Attachment 01b1 PWS Task Order 1.docx

PERFORMANCE WORK STATEMENT (PWS)

Pentagon Force Protection Agency (PFPA) Integrated Security Services Contract 4 (ISSC) Task Order One

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personal services contract to provide Integrated Security Services. The Government shall not exercise any supervision or control over contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Prime Contractor who, in turn is responsible to the Government.

0. Description of Services/Introduction: The Pentagon Force Protection Agency (PFPA) Integrated Security Services Contract (ISSC) is a total system approach for providing integrated electronic and physical security systems for the Pentagon Reservation, Mark Center, Defense Health Headquarters (DHHQ), DoD leased facilities, and Raven Rock Mountain Complex (RRMC) in Adams County, PA and Washington County, MD as defined in 32 CFR 234.1.

0. Background: Previous contracts for this requirement, awarded in 2007, 2012, and 2017 provided comprehensive security integrator services to PFPA. Since inception, contract scope has expanded to include additional facilities, new systems, and increased security capabilities.

1.3 Objectives: The Government’s four, inter-related high level objectives for the ISSC are:

a) Scalability and Interoperability – Systems shall be capable of scaling to accommodate additional users, sensors, capabilities, and facilities. Similarly, systems shall be able to adjust down as facilities are closed, suites are decommissioned, or requirements adjusted. Systems and their components shall to the maximum extent possible, utilize open standards and commercial-off-the-shelf (COTS) technology. Standard network protocols shall be used to traverse the Government’s network. Wherever computers are required, they shall be widely available models based on open systems architecture. Standard operating systems shall be used, such as but not limited to Microsoft Windows, Linux, and UNIX for the computer-based systems provided under ISSC.

b) Availability and Resiliency – The Government has a goal of operating ISSC systems at or near a 100% operational level. Systems shall be designed and implemented to be resilient to failure such that a failure of a single component should not incapacitate the entire system. To achieve this goal, the Contractor shall leverage industry best practices for assuring resiliency and availability, including but not limited to:

· Built-in redundancy

· Automatic failover

· Fault tolerance

· Virtual environments

· Data backup

· Data archiving

· Automatic updates of operating systems (OS) and applications

· Existing and future cloud management services

· Notification of software/hardware approaching end of life

· Power-on replacement i.e. hot swapping components or peripherals

· Continuous Power i.e., uninterruptible power supplies (UPSs)

· Backup power i.e. batteries and generators

· Surge suppressors

For the purposes of this contract, system reliability is defined as the probability that a system or subsystem, including all hardware, firmware, and software will satisfactorily perform the intended function(s) for which it was designed, duration for which it is in operation, and in the operational environment. The Contractor shall maintain system reliability at a level equal to, or higher than, the systems documented percentage or failure rate provided by the manufacture and/or as required by regulatory requirements for classified areas.

For the purposes of this contract, system availability is defined as the ratio of time a system, subsystem, or component is functional to the total time it is required or expected to function.

For the purposes of this contract, system serviceability is defined as the ease with which a component, device, or system can be maintained and repaired. All precautions should be taken to maintain and repair systems to cause as little downtime or disruption as possible and within the expected reliability and availability standards stated in this contract. The Contractor shall notify the government of any potential problems or recommended actions critical to systems operations that can be addressed by maintenance and repair, as far in advance as possible to minimize downtime or failure.

Factors that do not impact contractual requirements for system reliability, availability, or serviceability are where root cause of problems are as a result of network, power, or other external factors outside the scope of this contract and maintained by OGAs or OGCs. Outages caused by external factors shall not count against the availability or reliability statistic until the network, power, or other external factor has been restored, but may require support for the application or equipment impacted.

c) Reliability and Cost Sustainability – Systems and services shall be affordable across the full lifecycle while meeting the Government’s requirements, minimize the use of custom and proprietary solutions, and remove systems, hardware, and software before they incur excessive sustainment costs or reach end of service.

d) Accountability and Customer Satisfaction – Systems and services shall be designed and implemented, and quality checked (i.e. QA/QC) to be user friendly, mindful of the impact and sensitivities of the customer workspace, high performing, and to meet contractual service requirements.

