Attachment 1 - Statement of Work (SOW).pdf

STATEMENT OF WORK (SOW)

Contents

1. INTRODUCTION

2. PURPOSE AND BACKGROUND

3. SCOPE

4. PERIOD OF PERFORMANCE

5. WORK SCHEDULE AND LOCATION

6. PERFORMANCE REQUIREMENTS

7. DELIVERABLES

8. PERFORMANCE REQUIREMENTS SUMMARY MATRIX

9. CONTRACT MANAGEMENT .................................................... 7Error! Bookmark not defined.

10. COMPLIANCE DOCUMENTS ................................................. 11Error! Bookmark not defined.

11. OTHER TERMS, CONDITIONS, AND PROVISIONS .......... 10Error! Bookmark not defined.

12. ATTACHMENTS ........................................................................ 11Error! Bookmark not defined.

STATEMENT OF WORK STATEMENT (SOW)

Title: Facility Re-Key and Access Control Equipment and Program

Requiring Activity Name: Walter Reed Army Institute of Research (WRAIR)

1. INTRODUCTION

The WRAIR aims to conduct biomedical research that is responsive to Department of Defense and US Army requirements and delivers life-saving products including knowledge, technology and medical material that sustain the combat effectiveness of the Warfighter.

With our headquarters dedicated to Senator Daniel E. Inouye and located in Silver Spring, Maryland, the Walter Reed Army Institute of Research is the largest biomedical research facility currently serving the Department of Defense. Established in 1893, our research and development now reaches around the world from Maryland to Germany, Thailand, and Kenya.

Our vision is to be the premier DoD biomedical research organization, constantly relevant, integrating basic research and advanced technology that protects, projects, and sustains the Warfighter today, invents global medical solutions for the future, and keeps the Warfighter on point for the Nation. We host three Centers of Excellence for Military Psychiatry and Neuroscience Research, Military Infectious Disease Research, and Enabling Capabilities Research;

each center ranging from blast induced neurotrauma to malaria vaccine development.

2. PURPOSE AND BACKGROUND

The Operations and Security Division of the WRAIR is responsible for protecting WRAIR personnel and confidential research efforts for the continued success of the Warfighter mission. The WRAIR Operations and Security team has recently identified that many of its room entry doors lack the physical security requirements specified in AR 190-13. The WRAIR facilities consist of buildings 500, 501, 503, 508, 509, and 511 at the WRAIR campus on Forest Glen Annex, Silver Springs, Maryland.

3. SCOPE

The contractor will deliver and install a WRAIR campus wide facility re-key capability. To include, core replacement, key control software, key cutting capability, hardware installation, and training. This Access Control System and Security Management System (SMS) workstation will be completely integrated throughout the WRAIR campus on Forest Glen Annex. The system is autonomous and separate from the current ICIDS Security System, monitored at the WRAIR Project Management Office (PMO) for simultaneous, 24 hour monitoring. Minimum Essential Characteristics are listed in Attachment 2.

4. PERIOD OF PERFORMANCE

The periods of performance for this contract are as follows:

Base period 20 April 2022 – 19 April 2023 Option period 1 20 April 2023 – 19 April 2024 Option period 2 20 April 2024 – 19 April 2025 Option Period 3 20 April 2025 – 19 April 2026 Option Period 4 20 April 2026 – 19 April 2027

5. WORK SCHEDULE AND LOCATION

5.1. Work Location

The work location is 503 Robert Grant Avenue, Silver Spring, MD 20910.

5.1.1. Telecommuting- Not applicable

5.1.2. Working During Emergency Situations- Not applicable

5.2. Federal Holidays

The contractor shall not perform services on days designated as a Federal Holiday by Federal Status, Executive Order, Presidential Proclamation or Installation Commander

Federal holidays are an exception to the regular duty hours. Any of the holidays listed below falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. The following is a list of legal federal holidays that services shall not be performed.

The following are Federal Holidays:

New Year’s Day Birthday of Martin Luther King, Jr.

Washington’s Birthday Memorial Day Juneteenth Independence Day

Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

5.3. Post Closure

All non-mission essential contract employees shall not report to work on days the Government or installation is closed due to local determinations relating to safety conditions, inclement weather conditions, national emergencies, energy conservation. During these periods of closure, the mission essential contractor personnel shall report for work.

5.4. Work Schedule

The contractor shall provide support from 0745 to 1630 Eastern Time.

