Alerton DDC PWS 7-20-26.docx

PERFORMANCE WORK STATEMENT

Title: Alerton Building Automation System Maintenance and Emergency Repair Date: 07/15/2026

I. BACKGROUND INFORMATION

The National Institute of Standards and Technology (NIST) is a 576-acre facility consisting of thirty-six (36) mixed use (mainly office and research laboratory) buildings. There are currently four (4) proprietary building automation systems used to control various mechanical equipment that maintain the required environmental conditions on campus. The Alerton Envision for BACtalk Control Systems pertains to this performance work statement (PWS).

II. PURPOSE

Contractor is to provide all labor, supervision, tools, material, and equipment to provide preventative maintenance and emergency services for the Alerton Envision for BACtalk Control systems specified. Contractor must maintain systems to ensure systems are in proper operating order.

PLACE OF PERFORMANCE

Maintenance service must be provided twice a month, and the place of performance shall be at NIST, Gaithersburg Campus. Maintenance service shall be performed during normal business hours (7am – 5 pm Monday through Thursday, excluding, weekends and Federal Holidays).

PERIOD OF PERFORMANCE

This is a 1-year Base Period contract with four (4) 1-year Option Periods.

Base - 9/1/2026 – 8/31/2027 Opt.1 – 9/1/2027 – 7/31/2028 Opt.2 – 9/1/2028 – 7/31/2029 Opt.3 – 9/1/2029 – 7/31/2030 Opt.4 – 9/1/2030 – 7/31/2031 Six-Month EXT – 08/01/2023 – 01/31/2032.

III. SPECIFIC REQUIREMENTS

The maintenance service shall cover:

· Alerton Envision for BACtalk application 6ea. Locations. 2ea.Servers and 4ea. Clients. This includes replacement and/or updating of servers, client PCs.

· Global Controllers (BTI’s and BCM’s) 16 ea. BTI’s and 9ea. BCM’s or interfacing of automation to unitary devices related to mechanical operation of points to be controlled by automation system that are maintained in DDC Cabinets.

TASKS

Maintenance services shall include the following:

Task 1 – Data Backup

Complete data backup to CD, DVD or flash drive to include trend logs, programming, graphics, and control software must be conducted whenever software or programming changes is made but no less frequently than monthly.

Task 2 – Graphics Revisions

The contractor shall maintain all graphics at each of the applicable workstations.

Task 3 – Programing Diagnostics

The contractor shall perform diagnostics of programs and make recommendations for change/correction to meet original control performance requirements. After consulting with NIST COR the contractor shall make changes to programming to achieve the performance requirement.

Task 4 – Field Panel Diagnostics

The contractor shall perform diagnostics of all field panels. The contractor shall analyze the results of diagnostics and make recommendations for changes to optimize the building control performance within the functional capabilities for the system any changes required to hardware will be the responsibility of NIST. Changes required to software to resolve issues shall be the responsibility of the contractor.

Task 5 - Control Loop Evaluation and Tuning

The contractor shall evaluate and tune critical control loops to maintain peak efficiency of equipment as the building mechanical systems’ performance changes over time. NIST DDC personnel shall work with the Contactor to identify the critical control loops on each system.

Task 6 – Consultation

The Contractor shall consult with NIST DDC personnel to identify and resolve problems with hardware and/or software in the applicable automation system. Any changes required to hardware will be the reasonability of NIST. Changes required to software to resolve issues shall be the reasonability of the contractor.

Task 7 – Emergency Service

This shall Include time for Contractor to diagnose and resolve problems identified by NIST. This shall include normal or out of normal hours past 7am – 5pm Monday through Thursday to include Fridays, Saturdays, Sundays and Federal holidays. If necessary, the Contractor shall respond to the site in 24 hours of contact by NIST. Pricing shall be based upon 40 hours of emergency service.

Task 8 – IT Security Requirements Security Hardening & Configuration

· The Contractor shall ensure that all software components including the operating system, firmware, and database management systems utilized in the management and operation of the BAS systems are maintained on versions currently supported by the manufacturer.

· All non-essential services, ports, and protocols must be disabled or removed.

· Before and after any maintenance or repair activity, a full system configuration backup shall be performed.

Access Management

· Access shall be granted only to the level required for the specific maintenance or repair task.

· The use of shared administrative accounts is strictly prohibited. The Contractor must use unique, named credentials for all installation and configuration tasks.

· All default passwords (e.g., system administrator, admin, operator, guest) must be changed to unique passwords prior to system handover.

Device Control

· Personal laptops, USB drives, smartphones or any wireless-capable devices are prohibited from connecting to the BAS environment.

· The Contractor personnel shall not attempt to bridge the BAS systems to a cellular hotspot or any other network-connected device.

Auditing & Logging

· The Contractor shall configure the system to provide an audit trail of all administrative and operator actions. The system shall log administrative actions, successful and failed login attempts, account lockouts, and configuration changes. Logs must include a timestamp and the specific user ID.

· Audit logs and event histories shall be retained within the active production database for a minimum of 12 months before archiving. Archived logs shall be maintained for an additional period of 18 months in a format that allows for restoration if requested by the COR or during an audit.

