Security Access Control System (SACS)

Operation and Maintenance (O&M) Services

Exhibit A

Scope of Work at Hartsfield-Jackson Atlanta International Airport

(H-JAIA)

INTRODUCTION

City of Atlanta (“COA”) Department of Aviation (“DOA”) Public Safety and Security (PSS) is soliciting a proposal to provide Security Access Control System Services at Hartsfield-Jackson Atlanta International Airport (“ATL”). The contract will support CFR 1542 compliance requirements and provide enhancements throughout the airport from sterile to secure areas and will deliver integrated capabilities for access control, alarm monitoring, and identification badging.

1. Overview

The Security Access Control System (SACS) currently manages over 103,075 active cardholder records and is expected to grow in scale as airport operations expand. The system supports ingress and egress security for more than 1,434 doors and over 2,616 controllers across the facility.

The SACS Operations and Maintenance scope includes:

Installation, replacement, and procurement of network and security equipment Structured cabling installation to support system infrastructure Monitoring and support of servers, workstations, and Automated External

Defibrillators (AEDs) Installation, maintenance, and upgrades of software and system interfaces Database backup and restoration services Maintenance and periodic updates to the Disaster Recovery Plan Execution of preventive and corrective maintenance protocols Inventory management and procurement of new or replacement equipment as needed Continuous system performance analysis, programming, and testing Total system monitoring and defect resolution Generation of scheduled system reports Provision of training and system documentation Support for airport expansion projects, including configuration changes

(adds/moves/changes/deletes) to SACS

Additionally, the contract requires the replacement of 30% of end-of-life devices each year throughout the term of the agreement. The vendor will also manage the Department of Aviation’s Active Directory to optimize licensing and segment user access based on function.

The selected vendor must support integration with the airport’s Identity Management System to ensure compliance with CFR 1542. Upcoming enhancements include enabling biometric authentication at first entry portals and implementing audio/video and anti-piggybacking technologies to secure transitions from sterile to secure areas.

2. Justification

The Security Access Control System (SACS) installed at the Airport is a LENEL OnGuard Model PCS-PRO-REDU, Version 7.6.382.5264. This system provides integrated access control, alarm monitoring, and badging functionalities. It enables the Airport to issue credentials using the HID platform, which stores cardholder images and personal information, and grants access to designated areas within the facility.

Currently, there are no Airport-employed personnel certified by LENEL to manage the operations and maintenance of the SACS Operations and Maintenance program.

3. Acronyms

AED – Automated External Defibrillator AIS – Airport Information Systems AOA – Air Operations Area APC – American Power Conversion Corporation CAD – Computer-Aided Dispatch CCTV – Closed-Circuit Television CITY – City of Atlanta CPI – Consumer Price Index CR – Change Request DBA – Database Administrator DOA – Department of Aviation FIDS – Flight Information Display Systems GPETE – General Purpose Electronic Test Equipment HID – Human Interface Device H-JAIA – Hartsfield-Jackson Atlanta International Airport IDF – Intermediate Distribution Facility LAN – Local Area Network

LNL – LENEL

MDF – Multiple Distribution Facility MS-WORD – Microsoft Word MUFIDS – Multi-User Flight Information Display Systems O&M – Operations and Maintenance P&D – Planning and Development PDF – Portable Document Format PIR – Passive Infrared Detector RCA – Root Cause Analysis RFP – Request for Proposal SACS – Security Access Control System SDC – Security Door Controls SIDA – Security Identification Display Area SLA – Service Level Agreement SQL – Structured Query Language

UAS – Universal Access System UPS – Uninterruptible Power Source

4. System Overview

4.1 The Security Access Control System (SACS) currently in operation at the Airport is a LENEL system that provides integrated access control, alarm monitoring, and badging capabilities. The system enables the issuance of HID access cards that store cardholder information and grant access to designated areas throughout the facility. These access areas include secured workspaces, MDF and IDF closets, server rooms, Federal Inspection Services (Customs and Border Protection), public areas, the Security Identification Display Area (SIDA), the Air Operations Area (AOA), City of Atlanta-owned facilities surrounding the airport, and non-SIDA areas designated for concessions and vendor personnel. While biometric authentication is not currently deployed, the system is capable of supporting biometric integration. The Airport plans to implement biometric access at all first entry portals over the next two (2) years, along with other advanced technologies to enhance security at high-traffic access points,

4.2 The selected provider should plan for up to a thirty (30) day transition period overlapping with the current SACS Operations and Maintenance (O&M) contractor. This transition phase will facilitate the transfer of both physical and intellectual property belonging to the City and allow the new provider to become fully familiar with the operational and maintenance requirements of the Airport’s SACS. During this period, the provider is expected to initiate the comprehensive field inventory outlined in Exhibit A. All associated costs for this overlap period must be included in the provider’s first-year fixed price proposal.

4.3 The Provider will be required to support a system that currently maintains over 103,075 active cardholder records, with the expectation of continued growth in response to increasing airline demand and ongoing infrastructure expansion.

