5000170741 EPACS SOW .docx

Physical Security System Scope of Work

Prepared by/Date: Jonathan Stevenson / 27 JUN 2023

Facility Location:

700 Market St.

Parkersburg, WV 26101

I. STATEMENT OF WORK

1.0 OVERVIEW

1.1 Description: The Internal Revenue Service requires the purchase and installation of a complete physical security equipment (Electronic Access Control System, Video Surveillance System & Intrusion Detection System) as specified in Section 3.6.

1.2 Background: The IRS is required to procure physical security equipment, inclusive of relative construction services and testing for the following project: The purpose of this project is to bring the Parkersburg, WV IRS POD (WV0304) into alignment with the IRM and ISC recommendations for an FSL 2 facility. Install Enterprise Access Control System (EPACS) to meet the requirements of the ISC and IRM.

EPACS upgrade on both IRS occupied floors of POD.

Install 3 EPACS panels,17 card readers with associated DTLM3’s, door contacts, electric strikes, REX sensors, and door strike cover plates.

To mitigate disturbing any potential asbestos, no penetrations will be made through original building walls.

Note: This is not considered a construction requirement even though minor construction work may be required for installation of the physical security system.

2.0 RELATED DOCUMENTS

2.1 This scope shall be used in conjunction with documents such as mark-up plans, drawings and specifications for the project, when applicable. At a minimum, contractor must comply with manufacturer’s specifications found in Section 3.6 below.

FLOOR PLANS AND/OR DRAWINGS INDICATING THE APPROXIMATE DEVICE LOCATIONS FOR ITEMS IN SECTION 3.6.

2.2 LIST OF ACRONYMS

The acronyms listed below will be used when referring to the corresponding terms:

2.3 REFERENCES

Services to be performed by the Contractor under this scope of work shall conform to all applicable requirements and criteria indicated in the following handbooks and publications and the latest issues and changes thereto:

a) General Services Administration Facilities Standards for the Public Buildings Service PBS/PQ-100.1.

b) Internal Revenue Service Facilities Design Criteria and Physical Security Standards for IRS Facilities.

c) Federal Information Processing Standards Publication FIPS-Pub; 174-1 and 175

d) National Fire Protection Association (NFPA) Codes and handbooks

i. NFPA72,

ii. NFPA101 Life Safety Codes

iii. NFPA70E

iv. National Electric Code NFPA 70.

e) Electronic Industries Association (EIA/TIA Standard 568-A, related bulletins and 569)

f) All applicable Federal, State and local codes and regulations

g) Interagency Security Committee (ISC) Standards

h) Homeland Security Presidential Directive HSPD-12

i) Occupational Safety and Health Standards.

j) Federal Information System Management Act (FISMA)

k) Federal Information Processing Standard Publication (FIPS 201-1)

l) National Institute of Standards and Technology SP 800-73

m) National Institute of Standards and Technology Standard (draft) SP-800-116

n) Americans with Disabilities Act.

o) Underwriters Laboratories (UL)

a. UL 1076 (1995; Reprint Sep 2010), Proprietary Burglar Alarm Units and Systems.

b. UL 634 (2007; Reprint Mar 2013), Connectors and Switches for Use with Burglar-Alarm Systems.

c. UL 639 (2007; Reprint May 2012), Standard for Intrusion Detection Units.

d. UL 609 (1996; Reprint Sep 2010) Local Burglar Alarm Units and Systems

e. UL 1610 (1998; Reprint Sep 2010), Standard for Central-Station Burglar-Alarm Units

f. UL 681 (2014), Installation and Classification of Burglar and Holdup Alarm Systems.

The above items are a standard listing of handbooks and publications. The contractor will utilize only those sections that are applicable to develop and complete the Scope of Work. Where conflicts occur, the more stringent requirement shall take precedence.

3.0 PROJECT/WORK IDENTIFICATION

3.1 INSTALLATION:

Installation includes all work and materials necessary for a full and complete system. Installation may include, but not be limited to the following:

a) Electrical power to all devices.

b) All wiring, conductor, conduits, and connections.

c) VSS, Access Control, IDS (intrusion detection system), duress and any other physical security system tie-ins.

d) Floor prep, flooring, walls and ceiling finish work.

3.2 – 3.4 NOT USED

3.5 GENERAL REQUIREMENTS:

A. Upon award of contract, the Contractor shall contact the Contracting Officer’s Representatives (COR) and/or POC: Jonathan Stevenson for commencement and coordination of performance.

B. Prepare a project schedule of dates and times when installation will occur, including anticipated completion dates. This information shall be updated, and the revised schedules forwarded on a weekly basis to the Contracting Officer’s Representatives (COR) and IRS POC through email notification: jonathan.e.stevenson@irs.gov

C. Upon commencement of performance, the IRS POC will review with the Contractor of the proposed location for each device (i.e., alarm keypads, duress buttons, access keypads, motion, cameras, etc.) as shown on the drawing. Major changes will only be approved by the Contracting Officer.

