B08_-_140F1S25Q0064_-_2.pdf

140F1S25Q0064

1. REQUEST NO.

5a. ISSUED BY

NAME

a. NAME

c. STREET ADDRESS

d. CITY

10. PLEASE FURNISH QUOTATIONS TO

THE ISSUING OFFICE IN BLOCK 5a ON

OR BEFORE CLOSE OF BUSINESS (Date)

2. DATE ISSUED 3. REQUISITION/PURCHASE REQUEST NO. 4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG.1

RATING

6. DELIVERY BY (Date)

7. DELIVERY

9. DESTINATION

a. NAME OF CONSIGNEE

b. STREET ADDRESS

PAGE OF PAGES

5b. FOR INFORMATION CALL: (No collect calls)

TELEPHONE NUMBER

AREA CODE NUMBER

8. TO:

b. COMPANY

e. STATE f. ZIP CODE

c. CITY

d. STATE e. ZIP CODE

IMPORTANT: This is a request for information, and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it to the address in Block 5a. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services. Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotations must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

THIS RFQ

REQUEST FOR QUOTATION

(THIS IS NOT AN ORDER)

IS IS NOT A SMALL BUSINESS SET ASIDEX

08/12/2025 0044023841

1 1

FWS, IT Services 5275 Leesburg Pike Falls Church VA 22041

FWS IT Services

FWS BALD KNOB NWR

1439 COAL CHUTE ROAD

BALD KNOB

AR 72010-9540

505 248-6627Lorenzo Aragon

08/18/2025 1700 ED

FOB DESTINATION

OTHER

(See Schedule)X

ITEM NO.

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

00010 DMP Fire System 1 EA

00020 Intrusion Detection System 1 EA

FWS Contracting POC: Lorenzo Aragon; E-Mail:

lorenzo_aragon@fws.gov; Ph# 505-248-6627

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS (%) b. 20 CALENDAR DAYS (%) c. 30 CALENDAR DAYS (%) d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations

13. NAME AND ADDRESS OF QUOTER

b. STREET ADDRESS

c. COUNTY

d. CITY e. STATE f. ZIP CODE

14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

16. SIGNER

a. NAME (Type or print)

c. TITLE (Type or print)

a. NAME OF QUOTER

AREA CODE

NUMBER

15. DATE OF QUOTATION

b. TELEPHONE are are not attached

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition not usable

STANDARD FORM 18 (REV. 6-95)

Prescribed by GSA - FAR (48 CFR) 53.215-1(a)

The U.S. Fish and Wildlife Service (USFWS), Bald Knob NWR, has a need to secure a new Intrusion Detection System (IDS) and Fire Alarm System under RFQ# 140F1S25Q0064. Please see the attached Performance Work Statement (PWS) for additional details.

I. Type of Contract

The Government contemplates award of a firm-fixed price contract resulting from this solicitation.

II. Quote Instructions

1. Submission of questions

a. Interested vendors must submit any questions concerning the solicitation by Friday August

15, 2025, at 12:00 PM EST. Questions may be submitted via email to lorenzo_aragon@fws.gov.

2. Submission of quotes

a. Quotes are to be submitted via email to lorenzo_aragon@fws.gov by Monday August 18, 2025, at 5:00 PM EST.

3. Period for acceptance of quote

a. The vendor agrees quotes will be valid for at least 60 days from the date specified for receipt of quotations.

4. Late submissions, modifications, revisions, and withdrawals of quotes

a. Vendors are responsible for submitting quotes, and any modifications, revisions, or withdrawals, so as to reach the Government office designated in the solicitation by the time specified in the solicitation. Any quote, modification, revision, or withdrawal of a quote received at the Government office designated in the solicitation after the exact time specified for receipt of quotes is "late" and will not be considered.

5. Specific Quote Instructions

a. Quotes shall be submitted in two (2) separate volumes. Volume I-Technical (factors 1&2) shall be no more than (25) twenty-five pages not including cover page, or appendix.

Volume II-Price (factor 3) does not have a page limit.

i. Volume I - Technical (factor 1 & 2)

ii. Volume II - Price (factor 3)

b. Volume I – Factor 1- Technical:

i. This volume should address all non-price factors. Volume I shall include the cover page, descriptive literature that explains the vendors proposed product/service with enough detail to ascertain whether the quoted product/service will meet the criteria specified in the PWS.

ii. The vendor shall be able to demonstrate their experience installing new Intrusion Detection Systems and Fire Alarm Systems and ability to perform work similar in scope to the tasks listed in the PWS.

c. Volume I – Factor 2 Past Performance

i. The Vendor should be able to demonstrate successful past performance and experience installing new Intrusion Detection Systems and Fire Alarm Systems to the USFWS or other government agencies.

ii. The vendor shall demonstrate their prior experience as it relates to similar use cases of similar size, scope, and complexity to this requirement within the past three (3) years. A minimum of two (2) examples will be required.

iii. The examples must include the following information:

1. Project Description

2. Dollar amount of project

3. Period of performance mailto:%20lorenzo_aragon@fws.gov.

mailto:%20lorenzo_aragon@fws.gov.