4.4 The current system includes infrastructure and equipment that secure access across more than 1,434 doors and operate over 2,616 door controllers. System components include, but are not limited to, the following:

4.4.1 Head End Equipment which includes:

Two (2) DELL database server Ten (10) DELL communication servers One (1) DELL archive server Two (2) DELL linkage server Three (3) DELL test drivers

4.4.2 Badging Workstations which are configured with:

Sixteen (16) SwiftPro Badge Printers Five (5) TOPAZ signature pads Sixteen (16) Dell Optiplex Workstations with dual 24” monitors

Two (2) badge hole punch machines

4.4.3 Field Equipment including:

Sixty (60) Dell alarm and admin workstations and associated peripherals Six (6) HP M553 printers One hundred seventy (170) LNL-3300 intelligent controller panels Two hundred eighty (280) t LNL 1100 input panels One hundred (100) LNL 1200 output panels One hundred forty-five (145) ( LNL-8000 star multiplexer One hundred forty-two (142) LNL 1300 reader module (single) One thousand nine hundred forty (1940) LNL 1320 dual reader module Two thousand eight hundred (2800) HID RK40 readers Seven hundred thirteen (713) request to exit (REX) pushbuttons Five hundred twenty seven (527) SDC electronic magnetic locks Six hundred ten (610) SDC electronic magnetic egress locks Twenty-four (24) Schlage maglocks Three thousand five hundred (3500) alarm input points Seventeen hundred (1700) Magnasphere balanced magnetic switches Twenty (20) GE Security wide gap door contacts One hundred ninety(190) GE Security flush mount GE Security flush mount door contacts Seven hundred eighty (780) audio visual strobe devices Three hundred forty (340) Altronix power supplies One hundred twelve (112) Lenel-600 power supplies Eighteen (18) Altronix AED power supplies Three hundred seven (307) cabinet tamper switches Three hundred fifty (350) magnetic door holders Forty (40) Bosch PIR REXs Two hundred sixty-five (265) AED alarms Forty (40) panic alarms Forty (40) breach containment alarms Fifty-three (53) roll up/chop door alarms Twenty-three (23) conveyor running alarms Thirty-six (36) emergency stop alarms Twenty-three (23) system malfunction alarms Sixteen (16) misc alarms Nineteen (19) turnstile/revolving door alarms One hundred sixty (160) () emergency call box alarms One hundred ninety-six (196) CBP call buttons Thirty (30) workstation UPS units Two hundred eighty (280) SDC key switches One hundred seventy-five (175) duress One hundred sixty (160) electric mortise locks One hundred sixty-five (156) Von Duprin fire alarm interfaces Sixty-five (65) MOMS fire alarm releases Eight five (85) Omnitron Systems fiber-copper media converters

Two hundred eighty (280) Yuasha 12VDC batteries Eighty (80) Vertiv IDF Room UPS's Eight (8) Cisco fiber switches Fifty-three (53) Cisco network switches Twenty (20) Airphone JP-Series Intercom

4.4.4 Provider must conduct a detailed field inventory and provide the detailed field inventory thirty (30) days after NTP date. The provider must on a quarterly basis provide the field inventory and provide attic stock information to the Director of Access Control/Insider Threat.

4.5 Scope of Services - Operations and Maintenance

The Provider shall be responsible for the complete maintenance of the Security Access Control System (SACS). The Provider shall follow all Policies, Procedures and Standards found in the AIS IT Standards and AIS IT Policies.

The Provider shall be responsible for the operations and maintenance of all Security Access Control System (SACS) components, including but not limited to the following equipment.

The Provider must also support newly implemented technologies such as biometrics and anti-piggybacking devices, as well as prepare for future enhancements involving integrated audio/video communication systems at access points.

4.5.1 Maintained equipment includes, but is not limited to:

Alcatraz units Aiphone intercom systems Ancillary equipment Anti-piggybacking technology Audio/Video systems (including future A/V integration for badge holder communication at access points) Badge hole punches Badge printers Balanced magnetic switches Biometric fingerprint readers Biometric facial recognition devices Card readers Crash bars Delayed egress maglocks Digital cameras for badge production Dual door controllers Electric mortise locks Gateways HID iClass encoders ID scanners

Intelligent field panels Key switches Magnetic door holders Media converters Modems Motion detectors Panic buttons Passive infrared detectors (PIRs) Peripheral devices Power supplies Printers Pushbuttons Standard magnetic locks Remote input boards Remote output boards Report and vehicle permit printers Salto Lock systems Scanners Servers Signature pads Single door controllers Sounder horns Strobe/audible devices Surge protectors Uninterruptible Power Supplies (UPS) Wireless keyboards Wireless mice Workstations

4.5.2 Upon execution of this contract, the Provider shall:

4.5.2.1 Install new and replacement equipment.

4.5.2.2 Purchase network equipment for expansion, if requested.

4.5.2.3 Install cabling to support equipment.

4.5.2.4 Monitor and support badge and paper printers for reports.

4.5.2.5 Replace any workstation hardware with latest version of Windows on Lenel- compatible workstation hardware within the first 90 days of the contract start; and the provider must continue to upgrade operating systems to the latest versions of windows as appropriate.

