36C24827Q0084.docx

36C24827Q0084

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

516-27-1-5105-0102 36C24827Q0084 11-04-2026 William Penhallegon 7273177152 11-13-2026 2:00pm

EST

36C248 Department of Veterans Affairs Network Contracting Office 8 (NCO 8) 10,000 Bay Pines Blvd Bay Pines FL 33744 X X 561621 $25 Million Net 30 days N/A X

MCC: 90D

Department of Veteran Affairs C.W. Bill Young VA Medical Center See SOW 10,000 Bay Pines Blvd.

Bay Pines FL 33744 36C248 Department of Veterans Affairs Network Contracting Office 8 (NCO 8) C.W. Bill Young VA Medical Center 10000 Bay Pines Blvd.

Bay Pines FL 33744

Department of Veterans Affairs

FMS-VA-2(101)

Financial Services Center PO Box 149971 Austin TX 78714-9971 See CONTINUATION Page The United States Department of Veteran Affairs Healthcare System C.W. Bill Young VAMC anticipates awarding a Firm Fixed Price Contract for Building 111 Project Lighthouse C-CURE Installation identified below.

This RFQ is a Service Disabled Veteran Owned Small Business (SDVOSB) set-aside requirement.

See Statement of Work (SOW) B.3 PRICE/COST SCHEDULE must be filled out.

See CONTINUATION Page 516-3670162-5105-854100-2580 010050192 x X William Penhallegon Contracting Officer Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C248 William Penhallegon Department of Veterans Affairs Network Contracting Office 8 (NCO 8)

10,000 Bay Pines Blvd Bay Pines FL 33744

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 STATEMENT OF WORK

Statement of Work C-cure upgrades for Project Lighthouse

Provide one complete 32-reader iSTAR Ultra G2 cabinet installation, fourteen installed readers and four complete new-door hardware packages. Identiv uTrust is the Bay Pines standard; compliant APL-listed compatible alternatives are acceptable. Include composite cable, all contractor-provided pathways, DPS, and door operation meeting documented ward and life-safety requirements.

Technical requirements are defined below. Contractor verifies actual conditions and submits supported implementation details before ordering. The common bidder schedule and written solicitation amendments establish locations and final priced quantities.

1 Scope quantities and substitutions R01 Complete integrated scope. Provide all labor, supervision, engineering detailing, materials, delivery, staging, pathways, composite cabling, removal, installation, programming, integration, testing and closeout for Phase 1 on the third floor of Building 111 at C.W. Bill Young VA Medical Center. Base scope is fourteen installed and commissioned readers, eight wall and six keypad, including four complete new lock/DPS/REX packages. Provide the complete 32-reader iSTAR Ultra G2 hardware and power capacity in one integrated cabinet. Integrate with the existing VISN 8 C•CURE system.

R02 Phase 1 quantities and pre bid verification. Base pricing includes fourteen installed reader positions, eight wall and six keypad, and four complete new-door hardware packages included within that reader scope. Fourteen is the minimum installation requirement; the issued common schedule and any written amendment establish the final priced quantity. Reader count does not by itself establish unique door count. VA technical reviewers shall develop one common door/reader schedule from the marked-up project blueprint. The CO shall issue the same schedule, locations and any quantity changes to all bidders before final quotations. Bidders shall attend announced site access and identify discrepancies; each bidder is not required to create a separate engineered door schedule. After award, the contractor verifies measurements and develops detailed implementation drawings before ordering. Report scope-changing discrepancies for written resolution before proceeding.

R03 Controlled scope and substitutions. Identiv uTrust Series readers are the Bay Pines standard and basis of design. Any currently GSA APL-listed PACS reader meeting the stated C•CURE compatibility, credential/authentication, OSDP Secure Channel, form-factor and functional requirements is acceptable; do not reject an otherwise compliant alternative solely for brand. Submit the exact model, firmware, APL approval letter and applicable tested-solution restrictions, compatibility evidence and equal-performance comparison with the quotation. VA Engineering reviews technical compliance; only the CO authorizes contractual substitutions, quantity changes, price/time changes or waiver of a requirement. After award, obtain written technical acceptance and any necessary CO action before ordering a changed configuration.

2 Contractor qualifications R04 Manufacturer authorization. The prime or identified specialist subcontractor performing C•CURE work shall hold current manufacturer authorization applicable to installation, configuration and support of the offered C•CURE 9000 system. Submit manufacturer-verifiable authorization, scope, limitations, support entitlement and verification contact. Maintain authorization during specialized work and warranty support. A reseller invoice alone is insufficient.

