DRAFT PWS RFI for CCTV Cameras at Detroit VAMC Police.docx

Equipment, CCTV Cameras, Licenses and Installation, Detroit VAMC, Police

VA-25-00093311

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

John D. Dingell VA Medical Center Police Unit

Equipment, CCTV Cameras, Licenses and Installation, Detroit VAMC, Police

Date: August 6, 2025

VA-25-00093311

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA) Office of the Senior Security Office/Physical Security and Infrastructure Office, along with the John D. Dingell VAMC Directors Office and VA Police Department requires a modernized security camera system with analytics in order to comply with the VA 0730 Handbook, Security and Law Enforcement, and the OIT VA Directive 6517, 6518, 6500 (6500.6 and 6500.11), 6008 along with the OIT Strategic Plan and Veterans Affairs Enterprise Architecture Principles, in addition to:,

· Presidential Executive Order 14111, dated November 27, 2023, aims to enhance the quality and effectiveness of security measures and protections in Federal facilities while modernizing these programs and technologies to meet current industry standards.

In addition to security measures, the VA has been charged by the U.S. Office of Management and Budget and the White House with the following:

· Presidential Executive Order 14028, titled “Improving the Nation’s Cybersecurity,” was issued on May 12, 2021. This order focuses on advancing agencies toward a Zero Trust architecture and accelerating the transition to secure cloud services.

· Presidential Executive Order 12997/13286 established the Interagency Security Committee, which aims to enhance the security and protection of federal facilities across the United States.

· Presidential Executive Order 13800, titled "Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure," was issued on May 11, 2017. The order aims to enhance the nation's cybersecurity posture and capabilities by focusing on the modernization of federal IT infrastructure and the protection of critical infrastructure.

· Guidance issued on February 26, 2025, aims to implement technological solutions that automate routine tasks, allowing staff to concentrate on higher-value activities. This guide also outlines plans to reduce costs and promote efficiency by adopting new software systems and eliminating duplicate systems.

Due to these orders, the John D. Dingell VAMC requires a modernized security system that will enhance security, provide an easy-to-use system, minimize on-premises infrastructure, and increase the VA’s cybersecurity posture while meeting National Defense Authorization and Trade Agreements Act manufacturing rules according to the 2023 FAR clauses while complying with Federal Information Security Management Act (FISMA). The VA Police require that the new system to be able to integrate with the VA Police’s Body Worn Camera Solution (Axon) and other VA Police Enterprise VA Police Solutions as a Service product with Camera’s and software itself. The solution will need to be outfitted for the John D. Dingell VAMC located at 4646 John R. Street, Detroit, MI 48201.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

SCOPE OF WORK

The Contractor shall provide all equipment, services, and solutions as a service as defined in the Contractor’s response to the contract as needed. The Contractor shall provide, as per the contract, all materials needed to properly install and configure the physical security system, which will be delivered to the addresses specified in the contract, which is 4646 John R. Street, Detroit, MI 48201, with attention to “Police Unit – Brandi Gutierrez”. The Contractor shall complete installation as per the contract and the contract documents. The Contractor shall remove existing equipment. The VA Logistics Office will be responsible for disposal of old equipment. The Contractor shall provide new equipment (not used or refurbished), and all installation labor and materials required for the security system. The Contractor shall execute the installation and programming of the proposed new modernized CCTV Security Surveillance System at John D. Dingell VAMC. The Contractor shall have the SaaS solution either FedRAMP Approved or FedRAMP Ready on the FedRAMP Marketplace (FedRAMP Marketplace) and provide the VA OIT’s FedRAMP Validation and Authority to Operate (ATO) process documentation as part of the contract.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be from the date of award of FedRAMP ATO Approval and VA ATO Approval base is 12 months along with 5 years total for the Licenses for Government use. The overall period of performance for installation shall not exceed 12 months from the date of award of the FedRAMP and VA ATO approval. The FedRAMP ATO Approval and VA ATO Approval are FISMA Law and would be a conditional factor for the contract as per the SaaS language in the contract as part of the deliverables.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). No overtime is authorized unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks outlined in this PWS will be carried out at VA facilities, specifically at the John D. Dingell VA Medical Center, located at 4646 John R. Street, Detroit, MI 48201. Work may also be performed at remote locations, provided prior approval is obtained from the Contracting Officer’s Representative (COR).