4.5.2.6 Ensure ongoing upgrades of operating systems to the latest supported Windows versions, as appropriate.

4.5.2.7 Reserved.

4.5.2.8 Replace and upgrade the door controllers from series 1 to the latest series. Current Series 1 805, Series 2 1242, and Series 3 368.

4.5.2.9 Install software and maintain software interfaces as stated in Section 4.5.9.

4.5.2.10 Perform database and system backups daily and test restorations on a quarterly basis. Report provided to show success of daily back up and quarterly test(s) to the Airport Manager of Access Control/ Insider Threat.

4.5.2.11 Develop a system disaster recovery plan and submit to the Manager of

Access Control/Insider Threat. Maintain and execute system disaster recovery plan on a quarterly basis and provide to the city (DOA). On an annual basis the system disaster recovery plan must be reviewed by the vendor with AIS to validate plan still meets standards.

4.5.2.12 Provide scheduled reports directly to Manager of Access

Control/Insider Threat, detailed in Section 4.5.10.

4.5.2.13 Perform system programming and testing in the test environment prior to pushing the new programming to the live environment.

4.5.2.14 Perform the preventative maintenance as the plan dictates with documented outcomes of what must be corrected.

4.5.2.15 Perform corrective maintenance and provide to the Manager of Access

Control/Insider Threat the completed corrective action of the maintenance.

4.5.2.16 Procure new equipment as required to ensure system integrity is maintained and hardware is not past defining end of life for the device.

4.5.2.17 Maintain equipment inventory with asset numbers and warranty information. Provide to the Manager of Access Control/Insider Threat quarterly of inventory and location of inventory stored.

4.5.2.18 Provide train the trainer training and system documentation/user manual for employees as requested; and

4.5.2.19 Perform adds, moves, changes as it relates to day to day operations.

4.5.2.20 Have a dedicated training allowance for two (2) DOA employees to travel

(airfare/hotel) to Rochester, NY to understand changes to the future Lennel product annually.

4.5.3 Provide all direct and indirect labor required to perform the required services.

4.5.3.1 Install and replace equipment that is in the current environment that is at the end of life or no longer preforms as required.

4.5.3.2 Provider must provide all requested new equipment to the City for approval to purchase prior to procurement of the equipment.

4.5.3.3 All equipment shall be installed according to manufacturers and AIS specifications. All hardware purchased under this agreement will be considered City property, to include hardware purchased to support the test lab environment.

4.5.3.4 If the vendor must make changes, upgrades, or changes to the environment, in accordance with AIS IT Policies, must be approved by the Department of Aviation AIS through the Change Approval Board before any equipment can be installed or software modifications occur.

4.5.3.5 Any equipment found to be defective shall be replaced using the in-stock inventory. In stock inventory must be replenished to meet minimum inventory requirements.

4.5.3.6 All new equipment must be received and documented and stored in an approved location. All equipment must be asset tagged, and hardware warranty must be tracked with the associated device. At the end of the contract, this information is owned by the City and provided in an excel format.

4.5.3.7 All procured equipment must be new and consistent with current technology in the ecosystem and in accordance with AIS standards.

4.5.4 Install Cabling: The Provider shall be responsible for troubleshooting and repairing any problems found with network cabling.

4.5.4.1 Install new cabling to support equipment as required.

4.5.4.2 Repair existing cabling as required.

4.5.4.3 All cabling must follow cabling standard found in AIS IT

Policies.

4.5.4.4 All as-builts of cable lay to include horizontal and vertical must be provided to DOA AIS IT prior to project closeout.

4.5.4.5 All new fiber cable installations must meet AIS Fiber Optic

Cable requirements and results provided for approval to the DOA AIS IT department prior to project closeout and payment for work.

4.5.5 Purchase Network Equipment: All equipment and materials purchased for this project shall be registered under the name of City of Atlanta, Department of Aviation.

4.5.5.1 For all new network switches, a Smart Net contract must be provided for the first year of coverage.

4.5.5.2 The City will provide the Smart Net coverage for existing SACS switches.

4.5.5.3 If required, fiber pairs will be provided to the Provider by the

City for any new additions to the network. The Provider must request these fiber pairs in writing (email) to the City ten (10) business days in advance of date required.

4.5.5.4 DOA AIS requires that all network switches that are procured by the provider, and provided to the owner for configuration, the provider then will rack and stack the Switch within the racks meeting DOA AIS Standards.

4.5.5.5 Prior to the procurement of any network equipment, DOA

AIS must approve the purchase of the equipment prior to procurement of the devices.

4.5.5 Servers: The City is responsible for configuring and maintaining network devices, after purchase by Contractor or DOA AIS. The Provider shall keep all LENEL database upgrades and updates current.

4.5.5.1 All City and DOA AIS IT security tools shall be installed on all SACS servers and workstations to protect equipment.

4.5.5.2 The City is responsible for all OS and vulnerability patches on servers and workstations.

4.5.5.3 Any change to server configuration, distribution or location must be requested in writing and approved by using the DOA AIS Change Approval Board process.