1.4 Scope: The ISSC consists of four main capabilities; Electronic security systems, Physical security, Passive and active barriers, and Infrastructure support. Systems and services under each capability include but not limited to the following:

Electronic security systems, access control; intrusion detection; visual surveillance and intelligent video analytics; physical security information management; license plate recognition; gunshot detection; under vehicle inspection; identity, credential, and access management; mass notification; biometric and multi-modal authentication; computer aided dispatch and other law enforcement mission applications; chemical, biological, radiological detection and mitigation; and operations center collaboration visualization systems.

Physical security, personnel, vehicle, cargo, and parcel screening systems; passive and active barriers, turnstiles, fencing, bollards, gates, traffic control; ballistic rated glass, booths, kiosks, and mobile shields; blast-resistant waste receptacles, doors (sound-rated and force protection), window film, locks, and door hardware.

Software applications in support of Electronic Security, Physical Security, Law Enforcement, and Emergency Management.

Infrastructure supporting the above systems, software configuration, custom code, cabling for electrical and information technology; trenching, grading, utilities, conduit placement, and other civil types of work.

To deliver these capabilities, the Contractor shall provide the services listed below:

a) Full Lifecycle Systems Engineering:

The Contractor shall be responsible for providing full lifecycle systems engineering services for upgrades or new electronic and physical security systems. The full lifecycle shall include requirements elicitation and analysis, design, development, testing, installation, configuration, integration, verification and validation, transition, sustainment, and decommissioning.

b) System Support, Sustainment, and Administration:

The Contractor shall be responsible for sustainment support of electronic security systems. This support includes system monitoring, troubleshooting, patching and software updates, configuration, and administration.

c) 3rd Party Software and Other Government Contractor (OGC) Support:

The Contractor shall provide support to 3rd party software integrations and the OGC installing and maintaining it. This support includes software upgrades, existing or new connections/integrations to ISSC systems, testing, troubleshooting and other areas impacting either ISSC supported systems or those maintained by OGC’s.

d) Preventative Maintenance:

The Contractor shall be responsible for performing periodic preventative maintenance on all electronic and physical security systems identified in this Performance Work Statement (PWS) as well as any components installed during this contract unless specified in the individual task order PWS. Periodic preventative maintenance shall be performed at minimum in accordance with manufacturer recommendations and may require additional preventative maintenance work due to amount of use or ambient conditions.

e) Repair and Sustain:

The Contractor shall be responsible for responding to and repairing damaged, malfunctioning, or inoperable systems and their components as described in this PWS as well as any components installed during this contract unless specified in the individual task order PWS.

f) Configuration Management:

The Contractor shall maintain a database of all ISSC electronic and physical security systems characteristics.

g) Logistics Management:

The Contractor shall be responsible for procuring, storing, and inventory of materials and supplies to deliver services under this contract.

h) Quality Management:

The Contractor shall be responsible for tracking, baselining, and identifying deviations from ISSC and manufacturers standards for quality and performance.

i) Installation, Decommissioning, Hardware, and Alterations:

The Contractor shall be responsible for hardware, installation, extension, relocation, and alterations of electronic and physical security systems per ISSC and manufacturer standards.

j) Design and Technical Evaluation:

The Contractor shall be responsible for performing technical evaluations of new and existing electronic and physical security systems to assess their capacity to meet requirements, maturity, and their continued use.

k) Training:

The Contractor shall be responsible for delivering initial and reoccurring training on electronic and physical security systems to Government and Contractor personnel.

The Contractor shall be responsible for:

a) Service, maintenance, and performance of existing systems and applications at the time of award of this contract.

b) Service, maintenance, and performance of new systems and applications installed and/or upgraded while this contract is in place. These systems may be installed by the ISSC Contractor, or OGCs as part of other non-ISSC construction projects.

The work to be performed on ISSC is divided into five major categories, which are:

1. Capital Improvement (This is a subcategory of Installation for accounting purposes as described in 1.4.10)

2. Non-Capital Improvement (This includes all task orders that don’t meet Capital Improvement criteria)

The specific systems and subsystems are defined in Section 5.0 and Appendix A.

1.4.1 High Risk Personnel (HRP) Residence Protection: The Contractor may provide security system design, hardware, installation, and maintenance for the residences of High Risk Personnel (HRP), including the Secretary of Defense, the Deputy Secretary of Defense, and others as designated by PFPA. These security systems and appurtenances include visual surveillance, intrusion detection, hardened locks and doors, passive barriers, security lighting, monitoring stations, and duress. The Contractor shall consider the sensitive nature of installation at these locations, including careful consideration of aesthetics, non-prominent appearance, and minimal disruption to the homeowner. Maintenance and repair activities at these locations needs advanced coordination with the Government and will be requested through separate task order.

