Solicitation_AG_94TZ_S_15_0083_FINAL.docx

APPENDIX A - SCHEDULE OF ITEMS

Collection Services for the Red Rock Ranger District

Furnish all labor, supervision, transportation, automated fee collection machines, other equipment and incidentals necessary to collect, count and deposit fees in compliance with the requirements herein.

BASE PERIOD: (Date of Award – October 31, 2016)

ITEM

NO.

SUPPLIES AND

SERVICES

DESCRIPTION

UNIT OF MEASURE

ESTIMATED

UNITS

UNIT OF MEASURE

TOTAL

Percent per machine

OPTION YEAR ONE: (November 1, 2016 – October 31, 2017)

ITEM

NO.

SUPPLIES AND

SERVICES

DESCRIPTION

UNIT OF MEASURE

ESTIMATED

UNIT OF MEASURE

Percent per machine

OPTION YEAR TWO: (November 1, 2017 – October 31, 2018)

NO.

SUPPLIES AND

SERVICES

DESCRIPTION

UNIT OF MEASURE

ESTIMATED

UNIT OF MEASURE

Percent per machine

OPTION YEAR THREE: (November 1, 2018 – October 31, 2019)

NO.

SUPPLIES AND

SERVICES

DESCRIPTION

UNIT OF MEASURE

ESTIMATED

UNIT OF MEASURE

Percent per machine

OPTION YEAR FOUR: (November 1, 2019 – October 31, 2020)

NO.

SUPPLIES AND

SERVICES

DESCRIPTION

UNIT OF MEASURE

ESTIMATED

UNIT OF MEASURE

Percent per machine

1.0 SCHEDULE OF SUPPLIES/SERVICES

Automated Fee Machines and Fee Collection Services for the Red Rock Ranger District.

Furnish all labor, supervision, transportation, automated fee collection machines, other equipment and incidentals necessary to collect, count and deposit fees in compliance with the requirements herein.

Refer to Schedule of Bid Items in Appendix A shown above.

2.0 PERFORMANCE WORK STATEMENT

Background: The Red Rock Ranger District operates the Red Rock Pass Fee Program that contains 17 fee sites. This is allowed under the Federal Lands Recreation Enhancement Act (FLREA). A valid pass is required for public parking at fee sites. Fee machines facilitate the public purchase of the Red Rock Pass and the collection of fees. There are a total of 16 fee machines currently in place. It is anticipated that several additional fee machines may be added in the next 4 years and some may be moved or removed. Revenue is collected each year (refer to Figure 2) and expended to support visitor services on National Forest land.

The Government intends to enter into a contract to provide fee collection and machine operations and maintenance services on the Red Rock Ranger District for one base period beginning approximately November 1, 2015 through October 31, 2016 with Four (4) 1 year option periods. Setting fee pricing and conducting public compliance activities remain the responsibility of the Government.

The purpose of this contract is for automated fee collection and fee machine operation and maintenance services for the Red Rock Ranger District. The contractor shall provide all labor, supervision, security, equipment, and incidentals necessary to perform fee collection services as defined in this Performance Work Statement (PWS) for the Red Rock Ranger District on the Coconino National Forest.

The goal of this acquisition is to provide US Forest Service (USFS) Red Rock Ranger District (RRD), Coconino National Forest, with automated fee machine (AFM) units for collection of Red Rock Pass fee revenue, documenting, and reporting sales transactions; user role access control; product item management; and production of reports for all functions and data in the system. It is also a goal of this acquisition to provide the services of installation, operation, warranty, training and technical support of the AFM units.

Automated Fee Machines are stand-alone point-of-sale units, also called Pay Stations, used for the collection of fees at unstaffed locations (e.g., parking lots for day use sites). AFMs are programmed to sell products, accept payment, produce a receipt for the proof of purchase, and provide reports on the sales and collections. Items that would be sold at these AFMs include: One (1), and seven (7) day Red Rock passes; Annual Red Rock Passes, and Interagency Annual Passes.

This acquisition must be compliant with the Payment Card Industry (PCI) Data Security Standards (requirements for consumer data protection in credit card processing); requirements of OMB Circular A-123 (“Management’s Responsibility for Internal Control”), Federal Information Systems Management Act (FISMA) IT Security, Americans Disabilities Act (ADA), and Section 508 of the Rehabilitation Act requirements, and the 2014 Presidential Executive Order, which requires that federal agency payment card acceptance must include EMV chip and PIN capability to strengthen the security of retail payments.