4. Point of contact, telephone number, and email address.

d. Volume II – Price

i. Price volume shall include the cost of the requested products/services listed in the

PWS.

ii. Vendors are encouraged to offer discounted prices. The vendor shall submit a separate price quote for the products/services specified in the PWS.

III. Evaluation Factors

The technical features of each quote shall be evaluated against the Request for Quote (RFQ) requirements, assessing the strengths and weaknesses of each quote in light of evaluation criteria described below. The technical evaluation factors shall be evaluated using reasoned judgment that results in the assignment of a rating as follows: Outstanding, Good, Acceptable, or Unacceptable.

Outstanding: The proposal meets requirements and indicates an exceptional capability and understanding of the requirements. Strengths far outweigh any weaknesses. Risk of unsuccessful performance is very low.

Good: The proposal meets requirements and indicates a thorough capability and understanding of the requirements. Proposal contains strengths which outweigh any weaknesses. Risk of unsuccessful performance is low.

Acceptable: The proposal meets requirements and indicates an adequate capability and understanding of the requirements. Strengths and weaknesses are offsetting or will have little or no impact on contract performance. Risk of unsuccessful performance is no worse than moderate.

Unacceptable: The proposal does not meet requirements and contains one or more deficiencies. Proposal is unawardable. The Contracting Officer will screen quotes to identify and eliminate any quotes that are so incomplete as to preclude consideration of award. The remaining quotes will be evaluated based upon the following factors:

1. FACTOR 1 – Technical approach understanding of the PWS

a. The vendor’s demonstration of its technical approach and understanding of the requirements as set forth herein, including how it described meeting the specific requirements in the PWS.

2. Factor 2 – Past Performance

a. The vendor shall clearly demonstrate satisfactory or better performance with projects of similar size, scope, and complexity of this requirement.

3. FACTOR 2 – Price

a. The Government shall evaluate pricing from all responses received using the evaluation criteria to determine that the total price is reasonable to perform the specific tasks being ordered.

IV. Basis of Award

The Government intends to evaluate quotes and award a contract without discussions with vendors.

Therefore, the vendor’s initial quote should contain its best terms from a price and technical standpoint.

However, the Government reserves the right to conduct discussions if later determined by the Contracting officer to be necessary or in the Government’s best interest. Award shall be made to the responsible vendor whose quote is determined to be the most advantageous to the Government, with appropriate consideration given to the evaluation factors. Award shall be made to the vendor whose quote, conforming to this RFQ, provides the best value to the Government. Non-pricing features of a vendor’s quote shall be evaluated in such a manner as to assess the value of those features as compared to the quoted prices or costs to the Government. Implicit in this process is the Government’s willingness to accept other than the lowest priced quote or highest rated quote. The non-price factors and the price factor. The Government may reject any or all quotes if such action is in the public interest; accept other than the lowest quote; and waive informalities and minor irregularities in quotes received.

V.Clauses

Incorporated in this solicitation are all GSA schedule provisions and clauses from the quoters GSA schedule.

Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP)

(February 2021)

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor.

To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions - Commercial Items included in commercial item contracts. The IPP website address is:

https://www.ipp.gov.

Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice [Contracting Officer to edit and include the documentation required under this contract]:

The Contractor must use the IPP website to register access and use IPP for submitting requests for payment.

The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 - 5 business days of the contract award date. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

(End of Local Clause)

DEPARTMENT OF THE INTERIOR ACQUISITION REGULATION (DIAR) CLAUSES

INCORPORATED BY FULL TEXT

1452.201-70 Authorities and Delegations (Sep 2011)

(a) The Contracting Officer is the only individual authorized to enter into or terminate this contract, modify any term or condition of this contract, waive any requirement of this contract, or accept nonconforming work.

(b) The Contracting Officer will designate a Contracting Officer's Representative (COR) at time of award.

The COR will be responsible for technical monitoring of the contractor's performance and deliveries. The COR will be appointed in writing, and a copy of the appointment will be furnished to the Contractor.

Changes to this delegation will be made by written changes to the existing appointment or by issuance of a new appointment.

