Attachment A - Statement of Work.pdf

Financial Crimes Enforcement Network Statement of Work

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

2099CF26Q00006

STATEMENT OF WORK

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

1.0 Introduction

The Financial Crimes Enforcement Network (FinCEN) is a bureau of the U.S. Department of the Treasury.

FinCEN’s mission is to safeguard the financial system from illicit use, combat money laundering, promote national security through the collection, analysis, and dissemination of financial intelligence, and strategically use financial authorities.

FinCEN operates facilities that require secure key control and physical access systems. The installed environment includes TRAKA key management cabinets, Medeco high-security lock cores and related hardware, Kaba Mas X10 high-security locks, and associated manual door hardware. FinCEN requires maintenance, repair, replacement, installation, software licensing, and technical support services to maintain the operational readiness and security of these systems.

2.0 Objective and Scope

The objective of this requirement is to provide timely, controlled, and properly documented maintenance and support for FinCEN’s installed key-control and locking systems. The Contractor shall provide all labor, supervision, management, tools, materials, equipment, licenses, transportation, and incidental services necessary to perform authorized work under this contract.

The scope includes the following:

• TRAKA key-control cabinets, associated software, firmware, licensing, and support;

• Medeco high-security lock cores and related hardware;

• Kaba Mas X10 high-security locks and related components;

• Other high-security locks and related hardware;

• Manual door-locking hardware and associated components;

• Preventive and corrective maintenance;

• Diagnosis, repair, replacement, installation, relocation, testing, and configuration documentation; and

• Emergency and after-hours services when authorized.

2.1 Existing Equipment References and Brand Treatment

References to TRAKA, Medeco, Kaba Mas X10, Lockmasters, or other manufacturers identify the Government’s existing equipment and operating environment. A reference to an installed brand does not, by itself, require all replacement items to be that brand.

For solicitation and contract administration purposes, items shall be treated as follows:

• Brand Name Only: The exact manufacturer or product is required and no substitute will be accepted. Only items expressly designated as “Brand Name Only” in the matrix below or elsewhere in the solicitation are restricted in this manner.

• Brand Name or Equal: An equal product may be offered when it satisfies every stated salient characteristic and is fully compatible with the installed environment.

• Performance-Based/Generic: No brand restriction applies. The item must satisfy the stated functional, performance, safety, and security requirements.

Any proposed equal product shall include all hardware, software, licenses, adapters, interfaces, and incidental components required for complete operation. An equal product shall not reduce security, performance, reliability, maintainability, or functionality; require unapproved changes to Government systems; or void an applicable manufacturer warranty or certification.

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

2099CF26Q00006

2.2 Brand-Treatment Matrix

System or Item Category

Installed Environment

Government Treatment Solicitation Requirement

TRAKA cabinets, proprietary software, firmware, and licensing

TRAKA Brand Name Only

FinCEN currently has four TRAKA cabinets installed that are UpToDate on their software, licensing, and required hardware components to successfully integrate with FinCEN’s current Access Control System (ACS) Lenel.

Cabinets:

• (2) Traka Touch Pro L cabinet (180 peg)

• (2) Traka Touch Pro S cabinet (60 peg) Licensing/Software:

(LenelS2 OnGuard Side):

• OnGuard API / Partner Integration License (Traka (Assa ABLOY) Side):

• Traka Web API / Communication License Hardware:

• Dual-Headed Network Adapter: Part number

ETH-003

• Cabinet Card Reader Interface: Part number

RPP-001

Medeco lock cores, keys, and related replacement hardware

Medeco Brand Name or Equal

FinCEN currently utilizes Medeco 32 series interchangeable cores with m3 technology hardware to strictly meet the Interagency Security Committee (ISC) standard for high-security mechanical key cylinders and restricted keyways. This hardware ensures robust protection against unauthorized key duplication.

Transitioning to an alternative high-security key brand or changing the established dealer/company would require a complete overhaul of the mechanical lock infrastructure at both facility locations. Replacing existing cylinders, hardware, and keys would result in substantial, unrecoverable duplication of costs that cannot be recovered. Operational Introducing a different proprietary keyway system or changing providers would disrupt access control management. It would create severe administrative confusion regarding key pathways, tracking, and facility room access for security personnel. The required lock infrastructure is vital to the security operations of FinCEN. Maintaining compatibility with the existing Medeco and ASSA ABLOY system is the only method that satisfies the government's requirements without incurring unacceptable operational risk and wasteful duplication of costs.