TRAVEL

The Government does not anticipate travelling under this effort to perform the tasks associated with the effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

The Contractor shall provide and maintain program management expertise. The Contractor shall use proven and mature industry standard program management practices and processes in the execution of the this contract. The Contractor shall manage and have oversight of all activities performed by Contractor personnel, including Sub-Contractors. The Contractor shall identify a Program Manager (PM) by name who shall provide management, direction, administration, quality control, and leadership of the execution of program and tasks within this PWS.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide to the COR Weekly Progress Reports. The reports shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The reports shall also identify any problems that arose and provide a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The reports shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Weekly Progress Report

TECHNICAL KICK-OFF MEETING

The Contractor shall hold a Technical Kickoff Meeting within five business days after award, onsite at a VA facility (location to be determined, some attendees may be virtual). The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort as well as the draft CPMP. The Contractor shall provide Kickoff Briefing detailing the information to be covered at the meeting in Microsoft (MS) PowerPoint format. The Kick-off Briefing shall be provided for all attendees one calendar day prior to the meeting. The Contractor shall provide Kickoff Meeting Minutes to all attendees within three calendar days after the meeting. The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM. The VA PM will notify the Contractor if any additional VA Police Officials are required to attend. In preparation of the technical kickoff meeting, the Contractor shall compile a Kickoff Meeting Agenda in MS Word and provide it to the VA PM no later than three days prior to the kickoff meeting.

The Contractor shall discuss the following at the kickoff meeting:

1. A high-level management approach that addresses the scope, resources, project assumptions, constraints, task objectives, key milestones, Contractor’s project organization and Contract administration, delivery schedule, and deliverables.

2. A high-level work plan for all activities that addresses on, and off-site personnel support expected by month for the installation and support services afterwards for the SaaS product.

3. Identification of Key Personnel, and Staffing/Resource Planning.

Deliverables:

A. Kick-off Briefing B. Kick-off Meeting Minutes C. Kick-off Meeting Agenda

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

The new CCTV Security Surveillance System is referred in this section as “solution”.

The solution shall have the ability to enhance security and have motion intrusion and alerting capabilities in a cloud-managed platform. In addition, it must provide an easy-to-use system, minimize on-premises infrastructure, and increase the VA’s cybersecurity posture while meeting the National Defense Authorization and TAA manufacturing rules according to the 2023 FAR clauses while complying with the Federal Information Security Management Act (FISMA).

· SaaS compliance with:

· FISMA Law FedRAMP Ready or Approved

· NDAA and TAA

· SOC 2 Type II

· UL / CUL 62368-1 certification for video, information, and communication technology equipment

The solution shall provide a fully integrated architecture of easy-to-scale hardware and an easy-to-use video management SaaS solution provided by the same manufacturer viable on many devices while managing bandwidth efficiently at scale. The solution shall utilize a SaaS solution that allows for advanced analytics, including the ability to quickly locate people or vehicles of interest across a site, thus quickly reducing incident response time and minimizing the time security personnel devote to the technological side of investigations.

The solution shall have the capability for all data to be able to be stored encrypted locally on each physical camera device on a solid-state drive to prevent any data breach, along with the ability to stream and archive data continuously and indefinitely to the cloud to prevent any loss of data. This solution shall have the hardware and software offered as a single solution. A graphical interface shall be provided by the same manufacturer and have role-based access control (RBAC) that is configurable by government personnel. Audit trails shall be built into the software solution and provided natively, as well as notifications, alerts, and the ability to operate the products without adding or needing any servers.

The Contractor shall provide the following capabilities and features in a Hybrid-cloud security platform with all products managed through a single pane and:

1. A solution that is either FedRAMP Authorized or FedRAMP Ready and must go through the VA's validation process to receive a VA ATO.

2. A SaaS solution operating in FedRAMP Government Cloud (AWS GovCloud, Microsoft Azure, or equivalent).

3. A solution that provides 24/7 US-Based 1-800 technical support team that can be reached by phone, email, or in-platform chat included at no additional cost.

4. The SaaS browser-based solution with Single Sign On with PIV/CAC Multifactor Authentication that includes:

a. FedRAMP Control process approved

b. Identity Provider Integrations via Security Assertion Markup Language (SAML) and System for Cross-domain Identity Management (SCIM) (Active Directory Federation Services (ADFS), Azure Active Directory (Azure AD), Okta)

c. Capability for a browser-based client that can be accessed across multiple platforms (to include Windows, Chrome OS, MacOS, iOS, and Android) without using proprietary plugins like Java, Silverlight, or Flash

d. Audit logs

e. Role-based access control natively in the SaaS

f. Auto software updates, updates, and continuous penetration testing at no cost

g. System to have mobile client or mobile device accessibility to securely access and view footage both on and off site at any time and to conduct person/vehicle analytics via the mobile device as well.

h. Emergency Access, audited for usage, sharable content to authorized law enforcement that can view selected cameras

i. Ability to remotely manage users and cameras across multiple sites

j. Certain custodians may view cameras at multiple locations

5. Data encryption in transit and at rest- FIPS 140-2 encryption standard

a. In Transit AES-128

b. At Rest AES-256

6. Archive video footage with unlimited cloud storage stored indefinitely

7. Software licensing for 5-year option

8. Does not require an NVR or DVR

9. The solution should be modular to allow additional devices at any time

CAMERA SPECIFICATIONS:

The solution shall have cameras that:

· Have built in solid-state hard drive capable of recording for immediate use of 30 days of continuous recording but has the ability for future use of up to 365 days of continuous video

· Are FIPS 140-2 validated and TAA complaint

· Are plug-and-play IP, PoE-based cameras

· Receive firmware and software updates pushed automatically via the cloud at no additional cost as part of the camera or product licenses

· Have a minimum of resting bandwidths 20-50kbs and low bandwidth mode options

· Have Bandwidth Management Tuning Capabilities

· Have a 10-year warranty on all fixed camera and gateway hardware

· Include all of the following detection and analytics capabilities at no additional cost:

· People/vehicle analytics

· Occupancy Trends

· Trajectory Tracking

· Line Crossing

· Loitering

· Live Face Blur

· Alarms People Detection

· License Plate Recognition (Bullet cameras only)

· Privacy Zones

· Tamper Alerts

· Motion and Crowd Alerts

· Status (online or offline)

· Include 30-day Cloud Backup, with additional able to be purchased

· Provide RTSP capabilities

· Operate in Temperature ranges of: -40 F- 122 F

· Have unlimited archive storage capabilities in the SaaS solution

· Have the ability to provide up to 5MP to 4k/10K image resolution (3840 x 2160)

· Are IP67 rating to protect against dust and environmental elements for outdoor cameras

· Have Accelerometers for tamper-proof capability

· Have IK8 vandal resistant rating or above

· Have Built-in Infrared illumination

· Have the capability to produce video at a minimum 24 FPS or more

· Have image stabilizing to reduce blurring

· Have Day and Night viewing and recording capability

· Have Standard RJ45 connectivity, including Power Over Ethernet (PoE)

· Have motion detection either as a camera option or an option on the management interface

· Have the capability to perform computer vision analytics at the edge (on device)

· Have the ability to see remote locations and run analytics with offsite viewing

· Provide all the proper device mounting kits and proper installation

SOW REQUIREMENTS:

The Contractor shall provide with the new CCTV Security Surveillance System the following:

a) Indoor Dome Camera, with minimum of 30 days’ video storage on camera with 512GB,

1. An IR range of 130 feet

2. Sensor Resolution 4K

3. Is FIPS Validated and TAA Compliant

4. Quantity: 33 units

b) License for cameras hosted on a government cloud (Amazon Web Services (AWS) GovCloud, etc.),

1. include 24/7 US-based support

2. 5 years licensing

3. Quantity: 33 units

c) Associated mounting equipment for cameras as required The Contractor shall ensure that the new CCTV Security Surveillance System is able to integrate with the VA Police’s Body Worn Camera Solution (Axon) and other VA Police Enterprise VA Police Solutions as a Service product, as required by VA Police, and to be a Solution as a Service with Camera’s and software itself.

JOHN D. DINGELL VAMC INSTALLATION INSTRUCTIONS:

MAIN LOCATION: 4646 John R. Street, Detroit, MI 48201

1. The Contractor shall provide installers who are fully accredited installers of the required cameras and system being installed.

2. The Contractor shall ensure required staff and Veterans Affairs (VA) Police will have access to the Cameras and the SaaS products for proper CCTV Physical Security surveillance practices and FedRAMP ATO process, SOP, and controls.

3. Each camera shall come with access to the SaaS back-end product for the VA Police and VA Staff to view said physical security surveillance needs and proper 5-year Camera Licenses for Government use.

4. The Contractor shall provide on-site training with both VA Police Services and OI&T for new system requirements as well as continued training during additional product enhancements, which happen quarterly.

5. The Contractor shall provide a Mapping Document that shows mapping of all cameras to be removed, replaced, and installed to include any instructions to the VA for power, Network Connectivity or other.

CLARIFICATIONS:

1. All grounding and bonding required will be supplied by the Government.

2. All network needs will be provided by the Government.

3. VA will provide any wiring and J-hooks for installation, but Contractor shall install the wiring and J-hooks. Installed wiring will utilize limited j-hooks as required. J-hooks are intended and will be installed for secondary infrastructure pathways ONLY. All pathways to include ladder rack, wire basket, wire trough, and conduit and backboxes required will be supplied by the customer.

NOTE:

VA will provide the following:

1. The UPS PAC for the system.

2. The VA backbone network availability for the new CCTV Security Surveillance System.

3. The ports and switches for network connectivity.

4. Network cables available from VA OIT, for the Contractor to install from camera to telecommunications room closet.

5. All the approvals and network security to allow the CCTV Security Surveillance System to communicate with the SaaS solution.

6. All the Virtual Local Area Networks (VLANS), IT Whitelist access for hardware to access the VA network securely, and provide a VA Product Stream Lead (PSL) and an Implementation team to track and help the Contractor complete the installation tasks and Program/Project Management.

WARRANTY:

The Contractor shall provide the standard manufacturer warranty for all installation of equipment and accessories. The warranty period shall begin when the item(s) is received by the Government if it passes the subsequent inspection by the VA Police personnel - not when the product is manufactured. The Contractor shall notify the COR within ten (10) calendar days of any recall notices, warranty replacements, safety notices or other issues regarding the equipment and accessories.

Recall Notices. The Contractor shall notify the Contracting Officer and the COR, in writing, within ten (10) calendar days of any recall notices, warranty replacements, or other safety issues regarding the equipment and accessories furnished under this contract. Failure to notify the Contracting Officer and the COR may result in the termination of this contract.

CLARIFICATIONS:

Installed wiring will utilize plenum-rated cable as required, and the Contractor shall include the conduit in the quoted price.

DELIVERABLES:

A. Mapping Document

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

FEDERAL RISK & AUTHORIZATION MANAGEMENT PROGRAM

The Federal Risk and Authorization Management Program (FedRAMP) is an innovative policy approach to develop trusted relationships between Executive departments and agencies and cloud service providers (CSPs). FedRAMP reduces duplicative efforts, inconsistencies and cost inefficiencies associated with current security authorization process. FedRAMP establishes a public-private partnership to promote innovation and the advancement of more secure information technologies. FedRAMP will enable the Federal Government to accelerate the adoption of cloud computing by creating transparent standards and processes for security authorizations and allowing agencies to leverage security authorizations on a government-wide scale. The Contractor shall be compliant with FedRAMP.

The Contract shall be FedRAMP compliant category Moderate/High.

If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements for Moderate Impact and must be in either a FedRAMP ready or FedRAMP authorized status as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. CSC subscribes to the SaaS offer and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain the following key characteristics:

1. On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

2. Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

3. Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

4. Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

5. Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must comply with FedRAMP requirements surrounding data location within the Continental United States. FedRAMP specifies data location requirements in the High baseline as part of control SA-9 (5); however, FedRAMP does not provide or specify data location requirements for other baselines. CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization Process.

1. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

2. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is Moderate Impact.

3. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 75 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 94 calendar days after contract award.)

4. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

5. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after the contract award. (If Data Security Categorization is High Impact, this will be due after 113 calendar days after contract award.)

6. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA. (If Data Security Categorization is High Impact, this will be due 113 calendar days after the SSP is accepted by VA.)

7. The Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Tabletop Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SSP being delivered.

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

9. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information, and Information System Security/Privacy Language.

10. The Contractor shall comply with data management requirements.

11. Successful issuance of a VA ATO will be required before living in VA data can be used in the system.

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation.

B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario If the solution is FedRAMP Authorized but not VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The system must be FedRAMP Authorized at no less than the Moderate Impact Level and must be in either a FedRAMP ready or FedRAMP authorized status

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

6. The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. The Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Tabletop Exercise with VA Stakeholders. This should be completed within 30 calendar days of VA gaining access to the SSP.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information, and Information System Security/Privacy Language.

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before living in VA data can be used in the system.

Deliverables:

A. VA Implementation Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation.

C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

If the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as Level Moderate and must be in either a FedRAMP ready or FedRAMP authorized status.

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information, and Information System Security/Privacy Language.

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before living in VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

Deliverables:

A. Continuous monitoring security artifacts B. Continuous monitoring scans C. Plan of Action and Milestones reports.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered the application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and can use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proof for each Identity Assurance Level (IAL) is appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) is appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level…