RFQ Amendment 36C25924Q0828 0001.docx

5. PROJECT NUMBER (if applicable)

CODE

7.

ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF

PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO:

Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED

STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF

CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF

SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer) 36C259 Department of Veterans Affairs Network Contracting Office

NCO 19

6162 South Willow Drive, Suite 300 Greenwood Village CO 80111 36C259 Department of Veterans Affairs Network Contracting Office

NCO 19

6162 South Willow Drive, Suite 300 Greenwood Village CO 80111 To all Offerors/Bidders

36C25924Q0828

X X X remains 9/27/2024 at 4pm MDT X

1. The purpose of this solicitation amendment is to answer a solicitation question in regards to the CCTV system make and model which is updated and highlighted in yellow in section B.2 Performance Work Statement (PWS) on page 3.

2. The solicitation close date remains unchanged, due 9/27/2024 at 4pm MDT received via email by John Cheng, Contracting Officer, e-mail: john.cheng2@va.gov

Officer, e-mail: john.cheng2@va.gov

CONTINUATION PAGE

B.2 Performance Work Statement (PWS)

Veterans’ Health Administration – Member Services (VHA-MS) MS Waco, TX CCure PACS License and CCTV Systems Maintenance Support Services

1. GENERAL: The Veterans Health Administration (VHA) Member Services (MS) has a requirement for updating, licensing, and repairs for the current CCure Physical Access Control System (PACS) and Closed-Circuit Television (CCTV) systems located at the following location: 4800 Memorial, Building 90, Waco, TX 76711. The requirement involves repairs of the current systems, updating the CCure program, software service agreement and licensing of the PACS and CCTV system.

1.1. Description of Services: Member Services has a need for a contract to repair and update current CCURE 9000 PACS and CCTV systems. The Contractor must provide all management, personnel, labor, supplies, tools, equipment, communication devices, transportation, and fuel necessary to service, repair, update, and provide licensing for the CCure PACS systems and CCTV systems. Repairs, parts, licenses, and software updates will be paid as invoiced for each service as performed.

1.2. Objectives: Member Services has a need for a contractor that can perform emergency and routine repairs, provide software and licensing agreements, and updates to the existing CCure PACS system and CCTV systems located at the location listed above.

1.3. Scope: The Contractor will keep the CCure PACS and CCTV systems operating correctly by repairing and updating the system. The Contractor will be responsible for keeping the software and licensing agreements current. The Contractor must perform all services identified to the standards in this Performance Work Statement (PWS).

1.4. Place of Performance: The site location for this contract is: 4800 Memorial, Building 90, Waco, TX 76711

1.5 Period of Performance:

1.6. Period of Performance: Contract will be awarded for one (1) base year with four (4) one-year options to be awarded at the discretion of the Government and if funds are available for a continuance of services.

1.7. Federal Observed Holidays and Military Training Holidays: Do not schedule work on Federal holidays or days observed in lieu thereof. The Federal holidays listed below are observed. When a holiday falls on a Sunday, the following Monday will be observed as the holiday. When the holiday falls on a Saturday, the preceding Friday will be observed as the holiday. When a service is required fewer than three times per week and the time for that service falls on a holiday the work shall be accomplished on the day following or preceding the holiday.

Memorial Day Juneteenth Thanksgiving Day Christmas

Independence Day

1.8. Hours of Operation: The Contractor must schedule all normal work requirements to be performed during the normal work hours of 7:00am – 4:00pm Central Standard Time (CST) for the Waco, TX site. Any work outside the normal work schedule will require advanced coordination and approved between the Contractor and the Contracting Officers Representative (COR). These tasks must not interfere with employees working at any time.

1.9. Quality Control: Quality control is the Contractor’s responsibility. Contractor quality controls are how the Contractor assures the services are accomplished in accordance with (IAW) contract documents.

1.10. VA Quality Assurance: The VHA is responsible for quality assurance and will monitor the Contractor’s performance under this PWS. The COR is the VHA’s Quality Assurance Evaluator.

2. SPECIFIC TASKS

2.1 Updating PACS/CCTV Software: The contractor must maintain a current software agreement for the period of performance of the contract.

System IDs number for CCure System

· Waco: 9-19001 Video management system

· Waco: LTS Security Inc. Model # LTD8432T-FA

2.2 PACS/CCTV License Agreement: The contractor must maintain current license agreements for the period of performance of the contract. This site has 1 (one) license.

2.3 PACS/CCTV Service/Repair: Contractor must supply parts and labor to service and repair the CCure and CCTV systems. Parts and services will be paid through the payment system as invoiced at time of service.

· The number of devices (readers, cameras, monitors): 17 7 cameras, 1 monitor, and 55 PACS card readers

2.3.1 Emergency Repair: Repair is defined as an incident that prevents the system or device from functioning as it was designed and constitutes an emergency security issue for employees’ safety. For example: a door that will not lock or unlock, or a camera that is offline that surveils an entrance door. The Contractor shall have a service technician on site within six (6) hours of an emergency repair call.

Once on site, the Contractor’s technician(s) must report to the site Contracting Officer Representative (COR). After the Contractor’s technician determines the repair(s) need parts, the Contractor must provide a quote for unscheduled & emergency maintenance repair parts & services to the COR for review. Only the COR is authorized to approve the unscheduled & emergency maintenance quote if there are funds available from the annual unscheduled maintenance parts and service hours allowance/allocation. However, if there are not enough funds left on the annual allowance/allocated funds, then only the CO is authorized to approve additional funds through a contract modification.