D. The Contracting Officer (CO) is the person with the authority to enter into, administer, and/or terminate contracts, make related determinations and findings, make constructive changes, and bind the Government in contractual matters. The IRS POC monitors contract performance and provides technical direction within the terms and conditions of the contract. This individual does not have the authority to make constructive contract changes or bind the Government in contractual matters. The Contractor shall document all proposed changes in writing and address them to the CO with copy to the IRS POC. The CO is the only government official who can modify and approve changes to the original scope of work.

E. Warranty: The contractor shall ensure all components and systems have a minimum one-year warranty, including parts and labor. The IRS shall not provide additional funding for service during the one-year warranty period due to any alarm system malfunction. The one-year warranty period shall commence at the time of government acceptance.

F. The Contractor shall provide a list of all proposed security equipment and devices to be used in this Contract. This list shall contain and clearly identify the make, model, and technical specifications of proposed security equipment and devices. The security equipment and devices proposed shall be approved by IRS POC.

G. The Contractor shall not substitute equipment/parts for any reason without the prior written approval of the IRS POC. Some items in this scope are part of an enterprise system and substitution is not allowed. Substitutions of any equipment/parts without the written Government approval shall be corrected at the Contractor own expense and delay.

H. The Government (IRS) requires an experienced Contractor to install the Security equipment as required and contained in this specification/statement of work. This is defined as a contractor who has been installing electronic physical security equipment for at least five years and has an association with and/or follows the installation standards presented by the National Burglar Fire Alarm Association (NBFAA), and the state chapters. The Contractor shall install the alarm system according to applicable agency certification and Underwriters Laboratories (UL) guidelines (installation methods, wire supports, etc.)

I. Install all necessary electrical outlets, including hardwiring of circuits by a licensed electrician to ensure that all devices function as designed [Coordinate with General Contractor (GC) Electrician, if applicable; in some projects the GC electrician will provide power]. All electrical work necessary to make the entire physical security system and equipment function properly is the Security Contractor’s responsibility and may require ‘collaboration’ with local building manager/contractor. Power circuits can be shared to 80% capacity amount security equipment (ACS; VSS and IDS); but must be dedicated to security devices and in a separate conduit and circuit breaker. All power connections shall be labeled at the breaker panel and at the load device identifying the breaker Number and location.

J. The Contractor shall furnish and install and test all equipment, cable, wire, connectors, labor and any electrical requirements that are necessary for the successful installation of the physical security systems as described in this Statement of Work.

K. Fasten all wires in the ceiling to overhead wire supports in order to prevent damage that may occur from existing or future wire runs in the ceilings. Wires shall not be supported solely by suspended ceiling. Periodic labels (no more than 20ft) shall be placed on expose wire(s) or conduits to indicate type of wire (i.e., alarm, access, video and device connected). All wiring shall be concealed and of a gauge no less than 18 with 4 conductors and copper stranded in composition, unless otherwise noted. Mechanical pulling of wires is prohibited.

L. Each wire/cable/etc. shall be properly labeled as it enters its termination location on the head end. This is needed for long term troubleshooting purposes. Wire numbers shall be used with a wire legend posted on panels on site with a full description of each device detailing where it is going and where it terminates. The labels shall be printed on letter size label sheets that are self- laminated vinyl that can be printed from a computer data base or spread sheet. The labels shall be E-Z code WES12112 or equivalent Dot Matrix, Series: WES, 9-1/2 in Length, 8 in Width, White, Polyester, For Use With: Dot Matrix Printer.

M. Every detector, sensor, button, junction box, control panel, transformer, phone jack, etc. shall be labeled in order to show the device, security system (i.e. ACS, IDS or VSS) and/or zone number on the front cover of the specific device. Each label shall be large enough to be seen from a standing position 12 in. distant without the use of a ladder.

N. Conceal all wires that are in the agency-protected space by “fishing” wire in the walls, ceilings and doorframes to ensure tamper resistance. At various locations in which walls cannot be fished or channeled place wire in EMT. Wires are not allowed to be exposed or visible. Wire-mold is not permitted. The Contractor shall first attempt to fish wire in walls prior to using EMT in the agency-protected space.

O. No penetrations of original building walls will be made.

P. Conceal all wires that are outside the agency-protected space by placing wiring in conduit, EMT, metallic tubing, etc. The size of the conduit, EMT, metallic tubing, etc. shall be large enough (i.e., 50% larger than needed) to permit additional wire pulls.

Q. Homerun a wire from each device, keypad, receiver, etc. to the alarm control panel, enclosure, spare cabinets, or auxiliary power supply. Splices, t-taps, etc. are not permitted, except inside the control panel, spare enclosure, cabinets, or auxiliary power supply. All wire(s) shall be installed in accordance with UL Standards for alarm, access, and/or VSS.

R. Contractor shall provide any devices, appliance, material or work not shown on Drawings but mentioned in this Specifications, or vice versa, and any incidental accessories necessary to make the work complete and perfect in all respects and ready for operation, even if not particularly specified, shall be provided without additional expense. The Drawings and Specifications are intended to supplement each other so that any details or equipment shown on either shall be executed the same as if mentioned in both. Note that not all devices required in the specification can be shown in drawings as it is mainly to show location.