The scope of this acquisition is to rent industry standard AFM units and associated software for approximately nineteen (19) locations, to collect fees and provide revenue to the Forest Service and provide all necessary software, hardware, installation, integration, maintenance, training, and technical support for the AFM units. The scope also includes compliance with the relevant federal IT security, credit card security, and other federal requirements described in Section 4.0 Compliance Requirements.

The AFMs are to replace existing pay stations and add several new stations and to possibly change the location or entirely remove up to two during the contract period. The contractor may propose using refurbished AFMs or refurbishing the existing cabinets and installing their solution in the cabinets in order to reduce costs and recycle the materials. See Section 3.6.1 – 3.6.3 for requirements of the cabinets and Appendix A for description of the existing units.

2.1 AFM Units

The contractor must provide approximately sixteen (16) AFM units total; one each at the following locations. There may be the addition of up to 3 AFM units during the contract period. There may be a need to move or remove from service up to two machines during the contract period.

Figure 1: Fee Machine List

Potential new machines and locations*

(1). site location does not have access to grid power; photovoltaic solar power supply or battery required and to be supplied by Contractor.

(2). site location has grid power within 500 feet of site but any electrical hookup would be the full responsibility of the contractor. No government utilities are provided.

*Fay, Dry Creek, and Visitor Center machines are possible installations during the contract period.

See Appendix B for a map of locations of current AFM units and for photos of each of the locations.

The AFM units must meet the requirements within this Statement of Work (SOW).

The AFMs and associated software to meet the requirements of this SOW are to be used for the collection of fees for Red Rock Passes and Interagency Passes; to accept credit cards for payment (no cash transactions); to print receipts; to track transaction details; to capture transactional data; and to allow for the transmittal of transaction data for collection activity and sales reporting auditing, accounting and reporting.

Figure 2 – Annual Revenue from Red Rock Pass Fee Program (see attached)

2.2 Connectivity

Some Fee machine locations on the District are located in areas which lack good infrastructure, particularly with respect to internet connectivity. Wireless Internet provided by Verizon Wireless is the only connectivity available at the fee collecting locations. The connectivity of this solution is not on the USFS network.

2.3 Installation Plan and Configuration

2.3.1 Installation and Plan

The contractor must gather the information and provide an installation plan to the District which identifies the following:

· Infrastructure to be in place prior to installation for communications based on identified connectivity,

· Identify all peripherals and supplies needed for installation (i.e. receipt paper, surge protectors, solar panels, etc.),

· Key milestones with dates for configuration, testing, installation, training, and operation of the AFM units,

· Logistical considerations needed to perform the installation and training,

· Specific location and orientation for each machine at each site, and site preparation,

· Adequate space, internet and audio visual equipment for training.

2.3.2 Configuration

The contractor must gather necessary information from the USFS and configure the system for installation which includes at least the following:

2.3.3 Testing of configuration

The contractor must provide a way to demonstrate and test the configuration setup of the units as described above prior to the system being placed into operation. The contractor must provide an installation check-list to identify what needs to be completed for the installation, including testing and gathering technical information about the installation.

The contractor must perform a test of the operation of the unit before the unit is put into public operation to ensure the credit card merchant account authorization and settlement is set up properly, and that the transaction reaches the proper account and contractor endpoint and USFS COR access.

2.4 Installation and Operation

The contractor must install all AFM units at the proper locations. All locations are accessible on passenger car roads year-round.

The contractor must install and configure the AFM units, test them for data transfer and sales activity processing, and ensure that each AFM unit is able to transmit data properly to the contractor and to the identified FS COR. This includes ensuring credit card transactions have been properly authorized, settled, and funds transferred to the correct account.

The contractor shall have fourteen (14) consecutive calendar days within which to install and make operational all of the 16 replacement units. Installation will be scheduled to immediately follow or be concurrent with the removal of the existing machines under contract (which will be terminated). This is in order to minimize the time during which AFM units are unavailable to the public.

A post installation report is required which would provide the following:

2.4.1 Install According to PA-DSS Implementation Guide

The contractor must install any payment systems in accordance with the PA-DSS Implementation Guide for the credit card application that has been incorporated into the system being installed, and must deliver:

2.5 Training

The contractor must provide system operation training to the USFS representative prior to the deployment of the AFM system.

2.5.1 Onsite Training

The contractor must provide onsite training to USFS staff on the use and maintenance of the AFM units and associated systems. In particular, the contractor must conduct at least one session of end-user operational training on-site concurrent with the installation period. The training must cover at least the following:

The contractor must provide a training agenda with stated objectives and outcomes for each training session. The contractor must provide an electronic version in Microsoft Word or PowerPoint of the training materials and at least three (3) copies of printed training materials.

