 6 rooftop hatches). The total number of motion sensors is 43. Changes to DoD, AF and Accrediting Official (AO) policies may require the installation of additional sensors. Current sensor wiring can be reutilized. Any new sensors will require the installation of the proper shielded wiring to the closest enclosure.

c. IDE (intrusion detection equipment) cabling that extends beyond the SCIF perimeter shall employ Encrypted Line Security or be installed in a closed and sealed metal conveyance defined as a pipe, tube or the like constructed of ferrous Electrical Metallic Tubing (EMT), ferrous pipe conduit or ferrous rigid sheet metal ducting. All joints and connections shall be permanently sealed completely around all surfaces (e.g. welding, epoxy, fusion, etc.). Set screw shall not be used. The seal shall provide a continuous bond between the components of the conveyance.

d. Premise Control Unit (PCU). PCUs programmed into multiple logical units or partitions, of the same PCU, that function as individual control units for the intrusion detection system installed in multiple areas or rooms operated independently of one another. All conditions of compliance that apply to a PCU and IDS apply equally to the partitions of the PCUs. The PCUs shall be independent of IDS safeguarding non-UL 2050 certified areas. Logical units must be viewable and controlled via Site Commanders; one in building 2000, one in building 2001, and one in building 2007. There are currently no PCUs in place. The IDS will be redesigned and reconfigured to support new Vindicator Premise Control (VPC) units where needed. The new configuration will be designed and configured with Monitored Local Control so that the monitoring station at BDOC does not have the capability to clear alarm point alarms unless they are cleared by the local Site Commanders first.

e. Access Control System (ACS). ACS shall be assessed and upgraded as part of the IDS upgrade. The ACS must be compatible with the IDS and have badge-in card/PIN capability.

The repositioning of current MR50 reader controllers at all nine entrances is also required. The MR50’s must be moved from their current location to another position near the doors and be configured properly to allow entry to the facility and push-to-exit access to exit the facility.

f. Badge Manager System. A new badge creation system shall be installed as part of the ACS upgrade. The badge system computer (CPU) must have current software (e.g., Windows 11, etc.) in accordance with the CMD Equipment Approval list and be capable of generating multiple forms of picture identification badges. Two Vindicator Badge Manager systems are required in separate locations and the systems must work in conjunction with one another and need to be tower units not rack mounted.

g. Other Key Systems. The current System Archive Workstation (SAW), SQL database server, and two Vindicator Command and Control (VCC) computers shall be upgraded with new systems running the current software recommended by Vindicator and have a Windows 11 operating system. All units need to be a rack mounted design. One SAW and VCC can be combined into one system and housed in Rm201. The other VCC will be replaced in Rm125.

The Rm125 VCC needs to be configured to send all IDS alarms to BDOC. The 16th AF Alarm Maintenance system administrators will be given full administrator rights on all systems.

h. Transponders. Upgrade 6842 (47 total) transponders to 1500 (26 total) connected via ethernet. This will not be a one-for-one swap as the old system required more transponders in the past for more alarm sensor that have since been decommissioned. Configure/program all transponders. All wiring within the enclosure will be professionally tidy with very little excess.

i. Network switches. An upgrade to the IDS/ACS network switches is required to meet current standards and allow for any additional connections required for the IDS/ACS upgrade.

DISA approved 48-port Cisco switches must be used. The 16th AF Alarm Maintenance system administrators will be given full administrator rights on all switches.

j. Forced Doors Alarms. Configure all facility primary and secondary entrance doors with forced door alarms. There are nine double door configurations in total with one active side each. “Access Allowed” switches need to be installed inside the current panic bars at all nine exits and configured accordingly.

k. New System Diagrams. New drawings/diagrams will need to be created showing all components and their connectivity. This system documentation is required by AFLCMC/HBU, the Accrediting Official, local administrators, and support contractors.

l. Additional Building Configurations. There are several other buildings supported by the current system. This installation/upgrade is intended to only make necessary changes to buildings 2000, 2001, and 2007. The other buildings components/configurations supported by this IDS/ACS shall remain unchanged until they can be upgraded at a later time.

m. Vindicator V5 Note. The current CMD Equipment Approval list (29Apr2024) does not list Vindicator V6 appliances as approved devices. If these devices are approved before the time work is to begin, an upgrade to the current V5s will be made to V6’s in accordance with the new CMD Equipment Approval list. There is one IDS V5 and ten ACS V5s in place on the system. Six of the ACS V5’s supports these three buildings. All new appliances will be installed and configured to match the current system requirements/design as well as the new features required and listed in this Statement of Work.

n. Coordination of all changes being made will have minimal impact to BDOC visibility of alarm points and minimal impact to the ability of keeping the facilities secure and granting access to those who work there. The impact of all changes when they are going to be made will be approved by the local building security officers.

STATEMENT OF WORK