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

2099CF26Q00006

System or Item Category

Installed Environment

Government Treatment Solicitation Requirement

Kaba Mas X10, CDX-10, and LKM replacement components

Kaba Mas / Lockmasters

Brand Name Only

FinCEN currently has Kaba Mas X-10, CDX-10, and Lockmasters LKM series (LKM10K) ultra-high-security electromechanical locking systems that are designed exclusively to protect National Security Information (NSI) and Classified materials installed as required/needed. These items are bound by strict federal specification limits. The complete locking units are heavily restricted items that can only be purchased by the Federal Government, authorized government contractors, or specially designated organizations under the Kaba Mas Limited Use Clause. Each safe and secure door has been drilled to accommodate this style of locking device, installing a different maker/style may cause the door or safe drawer to become inoperable.

Manual door hardware, cabling, interconnections, and incidental materials

Various

Performance- Based/Generic unless otherwise identified

Meet the applicable fit, function, code, safety, and compatibility requirements.

3.0 Contract Type, Work Authorization, and Cost Control

3.1 Time-and-Materials Structure

Work shall be performed on a time-and-materials basis in accordance with the contract’s labor categories, fixed hourly rates, materials provisions, and ceiling price. The Contractor shall not exceed the applicable funded ceiling or incur costs beyond an authorized service request without advance written authorization from the Contracting Officer (CO).

The solicitation pricing schedule shall identify, at a minimum, the labor categories, regular-hour rates, approved after-hours or emergency rates, estimated hours, material or other-direct-cost treatment, option-period pricing, and total evaluated price.

3.2 Service Requests and Written Estimates

Except for recurring preventive maintenance already scheduled under the contract, work shall be initiated through a written service request. Before beginning repair, replacement, relocation, or installation work, the Contractor shall provide a written diagnosis and estimate that identifies:

• The service-request or ticket number;

• The condition found and recommended corrective action;

• The proposed labor category or categories, estimated hours, and applicable hourly rates;

• The proposed materials, quantities, unit prices, and any separately stated handling charge permitted by the contract;

• The estimated not-to-exceed amount;

• The proposed schedule and expected system downtime; and

• Whether the proposed item is Brand Name Only, Brand Name or Equal, or performance-based under Section

2.2.

The Contractor shall not begin the proposed work until written authorization is received from the CO or from the COR acting within the limits of a written delegation. Only the CO may modify the contract, change its scope or terms, or increase the contract ceiling.

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

2099CF26Q00006

3.3 Materials and Replacement Parts

Materials and replacement parts shall be new and commercially available unless the CO authorizes another condition in writing. The Contractor shall maintain traceability to the manufacturer and provide invoices, receipts, part numbers, warranty information, and other supporting documentation required by the contract. Removed Government-owned equipment shall be returned to the COR unless the Government provides written disposal instructions.

Replacement of worn or damaged components during preventive maintenance is not automatically included in the preventive-maintenance service. The Contractor shall obtain authorization under Section 3.2 before installing billable replacement parts, unless the part is expressly included in a fixed-price preventive-maintenance line item in the solicitation schedule.

4.0 Performance Requirements and Tasks

4.1 General Requirements

The Contractor shall:

• Designate a primary point of contact and alternate point of contact for contract coordination;

• Coordinate onsite work, outages, and facility access with the COR;

• Provide qualified personnel, tools, test equipment, transportation, and incidental supplies necessary to perform authorized work;

• Maintain the operational status of existing systems to the maximum extent practicable during maintenance and installation activities;

• Protect Government property and repair damage caused by Contractor operations at no additional cost to the

Government;

• Remove debris generated during performance and dispose of non-Government property in accordance with applicable requirements;

• Dispose of electronic equipment only when specifically authorized and through approved recycling or disposal channels;

• Provide technical documentation necessary to support Government security and system-authorization activities; and

• Immediately notify the COR of any condition that may affect security, safety, schedule, system availability, or cost.