2.5.2 Remote Training

In order to support the standardization and effective operations of the system, the contractor may also propose remote training modules by providing a conference line bridge number and web conferencing link. These training modules may be used to prepare the USFS for implementation or improve operations post-implementation.

2.6 Manuals and Documentation

2.6.1 PA-DSS Implementation Guide

The contractor must deliver the Payment Card Industry Implementation Guide for the credit card payment application incorporated into the delivered system.

2.6.2 AFM Unit Manuals

The contractor must deliver one printed copy and one copy in electronic form user manuals documenting all functions of the AFM units including operations, programming of products and users, maintenance, and troubleshooting.

2.6.3 Updated Manuals and Documentation

An updated manual must be delivered within 30 days of a release to describe any operational or technical changes. If the change is minor, a technical bulletin will be acceptable until major changes warrant a new manual to be provided.

2.7 Technical Support

2.7.1 Service Level Agreement (SLA)

The contractor must provide an option for USFS to purchase annual and/or hourly support for the AFM and associated systems. Items covered in an SLA must include:

· Support Mode: Methods by which FS may access and receive service from the Tier 1 (front-line) support.

· Service Availability: Days and times in which Tier 1 support is available and after-hours operations.

· Time to Answer: Average and maximum time users will have to wait before being able to speak with a Tier 1 Support Representative.

· Access to Configurations: Describe how the technical support personnel will access the USFS’s machine(s), if needed, to provide support.

· Issue Resolution Time: Average and maximum time between report of an issue and resolution.

· Customer Satisfaction: Average customer satisfaction level for technical support calls, along with methods of assessment.

The contractor’s proposal may propose a varying degree of SLA options along with the associated costs.

2.7.2 Warranty

The contractor should provide their warranty for the AFM hardware and software. Items covered in the warranty include:

· Length of warranty

· List of all items covered/not covered

· Point at which warranty begins

· Warranty reporting procedures

· Maximum time from defect report to equipment replacement or repair

· Duration of warranty for replaced equipment

· On-site vs. remote warranty service

· Cost and process for extended warranties

· How the Warranty addresses vandalism of the AFM.

2.7.3 Return Material Authorization (RMA)

The contractor should provide a description of their Return Material Authorization (RMA) process.

2.8 System Administration

2.8.1 Solutions Deployed Off of the USFS Network

Because these AFMs are deployed “off” the USFS Network, the contractor must provide system administration of the deployed solution. System administration is defined as:

· Maintenance of firewall configuration on the deployed solution to prevent unauthorized access (DSS Requirement 1)

· Initial and ongoing configuration management and hardening of the underlying operating system (DSS Requirement 2)

· Update of antivirus software (DSS Requirement 5)

· Updates and patching of operating system and other critical software (DSS Requirement 6)

· Backup and disaster recovery of data

· Logical access control, user account management, password and account lockout management, and management of access control lists (DSS requirements 7 and 8)

· Secure remote access using two-factor authentication (DSS Requirement 8.3)

· Monitoring of severe security and incident reporting (DSS requirement 10)

· Vulnerability scanning and management – internal only (DSS Requirement 11.2)

· Host intrusion detection/prevention (DSS Requirement 11.4)

· File integrity monitoring (DSS Requirement 11.5)

2.9 PCI Compliance for Services

Providers of the services in this section must provide services in a PCI-compliant manner. See Section 4.1.2 for details on requirements for demonstrating PCI compliance.

3.0 Functional Requirements

The functional requirements section defines the requirements the AFM units must meet.

3.1 AFM Unit Functional Requirements

AFMs were originally developed for the parking industry and because of this there are generally two different types of programs: “Quick Pick” or “Pay-by-Space”. This SOW is requesting to use the Quick Pick type of programming.

3.1.1 Ease of Transaction Processing

The AFM must implement a fast and user friendly interface to prompt the customer through purchasing a product, making payment through the programmed tenders, and obtaining the receipt. The prompts of the menu and design of the machine should be completely self-explanatory to the customer where additional signage is not needed to walk the user through selecting the appropriate item, paying, and obtaining their receipt.

3.1.2 Product Pricing

The AFM must be able to configure each product for sale with different prices (i.e. $5 for a 1-day permit, $15 for a 7-day permit, $20 for an Annual Pass). The USFS staff, with the appropriate user rights, must be able to change the pricing for each product, if needed during the contract period.