R05 Named programmer and commissioning lead. Identify actual programming and commissioning personnel, employer, role, onsite tasks and qualifications. The lead C•CURE programmer shall hold current AC9001 C•CURE 9000 Installer/Maintainer certification or a manufacturer-confirmed equivalent appropriate to the installed release, together with documented iSTAR Ultra G2 installation/configuration training. Submit certificates, issue dates, status and manufacturer confirmation where applicability is unclear. Qualified personnel shall personally execute specialized work; supervision or borrowed credentials alone does not satisfy this requirement.

R06 High Assurance specialist. Personnel configuring or commissioning HA functions shall document successful completion of AC9202 C•CURE 9000 High Assurance with Innometriks, or manufacturer-confirmed equivalent HA training, and applicable update training or manufacturer confirmation for the proposed G2 controllers and Identiv uTrust or accepted equivalent reader combination. Provide at least one verifiable comparable HA integration reference identifying the assigned person’s role in enrollment, certificate validation and enterprise integration. Do not require a separately named HA installation certification without manufacturer evidence of that designation.

R07 Specialist skills and subcontractors. Demonstrate assigned staff competence in OSDP Secure Channel key provisioning and diagnostics, supported integrated power/lock-control assemblies, load calculations and fault isolation through training records or comparable project records and the proposed method. If MAS/SAS architecture itself is modified, the responsible specialist shall hold AC9444 Enterprise Architecture certification or manufacturer-confirmed equivalent; ordinary door programming alone does not trigger that condition. Qualified approved subcontractors may satisfy specialist requirements. Replace personnel only with equally qualified staff accepted before specialized work.

3 Work plan and hold points R08 Work plan timing. Within 10 business days after notice to proceed, submit the complete work plan and H1 design package. Within 5 business days of receiving VA comments, submit a correction or a documented corrective schedule to the COR. Allow 10 business days for each VA technical review cycle in the proposed schedule. These periods do not guarantee VA approval or change the contract completion date. Identify delays promptly to the CO.

R09 Procurement hold point H1. Do not order configuration-dependent materials or start installation until the COR transmits written VA Engineering technical acceptance of the complete H1 package and necessary CO authorizations are issued. Submit named staff/authorization evidence, complete exact BOM, dimensioned one-cabinet layout and manufacturer mounting support, common issued and contractor field-verified door/reader schedule, controller/port/I/O allocation, point-to-point diagrams, composite cable/pathway design, power/battery calculations for the required 32-reader capacity, existing entitlement verification, C•CURE/HA compatibility, network integration, ward/life-safety door sequences, outage/rollback plan and T01–T18 procedures. Contractor shall supply these engineering details to implement the defined requirements. Silence is not approval.

R10 Field verification. Before H1, verify the specified C•CURE 9000 3.10.1 CU02 baseline and any later VA-authorized release actually in use, patch level, SAS/MAS relationship, controller and reader firmware, existing HA services, 200-bit format mapping and licenses. Verify the designated signal closet shown on the marked-up project blueprint, and measure the equipment area, wall anchorage, cabinet door swing and service clearances; trace all affected reader/lock/DPS/REX circuits, network and AC sources, cable routes, lock loads, fire interfaces and ward operation. Furnish the final schedule and drawings. Resolve manufacturer compatibility and ordinary fit details as contractor design obligations; promptly report concealed conditions or a scope-changing conflict to the CO before proceeding. Do not assume a software upgrade is authorized. Confirm the door/frame supply scope and the original heading “UPS #1” during the pre-bidt; the CO shall publish common clarification before final quotations. Do not infer an additional UPS procurement requirement from that heading.

4 Cabinet and controller installation R11 Consolidated equipment cabinet. Provide one consolidated access-control cabinet containing the GCM, all four ACMs, any required auxiliary modules, DC supplies/chargers, lock-power distribution and relays, protective devices and Phase 1 batteries. Basis of design is LifeSafety Power E12S Software House unified enclosure, nominal 48 H × 36 W × 8 D inches, with exact current manufacturer-supported G2 backplate and full internal assembly. Separate wall power boxes, relay boxes or supplementary control/battery cabinets are prohibited unless a documented unavoidable technical necessity receives written VA Engineering concurrence and required CO authorization. Do not reduce 32-reader capacity or omit batteries to obtain fit. Field readers, lock hardware and building fire equipment remain at their required locations. Install in the designated signal closet shown on the marked-up project blueprint supplied through William Penhallegon. The blueprint is associated with Kelly Stahley; its drawing number, date and revision shall be recorded when supplied and included in the solicitation. Verify fit, anchorage, service access and manufacturer location restrictions, including restrictions on installation within patient-care areas. Refer conflicts for technical review before installation.