4.2 Service Desk and Response Requirements

The Contractor shall maintain a dedicated telephone number and email address for service requests. The following definitions apply: “acknowledgement” means confirmation that the request was received and assigned;

“initial response” means contact with the Government to begin diagnosis or triage; and “onsite response” means arrival of qualified personnel at the applicable FinCEN location.

Requirement Performance Standard Measurement/Documentation

Service-request acknowledgement Within 2 hours of receipt Time stamp in service-ticket record

Initial response/triage Within 4 hours of receipt Time stamp and summary of initial contact

Emergency onsite response Within 4 hours of receipt Arrival time documented in service-ticket record

Routine onsite response Within 3 days of receipt Arrival time documented in service-ticket record

Maintenance/service report Within 5 business days after completion of service PDF service report submitted to the COR

4.3 Preventive Maintenance

The Contractor shall perform preventive-maintenance inspections at least once every six months at dates coordinated with the COR. Preventive maintenance shall include, as applicable:

• Visual and functional inspections;

• Operational testing and diagnostic evaluation;

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

2099CF26Q00006

• Cleaning, adjustment, and lubrication consistent with manufacturer guidance;

• Verification of system configuration and communication status;

• Application of authorized software updates and security patches;

• Identification of worn, damaged, obsolete, or unsupported components;

• Recommendations for corrective action and replacement; and

• Submission of a preventive-maintenance report for each location.

4.4 Corrective Maintenance and Repair

The Contractor shall diagnose and correct equipment failures, intermittent conditions, software or firmware issues, damaged components, and other deficiencies covered by this requirement. Corrective maintenance shall restore the affected equipment to normal operation and shall include testing and documentation of the completed work.

When permanent repair cannot be completed during the initial visit, the Contractor shall identify any temporary measure, security impact, required parts, estimated completion date, and recommended Government action in the service report.

4.5 Installation, Relocation, and Replacement

For authorized installation, relocation, or replacement work, the Contractor shall:

• Verify field conditions and dimensions before ordering or installing materials;

• Identify required outages and obtain approval before interrupting service;

• Provide and install all required mounting hardware, cabling, interconnections, licenses, and ancillary components included in the authorized estimate;

• Perform work in accordance with manufacturer instructions and applicable building, fire, life-safety, electrical, accessibility, and security requirements;

• Restore affected finishes and work areas to their pre-work condition; and

• Update equipment and configuration records after completion.

4.6 TRAKA Software Licensing and Technical Support

The Contractor shall provide authorized software licensing, maintenance, firmware, patches, and technical support required for the continued operation of the installed TRAKA systems when included in an authorized service request or contract line item. The Contractor shall identify license type, quantity, term, support level, renewal date, and any manufacturer authorization required to provide the license or support.

4.7 Testing and Acceptance

Following installation, replacement, relocation, or major repair, the Contractor shall conduct testing sufficient to demonstrate that the affected system or component operates properly and integrates with the existing environment. Testing documentation shall include, as applicable:

• Pre-test or test-plan documentation;

• Functional test results;

• Final acceptance-test results;

• Configuration and asset information;

• Manufacturer documentation and warranty information; and

• A punch list and written confirmation when all punch-list items are complete.

Government acceptance shall occur after successful completion of required testing and written approval by the COR acting within the limits of the COR’s delegation. Acceptance does not waive latent defects, warranty obligations, or other contract rights.

4.8 Warranty

The Contractor shall provide a minimum 12-month warranty on newly installed equipment and associated installation labor unless the solicitation schedule requires a longer period. The warranty shall include parts, labor, troubleshooting, repair, replacement, testing, and validation. Warranty coverage shall begin upon Government acceptance. The Contractor shall provide applicable manufacturer warranty documentation and shall coordinate warranty service without additional charge to the Government.