3.1.3 Multiply Price Charged by Quantity Entered

The AFM must be able to multiply the rate by a number, entered by the visitor, to calculate the total being purchased. This feature displays a prompt asking a programmed question of how many of ‘the product’ they want i.e. “How many 1-day passes?” The visitor then enters the quantity and the machine tells them the total amount for the purchase. The appropriate expiration date and time will then print on the receipt. The machine must print separate passes for each product purchased (e.g., if the customer purchased three 7-day passes the AFM must print three (3) separate permit/receipts).

3.1.4 Calculate Expiration Date & Time for Valid Thru Date

The AFM must be able to calculate and display on the receipt an expiration date based on the following different ways to calculate and display on the receipt the products expiration date.

· Number of days valid: The expiration date and time is calculated based on the products number of days. Valid expiration dates will calculate the expiration date and time, i.e. a twelve month expiration date from the date of purchase for an annual pass or a 1-day pass purchased at noon, expires 1 day later at noon.

· Rate Multiplier: The expiration date and time is calculated based on the product number of days entered to be purchased, i.e. the number of days for a Red Rock Pass purchased, i.e. 1-day or 7-day.

The USFS staff, with the appropriate user rights, must be able to change the expiration date and time for each product.

3.1.5 Tender Processing

The AFM must support the processing of visitor tenders of credit cards only (Visa, MasterCard, Discover, American Express, and JCB). Credit cards will be the only form of tender accepted.

See Section 3.4 Credit Card Processing and 4.1 Credit Card Compliance for further requirements.

3.1.6 Manual Entry of Credit Card Number

The AFM unit must allow an authorized user, USFS staff, to manually enter the credit card payment information when the magnetic reader is unable to capture data to process a transaction. The transaction must be included in the report as “manual entry”.

3.1.7 Payment with Same Card

The AFM must allow the same credit card to be used more than once on the same day at any one machine and for the same dollar amount. This is because more than one transaction may be purchased from the visitor and/or a visitor may purchase multiple permits for multiple parties in separate transactions.

3.1.8 Refund Processing

The AFM system must support the ability to process refunds. All refund transactions must be captured and reported at a minimum by identifying the fee collector processing the refund, date and time.

3.1.9 Receipts Configuration

For fraud purposes, re-printing of receipts must be able to be programmed at an administrative access level to not allow unauthorized users to print duplicate receipts. “Duplicate” will be printed on all duplicate receipts printed.

3.1.10 Printed Receipts Transaction Information

All printed receipts must include the following printed information:

· Forest Service specific configurable header with Red Rock District name, site name, and district office phone number

· Unique machine identifier

· Date and time of transaction

· Unique transaction id number

· Line item with name and price of each product with relevant sales information, i.e. product name, price, quantity

· Any multipliers used in the price calculation

· Total of all transactional lines for receipt total

· Type of credit card tenders following the credit card industry requirements

· Calculate and print in larger and bold text the valid thru date and time: “Month, Day Year, Time” of the product based on the specific period of time a product is valid for ; (i.e. a 7-day pass)

· Variable footer message of at least five (5) lines specific to the item(s) purchased

See Section 3.6.7 Receipt Paper for further requirements.

3.1.11 Number of Receipts to Print

The AFM must print the designated number of receipts for the products configuration i.e. one receipt prints for a 1 day Red Rock Pass and one receipt prints for an Annual Red Rock Pass. The USFS staff, with the appropriate user rights, must be able to change the number of receipts to print for each product.

3.1.12 Out of Receipt Paper

The AFM must monitor the receipt paper and not allow a transaction to be completed if the printer is out of paper or in the event of a paper jam. Upon replacement or reloading of receipt paper, the AFM unit will print the receipt.

3.1.13 Transaction Data Capture

The AFM must capture and document for reporting all transactional data, including but not limited to:

· Unique machine identifier

· Date and time of transaction

· Unique transaction id number

· Product(s) sold

· Tender type paid

· Tender amount paid

· Credit card authorization number OR identify if it has been rejected

3.1.14 Cancel or Abort Transaction

After a transaction has been initiated by the visitor but prior to the tender being completed they must be able to cancel (abort) a transaction. This action must not print a receipt.

3.2 User Access Management

The AFM must implement user access control according to FISMA, USFS IT Security, and PCI DSS requirements. The following are the user access requirements for the AFM.

3.2.1 Create Authorized Users by Security Functions

The AFM must have the ability to create users so they can be identified and authenticated with a unique password. The following requirements apply:

· Creation of appropriately credentialed users to perform the creation and management and to assign permissions or access to designated

· functions. For example, a manager level credentialed user could create, modify, terminate, or delete user accounts but a fee collector cannot.

· There must be a way to designate a user as terminated and access terminated.

· Only user accounts without any historical transactions may be deleted.