4.5.5.4 Access to DOA AIS Server rooms to perform maintenance must be scheduled with DOA AIS in advance. Conformance to security policy found in AIS Policies is required.

4.5.5.5 Service provider must perform server maintenance in coordination with DOA AIS server engineer to ensure the impact to airport operations are minimal. Server maintenance includes routine and critical maintenance.

4.5.5.6 Event logs on the server must be kept below a capacity of sixty (60%) percent. Event logs must be archived in accordance with DOA AIS policies.

4.5.5.7 The City must be notified by telephone when emergency access is required to the AIS server room(s). All access processes are defined in the AIS IT Policies.

4.5.5.8 AIS Security shall perform audits that may include penetration testing and vulnerability scans.

4.5.6 Workstations:

4.5.6.1 All SACS servers and workstations shall be joined to the City's managed domain to ensure devices align with AIS standards and policies.

4.5.6.2 The City requires that the service provider in conjunction with DOA AIS must ensure that the OS and vulnerability patches on servers and workstations are required to be remediated.

4.5.6.3 The Provider shall work with the City to create a standard SACS image that will be installed on all workstations.

4.5.6.4 LENEL software must be kept current and any upgrades, newly released versions, must be tested in the test environment prior to being deployed in the production environment, the versions are to be scheduled by the Provider two (2) weeks in advance and accomplished in accordance with AIS IT Policies.

4.5.6.5 In conjunction with the DOA AIS the provider will provide and maintain an active directory for users and passwords of the system.

4.5.6.6 Every thirty days the provider will provide to DOA AIS and Manager of

Access Control/Insider Threat the list of active users for audit purposes.

4.5.7 Printers: The Provider is responsible for ensuring all printers are functioning properly and inline encoding is reliable at 99.99%.

4.5.8 Maintain Customized Software:

4.5.8.1 The Provider shall be responsible for ensuring all current interfaces are tested and are operational, the interfaces are listed below in Section 4.5.9.2.

4.5.8.2 All customized software shall be supported by the Provider.

4.5.8.3 Customized Lenel database tables, database triggers, and database fields are utilized for company information, cardholder records, badge records, vehicle permits, biometric enrollment, lock and key system, and other customized functions.

4.5.8.4 CCTV interface- controls camera callups for cameras. There are approximately 1,682 camera call ups between AED and SACS door alarms. The integration is accomplished through software level integration; the CCTV and SACS networks are connected through a "Black Box" with serial and Ethernet connectivity.

4.5.8.5 Fingerprint maintain integration with Detrios database and triggers until the DOA Credentialing Office has transition to IDMS.

4.5.8.6 All LENEL software and printer encoder software must be kept updated to the latest version. The Provider must provide a plan detailing the planned software installation, with detailed tasks defining work to be accomplished, resources associated, task durations, time requested for complete installation, test plan, and back out plan. This must be submitted to the Manager of Access Control/Insider Threat and to the designee for AIS Airport Systems team for approval before the Provider begins work. All new software and upgrade versions must be tested in the test environment prior to being pushed to the production environment.

4.5.9 System backup and Data Restoration

4.5.9.1 Backups

4.5.9.1.1 The Provider is responsible for performing a full

database back-up daily and storing the file in a location accessible through SACS network.

4.5.9.1.2 The Provider shall work with the AIS Airport Systems Team to ensure the CITY's backup solution can access the Provider's backup file.

4.5.9.1.3 The Provider shall provide complex database passwords that meet AIS standards/password policy to the CITY and notify them when any changes are made to the database.

4.5.9.1.4 The Provider shall maintain an inventory of all system passwords and keep the list updated. This list shall be subject to audit by the CITY without prior notice.

4.5.9.1.5 If the DOA finds that there are any problems associated with backing up the data, the Provider will be notified and shall be available immediately to assist in resolving the problem. If the problem is found to belong to the Provider, it will be resolved according to a schedule provided by the AIS Operations team.

4.5.9.2 Data Restoration

4.5.9.2.1 The Provider will be required to assist the CITY in testing the restoration of the database on a quarterly basis (A quarter is defined as on or before 3/31: 6/30:

9/30: 12/31). A report is required to be provided to the Manager of Access Control/Insider Threat on a quarterly basis to validate that testing has been completed.

4.5.9.3 The City shall notify the Provider when the data restoration exercise is to be performed with the expectation that the Provider will assist in the Restoration. The Provider must have a qualified DBA available to perform this task.

4.5.9.3.1 If a Database restoration exercise is requested by

the Provider, it shall be done by submitting a Change Request to the CITY at least two (2) weeks in advance of execution of the test.

4.5.9.3.2 The Provider shall perform daily checks of the

database to ensure that corruption has not occurred. These checks must be done by a qualified DBA.

4.5.9.3.3 If corruption or any other problem is found with

the database and data restoration or corrective action is required, the Provider shall notify the CITY in writing via email and obtain approval before proceeding from the Airport Security Manager or designated employee.