6. PERFORMANCE REQUIREMENTS

6.1. Objectives

Contractor shall provide all labor, materials, equipment, tools, specialty services, and supervision necessary to perform the requirements of Upgrade Locks and Rekey Facilities. Generally the work required by this contract shall be performed in accordance with Specifications and this Statement of Work and meeting the minimum essential characteristics (MECs). (Attachment 2)

Contractor shall furnish and install one new key machine and associated equipment. Contractor shall provide and cut approximately 6,000 new keys. Contractor shall distribute new keys to selected staff based on department chief interviews and in coordination with the COR. Contractor shall replace approximately 3,000 locks cylinder cores throughout the WRAIR facility and outlying areas.

6.2. Specific Tasks / Requirements

6.2.1. Provision and Installation

The contractor shall install and test the new key control software and smart-key technology as well as lost key recovery and audit capability and programming each workstation for monitoring all remote zones throughout the annex. The contractor will provide a service and maintenance contract as well as system training and oversight of a minimum of five years and in the event that the system becomes antiquated or not serviceable in the future, the contractor will prorate the current installed equipment and provide a pro-rated buyback that will assist in offsetting the cost of new equipment upgrade throughout the facility and a new maintenance and service contract will be initiated at a pro-rated rate as well for a period of five years from new installation.

6.2.2. Equipment

The contractor shall provide and install the following equipment: 3,000 Restricted Cores with key, 3,000 restricted operating keys, 3,000 restricted master keys, 1,000 restricted key blanks, ten (10) grandmaster keys, and one (1) workstation that consist of key cutting machine, pinning kit for keying cores, web system support, and any other equipment, like computer tower and monitor, key docking stations, and speakers, key control program software license, one (1) Uninterruptable Power Supply (UPS), all associated hardware required to connect all zones to the main computer and integrate/connect the same zones to the WRAIR PMO server for monitoring and police response, and installation items (Deliverable 1). (Attachment 3)

6.2.3. Maintenance Services Responses

6.2.3.1. Standard Response- On order the contractor shall respond in two (2) days for issues related to repairing locks, replacing locks, rekeying locks, cutting keys, repairing door hardware, lockouts, broken keys, stuck keys, adjustments, alignments or lubrication. NOTE: This does not include any materials or hardware, labor only.

6.2.3.2. Emergency Response- On order the contractor shall respond on the same day or after normal business hours for issues related to repairing locks, replacing locks, rekeying locks, cutting keys, repairing door hardware, lockouts, broken keys, stuck keys, adjustments, alignments or lubrication.

6.3. Technical/ Requirements

6.3.1. General Requirements

6.3.1.1. Contractor will be responsible for conducting complete onsite site survey to ascertain specific quantities of cores required to conduct locking rekey of all doors.

6.3.1.2. Contractor will be responsible during onsite survey to ascertain any existing locking hardware which will not accept Medeco or equal and replace hardware, as necessary, to meet specifications below.

6.3.1.3. Patented Cores and Keys must be Medeco or equal (Brand Name or Equal) technology electronic inteli-key.

6.3.1.4. Patented Cores and Keys shall be patent protected by a Federal Utility Patent for a period of no less than 10 years with federal patent protection to eliminate unauthorized key reprogramming.

6.3.1.5. Patented Cores and Keys shall have exclusivity controlled by the administrator and system user at site, to ensure no keys or cores are programmed without oversight and user authorization for access and entry.

6.3.1.6. Key system hardware provided by contractor for this project MUST be of same manufacturer and MUST be same as previously installed core and key hardware design. This will ensure continuity for warranty support and maintenance inventory control, offering lowered total cost of ownership.

Medeco intelligent key will provide all power to the cylinder, eliminating the need for any hard wiring or power supply. System install must have the ability to use existing mechanical cylinder hardware and seamlessly have the ability to install the Medeco cylinder.

6.3.1.7. Exclusive patented Medeco (Brand Name or Equal) cores and keys shall be available in a multifunction lock and key system and assembly allowing for infinite access control combinations and system expansion without the problem of dual or duplicate key combinations, with the ability to control all inteli-keys via key docking station and patented software access and accountability programs. All patented inteli-keys must meet patent restrictions and meet all DoD requirements for access control and accountability in accordance with:

1) AR 190-13 Army Physical Security Program

2) AR 190-17 Biological Select Agents and Toxins Security Program

3) 190-51 Security of unclassified army property (sensitive and nonsensitive)

4) 190-54 Security Of Nuclear Reactors And Special Nuclear Materials

5) 10 CFR 37.49 Monitoring, detection, access and assessment of Nuclear materials

6) 380-67 Personnel Security Program

6.3.1.8. Cores and Keys must be keyed into primary software programming Grand Master System where key programming is maintained and controlled at the administrator and user level to ensure integrity of the master key system, and elimination of cross keying when working with multiple contractors.