S. The Contractor assumes responsibility for all necessary patching, repairing, painting, etc. as a result of installation or removal of items in the scope of this project, or in the event of an accident (i.e., drilling through drywall by mistake). The Government (IRS) shall not incur any additional costs for patching, repairing, painting, etc.

T. Contractor shall perform a pre-installation and final walk-through of all physical security system with the IRS POC and U.S. Department of Homeland Security/FPS representative to ensure system is complete and acceptable before final invoice and payment. The IRS POC shall coordinate the pre-installation and final walk-through.

U. Contractor shall demonstrate and train the IRS POC on the full operation of all security systems installed to government personnel. The Contractor shall ensure that required government employees selected by IRS POC, can operate the systems in a competent manner. Contractor shall provide the Government (IRS) with manufacturers technical and/or maintenance booklets of installed physical security equipment.

V. All installed equipment shall remain the property of the United States Government. The Contractor shall retain no liens, titles, etc. against any installed or uninstalled equipment once payment is received from the government.

W. Remove all old non-operative security equipment, power supplies and wiring from interior of current IDF/MDF/Security room location. No security equipment, wiring, or pathways shall be abandoned in place. Conduit can be abandoned if label property as abandoned and location of the other end at both ends and sealed.

X. Compliance with Manufacturer’s Specifications: The Contractor shall obtain all necessary equipment manufacturer’s installation specifications and drawings to complete all installation and contract work. The Government will not furnish any manufacturer’s information except that which is included in the contract documents. It is the Contractor’s responsibility to see that the equipment is installed to manufacturer’s specifications.

3.6 SPECIFIC REQUIREMENTS: The Contractor will perform the following tasks.

3.6.1 - Access Control System (ACS)

Description: Secure the services of an IDENTIV/HIRSCH certified, approved, licensed and bonded Contractor to install new SMART card readers and access control hardware with IDENTIV access control Technology, control panels, firmware, card readers, etc. in order to be in compliance with HSPD-12, FICAM, and NIST.

ACS Requirements:

A. Contractor or vendor shall provide bids/quotes/proposals and invoices for ACS separate from IDS and VSS scope. Lump sum will not be acceptable. IRS regulations requires the ePAC portion of the work to be funded from a different source.

B. Installation of the Access-Control/IDENTIV equipment shall be performed by Identiv certified technicians having installation configuration laptop with the Latest Velocity version access control software to complete SNIB3 setup and IP programming; this is a company provided laptop not connected to IRS domain. [Note: contractor must use their own installation laptop, government will not provide laptop]. Contractor shall install /terminate all Equipment per Identiv specification.

C. At least one individual directly involved in system design and providing installation technical support must have successfully completed GSA mandated federal PACS Vendor certification testing conducted by the Smart Card Alliance known as Certified System Engineer ICAM PACS (CSEIP) certification program. All individuals involved in on site Identiv panel installation must have successfully completed Identiv Digi track training. Certificate of completion for these credentials shall be submitted to IRS POC.

D. Prior to Installation the Contractor shall participate in a pre-installation site review meeting with NAC and security personnel.

E. Identiv manufacturer’s warranty is 5 years for readers and 2 years for all other components.

Prior to Installation:

F. The contractor must provide at least a 14-days’ notice to IRS POC and NAC before proceeding with the reader installation.

G. IDENTIV/HIRSCH certified technician must schedule and participate in a pre-installation meeting (approximately 1.5 hours) with the NAC to ensure compliance of equipment and Identiv specifications (Equipment information must be available).

H. Submit the serial numbers and MAC addresses for the new panels to the NAC to update the DGDD as soon as the equipment is delivered. They must be added to the IT inclusion list before a panel is brought online; otherwise, the port will be immediately disabled which will add unnecessary time and effort in troubleshooting.

I. When ordering Hirsch/Indentiv products the contractor must specify in the order to the manufacturer that the product is to be configured for the IRS use. Please use additional part # “IRS assembly-MX” on the order to Identiv for IRS configuration package.

J. Coordinate with Architectural contractor providing doors and frames to ensure they are pre-cut for the Electric Strike and door contacts provided on security scope. Please, also ensure that all locks for door with Electric Strike are “STOREROOM” function lockset (similar to SCHLAGE ND80 or equal) and perimeter doors have Latch Bolt Guard Plates.

Installation:

K. Contractor shall install new card readers, control panels, firmware, and associated accessories as needed to make sure all card readers are fully functional and compatible with the latest PIVII (i.e., SMART) card to be also used as an access card.

L. Refer to drawings for Card Reader/panel locations. Location questions should be review with local security specialist POC.

M. Connect All Panel access device wiring connections as per provided DGDD [door group design document] N. The Contractor shall participate in field testing with IRS NAC to make sure all card readers, panels and associated accessories are installed properly, and the building is ready to load to IRS Enterprise Network Server.

