S06. Amendment 0001 36C26326Q0427 0001_1.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 7

636-26-2-5067-0047

36C263

DEPARTMENT OF VETERANS AFFAIRS

NETWORK CONTRACTING OFFICE 23

2501 W. 22ND STREET

SIOUX FALLS SD 57105

DEPARTMENT OF VETERANS AFFAIRS

NETWORK CONTRACTING OFFICE 23

2501 W. 22ND STREET

SIOUX FALLS SD 57105

36C26326Q0427

X

X X

** HOUR & DATE for Receipt of Offers is EXTENDED to: 03-17-2026 5:00PM CDT

See CONTINUATION Page 636-3660152-5067-840700 2625 010040700 636-26-2-5067-0047

X one

C•CURE 9000 and TLS Encryption Upgrade for the VA Nebraska Western Iowa Health Care System for a period of Performance 03/30/2026 to 06/30/2026.

The purpose of this amendment is to:

1. Publish Technical Questions and Govenment Answers

2. Publish an updated Statement of Work

3. Extend the solicitation period. All quotes are due by Tuesday, 3-17-2026 at 5:00 PM. Quotes shall be sent via email to amanda.patterson-elliott@va.gov.

John Milroy

VA-VHA-RPOC-2023-0067

Technical Questions and Answers

36C26326Q0427

Question # 1.

a. The SAM.GOV Bid Description lists 2 locations

i. “C CURE 9000 and TLS Encryption Upgrade for the VA Nebraska-

Western Iowa Health Care System, 4101 Woolworth Avenue, Omaha, NE 68105

ii. AND for the Department of Veterans Affairs, Grand Island VA Medical Center, 2201 N Broadwell Ave, Grand Island, NE 68803.”

b. While the SOW only lists 1 location

i. “2. PERFORMANCE LOCATION:

ii. 2.1. Department of Veterans Affairs Nebraska-Western Iowa Health Care

System, Omaha Division Medical Center, 4101 Woolworth Avenue, Omaha, NE 68105”

c. Could you please confirm which location(s) are included in the scope of work?

Government Answer: The place of performance is VA Nebraska-Western Iowa Health Care System, 4101 Woolworth Avenue, Omaha, NE 68105 AND for the Department of Veterans Affairs, Grand Island VA Medical Center, 2201 N Broadwell Ave, Grand Island, NE 68803.

Question # 2.

Additionally, if both locations are included, are the two C-CURE systems linked or managed separately?

Government Answer: The systems are linked.

Question # 3.

Question on the Period of Performance:

d. SAM.GOV Bid Description: “The period of performance is 03/30/2026 to 06/30/2026 for the base year period of performance.”

e. SOW: “PERFORMANCE PERIOD: 04-01-2026 to 07-31-2026”

f. Could you please confirm which period of performance should be used for proposal planning?

Government Answer: The period of performance is 03/30/2026 to 06/30/2026.

Question # 4.

To accurately scope the work, could the Government please provide the following information regarding the existing Software House C-CURE 9000 system? (If the Omaha and Grand Island locations are both being addressed, there will/may be 2 SSNs and SSAs – please provide information on both, if relevant.)

g. The system serial number(s)

h. The current Software Support Agreement (SSA) level and status

i. Is the SSA currently active or expired?

ii. If the SSA is expired, should the contractor include renewal and update costs in the proposal?

i. The number of doors currently monitored by each system

Government Answer:

1. There is only 1 SSA for the two campuses.

a. The SSN is 9-21400

b. Status is active. Level is known.

i. Active. License will expire on 04/30/2026

ii. N/A

c. 779 doors are monitored by the software

A.1 PERFORMANCE WORK STATEMENT Amended 03-11-2026

1. Project: VAMC Access Control TLS 1.3 Upgrade and Controller Replacement

2. PERFORMANCE LOCATION:

2.1. Department of Veterans Affairs Nebraska-Western Iowa Health Care System, Omaha Division Medical Center, 4101 Woolworth Avenue, Omaha, NE 68105

2.2. Grand Island VAMC, 2201 N Broadwell Ave, Grand Island, NE 68803

3. PERFORMANCE PERIOD: 03-30-2026 to 06-30-2026

4. Project Overview

4.1. This project consists of upgrading the existing Software House C•CURE 9000 Physical Access

Control System (PACS) infrastructure from Transport Layer Security (TLS) 1.2 to TLS 1.3 encryption standards through replacement and firmware updates of affected iSTAR controllers and associated hardware.

4.2. The upgrade is required to maintain system operability, manufacturer supportability, and cybersecurity compliance due to the expiration of the default TLS 1.2 host certificate on February 18, 2026. Failure to complete this upgrade may result in loss of communication between the C•CURE server and field controllers following any system interruption or controller disconnect event.