1.4.2 Site Conditions and Work Environment: The Contractor shall anticipate the need to access confined spaces, which Occupational Safety and Health Administration requires appropriate permits/certifications and defines as roofs, roof hatches and access points; telecommunications closets and high voltage rooms; and areas of high traffic or criticality that may not be interrupted during peak access periods as part of installation, preventative maintenance, and repair activities. The Contractor shall provide installation, preventative maintenance, and repair activities throughout the year, in all weather conditions. The Contractor shall provide the appropriate tools, safety measures, and qualified personnel to accommodate the unique nature of these environments and ambient conditions.

The Contractor shall apply for and receive any required building permits, including space use, confined space entry, hot work, excavation, electrical, above ceiling, and utility permits from the Building Manager’s Office or appropriate authority having jurisdiction prior to performing the required work.

The Government shall provide the Contractor with limited parking based on availability at the Pentagon Reservation, Mark Center, and Raven Rock Mountain Complex. There is no Government provided parking at leased facilities. The Contractor shall be fully responsible for procuring parking at all locations to perform work required under this Contract.

1.4.3 Support for On-Going Initiatives: This section describes ongoing ISSC and ISSC related efforts spanning from 2020 until the anticipated award of this contract. Support of these new projects shall be performed under this task order. This section is provided for informational and planning purposes.

1.4.3.1 Privileged Management Program (PMP): PFPA’s PMP is an enterprise solution designed to provide Identity, Credential and Access Management (ICAM) services across the PFPA protected facilities and was developed to achieve compliance with the Homeland Security Presidential Directive 12 (HSPD-12) federal mandate referenced in Appendix B. PMP capabilities include tenant enrollment, identity, credential and access management, and provisioning to PFPA PACS, continuous vetting via Identity Management Engine for Security Analysis (IMESA), tenant security manager self-service control of PACS for their offices, and all aspects of visitor registration, vetting, check-in, escort binding, and checkout.

1.4.3.2 Physical Security Information Management System: PFPA’s Physical Security Information Management (PSIM) system is a commercial-off-the-shelf (COTS), enterprise security management solution that enhances overall situation awareness, surveillance, alarm and incident management for its security operations centers. The PSIM system serves as an integration platform to integrate various, disparate electronic security systems so they function as collective and to automate the application of business rules and operational procedures to assist security operators with alarm and incident management across the Pentagon and the NCR facilities. PFPA is in the process of replacing existing PSIM, which is Proximex Surveillint, with CNL IPSecurityCenter (IPSC) with estimate completion Q2 of 2021. PFPA anticipates opening CNL IPSC to additional user populations beyond the Security Operations Centers during the life of this contract.

1.4.3.3 Alarm Reduction Efforts: PFPA has made significant progress since 2013 in reducing nuisance alarms throughout its systems through aggressive maintenance, lifecycle replacement, configuration changes, and PSIM business logic. PFPA continues to make concerted efforts to reduce nuisance alarms through system/hardware/sensor replacement. PFPA places primacy on fixing causes of alarms at the source, as close to the problem as possible

1.4.4 System Support: The Contractor shall provide baseline system administration support of all systems identified in Section 5.5 as well as any new systems installed under this contract.

1.4.4.1 Baseline System Support:

System support shall include the following services:

System Monitoring: The Contractor shall be responsible for continuous monitoring and oversight of ESS. The Contractor shall establish an automated, continuous method to electronically track the status of ISSC systems, devices, and end points and record statistics on uptime and availability. The Contractor shall provide monthly reports on system and endpoint uptime and reliability. The Contractor shall report to the Government unplanned infrastructure, network, power, or ISSC system interruptions that impact or degrade ISSC Systems. The Contractor shall fully participate in planned and unplanned network outages, including participation in outage teleconferences, on-site coverage, response, remediation to restore systems to pre-outage conditions, and after-action reports on outages. The Contractor shall maintain an active database of equipment across the enterprise to include all devices and their associated location information (address, suite, door(s)), security managers and lessor contact information (where applicable) when made available to PFPA for ISSC use. The Contractor shall integrate this information with geo-spatial databases to ensure consistent records and information for both installation and maintenance. Contractor shall provide database information within 48 hours of request and shall provide database access to the Contracting Officer (CO), Contracting Officer Representative (COR) and COR-approved personnel for use in more frequent/tailored data queries.

