36C77025R0007 Attachment 1- SOW- Final.docx

SECTION C - Description/Specifications/Statement of Work

TITLE: CMOP Physical Security Maintenance and Life Cycle Management

C.1 PROGRAM DESCRIPTION AND BACKGROUND

Introduction

The purpose of this acquisition is to efficiently procure Maintenance and Life Cycle Management services for the CMOP Enterprise-wide Physical Security System. Presently all CMOP facilities have a standardized Physical Security System; with an integrated Intrusion Detection System (IDS), Physical Access Control System (PACS) and Video Surveillance System (VSS). This enterprise-wide system is highly complex and requires substantial oversight and management to maintain functionality and compliance with VA/VHA guidelines and policies. It is vital that VA CMOP ensures the devices, systems, and supporting software are well maintained and sufficiently supported in order to retain the established high level of security.

Background

Veterans Health Administration (VHA) Consolidated Mail Outpatient Pharmacy (CMOP) currently has total of (8) production facilities across the United States. The production facilities reside in Leavenworth, KS; Shawnee, KS; Chelmsford, MA; Tucson, AZ; Lancaster, TX; Murfreesboro, TN; and Hines, IL; and Ladson, SC. However, the facility in Shawnee, KS is planned to replace the facility in Leavenworth, KS.

In addition, CMOP also supports VHA Meds by Mail (MbM) which has three locations: Dublin, GA; Murfreesboro, TN; Cheyenne, WY. However, the facility in Murfreesboro, TN is planned to replace the facility in Dublin, GA.

Security is critical for these facilities as they process more than 120,000,000 prescriptions annually, handling more than 85% of the outpatient prescriptions for VHA. This requires large volumes of both controlled and uncontrolled pharmaceutical drugs to be stored and processed through these facilities.

The CMOP Security System (CSS) includes three systems: Video Surveillance System (VSS), Physical Access Control System (PACS), and Intrusion Detection System (IDS). The CMOP Video Surveillance System provides enhanced access to live and recorded video feeds ensuring physical safety and security, proper medication handling and storage and visual data for quality assurance and incident investigation. The video surveillance system includes management software (Genetec Security Center), networked video storage, and video cameras.

The VSS, Genetec Security Center, provides each CMOP with enterprise-wide access to reliable and compliant video surveillance data for enhanced physical security, medication safety and daily business operations. This ensures the patients will receive viable, effective, and safe medications, as well as ensuring and documenting a safe and secure employee workplace environment.

The CMOP Physical Access Control System (PACS) manages and controls the physical access to CMOP buildings and provides event monitoring, notifications, and reporting. The PACS software, C-CURE 9000, can integrate video, access control, intrusion, fire, and real-time location security modules to provide organizations security situational awareness. The badging module is utilized for VA Personal Identity Verification (PIV) and access control requirements.

C.2 STATEMENT OF WORK

This requirement is for Life Cycle Management of the CMOP Security System (CSS) at the eight designated CMOP facilities. Life Cycle Management includes a comprehensive service to support emergency response, preventative maintenance, unscheduled repair response, system documentation as well as managing needed system updates or changes in configuration for both the hardware and software components. Performance of these services will be through a common management system, overseen by a Service Program Manager, and implemented simultaneously and similarly by local, factory-trained and certified staff for each CMOP location. Each of the eight sites has drawings, reports and system information for the existing facility installed systems. Systems are integrated and consist of a Bosch Intrusion Detection System (IDS), Johnson Controls P2000 (exclusive to the Leavenworth CMOP) or Software House C-CURE 9000 Physical Access Control System (PACS) and the Genetec Security Center Video Surveillance System (VSS). The CSS includes additional equipment for aggregation of the camera systems and reporting/archiving of access control data across all CMOPs. The VA CMOP desires to obtain support services to ensure these systems remain operationally functional and reliable in the future. The project includes the following locations:

Leavenworth, KS 66048 Life Cycle Management- site transitioning to Shawnee set to close within FY26

Chelmsford, MA 01824 Life Cycle Management

Tucson, AZ 85706 Life Cycle Management

Lancaster, TX 75134 Life Cycle Management

Murfreesboro, TN 37127 Life Cycle Management- site transitioning to Elam Farms set to close within FY26

The project overall and at each site shall have three task areas, Service Management, Maintenance and Repair Service, Emergency and Warranty Service.