(c) The COR is not authorized to perform, formally or informally, any of the following actions:

(1) Promise, award, agree to award, or execute any contract, contract modification, or notice of intent that changes or may change this contract;

(2) Waive or agree to modification of the delivery schedule;

(3) Make any final decision on any contract matter subject to the Disputes Clause;

(4) Terminate, for any reason, the Contractor's right to proceed;

(5) Obligate in any way, the payment of money by the Government.

(d) The Contractor shall comply with the written or oral direction of the Contracting Officer or authorized representative(s) acting within the scope and authority of the appointment memorandum. The Contractor need not proceed with direction that it considers to have been issued without proper authority. The Contractor shall notify the Contracting Officer in writing, with as much detail as possible, when the COR has taken an action or has issued direction (written or oral) that the Contractor considers to exceed the COR's appointment, within 3 days of the occurrence. Unless otherwise provided in this contract, the Contractor assumes all costs, risks, liabilities, and consequences of performing any work it is directed to perform that falls within any of the categories defined in paragraph (c) prior to receipt of the Contracting Officer's response issued under paragraph (e) of this clause.

(e) The Contracting Officer shall respond in writing within 30 days to any notice made under paragraph

(d) of this clause. A failure of the parties to agree upon the nature of a direction, or upon the contract action to be taken with respect thereto, shall be subject to the provisions of the Disputes clause of this contract.

(f) The Contractor shall provide copies of all correspondence to the Contracting Officer and the COR.

(g) Any action(s) taken by the Contractor, in response to any direction given by any person acting on behalf of the Government or any Government official other than the Contracting Officer or the COR acting within his or her appointment, shall be at the Contractor's risk.

(End of clause)

52.217-8 -- Option to Extend Services.

As prescribed in 17.208(f), insert a clause substantially the same as the following:

Option to Extend Services (Nov 1999) The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days.

(End of Clause)

52.204-28 Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts.

As prescribed in 4.2306(a), insert the following clause:

FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS—FEDERAL SUPPLY SCHEDULES,

GOVERNMENTWIDE ACQUISITION CONTRACTS, AND MULTI-AGENCY CONTRACTS (DEC 2023)

https://www.acquisition.gov/far/4.2306#FAR_4_2306

(a) Definitions. As used in this clause—

Covered article as defined in 41 U.S.C. 4713(k), means—

(1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 ( 47 U.S.C. 153);

(3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or

(4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

FASCSA order, means any of the following orders issued under the Federal Acquisition Supply Chain Security Act (FASCSA) requiring the removal of covered articles from executive agency information systems or the exclusion of one or more named sources or named covered articles from executive agency procurement actions, as described in 41 CFR 201–1.303(d) and (e):

(1) The Secretary of Homeland Security may issue FASCSA orders applicable to civilian agencies, to the extent not covered by paragraph (2) or (3) of this definition. This type of FASCSA order may be referred to as a Department of Homeland Security (DHS) FASCSA order.

(2) The Secretary of Defense may issue FASCSA orders applicable to the Department of Defense (DoD) and national security systems other than sensitive compartmented information systems. This type of FASCSA order may be referred to as a DoD FASCSA order.

(3) The Director of National Intelligence (DNI) may issue FASCSA orders applicable to the intelligence community and sensitive compartmented information systems, to the extent not covered by paragraph (2) of this definition. This type of FASCSA order may be referred to as a DNI FASCSA order.

Intelligence community, as defined by 50 U.S.C. 3003(4), means the following—

(1) The Office of the Director of National Intelligence;

(2) The Central Intelligence Agency;

(3) The National Security Agency;

(4) The Defense Intelligence Agency;

(5) The National Geospatial-Intelligence Agency;

(6) The National Reconnaissance Office;

(7) Other offices within the Department of Defense for the collection of specialized national intelligence through reconnaissance programs;

(8) The intelligence elements of the Army, the Navy, the Air Force, the Marine Corps, the Coast Guard, the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Department of Energy

(9) The Bureau of Intelligence and Research of the Department of State;

https://www.govinfo.gov/link/uscode/41/4713 https://www.govinfo.gov/link/uscode/40/11101 https://www.govinfo.gov/link/uscode/47/153 https://www.ecfr.gov/current/title-32/part-2002 https://www.ecfr.gov/current/title-41/section-201-1.303#p-201-1.303(d) https://www.ecfr.gov/current/title-41/section-201-1.303#p-201-1.303(e) https://www.govinfo.gov/link/uscode/50/3003

(10) The Office of Intelligence and Analysis of the Department of the Treasury;

(11) The Office of Intelligence and Analysis of the Department of Homeland Security; or

(12) Such other elements of any department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the intelligence community.

