Attachment B SOW LCHCC Physical Access Control System.pdf

STATEMENT OF WORK

Physical Access Control System Project Lee County Health Clinic (LCHC)

1. Background:

LCHC is directed by Bay Pines leadership to implement a standardized physical access control system consistent with the Software House CCURE 9000 platform utilized at Bay Pines.

The LCHC intends to procure and install a Software House CCURE 9000 Physical Access Control System (PACS), including all hardware, cabling, and software necessary to support facility access control operations.

The system shall support PIV-compatible access control utilizing FIPS 201 approved components and shall support both PIV credentials (13.56 MHz) and legacy proximity credentials (125 kHz) for authorized users.

The system shall operate as a standalone system and shall be configured to support future integration into the Bay Pines enterprise CCURE 9000 environment.

2. Location of Project:

The work shall be performed at the Lee County Health Clinic, 2489 Diplomat Pkwy, Cape Coral, FL 33909.

3. Service Description:

3.1 The Contractor shall provide (furnish and install) all hardware, software, and associated components required to implement a complete and fully operational Software House CCURE 9000 Physical Access Control System (PACS) at LCHC.

The system shall be compatible with Software House CCURE 9000 and shall support PIV-compatible access control utilizing FIPS 201 approved components. The system shall support both PIV credentials (13.56 MHz) and legacy proximity credentials (125 kHz) for authorized users.

PIV credentials shall be read via CHUID, with FASC-N data utilized within the system for credential identification and access control decisions. External credential validation services are not required under this scope.

This system shall be referred to as the "CBOC System". The system shall be owned and maintained by LCHC and shall operate as a standalone system. The system shall be configured to support future integration into the Bay Pines enterprise CCURE 9000 environment.

3.2 The Contractor shall provide Software House certified personnel to perform installation, configuration, and commissioning of the CCURE 9000 PACS system.

3.3 The Contractor shall install and configure CCURE 9000 server, administration, and monitoring applications at the facility to support system operation.

The system shall include a minimum of three (3) workstations:

• One (1) enrollment/badging workstation (also configured for monitoring)

• Two (2) additional monitoring workstations

3.4 The Contractor shall configure the system to provide full operational capability, including but not limited to credential management, access control, alarm monitoring, event reporting, and system administration.

3.5 All users shall be re-enrolled by the Government. Migration of existing cardholder data is not required.

3.6 The Contractor shall configure the system database and implement backup functionality in accordance with manufacturer requirements and Government standards.

3.7 All system configuration shall be performed, including configuration of inputs/outputs, doors, access levels, and event monitoring. At a minimum, the system shall support and generate events including door forced, door held open, and invalid credential access

3.8 All system components shall be labeled and configured in accordance with Government-provided naming conventions.

3.9 System maps shall be created within CCURE 9000 to reflect all access-controlled doors and associated devices using available floor plans or field-verified layouts.

3.10 The system shall be capable of integration with facility backup and recovery processes in accordance with manufacturer recommendations.

3.11 Hardware and materials shall be installed as required to support full system operation.

Existing hardware may be reused where is meets manufacturer requirements and passed required testing.

3.12 Cabling shall be installed as required to support system operation. Existing cabling may be reused where it meets manufacturer requirements and passes required testing. New or replacement reader communications shall utilize OSDP protocol with secure channel where applicable.

3.13 All devices shall be installed in accordance with original equipment manufacturer specifications.

3.14 All system components shall be tested and verified to ensure proper installation, configuration, and operation.

3.15 System equipment shall be compatible with Software House CCURE 9000 and shall include, but not be limited to:

• Network infrastructure required to support system operation on a dedicated and segmented network

• FIPS 201 compliant card readers compatible with CCURE 9000, of a single manufacturer and model family

• Request-to-Exit devices

• Software House iSTAR Ultra controllers with enclosures

Network infrastructure supporting the existing system is over 10 years old and shall be replaced.

The network shall support segmented operation, Power over Ethernet (PoE) for all applicable devices, and sufficient capacity to support system performance. Network equipment and configuration shall be coordinated with the Government.

4. Security Systems Testing and Acceptance

4.1 General Requirements

The Contractor shall perform comprehensive testing and commissioning of the PACS system following completion of installation and configuration. All testing shall be conducted in accordance with manufacturer requirements and this Statement of Work.