R12 Supported assembly and fit. Install one Software House GSTAR-GCM and four GSTAR-ACM boards, using the manufacturer-supported unified mounting arrangement, standoffs, brackets, harnesses, partitions and service clearances. All four ACMs shall be installed, powered, recognized by the GCM and available at Phase 1 acceptance; an empty board position does not comply. Obtain written enclosure/assembly manufacturer confirmation of the exact G2 board revisions and the entire power/battery arrangement. No improvised stacking, adhesive-only mounting or listing-defeating field alteration is permitted. E12M Mercury backplates and smaller sixteen-reader assemblies do not satisfy this project.

R13 Dimensioned serviceable layout. Show cabinet H/W/D, wall footprint, door swing, conduit entries, mounting surface/anchors, loaded weight, battery locations and removal paths, AC/DC separation, required working space, component clearances, wire duct and ventilation. Maintain each manufacturer’s thermal, electrical and service clearances; terminals and fuses shall remain accessible with the assembly installed. Do not place a cabinet where service obstructs required egress or equipment working space.

R14 Safety and listing. Comply with NFPA 70, NFPA 101, NFPA 80, applicable accessibility, VA installation/safety requirements and manufacturer/listing conditions in the editions governing this facility and project. Contractor shall identify those editions and applicable door-locking provisions in H1 for VA fire-safety review; publication of a newer edition alone does not establish its adoption. Provide applicable UL 294 access-control/power listing evidence and listed fire-rated hardware where required. Maintain required AC/DC and power-limited/non-power-limited separation, bonding and clearances. A cabinet or component listing alone does not validate an altered assembly. Refer conflicts to VA fire safety/AHJ before installation; ward policy cannot waive life-safety obligations.

R15 Wiring quality and labels. Provide durable machine-printed labels at both ends of every cable and conductor group identifying door, controller, module, port, input/output and power circuit. Label fuses, disconnects, voltages, battery polarity and fire interface. Use protected entries, strain relief, manufacturer-compliant terminations, bend radii, shielding/grounding and organized service loops. Place supervision resistors at monitored field devices as prescribed; do not defeat field supervision at the panel. Document all terminal numbers and interconnections.

5 Power and battery backup R16 Power supply design. Provide three manufacturer-supported LifeSafety Power FPO250 supplies in the same E12S cabinet: one 12 VDC logic/reader supply and two separate 24 VDC lock-power groups. Submit manufacturer confirmation of the complete assembly. Provide required 32-reader power capacity with minimum design allowances of 0.25 A at 12 VDC per reader and 0.50 A at 24 VDC per lock position, using actual device loads when higher, plus all controller, auxiliary, monitoring and charger demand. These are load-sizing minimums, not measured device currents. Calculate normal, worst simultaneous, inrush, voltage drop, branch limits, charging, thermal and applicable listing derating for each supply and the complete assembly. Do not parallel outputs without manufacturer support. Do not reduce the three-supply requirement or capacity to resolve a shortfall; submit any incompatibility or fit conflict for written technical review before ordering.

R17 Protected lock outputs. Provide 32 individually controlled and protected lock-output positions using supported G2 ACM wet/dry outputs and integrated supply/distribution arrangements. The thirty-two primary lock positions are distinct from auxiliary relay outputs. Use integrated onboard protection/relays where adequate; add only manufacturer-required supported distribution/relays inside the same cabinet. Rate contacts and protection for actual voltage, steady/inrush and inductive loading and use required suppression. Map both 24 VDC supplies to defined branch groups; do not assume aggregate current is available on every branch or bus. Preserve hardware fire-interlock behavior and separation of lock and logic power.

R18 Battery sizing and accommodation. Provide one appropriately configured supervised battery bank per supply, all inside the same cabinet. Contractor shall calculate battery quantities and capacity from manufacturer discharge curves, end voltage, aging/temperature derating, conversion losses and charger/recharge limits. Provide four hours at the approved worst-case installed Phase 1 standby load, including all four ACMs, followed by fifteen minutes of required access-control and lock operation. Maintain required ward and egress behavior. Use new batteries within manufacturer date/shelf-life limits, fully charged before testing. Demonstrate dimensioned fit and service/removal access; do not add series battery Ah. Prove initial runtime by witnessed full-duration T09 testing. During testing and recovery maintain approved temporary protection. Restore required standby capacity through recharge or equivalent fully charged replacement batteries, verify normal charging and no battery faults, and document restoration before final acceptance. Calculations or nameplate life alone do not prove runtime or guarantee service life.