National security system, as defined in 44 U.S.C. 3552, means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—

(1) The function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions, but does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications); or

(2) Is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy

Sensitive compartmented information means classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled within formal access control systems established by the Director of National Intelligence.

Sensitive compartmented information system means a national security system authorized to process or store sensitive compartmented information.

Source means a non-Federal supplier, or potential supplier, of products or services, at any tier.

(b) Notice. During contract performance, the Contractor shall be required to comply with any of the following that apply: DHS FASCSA orders, DoD FASCSA orders, or DNI FASCSA orders. The applicable FASCSA order(s) will be identified in the request for quotation (see 8.405-2), or in the notice of intent to place an order (see 16.505(b)). FASCSA orders will be identified in paragraph (b)(1) of FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition, with its Alternate II.

(c) Removal. Upon notification from the contracting officer, during the performance of the contract, the Contractor shall promptly make any necessary changes or modifications to remove any covered article or any product or service produced or provided by a source that is subject to an applicable Governmentwide FASCSA order (see FAR 4.2303(b)).

(End of clause)

1452.233-2 -- Service of Protest Department of the Interior (Jul 1996) (Deviation)

(a) Protests, as defined in section 33.101 of the Federal Acquisition Regulation, that are filed directly with an agency, and copies of any protests that are filed with the Government Accountability Office (GAO), shall be served on the Contracting Officer (addressed as follows) by obtaining written and dated acknowledgment of receipt from U.S. Fish & Wildlife, 4301 Fairfax Drive, Arlington, VA 22203.

(b) The copy of any protest shall be received in the office designated above within one day of filing a protest with the GAO.

(c) A copy of the protest served on the Contracting Officer shall be simultaneously furnished by the protester to the Department of the Interior Assistant Solicitor, Acquisitions and Intellectual Property, https://www.govinfo.gov/link/uscode/44/3552 https://www.acquisition.gov/far/8.405-2#FAR_8_405_2 https://www.acquisition.gov/far/16.505#FAR_16_505 https://www.acquisition.gov/far/52.204-30#FAR_52_204_29 https://www.acquisition.gov/far/4.2303#FAR_4_2303

1849 C Street, NW, Room 6511, Washington, DC 20240.

(End of Provision)

52.204-26 Covered Telecommunications Equipment or Services-Representation.

As prescribed in 4.2105(c), insert the following provision:

COVERED TELECOMMUNICATIONS EQUIPMENT OR SERVICES-REPRESENTATION (OCT 2020)

(a) Definitions. As used in this provision, "covered telecommunications equipment or services" and "reasonable inquiry" have the meaning provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) ( https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services".

(c)

(1) Representation. The Offeror represents that it □ does, □ does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument.

(2) After conducting a reasonable inquiry for purposes of this representation, the offeror represents that it □ does, □ does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services.

(End of provision)

52.201-1 Acquisition 360: Voluntary Survey.

As prescribed in 1.102-3(b), insert the following provision:

ACQUISITION 360: VOLUNTARY SURVEY (SEP 2023)

(a)All actual and potential offerors are encouraged to provide feedback on the preaward and debriefing processes, as applicable. Feedback may be provided to agencies up to 45 days after award. The feedback is anonymous, unless the participant self-identifies in the survey. Actual and potential offerors can participate in the survey by selecting the following link: https://www.acquisition.gov/360.

(b)The Contracting Officer will not review the information provided until after contract award and will not consider it in the award decision. The survey is voluntary and does not convey any protections, rights, or grounds for protest. It creates a way for actual and potential offerors to provide the Government constructive feedback about the preaward and debriefing processes, as applicable, used for a specific acquisition.

(End of provision) https://www.acquisition.gov/far/4.2105#FAR_4_2105 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.sam.gov/ https://www.acquisition.gov/far/1.102-3#FAR_1_102_3 https://www.acquisition.gov/360

United States Department of the Interior

U.S. Fish & Wildlife Service

Performance Work Statement (PWS)

INTRUSION DETECTION SYSTEM (IDS)

This Intrusion Detection System (IDS) is specified for the US Fish and Wildlife Service (FWS) Bald Knob National Wildlife Refuge Office located at 1439 Coal Chute Road, Bald Knob, AR 72010.

The contractor shall install, and make fully functional, an Underwriters Laboratory (UL) listed Intrusion Detection System (IDS) and Fire Alarm Control Panel (FACP). The system hardware (panels) shall be of a models listed below (unless equivalent is approved) and shall have the capability of expansion with expansion modules, panel tamper notification, remote monitoring, and remote annunciation using standard internet protocol-based communications.