4.2 Government Coordination

Testing activities shall be coordinated with the Contracting Officer’s Representative (COR).

Testing shall not commence until authorization is provided by the Government.

4.3 System-Wide Testing Requirement

All system components shall be tested to verify proper installation, configuration, communication, and operation. Testing shall include, but not be limited to, controllers, card readers, locking devices, request-to-exit devices, door position switches, and associated inputs/outputs.

4.4 Door-Level Functional Testing

Each access-controlled door shall be individually tested to verify proper operation. At a minimum, testing shall include:

• Valid credential presentation results in authorized access

• Invalid credential presentation results in access denial

• Door forced condition generates an alarm

• Door held open condition generates an alarm

• Door status is correctly displayed at monitoring workstation

• Locking hardware functions as intended

• Request-to-exit devices function properly

4.5 System Communication Testing

The Contractor shall verify communication between all field devices, controllers, and workstations. All devices shall report status correctly within the CCURE 9000 system without communication errors.

4.6 Alarm Monitoring and Event Verification

The Contractor shall verify that all system events and alarms are properly generated, transmitted, and displayed at the monitoring workstations. Event reporting shall include, at a minimum, door forced, door held open, and invalid credential events.

4.7 Network and Power Verification

The Contractor shall verify that network connectivity and power systems supporting the PACS are functioning as required. This includes verification of PoE functionality, controller communication, and backup power operation.

4.8 Deficiency Correction

All deficiencies identified during testing shall be documented and corrected prior to system acceptance. Retesting shall be performed to verify corrective actions.

4.9 System Acceptance

Final system acceptance shall be contingent upon successful completion of all testing requirements and Government verification that the system is fully operational and compliant with this Statement of Work.

4.10 Documentation of Testing

The Contractor shall provide documentation of testing results, including verification that all devices and doors have been tested and are operational.

5. Training Requirements

5.1 The Contractor shall provide training for Government personnel designated to perform system administration, operation, and maintenance of the Software House CCURE 9000 Physical Access Control System (PACS).

5.2 Training shall include, at a minimum, system operation, configuration, and administration of the CCURE 9000 PACS, including configuration of inputs/outputs, door parameters, and system events such as door forced, door held open, and invalid credential access.

5.3 Training shall be conducted by personnel authorized and certified by Software House for CCURE 9000 systems. Training shall be conducted onsite at a Government-furnished facility.

5.4 Training shall consist of two (2) onsite training sessions. One (1) training session may be conducted immediately following system acceptance, with remaining training scheduled in coordination with the Government.

5.5 A total of six (6) Government personnel shall receive training. All six (6) personnel shall receive entry-level training equivalent to Software House CCURE 9000 Operator/Basic Administrator (AC9641 or equivalent). Three (3) personnel shall receive advanced training equivalent to Software House CCURE 9000 Installer/Maintainer certification (AC9001 or equivalent).

6. General Requirements:

6.1 The services/work that the Contractor shall provide specifically includes those described in the Service Description or specified herein. However, the performance as described and specified shall not be deemed to constitute a detailed specification having the effect of excluding other needed work not specifically mentioned that will be necessary for the successful completion of this project as generally described.

6.2 The Contractor is required to furnish all service necessary to successfully fulfill the overall objectives set forth in the contract. Complete installation, configuration, testing, and programming services shall be provided by the Contractor for all devices procured in this award to ensure full operation of all devices on the PACS System.

6.3 All work shall be performed by OEM trained and certified technicians.

6.4 Contractor personnel shall schedule with the contract POC before beginning any work. The contractor shall provide all services during normal operating hours Monday through Friday from 8:00 a.m. to 4:30 p.m. excluding the weekend and federal holidays. Service schedule shall be agreed to by the contractor and the designated POC.

6.5 Government-owned dumpsters may not be used for disposal of shipping waste material.

The general area shall be left in a clean and orderly condition free of any foreign material caused by the installation or repair activities. The Contractor shall patch and paint any wall or surface that has been disturbed by the execution of this work.

6.6 The Contractor shall provide all technical documentation upon request including service manuals, operator’s manuals, upgrade documentation, etc. All equipment and materials provided by the Contractor shall be new and, where appropriate, shall arrive on-site sealed in original manufacturer’s containers.

6.7 All equipment and materials provided by the Contractor shall be new and, where appropriate, shall arrive on-site sealed in original manufacturer’s containers.

