FINAL 36C10F20R0065_1.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. DUNS: DUNS+4:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 85

36C10F20R0065 06-02-2020

Krystal Glasper 202-812-5083 06-26-2020

2:00PM

003C4

Department of Veterans Affairs

Office of Construction and

Facilities Management (003C4D)

1425 Tri-State Parkway, Suite 140

Gurnee IL 60031

X 100

X

Y

561621

$20.5 Million

N/A

See Delivery Schedule

101F

Department of Veterans Affairs

Office of Construction and

Facilities Management

1425 Tri-State Parkway, Suite 140

Gurnee IL 60031

FMS-VA-2(101)

Financial Services Center

PO Box 149971

Austin TX 78714-9971

See CONTINUATION Page

This is a Request for Quotation for the following service:

Conduct a site assessment and evaluation of the current system configurations and operational state of the PACS/ESS systems located at the VA FSC offices located in Austin &

Waco, TX as further described in the attached SOW.

This procurement is 100% set-aside for CVE verified Service

Disabled Veteran Owned Small Businesses (SDVOSB). The SDVOSB offeror shall be registered as such at https://vip.vetbiz.va.gov at the time of proposal submission and at the time of award. Contractor shall also be registered in SAM at https://sam.gov

Mandatory Site Visit information is located on page 37

RFIs must be submitted NLT June 11, 2020 at 2:00pm CST

Total Period of Performance not to exceed 1215 calendar days

See CONTINUATION Page

Krystal Glasper

Contracting Officer

36C10F20R0065

Table of Contents

SECTION A ...................................................................................... Error! Bookmark not defined.

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS . Error!

Bookmark not defined.

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

Table of Contents ...................................................................................................................... vii

1 INTRODUCTION

1.1 Background

1.1.1 Physical Access Control Systems (PACS)

1.1.2 Electronic Security Systems (ESS)

1.1.3 Related Infrastructure

1.2 Objective

1.3 Applicable Documents

1.4 Period of Performance

1.5 Place of Performance

1.5.1 Licenses and Regulations

1.5.2 Personnel

1.5.3 Confidentiality and Non-Disclosure

2 STATEMENT OF WORK

2.1 Program Management

2.1.1 Communications

2.1.2 Planning

2.1.3 Reporting

2.1.4 Change Management

2.1.5 Project Deliverables

2.2 Phase One – Site Assessment Project

2.2.1 Assessment Document Review

2.2.1.1 VA Documents

2.2.1.2 Installation Documents

2.2.1.3 Warranty Documents

2.2.2 Technical Data Review Report

2.2.3 Assessment Equipment/Software Review

2.2.3.1 Equipment/Software Review Report

2.2.4 Facility Select Remediation Options

2.2.5 Facility Select Remediation Plan

2.3 Phase Two – PACS and ESS System Compliance

2.3.1 PACS/ESS System Compliance Project

2.3.1.1 Installation Preparation

2.3.1.2 Facility Access

2.3.1.3 Equipment Acquisition

2.3.1.4 Photographic Documentation

2.3.1.5 System Functionality and Performance Requirements

2.3.1.6 Related Systems

2.3.1.7 Power

2.3.1.8 Definition and Dependencies

2.3.1.9 Coordination with Smart Card Distribution

2.3.1.10 Transition Approach

2.3.1.11 Security

2.3.1.12 Support from Other Organizations

2.3.2 Software

2.3.2.1 Data Conversion

2.3.2.2 System Configuration

2.3.3 Contractor Testing

2.3.3.1 Acceptance Testing and Turnover

2.3.4 Removal of Equipment and Materials

2.3.5 As-Built Documentation

2.3.6 Training

2.3.7 System Administration

2.3.8 System Configuration

2.3.9 Database Maintenance

2.3.10 Preventive Maintenance

2.3.11 Software Updates

2.3.12 Corrective Maintenance

2.3.13 Quick Issue Response

2.3.14 Section 508 – Electronic and Information Technology (EIT) Standards

2.3.15 Equivalent Facilitation

2.3.16 Compatibility with Assistive Technology

2.3.17 Representation of Conformance

APPENDIX A – FACILITY LOCATION

ABBREVIATIONS

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL ITEMS (OCT

2018)

C.2 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.3 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) ... 46

C.4 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.5 VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA

ACQUISITION OF COMMERCIAL ITEMS (APR 2020)

C.6 VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING—MONITORING AND

COMPLIANCE (JUL 2018)

C.7 VAAR 852.247-71 DELIVERY LOCATION (OCT 2018)

C.8 VAAR 852.247-72 MARKING DELIVERABLES (OCT 2018)

C.9 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.10 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (MAR 2020)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL ITEMS (OCT 2018)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (DEC 2019)

E.3 52.216-1 TYPE OF CONTRACT (APR 1984)

E.4 52.232-31 INVITATION TO PROPOSE FINANCING TERMS (MAY 2014)

E.5 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.6 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.7 52.212-2 EVALUATION—COMMERCIAL ITEMS (OCT 2014)

E.8 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL ITEMS (MAR 2020)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: TBD

b. GOVERNMENT: Contracting Officer 36C10F

Office of Construction and

Facilities Management (003C4D)

1425 Tri-State Parkway, Suite 140

Gurnee IL 60031

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [x] monthly

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment

Requests.