O. The contractor shall perform the following tests after installation of card readers, door control panels and associated accessories on each floor in presence of IRS POC and real time review with NAC.

a. Utility/Battery Power Fail test

b. SNIB2/3 Comm Fail test

c. Door Relay/remote access grant test

d. MATCH line Monitor/Signal Interruption test

e. Alarm expansion / reader/ panel tamper test

f. Door Open Too Long (DOTL) test

g. Forced Entry test

h. Door PIR sensor aiming/dead-spot test

i. Door contact alignment/ fit integrity test

j. Card read test: PIV-I, prox cards- valid/invalid.

k. Momentary Access test.

l. MOV installation

m. Grounding termination checks

n. Fire/emergency system functional interface testing [door unlock] shall be performed same day for occupied spaces and no later than beginning of next business day for all other affected spaces with new readers/panels.

Contractor shall:

1. Furnish and install a total of 17 card readers listed below at approximately mounting height of 44 inches AFF [NOTE: Reader also need to be specified for “IRS assembly”]. Readers needs to be connected to the RREB board to be FICAM compliant.

Identiv Utrust TS Government Reader [Sourced from Identiv] A. 11- 8132ABTFGZY [or 8132ABPFGZY for building exterior] prox regular wall mount (most used).

B. 6 - 8206ABTFGZY Keypad/prox in at two factors ‘Limited’ areas (i.e., MDF, IDF, Security Rooms and Mail Rooms) and CI perimeter doors.

2. Install, configure, and test 17 IDENTIV Model No. DTLM3 (Miniature Embedded Line Module 3 – one needed for each card reader). Install in new 6x6x4 inch ceiling located enclosure box [similar to Hoffman ASG6X6X4 or equal] for each DTLM3 above door. Note: these card reader modules shall be wired back to the access control panel/controller. No exposed wiring will be permitted.

3. Install 17 Door Strikes [HES 1600 series, or HES 1006K; or approved equal]. FAIL SECURE Minimum Specifications: ANSI/BHMA A156.31, Grade 2; UL 1034 burglary-resistant listed; UL 294 listed; Tamper-resistant; Static strength 1,500 lbs, Dynamic strength 70 ft-lbs; Endurance 1 million cycles; Field selectable fail secure/fail safe; Dual voltage 12/24 VDC/VAC.

4. Contractor shall install (17) door contacts to the DTLM3 located in the ceiling above each door that has a card reader. Door contacts will be shared with IDS systems. Provide 2-loop version (1 loop for IDS and 1 for ACS) of the UL634 Level II listed contact (Magnasphere HSS-L2C) in the IDS Section 3.6.3.5.

5. Install 17 Request-to-Exit (REX) sensors/devices [Bosch Model DS160/DS161PIR; or approved equal]. Minimum Specifications: UL294 Certification; Programmable fail-safe or fail-secure modes; 12 VAC or VDC to 30 VAC or VDC; Two Form C relay contacts (Adjustable from 0.5 sec to 64 sec) each rated 1 A at 30 VAC or VDC for resistive loads; 8 mA nominal standby current.

6. Contractor shall install, configure, and test the following IDENTIV equipment to the ePAC server system:

Install, configure, and test 3 IDENTIV Digi*Trac Model No. MX8-S3OB-FICAM (8 doors, 115 VAC) Controller w/Enclosure.

NOTE: Criminal Investigation (CI) doors must be in a CI dedicated MX Controller. This controller(s) will only connect to CI doors.

NOTE: EACH DOOR CONTROL PANEL MUST COME WITH THE FOLLOWING COMPONENT FROM THE FACTORY BASED ON “IRS ASSEMBLY-MX” PART #:

A. Configure, and test an IDENTIV/HIRSCH Model No. MEB/CB128 [128,000 User Code & Buffer Expansion Board] for EACH MX Control Panel above.

B. Configure, and test an IDENTIV/HIRSCH Model No. AEB8 [8 Alarm Input Expansion Board] AND/OR REB8 for panel that need to connect to the Fire Alarm and need relay input card] for EACH MX Control Panel above.

C. Configure, and test an IDENTIV/HIRSCH Model No. MEB/BE [Memory Expansion Board – Buffer Expansion] for EACH MX Control Panel above.

D. Configure, and test an IDENTIV/HIRSCH Model No. SNIB3 [Part # S3OB have SNIB3 included On-Board] for EACH MX Control Panel above.

E. Configure, and test an IDENTIV/HIRSCH Model No. RREB [Part # S3OB have RS485 Reader Expansion Board (RREB) Built-In] for EACH MX Control Panel above.

F. CCM [most current version included in panel] G. Factory provided IRS BAR CODE.

H. Install, configure, and test an IDENTIV/HIRSCH Model No. MELM3 (Miniature Embedded Line Module 3) for EACH MX Control Panel above.

7. Special Installation Instruction: Wiring Information:

A. Provide, Install and test all new wiring: PAIGE G743107 cable or equal 22AWG/2-pair/ISP/Plenum rated for MELM/contact/REX/Field Device.

