SF30_70RFP423QE6000002 Amendment 0002.pdf

FOR OFFICIAL USE ONLY (FOUO)

For Official Use Only (FOUO)

Federal Protective Service U.S. Department of Homeland Security

STATEMENT OF WORK

for

Upgrade of Video Surveillance System (VSS)

October 19, 2022

VSS Upgrade

MO0095

Thomas F. Eagleton United States Courthouse

111 South 10th Street St. Louis, Missouri

STATEMENT OF WORK

Amendment 0002 Revised, 06/07/23

TABLE OF CONTENTS

A. Table of Contents

A. BACKGROUND

B. PURPOSE

B.1 DESCRIPTION OF EXISTING SYSTEM

B.2 DESCRIPTION OF NEW SYSTEM

C. SCOPE

C.1 GENERAL

C.2 INSTALLATION REQUIREMENTS

C.3 NETWORK VIDEO MANAGEMENT SYSTEM (NVMS) INSTALLATION REQUIREMENTS

C.4 CONTROL ROOM MONITORS

C.5 NETWORKING EQUIPMENT

C.6 OPERATING SYSTEMS UPDATES AND SERVICE PACKS

C.8 APPENDIXES

D. SYSTEM/EQUIPMENT SALIENT CHARACTERISTICS AND REQUIREMENTS

D.1 NETWORK VIDEO MANAGEMENT SYSTEM

D.2 MINIMUM SERVER AND WORKSTATION REQUIREMENTS

D.3 IP NETWORK VIDEO CAMERA MINIMUM REQUIREMENTS

D.4 NETWORK MANAGED SWITCH

D.5 VIDEO MONITOR

E. ADDITIONAL PROJECT REQUIREMENTS

E.1 DESIGN STANDARDS

E.2 MATERIALS AND EQUIPMENT

E.3 ELECTRICAL AND CABLING REQUIREMENTS

E.4 FINAL INSPECTION AND ACCEPTANCE

E.5 CLEANLINESS, PROTECTION, AND PATCHING

E.6 WARRANTY AND MAINTENANCE

E.7 SAFETY AND HEALTH

E.8 QUALITY CONTROL PLAN

E.9 TRAINING

E.10 CONFIGURATION MANAGEMENT

E.11 COMPONENT/DEVICE CONFIGURATIONS

E.12 NETWORK SETTINGS

E.13 WIRELESS NETWORK SECURITY

E.14 AUDIT AND ACCOUNTABILITY

E.15 IDENTIFICATION AND AUTHENTICATION / ACCESS CONTROL

E.16 DATA PROTECTION

E.17 USER ACCOUNTS

E.18 INCIDENT MANAGEMENT AND DISASTER RECOVERY

E.19 SOFTWARE MAINTENANCE

E.20 ENTERPRISE ARCHITECTURE

F. DELIVERABLES

F.1 GENERAL

F.2 REQUEST FOR QUOTATION (RFQ) DELIVERABLES

F.3 PRE-INSTALLATION DELIVERABLES

F.4 POST-INSTALLATION DELIVERABLES

G. PROJECT ADMINISTRATION

G.1 WORK AUTHORIZATION

G.2 PERIOD OF PERFORMANCE

G.5 SPECIAL SCHEDULING REQUIREMENTS

G.6 CONTRACTOR ACCESS AND USE OF PREMISES

G.7 SECURITY REQUIREMENTS

G.8 CONTRACTOR SUITABILITY REQUIREMENTS

H. APPLICABLE STANDARDS

H.1 GENERAL

H.2 ACCESSIBILITY REQUIREMENTS (SECTION 508)

I ACCOUNTABLE PROPERTY:

I.1 DEFINITIONS:

I.2 DELIVERABLES:

I.3 INVOICES:

I.4 PROPERTY ACCOUNTABILITY:

I.5 PHYSICAL INVENTORY:

I.6 PROPERTY DISPOSAL:

I.7 LOST, STOLEN, DAMAGED OR DESTROYED (LDD) PROPERTY:

J. INFORMATION TECHNOLOGY SECURITY

J.1 SECURITY CERTIFICATION/ACCREDITATION

J.2 SECURITY REVIEW AND REPORTING

J.3 CONTINUOUS MONITORING

J.4 SPECIFIC PROTECTIONS

A. BACKGROUND

A.1 The Federal Protective Service (FPS) is the federal law enforcement agency responsible for the protection and security of federal facilities, employees, and visitors. FPS actively works to reduce security vulnerabilities of federal facilities from criminal, terrorist, accidental, and natural disaster threats to ensure properties remain safe, secure, and available to the American public and employees of the federal Government.

A.2 The following Statement of Work (SOW) and guidelines have been developed by the Department of Homeland Security (DHS), Management Directorate (MGMT), Federal Protective Service (FPS) to mitigate threats and vulnerabilities pertaining to federal buildings and Government leased spaces. The SOW and regulations were developed with the notion that the security posture of each federally owned building or Government leased space is unique.

B. PURPOSE

B.1 Description of Existing System

Currently, the video surveillance system installed consists of one Digital Video Recorder (DVR), located in the CSO Control equipment room of the United States Courthouse (MO0095) to include associated monitor and Pan-Tilt-Zoom (PTZ) controls. The video and PTZ controls are routed through USMS owned IP encoders and viewed and controlled utilizing the USMS Network video Management System (NVMS). There are currently a total of Twenty One (21) analog cameras installed, comprised of Nineteen

(19) external PTZ cameras and Two (2) exterior fixed cameras.