· The user is authorized to perform specified functions in the system (i.e. generate reports, perform collections, change sites, access product configuration, tender acceptance, apply updates or patches as system administrators).

3.2.2 Generate list of authorized users

The AFM must be able to generate a list of users currently authorized to access the AFM and their level of access.

3.2.3 Password Requirements

The AFM must enforce password requirements, including:

· Minimum and maximum length of password

· Minimum and maximum lifetime of password

· Password composition requirements for numeric and special characters

· Number of passwords that cannot be reused

A user with an active account must be able to create a unique password for their use. This activity should be logged for reporting purposes. The AFM must allow the user to change the user’s own password.

3.2.4 Authentication and Tracking

The AFM must authenticate all users and track all AFM activities to the user, location, and USFS level. Authentication must include each user having a unique password they have chosen for completing their user login.

3.3 “Quick-Pick” Programming Quick Pick programming provides a list of products that can be selected to purchase. All SOW requirements apply.

The initial AFM items for sale will be one (1), and seven (7) day passes, Red Rock Annual Pass, and the Interagency Pass. If an annual Red Rock Pass or Interagency Pass is purchased, the visitor may exchange the AFM transaction receipt at authorized locations such as the Red Rock Ranger District Visitor Center or the Chamber of Commerce Visitor Center in Sedona for the corresponding pass card. The AFM unit will display the requirements for the purchase of each pass and the process for the exchange (Annual and Interagency) prior to processing the purchase.

The AFM shall be able to offer up to 4 additional products as needed by the USFS in the future.

3.4 Credit Card Processing Requirements

3.4.1 Credit Card Tender Processing

Credit cards shall be processed through the US Treasury’s Financial Management Systems (FMS) designated merchant processing bank and platform, and are subject to all guidelines from the US Treasury’s Financial Management Systems (FMS) Card Processing Rules and Regulations.

The AFM unit software must be able to process visitor tenders of the Treasury designated credit card brands (Visa, Master Card, Discover, American Express, and JCB). The system must be able to be reprogrammed to be modified in order to change the credit card brands accepted.

The US Treasury regulation (TFM 8060.20) requires all credit card transactions collected by or on behalf of the Government must be deposited into a US Treasury account.

3.4.2 Credit Card Authorization

When a PD/SSL connection is available, the process of obtaining the credit card authorization (when online) and printing the receipt must occur in less than five seconds.

The AFM must be able to obtain a credit card authorization under a system administrator established set amount of time (i.e. 30 seconds for a dial-up analog connection or 5 seconds for an IP based connection). Otherwise, it can complete the transaction in an offline store and forward mode, see next requirement.

3.4.3 Offline Store and Forward

When connectivity is not available to obtain authorization, the AFM software must securely (according to PCI DSS Standards) capture, process, store, and forward the credit card request upon reconnection with the network to the authorizing bank.

The AFM must validate if the credit card number was captured through a swiped or manually entered transaction and has been captured correctly and is a viable number.

Any transaction stored in the offline mode and then rejected must be documented and included in a report.

3.5 Reports

The AFM must produce a variety of reports to assist with transaction reporting.

· Minimum required reports include:

· Financial reports based on product purchased by day of sale and tender type processed (i.e. authorized credit card*)

· Credit card sales settlement report must correlate to the bank’s auto close settlement time

· Monthly, quarterly, and annual financial summaries

· Detailed record of transactions through a transaction log

· Refund reports

· Transactions stored in the offline mode and then rejected

*Identified reports must be printed from the AFM with the appropriate user permissions.

3.5.1 Report Format

Reports printed at the AFM must be print ready to print to the receipt printer.

Reports printed from the AFM software to a local or networked printer must be print ready. Thus the user must not need to page format the data prior to printing.

Reports must include the following basic information for the report on each page:

· Title of report

· Date and time report was generated

· Page number

Reports printed from the AFM software must be able to be saved or exported at a minimum in the following formats:

· Portable Document Format (PDF)

· Microsoft Word (version 2010 or earlier)

· Microsoft Excel (version 2010 or earlier)

3.5.2 Report Generation by Filters

The AFM software must generate reports by filters such as:

· Unique machine identifier

· Date and time ranges

· Product(s) sold

· Quantity sold

· Revenue generated

3.5.3 Transactional Sales Data Reports

The AFM software must generate reports by any combination of the following user selected data:

· Unique machine identifier

· Date and time of transaction

· Unique transaction id and number

· Product(s) sold

· Transaction type (sale, refund, exchange, etc.)