Department of Veterans Affairs

FMS-VA-2(101)

Financial Services Center

PO Box 149971

Austin TX 78714-9971

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

DEPARTMENT OF VETERANS AFFAIRS

AUSTIN, TX FINANCIAL SERVICES CENTER

PHYSICAL ACCESS CONTROL AND RELATED SECURITY SYSTEMS

REMEDIATION AND ENHANCEMENT

STATEMENT OF WORK

February 18, 2020

V5.0 vii

Page vii of 85

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

Table of Contents ...................................................................................................................... vii

1 INTRODUCTION

1.1 Background

1.1.1 Physical Access Control Systems (PACS)

1.1.2 Electronic Security Systems (ESS)

1.1.3 Related Infrastructure

1.2 Objective

1.3 Applicable Documents

1.4 Period of Performance

1.5 Place of Performance

1.5.1 Licenses and Regulations

1.5.2 Personnel

1.5.3 Confidentiality and Non-Disclosure

2 STATEMENT OF WORK

2.1 Program Management

2.1.1 Communications

2.1.2 Planning

2.1.3 Reporting

2.1.4 Change Management

2.1.5 Project Deliverables

2.2 Phase One – Site Assessment Project

2.2.1 Assessment Document Review

2.2.1.1 VA Documents

2.2.1.2 Installation Documents

2.2.1.3 Warranty Documents

2.2.2 Technical Data Review Report

2.2.3 Assessment Equipment/Software Review

2.2.3.1 Equipment/Software Review Report

2.2.4 Facility Select Remediation Options

2.2.5 Facility Select Remediation Plan

2.3 Phase Two – PACS and ESS System Compliance

2.3.1 PACS/ESS System Compliance Project

2.3.1.1 Installation Preparation

2.3.1.2 Facility Access

2.3.1.3 Equipment Acquisition

2.3.1.4 Photographic Documentation

2.3.1.5 System Functionality and Performance Requirements

2.3.1.6 Related Systems

2.3.1.7 Power

2.3.1.8 Definition and Dependencies

2.3.1.9 Coordination with Smart Card Distribution

viii

Page viii of 85

2.3.1.10 Transition Approach

2.3.1.11 Security

2.3.1.12 Support from Other Organizations

2.3.2 Software

2.3.2.1 Data Conversion

2.3.2.2 System Configuration

2.3.3 Contractor Testing

2.3.3.1 Acceptance Testing and Turnover

2.3.4 Removal of Equipment and Materials

2.3.5 As-Built Documentation

2.3.6 Training

2.3.7 System Administration

2.3.8 System Configuration

2.3.9 Database Maintenance

2.3.10 Preventive Maintenance

2.3.11 Software Updates

2.3.12 Corrective Maintenance

2.3.13 Quick Issue Response

2.3.14 Section 508 – Electronic and Information Technology (EIT) Standards

2.3.15 Equivalent Facilitation

2.3.16 Compatibility with Assistive Technology

2.3.17 Representation of Conformance

APPENDIX A – FACILITY LOCATION

ABBREVIATIONS

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL ITEMS (OCT

2018)

C.2 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.3 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) ... 46

C.4 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.5 VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA

ACQUISITION OF COMMERCIAL ITEMS (APR 2020)

C.6 VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING—MONITORING AND

COMPLIANCE (JUL 2018)

C.7 VAAR 852.247-71 DELIVERY LOCATION (OCT 2018)

C.8 VAAR 852.247-72 MARKING DELIVERABLES (OCT 2018)

C.9 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.10 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (MAR 2020)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

ix

Page ix of 85

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL ITEMS (OCT 2018)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (DEC 2019)

E.3 52.216-1 TYPE OF CONTRACT (APR 1984)

E.4 52.232-31 INVITATION TO PROPOSE FINANCING TERMS (MAY 2014)

E.5 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.6 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.7 52.212-2 EVALUATION—COMMERCIAL ITEMS (OCT 2014)

E.8 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL ITEMS (MAR 2020)

1 INTRODUCTION

1.1 Background

1.1.1 Physical Access Control Systems (PACS)

Homeland Security Presidential Directive 12 (HSPD-12) requires federal agencies to issue secure and reliable identification to all employees and contractors. FIPS Publication 201-1 Personal Identify Verification (PIV) of Federal Employees and Contractors, issued by The National Institute of Standards and Technology (NIST), establishes the technical specifications for the smart cards that respond to this requirement.

HSPD-12 requires Federal agencies to provide a common ID credential system for all federal employees and contractors. PIV badges are electronically verifiable and protected by digital certificates, biometric data, and a Personal Identification Number (PIN) code. These credentials are issued, managed, and revoked from a central management system and require applicant background checks.