B.2 Description of New System

B.2.1 This SOW is for the purchase and installation of a new standalone, Network Video Management System (NVMS), to be located at the Federal Court House and associated software and licensing, IP cameras, client workstations for viewing live and recorded video, network switches, and all additional equipment and appurtenances necessary for a fully functional IP based NVMS system at the Thomas F. Eagleton United States Courthouse, 111 South 10th Street, St. Louis, Missouri.

The system will monitor vehicle and pedestrian traffic, parking areas, personnel entry and exits, emergency exits, and the exterior perimeter of the facility. The system will be configured as a stand-alone Local Area Network with the ability to connect to a Wide Area Network / Intranet in the future.

The Following equipment is to be provided and installed:

1. One (1) Network Video Recorder. Equipment to be located in the 2nd floor USMS Computer Room 02-403-1.

2. One (1) Video Management server. Equipment to be located in the 2nd floor USMS Computer Room 02-403-1.

3. Three (3) VSS workstations and monitors. Equipment to be installed in the following locations;

(a) CSO Control Center, Room 02-146 (note: USMS will provide monitor(s) for this location.)

(b) USMS JSI Office, Room 02-311

(c) 1st floor PSO room, Room 01-107

4. Three (3) Video decoder and monitors. Equipment to be installed in the following locations;

(a) Mezzanine level west CSO desk.

(b) Loading Dock / Mail Room

(c) Parking garage booth

5. Ten (10) Camera, 6MP, Fixed exterior IP dome w/ a 3-9mm FL lens with mount.

6. Eight (8) Camera, camera quad multi image 20MP 3.7-7.7 mm,

7. Eight (8) Camera, 2MP Pan Tilt Zoom (PTZ) exterior pendant mount with mounting arm.

8. One (1) Network switch, 24 port, managed, POE, rack mountable.

Equipment to be installed in the 2nd floor CSO Control Center Equipment Room 02- 147.

9. One (1) Network switch, 12 port, managed, POE, rack mountable. Equipment to be installed in the 5th floor Telecom Closet 05-104, with appropriately sized wall mountable rack.

10. Two (2) Battery Backup power supply units, sized to provide 4 hours operation to connected equipment upon loss of power. Equipment to be installed in following locations;

(a) 2nd floor CSO Control Center Equipment Room 02-147.

(b) 5th floor Telecom Closet 05-104

11. One (1) equipment rack, floor mounted, sized to house the NVR, Server, Network Switches, battery backup power supply and cable management equipment as required to be installed in 2nd floor USMS Computer Room 02-403-1.

12. One (1) KVM console with monitor, rack mounted. Equipment to be located in the 2nd floor USMS Computer Room 02-403-1. Console will be used for local access of the NVMS and video management servers.

13. Fiber optic SFP Modules. Installed as appropriate for cable runs.

14. Move existing pole located on southwest corner (Camera 19) further towards the sidewalk at corner of Clark and 11th Street.

15. One (1) Network switch, 8 port, managed, POE, rack mountable. Equipment to be installed in the 28th floor TTO storage room 28-131, with appropriately sized wall mountable rack

B.2.2 The proposed work will remove all existing FPS responsible recording equipment, cameras, housings, associated cabling, and other installed appurtenances unless designated by FPS to be retained and reused during the new installation.

B.2.3 The proposal shall include a one-year warranty period. After the one-year base warranty period the contractor shall include four (4) one-year option periods for technical services, support, testing, maintenance and repair of the system and components installed in this SOW.

B.2.4 The proposal will remove three existing USMS cameras to include all housings, cables and appurtenances. Cameras to be returned to the USMS. The cameras to be removed are located at the following locations.

a) 5th floor Camera #233, located in the center of the roof on the north side.

b) 5th floor Camera #234, located in the center of the roof on the south side.

c) Sallyport Camera #218, located adjacent to the Sallyport Door Northwest

C. SCOPE

C.1 General

C.1.1 As part of the pre-bid process, FPS may have a site visit and all interested Contractors are invited to attend. The purpose of the site visit is for Contractors to survey the site and review the requirements of this SOW. A site visit will be scheduled by the COR/FPS PM. All questions relevant to this SOW shall be submitted in writing to the COR/FPS PM. The Contractor shall not make or assume any changes to this SOW without written approval from the COR/FPS PM.

C.1.2 The Contractor shall be responsible for the removal, inventory, packaging for storage and return of all removed equipment to the FPS PM. All currently installed wire, cable, and fiber, which is not designated for reuse, shall be completely removed by the Contractor, and properly disposed of.

C.1.3 The existing system shall remain fully functional and operational to the extent possible during the installation of the new surveillance system. The contractor shall cut over from the existing system to the new system in stages in order to minimize the number and duration of outages. The Contractor shall submit a system cutover plan in accordance with Section F Deliverables. The cutover plan shall be reviewed and approved in writing by the FPS PM.

C.1.4 The Contractor shall provide and install and configure the system as described and/or shown herein. The system shall include all connectors, adapters, terminators, and appurtenances to interconnect all equipment. The Contractor shall also supply all cabling and miscellaneous materials necessary to interconnect all equipment installed in accordance with this SOW.

C.1.5 The Contractor shall be required to be familiar with all applicable codes while carrying out the work outlined in this SOW. The Contractor shall complete the work pursuant to this SOW following all applicable codes and standards including, but not limited to:

Occupational Safety and Health Administration (OSHA), Underwriters Laboratories (UL), National Fire Protection Association (NFPA), National Electrical Code (NEC), and any additional federal, state and local codes and policies.

C.1.6 The Contractor shall furnish all tools and equipment necessary to complete all work outlined in this SOW. The Contractor Shall not be authorized the use of Government owned property, tools, or equipment, to complete work in accordance with this SOW, unless otherwise specified.