MONITORING SOLUTIONS:

The Government will provide additional connection/monitoring information to the vendor once the vendor has offered an approved panel.

The Government may choose to contract with the U.S. Department of Homeland Security (DHS) - Federal Protective Service (FPS) for monitoring services. All systems monitored by DHS will require the completion of the DHS MegaCenter Alarm Requirements 2023 (MAR) package (Instructions are associated with the MAR package). If connected to DHS, the system will require a static Internet Protocol (IP) address that the government will furnish.

If the vendor is to provide monitoring services, the station will provide FWS-OEMPS an alarm zone data sheet obtained from the commercial monitoring company prior to acceptance of the system. Commercial monitoring may not be connected via ethernet to the FWS network and will therefore require a separate internet connection or a POTS line.

The Government may request the system be programmed to auto-arm daily (TBD).

The IDS control panel and associated power distribution hardware will be located within the Closet Storage Room of the Headquarters Building. This location must be properly ventilated to ensure appropriate cooling of electronics. The system shall be connected to the U.S. Fish & Wildlife Service network via coordination with U.S. Fish & Wildlife Service IRTM and then IP connected to the FPS MegaCenter via network. Vendor should have prior experience and knowledge of connecting IDS systems to FPS MegaCenter via internet.

A battery backup shall be incorporated into the IDS panel using a 7 AMP hour battery that will allow for a minimum of 4 hours of backup power, from initial commercial power failure.

System Panels Authorized

A. Bosch model numbers 8512G or 9512G series B. DMP model XR150 Note: Proprietary panels will not be accepted due to the inability to provide adequate support.

The doors/areas as listed in table below, shall be alarmed using appropriate methods for the types of doors and areas. All doors are to be fitted with either recessed or frame mounted magnetic contacts.

Each sensor (door, PIR, glass break, etc.) must be configured as a separate zone.

Areas – site may elect to have multiple areas configured within the system, allowing individual areas (or all areas at once) to be armed or disarmed by authorized users.

The contractor must provide a minimum of 2 hours of end-user training to facility staff prior to facility acceptance.

All components provided under this contract must be new. Used, repurposed, or refurbished equipment is not authorized for use and will not be accepted.

Offeror must provide cut sheets (specifications) for proposed system components.

Warranty: Manufacturer's standard form in which manufacturer and Installer agree to repair or replace components of intrusion detection devices and equipment that fail in materials or workmanship within one year from date of Substantial Completion.

Equipment required (see tables below for locations):

1 Intrusion Detection Panel (Network connection) 1 Wireless Receiver 2 Keypads 4 Magnetic Door Contacts 12 PIR Motion Detectors

Headquarters Building Device Table

DEVICE LOCATION DEVICE TYPE

Closet Storage Room PANEL - in enclosure that shall be mounted to a ¾“plywood backer board affixed to the room wall and connected to the internet for transmission to the CMS.

Closet Storage Room WIRELESS RECEIVER - installed at main panel 2 Keypads 2 KEYPAD - Touch Screen Keypad or Wireless Screen

Keypad (or equivalent).

12 PIR Motion Detectors 12 – WIRELESS PHOTO INFRARED MOTION

DETECTOR(S) – Ceiling mounted - PIR Motion Detector installed with no gaps in coverage

2 Exterior Single Doors 1 Exterior Double Door

4 – MAGNETIC CONTACT (recessed) - Recessed Door Transmitter - WH 3/8" diam min press mag fit contact (or equivalent)

Marked Floor Plan Color Chart

Color Device Red Dot IDS Panel Blue Dot PIR Motion Detectors Green Dot Door Contacts Yellow Dot Keypads Orange Dot Wireless Receiver

See marked floorplan below.

Removal of the old fire system

New DMP panel XF500 fire panel will one for one replace the current compatible compliant DMP system. Three Pull station, 8 Wall Mounted strobes, and 1 Fire Panel. One additional Smoke Detector will be added for a total of 4 Smoke detectors.

The current Fire Panel location in Mud Room will be relocated to the Closet Storage Room.