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

2099CF26Q00006

5.0 Deliverables

Deliverable Due/Frequency Minimum Content Government Recipient

Kickoff meeting Within 10 business days after award

Points of contact, communication procedures, service-request process, invoicing process, security coordination, and initial schedule

CO and COR

Status report Every two months Open and closed tickets, labor hours, materials, ceiling status, risks, upcoming preventive maintenance, warranties, and unresolved issues

COR

Written diagnosis and estimate

Before authorized repair, replacement, relocation, or installation

Information required by Section 3.2 COR and CO when required

Service/maintenance report

Within 5 business days after service

Ticket number, dates, personnel, labor hours, work performed, parts used, test results, configuration changes, recommendations, and photographs when requested

COR

Preventive-maintenance report

After each semiannual visit

Inspection results, deficiencies, recommended corrective actions, and inventory changes COR

Manufacturer and warranty documentation

Upon equipment replacement or installation

Manufacturer, model, serial number, warranty term, manuals, and license/support information COR

Test and acceptance package

Upon completion of applicable work

Test results, configuration documentation, punch list, and final acceptance information COR

Invoice package Monthly Invoice and supporting documentation required by Section 6.4

Designated invoicing office and COR

All deliverables shall be submitted electronically in searchable PDF format unless the CO or COR directs another format within the scope of the contract.

6.0 Contract Management Procedures

6.1 Period of Performance

The anticipated period of performance consists of one 12-month base period and four 12-month option periods.

Continuing maintenance, service, and support for existing equipment shall begin on the contract start date.

Maintenance, service, and support for newly installed equipment shall begin upon installation and Government acceptance, subject to the applicable contract line item and period of performance.

6.2 Place of Performance

Services shall be performed at FinCEN facilities in Washington, DC, and Vienna, Virginia. The Government will provide specific facility information and access instructions after award and completion of applicable security processing.

6.3 Hours of Work and Emergency Services

After-hours or emergency rates may be charged only when the Government requires service outside the normal work window and the service is authorized in writing under Section 3.2. The Contractor shall clearly identify the applicable after-hours or emergency labor category and rate in the written estimate and invoice.

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

2099CF26Q00006

6.4 Invoice and Supporting Documentation

The Contractor shall submit invoices monthly. Each invoice shall identify the contract number, period of performance, service-request number, location, dates of service, labor category, employee name or unique identifier, labor hours, hourly rate, extended labor amount, materials and quantities, unit prices, authorized handling charge if applicable, travel or other direct costs if authorized, and total amount billed. The invoice package shall include the approved estimate, service report, material receipts or invoices, and other documentation required by the contract.

The Contractor shall provide a cumulative ceiling-status report with each invoice showing amounts billed and remaining for the applicable contract line item and performance period.

7.0 Security Requirements

This contract involves access to and work with Classified National Security Information. The Contractor company shall possess an active final Secret facility clearance (FCL) at the time of award and shall maintain the required FCL throughout contract performance. Interim facility clearances are not acceptable.

All Contractor personnel supporting this contract shall possess a final Secret personnel security clearance based on a favorably adjudicated Tier 3 (T3), or equivalent, background investigation by the start of the period of performance. Interim personnel clearances are not acceptable. All Contractor personnel supporting this contract shall also be actively enrolled in a Continuous Vetting (CV) program consistent with current Trusted Workforce requirements, regardless of the date of the individual's last investigation or adjudication.

All Contractor employee investigative and security-clearance actions are the responsibility of the Contractor.

Failure to provide personnel with the required clearance level constitutes a failure to satisfy the contract requirement for cleared personnel and may be grounds for termination. These requirements also apply to replacement personnel. The Contracting Officer and the FinCEN Office of Security must approve personnel replacements before the replacement performs work under this contract.

All Contractor personnel requiring access to FinCEN information, information systems, or facilities shall be approved by and processed through the FinCEN Office of Security in accordance with the Contract Security Classification Specification (DD Form 254). No person may begin performance until required clearance, access approval, and facility processing are complete. The Government may deny access to or remove Contractor personnel whose actions conflict with Government security interests, and the Contractor shall promptly remove the individual from contract performance after notification.

Classification guidance shall be in accordance with applicable source documents or the Treasury Classification Guide, dated September 21, 2021, as provided at contract award. Controlled Unclassified Information (CUI) shall be the primary term used to mark sensitive but unclassified information originating within Treasury or bureau offices. Foreign Government Information, Limited Dissemination Information, Law Enforcement Sensitive information, and For Official Use Only information shall be treated as CUI, and applicable CUI handling and protective measures shall be applied.