C.1.7 In the event any operational system or utility (e.g. fire, IDS, HVAC) is required to be disabled or turned off, forty-eight (48) hour notice shall be required and approved by the GSA Building Manager, FPS Inspector, and/or FPS PM prior to deactivation.

a) The Contractor, prior to departing for the day, shall ensure all system(s) previously disabled or turned off are functioning properly. A basic functional test shall be required to determine proper functionality of the system(s) and should be reported to the FPS PM.

b) In the event a system is non-functional once enabled or turned on, it shall be the responsibility of the Contractor, at no additional cost to the Government, to restore the system(s) prior to departure from the site.

c) If the Contractor fails to restore all system(s) before departing, they shall be liable for all costs incurred by the Government to restore system(s) functionality.

C.1.8 All personnel engaged in installation activities pursuant to this SOW shall be licensed by the state, local authority, and/or the city local authority in the required trades or professions which require licensing by such jurisdictions. The type and level of license shall be consistent with requirements of the jurisdictions and work to be performed by this SOW.

C.1.9 It shall be the sole responsibility of the contractor to employ personnel licensed and qualified to carry out all tasks outlined in this SOW. At no time during the installation shall the contractor require Government personnel to complete tasks required to be completed by the contractor as covered by this SOW.

C.1.10 The Contractor shall be solely responsible for ensuring their employees and subcontractors abide by all requirements of the contract. At all times while work is being performed in accordance with this contract, the Contractor shall have a supervisory representative available to answer questions, resolve issues, supervise company employee(s), and subcontractor(s).

C.1.11 The Contractor shall provide a daily access schedule to coordinate installation activities. The schedule shall be submitted as part of the project plan.

C.1.12 The Contractor shall maintain a separate set of drawings, schematics, and wiring diagrams of the VSS system to be used for creating as-built drawings. This set shall be accurately kept up to date by the Contractor, noting all changes and additions to the VSS system and shall be available for the final inspection walkthrough.

C.1.13 The Contractor may be required to attend installation construction meetings.

C.2 Installation Requirements

C.2.1 The Contractor shall install all system components and appurtenances in accordance with manufacturer’s instructions following all applicable local, state, and federal codes and policies. All appurtenances, such as, but not limited to connectors, terminators, and mounting hardware shall be supplied by the Contractor, as well as, all adjustments, alignments, programming, and configuration required for a complete and optimal VSS system.

C.2.2 The Contractor shall purchase/install license(s), as required by the manufacturer, for all equipment/device(s) requiring licensing. All licensing fees shall be nonrecurring.

C.2.3 All equipment required to be wall or rack mounted shall be mounted. The Contractor shall provide enclosures as necessary for equipment not mounted in racks or supplied with an appropriate housing.

C.2.4 The Contractor shall be responsible to provide the proper equipment and tools to access all equipment which is not accessible by ladder.

C.2.5 All measurements and equipment locations are approximate and shall be verified by the Contractor for accuracy and installation feasibility. The Government shall not be held responsible for any error or variation in any measurements or other data listed, nor shall the Contractor, because of an error or variation in any measurement listed, be relieved of the responsibility to carry out the requirements in accordance with the true intent and meaning of the specifications without additional cost to the Government.

C.2.6 All ceiling tiles removed to accommodate installation shall be returned at the end of the workday.

C.2.7 The Contractor shall remove and haul debris from the project site daily and dispose of in a proper, acceptable manner in accordance with all federal, state and local laws and regulations, off of job site property. The debris created from this project shall not be disposed of at the job site, in Government dumpsters, or on Government property.

C.2.8 The Contractor shall install and configure all equipment in accordance with manufactures recommendations and industry best practices.

C.2.9 The Contractor shall verify all camera views and video resolution with the FPS PM prior to installation.

C.2.10 The Contractor, when removing the existing cameras, cabling, and appurtenances in accordance with this SOW, shall ensure all openings or penetrations are sealed and/or patched to protect against weather exposure, unless otherwise designated for reuse. All openings or penetrations that are designated for reuse shall be sealed and/or patched to protect against weather exposure at the completion of installation. All penetrations that become exposed to weather during installation shall be protected from exposure throughout the installation period.

C.2.11 All existing conduit, junction boxes and pathways designated for reuse shall be of sound condition. If existing pathways are found deficient, broken or unusable the contractor will bring to the attention of the PM and request a change order for repair/replacement.

C.3 Network Video Management System (NVMS) installation requirements

C.3.1 The Contractor shall configure the installed VSS system to function in a Network Domain environment, not as a workgroup.

C.3.3 Windows and the NVMS software shall be configured to use MS Active Directory for authentication.

C.3.4 The Contractor shall not apply power to the NVMS until, at a minimum; the following checks have been completed.

a) All equipment has been installed and connected in accordance with manufacturer’s instructions.

b) All installed and/or reused wiring has been tested accordingly (e.g. shorts, opens, continuity).

c) Power supplies have been verified to operate at the correct voltage, phase, and frequency. Satisfaction of the above requirements shall not relieve the Contractor of responsibility for incorrect installation, defective equipment, or collateral damage as a result of Contractor work/equipment.

C.3.5 The Contractor shall ensure all system devices are configured appropriately for time synchronization. All devices shall be configured for time synchronization with the NVMS Server.

C.3.6 The Contractor shall install a rack mounted host (19” combination display, keyboard, and mouse at a usable height), at the NVMS Equipment rack, connected to the new NVMS Server for system configuration and administration. The host may be KVM based. If a KVM host is selected, ensure the NVMS controller has the local video option installed.

C.4 Control Room Monitors

C.4.1 USMS will be responsible for purchase and installation of monitors in the 2nd floor CSO Control Room. The contractor will be responsible for installation and configuration of the CSO control room workstation and interface to the USMS monitors. The USMS monitors will connect to the workstation via standard video connection, HDMI, DV Etc.