5. Objectives

5.1. The primary objectives of this project are:

5.2. Ensure continued operation of the VA Physical Access Control System.

5.3. Upgrade system encryption to TLS 1.3 to meet manufacturer security requirements.

5.4. Replace unsupported first-generation iSTAR Edge controllers with second-generation hardware.

5.5. Update firmware on all applicable controllers to the latest supported versions.

5.6. Maintain secure connectivity between controllers and the C•CURE 9000 server environment.

5.7. Reduce cybersecurity risk exposure associated with unsupported encryption protocols.

6. Systems Covered Under This Scope

6.1. This scope includes all access control panels connected to the existing C•CURE system environment that currently operate using TLS 1.2 encryption, including:

6.2. Approximately 91 Software House control panels

6.3. 23 panels identified as directly impacted by TLS certificate expiration risk

6.4. Replacement of 52 first-generation iSTAR Edge panels

6.5. Integration with existing or EHRM-provided Ultra control panels where applicable

7. Scope of Work Tasks

7.1. Hardware Replacement and Installation

7.1.1. The contractor shall:

7.1.1.1. Furnish and install:

7.1.1.1.1. iSTAR Ultra G2 ACM and GCM boards

7.1.1.1.2. 52 iSTAR Edge G2 controller motherboards

7.1.1.1.3. Associated power supplies and batteries

7.1.2. Replace existing first-generation Edge controllers with second-generation units.

7.2. Install Ultra control panels at designated facility locations.

7.3. Connect designated Edge panels to Ultra panels provided under separate projects where identified.

7.4. Firmware and Cybersecurity Upgrades

7.5. The contractor shall:

7.5.1. Upgrade firmware on all new and applicable existing controllers to the latest supported release.

7.5.2. Configure controllers to operate using TLS 1.3 encryption.

7.5.3. Implement host-based certificates where required.

7.5.4. Reconnect all controllers to the C•CURE server following upgrade.

8. Programming and Configuration

8.1. The contractor shall:

8.1.1. Perform controller-level programming updates.

8.1.2. Configure system schedules, alarms, and operational parameters.

8.1.3. Deploy updated system graphics and configuration settings as required.

8.1.4. Utilize a VA-provided laptop with C•CURE software for initial controller provisioning where required.

9. Testing and Commissioning

9.1. The contractor shall perform:

9.1.1. Point-to-point verification testing.

9.1.2. System communications validation.

9.1.3. Functional testing of access control devices.

9.1.4. System startup and commissioning.

9.1.5. Verification of TLS 1.3 secure communications.

10. Training

10.1. The contractor shall provide operator training covering:

10.1.1. System operation following upgrades.

10.1.2. Controller management and monitoring.

10.1.3. Alarm and event response procedures.

11. Labor and Work Hours

11.1. Work will be performed during normal business hours:

Monday through Friday

11.1.1. 7:00 AM to 5:00 PM

11.1.2. Excluding federal holidays

11.1.3. After-hours work is not included unless separately authorized.

12. Equipment Summary

12.1. Major equipment included:

12.2. 1 — iSTAR Ultra G2 ACM Board

12.3. 1 — iSTAR Ultra G2 GCM Board

12.4. 52 — iSTAR Edge G2 Controllers

12.5. 1 — Ultra Power Supply System

12.6. Batteries and associated hardware

12.7. Programming and installation labor (approximately 295 hours)

13. Deliverables

13.1. The contractor shall provide:

13.1.1. Fully installed and operational TLS 1.3 compliant PACS controllers

13.1.2. Updated firmware across all affected devices

13.1.3. System configuration documentation

13.1.4. Test and commissioning verification

13.1.5. Operator training completion

14. Assumptions and Dependencies

14.1. Existing infrastructure wiring remains serviceable.

14.2. VA will provide necessary network access and credentials.

14.3. VA will provide a laptop with C•CURE software for controller provisioning where required.

14.4. Work areas will be accessible during scheduled installation periods.

15. Warranty

15.1. All installed equipment and workmanship shall be warranted for a period of one (1) year following installation completion in accordance with manufacturer and contractor warranty terms.

16. Risks of Non-Execution

16.1. Failure to execute this project prior to TLS certificate expiration may result in:

16.2. Loss of PACS controller communications after system interruption

16.3. Inability to manage facility access control electronically

16.4. Increased cybersecurity vulnerability

16.5. Operational disruption impacting patient care areas and secure zones

16.6. Emergency replacement costs exceeding planned project funding

17. Acceptance Criteria

17.1. Project completion will be considered successful when:

17.2. All controllers communicate securely using TLS 1.3.

17.3. Access control functionality is fully operational.

17.4. Testing and commissioning documentation is approved.

17.5. Training has been delivered to designated personnel.