Purple Square New Fire Panel

Complete table description of FACP and device layout

Information Technology Baseline Compliance Contract Guidelines

July 2022

Table of Contents Introduction

Section 1.0 – Information Technology and Cybersecurity Requirements

A. Applicability B. Requirements C. Information Systems D. Cloud E. Internet Protocol Version 6 (IPv6) F. Continuous Monitoring G. Security Training and Reviews H. Contractor Reporting Requirements

Section 2.0 – Cybersecurity Incident Response

A. Applicability B. Definitions C. Requirements

Section 3.0 – Privacy Requirements

A. Applicability B. Definitions C. Privacy Act Requirements D. Privacy Controls E. Privacy Breach Reporting Requirements F. Privacy Training Requirements

Section 4.0 – Accessibility Requirements (Section 508)

A. Applicability B. Requirements

Section 5.0 – Records Management Requirements

A. Applicability B. Definitions C. Requirements

Section 6.0 – Contractor Personnel Security Requirements

Section 7.0 – Controlled Unclassified Information Requirements

A. Applicability B. Definitions C. Authorities D. Requirements E. Training

Section 8.0 – Paperwork Reduction Act of 1995

Section 9.0 – Reference Documents

Section 10.0 – Glossary

DOI Baseline Compliance Contract Guidelines 2 | Page

DOI Baseline Compliance Contract Guidelines 3 | Page

Introduction This document provides guidance regarding requirements that must be reviewed and considered for incorporation, where applicable, in all Department of the Interior (DOI, Department) contract actions that involve information technology (IT) products or services. Contracting Officer Representatives (CORs) and/or the requirement owners should work closely with their Bureau or Office Associate Chief Information Officer and Contracting Officer (CO) to ensure the below requirements are properly addressed in IT contracts within the appropriate sections. Any referenced regulation or policy should be provided to the Contractor via hypertext link or other means.

Section 1.0 – Information Technology and Cybersecurity Requirements A. Applicability

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Requirements Information systems and system services provided to the Department by the Contractor must comply with DOI IT Cybersecurity and Privacy Control Standards, privacy policies, and other related guidance. Contracts that involve Industrial Control System (ICS) products and services should be evaluated on an individual basis and contain language specific to ICS. Please contact the Bureau of Reclamation (BOR) at ICSsecurity@usbr.gov for ICS issues and guidance.

The Contractor and the contractor-managed systems shall comply with all federal regulations and guidance, including but not limited to:

1. Federal Information Security Modernization Act of 2014 (FISMA) accessible at https://www.cisa.gov/federal-information-security-modernization-act

2. Federal Risk and Authorization Management Program (FedRAMP) for cloud hosted systems accessible at https://www.fedramp.gov

3. Section 208 of the E-Government Act of 2002 accessible at https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW- 107publ347.pdf

4. Privacy Act of 1974 accessible at https://www.justice.gov/opcl/privacy-act-1974

5. Federal Information Processing Standards (FIPS) and the National Institute of

Standards and Technology (NIST) 800-Series Special Publications (SP) accessible at https://www.nist.gov

6. Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource, accessible at https://www.cio.gov/policies-and-priorities/circular-a-130/

C. Information Systems The Contractor shall manage information in accordance with applicable laws, regulations, executive orders, and policies regarding the marking, safeguarding, and dissemination of mailto:ICSsecurity@usbr.gov mailto:ICSsecurity@usbr.gov https://www.cisa.gov/federal-information-security-modernization-act https://www.cisa.gov/federal-information-security-modernization-act https://www.fedramp.gov/ https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.justice.gov/opcl/privacy-act-1974 https://www.justice.gov/opcl/privacy-act-1974 https://www.nist.gov/ https://www.nist.gov/ https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.cio.gov/policies-and-priorities/circular-a-130/

DOI Baseline Compliance Contract Guidelines 4 | Page

Controlled Unclassified Information (CUI). Personally Identifiable Information (PII) is a subset of information designated as CUI, and Sensitive PII is a subset of PII that requires additional controls and safeguards. (See section 3, Privacy Requirements)

The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

Contractor Information Systems shall comply with FISMA. The Contractor shall provide an Assessment and Authorization (A&A) documentation package for each system that complies with Federal Information Processing Standard (FIPS) 199, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34, NIST SP 800-37, NIST SP 800-53, NIST SP 800-60, et al.

The Contractor cryptographic modules used to protect DOI information shall comply with the current NIST FIPS 140 version and be validated by the Cryptographic Module Validation Program.

Access to all government data stored outside the confines of a DOI-managed data center shall comply with Trusted Internet Connections (TIC) requirements.

All Contractor personnel requiring access to DOI information data and/or systems shall be cleared at appropriate levels as set forth:

1. Low Risk position will require a National Agency Check with Written Inquiries (NACI) or equivalent investigation.

2. Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI).

3. High Risk position will require a Background Investigation (BI).

Vulnerability Scanning - All IT systems providing services to or on behalf of the Department or storing, processing, or routing DOI CUI information must be scanned monthly with a vulnerability analysis tool using authenticated scans that are acceptable to DOI. Vulnerabilities and weaknesses shall be remediated in accordance with (IAW) Department-mandated time frames commensurate with the level of risk.

