Attachment 6 - Sample Task Order PWS Rev 00 for ESS VII.docx

Sample Task Order

PERFORMANCE WORK STATEMENT

Sample RFP XXXX Sample Task Order XXXX February 2021 Revision 00

Procurement, Installation, Maintenance and Service of Electronic Security Systems at Anywhere, USA

1.0 SYNOPSIS. Contractor shall provide deliverables for a complete and integrated Electronic Security System (ESS) for various Federal facilities and locations at Anywhere, USA.

1.1 No existing ESS conditions nor does an Authority to Operate (ATO) exist.

1.2 Revisions to the Performance Work Statement (PWS).

1.2.1 Revision 00. Revision 00 to the PWS is for the award of this Sample Task Order.

2.0 SCOPE.

2.1 Contractor shall plan, procure, and install ESS to include Maintenance and Service (M&S) as described in this PWS.

2.2 The ESS hardware and software capabilities for collection, communication, and display of events (such as alarms, camera footage, user codes, etc…) shall be sized to fit the ESS with limited or no restrictions for expansion.

2.3 Cybersecurity. The ESS shall be installed and configured as a Closed-Restricted Network (CRN).

2.3.1 It has been determined that the system will receive a cybersecurity categorization of Low-Low-Low and shall be designed and secured to that level in accordance with (IAW) Department of Defense Instruction (DoDI) 8510.01.

2.3.2 Contractor shall utilize the latest DoD approved Operating Systems (OS) for all systems provided. (Windows Server 2019 and Windows 10 are the current approved versions of Microsoft OS software.) All network hardware (routers and switches) provided will support Software-Defined Access and be on the Department of Defense Information Network Approved Products List (DoDIN APL).

2.4 The ESS consists of the following subsystems and features:

2.4.1 Intrusion Detection System (IDS). The function of the IDS is to detect intruders IAW criteria listed within each Task.

2.4.2 Access Control System (ACS). The ACS components shall be listed as approved on the Government Services Administration (GSA) Physical Access Control System (PACS) Approved Products List (APL) and be based on the use of both the contact and contactless features of the DoD Common Access Card (CAC). The card readers shall be equipped with a Personal Identification Number (PIN) pad.

2.4.2.1 Doors that require ACS shall be programmed/configured to perform Public Key Infrastructure Authentication (PKI-Auth) in order to gain entry.

2.4.2.2 Gates that require ACS shall be equipped with pedestal mounted, approved contactless card readers with PIN pad and configured with an assurance level of Little or No Confidence via Card Holder Unique Identifier (CHUID), but capable of being easily configured by the end user to support an assurance level of Some Confidence via PKI-Card Authentication Key (CAK) + CAC PIN.

2.4.2.3 Enrollment stations shall be desk mounted and include a laser text printer for system reports and enrollment reader. Enrollment capabilities shall be local only.

2.4.2.4 A badging station is not required.

2.4.2.5 Since the ESS is a CRN and will not be connected to the Federal Bridge for Certificate Revocation List (CRL) checking. CRL updates shall be performed, at least, on a quarterly basis under M&S.

2.4.2.5.1 Although the ACS is not connected directly to the bridge, the ACS shall still be capable of providing a high level of assurance by performing the required challenge and response of the PIV authentication certificate and compare it to the certificate on file on the local authentication server/certificate manager.

2.4.3 Video System. The Video System, also known as Closed Circuit Television (CCTV) system, is to enable assessment, without human intervention, of an alarm event IAW criteria listed within each Task.

2.4.3.1 The video system shall be internet protocol (IP) based with a Redundant Array of Independent Disc (RAID) 5 Network Video Recorder (NVR).

2.4.4 Security Command Center (SCC). The SCC shall integrate all subsystems and communications and provide operator control interface to the ESS IAW criteria listed within each Task.

2.4.4.1 A newly constructed Regional Dispatch Center (RDC), located within 15 miles, is continuously government-managed and will assess and initiate response for ESS alarms. The RDC shall only be capable of monitoring, not altering the system.

2.4.4.2 Alarm events shall report locally and to the RDC, but only cleared locally.

2.4.5 Backup Power. The ESS shall have Uninterruptible Power Supply (UPS) IAW criteria listed within each Task. No existing means of backup power is usable.

2.4.6 Component Enclosure. Shall not have knockouts, shall be lockable, and IAW criteria listed with each Task.

2.4.7 Equipment Rack. Shall be enclosed, lockable, and IAW criteria listed with each Task.

2.4.8 Infrastructure (conduit and cabling). None existing with exception to a Government furnished fiber patch panel with available connection (dark fiber) from the Communications Room to the RDC.

2.4.9 Growth Capability. Growth capability is not to be limited by the provided products.

2.4.10 National Defense Authorization Act (NDAA). Equipment shall be compliant with the John S. McCain National Defense Authorization Act (NDAA) and shall not contain "telecommunications equipment or services" banned by the NDAA, nor employ any component or technology of any system - substantial, essential, critical or otherwise - from banned companies.