R19 Fault supervision. Report cabinet tamper and manufacturer-supported AC failure, supply/system fault, low-battery and battery-disconnect conditions to the existing C•CURE system. Use supported contacts/interfaces and supervised inputs with clear event and restoration text. Manufacturer-supported combined fault alarms are acceptable when the point schedule clearly identifies every represented condition and any limitations. Do not require separate alarms for conditions combined by the supported manufacturer interface. Include required fire-interface monitoring. Safely demonstrate supported fault and restoration reporting at acceptance.

6 Equipment and capacity R20 Equipment reconciliation. Furnish the fixed equipment and performance schedule in Attachment 2: one GCM, four ACMs, one complete E12S unified cabinet/power/battery assembly, at least fourteen installed readers (eight wall and six keypad), four new complete-door packages, DPS at every affected door, use of existing VA-provided enterprise entitlements, composite cable and contractor-provided pathways. Reconcile every original SOW line in the H1 BOM. Fourteen G2-RM-4E boards and two ambiguous OSDP 18 modules are not mandatory in the centralized design: onboard ACM I/O and lock functions are the basis. Furnish additional in-cabinet modules only if a documented supported point/function need remains; do not omit a required function or add an external enclosure. Contractor shall verify whether additional modules are necessary for the actual point/functions, obtain written technical acceptance before ordering them, and mount all such modules inside the same cabinet.

R21 Reader and controller capacity. Provide 32 logical wired-reader positions using one GSTAR-GCM and four eight-reader GSTAR-ACM boards, all installed, powered, recognized and functional at acceptance. Provide manufacturer-backed confirmation of the required 32-reader High Assurance capacity with the exact C•CURE, G2, reader and HA configuration before ordering. Return any capacity shortfall for VA technical review; do not silently reduce capacity or assurance. Allocate fourteen active reader positions, or the amended quantity, and identify unused positions. Entry/exit readers consume separate reader positions. Document actual onboard inputs, primary lock outputs and auxiliary outputs without double-counting.

R22 Door and input modules. Use centralized home-run reader and door wiring to ACM ports and onboard supervised I/O/lock outputs. Provide one OSDP reader per allocated RS-485 port for Phase 1; no mixed RM/Wiegand segment or undocumented daisy-chain is permitted. The four ACMs provide 96 published supervised inputs and 64 total outputs, including primary lock and auxiliary functions; allocate actual points and ratings without double-counting. Do not purchase the original fourteen RM modules merely because RM-4E appears in the old list. Resolve the original OSDP 18 entry as a traceability item; if an OSDP-I8 is actually necessary, identify each of its eight required inputs and mount it inside the cabinet.

R23 Reader selection and new hardware. Provide Identiv uTrust Series readers as the Bay Pines basis of design: eight wall readers, C•CURE-qualified Identiv/JCI IDV-9110AB (APL 10176), and six keypad readers, IDV-9210AB (APL 10178), terminal type, or acceptable APL-listed compatible readers under R03. The supplied approval identifies hardware 7.5.08 and firmware 7.6.35 for those variants; use the approved supported configuration or a documented current approved successor. Do not treat another OEM firmware image as interchangeable. All fourteen readers shall be installed, configured and functionally accepted in Phase 1, with none substituted by loose spare delivery. Furnish four new Grade 1 electrically controlled lock assemblies with DPS and REX, hardware power transfer, mounting and required interfaces. For ordinary free-egress latch doors, the hardware basis is HES 1006 fail-secure 24 VDC strike or equal with the correct listed faceplate and retained compatible mechanical egress. Where a ward-specific approved clinical/special locking arrangement or door construction makes that basis unsuitable, contractor shall furnish a listed functionally suitable assembly under R47, not select an unsafe generic strike. Keep all mandated functions within the base scope.

R24 Software and HA licenses. The existing VA enterprise license capacity and required entitlements are available for this installation. Do not include automatic purchases of fourteen generic licenses, duplicate HA suites or additional reader licenses. Coordinate with authorized VA administrators to verify existing entitlement activation and integration for the required configuration. Refer any unexpected entitlement conflict to VA technical reviewers before ordering or making changes; additional purchases or system upgrades require written authorization.