D. Cloud All Contractor cloud-hosted Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) or other “as a Service” offerings shall comply with applicable language within the DOI cloud hosting program guidelines.

E. Internet Protocol Version 6 (IPv6) The applicability of IPv6 to DOI-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the Department Acquisition, Arts, and Asset Policy DOI-AAAP-0055, Procuring Internet Protocol Version 6 (IPv6), (per OMB Memorandum M-05-22, August 2, 2005) and with subsequent federal requirements (OMB Memorandum M 21-07 Transition to IPv6, September 28, 2010) regardless of whether the

DOI Baseline Compliance Contract Guidelines 5 | Page acquisition is for modification, upgrade, or replacement. All Enterprise Architecture related component acquisitions shall be IPv6-compliant as defined in the U.S. Government Version 6 (USGv6) Profile (NIST SP 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program. In cloud service procurements, IPv6 compliance should be pursued where practicable.

F. Continuous Monitoring All Contractor-operated systems that input, store, process, output, and/or transmit DOI CUI shall meet or exceed the continuous monitoring requirements identified in the DOI Continuous Monitoring Plan or the Bureau or Office Continuous Monitoring Plan, whichever best fits mission, security, and risk management needs.

Contractor-managed systems are required to have an assigned Information System Security Officer (ISSO) and System Owner (SO) to support the processes described in the contract. While the procuring organization designates government personnel to serve in these roles, the contractor must provide functionally equivalent personnel to enable effective day-to-day operation, management, and monitoring of the system. The Contractor ISSO and SO resources are required to comply with DOI- or other-approved annual and Role Based Security Training (RBST) requirements.

Contractors managing systems on behalf of the Department are required to submit Continuous Monitoring Reports per the Continuous Monitoring Plan to the federal point of contact designated in the contract per the timelines prescribed in the Continuous Monitoring Plan. The Contractor-managed systems may be required to submit to a penetration test (at the discretion of the awarding program) in coordination with DOI cybersecurity personnel or approved contract officials.

When required by the contract, the Contractor must provide the following in alignment with DOI’s continuous monitoring strategy:

1. account management

2. vulnerability management

3. patch management

4. antivirus

5. malware detection

6. event management

7. configuration management

8. license management

9. incident management

G. Security Training and Reviews All users of federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing federal information systems under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and

DOI Baseline Compliance Contract Guidelines 6 | Page be completed on an annual basis thereafter. New Contractor employees assigned to the contract shall complete the training before accessing federal information systems under the contract. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than thirty

(30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification each year. The e-mail notification shall state that all Contractor and subcontractor employees have completed the required training.

The government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced, particularly when contractors build and operate or maintain systems on behalf of the Department. In such cases, the Contractor shall afford DOI, the Office of the Inspector General, and other government organizations access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor shall provide access, to the extent necessary as determined by the government, for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of government data or the function of computer systems used in performance of the contract and to preserve evidence of computer crime. Cloud Service Providers should not be expected to grant physical access to government inspectors.

H. Contractor Reporting Requirements The Contractors operating information systems on behalf of the Department shall comply with FISMA reporting requirements. Department system owners shall coordinate annual and quarterly data collection. Contractors must provide DOI with the requested information based on the timeframes provided with each request. The Contractor systems shall comply with near real time feeds in accordance with Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) requirements as coordinated by DOI. Reporting requirements are determined by OMB and may change each reporting period.

The Contractor-managed systems shall adhere to NIST 800-53 and submit to an annual assessment performed in coordination with DOI cybersecurity personnel or approved contract officials. All results of the annual assessment become the property of the Department.

The Contractor shall comply with DHS or other government oversight bodies regarding cybersecurity-related mandates and directives (Binding Operational Directives [BOD], etc.) or any additional ad-hoc reporting requirements.

Section 2.0 – Cybersecurity Incident Response A. Applicability

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions.

DOI Baseline Compliance Contract Guidelines 7 | Page

As used in this term-

“Incident” means an occurrence that

1. actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

2. constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

C. Requirements All Contractor employees and information system service providers shall be responsible for recognizing and reporting security incidents. Information system service providers shall receive the current version of the DOI Incident Response Plan, Policy, and Handbook at the time of award, in addition to bureau- or office-specific guidance for appropriate reporting and response at all levels. All suspected or confirmed information security incidents shall be reported in accordance with the requirements listed below, even if it is believed the incident may be limited, small, or insignificant. For hosting environments, including cloud systems and services, this includes incidents occurring on the service provider’s underlying infrastructure supporting containers utilized by the Department. In such cases, the vendor’s primary security operations and/or incident response unity shall engage directly with the DOI Cyber Security Operations (CSO) Section and provide DOI CSO with security and event logs covering the period of the incident and up to six months prior. The DOI CSO and Bureau or Office Incident Response Teams will determine when an incident requires additional focus and attention.