3.0 APPLICABLE DOCUMENTS. The following criteria (latest version, unless otherwise noted) and manufacturer recommendations shall be applied during the execution of all work performed:

a. UFGS 27 10 00 Building Telecommunications Cabling System

b. UFGS 28 08 10 Electronic Security System Acceptance Testing

c. UFGS 28 10 05 Electronic Security Systems (ESS)

d. UFC 4-010-06 Cybersecurity of Facility-Related Control Systems

e. UFC 4-021-02 Electronic Security Systems

f. AR 25-1 Army Information Technology

g. AR 25-2 Army Cybersecurity

h. AR 190-51 Security of Unclassified Army Resources (Sensitive and Nonsensitive)

i. FIPS 201-2

j. American with Disabilities Act (ADA) regulations

k. Homeland Security Presidential Directive (HSPD) 12

l. National Fire Protection Association (NFPA) 101 Life Safety Code

m. Safety and Health requirements will be performed IAW U.S. Army Corps of Engineers EM 385-1-1

n. DoD Directive 8140.01 Cyberspace Workforce Management

o. DoD Instruction 8500.01, Cybersecurity

p. DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

q. Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs)

r. Intelligence Community Technical Specification for Intelligence Community Standard / Directive (ICS/ICD) 705

4.0 SUMMARY OF REQUIREMENTS.

4.1 Design Activities.

4.1.1 SD-02 Shop Drawings. Contractor shall deliver clear and complete shop drawings that include:

4.1.1.1 ESS Components. Indicate each ESS component function that includes:

a. Termination device points

b. Interconnections required for system operation

c. Interconnections between modules and devices

d. Proposed wireway or conduit systems to be used including:

(1) Locations

(2) Sizes

(3) Types

e. Drawings showing:

(1) Device locations and spacing

(2) Mounting and positioning details

(3) Riser Diagrams with cable sizes and types

(4) Equipment list (make, model and quantities to include software licenses)

(5) Alarm and access control zones

(6) Sensor Coverage Plan

(7) Spare capacity

(8) Installed software

4.1.1.2 Overall System Schematic. Indicate the relationship of integrated components on one-line diagrams that include:

a. Power source

b. System controls

c. Impedance matches

d. Interconnecting wire data including:

(1) Number

(2) Size

(3) Identification

(4) Maximum lengths

4.1.2 SD-03 Product Data. Contractor shall deliver manufacturers’ data for all materials, equipment, and software required to implement the complete system as required in the SD-02 Shop Drawings.

4.1.3 SD-05 Design Data. Contractor shall deliever design data that includes:

a. System Throughput Rates

b. Backup Battery (to include UPS) Capacity and Retention Calculations

c. Video System Storage Calculations

4.2 Procure and Install. Contractor shall provide the Design Activities listed above for the following fictitious procurement and installation tasks:

Task 1. Using AR190-51, provide ESS for the following U.S. Army Corps of Engineers civil work resources: Powerhouse, Switchyard, Transformers, Spillway Gate Structure, and Control Room. The risk analysis resulted in a risk level III for each area. For the purposes of this sample task order, when AR190-51 mentions “access into an area will be controlled,” this should be interpreted as electronic ACS. Further details for this Task:

a. Security lighting, fencing, automatic gate openers (each location is a single swing gate), signage except for IDS, doors and physical hardening of portals are provided by others.

b. Unescorted public access is not allowed beyond the fencing and gates. The automatic gate openers have vehicle loop detectors for safety and to open the gate from the secure side. Egress shall remain free, but an outbound/egress ACS is required at each gate.

c. The transformers are owned, operated, and maintained by USACE.

d. Approaching/Unsecure side of the perimeter fence does not require IDS.

e. Arming and disarming will be controlled via software; arming and disarming keypads are not required.

f. In scenarios where UFGS 28 10 05 sentences contain choices or optional features the more stringent or best capability shall be selected, unless otherwise stated.

g. The following UFGS 28 10 05 capabilities are not required: two-man access code or credentials; silent ambush alarm; Premise Control Unit (PCU) manual and self-test; ACS positive operator acknowledgment; ACS Guard Tour; and Video Analytics beyond the need to assess alarm events without human intervention.

h. Appropriate sensor types are to be selected to meet the requirements.

i. The Control Room Communications Room requires IDS as a separate zone and ACS.

j. The Control Room requires the enrollment station and a monitoring station/SCC.

k. The RDC requires a monitoring station.

Task 2. Using IC Tech Spec – ICS/ICD 705 v1.5, provide ESS for the Secure Area. The area will not be continuously occupied nor will continuous visual observation be possible. Further details for this Task:

a. CCTV to supplement ACS is required.

b. Appropriate combination lock is required.

c. CCTV to monitor the entry/exit points is required.

4.3 Maintenance and Services (M&S). Contractor shall provide a Maintenance Plan for this fictitious task order.

Task 3. Maintenance Plan. The Maintenance Plan should include, at a minimum, the following:

a. Narrative describing the work to be performed

b. Cybersecurity maintenance and sustainment

c. Tasks and frequency for preventative maintenance based on manufacturers’ data and system security standards

d. Standard test procedures to be performed for corrective and preventative maintenance

5.0 DELIVERABLES. Contractor shall provide Design Activities for Tasks 1 and 2 and a Maintenance Plan for Task 3.

6.0 LIST OF ATTACHMENTS. All attachments will be included with this PWS but are provided under separate cover.

Attachment 1 – Sample Task Order Drawings