C.2.1 Service Management

1. Oversight and Management Structure

a. All service included in this contract shall be managed through a single point of contact and a dedicated Service Program Manager in the form of a Contracting Officer Representative (COR) for the coordination and management of all work. The Service Program Manager shall be responsible for facilitating, tracking and reporting for all work actions executed during the contract period. The Service Program Manager shall ensure CMOP system needs are routed to the appropriate offices and persons in order to provide efficient response to service needs. In addition, the Service Program Manager shall be responsible for ensuring that the defined response times for needed services meet or exceed contract expectations. Service Program Manager shall ensure a clear structure is established and that identified CMOP personnel are trained on the process for accessing the needed services to maintain local systems. When a needed service falls outside of the normal defined services, the Service Program Manager shall be responsible for working with CMOP to define and adjust the process to improve service support moving forward.

b. Within the first 14 calendar days of contract execution, a Service Program Manager shall be appointed and a “Management and Response Plan” shall be submitted to VA CMOP for review and approval. It is the responsibility of the service provider and the appointed Service Program Manager to hold necessary meetings with National and Local CMOP representatives, and the Contracting Officer to communicate and educate CMOP on this plan and to address any questions or discrepancies identified that may be potential barriers to providing service prior to approval by VA CMOP. This should be completed as soon as reasonably possible, but no later than 45 calendar days after the start of the contract.

2. Repair Notification and Service Access

a. Contractor shall provide the ability to request services 24 hours a day, 7 days per week, and 365 days per year for designated CMOP personnel through a centralized service unit as a single access point for CMOP activities. This may be provided via multiple methods of notification (phone, web portal, or email) but contractor shall verify and ensure that reporting service needs is functional and accessible by all CMOP locations at all times during the year. In addition, the method for submitting requests shall allow for centralized roll-up and tracking of all CMOP service requests. All work shall be coordinated, scheduled, tracked, and documented through a centralized location.

b. Contractor shall provide a template for the required information that will be needed, collected and tracked for all service calls. The format and data tracked will be reviewed and approved by the VA CMOP COR.

3. Equipment and Parts Replacement

a. Contractor shall evaluate the currently installed CMOP systems and detail count, kind, condition, criticality and location (physical and virtual) of the existing CMOP system equipment and parts. Contractor shall use the results of this evaluation to detail any necessary repairs or replacements to the equipment prior to assuming responsibility for maintenance for those items.

b. A plan with options for equipment and parts support throughout the life of the contract shall be submitted to the VA for consideration within the contract. This plan shall address contractor’s strategy for recommended equipment and components that will support maintaining the current system and minimizing the downtime of the system. The Plan shall outline:

i. levels of criticality for various system equipment and parts by system,

ii. the quantity and location’s recommended to support various levels of response,

iii. description of process for managing equipment and parts inventory

iv. effect on response actions

v. supporting data and documentation

vi. cost breakdown by option

4. Service Response Times

a. Within one (1) business day of a reported need for service by CMOP the contractor shall respond to the CMOP to determine the nature, extent and validate the criticality of the reported issue. This response may be made by telephone. The contractor’s technical representative may initially attempt to troubleshoot and resolve the reported issue via phone or use this form of notification to determine the necessary equipment and parts needed to address the problem.

b. When resolution cannot be completed remotely, the contractor shall have a service technician familiar with the requesting CMOP on-site within two (2) business days between 8AM-4:30PM local time, Monday through Friday.

c. During hours outside of the 8AM-4:30PM local time, M-F timeframe, the contractor shall respond to the CMOP to determine the nature, extent and validate the criticality of the reported issue. If the problem cannot be resolved, the National Service Organization representative shall notify the contractors designated Service Program Manager. The Service Program Manager in conjunction with CMOP COR? will determine if emergency service is necessary to secure facility and act accordingly. If Emergency service is authorized as a Time and Material activity, then a Service technician shall be on-site within the time agreed to in the specific emergency request. All information shall be documented within the service log for tracking and follow-up purposes.

d. The Certification and Accreditation requirements do not apply, and the Security Accreditation Package is not required. If remote connectivity is needed, contractor will be responsible for designating dedicated individuals that will obtain VA approved credentials for accessing the security systems remotely. This includes all background checks, training and information needed to obtain PIV credentials and VPN/CAG level access. These individuals will be sponsored by the VA CMOP COR .