· Total charge per transaction

· Credit Card Merchant Identification Number (MID)

3.5.4 User Accounts

The AFM must generate reports to provide a complete list of the following:

· All authorized users with their role

· All deactivated users

· Date and time of user account creation

· Last user account modified date

3.5.5 Remote Monitoring

AFMs must have the capability to be monitored remotely by the contractor and the COR to ensure the machine is functioning properly and to retrieve reports.

3.6 Technical Requirements of AFM Hardware

The following section documents requirements of all AFM unit hardware delivered under this SOW.

3.6.1 Cabinet

The AFM cabinet and layout of the display and components must be designed to be durable to withstand harsh environmental conditions, user friendly to the customer and employee maintaining the machine, and be tamper/theft resistant.

The cabinet and all components used by the visitor to complete a sale (i.e. display, keypad, etc.) must meet Americans Disabilities Act (ADA) accessibility requirements (See Section 4.3) and Section 508 of the Rehabilitation Act (see Section 4.2).

3.6.1.1 Replacement of Existing Cabinets

Sixteen of the AFMs are to replace sixteen (16) existing pay stations. If appropriate, the contractor may propose refurbishing the existing cabinets and installing their solution in the cabinets in order to reduce costs and recycle the materials. The reused cabinets may need to be renovated to ensure a professional appearance.

3.6.1.2 Pedestal for the Cabinet

The USFS prefers the contractor to use the existing AFM space and orientation; however, the contractor may propose an alternative location/orientation that is more cost effective or has improved connectivity. Upon USFS technical review this will be approved or denied. See Appendix B for a description of the existing AFM locations.

The AFM must be securely attached to the pedestal and does not allow removal without opening up the cabinet door.

The contractor must provide the dimensions and requirements for installation of the cabinet with their proposal.

The contractor must provide a pedestal for the cabinet that is suitable for holding the white and brown fee schedule sign (as the current cabinets do). The contractor is responsible for installing these signs to be provided by the USFS.

3.6.1.3 Cabinet Back-up Battery

The cabinet should be able to accommodate a battery that is used as a back-up power source for the solar powered fee stations.

3.6.1.4 Custom Paint of Cabinet

The cabinet must be colored the FS required color. Contractor may propose options to achieve the required paint color for the cabinet color: Body color: Pantone 175(red-brown); or equivalent FS approved

3.6.2 Environment Requirements

The AFM and case must be weather resistant with the ability to function in extreme high and low temperatures, high humidity, dusty, and wet environments since self-pay machines are located outside. They must be able to withstand extreme environmental conditions causing corrosion, rust, melting of components, paint peeling, and fading.

3.6.2.1 Dust and Water Intrusion

Dust-protection: Infiltration of dust cannot be entirely prevented, but the machine shall be adequately sealed to prevent excessive dust from entering the machine and interfering with operation.

Splashing water: Water splashing against the enclosure from any direction shall have no harmful effects.

In order to protect against dust and water intrusion into the device, each AFM must have an Ingress Protection Rating (IP rating) of IP54.

3.6.2.2 Temperature Range Operability

Each AFM, including peripherals, must be operable across an outside temperature range of -9° F to 109° F and withstand extreme outside temperatures ranging between -9° F and 109° F without any damage to the AFM systems.

3.6.3 Security of AFM

The AFM must have a vandal resistant case with a secure locking system for access into the machine. The door must be resistant to prying or drilling and able to be secured to a permanent pedestal.

3.6.3.1 Locks for the AFM

The AFM must have a physical lock which is tamper proof from being picked or replicated to prevent theft and protect the software and PCI DSS data. The lock cores must be unique and may not be duplicated. If lost a new core and key must be available for the USFS designee to obtain additional keys and locks from the key company.

3.6.3.2 Logging of Access to AFM

The AFM must be able to detect when it has been opened and closed. Access into the machine must be logged with the date and time the machine was opened and closed and what functions occurred within the software of the machine.

3.6.3.3 Security Alarm

The contractor must provide the AFM with an internal (silent) alarm which dials to a designated number and external audible alarms to alert enforcement personnel of attempted break-ins or vandalism. The contractor must provide an option for an audible security alarm that will activate when there is attempted break-in.

3.6.4 Display

The machine must have a screen with visual prompts displaying rates and options that is Section 508 compliant. The display screen must be user friendly, easily read from different angles and under varying lighting conditions (including bright, low or no light), resistant to extreme weather conditions, and modular for easy removal and servicing.

The AFM must be designed to be readable in direct sunlight with outside temperatures ranging from -9° F to 109° F.

The display must be usable by a gloved hand.