C.5 Networking Equipment

C.5.1 As required per this SOW, the contractor shall purchase, install, and configure all equipment, components, and necessary appurtenances for a complete and appropriately configured Ethernet network connecting all devices of the NVMS.

C.5.2 The Contractor shall configure installed switches for Trunk line communication between the switches.

C.5.3 The Contractor shall ensure that all installed monitors that are Wi-Fi-capable have that capability disabled.

C.6 Operating Systems Updates and Service Packs

C.6.1 Operating systems and software applications shall be capable of being updated/patched after delivery. The Contractor shall ensure that all installed server(s) and client workstation(s) Operating System Software (OS), at the time of installation, are current with all security updates/patches, service packs, revisions, and shall provide through the warranty period. The NVMS and all other installed software shall be the current version with all applicable updates and installed in accordance with manufacturers recommendations.

C.6.2 The Contractor shall remove and/or disable all software components that are not required for the operation and maintenance of the camera system; and shall provide documentation on what is removed and/or disabled. The software to be removed and/or disabled shall include, but is not limited to: games, device drivers for network devices not delivered, messaging services (e.g., MSN, AOL IM), Servers or clients for unused Internet services, unused networking and communications protocols, unused document processing utilities (Microsoft Word, Excel, PowerPoint, Adobe Acrobat, OpenOffice, etc.).

C.6.3 The Contractor shall provide notification of patches affecting security within a pre-negotiated period as identified in the patch management process.

a) Pre-Contract Award – The Contractor shall provide details on their patch management and update process. Responsibility for installation and update of patches shall be identified.

b) Post-Contract Award - The Contractor shall provide notification of known vulnerabilities affecting Contractor-supplied or required OS, application, and third-party software within 30 days after public disclosure.

C.8 Appendixes

C.8.1 Floor Plans C.8.1.A MO0095 Level 01 C.8.1.B MO0095 Level 01 Mezzanine C.8.1.C MO0095 Level 02 C.8.1.D MO0095 Level 05 C.8.1.E MO0095 Site Plan

D. SYSTEM/EQUIPMENT SALIENT CHARACTERISTICS AND

REQUIREMENTS

D.1 Network Video Management System

D.1.1 The NVMS shall support these essential capabilities:

a) Live video monitoring

b) Recording of video

c) Playback of video from local or remote location(s)

d) Integral alarm/event management

e) Video export

D.1.2 The NVMS shall store/archive video using one of the following techniques:

a) Internal Disk Storage

b) Direct Attached Storage

c) Storage Area Network

D.1.3 The NVMS shall include image storage with configurable resolutions and frame rates.

D.1.4 The NVMS shall be compatible with, but not limited to: H.264, MPEG4, and MJPEG video compression formats.

D.1.5 The NVMS shall be capable of system fail-over and redundancy options.

D.2 Minimum Server and Workstation Requirements

D.2.1 Video storage appliance minimum requirements

CPU Intel Xeon Processor E3-1275 V3 (8 MB Cache,

3.5 GHz)

OS N/A

RAM 8 GB, DDR3-1666 ECC UNB (1 x 8 GB) Network Interface Dual Intel i210 Gigabit LAN Display Adaptor 4 x Mini Display Port DVD-ROM internal Storage Configuration RAID 5 Source Manufacture Bosch Security DIVAR IP-7000, 16x8TB or equivalent

D.2.2 NVMS Server minimum requirements

CPU Intel Xeon Silver 4208 (2.1GHz/8core/85W) FIO Processor Kit

OS Microsoft Windows Server 2019 standard edition, 64 bit

RAM HPE 16 GB (1 x 16 GB) Single Rank x4 DDR4‑2666 CAS-19-19-19 Registered Smart Memory Kit

OS Hard Drive HPE 300 GB SAS 12G Enterprise 15K SFF (2.5 in)

HDD

Network Interface HP Ethernet 1 GB 4-port 366FLR adapter Display Adaptor n/a DVD-ROM HP SATA DVD-ROM drive JackBlack Gen9 Source Manufacture Bosch Security MHW-S380RA-SC or equivalent

D.2.3 Workstation Minimum Requirements

CPU Intel Xeon W-2123 (3.6 GHz, 8.25 MB cache, 2666 MHz memory speed, 4C CPU)

OS Microsoft Windows 10 Professional 64-bit for Workstations

RAM 16 GB (1 x 16 GB) DDR4 2666 DIMM ECC RAM OS Hard Drive 500 GB, 7200 RPM SATA 3.5 inch HDD Network Interface 2 – Gb Ethernet LAN ports Display Adaptor NVIDIA Quadro RTX 4000

DVD-ROM HP HH DVD Writer (16x RW DVD-R) Source Manufacture Bosch Security MHW-WZ4G4-HEN4 or equivalent

D.3 IP Network Video Camera Minimum Requirements

D.3.1 Exterior Fixed PoE IP Camera: The Contractor shall determine the necessary lens settings based on the required field of view, resolution, and lighting for each camera.

a. Bosch Security Starlight 8000i, NDE-8503-R or equivalent

b. 1 1/8-inch CMOS sensor, 3264 H x 1840(V) pixels (6MP)

c. Varifocal 3mm-9mm lens

d. DORI coverage;(min./max based on lens adjustment); Detect= 125 ft /505 ft, Observe=53 ft / 213 ft, Recognize=26 ft / 106 ft, Identify=13 ft / 53 ft

D.3.2 Camera quad multi imager 20MP 3.7-7.7 mm. four fixed 5mp cameras utilizing 1 IP address. The Contractor shall determine the necessary lens settings based on the required field of view, resolution, and lighting for each camera element. Bosch NDM-7703-A

a. Bosch Security Flexidome multi 70000i, NDM-7703-A or equivalent

b. 3.7-7.7 mm focal length

c. 2592h x 1944v pixels (5 MP x4 imagers)

d. DORI coverage;(min./max based on lens adjustment); Detect=176ft/461ft, Observe=74ft/94ft, Recognize=37ft/97ft, Identify=19ft/49ft.