5. Service Tracking and Reporting

a. As noted in section 2.a. above, contractor shall have a single point that the CMOP COR(s) can use to coordinate both scheduled and unscheduled actions. Contract shall provide a plan for the documentation, tracking and reporting of all work performed under the contract.

b. Performed work shall be collected in sufficient detail to monitor all aspects of equipment and system performance.

c. Data relative to any work action shall be collected in a manner that allows tracking and trending on a CMOP system wide basis as well as the ability to stratify data by equipment type, make, and model, and location, type of work action, dates, work disposition and component criticality.

d. CMOP shall be given access to data and reports at various levels in order to monitor system performance. Data shall also be used to track contract performance and identification of future areas of improvement between contractor and VA CMOP.

e. Contractor shall provide samples of data collection methods, tools, forms, and formats prior to commencement of the contract for CMOP to evaluate.

f. Contractor shall provide support and training to designated CMOP personnel on access and utilization of databases and reports. Contractor shall provide support for providing custom reports on collected data when not readily available or accessible.

6. Maintaining System Documentation

a. All data collected during the life of the contract shall be maintained throughout the duration of the contract.

b. Data collected shall have regular and recurring backups in order to minimize the risk of data loss from hardware and software loses.

c. All written hard copies of data collected during the contract shall be scanned and turned over to VA CMOP when requested or at least annually as necessary. This includes all service tickets, inspection, testing, maintenance and other associated documentation.

d. Contractor is responsible for updating and maintaining all system documentation during the duration of the contract. This includes providing updated system drawings on a regular and recurring basis to ensure any changes and modifications to the system are maintained and accurate. Contractor shall submit a plan and process for completing updates of both local and enterprise-wide documentation on at least a semi-annual basis. Drawing shall be submitted in both AutoCAD Version 12 or newer and Adobe PDF format. The VA CMOP will provide facility drawings (physical and network) suitable for use as a basis to plot the ESS components physically and virtually.

e. For any equipment changes, updates or modifications noted on the drawings, the contractor shall provide updated Equipment record information as well as any associated product specification information, operating and maintenance literature for the new components. This includes software and hardware related items.

7. Site Requirements, Security and Work Safety

a. Contractor workers shall become familiar with local CMOP security requirements as it pertains to access for both the site and specialized areas. Workers shall adhere to all CMOP policies relative to working within the CMOP environment.

b. Contract workers shall be required to comply with all Federal, Agency and local CMOP safety and occupational health policies and requirements when conducting work. Where a safety plan or procedure does not exist, safe practices shall be developed between the contractor and the local or national CMOP COR prior to work commencing.

c. Contractor is responsible for ensuring service workers have appropriate personal protective equipment and are trained in safe work practices and the use and care of issued Personal Protective Equipment (PPE).

C.2.2 Maintenance and Repair Service

1. System Equipment and Hardware

a. Contractor shall evaluate the equipment installed across the entire enterprise-wide system and present VA CMOP with a risk based Maintenance and Repair program that uses manufacturer’s recommendations, industry standards, past performance and component equipment history information in order to maximize the operating effectiveness of the system while minimizing the necessary resources to maintain the system over its operational life.

b. Program in consultation with the COR and based on their initial findings shall rank components by how critical they are to the operation of the system and the functional role they play within the system. The program shall weigh in other important factors, such as:

1) the time/cost of repair or replacement of the component,

2) relative availability of the component,

3) degree of redundancy within the system,

4) age and operating condition of the component,

5) and other factors

c. Program shall recommend which equipment, and components should be included in a regular and recurring preventative management program, components that should be monitored through predictive or other methods and which components should be maintained through a repair and replace process on a case-by-case basis. Methodology and basis for recommendation shall be presented to CMOP for review and acceptance no later than 15 days after determination. Contractor may also recommend multiple alternatives for maintaining any of the system components along with the corresponding risk for VA CMOP to consider.

2. System Software – Contractor shall be responsible for supporting and maintaining the software for the IDS, PACS, Enrollment and VSS systems.

a. Contractor shall review, update, document and evaluate the current software and firmware for each of the operating integrated operating systems and system hardware, that are not on the VA Network, or under management by VAOIT, and have current SSA’s (Software Service Agreement or License), login’s and our actions do not violate any warranty or other agreement the VA may have in place. Software that is not current at time of acceptance into this maintenance program will not be updated within this pricing structure. This effort is a base maintenance program which is different from the upgrade programs priced in Options 1 and 2.

b. Based on review and evaluation, contractor shall provide its recommended plan for:

c. System software training and support as needed for users in on-going development and use of the system (schedules, analytics, report generation, etc.).

d. Software maintenance shall be provided for all commercial software provided under this Contract in accordance with customary commercial software maintenance terms and conditions offered to the general public, to include all fixes, updates and changes necessary to maintain the software in an operational state.