On February 3, 2011, the Office of Management and Budget (OMB) released Memorandum 11-11 (OMB M-11-11), Continued Identification of Homeland Security Presidential Directive (HSPD) 12 that requires all federal agency systems be enabled to use PIV credentials in accordance with NIST guidelines. OMB directs agencies to use PIV badges in daily operations and integrate centrally managed PIV badge systems with the physical access control systems (PACS). PACS readers must, at a minimum, extract unique token identifier information from the PIV badge and by FY 2012 the existing federal physical and logical access control systems must be upgraded to use PIV credentials.

1.1.2 Electronic Security Systems (ESS)

Related to the HSPD-12 requirements, is the overall security modernization that provides the level of security protection necessary in VA facilities such as hospitals, regional offices, and related. These modernizations include the remediation and/or upgrade of ESS functions that include;

• CCTV (Camera’s and related recording devices)

• Intrusion Detection Systems (IDS) (Devices to detect non-approved access)

• Duress (Emergency alerts and general interaction with law enforcement for support)

• Visitor Management – Option (Control Access and Identify of Visitors)

These functions are critical for maintaining a proper security posture at this various VA facilities and allow local and regional law enforcement the tools needed to support their security operations.

1.1.3 Related Infrastructure

In addition to the systems and devices that create the secure environment desired by the VA are the related physical construction infrastructure assemblies and equipment that are controlled and monitored by the security environment. Remediation of entrance/exit locations, Information Operation Centers (IOCs) and IT facility equipment can be included as needed in the overall remediation project.

The following construction materials and assemblies are common installed equipment but are not limited as to what may be needed at a location related to construction activities. This can include:

Physical Access Entry Points

• Entrance/Exit(s)

• Doors

• Door Frames

• Door Locking Mechanisms

• Complete Door Assemblies

• Perimeter Gates

Physical Monitoring Locations

• Operation Centers

• Monitoring Racks

• Specific Operation Center Furniture

• Audio/Video Monitoring Devices

Computer Facility Locations

• Racks

• Raceway

All installation and implementation of construction related equipment will follow the VA

Physical Security Design Manual (PSDM) Jan. 2015 (Currently in Update as of 6/16).

This document is further referenced in section 1.3 Applicable Documents.

1.2 Objective

The objective of this Statement of Work (SOW) will be accomplished in two phases.

Phase One, is the performance of a Site Assessment. The outcome of Phase One will be the gathering of assessment information pertaining to all PACS/ESS system components at Austin and Waco, TX Financial Services Center (FSC). The assessment will include the review and data gathering at the site and the development of remediation options that will be presented to the Government once assessment is completed. The assessment is meant to specifically limit “risk” to both the Government and Contractor(s) the second Phase – Phase Two PACS/ESS Compliance, will occur

IF the VA selects the desired remediation option plan, and engages the Contractor to perform the work. Phase Two is considered an option (Option 1). If Option 1 is exercised and once both phases are complete, the remediated site will follow HSPD-12 directives as well as the security of the physical site will be “Modernized.” To better define work in both Phases, the following will be adhered to:

Phase One Site Assessment - Contractor will conduct a site assessment and evaluation of the current system configurations and operational state of the PACS/ESS Systems installed at the Austin, TX FSC facility located at 7600 Metropolis Drive, Building 5, Austin, TX 78744 (VA Facility Code 104), and an additional facility with PACS/ESS

Systems installed at the Waco, TX FSC facility located at 4800 Memorial Drive, Building

92, Waco, TX 76711 (VA Facility Code 104). Upon completion of the assessment, the

Contractor shall develop three alternative remediation plans listed below containing all material, labor, and cost:

• 1) Provide all actions necessary to ensure the PACS/ESS is fully compliant with Master Specifications, Technical Specifications for ICD/ICS 705 (where applicable) and equipment manufacturer requirements.

• 2) Design and present changes to the PACS/ESS architecture and topology to ensure safety and security and development of sufficient technical documentation to adequately describe the PACS/ESS. In doing so, the installer assumes liability for 100% functionality of the PACS/ESS system understanding VA regulations, VA Environs, and VA Identity Management tools. The VA understands that neither GSA nor the PACS/ESS industry can design a turn-key system. Reliability is the number one requirement of the system.

• 3 ) Provide the minimum repairs and modernization necessary to ensure system safety and the minimum documentation necessary to describe and locate installed components.

• 4) Provide timeframes and project schedules to complete all work

Site Assessments can be conducted during normal business hours and at the direction of the facility POC.

Option 1 - Phase Two PACS/ESS System Compliance - Once the site assessment is completed, the contractor shall provide all documentation to include floorplans, drawings, etc., for VA review and approval. VA will then consider the options provided in the assessment and engage the Contractor (if ALL Government criteria is met) to provide all material, labor, and cost associated to bring each facility into compliance with VA’s enterprise PACS/ESS requirements and HSPD-12 specifications. Phase Two will not begin until VA approves site assessment.