Approval from the FinCEN Office of Security is required before subcontracting any work associated with this contract that requires access to classified information or access to FinCEN facilities. Subcontractor DD Forms 254 shall be submitted to the FinCEN Office of Security for concurrence before the subcontractor begins performance of the affected work.

All Contractor personnel shall comply with FinCEN reporting requirements, including Security Executive Agent Directive 3 (SEAD 3), Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position. Failure to comply may result in administrative action, including removal from access to FinCEN facilities or information. The Contractor's Facility Security Officer shall provide a copy of any required SEAD 3 report or derogatory-information report to the FinCEN Office of Security within 72 hours of receipt.

When a Contractor employee is no longer assigned to this contract, the Contractor shall immediately notify the COR. If initial notification is provided by telephone, the Contractor shall provide written notification within 24 hours. The Contractor shall complete required out-processing and return all Government-issued property, including identification cards, keys, phones, and computers, in accordance with FinCEN Office of Security instructions.

All Contractor personnel shall execute required nondisclosure and reporting forms before being granted access to FinCEN facilities or information. The Contractor shall comply with the DD Form 254, applicable Treasury and FinCEN security policies provided after award, and all additional security attachments incorporated into the solicitation and resulting contract. If this SOW conflicts with the DD Form 254 or an incorporated security

Lock, Key, and TRAKA Key Management System Maintenance and Support Services

2099CF26Q00006

requirement, the Contractor shall immediately notify the CO and shall not proceed with the affected work until the Government resolves the conflict in writing.

8.0 Government-Furnished Information and Support

The Government will provide, when available and applicable:

• Existing floor plans and site information;

• Equipment inventories and available configuration information;

• Access to Government facilities after completion of applicable security processing;

• A designated COR and Government points of contact; and

• Government review and approval of service requests, estimates, outages, testing, and acceptance documentation.

The Government’s provision of inventory or configuration information does not relieve the Contractor from verifying field conditions before ordering materials or performing installation work.

9.0 Existing Government Equipment Inventory

Equipment Category Location Approximate Quantity Description/Notes

TRAKA cabinets Vienna, VA 2 180-position cabinets

TRAKA cabinets Washington, DC 2 60-position cabinets

Medeco high-security cores/locks Vienna, VA 248 Existing installed cores/locks

Medeco high-security cores/locks Washington, DC 101 Existing installed cores/locks

Other high-security cores/locks Vienna, VA 31 Existing installed cores/locks

Other high-security cores/locks Washington, DC 1 Existing installed core/lock

Kaba Mas CDX-10 VA/DC 6 Pedestrian-door locks

Lockmasters/Kaba Mas X10 LKM VA/DC 1 Existing installed unit

Kaba Mas X10 VA/DC 53 Safe locks

10.0 Applicable Requirements and Order of Precedence

The Contractor shall comply with current, applicable Federal, Department of the Treasury, FinCEN, occupational safety, building, fire, life-safety, electrical, information-security, physical-security, accessibility, environmental, and manufacturer requirements that apply to the authorized work. Specific contract clauses, the DD Form 254, security attachments, and facility procedures incorporated into the solicitation or contract establish the enforceable requirements.

The Contractor shall promptly notify the CO and COR of any apparent conflict among this SOW, the solicitation schedule, contract clauses, the DD Form 254, a security attachment, manufacturer instructions, or an authorized service request. The Contractor shall not proceed with the affected work until the Government resolves the conflict in writing.

11.0 Definitions

Term Definition Contracting Officer (CO) The Government official with authority to enter into, administer, modify, or terminate the contract.

Contracting Officer’s Representative (COR)

The individual designated in writing to perform specified technical or administrative functions. The COR may not change contract terms, scope, or ceiling.

Emergency Service Accelerated service for a condition with an immediate operational, safety, or security impact, as determined and authorized by the Government.

Service Request A written Government ticket describing a maintenance or support need under the contract.

Salient Characteristic An essential physical, functional, performance, compatibility, security, or quality feature that an equal product must meet.