R46 Door position switches. Provide working supervised DPS at every Phase 1 affected controlled door, including every monitored leaf of a pair. Include new DPS with each of the four complete packages and furnish/replace contacts elsewhere where absent or unsuitable. Contacts shall be listed for the application, suitable for actual metal/wood door and frame construction, protected from casual tampering and connected to dedicated supervised C•CURE inputs with field end-of-line devices. Use concealed magnetic contacts where compatible with the door rating/construction; use supported protected surface/armored arrangements where concealed installation would compromise the assembly. A strike latch monitor or software lock command does not substitute for actual door-open/closed sensing. Show each leaf’s status and aggregate door alarms correctly; no bypassed or panel-located resistor may mask a field wiring fault.

R48 Required 32 reader capacity. Provide the complete 32-reader cabinet/controller installation and rated power provision required by R11–R22. Label all active and unused reader, input and output positions and provide supported wire management and cable entries. At fourteen installed readers, eighteen reader positions remain unused; update the allocation to the issued quantity. Demonstrate hardware operation and manufacturer-backed 32-reader HA capacity under T17. Unused positions do not substitute for any of the fourteen required installed readers.

7 Integration and door functions R25 Supported enterprise integration. Integrate with the existing VISN 8 C•CURE 9000 3.10.1 CU02 system, or a later manufacturer-supported release already authorized by VA. Plus does not authorize the contractor to upgrade production software. Provide exact manufacturer support evidence for the reader/firmware/G2/HA-service combination and apply current GSA approval restrictions. GSA APL status and C•CURE version compatibility are separate checks. Preserve existing server/SAS, partitions, naming, groups, credentials and monitoring. No new server, production database, MAS/SAS architecture change or global-object change is authorized without a reviewed technical plan and required CO action.

R26 200 bit identifier preservation. Preserve and test the established full 200-bit credential format at every affected reader for which the existing credential population uses it. Record exact site fields and mapping rather than truncating to a card number. Test approved identities differing in relevant high-order fields for correct distinct mapping and authorization. Separately demonstrate required cryptographic PIV/CAC authentication; successful transport of an identifier, an APL logo, or the reader family name alone does not establish HA operation.

R27 HA authentication and enrollment. Provide supported C•CURE HA enrollment, certificate validation and cryptographic authentication for affected PIV/CAC readers using the existing approved VA HA trust and policy infrastructure. Minimum new-reader credential capability shall include contactless PKI-CAK; retain any stronger applicable existing mechanism, required PIN or other factor. At keypad doors implement the established ward-authorized card/PIN sequence; do not infer PKI-AUTH support or enable identifier-only access from keypad presence. Verify enrolled identity, certificate validity/path/status and refresh rules; preserve existing approved offline/cached-status policy. If a required mechanism needs a contact reader, furnish the supported contact-capable uTrust counterpart or equally compliant APL-listed reader, with technical evidence. Do not introduce biometrics or relax an assurance level without written authorization. Resolve actual existing policy and service details at H1 with authorized administrators, not the CO as equipment designer.

R28 OSDP Secure Channel. Use OSDP Secure Channel on all affected reader communications; ordinary OSDP, RM or Wiegand does not meet that requirement. Provide one Phase 1 reader per dedicated port, manufacturer-compliant RS-485 data pairs, supported speed/address/termination and cable distance. Protect keys, use non-default production keys as supported, disable installation/default-key mode after commissioning and prove encryption per link. Disclose and resolve any reader/controller/firmware limitation before ordering. A component that only reads a PIV number over Wiegand is not an acceptable equivalent.

R29 Permissions and offline operation. Preserve existing authorized access groups, schedules, holidays, keypad commands, door alarms and ward-specific staff/clinical functions. Contractor shall capture baseline sequences with Electronics Shop, ward leadership, VA Police and VA fire safety, then submit the complete normal/fire/power/network-loss/staff-release/reset matrix under R47. Local controller operation shall follow the approved HA cache/status and access policy and queue/reconcile events after reconnection. No network outage may silently bypass a credential factor, defeat an emergency-release path or unilaterally change a ward locking rule.

R47 Life safety and ward operating sequence. For each affected door, deliver a documented sequence meeting applicable life-safety/fire/accessibility requirements and established ward rules. Contractor shall field-verify clinical use with ward leadership and locking classification with VA fire safety/AHJ; these reviews confirm lawful operational constraints and do not ask Contracting to design hardware. Sequence shall identify authorized entry, patient/staff egress, staff override/emergency release, any nurse-station interface, required fire/smoke/sprinkler release, loss of AC/battery/controller/network, tamper/forced/held alarms, fail state and reset/relock. Ordinary egress shall operate without software/network or credential dependency where required. Clinical/special locking is permitted only when its actual code conditions and VA approval are documented; do not add delayed egress, blanket-unlock all ward doors or let a motion REX defeat approved patient-security controls. Where sensor-released electric locking requires independent manual/hardware release, provide it; a controller command is not a substitute. Preserve fire-door latching and approved staff rescue access, and provide required tamper/ligature-resistant hardware where the ward’s documented risk conditions require it. Conflicting ward/code instructions are resolved before H1; no approval may waive applicable law.