1.3 Applicable Documents

The following documents form a part of the requirements of this Statement of Work to the extent specified

• FIPS 201-1(x) - Personal Identity Verification (PIV) of Federal Employees and Contractors

• SP 800-73 - Interfaces for Personal Identify Verification

• SP 800-116 - A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)

• Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities ICD 705 Tech Spec-for ICD/ICS 705

VA Physical Access Control Systems (PACS) Requirements VA Master Construction Specifications

28 13 00 Physical Access Control System (PACS) 28 13 16 Physical Access Control System and Database Management 01 00 00 General Requirements 28 05 00 Common Work Results for Electronic Safety and Security 28 05 13 Conductors and Cables for Electronic Safety and Security 28 08 00 Commissioning of Electronic Safety and Security

VA Directives and Handbooks

Technical Reference Model 6500 Information Security Handbook Continuous Readiness Information Security Program 0730 Appendix B

Note: If location facilities have specific requirements related to construction, all work shall comply with those VA departmental construction standards and applicable manufacturer's installation and user manuals.

1.4 Period of Performance

A preliminary kickoff meeting will occur within 5 calendar days of award.

The following Period of Performance (PoP) for this SOW’s phases:

Base Phase 1, Site Assessment 30 calendar days after kickoff

a. Site Assessment/FSRO submittal 5 bus. days after assessment

b. VA approval 5 bus. days after submittal

c. FSRP 3 bus. days after FSRO approval

d. VA Approval to exercise option 10 bus days after FSRP approval

**If it is determined that Option 1 is required, it will be exercised within 10 business days after approval of the base deliverable FSRP.

Option 1 Phase Two, PACS System Compliance Not to Exceed 90 calendar days

a. Kick-off meeting 1 bus day after exercising option

b. Project schedule submittal 3 bus days after kickoff meeting

c. VA approval of schedule 5 bus days after submittal

d. Bill of Materials (BoM) submittal 5 bus days after exercising option

e. VA approval of BoM 5 bus days after submittal

f. Drawing submittal 30 calendar days after option award

Option 2 Remediation and Enhancement 365 calendar days Option 3 Remediation and Enhancement 365 calendar days Option 4 Remediation and Enhancement 365 calendar days

Note: All options will be exercised at the discretion of the Government.

1.5 Place of Performance

All site assessment activities and future compliance will be performed at the Austin FSC located at 7600 Metropolis Drive, Building 5, Austin, TX 78744. (VA Facility Code 104) and/or Waco, TX FSC facility located at 4800 Memorial Drive, Building 92, Waco, TX 76711 (VA Facility Code 104). Appendix A

Contractors shall follow guidance set forth by the City of Austin, TX as it relates to safety measures due to COVID-19.

1.5.1 Licenses and Regulations

The Contractor will ensure that the company and ALL assigned personnel are cleared in accordance with the VA requirements. The minimum standard is a National Agency Check with Inquires (NACI), licensed in accordance with state and local requirements, and that all work performed complies with ALL known applicable regulations and codes.

1.5.2 Personnel

Unless specifically noted otherwise, the performance of work shall be the responsibility of the Contractor. The Contractor shall be responsible for all site assessment activities as well as the final design and installation of all elements and systems, including items for which the VA may have a role in construction and/or installation.

Under Phase One, the VA expects that the contractor will have a select few personnel who will physically perform the site assessments with two goals:

• Find all the physical, procedural and unique elements that exist with the old PACS/ESS system and discover and record those elements which are missing as documented through the site assessment.

• Through due diligence the vendor will research all: logistical issues, materials, limitations, future etc. at the site to ensure the system to be presented will answer the security needs through compliance and innovation. Project risk understanding is THE KEY element of the assessment process.

1.5.3 Confidentiality and Non-Disclosure

All data collection instruments, drafts and final reports, all data files and associated working papers, and other material deem relevant by VA which have been generated by the Contractor or provided to the Contractor by VA in the performance of this contract are the exclusive property of the US Government and are to be submitted to the COTR at the completion of the project. All Government information made available to the contractor shall be used by the Contractor only for the purpose of carrying out the requirements of the contract. Unless explicitly authorized by the VA, government information made available to the Contractor shall not be divulged or made known in any manner to any person except as may be necessary in the performance of this contract.

2 STATEMENT OF WORK

2.1 Program Management

The contractor shall perform all management tasks that are required to execute the phases and tasks identified herein in accordance with the established schedule and to report the status/progress of these tasks to the local VA site/facility point-of-contact, the Contracting Officer, and to the VA Contracting Officer Representative (COR).

The contractor will provide a Program Manager for the duration of this contract that will be considered Key Personnel. As the Program Manager, this member of the contractor’s team will oversee all Phase One/Two work and be the key contact for VA staff.