Software Updates: The Contractor shall receive and apply all software and firmware updates as they are released by the vendor. Further detail on this Contractor responsibility is located in Section 1.4.7.3.

Configuration Changes: The Contractor shall perform configuration changes to ISSC systems upon Government approval. These configuration changes include, but are not limited to, changing alarm priorities, schedules, parameters; system and device attributes, rule sets, camera home positions, reader group changes; PSIM response workflow adjustments; add, change, and remove ISSC system users; and documenting all system configuration activities. The Contractor shall perform configuration changes within two business days of the approval. Any situations where the configuration changes that cannot be performed within two business days, the Contractor shall provide to the requestor and the COR a written explanation as to the reason and the estimated date of completion. The Contractor shall record all configuration changes for each system in a database.

Reports: The Contractor shall provide to the Government both periodic and ad hoc reports from all ISSC systems. These reports include, but are not limited to, alarm activity; time to acknowledge and clear an alarm by an Operations Center; highest frequency alarms for a specified period; daily turnstile status reports; number of personnel passing through a specific card reader, reader group, entrance, or facility; reports on number of personnel granted access to a specific card reader, reader group, or facility; errors and failures; number, location, and type of outages and impairments; mean time to repair; and lists of sensors, devices, card readers, reader groups; summary of system configuration changes The Contractor shall provide these reports within one business day of request. Urgent more immediate reports will be submitted by the COR for only emergency situations.

1.4.4.2 Information Technology, Network, and Cybersecurity: PFPA is a customer of Defense Information Systems Agency (DISA) Joint Service Provider (JSP). DISA/JSP is responsible for the vast majority of IT delivery to PFPA, to include user accounts, cabling, switches, routers, virtual private networks, firewalls, cybersecurity service provider (CSSP) and defensive cyber operations (DCO), assessment and authorization and issuance of authority to operate (ATO), workstations, and workstation operating system and 3rd party non-ISSC application patching. JSP and higher level DoD information technology / cybersecurity organizations periodic cybersecurity compliance inspections are a key barometer by which ISSC quality is judged.

The Contractor is not responsible for providing or maintaining workstations, server hardware, or similar, unless specified as part of an individual task order. Workstation, server, switch support is accomplished by Other Government Contractor. The Contractor is responsible for application level troubleshooting of ISSC software on servers and workstations. The list of network services to be provided by DISA/JSP is identified in Appendix A, Table 2.

Cybersecurity Services: The Contractor shall provide cybersecurity configuration, documentation, and software update support for all ISSC servers and security devices (e.g., PACS panels, cameras, etc.) in order to maintain their Authority to Operate.

The Contractor personnel with system administrator / engineer responsibility shall have minimum DoD IA Workforce Level II certifications in accordance with (IAW) references identified in Appendix B prior to beginning work on the contract.

The IT Service Provider performs vulnerability compliance scans of all services and network devices at least weekly.

· IIS and Web Server STIG

· Application STIG

· Microsoft SQL Server STIG

· Redhat Server STIG Continuously maintained IAW individual STIG frequency.

· Hardware/Software Lists

· System Design Documentation

· System Architecture

· System Security Categorization

· Privacy Impact Assessment

· System Security Plan

· Compelling body of evidence (e.g., screenshots, logs, scan results) that empirically demonstrate cybersecurity compliance As needed for periodic cybersecurity compliance inspection and re-accreditation

ATO documentation shall be submitted at least 100 days prior to ATO termination date

Cybersecurity of Security Devices: Security end-point devices, including but not limited to PACS panels, video surveillance cameras, and similar IP enabled devices, pose unique cybersecurity risks as these devices are not typically monitored or managed for cybersecurity vulnerabilities as normal servers and workstations are. The Contractor is responsible for being aware of cybersecurity vulnerabilities through either direct vendor communications, monitoring of the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) National Vulnerability Database, and open source disclosure channels for all IP enabled security devices under this contract. Within 2 business days of any reported disclosure via the above channels the Contractor shall provide a report that describes the vulnerability, the impact and risk, and the Contractor’s remediation plan to the Government.

1.4.4.3 Technical Solutions Identification: At the request of the Government, the Contractor shall provide written technical solutions identification on up to 24 separate topics per contractual year. Technical solutions identification shall be aimed at improving system performance, reducing vulnerabilities, closing gaps associated with current security measures, or identifying new or replacement materiel solutions. These technical solution identification submissions are typically in a 5-15 page white paper format that describes the issue/requirement and the proposed solution also provides a rough cost estimate for solution.