D.3.3 Exterior Poe IP Pan-Tilt-Zoom camera: verify the camera is compatible with the video management system software to ensure full functionality of the camera.

a. Bosch Security Autodome 7000i, NDP-7602-Z30 or equivalent.

b. 30x zoom

c. 1944 x 1212 (2.35 MP)

d. DORI coverage (max/min based on zoom adjustment); Detect=200ft/6276ft, Observe=79ft/2510ft, Recognize=39ft/1279ft, Identify=20ft/627ft.

D.4 Network Managed Switch

a. C9300-24S

b. Cisco 8/12/24 Port Switch Catalyst 9300, 12/24x 1G SFP or equivalent

c. Serial DB9 RS-232 console port

d. Rack Mountable

D.5 Video Monitor

a. Bosch Security UML-324-90 or equivalent.

b. LCD Panel LED

c. Viewable Picture Area 31.5 in.

d. Active Display Area (H x V) 698.4 x 392.85 mm (27.5 x 15.5 in.)

e. Resolution1 1920 x 1080

f. Aspect Ratio 16:9

g. Display Colors 16.7 million

h. Response Time 8 ms (typical)

i. Backlight 50,000 hours

E. ADDITIONAL PROJECT REQUIREMENTS

E.1 Design Standards

E.1.1 Design Limitations – During design and planning activities, the Contractor shall advise the FPS Technical POC of all functional incompatibility issues and/or system interoperability limitations of any equipment to be installed. This shall include, but is not limited to, limitations as a result of, lighting levels, insufficient heating, ventilation and HVAC, power, rack, console, and space requirements.

E.1.2 Infrastructure Design – The system design shall include all conduit, junction boxes, cabling, fiber, network topology, and HVAC and power requirements for the proposed Network Video Management System (NVMS).

E.1.3 Equipment Selection – The Contractor shall use commercial off the shelf (COTS) components in system design.

E.1.4 Backup Power Requirements –All VSS electrical and electronic equipment installed shall be powered from an Uninterruptable Power Supply (UPS). It is expected that all equipment necessary for continuous live viewing, recording, and archiving VSS video will be uninterrupted during a power outage. The UPS shall be sized to provide at least four (4) hours0F

1 battery back-up in the event the primary power source is interrupted.

The Contractor shall include load calculations with their bid proposal.

E.1.5 Wiring Schematics – The Contractor shall provide complete system design wiring schematic diagrams representing planned device terminations to and between system equipment and components.

E.1.6 Riser Diagrams – The Contractor shall supply a system riser diagram. The diagram shall indicate the location of all associated system components.

E.2 Materials and Equipment

E.2.1 Items of the same type shall be products of a single manufacturer. All material, software and hardware, shall be new, the most current version, and presently being produced.

E.2.2 The Contractor shall provide enclosures as necessary for equipment not mounted in racks or supplied with an appropriate housing.

1 ISC RMP Criteria 70 - Provide uninterruptible emergency power to essential electronic security systems for a minimum of four hours.

a) Interior: Enclosures to house equipment in an interior environment shall meet the requirements of NEMA 250 Type 12.

b) Exterior (Exposed-to-Weather): Enclosures to house equipment in an outdoor environment shall meet the requirements of NEMA 250 Type 4X.

E.2.3 All exterior camera housings shall be minimum IP66/NEMA4X rated for protection against rain, dust, and snow.

E.2.4 All camera housings shall be a minimum IK-10 Impact-Resistant for vandalism.

E.2.5 Camera housings shall match the color and architecture of the building, equal to or greater than the existing camera housings. Coloring camera housings shall not void the camera and housing manufacturer’s warranty. Before camera housings are painted the color shall be approved in writing by the Facility Security Committee.

E.3 Electrical and Cabling Requirements

E.3.1 Wires, cables, and fiber shall meet applicable requirements of NFPA 70 and UL listings for type and method of installation.

E.3.2 Materials, equipment, and devices shall, at a minimum, meet requirements of UL, where UL standards are established, and requirements of NFPA 70.

E.3.3 All wire, cable, and fiber runs shall be installed in accordance with all federal, state, and local codes and/or regulations. In the instance there is a conflict between applicable codes and regulations, the most stringent shall apply.

E.3.4 All wire, cable, and fiber runs shall be installed inside conduit and sized according to NFPA 70 for fill requirements. All wiring shall be installed in ¾” EMT conduit (minimum size) and ¾” IMC conduit (minimum size) outside. All conduit fittings shall be steel compression type. Conduit shall be installed concealed to as great a degree as possible. Contractor shall make a written request, and get written approval, for any exposed conduit that they believe will be required. It shall be painted to match adjacent surface(s). but not smaller than ¾”.

E.3.5 All wire, cable, and fiber shall not contain splices between equipment termination points.

E.3.6 All wire, cable, and fiber shall be clearly labeled at both ends utilizing a permanent type of label using a common labeling convention.

E.3.7 There shall be no crimp type fittings utilized during cable/wire termination unless specified by the equipment manufacturer.

E.3.8 All equipment connected to AC power shall be protected from surges as described in IEEE C62.41 and IEEE C62.43. Fuses shall not be used for surge protection.