4.5.9.4 The problem shall also be logged in the Provider's incident tracking database. The Provider shall notify the CITY of the estimated time to repair.

4.5.9.5 If additional resources are required to resolve the problem, the Provider shall notify the CITY and obtain approval from the Airport Security Manager or designated employee before proceeding.

4.5.9.6 Within 24 hours of the resolution of the problem, the Provider must submit a completed (with detail) Root Cause Analysis (RCA) Form to the CITY. A sample of the Form can be found in the AIS IT Policies.

4.5.9.7 Disaster Recovery Plan

4.5.9.8 The Provider shall provide a disaster recovery plan within first thirty

(30) days of the executed Contract. Disaster recovery plan must be submitted within thirty (30) days if any changes are made to AIS and the Access Control / Insider Threat Manager.

4.5.9.9 Reporting

4.5.9.10 The Provider shall provide the standard reports that are available through the LENEL software as well as any custom reports that are necessary to aid in the execution of daily processes of the airport.

4.5.9.11 All reports generated shall be kept in a database provided by the

Provider for at least one hundred eighty (180) days.

4.5.9.12 The following reports shall be provided by the Provider on a weekly and monthly basis to the Airport Security Manager or designated employee:

4.5.9.13 Inventory Report

4.5.9.13.1 The Inventory Report shows all of the different hardware and software components of the SACS system and the quantities of each device on hand, asset number and warrant information. The report includes but is not limited to:

Manufacturer, Part Number, Model number, Description, Quantity, Warranty of hardware and end of life of device. The Inventory Report also tracks spare parts and quantities with storage locations. Document report must be in an excel document for the Airport Information Systems.

4.5.9.14 System Availability Report

4.5.9.14.1 The System Availability Report details uptime of critical

SACS equipment. Fields include:

• equipment type

• name of equipment

• availability

• Uptime

• IP address

• # of outages

• downtime

• warranty of devices

• asset number of devices

• physical location of devices

• end of life of the devices

4.5.9.15 The following reports shall be provided by the Provider as requested to the Manager of Access Control/Insider Threat or designated employee:

4.5.9.15.1 Ad-Hoc Reporting

4.5.12.6.1.1.1 Reports shall be provided using Crystal

Reports version 11 or greater and Power Bi

Reports. City must be able to create own reports using data fields/tables collected by the system.

4.5.12.6.1.1.2 UPTIME REPORT - Provider must supply

to the Manager of Access Control and Insider Threat a weekly uptime report, detailing failures of not meeting 99.99% with dates and times, location, and devices.

4.5.9.15.2 Badge Audit Holder Report

4.5.9.15.2.1 The Badge Audit Holder Report shows

all badge details for all companies that are active and unaccounted for. The report includes, but is not limited to last name, first name, middle name, badge number, expiration, status comments, badge layout and employer.

4.5.9.15.3 User Transaction Report

4.5.9.15.3.1 The User Transaction Report shows the

details of each user transaction from all Lenel applications. The report includes, but is not limited to time/date, username, workstation, type, object affected and details.

4.5.9.15.4 Company Directory Report

4.5.9.15.4.1 The Company Directory Report shows

the contact information for companies with ACTIVE UNEXPIRED badges. The report includes, but not limited to company name, contact name, phone, fax, insurance expiration, project end date and active unexpired badge count.

4.5.9.15.5 Purchases Report

4.5.9.15.5.1 On a monthly basis the Provider shall

provide the City with a Purchases Report which documents all hardware and software purchases made related to the Security Access Control System (SACS). The report shall include the following minimum information:

Purchase ID Category Item Description Quantity Vendor Unit Cost Total Cost YTD Cost Purchase Date Justification

4.5.9.15.6 Configuration Management Report

4.5.9.15.6.1 On a monthly basis the Provider shall provide

the City with a Configuration Management Report which documents all hardware and software installations, replacements, and upgrades related to the Security Access Control System (SACS). The report shall include the following minimum information:

Asset ID Asset Type Action (install, replacement, upgrade) Date of Activity Version (software only) Quantity

4.5.9.15.7 Incident Report

4.5.9.15.7.1 On a weekly and monthly basis, the

Provider shall provide the CITY with an Incident Report which documents all issues found with the Security Access Control System (SACS). The report shall consist of the following minimum information.

Device down time Ticket status Ticket resolution Ticket type Category Device name Device location Person assigned to (technician) Organization Incident (ticket) number Description of the problem Airport impact

Provide such other reports as required by the Airport Security Manager.

4.5.10 System Monitoring

4.5.10.1 The Provider must provide continuous monitoring of all system components (SACS equipment excluding workstations and servers). Provider must send to the Manager of Access Control and Insider Threat weekly and monthly device availability reports via email. Provider must also provide access to the reporting system for the Manager of Access Control and Insider Threat to view system reports at any time.

4.5.10.2 The Provider must provide continuous monitoring of the database and notify the CITY immediately if there are any problems to the Manager of Access Control and Insider Threat or designee.

