Alerton DDC COMPASS 2 Upgrade PWS 07.09.2026.docx

PERFORMANCE WORK STATMENT

Title: Alerton DDC Albireo Energy Compass 2 Server Upgrade Date: 07/06/2026

I. BACKGROUND INFORMATION

The National Institute of Standards and Technology (NIST) is a 576-acre facility consisting of thirty-six (36) mixed use (mainly office and research laboratory) buildings. There are currently four (4) proprietary building automation systems used to control various mechanical equipment that maintain the required environmental conditions on campus. The objective of this project is to upgrade the existing Alerton Envision Building Automaton System (BAS) to Alerton Compass 2 (or the latest stable version). The Contractor shall provide all necessary software, licenses, server/workstation hardware, engineering, installation, configuration, and commissioning required for a complete and fully operational system.

II. PURPOSE

Contractor shall be responsible for all labor, tools, material, equipment, and software required to complete the specified upgrade. Contractor must maintain the systems for the first year to ensure systems are in proper operating order. The years that follow system installed, Alerton Compass 2 server will be added to the existing Alerton Envision network and maintained accordingly.

PLACE OF PERFORMANCE

The place of performance shall be at NIST, Gaithersburg Campus. Upgrade and maintenance service shall be performed during normal business hours (7am – 5 pm Monday through Friday, excluding, weekends and Federal Holidays).

PERIOD OF PERFORMANCE

This is one year after the contract was signed.

III. SPECIFIC REQUIREMENTS

Compass 2 server upgrade and maintenance service shall cover:

· Furnish and install new Alerton Compass 2 software and associate license with SMA

· Re-install (updated for Compass 2) custom job files and graphics from most recently available system backup

· Provide programming labor to combine AML and GPL Alerton databases under single Compass 2 system

· Confirm system operation after migration is completed

· Furnish and install (1) rack mounted server in NIST provided rack in Building 225. Connect to PDU’s and network switch provided by NIST.

TASKS

Maintenance services shall include the following:

Task 1 – Server upgrade The Contractor shall supply, install, and configure a new server for Compass 2 meeting or exceeding the specification listed in attachment A.

Task 1 – Data Backup

The Contractor shall perform a comprehensive backup of the existing database to CD, DVD or flash drive to include points, trend logs, alarms, programming, graphics, and historical data.

Task 2 – Graphics Revisions

The Contractor shall maintain all graphics at each of the applicable workstations.

Task 3 – Programing Diagnostics

The Contractor shall perform diagnostics of programs and make recommendations for change/correction to meet original control performance requirements. After consulting with NIST COR the contractor shall make changes to programming to achieve the performance requirement.

Task 4 – Field Panel Diagnostics

The Contractor shall perform diagnostics of all field panels. The contractor shall analyze the results of diagnostics and make recommendations for changes to optimize the building control performance within the functional capabilities for the system any changes required to hardware will be the responsibility of NIST. Changes required to software to resolve issues shall be the responsibility of the contractor.

Task 5 - Control Loop Evaluation and Tuning

The Contractor shall evaluate and tune critical control loops to maintain peak efficiency of equipment as the building mechanical systems’ performance changes over time. NIST DDC personnel shall work with the Contactor to identify the critical control loops on each system.

Task 6 – Consultation

The Contractor shall consult with NIST DDC personnel to identify and resolve problems with hardware and/or software in the applicable automation system. Any changes required to hardware will be the reasonability of NIST. Changes required to software to resolve issues shall be the reasonability of the contractor.

Task 7 – Emergency Service

This shall Include time for Contractor to diagnose and resolve problems identified by NIST. This shall include normal or out of normal hours past 7am – 5pm Monday through Thursday to include Fridays, Saturdays, Sundays and Federal holidays. If necessary, the Contractor shall respond to the site in 24 hours of contact by NIST. Pricing shall be based upon 40 hours of emergency service.

Task 8 – IT Security Requirements The Contractor shall configure the Alerton Compass system to meet IT/OT security compliance standards.