The Contractor may submit unsolicited technical solutions identifications based on their identification of emerging trends in the security industry or capability and performance gaps. If the Government accepts the Contractor’s suggestions, the Contractor-initiated technical solutions identification shall count towards the 24 separate solutions required per year.

1.4.4.4 Lab Support: The Contractor shall provide and maintain an ISSC laboratory environment located in the NCR. This laboratory environment shall be used for multiple purposes, including, but not limited to, evaluation of new solutions; design, stress, and integration testing; testing of system patches and upgrades; diagnostic testing of issues experienced in the production environment, and OGC software for pre-installation testing. The Contractor’s laboratory shall mimic the Government’s production environment to the maximum extent feasible to provide empirical evidence of the performance of the system and reduce risk of changes performed in the production environment. The Contractor shall maintain all laboratory facilities and systems with appropriate physical and logical controls to protect systems from unauthorized access. The Contractor shall also accommodate training on ISSC Systems as specified in individual delivery orders.

1.4.5 Logistics:

Configuration Management: The Contractor shall deliver a Configuration Management Plan as a contract deliverable (see Section 3.2.5) in accordance with the following timelines:

a. Draft Plan is due as part of the Contractor’s proposal

b. Baseline Plan is due within 45 calendar days of contract award

c. Final Plan is due within 90 calendar days of contract award

d. Revised Plan is due within 30 days of any option year award

The Contractor shall implement, document, and continuously provide configuration management services of all ISSC Systems commensurate with the standards of American National Standards Institute/ Electronic Industries Alliance (ANSI/EIA)-649-1998 National Consensus Standard for Configuration Management. The Contractor’s Configuration Management Plan shall address standard system programming and configuration values (to include functional logic and timing) for the full range of systems and devices being installed. These configurations shall be confirmed through operational testing to meet the performance specifications identified in Section 5.1.1. The Contractor shall propose a standardized list of naming conventions and device labeling. The Contractor shall develop, update, and maintain initial software and hardware baseline. ESS drawings with point-to-point design currently exist and will be provided at time of award; however, the Contractor shall be responsible for validation of received designs/drawings. Additionally, any remediation of discrepancies is a responsibility of the Contractor. ESS drawings of all ISSC systems shall be maintained and updated by the ISSC Contractor and provided to the Government upon request.

The Plan shall address a change and configuration control system and periodic audits by both Government and Contractor personnel, to include verification and validation of subcontractor work.

The Contractor shall transfer data and information to the Government electronically to the maximum extent possible to facilitate more rapid communications between Government and Contractor organizations.

1.4.5.1 Maintenance Management System (MMS): The Contractor shall provide a commercial off-the-shelf (COTS) MMS. The MMS shall consist of a web based front end and a structured query language database.

The MMS shall capture the following data for all systems and their sub-components under ISSC. The Contractor shall be responsible for assuring the below data is captured and updated within three business days following any procurement, testing, installation, preventative maintenance, configuration change, or repair activity. The Contractor shall adhere to government requirements, guidance, and industry best practices to ensure secure connectivity and storage of the sensitive data contained in the MMS.

· Device type

· ISSC details:

· ISSC barcode number

· Project procured under

· Projects under which the device was moved, adjusted, or removed.

· Manufacturer details:

· Manufacturer

· Device model

· Value of component

· Manufacturer serial number

· Date of manufacture

· Useful life

· Predicted end of service date

· Device location:

· Building or storage site

· Floor

· Suite or room number

· Geospatial coordinates

· Pertinent configuration details, including but not limited to:

· Media Access Control (MAC) and Internet Protocol (IP) addresses

· Software or firmware version

· Device logical naming

· Alarm priority

· Parent and child device physical and logical connections

· Device specific configuration parameters, such as home position

· Licensing, warranty, service, and support agreement information, including terms and expiration and renewal dates

· A complete cradle to grave chronological history of:

· Device procurement, warehousing, pre-installation testing, installation, and placement in service

· Preventative maintenance schedule and activities, history of preventive maintenances (PMs), and date of next scheduled PM

· Break-fix repair history and corrective measures

· System patch / hot-fix history

· Time down and time returned to service per incident

· Configuration changes

· Removal, relocation, decommissioning, and final disposal

The MMS web based front end shall allow for the following capabilities for the Contractor and authorized Government personnel to:

· Submitting repair tickets and getting ticket status

· Tracking repair ticket lifecycle

· Searching for a device by salient characteristic above

· Printing standard reports for system metrics

· Natural language, free form database querying

· Export all or portions of the database in a file format compatible with Defense Property Accountability System to enable effective audit readiness

The Contractor shall provide training on the Contractor’s MMS solution to Government personnel.