3. Inspection and Testing – Contractor shall provide full system testing and inspection once (1x) per year. Inspection and testing shall be conducted to identify and document that the system is still operating in its installed state. A

a. Contractor shall provide an inspection and testing plan that includes the inspection of all system components and the testing protocol being used for review and approval by the Designated National CMOP Representative. Plan shall include all testing procedures, check sheets and other documents that will be used to conduct inspections and tests.

b. All inspections and tests shall be documented. A copy of the inspection and testing performed shall be provided in a summary report format with the inspection and testing documentation attached as back up for the items noted in the report. Two electronic (2) copies of the report shall be provided to VA CMOP COR. One (1) copy of report shall be provided to the CMOP where the inspection and testing occurred, and one copy shall be provided to the designated National CMOP COR representative.

c. Each report shall include a portion within the summary that outlines the discrepancies noted and any corrective action taken during the inspection and testing process. Any items that could not be resolved during the inspection and testing process shall be noted in the report with a reasonable timeframe for corrective action to be completed but not more than 30 days after the inspection and testing date. Any items deemed to be outside of the scope of this contract shall be annotated for review by the contracting officer and the designated VA CMOP COR to make a final determination on how to resolve the discrepancy. All noted items from inspection and testing reports shall have a unique identification assigned and tracked until resolved or complete.

d. Inspection and testing shall be separate and complimentary of the schedule for routine Preventative Maintenance.

4. Preventative Maintenance (PM) – Contractor shall evaluate systems and components and develop a comprehensive plan with the COR for performing regular and recurring maintenance.

a. , the contractor shall develop a comprehensive Preventative Maintenance Plan with processes and procedures to perform and document preventative or predictive maintenance on the system and its components.

b. The plan shall delineate the equipment and components independently for each CMOP location as well as the enterprise level equipment.

c. Contractor shall deliver the PM plan in accordance with A, B, and C. above for review and approval by the government. An initial proposed schedule for all inspection, testing and corresponding preventative maintenance shall be submitted by the contractor to the VA CMOP National Representative on an annual basis for review and concurrence.

d. All work should be closely coordinated with the CMOP COR. Any work requiring utility service disruption should be coordinated and initiated by a CMOP COR. It should be recognized that disruption of service for the production environment could have significant cost implications.

e. Each PM shall be documented by the technician and will be verified by a CMOP COR.

f. One (1) copy of the PM report shall be left with the local CMOP representative, and one (1) copy shall be provided to the National CMOP COR. The copy provided to the National CMOP representative may be in electronic Adobe PDF format.

C.2.3 Emergency Response and Warranty Service

1. Emergency Services – Contractor shall provide an emergency services plan to ensure response is available outside of the normal recurring business hours and weekends.

a. Plan shall be in concert and complement the repair services plan to identify the systems, equipment and components that warrant an elevated level of response to ensure that CMOP security is maintained.

b. Response for reported items that fall within the emergency service category shall have a response time commensurate with the nature of the system failure that exceeds the normal and recurring repair service as coordinated and agreed to by COR and Vendor.

c. The emergency response plan shall define a clear process for a tiered escalation of an emergency request in order to ensure the process has sufficient protocol and alternate resources to ensure response occurs within specified timeframes.

d. All work shall be closely coordinated with the CMOP COR. Any work requiring utility service disruption should be coordinated and initiated by a CMOP COR. It should be recognized that disruption of service for the production environment could have significant cost implications.

2. Warranty/Repair Services

a. All warranty related activity shall be coordinated and managed through the centralized process established and utilized throughout the contract to ensure consistency in service.

b. Utilizing the Maintenance and Repair Databases (above), the centralized process shall

i. Screen trouble calls,

ii. establish the warranty status of the specific system and/or component,

iii. coordinate with the appropriate CMOP COR and Technicians to make the warranty service call to the facility to repair the system within forty-eight hours of being notified by the CMOP

iv. coordinate the return of defective components to the manufacturer,

v. complete a service ticket for the work completed with appropriate signatures and filing

c. Warranty service calls shall be performed during normal business hours (8AM-4:30PM local time, Mon-Fri) or as otherwise coordinated with the appropriate CMOP COR.

d. All work shall be closely coordinated with the CMOP COR. Any work requiring utility service disruption shall be coordinated and initiated by a CMOP COR. It should be recognized that disruption of service for the production environment could have significant cost implications.