8 Security cable and pathways R30 Personnel and facility access. Before applicable access, submit personnel roster, role/access duration and required vetting/badging paperwork through the COR by VA-approved channels. Each employee/subcontractor shall satisfy the VA personnel-vetting/credentialing clauses, VA-assigned position designation and applicable escort/access conditions. Obtain required screening and access authorization before beginning applicable work; wear issued identification and follow check-in/escort procedures. VA security/ISO determines role-based requirements under current policy, including applicable VAAR 852.204-70 and 852.204-72 deviations. No blanket investigation tier or security clearance is invented by this SOW. Revoke and return access credentials on reassignment/completion.

R31 Information and system access. Before system access complete applicable VA privacy/security training, Rules of Behavior and privileged-access approvals. Use named least-privilege accounts, VA-approved devices, network settings and storage; protect credential, key and configuration data. No unapproved remote access, cloud transfer, personal-media copies or shared administrator accounts. Report suspected incidents immediately to the COR and designated VA security contact, following contract reporting requirements. Transfer sensitive closeout files through VA-approved secure channels. For new equipment and its integration, implement manufacturer-supported encrypted controller-to-C•CURE communications, replace default credentials, hand over credentials securely, use VA-approved supported firmware, and disable unnecessary services, diagnostics and ports where compatible with required operation. Document and verify these settings before acceptance. Enterprise-wide software, architecture or security changes require separate authorization.

R32 Occupied facility installation. Coordinate with VA Engineering, Electronics Shop, IT, VA Police and affected occupants. Protect occupied areas, utilities and existing equipment; implement the VA-approved infection-control, dust/noise, life-safety and work-area protection measures. Keep required egress open. Repair project-caused damage and restore finishes; firestop each disturbed rated penetration with a listed system appropriate to the actual assembly, recording system and location. Remove installation debris daily, perform a final sweep, remove abandoned wiring and conduits only where identified for removal and VA authorizes, and leave the work area clean and undamaged. Do not disturb retained shared infrastructure.

R44 Contractor furnished pathways. Provide all required conduit, raceways, sleeves, pull/junction boxes, reader/device boxes, supports, fittings, bonding, penetrations, pull strings, identification, firestopping and restoration for the Phase 1 system, including required AC/network connections from available VA-authorized sources to the cabinet. Include their installation in the fixed price; do not assume Government-furnished pathways. Existing usable pathways may be reused only after verifying capacity, condition, permitted use and written technical concurrence; contractor remains responsible for required new routes and continuity. Use minimum 3/4-inch EMT for accessible indoor door home-run routes, larger where fill/bend limits require; concealed flexible final connections and wet/corrosive-location raceways shall be listed and appropriate to the actual environment. No unsupported ceiling-grid attachment or exposed unprotected cable in occupied/service areas. Keep power/communications separation and rated assemblies intact. Contractor shall provide AC wiring from the VA-designated suitable source, required disconnect/protection and labeling, and network cabling/pathway/termination to the VA-designated connection. VA IT or authorized administrators provide network authorization, VLAN/IP and switch-port configuration and system access. Contractor coordinates these interfaces. Four new hardware packages include necessary door/frame preparation and listed modifications. Confirm supply of door leaves/frames and the meaning of “UPS #1” at site access; issue common clarification before final quotes.

R45 Composite door cable. Wire each Phase 1 door using new factory-assembled access-control composite combo cable with individually identified reader data/power, lock power, DPS and REX components. Provide genuine low-capacitance shielded twisted data pairs suitable for RS-485/OSDP; generic untwisted Wiegand cable is insufficient. Minimum composite construction: reader element with two shielded low-capacitance twisted pairs of 22 AWG or heavier plus a power pair of 18 AWG or heavier; DPS and REX elements of at least four conductors each, 22 AWG or heavier; lock element of at least two conductors, 16 AWG or heavier. Equivalent construction requires technical acceptance and shall meet or exceed these minimums and all device-specific requirements. Use stranded copper, no copper-clad aluminum; CMP in plenums and the required listed rating elsewhere. Verify impedance, capacitance, shielding, gauge, pair usage, terminations and supported distance against both controller and reader instructions. Upsize power conductors or provide an approved supported cable arrangement where voltage-drop/inrush requires; do not use spare random conductors as a substitute for specified data pairs. Home-run to the new cabinet, label both ends, use accessible junctions only and document continuity/polarity/shield and operating-voltage tests.