E.3.9 All cable and fiber installed in conduit shall include a pull string for future use. If an existing pull string is used in any location it shall be replaced with a new one.

E.3.10 All Ethernet network cabling shall be CAT 6/7 unshielded cable or singlemode fiber optic cable, UL listed for its intended use (e.g. indoor, outdoor, plenum).

E.3.11 All cabling shall be installed in accordance with ANSI/TIA/EIA-568-C Commercial Building Telecommunications Cabling Standard. All cable terminations shall conform to ANSI/TIA/EIA-568-C standards.

E.3.12 All cabling shall be tested to certify that the cable conforms to ANSI/TIA/EIA-568-C standards. The test device shall provide an electronic copy of the test results. Test results shall be printed and included in the O&M manual. Any wire, cable, or fiber that is existing and to be reused in support of this SOW shall be tested prior to use. Test report(s) shall be provided with final installation documentation and denoted that wire, cable, or fiber was previously installed.

E.4 Final Inspection and Acceptance

E.4.1 Upon completion of the installation the Contractor shall perform a Contractor Verification Test (CVT) in accordance with approved Perform Performance Verification Test (PVT) procedures to ensure installed system is fully operational. A copy of the test results shall be available for review by the FPS PM prior to commencing PVT testing and final inspection.

E.4.2 The Contractor shall submit, at a minimum five business days in advance of PVT testing, a proposed testing plan to the COR/FPS PM. The plan shall include test procedures, actions, and expected results demonstrating system functionality and compliance with this SOW. The test plan shall also include means for documenting test results. The test plan shall be approved by the FPS PM prior to the Contractor requesting Final Inspection and PVT testing.

E.4.3 The Contractor shall notify the COR/FPS PM in writing when requesting a date and time for Final Inspection and PVT testing. Request must be received, at a minimum, five business days in advance.

E.4.4 The Contractor shall provide all equipment and manpower necessary to perform Final Inspection and PVT testing.

E.4.5 Final Inspection Minimum Requirements

a) Review of Redline drawings.

b) Walk-through and inspection of all installed components and workmanship.

c) Perform Performance Verification Test (PVT) in accordance with approved test plan.

d) All equipment default or contractor entered user IDs and passwords shall be relinquished by the Contractor to the Government.

e) In the event a deficiency is found, or a test fails the Contractor shall have personnel available onsite to resolve the issue so inspection and testing may continue. Once the Contractor deems the issue has been resolved, a re-inspection or re-test shall occur.

f) The Final Inspection and PVT testing shall be performed during a single site visit.

g) Installation Acceptance by the Government shall be given only after the satisfactory completion of the Final Inspection, PVT testing, training, and receipt of all required deliverables outlined in this SOW.

E.5 Cleanliness, Protection, and Patching

E.5.1 The Contractor shall take necessary precautions to avoid damage to existing items that will remain in place, be reused, or remain the property of the Government. It shall be the sole responsibility of the Contractor to repair or replace damaged items, at no cost to the Government. Contractor shall notify COR/FPS PM of any damage immediately.

E.5.2 The Contractor shall not disturb existing construction beyond the extent indicated or necessary to fulfill installation requirements. In the event excessive damage is caused it shall be the sole responsibility of the Contractor to repair damage, at no cost to the Government. Contractor shall notify COR/FPS PM of any damage immediately.

E.5.3 The Contractor shall provide protective methods to control accumulation and migration of dirt and dust in and around all work areas. Removal of dirt, dust, and debris shall be completed daily and in accordance with all applicable federal, state, and local laws and regulation.

E.5.4 It shall be the sole responsibility of the Contractor to protect all existing building systems and utilities, to include, but not limited to, equipment, cabling, and appurtenances (e.g. fire, CCTV, IDS, HVAC) during demolition, installation and construction. If any system, service, utilities, equipment, or cabling are damaged due to installation construction the Contractor shall repair damage at no cost to the Government.

E.5.5 If necessary, the Contractor shall be responsible for moving furniture and/or equipment to protect it from damage during installation. All items relocated during installation shall be returned to their original location at the completion of work in the area. Any items that are unable to be relocated shall be protected from damage. In the event damage is incurred during this time it shall be the sole responsibility of the Contractor to replace damaged items without cost to the Government.

E.5.6 The Contractor shall prepare and lay out work in advance. Exercise care when cutting, channeling, chasing, or drilling of floors, walls, partitions, ceilings, or other surfaces as necessary for installation, support, or anchoring of conduit, raceways, and equipment.

E.5.7 FIRESTOPPING: The Contractor shall provide a qualified installer to install fire-stopping material to all penetrations and openings created during the installation. All existing penetrations or openings utilized by the contractor during the installation shall have fire-stopping material installed, regardless if it was previously installed. Fire-stopping shall consist of furnishing and installing tested and listed fire-stop systems, combination of materials, or devices to form an effective barrier against the spread of flame, smoke and gases, and maintain the integrity of walls, fire resistance rated walls, partitions, floors, and ceiling-floor assemblies, including through-penetrations. Firestop systems shall be UL Fire Resistance listed or FM P7825a approved with ''F" and/or “T” rated to at least be equal to fire-rating of the wall, fire wall, or floor in which penetrated openings are to be protected.

E.5.8 Where removal of equipment or materials leaves holes or damaged surfaces, the Contractor shall patch the holes and damaged surfaces, as well as, paint the surface to match adjacent finished surfaces. Finished surfaces of patched area shall be flush and match the existing adjacent surface as closely as possible. If new work is to be applied to existing area, then removal and patching shall be adequate for installation of new work.

E.6 Warranty and Maintenance

E.6.1 The warranty terms shall be one year from project acceptance.