B. PAIGE G454939AWH or 18AWG/2-pair/ISP equal cable for readers.

C. Power supply to Door Lock: PAIGE 454641AXX or 18AWG, equivalent

D. Wind City composite wire Part # 4461030-500 is an acceptable substitution or Belden equal.

E. Altronix to lock. Install MOV resistors at lock per manufacture recommendation.

F. Provide and install CAT6 ethernet patch cord w/ RJ45 connectors between the PACS Control panels and designated network switch connection port inside of the IDF rooms.

G. Non-Reader RS485 specifications: Belden 82842 or Belden 89842 [exterior/underground, any distance over 500 ft.] or approved equivalents

H. All new video, reader and alarm wiring and attached connectors shall be tested as an assembled unit for signal loss/strength [resistance and capacitance and db.] after installation prior to connection in compliance with Identiv specifications. The contractor shall provide written report of pertinent test results [volts/ dba/ ohms etc.] to IRS Security Specialist upon test completion. All new signal wiring connections [end of line resistors excluded] shall be labeled at each end and final numbering /termination points shall be recorded on connection diagram and separate data sheet and forwarded to IRS POC and NAC. A copy of wiring diagram shall also be left in each control cabinet/field device.

I. In the event that splices are unavoidable all interior splices must be approved by IRS project manager and shall be soldered and shall be copper terminal connectors or soldered and shall use adhesive lined heat shrink wire connectors.

J. Fire/emergency designated egress doors shall have Fire/emergency egress request to exit door sensors, contacts or other door hardware as required by applicable code dedicated to emergency egress operation. These devices shall be isolated and separate from any Access control system egress sensing hardware and operate per applicable Codes. Under no circumstance shall activation of a Fire or emergency signal be controlled by or routed through Access Control system. Fire/emergency system functional interface testing [maglock door unlocks] shall be performed same day for occupied spaces and no later than beginning of next business day for all other affected spaces with new readers/panels

K. LINE SUPERVISION MODULES

Required for All Monitored Devices. Digitally Processed, Analog Inputs 2 Styles

1. DTLM - Screw Terminals

2. MELM - Flying Leads

3 Input - Alarm, RQE, Tamper IRS standard is MELM 3 at all devices

8. Install power supply kits w/battery for each Controller and door lock power [Altronix MAXIMAL33D for 16 Output Access Power Controllers for ea. MX8 and/or Altronix AL600ULACM for 8 Outputs Power Supply for ea. MX4 or MX2 w/ 12V, 12AH Battery Pack. Two power supply outputs are required per door (one per REX and one per lock).

Each power supply will have TWO (2) MELM3 connected to the AEB-8 of MX panel.

1. Contact side of the first MELM3 tied to battery fail/low. Tamper side (Green wires) of the MELM3 to be tied to the tamper. Blue wires – Not used.

2. Contact side of second MELM3 tied to AC power fail. Blue & Green wires – Not used.

9. Provide and install cable/wiring/hardware as needed to/from government furnished switches to/from card readers, etc. All cable/wiring/hardware shall be plenum rated and in compliance with manufacturer’s recommendations. All wiring shall be run above IRS ceiling whenever possible. All wiring shall be suspended from ceiling /support structure attachment only. All wiring in Non-IRS space shall be in EMT or RMC conduit. All wiring shall be label per section 3.5 K-M requirements.

10. Test all new PIVII card readers before releasing to IRS. The Contractor shall make sure that control panels and the card readers are capable of matching and reading badge IDs from the new PIVII cards.

11. All Identiv panels will be supplied w/ new 12v 7ah backup battery.

12. Provide one DTMXSP spare parts kit and

13. Provide one FICAM ENROLLMENT KIT USB-FICAM Part# SMES-TS-USB-0GZY.

14. Contractor shall also participate in post completion final checkout ‘go live’ meeting’ testing all system attributes of connected hardware.

3.6.2 - FIRE-RATED PLYWOOD FOR DOOR CONTROL & BURGLAR PANEL

The Government estimates that the Contractor will need to supply and install manufacturer’s equipment. It is the Contractor’s responsibility to double check and be certain that all materials/equipment and/or labor are accounted for prior to quote submission. “HOMERUN” each device on its own stranded plenum rated wire or plenum coax with copper core and copper braid to the panel with no splices, “T” taps, no surface wire, etc:

3.7 TYPICAL DOOR ELEVATION ROUGH-IN DIAGRAMS

3.7.1 SINGLE DOOR - ELECTRIC STRIKE

3.7.2 SINGLE DOOR - ELECTRIC CRASH BAR / LOCKSET

3.8 OTHER INFORMATION

3.8.1 Government Furnished Equipment:

· Analog telephone line for burglar panel.

· Provide the room location for the electronic equipment to be wall mounted in a secure location under lock and key.

· IP address for each door control panel and data drop for each panel by IT

3.8.2 Related Work: Contract documents indicate the work of contract, and related requirements and conditions that have an impact on the project. Related requirements and conditions that are indicated on the contract documents include but are not necessarily limited to the following: (1) Existing site conditions and restrictions; (2) Alterations and coordination with existing work; (3) Other work to be performed concurrently by the Government; and (4) Other work to be performed concurrently by separate contractors.

3.8.3 Working Hours: Work shall be performed Monday through Friday (excluding holidays and weekends) from 7 AM – 6 PM. Any afterhours work will require prior written approval.