1.4.5.2 Replacement and Spare Parts Equipment: The Contractor shall maintain a sufficient bench stock of spare parts and replacement components for equipment on the program to ensure quick reaction to emergencies and to ensure timely repairs are made to all the equipment on the program, as well as being able to fulfill service requests within contractual requirements.

The Contractor shall provide a warehouse for the storage of all Contractor and Government spare parts. The Contractor shall arrange for the transfer of Government equipment from the outgoing Contractor’s facility. A list of the current inventory needing transfer is provided in Appendix D, however this list is a snapshot in time, and the Contractor should anticipate changes to current inventory needing transfer. The Contractor shall arrange for the input of all received equipment into MMS. The contractor shall propose a yearly recommendation on un-used warehouse inventory and make recommendations for disposal or turn-in of government furnished equipment that is obsolete. The contractor shall arrange for transfer and inventory of GFE from installation sites and government owned property (i.e. Warehouse) as requested by government.

The parts and supply inventory/bench stock shall be predominantly maintained in the Contractor's warehouse and procured by the Contractor as inventory gets below a level that allows the Contractor to meet repair time objectives specified in the PWS in Section 1.4.6.1. The determination of frequency of failure is based on the individual component, but shall be replaced if failing at least three times in a one-month period. This equipment and the maintenance plan shall be kept in the MMS. A list of these parts and equipment will be provided to the COR team on a monthly basis as outlined in Section 1.9.10.

1.4.6 Repair: Should an application, system, subsystem, or end-point supported under this contract become inoperable or degraded, the Contractor is required to respond per the requirements detailed in this section. These repairs shall include repair and replacement batteries, card readers, cameras, turnstiles, and other end-point devices, as well as troubleshooting and resolution of software issues. The Contractor shall provide all required equipment to perform repairs, including but not limited to service lifts, specialized tools, and any other equipment needed to maintain and service all electronic security systems under ISSC. The Contractor may be required to coordinate with OGAs, OGCs, subcontractors, or internal resources to troubleshoot and resolve the issue(s).

Upon discovery of a system outage or degradation, the Contractor shall immediately, but not longer than one hour, notify the Government COR team, the Government system owner, and PFPA Operations Centers of system impact via e-mail and or phone, along with measures being taken to remedy.

After action reporting for system outages are required within 24 hours of identifying or troubleshooting the root cause of system issues and shall provide all-inclusive details of the event, to include, but not limited time, date, actions taken, root cause, next steps, and lessons learned, as well as other pertinent information.

Quality Control and Repair teams shall ensure system and environment data is accurate and updated. Deficiencies found during preventative maintenance shall be repaired.

1.4.6.1 Response to Service Calls: The Contractor shall meet the following response and repair time objectives.

Tier 1 severity service calls reflect ongoing disruption to PFPA’s core law enforcement, security, and force protection mission.

TIER 1 SEVERITY SERVICE DEGRADATION CRITERIA

TIER 1 SEVERITY SERVICE DEGRADATIONS RESPONSE TIMES

10 minutes (Outside Normal Duty Hours)

Every two hours thereafter until resolved

180 minutes (Outside Normal Duty Hours)

Final report within five business days

TIER 2 SEVERITY SERVICE DEGRADATION CRITERIA

TIER 2 SEVERITY SERVICE DEGRADATIONS RESPONSE TIMES

60 minutes (Outside Normal Duty Hours)

Every two hours thereafter until resolved

8 hours (Outside Normal Duty Hours)

Final report within five business days if service degradation impacts high level personnel or increases in scope

Occasionally ISSC system service degradations are caused by a higher-level service disruption. These higher-level disruptions include interruption of electrical service by building management or IT/network disruptions. The Contractor is responsible for identifying when a higher-level service degradation is potentially causing the ISSC system disruption and opening a ticket with the responsible organization. The Contractor shall update any service interruption notification that the issue has been referred to others for resolution. The Contractor shall capture the ticket number and lifecycle within their MMS.