4.5.10.3 All problems found during monitoring are to be resolved and an incident ticket recorded which defines the problem and resolution. Providers must send to the Manager of Access Control and Insider Threat weekly and monthly incident ticket reports. Provider must also provide access to the reporting system for the Manager of Access Control and Insider Threat to view system reports at any time.

4.5.10.4 All problems shall be resolved within the City provided Service

Level Agreement (SLA), found in Section 4.5.15.4.

4.5.14 Equipment and Software Testing

4.5.14.1 Before implementing any change in the production environment, testing must be done within the testing environment in advance, test results recorded and will not be moved to production environment until a positive result from test has been documented and approved by AIS and the Manager of Access Control and Insider Threat . The detailed test and implementation plan along with the test results must be provided to the AIS Airport Systems team for approval before the change is introduced into the production environment.

4.5.14.2 A change request must be submitted two (2) weeks before planned implementation of any planned system changes (software, hardware, database installations). The Provider must follow the Change Management process as defined in the AIS IT Policies.

4.5.15 Operations and Maintenance

4.5.15.1 General

4.5.15.1.1 The Providers must submit an Operations and

Maintenance plan which contains details of how Preventative and Corrective Maintenance will be performed on the SACS.

Provider must send to the Manager of Access Control and Insider Threat a monthly preventative maintenance report that encompasses the physical inspection, cleaning, calibration, configuration and testing of managed equipment. Provider must also provide access to the reporting system for the Manager of Access Control and Insider Threat to view system reports at any time.

4.5.15.1.2 Maintenance support staff shall be available on site during the normal business hours of 0600-1800L (Monday through Friday), for the Security Credentialing Office, five (5) days every week excluding City recognized Holidays, with off-hour support available through a primary contact available 24 hours per day. The normal business hours defined may be amended by the Airport. Airport is looking to expand into Saturday and Sunday hours, 0800L-16:00L.

4.5.15.1.3 Any changes affecting airport operations or airlines, major changes, disruptive preventative maintenance, upgrades, and patches shall be scheduled during the hours 22:00 to 05:00.

4.5.15.1.4 Non-schedule maintenance activities must be scheduled with the Manager of Access Control and Insider Threat in advance.

4.5.15.1.5 All IT related maintenance shall be performed within the maintenance window (refer to AIS IT Policies for exceptions).

4.5.15.1.6 Total system uptime of 99.99% must be maintained. The total system critical elements are card readers, door magnets, AEDs, servers, workstations, badge printers, databases and field panels. Provider is required to meet or exceed customer's expectation. Scheduled maintenance and construction are not factored into

4.5.16.1 Preventative Maintenance

4.5.16.1.1 Provider must supply a monthly preventative

maintenance schedule and report that encompasses the physical inspection, cleaning, calibration, configuration and testing of the equipment and components comprising the SACS. Manager of Access Control and Insider Threat must approve the preventative maintenance schedule in advance of the work. Provider must provide at the end of the month, the maintenance that was completed via a report.

4.5.16.1.2 Preventative, Software, and Equipment Maintenance

schedules must be presented to the Manager of Access Control and Insider Threat for approval before execution.

4.5.16.1.3 Verification of communication to Intelligent Field Panels shall be performed once per day. Report of completed verification of communication to Intelligent Field Panels are completed daily. Report must be provided to the Manager of Access Control and Insider Threat M-F.

4.5.16.1.4 All consumable materials are to be provided by the Provider to complete the preventative maintenance requirements of the contract.

4.5.16.1.5 Preventative Maintenance must be performed using

qualified technicians and industry best practices. Lead on-duty technicians must be LENEL certified. If the Provider is found to not have LENEL certified technicians, they will be removed from the site and will be required to be replaced with qualified technicians. Certifications will be verified through LENEL. Provider must provide to the certificate to the Manager of Access Control and Insider Threat and approved by the Manager of Access Control and Insider Threat prior to the individual being allowed to work on the system.

4.5.16.1.6 As part of the preventative maintenance plan, the Provider shall maintain an on hand inventory of spare parts which supports the ability to respond based on pre-defined service level definitions and current failure trends.

4.5.16.1.7 The Provider must utilize existing equipment inventory, before procuring new equipment

4.5.16.1.8 If existing inventory is found to be defective or not up to date, the Provider shall contact the Manager of Access Control and Insider Threat for resolution of problem.

4.5.16.1.9 Proposed changes to the Preventative Maintenance

process/procedures must be presented to the Manager of Access Control and Insider Threat for approval before execution.

4.5.16.1.10 Preventative maintenance shall be executed to identify degraded system/equipment performance or physical defects that could result in extended down time in advance

4.5.16.1.11 Preventative Maintenance shall include the proactive identification of problems, but shall not be limited to, line errors, open line faults, communication losses, shorted lines, offline devices, tamper alarms, excessive / repetitive alarms.

4.5.16.1.12 All equipment inventories will be stored in a secure, climate controlled environment

4.5.16.1.13 If new switches are to be ordered under this contract, it must be added to the current Smartnet contract, held by the City, for maintenance. All equipment serial numbers must be provided to the City.