3.8.4 Trash Disposal: Contractor shall provide garbage/waste receptacles for disposal of trash (such as wrapping paper, boxes, etc.) and be removed by Contractor upon completion of work.

3.9 CONTRACTOR RESPONSIBILITIES

3.9.1 Contractor shall furnish all labor, materials, and equipment necessary to perform the job.

3.9.2 Contractor is required to (i) be licensed; (ii) maintain insurance coverage that is common within the industry and for the nature of work.

3.9.3 All Contractor personnel shall be required to wear proper identification, which may include company attire with logo, badge, etc. when working in the government facility. [Identification card or badge (if needed) is to be displayed on contractor employees at all times.]

3.9.4 Contractor shall provide personnel who are professional, reliable, trained, and experienced in performing the job requirements.

3.9.5 Contractor must ensure that all personnel working on this requirement be: (I) a U.S. citizen or have lawful permanent resident status, and (ii) fluent in the English language. Contractor shall not employ any person to perform work under this requirement with any of the following background history: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrest for continuing offenses, or failure to file or pay federal income tax.

3.9.6 Contractor shall provide timely and professional customer service (i.e., address concerns, issues, and other administrative functions). For purposes of this contract timely means no later than by the close of business next business day.

3.9.7 Contractor personnel shall maintain a neat, clean, and hazard-free working environment to the extent practicable. All work shall be done using the highest standards of the trade and in compliance with all federal, state, and local codes. Contractor personnel shall take all necessary precautions to avoid scarring, marring or damaging government’s property. Contractor(s) shall incur any cost to repair or restore to its original condition Government property damaged during the performance of this work. Upon completion, all packing materials, debris, dust, etc. shall be removed from the premises and discarded in accordance with local and state regulations. The work area shall be left in “ready to occupy” conditions.

3.9.8 The work shall be carried out in such a manner so that there will be little no interference with the proper execution of Government business. All persons employed in contract work shall, while on the premises, comply with all building regulations.

3.9.9 Clauses for General Construction

1) Leased Buildings - Wall, Floor or Ceiling Penetrations

a) In a leased building the GSA representative or the Lessor’s building manager must be contacted for approval prior to the start of work to ensure there is no asbestos present in the area the work is to be performed. The Building Manager will provide a written statement about status of asbestos or other hazardous materials in the area. If there is asbestos or other hazardous materials in the area work cannot proceed until they have been mitigated.

b) Contract employees working on site must have received Asbestos Awareness Training by the employer prior to working on site regardless of whether clearance of asbestos presence has been given.

2) General Safety

a) It is the contractor’s responsibility to know and understand which regulations and standards promulgated by the Occupational Health and Safety Administration applies to them and they’re sub-contractors, as well as any local or state health and safety regulations. Sub-contractors who have less than 10 employees are not exempt from OSHA regulations and standards while working on a federal contract.

3) Working at Heights

a) If ladders are to be used to reach ceilings to pull wires contractors and subcontractors shall be trained in ladder safety per 29 CFR 1910.23 and use the appropriate non-conductive ladders for any work involving electrical devices.

b) The contractor shall not leave a ladder to climb onto any structures, in the ceiling spaces or anywhere else, that are not meant for human occupancy.

c) The contractor will ensure they provide the necessary equipment for their employees and subcontractors to work at heights safely and in compliance with 29 CFR 1910.28 and 1910 Subpart F.

4) Electrical

a) Electrical work must be performed by a licensed electrician. GFI electrical outlets must be used in any area that is in proximity to a water source. Local Building code must be followed.

b) The contractor shall adhere to the requirements of 29 CFR 1910.147 Control of Hazardous Energy.

5) Life Safety

a) All installation of equipment and furniture must clear the sprinkler heads by a minimum of 18 inches.

6) Recycling

a) The contractor will recycle waste materials, such as packaging, spent furniture and other end of life material to the maximum extent possible.

7) Green Purchasing and Bio-Based Preferred

a) When acquiring goods and services, the contractor shall acquire green products including bio-based, environmentally preferable, energy-efficient, water-efficient, and recycled-content products. The Contractor shall use paper of at least 30 percent post-consumer fiber content. When acquiring an electronic product to meet facility requirements, the contractor shall purchase Electronic Product Environmental Assessment Tool (EPEAT)-registered electronic products, unless there is no EPEAT standard for such product.

b) The contractor shall give preference to the purchase of:

c) Recycled content products designated in EPA’s comprehensive procurement guidelines.

d) Energy Star® products identified by DOE and EPA, as well as FEMP-designated energy-efficient products.

e) Water-efficient products, including those meeting EPA’s WaterSense standards.

f) Energy from renewable sources.

g) Biobased products designated by the U.S. Department of Agriculture in the BioPreferred program.

h) Environmentally preferable products and services, including EPEAT-registered electronic products.

i) Alternative fuel vehicles and alternative fuels required by EPAct.

j) Products with low or no toxic or hazardous constituents Non-ozone depleting substances, as identified in EPA’s Significant New Alternatives Program.

k) Biobased products are commercial or industrial products that are composed in whole, or in significant part, of biological products or renewable domestic agricultural materials or forestry materials. To the greatest extent feasible, the Contractor shall use “Green” products and services.

l) The Contractor, if bio-based products are available for items that are purchased through this contract, shall provide the required Biobased purchasing data using the United States Department of Agriculture (USDA) online reporting tool annually before October 30th. The reporting tool can be found at: SAM.gov | Entity Reporting.

m) The list of Biobased products can be found at: BioPreferred|Catalog The Contractor is responsible to keep current on additional Biobased products designated by the USDA and available for use in the performance of this Contract.

n) Additional information can be found at BioPreferred .