A kick-off meeting will be scheduled within 5 business days of contract award. At this meeting, all stakeholders can be present to go over the various activities and timelines associated with the Phase One approach. This meeting will be held at Date of Award (DoA) plus five (5) business days.

If Option 1 is exercised for Phase Two, a kick-off meeting will be convened via telecom or at the Austin FSC.

2.1.1 Communications

The Contractor will schedule, supervise, and manage all personnel required to monitor the performance of all Phase activities required by statement of work. The contractor shall be responsible for any delays or other impact due to misconduct on the part of its employees or subcontractors. Applicable personnel shall wear VA issued identification badges when working in Government facilities

The Contractor shall be required to communicate and coordinate with other VA personnel (e.g., VA IT, construction workers, physical security specialists, etc.) in the performance of the requirements identified in the SOW. The Contractor shall participate in, cooperate with, and contribute to discussions involving various VA PACS/ESS Contractors. At no time, shall direction be provided by or given to a Contractor by another Contractor, except where there is privity of contract. Should direction or resolution of issues be required, the Contractor(s) shall immediately notify the COR.

Technical direction may only be provided to the contractor, in writing, by the designated Contracting Officer’s Representative (COR) or Alternate COR. Should direction or resolution of issues be required, the Contractor(s) shall immediately notify the Contracting Officer’s Representative (COR).

To ensure a successful and productive work environment, Contractor shall establish and foster: a) formal information sharing, including requirement coordination forums and b) collaborative interface to facilitate application solution services in an integrated fashion.

2.1.2 Planning

For Phase One, the Contractor shall develop and submit for VA approval a project schedule that will provide status as to the facility visits and timelines associated with that site assessment endeavor.

Prior to Phase Two implementation, the Contractor will submit a project plan for remediation action for VA approval. The project plan should provide the various tasks to be performed and the resources, facilities, tools, and materials needed to accomplish these tasks.

For all activities, the Contractor shall use Microsoft® Office Project to generate the project schedule utilizing Gantt charts. The Contractor shall deliver electronically, a detailed project two- week look-ahead in addition to the modified project schedule for all tasks that will be accomplished. This document will give the COR the opportunity to plan around the implementation of the project. The Contractor shall furnish to the COR the project schedule and two-week look-ahead by the first business day of each week by 11 AM ET/8 AM PT. The Contractor shall coordinate scheduling of work with the COR.

Deliverables:

Project Schedule Project Plan

2.1.3 Reporting

The contractor shall regularly submit a Weekly Status report in a form approved by the COR. In addition, the contractor will submit a Monthly Status Report as to the overall project status, progress, and issues to the COR during the term of this contract. The Contractor shall provide all reports and/or updates via electronic means. The list of reports can be found within Deliverables listed below.

Deliverables:

Weekly Status Report Monthly Status Report

2.1.4 Change Management

The Contractor shall formally document and obtain Contracting Officer (CO) approval for any project changes (i.e. scope and/or requirements). All changes will be processed with collaboration among the customer, other stakeholders, Project Manager, the VA facility security representative (FSR), and the Contracting Officer Technical Representative (COR) responsible for the project’s success.

The contractor will strictly adhere to the deliverables and project plan/schedules specified in this contract. In the event of any anticipated or actual delay, the contractor will promptly:

1. Notify the VA COR in writing of the reasons for the delay and the actions being taken to overcome or minimize the delay

2. Provide VA COR with a written recovery process within 24 hours/business day after delay or anticipated delay is known.

The VA shall not be liable for excess procurement costs pursuant incurred by contractor because of any failure to perform this contract under its terms. If the failure arises from causes beyond the control and without the fault or negligence of contractor, the VA will review the item on a case by case clause.

2.1.5 Project Deliverables

Task Paragraph Tasks Delivery Date

2.1.2 Planning

Project Schedule and Project Plan

First business day of each week by 11 AM CST

2.1.3 Reporting Weekly Report

First business day of each week by 11 AM CST

2.1.3 Reporting Monthly Report

First business day of each month by 11 AM CST

2.2.3 Assessment

Equipment/Software Review

Site Assessment NLT 30 calendar days from start of assessment (kickoff meeting)

2.2.3.1 Equipment/Software

Review Report

Site Assessment NLT 30 calendar days from start of assessment (kickoff meeting)

2.2.4 FSRO

Facility Select Remediation Options Document

Within five (5) business days upon the completion of the site assessment

2.2.5 FSRP

Facility Selection Remediation Plan

Within 3 days of FSRO VA approval.

2.3.1 PACS/ESS System

Compliance Project

Formalized Project Schedule

Within three (3) days after project kick-off

2.3.1.1 Installation Preparation Design Drawings

Within 30 days of contract award for Phase 2

2.3.1.3.3 Procurement Records BOM

Within 5 days of VA approved FSRO

2.3.1.4 Photo Documentation

Photographic Documentation

First business day of each month by 11 AM CST

2.3.3 Contractor Testing Test Reports

Within 5 days of project completion

In addition, there are various “collection reports” within the assessment phase which are referenced in the sections following.

