Attachment 1 - SOW.docx

Statement of Work (SOW) Cheyenne VA Medical Center

Security Infrastructure System (SIS) Installation Security Cameras with Advanced Analytics

1.0 BACKGROUND

The Department of Veterans Affairs Office of the Senior Security Office/Physical Security and Infrastructure Office, along with the Cheyenne Veteran’s Affairs Medical Center (VAMC) Directors Office and VA Police Department requires a modernized security camera system with analytics to comply with the VA Handbook 0730, Security and Law Enforcement, and the Physical Security and Resiliency Design Manual (PSRDM), in addition to:

· Presidential Executive Order 14111, dated November 27, 2023, to enhance the quality and effectiveness of security in and protection of Federal facilities while modernizing those programs and technology with current industry standards.

In addition to security measures, the VA has been charged by the U.S. Office of Management and Budget and the White House with the following:

· Presidential Executive Order 14028 “Improving the Nation’s Cybersecurity” issued May 12, 2021, with advancing agencies towards Zero Trust architecture and accelerating movement to secure cloud services.

· Presidential Executive Order 12997/13286 established the Interagency Security Committee to enhance the security and protection of federal facilities in the United States.

· Presidential Executive Order 13800 titled "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure," issued May 11, 2017, aims to improve the nation's cyber posture and capabilities by focusing on modernizing federal IT infrastructure and securing critical infrastructure.

· Guidance issued on February 26, 2025, to implement technological solutions that automate routine tasks while enabling staff to focus on higher-value activities and introduce plans to reduce costs and promote efficiencies through improved technology, including through the adoption of new software systems and the elimination of duplicative systems.

Due to these orders, the Cheyenne VAMC requires a modernized security system that will enhance security, provide an easy-to-use system, minimize on-premises infrastructure, and increase the VAMC’s cybersecurity posture while meeting National Defense Authorization and Trade Agreement Act (TAA) manufacturing rules according to the 2023 FAR clauses while complying with Federal Information Security Management Act (FISMA). The solution will need to be outfitted for the Cheyenne VAMC located at 2360 E Pershing Boulevard, Cheyenne, Wyoming 82001.

2.0 SCOPE

This contract will provide all equipment, services, and solutions as a service and defined in the contractor’s response to the contract as needed. The contractor shall provide, as per the contract, all materials needed to properly install and configure the physical security system to provide intrusion detection in vulnerable areas of the hospital, which will be delivered to the addresses specified in the contract, which is the Cheyenne VAMC, Installation shall be completed by the vendor as per the contract and the contract documents. The contracted company will have the Software as a Service (SaaS) solution either Federal Risk and Authorization Management Program (FedRAMP) Approved or FedRAMP Ready on the FedRAMP Marketplace (FedRAMP Marketplace) and be willing to do the VA OIT’s FedRAMP Validation and ATO process as part of the contract.

3.0 CONTRACTOR REQUIREMENTS

The Contractor will execute the installation and programming of the proposed Modernized Security System at the Cheyenne VAMC. The contracted company will have the SaaS solution either FedRAMP Approved or FedRAMP Ready on the FedRAMP Marketplace and be willing to do the VA OIT’s FedRAMP Validation and ATO process as part of the contract.

4.0 PERIOD OF PERFORMANCE

Period of performance: The Installation process will be from the date of award of FedRAMP ATO Approval and VA ATO Approval base 12 months plus four (4) optional 12 months of the SaaS product support and years total for the Licenses for Government use. The FedRAMP ATO Approval and VA ATO Approval are Federal Information Security Modernization Act (FISMA) Law and would be a conditional factor for the contract as per the SaaS language in the contract as part of the deliverables.

Work shall be performed during the hours of 8:00 a.m. through 4:30 p.m. from Monday through Friday. Excluding weekends and all federally observed holidays. No overtime is authorized.

FEDERAL HOLIDAYS

Independence Day

5.0 TASKS

5.1 System Requirements

The solution must have the ability to enhance security and have motion intrusion detection and alerting capabilities to 24-hour Police dispatch center in a cloud-managed platform. In addition, it must provide an easy-to-use system, meet open network video interface forum standards with current onsite cameras, minimize on-premises infrastructure, and increase the VA’s cybersecurity posture while meeting the National Defense Authorization and TAA manufacturing rules according to the 2023 FAR clauses while complying with the Federal Information Security Management Act (FISMA).