8) Contract Clause for EPEAT

a) When acquiring an electronic product to meet their requirements electron product must meet those requirements with Electronic Product Environmental Assessment Tool (EPEAT®)-registered electronic products. The tool can be found here EPEAT Registry

3.10 IRS RESPONSIBILITIES

3.10.1 IRS POC shall provide access to the respective work area(s).

3.10.2 IRS POC shall assist in making the appropriate decisions with regards to specific location/placement, procedures, and programming. The IRS POC shall be readily available during the contract term and shall make decisions without delay. All required and applicable changes shall be executed through contract modification. Contract modifications shall be executed by the Contracting Officer.

II. INFORMATION SYSTEM SECURITY REQUIREMENTS FISMA SECURITY CONTRACT LANGUAGE (MAJOR IT SYSTEMS / APPLICATIONS or SERVICES)

1. CONTRACTOR SECURITY TRAINING

IR1052.224-9001 Mandatory IRS Security Training for Information Systems, Information Protection and Facilities Physical Access (JUN 2021) The Federal Information Security Modernization Act of 2014 (FISMA) requires each federal agency to provide periodic information security awareness training to all contractors/subcontractors involved in the management, use, or operation of Federal information and information systems. In addition, contractor/subcontractor personnel are subject to the Taxpayer Browsing Protection Act of 1997, which prohibits willful unauthorized inspection of returns and return information and details that any violation of the Act could result in civil and criminal penalties. Contractor/subcontractor personnel are subject to the Privacy Act of 1974 (5 U.S.C. 552a; Pub. L. No. 93-579), December 1974.

Contractor/subcontractor personnel are bound by the Records Management by 93 Federal Agencies (44 U.S.C. Chapter 31) regarding the care and retention of federal records.

a. The contractor must ensure all new contractor/subcontractor personnel complete all assigned briefings which are based on the responses provided on the Risk Assessment Checklist Form 14606. These responses pertaining to access to any IRS system, including basic LAN, email and internet; access to any Sensitive but Unclassified (SBU) data; and access to any IRS facility. Since new contractor/subcontractor personnel will not have access to the IRS training system, the COR shall provide softcopy versions of each briefing.

i. Exception: Contractor personnel (including subcontractors) performing under IRS contracts with Nonprofit Agencies Employing People Who Are Blind or Severely Disabled (as described in FAR Subpart 8.7) are exempted from the aforementioned briefing requirements, unless the contractor requests access to the training, or there is a compelling justification for requiring the training that is approved by the Contracting Officer (CO). An example of this would be in an instance where visually impaired personnel is assigned to perform systems development and has potential staff-like access to IRS information.

ii. Contractor/subcontractor personnel working with IRS information at contractor-controlled facilities with no access to the IRS network will be subject to all mandatory briefing excepting the Facilities Management Physical Security briefing as outlined in Publication 4812.

iii. Service Personnel: Inadvertent Sensitive Information Access Training Contractor personnel performing: (i) janitorial and cleaning services (daylight operations), (ii) building maintenance, or (iii) other maintenance and repair and need staff-like access to IRS facilities are required to complete Inadvertent Access to Sensitive Information (SBU) Access training.

iv. Service Personnel Security Awareness Training: Contractor personnel providing services in the following categories are required to complete FMSS Physical Security Training:

1. Medical;

2. Cafeteria;

3. Landscaping;

4. Janitorial and cleaning (daylight operations);

5. Building maintenance; or

6. Other maintenance and repair

b. In combination these mandatory briefings are known as IRS Security Awareness Training (SAT). The topics covered are: Cybersecurity Awareness, Privacy Information Protection and Disclosure, Unauthorized Access to Taxpayer Data, Records Management, Inadvertent Sensitive Information Access, Insider Threat and/or Facilities Physical Security. The completion of the assigned mandatory briefings constitutes the completion of the Security Orientation.

c. The SAT must be completed by contractor/subcontractor personnel within 5 business days of successful resolution of the suitability and eligibility for staff-like access as outlined in IR1052.204- 9000 Submission of Security Forms and Related Materials and before being granted access to SBU data. The date listed on the memo provided by IRS Personnel Security shall be used as the commencement date.

d. Training completion process:

The contractor must submit confirmation of completed SAT mandatory briefings for each contractor/subcontractor personnel by either:

i. Using Form 14616 signed and dated by the individual and authorized contractor management entity and returned to the COR. This option is used for new contractor/subcontractor personnel and any that do not have an IRS network account.