4.5.16.2 Corrective Maintenance

4.5.16.2.1 Corrective Maintenance is the identification and correction of system, equipment or component failures. It encompasses all SACS hardware and software, installation and design malfunctions.

4.5.16.2.2 Corrective procedures for these failures shall be performed on a 24-hour basis, 7 days per week, and 365 days per year.

4.5.16.2.3 The replacement of failed components and system equipment shall be accomplished by the Provider using on hand inventory.

4.5.16.2.4 If the Provider cannot repair the failure within the required SLA, the problem must be reviewed by the Manager of Access Control and Insider Threat or designated employee to determine the reason for the repair delay and if additional time is required.

4.5.16.2.5 Provider shall assume responsibility for providing security for the portals affected by equipment failure and report the estimated completion date or time to Manager of Access Control and Insider Threat or designated employee. A trouble call can be initiated by any City employee designated by the Manager of Access Control and Insider Threat. The Provider shall also continually analyze operational and maintenance performance data to determine actual or potential design or installation defects which could detract from the equipment or systems capability to perform its intended operational requirements.

4.5.16.2.6 The Provider shall furnish all required General Purpose Electronic Test Equipment (GPETE) and other tools to complete the required System repairs.

4.5.16.2.7The Provider must provide the CITY access to customer care via phone and an online maintenance system 24X7X365.

4.5.16.2.8 The Provider shall provide online work order management system which records work tickets. (Ticket must include at least the following: Ticket Reference number, Problem description, assigned to, when ticket was created (date/time), when ticket was resolved (date/time), acknowledged by who, Date/Time of ticket acknowledgement, a description of the resolution, downtime, and who created work ticket). An API with ServiceNow would be preferred.

4.5.16.2.9 The online work order management system shall provide immediate electronic notification to the technician servicing the maintenance requests as well as the Manager of Access Control and Insider Threat or designated employees.

4.5.16.2.10 The online work order management system must have the ability to generate reports on maintenance activity for the Manager of Access Control and Insider Threat or designated employee.

4.5.16.2.11 Provider will provide user IDs for online work order management system to the CITY with the ability to enter, check status of, update work orders and print work order reports. Work order management system must be able to communicate with the DOA data collection point.

4.5.16.2.12 Initial acknowledgment to all problems should be within five (5) minutes during core business hours. Acknowledgment is defined as the Provider acknowledging the failure by phone or email to the Manager of Access Control and Insider Threat or designated employee.

4.5.16.2.13 Response to all problems shall be within fifteen (15) minutes during core business hours. Response is defined as the Provider being on-site to address and resolve the issue.

4.5.16.2.14 Resolution to all problems should take place within forty-five (45) minutes during core business hours. Resolution is defined as a temporary or permanent fix to the issue.

4.5.16.2.15 Online incident database to designated City employee(s).

4.5.16.2.16 The City will determine the criticality of all problems and prioritize all incident requests.

Service Level Requirements – Core Business Hours Action Max Response Time (Min)

Acknowledge 5

Respond 15

Resolve 45

Service Level Requirements – Non-Core Business Hours Action Max Response Time (Min)

Acknowledge 10

Respond 30

Resolve 90

4.5.17 Staffing

4.5.17.1 The Provider shall have personnel that have been factory trained and certified on a LENEL OnGuard with the experience of working in a large, robust environment similar to the airport.

4.5.17.2 The Provider shall also have personnel on staff that have certification and/or expertise in the following:

• Microsoft SQL database

• CCTV

• LENEL Technician

• Staff Supervision

• Database Analysis

• Project Management expertise of a minimum of five (5) years

4.5.17.3 The Provider must provide resumes for all staff members that will be working on this contract to the Manager of Access Control and Insider Threat or designated employee. Staff members must be approved by the CITY before notice to proceed.

4.5.17.4 Any changes to the staffing plan must be approved by the Manager of Access

Control and Insider Threat or designated employee. The City reserves the right to approve or decline the staffing plan based on operational needs.

4.5.18 Training and Documentation

• Review current system documentation and ensure it is up to date.

• Maintain system documentation during this contract (As-builts).

• Assume documentation from current vendor and identify areas for update.

• Any changes made to the current production environment shall be documented and submitted to the City in the form of As-Builts (all equipment, software interfaces, database schema, data dictionaries, etc.) within ninety (90) days of adding new equipment.

4.5.18.5 All Drawings shall be produced with AutoCAD (as directed by the City) and the electronic files shall be provided to the City on CD-ROM in DWG and VISIO formats.

4.5.18.6 The Provider shall provide documented system user training for any new features that are released with software upgrades.

4.5.18.7 The Provider shall make available factory administrator training for DOA personnel. The personnel shall be defined at a later date. The Provider may provide the training virtual or in person at DOA.

4.5.18.8 The Provider will supply AIS Airport Systems with necessary training and documentation to support all Security Access Control software/hardware solutions covered under this contract. New systems implemented will be negotiated to determine costs and support.