3.6.5 Keypad

The machine shall have a reliable Section 508 compliant keypad which allows visitors to enter numbers for the number of items purchased.

3.6.6 Receipt Printer

The AFM must have a printer for printing receipts, collection and compliance reports with the following features:

· Modular and easy to remove for repair and maintenance

· Uses latest receipt printing technology for fast and durable receipts which prints a one item receipt under 5 seconds

· Auto paper cutting feature

The AFM must allow USFS staff to replenish receipt paper without the need of tools after gaining access to the interior of the AFM and be user friendly to change paper.

3.6.7 Receipt Paper

Receipt shall be printed on durable, weather resistant paper stock that is resistant to fading or turning black in extreme temperatures/sunlight. Each receipt printed by the receipt printer must be readable for seven (7) days of direct sun in the dashboard of a vehicle.

3.6.7.1 Paper stock with USFS Messaging

The contractor may provide a proposal for paper stock with a pre-printed USFS message on the back of the paper which could include the USFS logo as a watermark.

3.6.8 Magnetic Stripe Reader

Each AFM unit must include a magnetic stripe reader capable of reading the magnetic stripe on a credit card. The magnetic stripe reader must meet the PCI DSS requirements. In addition, the AFM must be chip and pin compliant.

3.6.9 Power

The current availability of power for each kiosk is shown in the list in 2.1. The contractor is responsible for acquiring and maintaining power to each of the AFM units. Some units may require solar or battery power.

The AFM shall at a minimum meet the Underwriters Laboratories (U/L) electrical Safety Standard 60950-1 with an international protection rating classification of IP54 or greater. The power supply shall have a circuit breaker and indicator to identify the power is on or off.

[IP54: Enclosures constructed for either indoor or outdoor used to provide a degree of protection to personnel against incidental contact with the enclosed equipment; to provide a degree of protection against falling dirt, rain, sleet, snow, and windblown dust; and be undamaged by external formation of snow and ice on the enclosure.]

3.6.9.1 UPS

Each AFM must include an uninterruptible power supply (UPS) capable of allowing the system, including all peripherals, to safely shut down, if necessary, and protect the AFM against electrical power surges and brown outs.

3.6.9.2 Surge Suppressor

Each AFM must include a surge suppressor that will allow the AFM and UPS to survive a power surge, including a lightning strike.

3.6.10 Operating System

If the AFM is Windows-based, it must run Windows 7. The contractor must stay current with operating system upgrades relative to the market.

3.6.11 Storage Devices

Any mass storage devices used in any AFM device must be solid-state, with no moving parts.

4.0 Compliance Requirements

This section defines the compliance requirements that must be met in order to meet industry, federal and USDA information and data security requirements.

4.1 Credit Card Compliance

4.1.1 PCI Requirements for Payment Applications

4.1.1.1 Payment Applications Data Security Standards (PA-SAA) Compliance The PCI-DSS identifies specific Payment Applications Data Security Standards (PA-DSS), which specify the security controls that a payment application is required to comply with.

The contractor must ensure the product suite is:

· Validated by the PCI SSC as a payment application; and

· Is deployed in accordance with the instructions detailed in the PA-DSS Implementation Guide for the product suite that is associated with its PA-DSS validation

The list of Validated Payment Applications is available from:

https://www.pcisecuritystandards.org/approved_companies_providers/validated_payment_applications.php

4.1.2 PCI Compliance for Service Providers

For support services provided under this SOW that allow the contractor any administrative access to USFS cardholder data or any key systems that comprise the Cardholder Data Environment (CDE), the contractor must achieve and maintain PCI DSS compliance for the services they are providing against the current version of PCI DSS published on the PCI Security Standards Council website.

As evidence of compliance, the contractor must provide when requested, a current attestation of compliance (AOC) signed by a PCI Qualified Security Assessor (QSA) along with the scoping or other such sections from their Report on Compliance that verifies that the services provided to the USFS were included.

4.1.3 Certification with Treasury-Designated Payment Processor The payment application used for processing credit card payments must be certified with the Treasury designated payment processor.

4.1.4 Card Brand Operating Regulations and Mandates

The contractor must remain compliant with Visa, Master Card, American Express, Discover, and JCB Operating Regulations and Mandates and assist the USFS in making operation business decisions based on the mandates.

4.1.5 Off-Network Operations

Because the contractor is operating the equipment off of the USFS network, the contractor must provide the most recent security assessment results which show the current state of security controls for the operating environment on which USDA information will be processed, per NIST 800-53A control CA-2.2.3 and CA-6.1.2.

