DRAFT PWS Servicing Computrols BAS CGVAMC.docx

Servicing Computrols Building Automation Systems

VA-27-00004994

DRAFT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) Western North Carolina Health Care System Charles George VA Medical Center (VAMC) Asheville, North Carolina

Servicing Computrols - Building Automation Systems

Date: August 27, 2026

VA-27-00004994

PWS Version Number: 2.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner.

The Charles George VA Medical Center (VAMC) requires ongoing support and maintenance for its existing Building Automation System (BAS) Computrols, to ensure optimal operation, energy efficiency, and safety. The facility requires a Computrols Subject Matter Expert. The contractor will have to assess the system and make necessary modifications to the system to return it to a stand-alone system located on-site. The Contractor will address system inefficiencies and potential malfunctions.

VA is seeking a contractor to furnish all labor and equipment necessary to maintain the BAS at Charles George VAMC in accordance with system manufacturer and VA. The current main front end for this system is a custom multiple server arrangement that has Computrols migrating to Tridium Niagara front end or enterprise system with a hardware platform consisting of five (5) servers and software applications supporting but not limited to the ABB, American Automatrix, Computrols, Cisco, and Tridium Niagara

There are also third party and integrated systems interconnected to the campus system including but not limited to the following: Johnson Controls Legacy system (N2 protocol, American Automatrix (Legacy System), Eaton, a Linux based Web Server array Appliance, and a new Tridium Niagara server. The network is comprised of a Cisco Business class 350 network which utilizes ethernet and fiber optic multimode network for the main tier infrastructure within the hospital operating at 2GB. The second-tier network which provides connections to all of the main controllers is accomplished through 1 Gigabyte (GB) ethernet connections utilizing Category (CAT) 6E cabling. These systems monitor, control, and provide alarms for critical Heating, Ventilation, and Air Conditioning (HVAC) and related systems that provide the proper engineering environment for mission critical hospital operations.

The contractor shall provide all necessary labor, materials, tools, equipment, and supervision for the installation, implementation, operation, and maintenance of the Computrols BAS at the Western North Carolina Health Care System, Charles George VAMC.

Computrols Service and Maintenance Contractor shall not serve as the Charles George VAMC independent reviewer of BAS new projects impacting the BAS and not place requirements nor restrict competition for any controllers or software in current projects or service.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

83. CFM TIL Section 23 05 11 – Common Work Results for HVAC, https://www.cfm.va.gov/til/

84. CFM TIL Section 23 09 23– Direct-Digital Control System for HVAC, https://www.cfm.va.gov/til/

85. CFM TIL Section 25-10-10– Advanced Utility Metering System, https://www.cfm.va.gov/til/

86. CFM TIL Section 27- Communications, https://www.cfm.va.gov/til/

87. VA Enterprise Facility IT Support Infrastructure Standard, https://www.cfm.va.gov/til/

88. Infrastructure Standard for Telecommunication Spaces, https://www.cfm.va.gov/til/

SCOPE OF WORK

The Contractor shall provide maintenance of VAMC BAS at Charles George VAMC in accordance with system manufacturer specifications and VA policies. This contract shall include hardware maintenance, software maintenance, training, software development, software customization, software repair, and hardware repair.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from the date of award. The overall PoP shall not exceed 12 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this Performance Work Statement (PWS) shall be performed in VA facility, Charles George VAMC, located in Asheville, North Carolina as stated within this PWS.

TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort. Travel time is not included in this contract.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform maintenance on the Charles George VAMC BAS. The BAS for purposes of this agreement, shall include all control systems connected to the BAS that are used to monitor and control critical systems throughout the hospital via independent network. This includes the Personal Computers (PCs), servers, software, programming, graphics, data, and communication network of the BAS. Instances of this equipment are air handlers, exhaust fans, refrigeration systems, chillers, cooling towers, isolation room controls, potable water controls, domestic heating systems, etc. Also included are the components in the field used to monitor, enable, and control the systems such as positioners, actuators, communication panels (to include all their panel contents, sensors, relays, inputs and outputs, controllers, software, power supplies, Uninterruptable Power Supplies (UPS), panel parts) to the final components that display data and/or are controllable. This includes any equipment installed after its warranty phase.