6.3.1.9. Contractor shall provide key fobs, docking station, Medeco (Brand Name or Equal) key software program, hardware, training and maintenance as noted for a period of 1 base year from completion of project and 4 follow on years.

6.3.1.10. Contractor shall provide Key Control Database as detailed below.

6.3.2. Qualifications

6.3.2.1. Contractor shall have minimum of five years documented experience in the manufacture, installing, maintenance and servicing state facilities and shall be approved by the owner.

6.3.2.2. The installer shall be certified by the manufacturer.

6.3.2.3. Hardware and software installer shall provide factory supervision during installation.

6.3.3. Maintenance

Manufacturer/contractor must have warranty/service technician within daily commuting distance of Forest Glen Annex for immediate service and maintenance in case of system failure or malfunction.

6.3.4. Technical Support and Services

Vendor shall have factory-trained, qualified technical services available 24 hours a day, every day of the year to meet any emergency need.

6.3.4.1 Vendor must be able to answer a service request within an appropriate time window for standard and emergency services.

6.3.5. Warranty

6.3.5.1. Standard Warranty

1) Three year standard warranty on all materials unless otherwise noted within requirements specifications from completion of project for all hardware installation.

2) Five year standard warranty on all labor performed.

6.3.5.2. Two Copies of the warranties must be provided to the owner upon substantial completion with the dates of warranty coverage noted.

6.3.6. Patented Keying System

6.3.6.1. All cores and keys shall be Medeco (Brand Name or Equal), interchangeable core.

6.3.6.2. All cores and keys shall be keyed into factory registered Master Key software System.

6.3.6.3. All cores and keys shall have federally protected patent life to be no less than 11 years.

6.3.6.4. Cores and keys must have control at the manufacture level as well as the site administrator and system user level so that no distributor, locksmith, wholesaler has access to this system to any customer other than WRAIR.

6.3.6.5. Key programming scheme shall be provided by customer with manufactures representative for this Factory Registered Patented key control and access software system.

6.3.6.6. All orders for keys or cores must have email verification from registered key custodian before order is processed.

6.3.6.7. Each barrel of core must be independently capped and identified.

6.3.6.8. All patented cores shall be supplied with one (1) programmable operating key for operation for every (3) patented cores, serialized for each core starting with the number one (1).

6.3.6.9. One (1) Patented Grand Master key, Two (2) patented System Control keys, Four (4) cut patented Master-keys, and four (4) cut patented sub-master keys shall be provided for entire system and will be accounted for within the accountability and access control system.

6.3.7. Key Control Database Software

6.3.7.1. Key Control Database and Importation of Key Codes will be included.

6.3.7.2. Key Control Software shall be equal to Medeco (Brand Name or Equal) software.

6.3.7.3. There will be no importation of WRAIR key codes conducted by the manufacture to ensure accurate record keeping of all doors being rekeyed with patented factory registered master key system. End result will be a database fully populated with all work performed by the contractor which includes the ability to ascertain which key goes to what door.

6.3.7.4. Training will be provided for WRAIR personnel to ensure proper usage of the system and database.

6.3.7.5. Training shall include onsite training which will consist of one full work week of training to ensure system comprehension and competency.

6.3.7.6. Training shall include any system updates and will be provided by the manufacturer.

6.3.8. Hardware

Any locking opening which requires rekey to patented Medeco (Brand Name or Equal), with existing hardware which will not currently accept patented Inteli-key core must be identified during onsite survey and noted for replacement.

6.3.9. Key Box

6.3.9.1. An electronically controlled key fob designed to house, audit and manage keys and any required security assets.

6.3.9.2. Will be wall-mountable or desk top mountable.

6.3.9.3. Access to key-fob is assigned to one or more users based on configuration through system software and administrative responsibility. PIN access is standard and system also should provide various other access options as necessary.

6.3.9.4. Key storage should be through direct entrapment or other mean allowing for tamper proof access.

6.3.9.5. Key storage system should be expandable with the possibility or requirement of additional access points, docking stations or controllers (add-on cabinets/key lockers).

6.3.9.6. Access to key fob should be allowable through various options to include, proximity reader, card swipe access, master key, and/or biometric reader.