2.2 Phase One – Site Assessment Project

The Contractor will perform a site assessment of the Austin and Waco FSC. The assessment will include system documentation, installed components and configurations, and validation of component and configuration operation of the PACS/ESS system. The following are some of the major points of reference utilizing the most current version.

• VA Master Construction Specifications Division 28 Parts 28 13 00, 28 13,16

• VA Technical Reference Model

• VA 6500 Information Security Handbook

• VA Continuous Readiness Information Security Program

• VA Directive 0730 Appendix B

• VA Physical Security Design Manual

• National Fire Protection Association (NFPA) Standards

• Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities ICD 705 Tech Spec-for ICD/ICS 705

It should be noted that much of the documentation may not exist and this should be noted in the assessment report. The contractor will provide list for what is and is not found at the site related to documentation that supports the PACS/ESS systems at each site. The contractor is not expected to create a document that does not exist unless the document would be a normal course of action to the new installation. (Example is the “drawings” of new camera locations, etc.)

A complete physical review of the site must be done which will included but not limited to:

• PAC System Servers

• PAC Workstations

• Other Systems (IDS, Fire, CCTV, etc.)

• Control Panels

• Control Panel Auxiliary Power

• Card Reader Assessment

• Card Reader Report (From Existing System)

• Other Sensors Monitored (Locks, REX, Strikes, etc.)

• Wire & Cable Condition

• PIV Card Status (Issued & Enrollment)

• Missing Equipment

• Code Violations

• Associated Facilities – Location and Subset System

• Existing CCTV (System, Cameras, Recording Storage, etc.)

• Leased space contractual concerns

• Conduit requirements and conduit necessities

• Other infrastructure concerns such as possible asbestos locations, difficult to drill walls [EG poured concrete walls] etc.

The assessment must note any nuanced issue that may be unique to the site which could include but not limited to advanced infection control measures, local IT guidance, and coordination impact caused by other contracts that are made known to the vendor which may impact the work break down structure.

As stated in the objectives for this SOW, the Contractor’s goal is to provide the following three (3) remediation options that include:

1. All actions necessary to bring the PACS and related ESS into full compliance with applicable directives as a holistic security system. System design and engineering must be 100% reliable and fully functional within the VA’s environs.

2. Objectively the project must do NO HARM that could negatively impact the VA’s ability to deliver services to Veterans.

3. Provide a system that has; longevity of service life along with low total cost of ownership which is maintainable considering location.

4. All documentation necessary to describe and locate installed components.

Along with configuration schema with notations on schema intricacies.

The contractor shall contact the VA facility and schedule time to conduct the site assessment, and notify the VA COR of the scheduled date. The Contractor shall not exceed the 30-day PoP of the base contract. All facility assessments must be completed by this 30-day time period. Any time needed beyond this period shall require approval of the CO and the VA COR.

2.2.1 Assessment Document Review

The purpose of this review is to determine the extent of system documentation and supporting reference materials required to be held, in support of the program. The Contractor shall conduct a search for and review of all system documentation, utilizing stakeholder interviews, system searches and vendor queries. The following is a representative listing of expected documents:

2.2.1.1 VA Documents

• Disaster Recovery Plan

• Standard Operating Procedures

• Internal Memorandums of Understanding (MOUs) and

Service Level Agreements (SLAs) formal and informal

• External MOUs or SLAs formal or informal

• Annual Physical Security Survey

2.2.1.2 Installation Documents

• System Drawings

• Block Diagrams

• Hardware Schedules

• Floor Plans

• Riser Diagrams

• Interconnect diagrams for intrusion detection, video, duress, voice communications, certificate validation, HVAC, other

• Door Schedules

• Test Plans or Commissioning Plans and Results

• Manufacturer Cut Sheets and UL Certificates

• Training Materials

2.2.1.3 Warranty Documents

• Warranty and/or Maintenance service provider(s), types and level of service, POC information, and status

• Maintenance and Service Call records

• Elevator service provider(s), POC info and status

• List of outstanding repair and/or maintenance actions- Including out of service Components, expired batteries, etc.

• List of systems and components covered and not covered by warranty. Date each current warranty expires

• Date and results of most recent independent system inspection(s) by Warranty/Maintenance provider, Fire Marshall, or Safety Inspector (i.e. Elevator)

2.2.2 Technical Data Review Report

The Contractor shall submit a preliminary deliverable of the above listed activities within 5 business days of completion of the review and assessment of system documentation and artifacts. This report shall include at a minimum an inventory and description of all items found, their completeness, and clearly point out any discrepancies or missing items when compared to the Master Specifications and items specifically identified for review.

2.2.3 Assessment Equipment/Software Review

The contractor shall identify all equipment and software that is currently installed as part of the existing access control system. These items shall include but not necessarily be limited to:

1) Servers, together with operating systems and applications software used on these servers;

2) Workstations, including operating systems and applications software, that are used to configure, operate, or monitor the existing PACS and ESS;

3) Other computers, including operating systems and applications software, that are used to connect the PACS/ESS with external systems;

4) Distributed control panels, including operating systems and applications software/firmware;

5) Door interface/card reader electronics, anti-pass-back devices,

6) Card readers.