9 Outages and completion R33 Outage hold point H2. Request each service interruption at least five business days in advance with affected doors, maximum window, contacts, temporary ward/security measures, egress protection, backup/rollback and restoration checks. Obtain written COR operational release after coordination with Electronics Shop, ward leadership, VA Police, fire safety and enterprise administrators. Plan no more than one affected door at a time unless a reviewed common-controller outage requires a specifically approved protected sequence. No outage may extend beyond its released window or leave an unsecured or unlawfully locked door. On unexpected failure, secure the area and immediately notify the COR; only the CO authorizes contract changes.

R34 Migration and restoration. Before changes capture VA-approved backups of affected database/configuration, controller settings and relevant HA configuration and document a viable restoration method with VA administrators. Migrate in bounded door groups, pretest where feasible and provide approved temporary security while a door is impaired. Restore scheduled functionality or execute rollback by the approved window end; secure and notify VA immediately if restoration fails. Do not remove safeguards until VA verifies normal operation.

R35 Working hours and fixed price. Routine work is 7:30 AM–4:30 PM Eastern Time Monday–Friday, excluding Federal and observed holidays. Submit after-hours requests through the COR at least five business days in advance for operational approval. Include all required planned after-hours cutovers, witness testing, travel, staging and support in the firm-fixed-price quotation; scheduling concurrence alone does not authorize extra compensation. Complete all Phase 1 work, tests, deficiency correction and closeout within 120 calendar days after notice to proceed. Bidders shall identify lead-time or scheduling conflicts before award; identify long-lead items and access constraints in the initial schedule; only the CO may change contractual completion, scope or price.

10 Commissioning and acceptance R36 Acceptance test plan. Submit detailed T01–T18 procedures with H1, including each affected door/leaf, all fourteen readers, four new packages, every installed controller/ACM/supply and all reserved hardware positions. Use the approved actual ward settings and emergency sequences as pass/fail values; do not invent operational delays to make a test pass. At least five business days before witnessed tests, submit contractor pretest/readiness records, intended witnesses and safe fault-test methods. Explain test applicability in advance; N/A may not waive a required installed function. Unused reader positions shall be tested under T17 using compatible supported test equipment.

R37 Witnessed pass fail results. Witness tests with COR-designated Engineering/Electronics Shop/enterprise staff, ward representative and VA Police/fire safety for applicable sequences. Record test/requirement ID, door/reader/leaf or reserved port, expected/actual behavior, timing and measurements, configuration, tester, witness and pass/fail. All required outcomes must pass; N/A requires a valid approved basis. Submit results within five business days after testing. Demonstrate all installed readers in place; bench testing ten loose readers does not satisfy fourteen installed Phase 1 readers.

R38 Deficiencies and acceptance. Correct and retest all nonconforming functions and dependent regression functions within the contract period at no added cost for nonconforming work. Final acceptance requires fourteen installed operational readers (or amended quantity), four complete new-door packages, required DPS/ward/life-safety operation, full 32-reader cabinet hardware and power-capacity evidence, successful applicable T01–T18 results, closed deficiencies, existing entitlement confirmation, restored battery standby capacity and complete closeout. Acceptance is written by the authorized Government official; partial use or a contractor certificate alone is not final acceptance.

11 Property and documentation R39 Removed Government equipment. Inventory and label removed equipment by asset/serial number and source location. Protect and segregate it pending VA property/IT/security disposition instructions. Do not sell, discard, sanitize, destroy or remove Government assets from site without written authorized release. Retain equipment VA designates for spares or evidence. For data-bearing equipment use VA-approved sanitization and verification before released disposal; record method, operator, verification, asset and disposition receipt. Dispose of batteries/electronic waste through lawful approved channels.

R40 Closeout documentation. Provide draft O&M/as-built package at least 5 business days before witnessed tests; update final documents within 10 business days after successful retest and before final acceptance. Deliver three complete paper O&M sets, searchable PDF set and editable native drawings/schedules through VA-approved channels. Include installed BOM/serials, door/reader/controller/module/port allocation, terminal diagrams, cable labels, settings and sequence, power/battery calculations and measured results, network/HA integration, licenses, signed tests, deficiency closure, manufacturer instructions, warranty/support contacts and disposal records. Transfer keys/passwords separately by secure VA-approved method.

R41 No formal training. Formal operator or maintenance training is not required. VA personnel already operate the established system. Provide the complete O&M, configuration and as-built documentation required by R40; do not include a separate training session or training cost.