PROJECT MANAGEMENT

Services shall include at least 1,248 hours of available technician time to assist the facility in the maintenance and operation of the Computrol system at the Charles George VA Medical Center. These hours will be utilized on site visits as well as online support. The facility anticipates an average of three (3), eight (8) hours by Qualified Technician per week for one year. However, visits per week will be adjusted to the needs of the facility, by the Contractor’s project manager, and VA staff, to include the VA PM, Contracting Officer’s Representative (COR), HVAC Supervisor, or Boiler Plant Operators. Controls vendor will perform the Services using factory-trained technicians specializing in Direct Digital Control (DDC) system maintenance and repair service. The Contractor will provide detailed reports of the services performed on each inspection and or repair prior to departing the facility at the completion of the visit. This report will include equipment log readings taken during the inspection, the condition of equipment, repairs, and/or services performed. The technician is to check in with the COR upon arrival at the site and meet with the Boiler Plant Operators and HVAC Supervisor to discuss current issues, needs, and priorities for the visit. Issues, diagnosis, and repairs will take priority over inspections. The technician shall also work with 3rd party vendors for integration and system collaboration and assist with VA modernization.

Deliverables:

a) Inspection Report

REPORTING REQUIREMENTS

The Contractor shall provide the COR with a Monthly Progress Reports in electronic form in Microsoft Word. The report shall clearly and concisely describe the data of services rendered, parts replaced, and repairs performed, the report will be in the form agreed with and approved by the COR and structured according to system. The report shall prescribe current problems anticipated future needs of the equipment and systems for preventive and predictive maintenance. The report shall be submitted to the COR within three working days following the last day of each month.

0. Monthly meetings

a) Maintain deficiency log and status of repairs, invoices, payments, and flex hours,

b) Attend virtual Monthly meetings to review reports, repair logs, and deficiency logs,

c) Maintain soft and hard copies of all preventive maintenance to review during monthly review meetings,

d) Provide Annual report of work performed on the site,

e) Account Manager must be present for the monthly meeting, and

f) Provide updated backups and passwords to the government.

0. Deliverables

a) Monthly Progress Report

MONITORING AND TROUBLE SHOOTING

The entire network shall be monitored and alerted 24 hours a day, 7 days a week, stand alone. Services for the network and servers shall include the following; Network hardware troubleshooting and repair, System patches and updates which are to be managed automatically, Root cause identification and proactive/automated repairs, 3rd party vendor engagement - for specialized software/application support, both on-site and on-site managed backups (daily). Licenses for the software are purchased by VA and are not part of this Task Order (TO).

Knowledge and certifications in the following are expected in order to properly fulfill the task :

· Computrols Engineering The Contractor shall be able to program and shall program (when necessary) the front end and entire database used in the system, using the design tools that come with any front end that is used at the hospital as well as any programming tools developed by the manufacturers and environments described in this section. The current main system is Computrols CBAS20 being migrated to Tridium Niagara. All new Computrols controllers shall be migrated to Tridium Niagara Server. During regular business hours there is not to exceed twenty-four (24) hour response to equipment problems if a technician/programmer is not on site. The technician/programmer will check in with the COR when arriving and leaving the job site.

The Contractor should keep an adequate supply of critical parts on hand so to minimize equipment down time. A list of critical parts must be given to the Utility Systems Supervisor within 30 days that will be kept on site. Critical parts that are not on site must be supplied within 24 hours of the problem being noted.

The Contractor can request remote access to the BAS for technical assistance. Various portals shall be maintained to allow various additional departments within the facility and remotely to monitor and control the BAS as well as providing Systems Supervisors to monitor and control the system remotely in case of problems after hours and to monitor system performance. This includes internet access and the software needed to access the system. The information needed for the sign-in will be given to the Systems Supervisor within five (5) working days of the TO being awarded.

Below is the itemized equipment covered under this effort:

Automatrix

Rm

Control

Control

Mech Rm

Control

Rm

Automatrix

Department Bldg. 47 Roof

Network Appliances

Power Metering

Migration of BAS system to Tridium Niagara

a) Ensure Computrol devices are discoverable through BACnet protocol and able to be brought into Tridium Niagara server.

b) Ensure points are readable and writeable. It is intended that the last written setpoint values such as humidity, pressure, and temperature setpoints are running in parallel during migration.

c) Work in conjunction with other parties including Veteran Affairs employees and third-party contractors to transition existing and new projects to the Tridium server.

d) Software Updates/Maintenance shall be performed after hours and shall have backups prior to doing any updates.