ii. Using the IRS training system which is available to all contractors with IRS network accounts

e. Annual Training. For contracts/orders/agreement exceeding one year in length, either on a multiyear or multiple year basis, the contractor must ensure that personnel complete assigned SAT mandatory briefings annually no later than October 31st of the current calendar year. The contractor must submit confirmation of completed annual SAT on all personnel unable to complete the briefings in the IRS training systems by submitting completed Form 14616 assigned to this contract/order/agreement, via email, to the COR, upon completion.

f. Contractor’s failure to comply with IRS privacy and security policy (to include completion and certification of SAT requirements within the timeframe specified) may be subject to suspension, revocation or termination (temporarily or permanently) of staff-like access to IRS IT systems and facilities.

g. Flow down of clauses. The contractor shall include and flow down, in its subcontracts (or arrangements or outsourced service agreements) that entails staff-like access to SBU information by a subcontractor, at any tier, the same Federal Acquisition Regulation (FAR) and local privacy and security or safeguard clauses or provisions for protecting SBUSystem Review / Site Visit

2. SAFEGUARDING / PROTECTING SENSITIVE PERSONALLY IDENTIFIABLE INFORMATION (PII)

Sensitive PII is defined as any information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual, regardless of whether the individual is a U.S. citizen, legal permanent resident, or employee or contractor to the Department. Sensitive PII is Personally Identifiable Information, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

Information Systems can be either electronic or manual. IRM 10.8.1 requires IRS sensitive information is to be handled and protected at the contractor's site, including any information stored, processed, or transmitted using the contractor's computer systems. Contractor personnel shall perform a background investigation and/or clearance required; receive security awareness and specialized IT security training required for contractor activities or facilities; and any facility physical security requirements.

IRS sensitive data (e.g., Sensitive But Unclassified (SBU), Personally Identifiable Information (PII) that is processed, stored, or transmitted by an information system outside of IRS facilities or IRS IT information system shall be protected with FIPS 140-2 or later validated cryptographic modules with approved modes of operation.

A list of NIST validated modules is available at the following link:

http://csrc.nist.gov/groups/STM/cmvp/validation.html.

a. The CSP/Contractor shall ensure that individuals accessing an information system processing, storing or transmitting information requiring special protection satisfy the personnel screening criteria.

Note: This requirement is defined by FedRAMP.

b. The organization shall:

Screen individuals prior to authorizing access to the information system; and Rescreen individuals according to FedRAMP Assignments: for national security clearances; a reinvestigation is required during the 5th year for top secret security clearance, the 10th year for secret security clearance, and 15th year for confidential security clearance. For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the 5th year. There is no reinvestigation for other moderate risk positions or any low-risk positions.

The CSP/Contractor shall ensure that data is used, only as identified, in the IRS contract and that the data will be used for nothing else to ensure the privacy of the individual.

The CSP/Contractor is responsible for maintaining an inventory of all PII provided to the contractor, generated by the contractor, or used by the contractor sufficient to enable notification to taxpayers, if disclosed. The inventory of PII must be updated semi-annually with a final inventory notification provided to the COR.

Most IRS information is categorized as Sensitive But Unclassified (SBU). This includes:

i. Federal Tax Information (FTI)

ii. Personally Identifiable Information (PII)

iii. Protected Health Information (PHI)

iv. Certain procurement information

v. System vulnerabilities

vi. Case selection methodologies

vii. Systems information

viii. Enforcement procedures

ix. Investigation information

x. Proprietary processes or algorithms used in investigative work or tax processing

Note: Live data, which is defined as production data in use (production, testing, development), often contains SBU.

IRM 10.8.2, Information Technology (IT) Security, Security Roles and Responsibilities, defines IRS-wide roles and responsibilities related to IRS information and computer security.

a. The IRS shall designate an Authorizing Official for the Cloud Computing Service per IRM 10.8.2.

b. Each Business Unit shall assign at least one (1) Information System Security Officer (ISSO) or Security Program Management Officer (SPMO) to the Cloud authorization process.

Various laws and regulations have addressed the need to protect sensitive information held by government agencies including the Federal Information Security Modernization Act (FISMA), the EGovernment Act of 2014, the Privacy Act of 1974, and OMB Circular A-130, Management of Federal Information Resources. FISMA requires agencies to have a security program and controls for systems to protect their sensitive information. Therefore, the contractor shall comply with OMB policies and Treasury / IRS specific policies, procedures or guidance to protect sensitive information.

IRM 10.8.24.2, Internal Revenue Manual (IRM) 10.8.24, Information Technology (IT) Security, Cloud Computing Security Policy, CSP roles and responsibilities related to IRS information and computer security.

Unless specifically identified, the scope of the CSP’s responsibility for the protection of IRS assets depends on the service delivery model being used (SaaS, PaaS, IaaS) and their contractual agreement. The IRS personnel with technical responsibilities for the use, implementation, and acquisition of cloud service shall ensure the CSP is made aware of and adheres to, as part of their contract, all applicable CSP…