12 Warranty R42 Warranty. Provide a 12-month contractor warranty on furnished equipment, software configuration/integration and workmanship starting at written final acceptance, subject to the contract warranty clauses. Transfer longer manufacturer warranties without shortening them. Correct covered defects in parts, labor, programming and travel without added cost; identify exclusions and manufacturer software-support terms before award. Do not represent this warranty as a new multiyear SSA or assurance that existing third-party enterprise software is defect-free.

R43 Warranty response. For covered warranty defects provide a reachable emergency support contact. For a security-critical covered defect acknowledge within four elapsed hours, including weekends and holidays, and coordinate an interim protection/restoration plan with VA within the same four-hour period. Provide onsite support by the next business day when needed; maintain approved interim protection until restoration. For noncritical covered defects acknowledge within one business day and provide a corrective-action schedule within two business days. These are response commitments, not a guaranteed four-hour repair. VA retains immediate facility protection responsibilities. Use only VA-approved remote methods.

Commissioning test register T01 Enterprise and licensing For each controller and logical reader, verify online status in the existing authorized VA SAS/enterprise, correct names/partitions and event routing; exercise an event at each reader and confirm the correct monitored door. Inspect active license entitlements and supported firmware/release matrix. Pass: all scheduled devices online and all required functions licensed, with no unapproved independent production system.

T02 Authorized denied and 200 bit credentials At each applicable reader, present an authorized test credential, a valid credential without permission, and VA-approved credentials differing in significant identifier fields. Pass: correct door releases only for the permitted credential and schedule; full required 200-bit identity mapping remains distinct in the approved configuration; denied events identify the correct reader/reason. Record mapping evidence without exposing credential secrets.

T03 High Assurance enrollment and authentication For each HA-designated reader, demonstrate the approved enrollment/validation workflow and required cryptographic challenge-response and PIN/factors. Test authorized valid, expired, revoked and untrusted credentials through approved test credentials or controlled vendor-supported test fixtures. Pass: valid permitted identity succeeds and each negative case is denied for the expected reason; certificate path/status evidence and refresh behavior match approved policy. Never revoke a live employee credential merely to test.

T04 OSDP Secure Channel and keypad For every reader link verify active OSDP Secure Channel, supported production keys and disabled default/installation-key mode. Safely test link fault and recovery; insecure substitution shall not grant access. For each keypad reader test its documented ward mode: card plus PIN requires an authorized card and correct PIN, with incorrect PIN denied; card-only mode accepts authorized cards without a PIN; scheduled modes require testing each mode and transitions. Verify required keypad commands. Keypad availability does not itself prove PKI-AUTH.

T05 Lock operation At every affected lock operate authorized access, scheduled unlock and operator command where permitted; observe physical latch/relock after closure. Pass: hardware, voltage and command match approved sequence and fail mode, no unintended adjacent door release, no binding and lawful egress at all times. Record actual unlock/relock timing against approved settings.

T06 Door position and supervision Open/close each door and safely simulate open-circuit/short-circuit field faults on supervised DPS circuits. Pass: correct door position, distinct configured fault indication and restoration appear at designated C•CURE monitoring; no disabled or bypassed point remains.

T07 Request to exit Activate every affected REX device in each approved exit sequence. Pass: expected lock release or alarm shunt occurs, door event is correct, shunt expires as configured, and ordinary/ emergency egress works independently where required. A motion sensor signal alone does not prove code-compliant release.

T08 Door alarms and permissions At each door simulate forced opening and held opening past the approved delay; test permitted and prohibited access schedules using controlled time/schedule methods without changing enterprise time. Pass: correct alarm, priority, location, delay, routing, acknowledgement and restoration; permissions/holidays match baseline or approved change. Safely demonstrate cabinet tamper and supported supply AC-loss, system/supply and battery alarms and restoration. Combined contacts pass when manufacturer-supported, clearly documented and correctly identified in event text.

T09 AC loss battery autonomy and restoration For each installed supply/battery system, safely interrupt AC and prove four hours at the approved worst-case installed standby load, including all four ACMs, followed by fifteen minutes of required operation. Begin with fully charged new batteries within manufacturer shelf-life/date limits. Record actual loads, battery currents/voltages, end-device voltages, reader/lock operations, ward/egress behavior, supported faults/restoration and pass/fail. Test every installed reader during the sequence. Pass requires full duration, acceptable voltages and correct functions without premature shutdown, data loss or unintended release. Maintain approved temporary protection during discharge/recovery.