6.3.10. Installation

6.3.10.1. Comply with Manufacturer’s written installation and recommendations for installation of system components.

6.3.10.2. Install patented cores/ key as directed during normal business hours.

6.3.10.3. Contractor will provide a project manager to coordinate installation and training and serve as a single point of contact for notice to proceed, scheduling and notice of acceptance.

6.3.10.4. Check and adjust operation of lock units in place to ensure proper latching and locking.

6.3.10.5. Replace units if any are not fully functional as received.

6.4. Management Reports and Plans- Not Applicable

7. DELIVERABLES

The contractor shall complete and submit deliverables in accordance with the “Deliverables Table” below. Unless specified in the SOW within the description of the deliverable, all deliverables will be made to the COR electronically.

DELIVERABLES TABLE

SOW

Ref.

Number Title/Description Due

6.2.2. Deliverable 1

Equipment for installing key cores, creating keys, and providing a key management/cutting system

As per the project schedule

7.1. Technical Reports and Documents

Technical reports and documents delivered by the contractor in the performance of this contract shall be considered Technical Data and documents delivered by the contractor in the performance of this contract shall be considered Technical Data as defined in the applicable DFAR clause 252.227-7013, Rights in Technical Data-Noncommercial Items. All documentation shall reflect the latest version of the work product or activity, unless specifically directed otherwise by the Government. All documentation shall be prepared in accordance with (IAW) standard industry practices, ensuring electronically produced documents which reflect logical flow of material, tables of contents indexes and page numbering. Where applicable, the contractor’s attention is called to the availability of commercial, industry, federal, and military guides, instructions, and standards for many of the topics addressed in this SOW and under this contract.

7.2. Inspection and Acceptance

The COR delegated oversight of specific technical, functional and oversight responsiblities is responsible for inspection and acceptance of all services, incoming shipments, documents, and services.

Certification by the Government of satisfactory services provided is contingent upon the Contractor performing in accordance with the performance standards contained in the Performance Work Statement and all terms and conditions of this order, including all modifications.

7.3. COR Information

To be determined

8. PERFORMANCE REQUIREMENTS SUMMARY MATRIX

The Government intends to utilize a Quality Assurance Surveillance Plan (QASP) to monitor the quality of the Contractor’s performance in relation to performance objectives. The Government will finalize the QASP immediately following award, and the COR will provide a copy of the final QASP to the contractor. The QASP is a living document and may be updated by the Government as necessary.

The Government will use the following performance requirements to measure the performance of the contractor. The contractor shall meet the Performance Objective(s) and Acceptable Quality Level(s) within the “Performance Requirements Summary Matrix” (PRS Matrix).

Performance Requirements Summary Matrix

# PWSRef. Performance Objective Performance Measurement

Acceptable Quality Level

Method of Surveillance

Incentive

1 6.2.2.

Equipment and installation for installing key cores, creating keys, and providing a key management/cutting system

The contractor shall adhere to the schedule.

Meets: >99.9

Direct observation by the COR

Frequency: Daily during installation

Meets: Favorable contractor performance evaluation.

9. COMPLIANCE DOCUMENTS

9.1. General Compliance

9.1.1. Federal Law

The services provided under this contract must be conducted in accordance with all Federal law, Department of Defense (DOD), Department of the Army (DA) and Medical Research and Development Command (USAMRDC) laws and command laws, regulations, policies, and procedures that govern the conduct of regulated research.

9.1.2. DoD Compliance Documents

A complete list of Department of Defense compliance documents providing specifications, standards, or guidelines can be found at http://www.dtic.mil/whs/directives/corres/dir.html

a) Army Regulation 340-21, Army Privacy Program.

http://www.army.mil/usapa/epubs/340_Series_Collection_1.html

b) Army Regulation 25-1, Information Technology.

http://armyhpubs.army.mil/epubs/25_Series_Collection_1.html

c) Army Regulation 25-2, Information Assurance.

d) Department of Defense (DOD) Instruction 8500.01 Cybersecurity

e) Department of Defense (DOD) Instruction 8510.01 Risk Management Framework (RMF) For DOD Information Technology (IT Department of Defense (DoD) Instructions 5400.11-R, Privacy Program: http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf

10. OTHER TERMS, CONDITIONS, AND PROVISIONS

10.1. Invoices

The contractor shall submit invoice to Wide Area Work Flow (WAWF) with sufficient documentation to provide certification of invoice.