4.5.19 Work Area

4.5.19.1 The Provider is responsible for securing adequate workspace to fulfill the scope of services contained herein. The workspace shall be located such that all required response times are compiled without impact of travel. The Provider may contact the DOA properties Division should the Provider be interested in leasing space at H-JAIA for its work area. The Provider is responsible for all data and phone requirements.

4.5.19.2 The Provider shall provide any workstations required to execute the contract to the City for verification of configuration before it can reside on the network.

4.5.20 Warranty

4.5.20.1 The Provider shall provide a one (1) year warranty for all new equipment installed. The warranty of the equipment starts from the date it is installed and accepted by the City.

4.5.20.2 The Provider shall provide a one (1) year installation warranty for all new installed and accepted by the city, refurbished or inventoried equipment

(i.e., cable, conduit, fittings).

4.5.20.3 The Provider shall be responsible for all shipping costs for any equipment under warranty.

4.5.21 Change Management

4.5.21.1 Changes to the network infrastructure can't begin until a Change Management Request has been submitted two (2) weeks prior to the requested change being completed and the Change Management process defined in the 'AIS IT Policies' has been followed.

4.5.21.2 When changes are approved by the CITY, the Provider shall be responsible contacting the appropriate City of Atlanta employees for installation and configuration of all network equipment.

4.5.21.3 If the Provider discovers suspected network problems, the AIS Airport Systems team shall be contacted immediately by email or phone and the problem logged in the Provider's service/support incident tracking system. Notification must also be made to the Manager of Access Control/Insider Threat via phone and email.

4.5.21.4 Design for any new network infrastructure shall be created by the Provider and presented to the CITY for approval in advance of any changes to the network infrastructure. All system documentation (updated As-Builts and network diagrams) shall be provided to the CITY when installation and changes (including configuration) are completed by the Provider.

4.5.22 Safety Provisions

4.5.22.1 The Provider shall be responsible for safety and protection of the Provider's employees, tenants, and the traveling public.

4.5.22.2 The Provider shall be responsible for initiating, maintaining and supervising all safety precautions required in connection with their work in accordance with the applicable portions of the Occupational Safety and Health Administration (OSHA) and other governing agencies.

4.5.22.3 The Provider shall report promptly in writing to the designated representative any accidents in connection with the performance of the work which results in death, any injury requiring medical treatment other than first aid administered at the jobsite, or property damage, giving full details and statements of witnesses. The Provider is required to contact the city for any incident/or accident-causing injury, property damage, etc. by calling 911 for an emergency and for non-life threating calling (404) 530-6800. The Provider must also contact the Manager of Access Control/Insider Threat to advise of issue.

4.5.22.4 The Provider shall be required to display appropriate signage to alert the public of unsafe conditions. The use of temporary signs at AIS is a necessary practice.

First, and foremost, the Provider shall use accurate and concise warning signs.

Secondly, it is the AIS policy to notify the traveling public, through the use of signs, whenever any of our facilities such as, but not limited to, restrooms, stairwells, restoration areas, equipment, escalators, and elevators are not in service. These signs will be used to direct the traveling public to the nearest equivalent that is in service.

The unexpected need for crowd control or other deviation from a normal route shall be provided through the use of temporary signs. The Provider shall be required to coordinate sign policy changes on an as needed basis with the City Wayfinding group to ensure branding and messaging meet city standards.

4.5.22.5 Provider shall be solely and completely responsible for initiation, maintaining, and supervision of safety precautions for the safety of, and shall provide the necessary protection to prevent damage, injury or loss to employees on the work site and other persons including, but not limited to general public who may be affected.

4.5.23 Protection for the Public and Property

4.5.23.1 The Provider shall take all necessary precautions to prevent injury to the public, building occupants, or damage to the property of others.

4.5.23.2 The storage, positioning, or use of equipment, tools, scraps, trash, and furniture in a manner likely to present a hazard to the public or building occupants by its accidental shifting, ignition or other hazardous qualities is prohibited.

4.5.23.3 No corridor, aisle, stairway, door, or exit shall be obstructed or used in such a manner as to encroach upon routes of ingress and egress utilized by the public or building occupants, or to present unsafe or unhealthy conditions to the public or building occupants.

4.5.23.4 Work shall be performed in any area occupied by the designated representative and unless adequate steps are taken for the protection of the public or employees.

4.5.23.5 At all times, the work area shall be fenced, barricaded, or otherwise blocked off from the public or building occupants may be in or pass through, under, or over the work area, alternate precautions such as the posting of signs, the use of signal persons, and the erection of barricades or similar protection around particularly hazardous operations shall be used. This must be coordinated and communicated with the Manager of Access Control/Insider Threat prior, unless it is an immediate life safety concern.

4.5.23.6 When work is to be performed over a public thoroughfare such as a sidewalk, lobby, or corridor, the thoroughfare shall be closed, if possible, or other precautions taken such as the installation of screens or barricades. This must be coordinated and communicated with the Manager of Access Control/Insider Threat prior, unless it is an immediate life safety concern.

4.5.23.7 Barricades shall be removed upon completion of the work, in accordance with local ordinances.

END