Task 9 Homeland Security Presidential Directive (HSPD)-12

Contractor personnel (including subcontractors) who require physical access to NIST facilities or logical access to NIST IT networks or systems must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; NIST HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Roster

The Contractor must submit a roster by name, position, e-mail address, phone number and responsibility, of all personnel (including subcontractor personnel) working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s).

The Contractor must submit the roster to the COR and/or CO within 14 days of the effective date of this contract. Any revisions to the roster because of staffing changes must be submitted within 14 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. If the employee is filling a new position, the Contractor must provide a position description, and the Government will determine the appropriate suitability level.

Position Sensitivity Designations Requirement

All Contractor (and/or any subcontractor) personnel must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

The following position sensitivity designation levels apply to this acquisition:

Low Risk – Tier 1

IV. GENERAL REQUIREMENTS

1. General Administration Requirements

a. Technicians shall be required to obtain a NIST badge to access the site. Typically, it takes thirty (30) calendar days to obtain a NIST badge. Contact the COR for paperwork necessary to obtain a NIST Badge.

b. For each service visit, the technician shall report to the COR (or designated alternate) upon arriving and departing the site.

c. User accounts and privileges for those accounts are only to be created or modified by NIST.

d. NIST will create BAS application and operating system accounts, if required, for Contractor technicians required to access system. Contractor shall notify NIST COR of need for account. NIST preference would be for each technician to have their own account, but a company account will be considered with proper justification.

e. Laptops are available for Contractor use on-site but must be requested through the NIST COR. Laptops shall be issued from and returned to NIST DDC Group on the day of service.

f. Only NIST-approved or provided data storage devices shall be used on the systems.

g. Applications must adhere to NIST IT security protocol. NIST will scan the systems at least annually and report any IT security vulnerabilities to Contractor for action. If revisions would cause functionality issues, the contractor must submit a justification in writing to the COR for not implementing changes.

h. Prior to assigning any new IP addresses and device instance numbers, consult with the NIST COR in writing to ensure that the designations conform to NIST protocol.

i. Service must be completed prior to submitting invoices to NIST for payment.

2. Quality Assurance

NIST’s role in quality assurance is to ensure that the Contractor is achieving the quality levels established in the operation and maintenance service contract and focuses on the Contractor’s QC plan. NIST periodically validates the execution of the Contractor’s QCP by reviewing areas such as inspection forms, service request logs, maintenance reports and timeliness of corrective actions.

As a part of the Government’ Quality assurance program, the Government may:

· Review and, if warranted reject any report or other submittals required by Contractor.

· Review performance and service records, including (if applicable, but not limited to) monthly progress reports, BAS data, and any computerized or hard copy records maintained by the Contractor documenting performance under this contract, and require correction of any unsatisfactory conditions noted.

· Determine adequacy of the Contractor’s QCP and document the overall success of this program. The Government may order improvements, if it determines the program is insufficient or ineffective.

· Obtain information and require improvements in service based on such information to the extent such results correlate with deficiencies in Contract requirements.

· Conduct (random and routine) physical inspections of facticity equipment and systems, including programs and files maintained on computers in Contractor’s onsite work areas and require correction of deficiencies noted.

· Perform inspections with Government personnel or independent third-party inspectors.

V. SCHEDULE OF DELIVERABLES

1. Prior to performing any field work, submit to NIST a job specific activity hazard analysis (“Safety Plan”) for review and approval. This will be reviewed by representatives from OFPM COR and Safety. It is anticipated that review of analysis will require seven (7) business days. A notice to Proceed will not be issued until the safety plan has been approved. Services technicians must comply with the approved plan while on site.

2. Quality Control Plan. The Government’s role in quality assurance is to ensure that the Contractor is achieving the quality levels established in the contract and focuses on Contractor’s Quality Control Plan (QCP). The Government periodically validates the execution of the Contractor’s QCP by reviewing such areas as the Contractor’s reports, inspections of equipment and timeliness of corrective actions; refer to the Quality Assurance Surveillance Plan (QASP). The COR will review all submitted reports, against the requirements of the scope of work and the QASP within ten (10) calendar days to verify that performance standards are being met, and quality is satisfactory.

3. Planned service dates shall be submitted for approval to NIST COR a minimum of fourteen (30) days prior to planned date. To allow NIST site resignation, the Contractor shall provide name and citizenship information of service technician to NIST COR a minimum of one (1) business day prior to planned date. If the technician is not a US citizen additional information is needed and that information must be submitted at least three (3) business days prior to planned date.

4. For each monthly service and emergency service visit, the Contractor shall provide a written reports indicating the date, time, duration, and description of service provided. This report shall be submitted to NIST COR within five (5) days of scheduled visit.

Quantity

VI. PAYMENT SCHEDULE

The Contractor will be paid, in accordance with the payments clause in the contract and as otherwise noted in this document, upon receipt and subsequent reviews of a proper invoice.

QUALITY ASSURANCE SURVEILLANCE PLAN

Submit a PM report of scheduled, completed, and outstanding tasks after each visit.

100% of reports accurately depict status

99%

File reviews, periodic inspections, and random, observations, customer complaints.

Conduct (random and routine) physical inspections of facticity equipment and systems

Contractor is in compliance with QCP when no deficiencies noted

99%

File reviews, periodic inspections, and random, observations, customer complaints