The Contractor’s Repair/Recovery Time SLAs are placed on hold while the higher-level service disruption is resolved. Once the higher-level service disruption is resolved, the Contractor’s Repair/Recovery SLA resumes. The Contractor’s MMS shall track the complete ticket lifecycle including time “off the clock” waiting for resolution from another organization.

A service call is a verbal or written request by telephone or e-mail from the COR, PFPA Operations Center personnel, or other authorized representative reporting a malfunction or maintenance problem. The information shall be entered by the Contractor into the MMS and tracked until completion. The Contractor shall commit the appropriate resources necessary to accomplish the repair, to include, but not limited to, system administrator for system issues as well as electronics technician for equipment repairs.

1.4.6.2 Completion of Service Calls: A service call shall be completed per the Table 1 in Section 1.4.6.1 from the time the service call is issued to the Contractor. If a service call cannot be resolved within the specified time period, the Contractor must notify the COR or one of his designated representatives. The Contractor shall submit a written notification that gives:

(1) an explanation of the delay

(2) the estimated time for completion of the service call

(3) evidence showing an effort to comply with the time requirement

(4) corrective measures to avoid repeated failures to meet response and repair time objectives

If immediate repairs cannot be made, the Contractor will coordinate with the tenant occupant/security manager to take all necessary actions or measures to protect the safety of the public and/or Government property.

1.4.6.3 ISSC Service Desk: The Contractor shall provide an on-site ISSC Service Desk services as the focal point for system monitoring, preemptive identification of system failures and degradations, technical support and inquiries, repair coordination and dispatch of technicians, making system configuration changes, system administration, and receiving customer service requests. The ISSC Service Desk shall be primary location for System Support activities described in Section 1.4.4 and the entry point for Repair activities under Section 1.4.6.

Operating Hours: The ISSC Service Desk shall be manned on-site 24 hours per day, 365 days per year, including Government holidays and during Government closures due to inclement weather and other incidents.

a. The Contractor shall maintain and monitor an e-mail account, MMS, and a telephonic answering service for receiving technical inquiries and service requests. The Contractor shall maintain a log of all inquiries and their content. The log will be incorporated into a Repairs Report and delivered to the COR on a monthly basis.

b. The Contractor shall enter and track all service requests in to the MMS. The Contractor shall record at minimum the date and time of the request, their organization, location, and system or component issue. The Contractor shall track the resolution of the issue in the MMS.

c. The Contractor shall proactively monitor ISSC systems and their components through electronic means. The Contractor shall preemptively take action to repair or restore system degradations and failures. The Contractor shall notify the servicing IT infrastructure provider of network outages affecting ISSC systems.

d. The Contractor shall implement Government approved configuration changes in the ISSC systems. All changes shall be documented in the MMS.

e. The Contractor shall provide notification of system changes, degradations, and outages to System Owners, Operations Centers, and PFPA Leadership.

f. The Contractor shall receive access change requests from the tenant Security Managers and implement those changes in the identity, credential, and access management system of record within two business days of receipt. The Contractor shall process tenant requests for personal identification numbers (PINs) for suite access within two business days of receipt. The Contractor shall respond to access inquiries from tenants and Security Managers on access to spaces within two business days of receipt. All access change requests and requests for PINs shall be tracked and reported monthly to the Government.

g. The Contractor’s Access Control Center (ACC) staff shall abide by approved ACC Standard Operating Procedure (SOP), to include all future updates. ACC SOP is listed as Appendix C.

1.4.6.4 Warranty: The Contractor shall provide all post installation services, vendor service, maintenance, and licensing agreements, and equipment/tools necessary to maintain the installed system equipment and software in an operational state. The warranty period shall begin upon formal, written acceptance of the system by the Government. The warranty period shall last for one year, or for the length of the Original Equipment Manufacturers (OEM) warranty, whichever is greater. At the conclusion of all warranty periods, the Contractor shall seamlessly transfer systems and components installed under the ISSC task orders into the existing preventative maintenance cycle and assume repair and sustainment responsibility.

1.4.7 Preventative Maintenance:

1.4.7.1 Preventative Maintenance Plan: The Contractor shall deliver and maintain a comprehensive, risk-based Preventative Maintenance Plan. The Plan shall document at a minimum, the frequency and type of preventative maintenance activity to system/component levels. The minimum maintenance frequency shall be in line with OEM recommendations. The Contractor’s plan shall identify systems and devices requiring maintenance above the OEM recommended minimum, due to the austere placement of devices, their criticality, high amount of use, and impact to security posture/coverage if the device/system capability is degraded/off-line. The Plan shall propose phasing/scheduling of preventative maintenance that minimizes impact to tenant space. The Plan shall also include verification of updates and device data in the MMS. The Preventative Maintenance Plan is subject to approval by the government and shall be submitted as a deliverable in accordance with the timelines set forth below:

a. Draft Plan is due as part of the Contractor’s proposal

b. Baseline Plan is due within 30 calendar days of contract award

c. Final Plan is due within three months of contract award

d. Revised Plan is due within 30 days of any option year award

Preventative maintenance shall also be performed on new systems installed during the life of this contract unless noted otherwise in the individual task orders.

1.4.7.2 Hardware Maintenance: The Contractor shall provide all parts, services required, and equipment necessary to maintain the ISSC equipment to manufactures specifications at an operational site as requested by the Government. Preventative maintenance shall be performed on all systems listed in Section 5.5 of this Performance Work Statement down to the lowest serviceable level identified by the vendor. The Contractor shall maintain a spare parts inventory and active logistics program to support the fielded equipment for the term of the contract.

1.4.7.3 Software Maintenance: The Contractor shall maintain software agreements with OEM vendors to receive software updates/patches for systems maintained under ISSC. Software shall not include the operating system or relational database management system, unless specified in an individual task order. Within 30 calendar days of OEM update release, the Contractor shall provide the following deliverables:

a. Patch/Update overview, identifying features, capabilities, and bug-fixes. The Contractor shall specifically identify new features that are responsive to Government identified needs or capability gaps.

b. Milestone schedule that identifies laboratory and production environment implementation.

c. Patch/Update dependencies needing coordination with operational and technical system stakeholders.

d. Documented testing of update in laboratory environment.

e. Integrator recommendation on whether to deploy patch/update.

All licensing issues shall be routed to the Government CORs.

1.4.8 Installation: The Contractor shall be responsible for the complete requirement analysis, system engineering, detailed design development, programming, configuration, integration, shipment, installation, and testing of systems as outlined in individual Delivery Orders (DO) in future task orders.

· The Contractor shall provide a qualified team of installation professionals with the necessary experience to install equipment properly while having minimal effect on the day-to-day operations responsibilities outlined in preventative maintenance, repair, system support, and logistics sections of this PWS.

· All engineers and technicians working on ISSC systems shall have certification and training from OEM in their area of expertise. The Contractor shall provide best practices and adherence to applicable DoD regulation, industry standards, and local regulation on all installation efforts. Deviation from applicable regulation should be noted in DO proposals.

· Infrastructure installation should adhere to cabling standards ANSI-TIA-EIA 569-A, Unified Facilities Criteria (UFC) 3-580-01, and the Department of Army ITA Telecommunications Distribution Design Method SOP00385.

· The contractor shall propose solutions in compliance with the Pentagon Exterior Standards Manual (PESM). Deviation from PESM shall be approved in writing by Government.

· Installation DO’s shall be designed and implemented in accordance with all applicable DoD regulations to include, but not limited to, the Office of the Director of National Intelligence, Intelligence Community Directives (ICD) 503, 705.1, DOD 5100.76M - Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives (AA&E), and ICD 705.2, Protecting Sensitive Compartmented Information within Information Systems; DoD Regulation, 5200.28, Security Requirements for Automated Information Systems; DoD Regulation, 5200.40, Information Technology Security Certification and Accreditation Process; DoD Manual 5220.22M, National Industrial Security Program Operating Manual (NISPOM); DoD Manual 5200.1R, Information Security Program; and Office Secretary of Defense Supplement to DoD 5200.1R.

· Contractor shall provide a performance verification testing plan for each DO that addresses the performance characteristics identified in section 5.5. This plan shall include a burn-in period of no less than 30 calendar days to demonstrate system performance through operational testing and include a testing checklist for Contractor completion and government validation. Procedures shall explain in detail, step-by-step actions and expected results, demonstrating compliance with the requirements specified.

1.4.8.1 Delivery Order Management:

· The Contractor shall manage all issued DO as outlined in contract requirements. The Installation Manager shall serve as the focal point for all Delivery Order and Period of Performance (POP) Management.

· The Contractor shall maintain comprehensive tracking tools to manage DO schedules and to identify Government or Contractor delays to the critical path in advance, along with recommendations/options to mitigate delay in overall project schedule.