e) Diagnose and Troubleshoot and ensure that Tridium Niagara reads faults or errors from the Computrols field controllers.

f) Maintain existing license for at least eight (8) client computers with Computrols software for VA Staff. MAINTENANCE At the frequencies recommended by the Original Equipment Manufacturer (OEM) and per the plan provided to the COR, the Contractor shall service and maintain the systems and components. This includes keeping the operating system and other software up to date with all updates, security, and periodic backup system in case of failure, fixes and keeping the system in good operating performance on all computers on the system. The Contractor must be able to maintain all equipment, stated above, whether Computrols or other company which is operating within the server/network, whether attaching to through BACnet, MODBUS, N2, OPTO, OPTO 22, or any other protocol.

Typical Contractor Preventive Maintenance (PM) visits shall be scheduled, and work performed during normal duty hours of 7:30am to 4:00pm. Critical areas shall be scheduled with prior approval of the COR for being completed either before or after business hours so as to not affect patient care. During each scheduled service visit, the Contractor shall actively involve the VAMC maintenance personnel in performing scheduled services and associated activities so that VA staff can be aware of any action that might affect patient care. The Contractor shall notify the Systems Supervisor when they are on site and when they leave. No unit should be shut down or changes made that could affect the systems operation unless first notifying the Systems Supervisor for approval to prevent an unscheduled loss of services. If the work needs to occur before or after working hours, this will be coordinated first with the Systems Supervisor. An electronic ticket should be generated for each visit and emailed to the Systems Supervisor.

VA has a designated room as the room to be utilized by Contractor personnel to provide support of the Computrols computer system. This space will remain under control of the VA Engineering Service personnel and will be used jointly with Contractor personnel. This space will always remain orderly and clean. Contractors will have to either apply for VA Identification (ID) badges for the duration of the contract or sign out temporary badges on each visit and return the badges at each visit to the boiler plant.

The Contractor shall work with the Systems Supervisor to ensure that the system including air handlers, exhaust, return, chillers, plate frame heat exchangers, programming et cetera is working to maximize the efficiency of the system and to assist the VA in achieving its energy saving goals. The Contractor will ensure that all sensors are reading correctly as part of regular PM and correct noted deficiencies and make any programming changes needed to improve the performance of the system as determined by Utility Systems Supervisor, HVAC Supervisor and/or COR.

Within 30 calendar days from date of award, the Contractor shall submit to the COR a clear, concise, and complete report that will be approved by the VA Systems Supervisor, included with the Monthly Report.

1) The report shall be in Microsoft Word, in a narrative format, and shall encompass all individual components, systems, and subsystems in the System referenced above and either delivered or emailed to the Systems Supervisor. The format shall be in a report that is agreed upon with the Systems Supervisor.

2) The report shall present the planned maintenance for the fiscal year for each month of the year to include the general plan for ensuring that the system is working correctly and efficiently.

3) The report shall include the security measures to allow for safe and secure remote access to the system by service technicians and the Systems Supervisor.

4) The goal of Preventative Maintenance is to catch controls that are not functioning correctly, that are out of range or calibration, that air handlers are functioning correctly, valves are not leaking by, dampers are controlling correctly based upon the most efficient operation by outside air temperature and humidity.

Preventative Maintenance tasks

a) Preventative Maintenance tasks are secondary to priority issues.

b) The Contractor schedules the visits with the COR. The COR will coordinate with the Boiler Plant Operators, HVAC, and Electronics team for meetings with the Contractor.

c) Assist in Graphics repairs.

d) Evaluate Air Handling Units (AHUs) and Variable Air Volume (VAVs) controls per configured setpoints – investigate any that are not.

e) Check software and firmware and update if necessary and obtain backups.

f) Review site occupancy schedules and note these in the findings for owner confirmation.

g) Document any abnormal findings (noise, vibration, temperature, visible).

h) Verify Alarm emails are being sent by the server. Establish an Alarm Text Message system.

i) Update user access credentials by written request from the customer.

j) Provide weekly backups and passwords to VA.