The contractor is responsible for properly preparing and forwarding to the appropriate Government official, the invoice and receiving report for payment. Invoices submitted for payment, which do not contain Contract Line Item Number (CLIN) and the Accounting Classification Reference Number (ACRN) information, will be rejected. Equipment purchases and Other Direct Costs (ODCs) are not authorized under this contract. The Wide Area Workflow – Receipt and Acceptance application is the required method of submission.

10.2. Anti-Terrorism and Operational Security

Not Applicable.

10.3. Compliance with Relevant DoD, Service, and Institutional Policy Regulations.

The Contractor shall comply with HIPAA and all relevant DoD/USG regulations for collection, storage, and transfer of sensitive data and PHI. In addition, the Contractor will comply with all requirements for communication of findings and publication in the scientific peer reviewed literature (e.g. Public Affairs clearance and Operational Security clearance for dissemination).

10.4. Personally Identifiable Information (PII) and Protected Health Information (PHI)

The contractor shall comply with the DHA Procedures, and Information (PGI) 224 – Protection of Privacy and Freedom of Information, revised 17 May 2015. The contractor may access PII in the course of task response to the requirements of this contract, as such the contractor shall comply with the document entitled “Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Requirements”.

The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data. The Contractor shall also ensure the confidentiality, integrity, and availability of Government data in compliance with all applicable laws and regulations, including data breach reporting and response requirements, in accordance with DFAR Subpart 224.1 (Protection of Individual Privacy), which incorporates by reference DoDD 5400.11, “DoD Privacy Program,” May 8, 2007, and DoD 5400.11-R, “DoD Privacy Program,” May 14, 2007. The contractor shall also comply with federal laws relating to freedom of information and records management. The Contractor shall comply with all requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), as implemented by the HIPAA Privacy and Security Rules codified at 45 CFR Parts 160 and 164, and as further implemented within the Military Health System (MHS) by DoD 6025.18-R, "DoD Health Information Privacy Regulation," January 24, 2003, and DoD 8580.02-R, “DoD Health Information Security Regulation, July 12, 2007.

IT services that collect, maintain, use, or disseminate personally identifiable information must be managed in a manner that protects privacy, in accordance with section 552a of Title 5, U.S.C.

(Reference (aa)), DoD 5400.11 (Reference (ab)) and DoD 5400.11-R (Reference (ac)). DoDI 5400.16 (Reference (ad)) established the guidance for development, review, and approval of Privacy Impact Assessments, in accordance with chapter 36 of Title 44, U.S.C. (Reference (ae)).

11. ATTACHMENTS

Attachment 1 - Acronyms List

Attachment 2 – Minimum Essential Characteristics

Attachment 3 - Equipment and Materials List

ATTACHMENT 1 – ACRONYMS LIST

Acronym Definition

AFARS Army Federal Acquisition Regulation Supplement

AFRIMS Armed Forces Research Institute of Medical Sciences

AKO Army Knowledge Online

AOR Area Of Responsibility

AT OPSEC Antiterrorism and Operational Security

ATCTS Army Training Certification Tracking System

CAC Common Access Card

CFR Code of Federal Regulations

CONUS Continental United States

COR Contracting Officer Representative

DFARS Defense Federal Acquisition Regulation Supplement

DoD Department of Defense

EIT Electronic and Information Technology

FAR Federal Acquisition Regulation

FBI Federal Bureau of Investigation

FPCON Force Protection Condition

FSC Federal Supply Code

FSS Federal Supply Schedule

GFE Government Furnished Equipment

GFI Government Furnished Information

GSA General Services Administration

IA Information Assurance

ID Identification

ID/IQ Indefinite Delivery / Indefinite Quantity

IPT Integrated Product/Process Team

IT Information Technology

NAC National Agency Check

NACI National Agency Check with Inquiries

NCIC-III National Crime Information Center Interstate Identification Index

NLT No Later Than

OCI Organizational Conflict of Interest

OCONUS Outside Continental United States

OPSEC Operational Security

PMO Project Management Office

PRS Performance Requirements Summary PWS Performance Work Statement

QASP Quality Assurance and Surveillance Plan

QCP Quality Control Plan

SOP Standing Operating Procedure

TARP Threat Awareness and Reporting Program

U.S.C. United States Code

UIC Unit Identification Code

US United States

USAMRAA United States Army Medical Research Acquisitions Activity

USAMRD-G United States Medical Research Directorate – Georgia

USAMRD-A United States Medical Research Directorate – Africa

WAWF Wide Area Work Flow WRAIR Walter Reed Army Institute of Research