E.6.2 After the one-year base warranty period, the contractor shall include four (4) one year option periods for technical services, support, testing, maintenance and repair of the system and components installed in this SOW.

E.6.3 In the event any Contractor supplied equipment, component, part fails within the specified warranty period; the Contractor shall immediately replace or repair the item within 24 hours at no additional cost to the Government. If the Contractor is unable to rectify the issue(s) within the allotted time, the Contractor shall be liable for all costs incurred by the Government to correct the issue(s).

E.6.4 The Contractor shall not be held responsible for failures due to fire, flood, vandalism, and/or misuse of Government equipment.

E.6.5 The Contractor shall include in the O&M manual a copy of all manufacturer warranties, terms, and conditions.

E.6.6 Network components shall be capable of disabling maintenance ports during normal system operation and enabling them only during approved maintenance activities.

E.6. 7 Remote maintenance paths shall not be utilized on this project.

E.6.8 The Contractor shall maintain an incident log as part of the software maintenance program, recording therein all deviations from normative operations, and all corrective actions taken. The incident log shall be submitted to FPS upon detection of anomalies, quarterly, and at the end of the contract period.

E.7 Safety and Health

E.7.1 All work shall comply with federal, state, and municipal safety and health regulations.

If there is a conflict between the regulations, the most stringent shall supersede all others.

E.7.2 The Contractor shall assume full responsibility and liability for compliance with all applicable regulations relating to the health and safety of personnel during the execution of work as outlined herein. The Contractor shall not fault the Government for any action on its part or that of its employees or subcontractors which results in injury, illness, or death.

E.7.3 Where pedestrian safety may be endangered the Contractor shall provide appropriate signage, barricades, or other means of notification.

E.7.4 The Contractor shall provide all required safety equipment and ensure the equipment is adequate and utilized appropriately for the work being performed.

E.7.5 The Contractor, in accordance with deliverable guidelines, shall submit a Roof Work Safety Protection Plan.

E.8 Quality Control Plan

E.8.1 The Contractor shall have a formal Quality Control Plan (QCP) in place covering areas of concern, such as, but not limited to equipment and cabling installation, maintenance, and customer service standards. The QCP shall also address equipment and cable labeling, system performance, installation aesthetics, programming and configuration conventions, and timeliness of service.

E.8.2 The QCP shall cover the Contractor’s quality control policies and procedures to ensure compliance with the requirements of this SOW.

E.8.3 The Contractor shall report non-compliance issues with the QCP to the COR/FPS PM.

E.8.4 The QCP shall include a routine review process that addresses all the areas of the Contractor’s performance and each of the elements of this SOW.

E.8.5 The QCP shall include the necessary processes for tracking identified deficiencies from initiation through to an acceptable corrective action. The process shall include a means to verify the identified deficiency has been reported, corrected, and accepted by the

COR/FPS PM.

E.9 Training

E.9.1 The Contractor shall submit a standardized Training Plan in accordance with manufacture’s recommendations for the type system installed to the COR/FPS PM for approval.

E.9.2 The Contractor shall provide operator, administrator, and maintenance training to required personnel. Training shall be conducted onsite and during normal business hours from 8:00 a.m. to 4:30 p.m.

E.9.3 Operator Basic, Operator Advanced and Administrator/Maintenance training shall be conducted as three (3) different sessions. Training sessions shall be a minimum of two

(2) hours in length. Each session shall utilize a mixture of lecture and “hands-on” training.

E.9.4 Instruction materials and manuals shall be included for reference, as well as, allowing FPS to train additional personnel at a later date.

E.9.5 At a minimum, training shall include:

a) Operator Training Basic

(1) With equipment powered off, conduct a complete system startup.

(2) General operating instructions.

(3) Video review procedure.

(4) Changing and selecting different cameras and views.

b) Operator Training Advanced

(1) All elements of Operator Training Basic

(2) Saving and Archiving video.

(3) Video Analytics Use

c) Administrator/Maintenance Training

(1) All elements of Operator Training Basic and Advanced

(2) Full System Configuration

(3) Video Analytic Configuration

(4) System Backup and Recovery

(5) Remote Network Operation

(6) Technical Support Information and Procedures

E.10 Configuration Management

E.10.1 Upon installation, all servers and client workstations Operating System (OS), Network equipment firmware, and camera firmware, must be current with security updates/patches, service packs, and revisions.

E.10.2 All installed software shall be the current version with all applicable updates and installed in accordance with manufacturers recommendations.

E.11 Component/Device Configurations

E.11.1 All devices connected to the network shall have default credentials changed in accordance with Section E.14 Audit and Accountability and provided to FPS in contract deliverable documentation.

E.11.2 All components that have remote access capability, e.g., web interfaces, remote configuration, shall be capable of being configured to restrict access by user ID and password.

E.11.3 Servers and workstations shall have the capability to automatically lock a user’s account after three consecutive failed logon attempts during a twenty-four (24) hour time period.

E.11.4 Automatic lockout period for accounts locked due to failed login attempts shall be set for twenty (20) minutes.

E.11.5 Shall have capability of manually unlocking accounts prior to the expiration of the twenty (20) minute period, after sufficient user identification is established.

E.11.6 User sessions on servers and workstations shall automatically be terminated after sixty

(60) minutes of inactivity.

E.11.7 All system components shall disable all unnecessary ports, protocols, and services. A list and justification for each open port, protocol and service shall be provided.

E.12 Network Settings

E.12.1 Port-forwarding settings on network devices shall be configured to only run the necessary ports for the network address translation for the system.

E.12.2 Networked components shall be configured for a network domain environment, not as a workgroup.