Security Hardening

· The Contractor shall harden the Compass server operating system and application software in accordance with the industry standard frameworks (e.g., CIS Benchmarks, NIST SP 800-123).

· The Contractor shall ensure that all software components including the operating system, firmware, and database management systems utilized in the management and operation of the Compass system are maintained on versions currently supported by the manufacturer.

· The Contractor shall disable all unused ports, services, and protocols on the Compass server. Any ports, protocols, or services not strictly required for the server's function (e.g., Telnet, printer spooler, SNMP) must be disabled.

Access Management

· All services, drivers, and applications must run with the minimum necessary permissions.

· The Contractor shall configure distinct user roles (e.g., Administrator, Operator, View-Only) adhering to the principle of least privilege.

· The Compass system shall be configured to enforce strong password complexity rules and account lockout policies.

· The Compass system shall enforce an automatic session timeout/logoff after [30] minutes of user inactivity.

· The use of shared administrative accounts is strictly prohibited. The Contractor shall use unique, named credentials for all installation and configuration tasks.

· All default passwords (e.g., sa, admin, operator, guest) must be changed to unique passwords prior to system handover.

Data Protection

· The Contractor shall ensure that all data stored on the Compass server are encrypted at rest using industry standard encryption (e.g., AES-256).

· All management traffic and application data-in-motion shall be protected using TLS version v1.3 (or TLS v1.2 where v1.3 is not supported).

· The Contractor shall configure automated, daily backups of the database, graphical files, and system configurations.

Device Control

· Personal laptops, USB drives, smartphones or any wireless-capable devices are prohibited from connecting to the BAS environment.

· The Contractor shall not attempt to bridge the BAS systems to a cellular hotspot or any other network-connected device.

Auditing & Logging

· The Contractor shall enable comprehensive system logging that records all user actions, including successful and failed login attempts, account lockouts, configuration changes, setpoint modifications, and alarm acknowledgements. Logs must include a timestamp and the specific user ID.

· Audit logs and event histories shall be retained within the active production database for a minimum of 12 months before archiving.

Maintenance

· The Contractor shall ensure that all software components including the operating system, firmware, Database Management Systems, and server are maintained at the most current stable release available.

· The server/workstation hardware must demonstrate forward compatibility with future software iterations.

Testing & Acceptance

· The Government will perform a security assessment of the new Compass 2 system, which is required for the NIST Authority to Operate (ATO), and for continuous monitoring activities thereafter. The Contractor shall work with the Government in mitigating all security risks found during the initial ATO assessment and information security continuous monitoring process.

· The Contractor shall coordinate and cooperate with the Government in conducting vulnerability scanning activities. The system shall not be placed into production until identified vulnerabilities are reviewed and remediated in accordance with the Government security requirements. Any findings must be remediated by the Contractor at no additional cost to the Government.

Task 9 Homeland Security Presidential Directive (HSPD)-12

Contractor personnel (including subcontractors) who require physical access to NIST facilities or logical access to NIST IT networks or systems must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; NIST HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Roster

The Contractor must submit a roster by name, position, e-mail address, phone number and responsibility, of all personnel (including subcontractor personnel) working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s).

The Contractor must submit the roster to the COR and/or CO within 14 days of the effective date of this contract. Any revisions to the roster because of staffing changes must be submitted within 14 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. If the employee is filling a new position, the Contractor must provide a position description, and the Government will determine the appropriate suitability level.

Position Sensitivity Designations Requirement

All Contractor (and/or any subcontractor) personnel must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

The following position sensitivity designation levels apply to this acquisition:

Low Risk – Tier 1

IV. GENERAL REQUIREMENTS

1. General Administration Requirements

a. Technicians shall be required to obtain a NIST badge to access the site. Typically, it takes thirty (30) calendar days to obtain a NIST badge. Contact the COR for paperwork necessary to obtain a NIST Badge.

b. For each service visit, the technician shall report to the COR (or designated alternate) upon arriving and departing the site.

c. User accounts and privileges for those accounts are only to be created or modified by NIST.