6.8 The Government reserves the right to refuse any items deemed to not meet this requirement.

6.9 The Contractor shall ensure full system functionality each time after performing system tests/inspections, maintenance, and/or repair. The Government reserves the right to refuse any items deemed to not meet this requirement.

7. Contractor Personnel Requirements:

7.1 The Contractor shall provide Software House-certified personnel with experience in maintenance, installation, and repair of the PACS equipment types listed herein.

7.2 Personnel must be qualified to perform the required services for all listed equipment and to properly install new or relocated devices. In the event the service representative is unable to rectify the situation, the Contractor shall provide a senior service engineer, or like, to resolve any problems.

7.3 All workmanship performed by the Contractor shall be of acceptable industry standard quality and issues shall be immediately rectified at no additional cost to the Government upon notification of non-acceptability by the Government. Valid documentation of certification shall be provided with the submission of offer at the time of solicitation.

8. Installation Services:

8.1 The Contractor shall coordinate an on-site walkthrough prior to installation to ensure all installation locations are correct and accurately represented in the security drawings depicting the pathways for PACS equipment.

8.2 The Contractor shall complete all required Infection Control Risk Assessment (ICRA) and Pre-Construction Risk Assessments (PCRA) prior to commencing installation services. No installation services shall begin until approval is provided by the POC.

8.3 The Contractor shall install wiring that is UL listed, NEC and NFPA 70, article 25 approved.

The PACS and CCTV System wiring shall not be run in the same conduit with other systems.

8.4 The Contractor shall comply with ANSI/TIA-569 Commercial Building Standards Telecom Pathways and Space. All network wiring shall be CAT 6A. Plenum wire shall be used in open areas (environmental air spaces/plenum ceilings) and standard CAT 6A within conduit.

8.5 The Contractor shall terminate all wiring with manufacturer approved connectors. The use of wire nuts is prohibited. The Contractor shall install cables as recommended by the manufacturer and pull cables without exceeding manufacturer’s recommended pulling tensions.

8.6 The Contractor shall secure and support cables by straps, staples, and or similar fittings designed and installed at intervals so as not to damage cables as recommended by the manufacturer.

8.7 The Contractor shall bundle, lace, and train conductors to terminal points with no excess and without exceeding manufacturer’s limitations on bending radii.

8.8 The Contractor shall provide wire separation during the installation as recommended by the original equipment manufacturer. Appropriate grounding shall be provided to eliminate any shock hazards. All equipment and cables shall be properly organized and labeled for efficient cable and equipment identification as recommended by the original equipment manufacturer.

8.9 The Contractor shall protect network devices against damage from electrostatic discharge during unpacking and installation.

8.10 The Contractor shall make certain that all network control equipment is accessible for service.

8.11 Contractor shall notify specifying authority if designated equipment closet/location does not meet manufacturer’s requirements for heat, airflow, or static electricity. Following completion of the installation services, the Contractor shall perform an operational system test and demonstrate proper operation of the system at the workstation.

9. Post-Installation Warranty and Support:

9.1 The Contractor shall provide a warranty on the system which shall include all necessary labor and equipment to maintain the systems in full operation for a period of one year from the date of acceptance.

10. Reporting Requirement and Deliverables:

10.1 Device List: The Contractor shall provide a list of all devices installed, including the following information, as applicable: Device type, Model Number, Serial Number, Location, Configuration/settings on device, Software Version (if applicable), MAC addresses

10.2 As Built Drawings of Software House CCURE 9000 System: The Contractor shall provide as built drawings of all installed components and associated wiring on building plans. Final payment for work will not be authorized unless these drawings are supplied. Drawings shall include all PACS devices, locations, and cabling interconnection.

11. Privacy and Security Requirements:

11.1 Contractor will be required to comply with physical security guidelines by either checking in with the VA Police each time they come on-site to perform contracted services or by obtaining a VA Contractor ID badge from the VA Police.

11.2 Contractor may not have access to any VA sensitive information or to the VA network under this contract. Contractor must be escorted at all times while performing work in sensitive areas with patient information.

11.3 Each Contractor employee must be escorted at all times by a VA employee (or)Contractor employee working on-site must complete training course “VA Privacy and Information Security Awareness and Rules of Behavior”

See Appendix B. The following language from VA Handbook 6500.6 is required in this contract.