· SaaS compliance with:

· FISMA Law FedRAMP Ready or Approved

· NDAA and TAA

· SOC 2 Type II

· UL / CUL 62368-1 certification for video, information, and communication technology equipment

The solution must provide a fully architecture integration, meeting all open network video interface forum standards, easy-to-scale hardware and an easy-to-use video management SaaS solution provided by the same manufacturer viable on many devices while managing bandwidth efficiently at scale. The solution must utilize a SaaS solution that allows for advanced analytics, including the ability to quickly locate people or vehicles of interest across a site, thus quickly reducing incident response time and minimizing the time security personnel devote to the technological side of investigations.

All data must be able to be stored encrypted locally on each physical camera device on a solid-state drive to prevent any data breach, along with the ability to stream and archive data continuously and indefinitely to the cloud to prevent any loss of data. This solution must have the hardware and software offered as a single solution. A graphical interface must be provided by the same manufacturer and have role-based access control (RBAC) that is configurable by government personnel. Audit trails must be built into the software solution and provided natively, as well as notifications, alerts, and the ability to operate the products without adding or needing any servers.

The Contractor must provide the following capabilities and features in a Hybrid-cloud security platform with all products managed through a single pane of glass and:

1. The Contractor must provide a solution that is either FedRAMP Authorized or FedRAMP Ready and must go through the VA's validation process to receive a VA ATO.

2. The contractor must provide a SaaS solution operating in FedRAMP Government Cloud (AWS GovCloud, Microsoft Azure, or equivalent)

3. Provides 24/7 US-Based 1-800 technical support team that can be reached by phone, email, or in-platform chat included at no additional cost.

4. SaaS browser-based solution with Single Sign On with PIV/CAC Multifactor Authentication that includes.

a. FedRAMP Control process approved.

b. Identity Provider Integrations via SAML & SCIM (ADFS, Azure AD, Okta)

c. Capability for a browser-based client that can be accessed across multiple platforms (to include Windows, Chrome OS, MacOS, iOS, and Android) without using proprietary plugins like Java, Silverlight, or Flash.

d. Audit logs.

e. Role-based access control natively in the SaaS.

f. Auto software updates, updates, and continuous penetration testing at no cost.

g. System to have mobile client or mobile device accessibility to securely access and view footage both on and off site at any time and to conduct person/vehicle analytics via the mobile device as well.

h. Emergency Access, audited for usage, sharable content to authorized law enforcement that can view selected cameras.

i. Ability to remotely manage users and cameras across multiple sites.

j. Certain custodians may view cameras at multiple locations.

5. Data encryption in transit and at rest- FIPS 140-2 encryption standard

a. In Transit AES-128

b. At Rest AES-256

6. Archive video footage with unlimited cloud storage stored indefinitely.

7. Software licensing for 5-year option

8. Does not require an NVR or DVR

9. The solution should be modular to allow additional devices at any time.

Camera Specifications

· Have built in solid-state hard drive capable of recording for immediate use of 30 days of continuous recording but has the ability for future use of up to 365 days of continuous video.

· Are FIPS 140-2 validated and TAA complaint.

· Are plug-and-play IP, PoE-based cameras.

· Receive firmware and software updates pushed automatically via the cloud at no additional cost as part of the camera or product licenses.

· Have a minimum of resting bandwidths 20-50kbs and low bandwidth mode options.

· Bandwidth Management Tuning Capabilities.

· Must have a 10-year warranty on all fixed camera and gateway hardware.

· Include all of the following Artificial Intelligence (AI) and analytics capabilities at no additional cost:

· People/vehicle analytics

· Occupancy Trends

· Trajectory Tracking

· Line Crossing

· Loitering

· Live Face Blur

· Alarms People Detection

· License Plate Recognition (Bullet cameras only)

· Privacy Zones

· Tamper Alerts

· Motion and Crowd Alerts

· Status (online or offline)

· Included 30-day Cloud Backup, with additional able to be purchased.

· Must provide RTSP capabilities.

· Operate in Temperature ranges of -40 F- 122 F.

· Have unlimited archive storage capabilities in the SaaS solution.

· Ability to provide up to 5MP to 4k/10K image resolution (3840 x 2160).

· IP67 rating to protect against dust and environmental elements for outdoor cameras.

· Accelerometers for tamper-proof capability.

· IK8 vandal resistant rating or above.

· Built-in Infrared illumination.

· Capability to produce video at a minimum 24 FPS or more.

· Image stabilizing to reduce blurring.

· Day and Night viewing and recording capability.

· Standard RJ45 connectivity, including Power Over Ethernet (PoE).

· Motion detection either as a camera option or an option on the management interface.

· Capability to perform computer vision analytics at the edge (on device).

· Ability to see remote locations and run analytics with offsite viewing.

· Provide all the proper device mounting kits and proper installation.

5.2 SOW Requirements

The Contractor must provide in the Security capabilities the following:

· Indoor Dome Camera with min of 30 days video storage on camera, with an IR range of 98 ft, Sensor Resolution 5MP, that is FIPS Validated and TAA Compliant.

· License for cameras hosted on a government cloud (AWS GovCloud, etc.), to include 24/7 US-based support, 5 years.

· Outdoor Bullet Camera with a minimum of 30 days of video storage on camera, with an IR Range of 98 ft, Sensor Resolution 4K, that is FIPS validated and TAA Compliant.

· Associated mounting equipment for cameras as required.

· Cellular Gateway for Outdoor Camera that is LTE cellular CAT12 that will come with provided service with 2XGigE RJ45 outputs, 2XPoE RJ45 outputs, that is Validated Compliant with FCC, IC, CE and TAA

a. License for cellular gateway, five years.

b. License for unlimited data for video device, five years.

c. License for unlimited data for video device, one years.

5.3 Cheyenne VAMC Installation Instructions

Main Location: 2360 E. Pershing Blvd. Cheyenne, WY 82001

1. The customer installers will be fully accredited installers of the required cameras and system being installed.

2. Required Cheyenne staff and Veterans Affairs (VA) Police will have access to the Cameras and the SaaS products for proper CCTV Physical Security surveillance practices and FedRAMP ATO process, SOP, and controls.

3. Each camera will come with access to the SaaS back-end product for the VA Police and VA Staff to view said Physical Security surveillance needs and proper 5-year Camera Licenses for Government use.

4. The Contractor must provide on-site training with both VA Police Services and OI&T for new system requirements as well as continued training during additional product enhancements, which happen quarterly.

5. Ask about PIV and security background vetting

Clarifications:

1. All grounding and bonding required will be supplied by the customer.

2. All network needs will be provided by the Government.

3. Installed wiring will utilize limited j-hooks as required. J-hooks are intended and will be installed for secondary infrastructure pathways ONLY. All pathways to include ladder rack, wire basket, wire trough, and conduit and backboxes required will be supplied by the customer.

Note:

1. The UPS PAC is expected to be provided for the system.

2. The VA backbone network is available and will be used for the new CCTV Physical Security Surveillance System.

3. The VA will have to provide the ports and switches for network connectivity.

4. Network cables are available, and do they need to be installed?

5. The VA will have to provide all the approvals and network security to allow the CCTV Physical Security Surveillance System to communicate with the SaaS solution.

6. The VA will provide all the VLANS, IT Whitelist access for hardware to access the VA network securely and provide an SDL and an Implementation team to track and help the Vendor complete the installation tasks and Program/Project Management.

Warranty:

Provide the necessary labor and assistance for warranty claims against manufacturers due to equipment failure during the manufacturer’s stated warranty period.

Clarifications:

Installed wiring will utilize plenum-rated cable as required, and conduit should be included in the quoted price.

6.0 SECURITY

The Contractor is required to check in with the COR before proceeding to the installation location. The contractor will install equipment, but will not have access to VA systems.

The C&A requirements do not apply, and a Security Accreditation Package is not required.