d. NIST will create BAS application and operating system accounts, if required, for Contractor technicians required to access system. Contractor shall notify NIST COR of need for account. NIST preference would be for each technician to have their own account, but a company account will be considered with proper justification.

e. Laptops are available for Contractor use on-site but must be requested through the NIST COR. Laptops shall be issued from and returned to NIST DDC Group on the day of service.

f. Only NIST-approved or provided data storage devices shall be used on the systems.

g. Applications must adhere to NIST IT security protocol. NIST will scan the systems at least annually and report any IT security vulnerabilities to Contractor for action. If revisions would cause functionality issues, the contractor must submit a justification in writing to the COR for not implementing changes.

h. Prior to assigning any new IP addresses and device instance numbers, consult with the NIST COR in writing to ensure that the designations conform to NIST protocol.

i. Service must be completed prior to submitting invoices to NIST for payment.

2. Quality Assurance

NIST’s role in quality assurance is to ensure that the Contractor is achieving the quality levels established in the operation and maintenance service contract and focuses on the Contractor’s QC plan. NIST periodically validates the execution of the Contractor’s QCP by reviewing areas such as inspection forms, service request logs, maintenance reports and timeliness of corrective actions.

As a part of the Government’ Quality assurance program, the Government may:

· Review and, if warranted reject any report or other submittals required by Contractor.

· Review performance and service records, including (if applicable, but not limited to) monthly progress reports, BAS data, and any computerized or hard copy records maintained by the Contractor documenting performance under this contract, and require correction of any unsatisfactory conditions noted.

· Determine adequacy of the Contractor’s QCP and document the overall success of this program. The Government may order improvements, if it determines the program is insufficient or ineffective.

· Obtain information and require improvements in service based on such information to the extent such results correlate with deficiencies in Contract requirements.

· Conduct (random and routine) physical inspections of facticity equipment and systems, including programs and files maintained on computers in Contractor’s onsite work areas and require correction of deficiencies noted.

· Perform inspections with Government personnel or independent third-party inspectors.

V. SCHEDULE OF DELIVERABLES

1. Prior to performing any field work, submit to NIST a job specific activity hazard analysis (“Safety Plan”) for review and approval. This will be reviewed by representatives from OFPM COR and Safety. It is anticipated that review of analysis will require seven (7) business days. A notice to Proceed will not be issued until the safety plan has been approved. Services technicians must comply with the approved plan while on site.

2. Quality Control Plan. The Government’s role in quality assurance is to ensure that the Contractor is achieving the quality levels established in the contract and focuses on Contractor’s Quality Control Plan (QCP). The Government periodically validates the execution of the Contractor’s QCP by reviewing such areas as the Contractor’s reports, inspections of equipment and timeliness of corrective actions; refer to the Quality Assurance Surveillance Plan (QASP). The COR will review all submitted reports, against the requirements of the scope of work and the QASP within ten (10) calendar days to verify that performance standards are being met, and quality is satisfactory.

3. Planned service dates shall be submitted for approval to NIST COR a minimum of fourteen (30) days prior to planned date. To allow NIST site resignation, the Contractor shall provide name and citizenship information of service technician to NIST COR a minimum of one (1) business day prior to planned date. If the technician is not a US citizen additional information is needed and that information must be submitted at least three (3) business days prior to planned date.

4. For each monthly service and emergency service visit, the Contractor shall provide a written reports indicating the date, time, duration, and description of service provided. This report shall be submitted to NIST COR within five (5) days of scheduled visit.

Quantity

VI. PAYMENT SCHEDULE

The Contractor will be paid, in accordance with the payments clause in the contract and as otherwise noted in this document, upon receipt and subsequent reviews of a proper invoice.

QUALITY ASSURANCE SURVEILLANCE PLAN

Submit a PM report of scheduled, completed, and outstanding tasks after each visit.

100% of reports accurately depict status

99%

File reviews, periodic inspections, and random, observations, customer complaints.

Conduct (random and routine) physical inspections of facticity equipment and systems

Contractor is in compliance with QCP when no deficiencies noted

99%

File reviews, periodic inspections, and random, observations, customer complaints