2024-R-058 Bidders Questions and Responses 7.15.25.pdf

Question

Number

Bidders Questions SAA Responses

Please provide CAD drawings or existing schematics of the four garage entrances

(camera & barrier locations) CAD drawings will only be provided to the contract awardee.

2 Please provide exact lane widths / island dimensions for the two gated lanes

Exact lane widths will not be known until contract award when the design of the system is underway and surveying can commence.

Please indicate the preferred data-exchange method for importing records into the SAA parking database (API specs or file template)

The SAA parking database has REST APIs for retrieving and updating data. These APIs return data in a JavaScript Object Notation (JSON) format. This is the preferred method for transferring data between systems.

Please provide the minimum plate-read accuracy and vehicle speed requirements

(day/night)

The plate read accuracy should have a minimum plate read accuracy rate of 90%. The LPR should capture vehicles traveling up to 25 MPH.

Does the SAA require bonding, insurance or security clearances beyond CJIS compliance?

For insurance requirements, please see RFP Section H.13.2 General Liability. For security requirements, please see RFP Section H.4.3 Personnel Security

6 Is it possible to request an extension of the due date? Please see RFP Amendment 003 extended the submission deadline to July 22, 2025.

7 Is there a site map of the facility available? The site map will only be provided to the contract awardee.

In C.1 Background it states:

“Parking enforcement conducted by Senate Parking Operations currently involves outdated pen-to-paper documentation and violation/ticket issuance, with manual data entry and email notifications. The SAA requires Contractor support to implement a Solution to modernize the outdated process while improving efficiency and accuracy.”

Does the SAA require an enforcement system to go with the LPR system? Yes.

In C.2 General Requirement it states:

“Solution shall also include two (2) barrier access arms with the ability to accommodate the appropriate code space, clearances, and …”

Can you clarify what code space and clearances are?

The codes space and clearances are stated in the AOC Design Standards and will only be provided to the contract awardee.

In regards to the statement “ … ability to import data from the existing web-based

SAA database and customer interface platform..”

In what format will this information will be transmitted? Please see response to Question #3.

In C.3 Solution Equipment, Materials, Hardware Installation Requirements, it shows that you require only entrance cameras.

Are we able to option exit cameras as well?

For the 2 lots that have barrier arms, will these be RFID card pass only entrances?

How will the exit be handled?

Offerors shall include exit cameras in the proposed solution. Please see RFP Amendment

003.

Offerors shall propose their recommended solution to meet the RFP requirements for the two (2) parking lots which have barrier arms; the primary solution will be the license plate reader and the secondary solution would be the RFID ID/badge.

Exit cameras shall be included in the proposed solution. Please see RFP Amendment 003.

In C.3.4 “install, and activate a mobile application or equivalent with appropriate data plan for the…”

What do you mean by “mobile application” ?

SAA Parking Specialist must be able to provide enforcement of the LPR via a cell phone or iPad. The vendor must provide the appropriate technology that would be compatible for a mobile application.

Is the goal of the system to track movement of the vehicles within the facility and to calculate time spent in the facility? No.

How are parking permits issued to each authorized person, and how often are the permit lists updated? Is this done periodically, or on an as needed basis only when a new person needs a permit, or is a permit removed from the system?

Currently approved permit holders have a sticker affixed to the windshield of approved vehicles. Staff permits are renewed every Congress (every 2 years); Press permits are renewed every year. Once the renewal period has ended, the permit is not longer active and a new request for a permit must be submitted.

Can you confirm if the awardee will need to provide and install the electrical cabling and concrete cutting needed to complete this project? On the site visit, there was mention of AOC doing this, but the RFP indicates the awardee will be responsible. Please confirm who will handle.

AOC will provide infrastructure to the site location and the awarded contractor will complete the installation. Any cutting and/or alteration to the existing concrete/hardscape will need to be approved by the AOC prior to any demolition occurring.

Is there an existing windows-based server on a network where we would be able to connect the LPR cameras and the gate arms to? Or, should the vendor provide a new server as part of the solution?

There is no existing server. The vendor should provide the required hardware, in coordination with SAA to ensure approval of its use.

What VMS is the US Capitol Police using? Knowing this will help us design a solution that is the most cost effective.

The system should be a "Stand-alone" solution. There is no requirement for integration within the current USCP camera system.

18 What Physical Access Control System (PACS) is currently being used?

The only PACS currently in place is the barrier arm located at the Russell garage entrance at

New Jersey and C Street. There are no other PACS in place.