7) Sensors and actuators that are monitored or operated by the PACS or ESS;

8) Interconnecting communications devices, including but not limited to, network routers, switches and hubs, modems, dedicated or leased telephone lines, etc.;

(9) Interconnecting cables;

9) Interfaces to external systems;

10) Primary power connections and uninterruptible power systems; and

11) Any other equipment that is required to operate, or is operated by, the PACS or

ESS.

The contractor shall produce block diagrams that identify each of these components and their typical interconnections and document each component (type, manufacturer, and revision level, location, condition) in a tabular form that is readily tracked to the block diagrams. The intent of this documentation is to provide detailed engineering drawings and ensure that all components have been identified to a level adequate to ensure they are appropriate addressed during the replacement/upgrade project.

Deliverable:

Site Assessment

2.2.3.1 Equipment/Software Review Report

The Contractor shall submit a preliminary Equipment/Software Review Report within 5 business days of completion of the review and assessment of al l system items. This report shall include an inventory and description of all items found, their completeness, and clearly point out any discrepancies or missing items when compared to the Master Specifications and items specifically identified for review.

Deliverable:

Site Assessment

2.2.4 Facility Select Remediation Options

Upon the completion, review and VA approval of the Site Assessment, the Contractor shall design 3 options for inclusion in the Facility Select Remediation Options (FSRO) document. This document will be delivered to the VA within five (5) business days upon the completion of the site assessment for the specific facility. The 3 options shall be different to be considered good (meets minimum SOW requirements), better (above requirements), best (superior requirements). Some difference should include but are not limited to:

• Cost difference

• Material difference

• Compliance level achievement difference

• Level of Effort difference

• Ability to add additional facilities – distance/connectivity

• Equipment and software differences/upgrades and updates

• Virtual versus non-virtual device strategies

• Security level difference

• Overall Total Cost of Ownership (TCO) differences

The VA will review this document and meet with the Contractor and all other stakeholders to focus on the best option and develop a course of action that mitigates program issues, ensures system integrity, provides facility security and delivers best value. From this document, the VA and other stakeholders shall decide on the options available and choose the appropriate direction.

Deliverable:

FSRO

2.2.5 Facility Select Remediation Plan

Upon VA approval of the selected option, the Contractor shall use the option details to develop a Facility Select Remediation Plan (FSRP) and begin the process of developing the project plan.

The plans shall clearly identify a logical schedule of significant events for document development, component installation, lay out plan, mobil izat ion, facility access, planned utility interruptions, system startup, checkout, projected test schedules, and other tasks required to accomplish the remediation of the PACS/ESS system.

The FSRP shall be delivered within 3 business days of FSRO VA approval. The Contracting Officer will issue the Contractor a Notice to Proceed (NoP) with remediation work. NoP shall be provided within a two-week (10 business Days) timeframe.

FSRP

2.3 Phase Two – PACS and ESS System Compliance

2.3.1 PACS/ESS System Compliance Project

When given Notice to Proceed (NoP) on Phase Two of the Austin FSC, the Contractor will use the Project Plan developed in all aspects of work to be provided.

A Kick-Off Meeting will be held within one (1) business day after the NoP is received by the Contractor. At this meeting, the Contractor will supply a preliminary project plan to be used as the guideline for future developments. The project schedule will identify each activity, its planned start date and duration, and any dependencies that affect the initiation or completion of each task. The project schedule shall incorporate at a minimum, all tasks and elements that are identified in the Statement of Work. After the initial review and VA approval of the preliminary project schedule, the Contractor shall deliver a formalized project schedule to the CO within three (3) business days after project kick-off. The Contractor shall update the project schedule weekly to reflect actual progress and shall submit to the COR.

Deliverable:

Formalized Project Schedule

2.3.1.1 Installation Preparation

The Contractor shall investigate and acquire all permits required by Federal, State, Municipal, and/or local code requirements for fire alarm, electrical, alarm and hazardous material. The Contractor shall develop all supporting documentation required for obtaining necessary permits and provide documentation to permitting authorities. The Contractor shall notify the CO prior to the start of the project on any conditions that may impact the project, equipment and schedule.

The Contractor shall coordinate scheduling of all work at the site with the COR and VA site lead. The Contractor shall follow all Federal and VA Rules of Conduct. Firearms, smoking, alcoholic beverages, illegal drugs, fighting, horseplay, and cursing on VA property by Contractor personnel are not allowed; shall not be tolerated; and may result in complete contract termination for cause.

The Contractor shall leave the site at the end of the day removing all trash and debris created by the removal of existing PACS/ESS and installation of the new PACS/ESS.

Every VA site will be treated with care for infection control. The Contractor shall consult with the VA POC to verify the removal and disposal of any existing security devices that need removal. The Contractor shall dispose of all electronic equipment via an authorized electronics recycler.