Deliverable:

Monthly Progress Report

STANDARD SYSTEM REPAIR

The Contractor shall check in with the COR and the Systems Supervisor for work orders and problems discovered in operations in the BAS. These problems are not considered emergencies; however, the system is expected to function correctly. These issues shall be tracked, and the issues shall be repaired within three business days of the request. The online system shall note when the order was submitted, when a technician was dispatched, and when the issue was resolved. The system shall generate emails to the Systems Supervisor at these interval steps. Any item that cannot be repaired within three business days shall be immediately communicated to the Systems Supervisor with a plan for repair in an expedited manner (examples might be a part that will take 48 to 72 hours to arrive). The service Contractor shall make every effort to make the system work until final repairs can be made. The technician and or Service manager shall meet with the Systems Supervisor to go over the list of active work orders to determine the priority of repairs - corrective actions. The technician shall check with the COR daily at the start of work to discuss what will be done that day and then report on the status of those repairs or any other discovered problems prior to departure.

1) Failure to solve a problem in a reasonable amount of time is considered a failure. Reasonable amount of time is considered as a non-emergency issue - three days. An emergency issue should be repaired as quickly as possible; the troubleshooting process and the repair should be a typical four-hour time frame.

2) The Contractor will have technicians (which should also be programmers) or sub-Contractors trained/licensed in each and all of the aforementioned systems, applications, and environments.

Recovery and Stabilization of Computrols Systems:

a) Obtain backups and ensure corrupt files are corrected.

b) Assist Boiler Plant Operators, HVAC shop, Electronics Shop, and Pharmacy to visually see data on the Computrols system. Ensure the BAS system is standalone, and air gapped from the VA OI&T Servers.

c) Troubleshoot and diagnose Computrols device issues. Ensure system and controllers are operational and determining which ones are needing repairs.

d) Convert all proprietary data to BACnet and that the Computrols server is aligned with the conversion.

e) Reconfigure network switches, open new ports, set new passwords, and configure other devices on other VLANs.

f) Assist in providing records of controller points inputs, outputs, and programming.

g) Ensure all passwords and documentation is provided to the COR.

h) Repair BAS controls issues by priority level and perform maintenance as dictated to emerging needs.

i) Assist with communication troubleshooting of integrated devices not originally installed by Contractor.

SOFTWARE MAINTENANCE

The Contractor shall provide software version upgrades of the all the database software technology (see background for software used) as they are released. Scope of work includes back up of software at each server and workstation, installation of new software at each server and workstation, programming of database information into new software, testing and training of new software to users.

The Contractor shall keep a backup copy of the system that can be restored for system failure. Back up of the system should be automated and periodic (daily).

The Contractor shall supply license points as needed with the Computrols system during the base year of the contract for the current Computrols front end. Any additional points for Computrols systems should be provided either by quote to the COR for decision on execution of optional task 5.6 for the allocated hardware/service improvement cost in the contract.

The BAS graphics shall be kept and maintained standard in the industry and meet VA specs, the graphics should be interactive, show floor plans, summaries of Air Handling Units (AHUs) and Variable Air Volume (VAVs)map key legend, and summary or trends on air change per hour, space temperature, pressure and humidity. The graphics must be pre-approved by the COR before installation.

The Contractor is responsible for the security of the BAS to include existing virus software, a backup copy of the system, archiving all alarms, events, so they can be viewed if needed, and deleted when full or nearing full capacity. The Contractor is responsible for the security of the system and must ask VA daily for remote access to the system.

Software License.

a) Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work Statement the software license provided to the Government is a perpetual, nonexclusive license to use the software.

b) The Government may use the software in a networked environment.

c) Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

d) All limitations of software usage are expressly stated in the Schedule of Supplies/Services and the Performance Work Statement.

e) Disabling Software Code and Password(s): The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out, passwords, backups, or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. The Computrols Contractor must provide VA with an admin and highest-level credentials or password(s). If any such disabling code or password is present, the Contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

TRAINING

Contractor shall provide ongoing training of the BAS system to VAMC employees. Training as requested by the Systems Supervisor shall be part of the 40 hours per week of service time. This information will detail important product and system topics that operators and administrators will find essential to keep up to date with current system developments and beneficial to the facilities management.

after hours calls outside the flex bank hours This task is for after-hours maintenance, repairs, parts, controls and license upgrades, and after-hours calls.

Deliverables:

A. Monthly Maintenance/Repairs/Upgrades Report to be included with Monthly Report at PWS 5.1.1.1 Licensing or Additional Repairs including additional Parts The contractor shall give an estimate for additional repairs and parts that will be separately quoted from this contract.

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-4, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall…