Attachment 1 - PWS - MS Enterprise CCURE CCTV Repair and License.doc

Veterans Health Administration – Member Services (VHA-MS) Performance Work Statement (PWS) MS Enterprise CCure PACS Service Contract

1. GENERAL: The Veterans Health Administration (VHA) Member Services (MS) has a requirement for updating, licensing, and repairs for the CCure Physical Access Control System (PACS) and Closed-Circuit Television (CCTV) systems located at the following locations: Topeka, KS 66618; Fort Riley, KS 66442; Waco, Texas 76711; Atlanta, GA 30329. The requirement involves emergency and routine repairs and maintenance, updating the CCure program, software service agreement and licensing of the PACS and CCTV system for each site.

1.1 Description of Services: The Contractor shall provide all management, personnel, labor, supplies, tools, equipment, communication devices, transportation, and fuel necessary to service, repair, maintain, update, and provide licensing for the CCure PACS systems and CCTV systems. Labor hours will be paid as invoiced for each service as performed.

1.2 Background: Member Services has a need for a contract to maintain, repair, and update CCURE 9000 PACS and CCTV systems at four (4) separate geographic locations.

1.3 Objectives: Member Services has a need for a contractor that can perform emergency and routine repairs, provide software and licensing agreements, and updates to the existing CCure PACS system and CCTV systems located in the four locations listed above.

1.4 Scope: The Contractor will keep the CCure PACS and CCTV systems operating correctly by maintaining, repairing, and updating the system The Contractor will be responsible for keeping the software and licensing agreements current. The Contractor shall perform all services identified to the standards in this Performance Work Statement (PWS).

1.5 Period of Performance: Contract will be awarded for one (1) base year with four (4) one-year options to be awarded at the discretion of the Government and if funds are available for a continuance of services.

1.5.1 Place of Performance: The four (4) site locations for this contract are:

3401 SW 21st Street, Building 9, Topeka KS 66618

409 Pershing Avenue, Building 409, Ft. Riley, KS 66442

2957 Clairmont Road, Suite 200, Atlanta, GA 30329 4800 Memorial, Building 90, Waco, TX 76711

1.6. General Information

1.6.1 Federal Observed Holidays and Military Training Holidays: Do not schedule work on Federal holidays or days observed in lieu thereof. The Federal holidays listed below are observed. When a holiday falls on a Sunday, the following Monday will be observed as the holiday. When the holiday falls on a Saturday, the preceding Friday will be observed as the holiday. When a service is required fewer than three times per week and the time for that service falls on a holiday the work shall be accomplished on the day following or preceding the holiday.

Memorial Day Juneteenth Thanksgiving Day

Christmas

Independence Day

1.6.2 Hours of Operation: The Contractor shall schedule all normal work requirements to be performed during the normal work hours of each site. Since one site is Eastern Standard (EST) and the other three sites are Central Standard Time (CST), Monday through Friday, coordination with the site COR will need to take place. Any work outside the normal work schedule will require advanced coordination and approved between the Contractor and the Contracting Officers Representative (COR). These tasks must not interfere with employees working at any time.

1.6.3 Quality Control: Quality control is the Contractor’s responsibility. Contractor quality controls are how the Contractor assures the services are accomplished in accordance with (IAW) contract documents.

1.6.4 VA Quality Assurance: The VHA is responsible for quality assurance and will monitor the Contractor’s performance under this PWS. The COR is the VHA’s Quality Assurance Evaluator.

1.6.6 Security Requirements: The Contractor shall provide the appropriate information to have access to buildings. Contractor personnel and/or sub-contractor personnel will be issued a contractor badge for access into the building upon approval.

1.6.6.1 VA Network Security Requirements: All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations, and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components

(hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating

Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than 3 days.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 10 days.

l. All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g., for the convenience of VA) shall only be granted with approval of the contracting officer and the VA Assistant Secretary for Office of Information and Technology.

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISSO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident

(Including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior,

(2) Successfully complete the VA Privacy and Security Awareness and Rules of Behavior training and annually complete required security training.

(4) Successfully complete any additional cyber security or privacy training, as required for

VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special

Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete

1.6.7 Key Control: All references to keys include key cards. If required, the Contractor shall establish and maintain a key control system to ensure that VHA keys and key cards issued to the Contractor are not lost, stolen, or used by unauthorized persons. The COR and Contractor will conduct an initial inventory on all keys and key cards prior to the start of contract performance. No keys issued to the Contractor by the VHA shall be duplicated. The Contractor shall immediately report any occurrences of lost or duplicate keys or key cards to the COR.

1.6.7.1 Unauthorized Use of Keys: The Contractor shall prohibit the use of VHA issued keys by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas.

1.6.7.2 Lost and Found Property: Turn in all articles of possible personal or monetary value found by the Contractor's employees while performing duties under this contract to the COR. Obtain receipts for articles turned into the COR.

1.6.8 Post-Award Conference and Periodic Progress Meetings: The Contractor agrees to attend any post-award conference and periodic progress meetings convened by the CO or COR IAW with FAR Subpart 42.5, Post-Award Orientation.

1.6.9 Contracting Officer’s Representative (COR): The COR is an authorized representative of a CO within the scope of his or her authority and is not authorized to change any terms and conditions of the resulting contract.

1.6.10 Contractor Employees: All Contractor employees shall wear personal identification cards, or badges, while working on the Installation, to avoid creating an impression that they are VHA officials.

1.6.10.1 Contractor Qualifications: Contractor and sub-contractors shall possess licenses as required by state and local jurisdictions; shall demonstrate relevant years of experience installing and/or performing maintenance with Software House iStar Ultra ACSS panels and CCure 9000, current version software (Tyco Security Products) for identified systems; shall possess certificates as identified below. Industrial Security Systems shall possess factory training and awarded factory certification at time of proposal for identified systems; shall demonstrate field capability to install and maintain identified systems, shall demonstrate capability to service CCTV cameras and shall provide training and certification records as part of the quote provided.

a. Contractor shall be certified in Software House iStar Ultra control panel. Contractor must be able to provide proof of certifications.

b. Contractor shall be certified in CCure 9000, current version, (TYCO Security Products). Contractor must be able to provide proof of certifications.

c. Contractor shall ensure each individual employee has a least 2 years’ experience as it relates to this project, which includes but is not limited to installing and/or performing maintenance and service with Software House iStar Ultra ACSS panels and CCure 9000, current version software (TYCO Security Products), installing and maintaining security systems, and servicing CCTV cameras.

1.6.11 Contractor Personnel Conduct: Contractor personnel’s conduct shall not reflect discredit upon the VHA. The Contractor shall ensure their personnel present a professional appearance. The Contractor’s employees shall observe and comply with all local policies and procedures concerning fire, safety, environmental protection, sanitation, security, and possession of firearms or other lethal or illegal weapons or substance.

1.6.12 Accessibility: Contractor shall contact the COR for access to the facility.

2. DEFINITIONS, ACRONYMS, AND ABBREVIATIONS

2.1 Definitions: As used throughout the contract or in material referenced in the contract, the following terms will have the meanings set forth below:

· Contracting Officer’s Representative (COR) - An employee of the VHA appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

· Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the VHA. The term used in this contract refers to the prime.

· Deficiency - A shortcoming in the quality or state of service performed.

· Equipment - A tangible item that is functionally complete for its intended purpose, durable, nonexpendable, and needed for the performance of a contract. Equipment is not intended for sale and does not ordinarily lose its identity or become a component part of another article when put into use. Equipment does not include material, real property, special test equipment or special tooling.

· Fiscal Year (FY) - The period of 1 October to 30 September each year.

· VHA-Furnished Property (GFP) - Property owned and furnished by the VHA for Contractor or resident use without charge or on a reimbursable basis as indicated in the contract.

· VHA-Furnished Service (GFS) - Service furnished by the VHA for Contractor or resident use without charge or on a reimbursable basis as indicated in the contract.

· VHA Property - All property owned or leased by the VHA. VHA property includes both VHA-furnished property and contractor-acquired property. VHA property includes material, equipment, special tooling, special test equipment, and real property. VHA property does not include intellectual property and software.

· Key Personnel - Contractor employees that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal. The prime contractor is responsible for performance of all subcontractors.

· Loss of VHA Property - Unintended, unforeseen or accidental loss, damage, or destruction of VHA property that reduces the VHA’s expected economic benefits of the property. Loss of VHA property does not include occurrences such as purposeful destructive testing, obsolescence, normal wear and tear, or manufacturing defects. Loss of VHA property includes but is not limited to:(1) Items that cannot be found after a reasonable search; (2) Theft: (3) Damage resulting in unexpected harm to property requiring repair to restore the item to usable condition; or (4) Destruction resulting from incidents that render the item useless for its intended purpose or beyond economical repair.

· Material - Property that may be consumed or expended during the performance of a contract, component parts of a higher assembly, or items that lose their individual identity through incorporation into an end-item. Material does not include equipment, special tooling, and special test equipment or real property.

· Performance Requirements Summary - Identifies the key service outputs of the contract that will be evaluated by the VHA to assure contract performance standards are met by the Contractor.

· Physical Security - Actions that prevent the loss or damage of VHA property.

· Point of Contact – (POC) – Site Representative

· Property - All tangible property, both real and personal.

· Quality Assurance (QA) - The VHA procedures to verify that services being performed by the Contractor are performed according to acceptable standards and meets the requirements of the contract.

· Quality Assurance Surveillance Plan (QASP) - An organized document written by the VHA specifying the surveillance methodology used for surveillance of contractor performance.

· Quality Control (QC) - All necessary measures taken by the Contractor to ensure the quality of an end product or service shall meet contract requirements.

· Subcontractor - One that enters into a contract with a prime contractor. The VHA does not have privity of contract with the subcontractor

· Submittal - Anything that can be physically submitted or delivered, but may include non-manufactured things such as meeting minutes or reports

· Trash Removal - Includes the pickup and removal of all papers and other debris in buildings. This includes but is not limited to wastebaskets, boxes, or any substance used for refuse.

· Workday - The number of hours per day the Contractor provides services IAW the contract.

· Work Week - Monday through Friday, unless specified otherwise.

3. VHA-FURNISHED PROPERTY AND SERVICES

3.1 Fire Prevention and Protection: The VHA will provide fire prevention and protection service at the facility for the Contractor.

3.2 Utilities: The VHA will furnish, without charge to the Contractor, natural gas, electricity, water, and sewage to support Contractor operations while performing the services specified herein. The Contractor is responsible for operating under conditions that preclude the waste of utilities and shall instruct employees in utilities conservation practices.

4. CONTRACTOR-FURNISHED ITEMS AND RESPONSIBILITIES Contractor shall furnish all parts, tools, equipment, communications devices, transportation, personnel, estimates, licenses, and registrations required to perform the services of this requirement.

5. SPECIFIC TASKS

5.1 Updating PACS/CCTV Software: The contractor shall maintain a current software agreement for the period of performance of the contract.

5.2 PACS/CCTV License Agreement: The contractor shall maintain current license agreements for the period of performance of the contract.

5.3 PACS/CCTV Service/Repair: Contractor shall supply all needed parts and labor to maintain, service, and repair the CCure and CCTV systems.

a. Emergency Repair: Repair is defined as an incident that prevents the system or device from functioning as it was designed and constitutes a security issue for employees’ safety. For example: a door that will not lock or unlock, or a camera that is offline that surveils an entrance door. The Contractor shall have a service technician on site within four (4) hours of an emergency repair call.

Once on site, the Contractor shall report to the site Contracting Officer Representative (COR). Contractor shall furnish a firm fixed priced quote that will contain CLINS for the labor, number of hours, and hourly cost and detailed material costs. Contractor will not proceed with any emergency repair and/or any labor outside the scope of this contract without the authority of the Contracting Officer.

b. Standard Service and Repairs: All other incidents that do not constitute a security issue for personnel working in the facility. Contractor shall have a technician onsite for standard repair calls within 24 hours.

5.4 PACS/CCTV Semi-annual Maintenance Inspection: Contractor shall make onsite semi-annual inspections to ensure card readers, hardware, cameras and systems are working correctly and all system updates are current. Remote access to system is not allowed.

6. Workmanship: The performance of work shall conform to the standards specified. While performing services in the building during normal duty hours, work areas left unattended shall be protected with the necessary warning signage to protect occupants from possible safety hazards such as slipping and falling. While performing services in the building after normal duty hours, maintain the physical security of the building. If the CO or the COR determine the work does not meet standards specified for a particular task, the Contractor shall redo the task at no expense to the VHA within 24 hours of notification. Any VHA property damaged by the Contractor during work performance shall be repaired or replaced immediately by the Contractor at no expense to the VHA.

6.1 APPLICABLE PUBLICATIONS: Publications applicable to the performance of work are listed below. Publications are referred to basic designation only. Assume publications to be the most current edition in effect at the time the contract is awarded. Publications referred to in the text shall be considered mandatory for the Contractor's performance of work. Comply with all mandatory publications and publications referenced therein or supplemented by the publications. All other publications shall be considered advisory in nature.

6.2 U.S. Department of Labor Occupational Safety and Health Administration (OSHA) Regulation: Available without cost at http://www.osha.gov/pls/oshaweb/owastand.display_standard_group?p_toc_level=1&p_part_number=1910 29 CFR 1910: Operational Safety and Health Standards.

TC-1