The Contractor may not propose significant deviations from the equipment locations noted on the design document unless the VA identifies and verifies design flaws or when functional improvements will be realized which result from such deviations and are reviewed and accepted by the VA. The Contractor shall document in their design submission all such changes to the design documents that accommodate the program and functional requirements defined herein. The CO shall approve in writing those changes that are acceptable to the VA.

The VA shall provide the Contractor sample drawings of most, but not all building spaces. The VA sample drawings will be intended to be used as reference documents only. The Contractor may use these reference drawings to identify the locations of the doors, door position switches, locks, Request to Enter (RTE) devices, PIV smart card readers, workstations, report printers and server locations.

The Contractor shall provide, subject to in-depth coordination and approval by the COR, the complete design of all aspects of the project including the final locations of all equipment and testing of the equipment to ensure all pieces of equipment are operational, and function according to manufacturer’s specifications. The Contractor shall provide the COR 100% design drawings within 30 calendar days of contract award for Phase 2.

Deliverable:

Design Drawings

2.3.1.2 Facility Access

The installation plan shall specify any tasks that require access to VA facilities outside normal working hours. Tasks that interfere with, or disrupt, VA operations shall be scheduled before or after normal working hours. Work outside normal working hours shall be approved by and coordinated with VA at least two weeks in advance and is subject to VA approval. The contractor is required to “pre” coordinate access and escorts (as applicable). The physical project will not begin until an agreed upon access plan is presented to the COR with agreement between the local site and the contractor. The contractor is responsible for identifying any “higher” access requirement that may be levied by the local facility. (This information is typically governed by the local Facility Chief Information Officer.)

2.3.1.3 Equipment Acquisition

The Contractor shall ensure that all PACS/ESS software and hardware components include all features and capabilities provided by the manufacturer for those products in support of VA requirements.

2.3.1.3.1 Storage

Space on site should be expected to be limited or non-existent in some buildings.

Therefore, the contractor shall be prepared for all required storage for equipment and materials prior to and during installation

2.3.1.3.2 Inspections and Acceptance

The contractor shall perform incoming inspections and tests as required to ensure that the equipment and software are complete, functional, and in compliance with manufacturer specifications prior to beginning installation. This shall include all parts and components that are required to replace existing inoperative or missing equipment as identified in the proposed design. The contractor shall perform all actions necessary to correct or replace defective components and materials prior to installation.

2.3.1.3.3 Procurement Records

The Contractor shall maintain records that document the receipt and inspection of all equipment components/software for the project and provide these records which shall include packing slips, product nomenclature, serial number(s), and quantity and develop an equipment receiving report containing all information. The Contractor shall deliver this equipment receiving report to the COR and VA POC after each phase of the equipment procurement and comprehensive equipment receiving report at project completion.

The Contractor shall develop and deliver to the COR, a Bill of Material (BOM) that specifies each piece of equipment, software component and its associated labor factor.

The Contractor shall deliver the BOM within 5 business days of VA approved FSRO choice. The COR will review and approve the BOM after receipt within 5 business days prior to equipment acquisition and installation.

Deliverable:

BOM

2.3.1.4 Photographic Documentation

The Contractor shall provide to the COR electronic photographic documentation, in JPEG format, minimum of 1600 x 1200 pixels, of the installation demonstrating that all components have been installed in accordance with the Statement of Work. The Contractor shall provide, on a monthly basis, photographic documentation during the installation/testing phase of the project as each component is installed and shall include any rough-in The Contractor shall format and label the photographic documentation and annotate all photographs with appropriate text to enable easy recognition of features, locations, and devices. If the Contractor’s photographs fail to provide enough clarity to clearly identify all components, the Contractor shall provide higher quality photographs that clearly show all components.

The Contractor shall not post any VA physical security system pictures, drawings or documents on a non-VA web or ftp site. The Contractor shall send photographic documentation via E-mail, or via upload to the VA-supplied secure portal. The COR will provide access to the Contractor to the VA secure portal.

Photo documentation

2.3.1.5 System Functionality and Performance Requirements

The contractor shall be responsible for ensuring that the remediation provided is designed and configured in such a manner to meet manufacturer specifications and FIPS 201-1/2 requirements, and is acquired, installed, and configured to meet, at a minimum, the requirements identified in the VA Physical Access Control Requirements document and VA Master Construction Specifications Division 28 Electronic Safety and Security. Access control will be determined by the contractor during the assessment.

The contractor is the sole entity responsible for ensuring the entire system is 100% reliable. Additionally, the vendor is singularly required to ensure that ALL the supporting licenses are valid for a minimum of 1 year after the final certificate of completion.

(a) Functionality. The FSRP shall support all functions provided by the existing access control system except where specifically approved by VA. The contractor shall specifically identify any features supported by the currently installed systems that will not be adequately addressed by the proposed design and will identify alternatives for addressing those features.