Referencing document J-02 SOP for Cybersecurity: Will servers and networking hardware installed for this contract be added to the Senate IT infrastructure or is the expectation that the devices for the implementation of this contract will reside on their own standalone network?

The SAA intends to add the on-premises components of the solution to the Senate IT

Infrastructure. Network segmentation may be configured where feasible.

Will bollards and other vehicle stopping devices at entrances to garages be included as a part of the scope of work for this RFP? No.

Please confirm what hours the Senate would anticipate the installation work be completed – Normal 8-5pm? After normal business hours? Will there be any other limitations or factors to consider when being able to schedule the work to be completed (when Senate is in session etc)?

The SAA anticipates that the installation would be completed during normal business hours

8 am - 5 pm. If there is an expectation of any extreme noise, the times may need to be adjusted to facilitate the Senate schedule. Certain events may require a temporary suspension of work. The SAA will coordinated any suspension with the contractor in advance.

Section 14 Contractor Responsibilities for Cybersecurity: The summary of this section references NIST, FIPS, and SP800 53, 161, and 171. Is the expectation of the SAA cybersecurity department that applicable STIG checklists for installed devices shall be completed and maintained throughout the life of the system?

The Contractor shall be responsible for compliance and any approved deviations must be consistently maintained, thoroughly documented, and reviewed on a monthly basis.

Section 14.3.8 Remote Access: Will remote access be granted within the scope of this proposal or is all post-installation maintenance work expected to be conducted on site?

No, remote access will not be granted. Post installation maintenance must be conducted on site, if possible.

Section 14.3.13.2.1.1 FedRAMP Impact Level Requirement: This section stipulates all cloud services must meet FedRAMP Impact Level Moderate or High. In the

RFP’s section C.3.4 it is indicated that FedRAMP “certified is preferred but not required.” Is the FedRAMP Moderate/High a requirement of this proposal for cloud services and only the daily image storage is excluded from that requirement or is the whole RFP solution excluded from the FedRAMP requirement?

Cloud components must be certified by recognized third-party standards, such as

FedRAMP, SOC 2 Type II, or ISO 27001.

Section C.2.1.2 States “Components of the Solution can reside either on premise or cloud storage.”

Are there any restrictions on which components?

No. The SAA is open to reviewing on-premises, cloud, and hybrid solutions. On-premises components must comply with secure supply chain attestations. Cloud components should be certified by recognized third-party standards, such as FedRAMP, SOC 2 Type II, or ISO

27001.

Section C.3 stipulates “up to four (4) LPR cameras”

Section C.3.1 The Contractor shall install up to four (4) LPR cameras, one at each of the following locations:

a. Hart Senate office building (SOB) garage entrance (C Street, NE);

b. Russell SOB garage entrance (Delaware Avenue, NE);

c. Russell SOB inside garage entrance (New Jersey Avenue, NW); and

d. Dirksen SOB garage entrance (northside).

Are there any restrictions on adding more entrance-monitoring cameras to improve accuracy?

No more than eight (8) cameras shall be proposed. Section C.3 has been revised to require up to eight (8) LPR cameras. Please see RFP Amendment 003.

What is SAA’s desired process when the Solution is unable to read and/or validate a plate at a control point?

The secondary solution would be to scan the RFID/Badge onto the barrier arm to activate the arm to lift with an approved ID.

C.3.2 The Contractor shall install the two (2) barrier arms, one at each of the following locations:

a. Hart SOB garage entrance (C Street, NE); and

b. Russell SOB garage avenue (Delaware Avenue, NE).

Are exit barriers/cameras desired to enable the Solution to calculate vehicle stay timing?

Section C.3 has been revised to require up to eight (8) LPR cameras. Please see RFP

Amendment 003. The Contractor shall install two (2) barrier arms, in accordance with RFP

Section C.3.2.

Section 14.3.13.2.2 Maintenance of required administrative, technical, and physical safeguards and controls: If the CS environment the cloud hosted solution is stored within is a vendor supplied SaaS solution, is the Contractor still required to provide an auditor account to the Senate upon request of the COR?

Yes. If the system is a SaaS offering delivered from the vendor’s own on-premises infrastructure, the vendor must achieve a third-party certification demonstrating that the system meets or exceeds FISMA or FedRAMP Moderate requirements.

Will the Senate extend the due date of this RFP one week due to the 4th of July holiday? Please see RFP Amendment 003 extended the submission deadline to July 22, 2025.