2.3.2 Standard Service and Repairs: All other incidents that do not constitute a security issue for personnel working in the facility. Contractor shall have a technician onsite for standard repair calls within 24 hours.

3 Security Requirements: The Contractor shall provide the appropriate information to have access to buildings. Contractor personnel and/or sub-contractor personnel will be issued a contractor badge for access into the building upon approval.

3.1 VA Network Security Requirements: All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations, and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than 3 days.

When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 10 days.

All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g., for the convenience of VA) shall only be granted with approval of thecontracting officer and the VA Assistant Secretary for Office of Information and Technology.

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISSO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (Including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

3.2 TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior,

(2) Successfully complete the VA Privacy and Security Awareness and Rules of Behavior training and annually complete required security training.

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

3.3 Key Control: All references to keys include key cards. If required, the Contractor shall establish and maintain a key control system to ensure that VHA keys and key cards issued to the Contractor are not lost, stolen, or used by unauthorized persons. The COR and Contractor will conduct an initial inventory on all keys and key cards prior to the start of contract performance. No keys issued to the Contractor by the VHA shall be duplicated. The Contractor shall immediately report any occurrences of lost or duplicate keys or key cards to the COR.

3.4 Unauthorized Use of Keys: The Contractor shall prohibit the use of VHA issued keys by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas.

3.5 Lost and Found Property: Turn in all articles of possible personal or monetary value found by the Contractor's employees while performing duties under this contract to the COR. Obtain receipts for articles turned into the COR.

4 Post-Award Conference and Periodic Progress Meetings: The Contractor agrees to attend any post-award conference and periodic progress meetings convened by the CO or COR IAW with FAR Subpart 42.5, Post-Award Orientation.

5 Contracting Officer’s Representative (COR): The COR is an authorized representative of a CO within the scope of his or her authority and is not authorized to change any terms and conditions of the resulting contract.

6 Contractor Employees: All Contractor employees shall wear personal identification cards, or badges, while working on the Installation, to avoid creating an impression that they are VHA officials.

7 Contractor Qualifications: Contractor and sub-contractors shall possess licenses as required by state and local jurisdictions; shall demonstrate relevant years of experience installing and/or performing maintenance with Software House iStar Ultra ACSS panels and CCure 9000, current version software (Tyco Security Products) for identified systems; shall possess certificates as identified below. Industrial Security Systems shall possess factory training and awarded factory certification at time of proposal for identified systems; shall demonstrate field capability to install and maintain identified systems, shall demonstrate capability to service CCTV cameras and shall provide training and certification records as part of the quote provided.

7.1 Contractor shall be certified in Software House iStar Ultra control panel. Contractor must be able to provide proof of certifications.

7.2 Contractor shall be certified in CCure 9000, current version, (TYCO Security Products). Contractor must be able to provide proof of certifications.

7.3 Contractor shall ensure each individual employee has a least 2 years’ experience as it relates to this project, which includes but is not limited to installing and/or performing maintenance and service with Software House iStar Ultra ACSS panels and CCure 9000, current version software (TYCO Security Products), installing and maintaining security systems, and servicing CCTV cameras.

8 Contractor Personnel Conduct: Contractor personnel’s conduct shall not reflect discredit upon the VHA. The Contractor shall ensure their personnel present a professional appearance. The Contractor’s employees shall observe and comply with all local policies and procedures concerning fire, safety, environmental protection, sanitation, security, and possession of firearms or other lethal or illegal weapons or substance.

9 Accessibility: Contractor shall contact the COR for access to the facility.

10 VHA-FURNISHED PROPERTY AND SERVICES

10.1 Fire Prevention and Protection: The VHA will provide fire prevention and protection service at the facility for the Contractor.

10.2 Utilities: The VHA will furnish, without charge to the Contractor, natural gas, electricity, water, and sewage to support Contractor operations while performing the services specified herein. The Contractor is responsible for operating under conditions that preclude the waste of utilities and shall instruct employees in utilities conservation practices.

11 CONTRACTOR-FURNISHED ITEMS AND RESPONSIBILITIES Contractor shall furnish all parts, tools, equipment, communications devices, transportation, personnel, estimates, licenses, and registrations required to perform the services of this requirement.

12 Workmanship: The performance of work shall conform to the standards specified. While performing services in the building during normal duty hours, work areas left unattended shall be protected with the necessary warning signage to protect occupants from possible safety hazards such as slipping and falling. While performing services in the building after normal duty hours, maintain the physical security of the building. If the CO or the COR determine the work does not meet standards specified for a particular task, the Contractor shall redo the task at no expense to the VHA within 24 hours of notification. Any VHA property damaged by the Contractor during work performance shall be repaired or replaced immediately by the Contractor at no expense to the VHA.

12.1 APPLICABLE PUBLICATIONS: Publications applicable to the performance of work are listed below. Publications are referred to basic designation only. Assume publications to be the most current edition in effect at the time the contract is awarded. Publications referred to in the text shall be considered mandatory for the Contractor's performance of work. Comply with all mandatory publications and publications referenced therein or supplemented by the publications. All other publications shall be considered advisory in nature.

12.2 U.S. Department of Labor Occupational Safety and Health Administration (OSHA) Regulation: Available without cost at http://www.osha.gov/pls/oshaweb/owastand.display_standard_group?p_toc_level=1&p_part_number=1910 29 CFR 1910: Operational Safety and Health Standards.

End of Performance Work Statement (PWS)

TC-1

Page 1 of

Page 1 of