All Contractor employees and information system service providers shall report all information security incidents to the appropriate Bureau or Office Incident Response Team and to the DOI Computer Incident Response Center (DOI CIRC) immediately, no later than 1 hour after “becoming aware of the incident,” at DOICIRC@ios.doi.gov, (703) 648-5655, regardless of day or time. Any contractor action to investigate, identify, respond to, contain, remediate, or recover from a security event (which includes “suspected” incidents) constitutes “becoming aware of the incident.”

When notifying the DOI CIRC and the appropriate Bureau or Office Incident Response Team, the Contractor shall include the CO and COR on the correspondence email to DOICIRC@ios.doi.gov and the appropriate Bureau or Office Incident Response Team. If the Contractor reported the incident by phone, then immediately following the reporting, the Contractor shall notify the CO and COR via e-mail. The Contractor is responsible for verifying that all notification was received and acknowledged by the CO or COR. If the Contractor has any questions regarding these procedures, they shall contact the CO or the COR.

The Contractor shall not include any controlled information in the subject or body of any e-mail.

Contractor shall transmit controlled information using validated encryption methods compliant with the current NIST FIPS 140 version to protect controlled information in e-mail attachments.

Passwords must not be communicated in the same email as the attachment. Contractor shall contact the CO or COR if encryption software is needed for guidance on appropriate, federally approved encryption methods.

mailto:DOICIRC@ios.doi.gov mailto:DOICIRC@ios.doi.gov mailto:DOICIRC@ios.doi.gov

DOI Baseline Compliance Contract Guidelines 8 | Page

Section 3.0 – Privacy Requirements A. Applicability.

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions.

As used in this term-

Breach: the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other-than-authorized purpose.

1. PII - information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

2. Sensitive PII (SPII) is a subset of PII that, if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. SPII is CUI and requires additional controls and safeguards to protect the privacy of individuals. Sensitivity of PII may depend on specific PII elements, groupings of PII, context or use of PII, or requirements under applicable federal laws, regulations, and policy such as the Privacy Act of 1974 and the CUI Rule. SPII includes but is not limited to full or truncated Social Security Number (SSN), driver's license or state identification number; financial account number; date of birth; citizenship; ethnic or religious affiliation; biometric identifiers such as fingerprint, voiceprint, or iris scan; medical information; criminal history; and system authentication information such as passwords, personal identification numbers or mother's maiden name.

C. Privacy Act Requirements The Contractor shall comply with the requirements of the Privacy Act of 1974 and shall not remove PII or Privacy Act material from government facilities or systems, or facilities or systems operated or maintained on the government’s behalf, without the express written permission of the Head of the Contracting Activity. When Privacy Act records, information, data, documentary material, and equipment is no longer required, the Contractor shall return it to the Department’s control or hold it until otherwise directed. Items returned to the government shall be hand carried, mailed, emailed, or securely electronically transmitted to the CO.

D. Privacy Controls The Contractor shall meet the privacy requirements of the E-Government Act, FISMA, applicable federal privacy laws, NIST, OMB, and DOI (including but not limited to those listed in the contract table of authorities) for the collection, handling, processing, and sharing of PII, and ensure compliance with the privacy controls requirements of NIST SP 800- 53, FIPS 199, DOI Baseline Compliance Contract Guidelines 9 | Page

FIPS 200, and DOI Privacy Control standards as appropriate for the sensitivity of the system.

The Contractor shall monitor the information system and update controls for continued privacy compliance on an ongoing basis and shall provide status reports to the Department upon request.

The Contractor shall be required to provide all necessary support to assist the Department in meeting the requirements of the Privacy Act and related laws and shall provide supporting documentation and access to information upon request by authorized agency officials. Support in this context includes timely responding to requests for information from the Department about the access, creation, collection, use, storage, maintenance, transmission, sharing, or disposition of PII on the Contractor’s system or processes, and providing timely review of relevant compliance documents for factual accuracy.

E. Privacy Breach Reporting Requirements The Contractor shall provide notice to DOI CIRC or the appropriate Bureau or Office Incident Response Team of any known or suspected breach of PII and meet breach reporting and mitigation requirements in accordance with the DOI Privacy Breach Response Plan or bureau or office applicable response plan.