4.1.6 Return Government Furnished Equipment

The contractor must return all government furnished information and property at the end of the contract or when the government requests the information or property. USDA will own the intellectual property rights to work developed on its behalf to the maximum extent possible, per NIST 800-53A control PS-4.1.3.

4.1.7 IPv6 for IP Devices

For any IP-based products, the contractor must provide a Suppliers Declaration of Performance (SDOC) or IPv6 ready logo that the information technology product(s) meet USDA’s IPv6 requirements as defined in NIST 500-267 per NIST 800-53A control CM-6.1.1.

4.2 Section 508 of the Rehabilitation Act Compliance

In 1998, Congress amended the Rehabilitation Act of 1973 to require Federal agencies to make their electronic and information technology (EIT) accessible to people with disabilities. Inaccessible technology interferes with an ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology, open new opportunities for people with disabilities, and encourage development of technologies that will help achieve these goals. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. All EIT procured under this RFP, including AFM units and software applications, must comply with the requirements of Section 508. Additional information about Section 508 compliance can be found at http://www.section508.gov

4.3 Americans Disabilities Act (ADA) Accessibility

The physical AFM must comply with the Americans Disabilities Act (ADA) accessibility requirements applicable to their design, user options and interfaces. All AFMs must be no more than 48” above ground to ensure customer operated controls are accessible.

5.0 Project Management, Revenue Accounting and Billing

5.1 Monthly Project Management Reports and Revenue Management The Contractor will receive a completed monthly financial statement, prepared by the USFS representative, in a format proposed by the contractor and accepted by the COR. This report will include transaction details for each AFM such that credit card or other bank fees and types of transaction and revenue by product type can be easily determined. Based on this report, the contractor will pay monthly, by check, to the USDA each month’s total revenue from all units, minus credit card processing fees. This check will be sent via certified mail to USDA Red Rock Ranger District Office on a schedule agreed to by the contractor and COR.

5.2 Site Visit Report

The contractor must, within three days after return from an on-site visit, provide a report in the format to be provided by the contractor, informing the USFS of the actions performed while on-site, including any installations performed (along with all relevant technical information about the installed products or applications) and any training provided to USFS personnel as a result from performed actions while on-site.

5.3 Billing

The contractor will invoice USFS monthly for a percent of revenue (revenue is defined as all payments received by AMF units minus credit card transaction fees). Invoicing will be scheduled and formatted in a way proposed by contractor and accepted by COR.

6.0 Delivery

Delivery, installation, setup and testing of AFM units shall be complete within 6 calendar weeks of award.

7.0 General Information

7.1 Days Defined

All references to days refer to calendar days, unless otherwise noted.

7.2 Contract Changeover

The contractor must support a successor contractor in the performance of this work in the event of a new Contractor being selected to perform the follow-on services. The Contractor agrees to use its best efforts to effect an orderly and efficient transition to any successor Contractor and its employees during a transition period to be specified by the Contracting Officer.

7.3 Facility Security

The Contractor must comply with all Federal and agency-specific security regulations and procedures.

7.4 Licensing Requirements

The contractor must identify in the proposal any licensing requirements applicable to the procurement of the AFM units and be a part of the contractor’s solution.

7.5 Government Furnished Property (GFP), Services and Data

In accordance with FAR 52.245-1, the Government will provide to the Contractor, Government furnished and Government owned property to support the Contractor in providing required services as specified in the SOW for this solicitation.

7.6 Exclusive Rights

The Government will provide and/or retain the exclusive rights to the GFP.

7.7 Document Formats

The contractor must deliver any documentation under this contract in unlocked/unrestricted Microsoft Office format.

8.0 Price Schedule

Based on APPENDIX A, provide the list of Line Item’s (LI) which a quote is being requested to meet this Statement of Work.

Each LI shall have a brief description of the item, an Extended Description with the relevant SOW requirements, anticipated Start, End and Delivery date which will be finalized upon award; quantity and unit of issue, and a space for unit price and total cost.

If non-bid items exist for a portion of the work, include the costs in a related bid item.

The contractor should include their recommended Start, End and Delivery dates with their proposal.

C-1.6. HOURS OF OPERATION.

C-1.6.1. Continuous —The fee machines must operate 24 hours per day, 7 days per week.

C-2. DEFINITIONS

C-2.1. Quality Control (QC). The body of requirements and activities incumbent on the Contractor to assure that the services provided conform to contract quality requirements. It refers to the Contractor's plans, programs, inspections and actions taken to produce performance results that meet contract objectives.

C-2.2. Quality Assurance (QA). A planned and systematic pattern of all government actions necessary to provide confidence that adequate technical requirements are established; products and services conform to…