E.12.3 Components shall implement identification and strong authentication (in accordance with DHS 4300A 5.1.1.1 for administration of the firewalls and Policy Enforcement Points (PEP).

E.12.4 Firewalls and PEPs shall be configured to prohibit any protocol or service that is not explicitly permitted.

E.12.5 System components shall not use the Telnet protocol. A connection protocol such as Secure Shell (SSH) that employs secure authentication (two factor, encrypted, key exchange) and is approved by FPS shall be used instead.

E.12.6 System components shall not use the File Transfer Protocol (FTP). A connection protocol that employs secure authentication (two factor, encrypted, key exchange) and is approved by FPS shall be used instead.

E.12.7 System components shall not use Remote Desktop connections, such as Microsoft’s Remote Desktop Protocol (RDP), without the use of an authentication method that employs secure authentication (two-factor, encrypted, key exchange).

E.13 Wireless Network Security

E.13.1 The NVMS system does NOT contain wireless connections.

E.14 Audit and Accountability

E.14.1 Audit logs on servers and workstations shall contain at least the following information:

a) Identity of each user and device accessing or attempting to access the system

b) Time and date of the access and the logoff

c) Activities that might modify, bypass, or negate information security safeguards

d) Security-relevant actions associated with processing

e) All activities performed using an administrator’s identity

E.14.2 Audit records and logs shall be protected from unauthorized modification, access, or destruction, when on located on local hard drives, network attached storage devices, or removable media.

E.14.3 System audit trail records shall be maintained online for at least ninety (90) days.

E.15 Identification and Authentication / Access Control

E.15.1 Servers, workstations, and devices with user interfaces (i.e., routers, firewalls, and cameras) shall be capable of using positive user identification and authentication mechanisms through the use of uniquely assigned user IDs.

E.15.2 Systems with authentication controls shall require each user to authenticate prior to system access.

E.15.3 Systems shall be capable of disabling user identifiers after ninety (90) days of inactivity.

E.15.4 Systems shall enforce password composition and complexity requirements:

a) Are at least 12 characters in length

b) Are not the same as any of the user’s previous 8 passwords

c) Do not contain any dictionary word

d) Are not the same as the User ID

e) Contains at least one number (e.g., 1, 2, 3) and one special character (e.g., @, #, $, E.15.5 Systems shall enforce passwords that expire after ninety (90) days.

E.15.6 Systems shall store all passwords in encrypted form.

E.15.7 Systems shall provide role based accesses that allow different levels of privilege. For example, administrators, general users, etc.

E.15.8 All default vendor or factory-set administrator accounts or passwords shall be changed before installation or use.

E.16 Data Protection

E.16.1 Cryptographic functions provided by any system component shall use only cryptographic modules that are Federal Information Processing Standard (FIPS) 197 (AES-256) compliant and have received FIPS 140-2 validation at the level appropriate to their use.

E.16.2 The Contractor shall provide configuration specifications for implementing encryption and authentication between the cameras and the network and specifically note all security measures associated with the system.

E.16.3 When the contract ends, the contractor shall return all information and information resources provided during the life of the contract and certify that all DHS information has been purged from any contractor-owned system(s) that have been used to process DHS information.

E.17 User Accounts

E.17.1 The Contractor shall provide user accounts with configurable access and permissions associated with the defined user role.

E.17.2 The Contractor shall adhere to least privileged permission schemes for all user accounts, and application-to-application communications.

E.17.3 The Contractor shall recommend which accounts need to be active and those that can be disabled, removed, or modified. The FPS PM shall approve in writing the Contractor’s recommendation.

E.17.4 The Contractor shall disable, remove, or modify all the accounts pursuant to the approved recommendation.

E.17.5 The Contractor shall provide documentation defining access and security permissions, user accounts, applications, and associated roles.

E.17.6 The Contractor shall disable or remove all default and guest accounts prior to the system acceptance.

E.17.7 The Contractor shall provide documentation on all Contractor-configured or manufacturer default accounts, usernames, passwords, security settings, security codes, and other access methods are changed, disabled, or removed prior to system acceptance.

E.17. 8 After the system acceptance, the Contractor shall disable, remove, or modify all Contractor-owned accounts or negotiate account ownership with the FPS PM.

E.18 Incident Management and Disaster Recovery

E.18.1 Incident Handling and Response - Upon notification of an incident affecting a system under warranty or within the scope of this contract, the Contractor should have an established incident handling and response capability (e.g. system restoration plan of site specific equipment). When a security incident occurs that impacts services, information or information systems, the Contractor shall consult and work closely with FPS security personnel (e.g., FPS Technical Countermeasures, FPS Advanced Technology Security Program) to handle and respond to the incident. The service provider should also be expected to implement preventative measures to mitigate against similar incidents in the future upon request.

E.19 Software Maintenance

E.19.1 The Contractor shall provide on-site software maintenance support for a period of 12 months. This support shall start upon successful completion of the Substantial Completion Inspection (SCI) and include support for the Video Management software.

Software maintenance support will be continued for four (4) additional 12 month periods upon execution of the contract maintenance option.

E.19.2 This support shall include screen development, report generation, software upgrades, OS patches, virus protection, system configuration, response plan implementation and other such support required for operation.

E.20 Enterprise Architecture

E.20.1 DHS Enterprise Architecture Compliance.

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following HLS EA requirements:

- All developed solutions and requirements shall be compliant with the HLS EA.

- All IT hardware and software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile.

- Applicability of Internet Protocol Version 6 (IPv6) to DRS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the US. Government Version 6 (USGv6) Profile National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

F. DELIVERABLES

F.1 General

F.1.1 The Contractor shall submit all pre-installation deliverables, as outlined in this SOW, within fifteen (15) business days from award of the contract.