DRAFT SOW IDS Maint Contract Oct 2025.pdf

STATEMENT OF WORK

MILITARY SEALIFT COMMAND HQ SCIF SECURITY INTRUSTION DETECTION SYSTEM MAINTENANCE

CONTRACT WITH OPTION YEARS

1.0 TABLE OF CONTENTS

2.0 GLOSSARY OF TERMS

3.0 SERVICES

4.0 ACRONYMS

5.0 DELIVERY AND PERFORMANCE

6.0 INSTALLATION AND MAINTANCE……………………………………………………………………………………………………...4

7.0 MAINTENANCE REQUIREMENTS

8.0 TRAINING REQUIREMENTS

9.0 GOVERNMENT FURNISHED SERVICES/PROPERTY

10.0 SECURITY REQUIREMENTS

11.0 CONTRACT DELIVERABLES

12.0 GENERAL CONTRACT ADMINISTRATION

13.0 PERFORMANCE REQUIREMENT SUMMARY

The explanation or definitions of terms and abbreviations commonly used in the security community can be found in Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities ICS 705-02 Series, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities, 22 December 2016, Sensitive Compartmented Information (SCI) Administrative Security Manual:

Administration of Physical Security, Visitor Control, and Technical Security, DoDM 5105.21 – Vol. 2, DoD Information Security Program: Protection of Classified Information, DoDM 5200.01, Vol. 3 and all Intrusion Detection System and Access Control Defense Information Systems Agency Security Technical Implementation Guide (STIG) requirements. No effort to duplicate these terms is intended. Where terms are used in this Statement of Work with a different connotation, or where definitions are lacking in the above-mentioned publications, the explanations of such terms are included.

Acoustic requirements – Discussions in this SCIF will be, on occasion, amplified - utilizing VoIP Secure telephones and Teleconference repeaters.

Accreditation – Accreditation is the beginning of a life cycle process of continuous monitoring and evaluation, periodic re-evaluation, and documentation reviews to ensure SCIF is maintained in an accredited state.

Accreditation Process – The accreditation process shall include a review of documents relation to SCIF design, construction, and operations. Documents shall include, but not limited to: Fixed Facility Checklists, Standard Operation Procedures, Emergency Plans, Construction Security Plan, and waiver request packages and supporting documentation, if applicable.

AECS Head-End Equipment Protection – Check to ensure the physical location of the primary IDS head-end equipment (server and/or work station/monitoring equipment) is in a continuously occupied location (e.g. guard monitoring station for alarms and CCTV.) MSC HQ continuously manned station is the Battle Watch Center (BWC). (See Glossary – Battle Watch Center)

2.0 GLOSSARY OF TERMS

1.0 TABLE OF CONTENTS

Alarm Response Times - Response time is based upon accreditation and security-in depth. If the response force cannot meet the required response time, additional security requirements (i.e., additional barriers, adding cameras, going to closed storage) must be added.

Automated Access Control Systems (AECS) – Also known as Two Factor Authentication – Automated Access Control Systems for the purposes of this SCIF is a mandatory requirement in this contract. Automated Access control system installed must use at least two technologies (badge. PIN, biometrics.), etc.

Badge In = Badge Out/Lock Out – IDS System must provide capability for AECS System to deny access to individuals who badge and PIN in to the SCIF, but fail to badge out prior to departure. This provides user capability to ensure SCIF is properly vacated prior to securing SCIF by locking FF-L-2740 device and arming the IDS at completion of workday.

Balanced Magnetic Switch (BMS) – Balanced Magnetic Switches for this IDS installation installed on perimeter doors must meet UL 634 Standards.

Closed Storage – SCIF will be Closed Storage for all SCI material, documents, charts, etc. All SCI material, with the exception of JWICS hard drives, will be stored in GSA approved security containers when the material is not in use and under the supervision of an appropriately trained and cleared person who has been read in to the program and has the “need to know”.

Continuous Operations Facility - Access Control Monitoring Methods: This SCIF will not be operating continuously, but whenever in operation – use of an Automated Entry Access Control System (AECS) Card Reader with Biometrics or Personal Identification Number (PIN) will be employed.

DD Form 254 - The MSC HQ SSO, with assistance from MSC HQ Contracting, will provide the concept approval and, if applicable, the DD Form 254, “Contract Security Classification Specification,” for contractor facilities to DIA Office of Counterintelligence and Security (DAC) with an information copy to the supporting SSO.

Government – Any person or organization within the U.S Government with a vested interest in the proper and technically sound installation of this intrusion detection system or associated installations safe outcome of the missions assigned to the contractor for which this contract supports.

IDS/ACS Primary and Emergency Power Supply – Primary Power for Intrusion Detection System/Access Control System must be commercial AC or DC power. In the event of commercial power failure at either the SCIF area or the monitoring station, the equipment must change power sources without causing an intrusion alarm indication. An Uninterrupted Power Supply (UPS) will be required for this to occur.

IDS/ACS Component Tamper Protection – Intrusion Detection System installed must provide component tamper protection. Failure to provide tamper protection to installed Intrusion Detection System/Access Control System could result in an undetected modification or disabling of IDS/ACS system components.

IDS Alarm Monitoring Indicators – System must provide audible and visual indication of any alarm activation at the primary monitoring station.

IDS Performance Verification – Installed IDS must provide a system of checks of all alarm sensors (BMS, motion, glass break, etc.) IDS performance verification test must be conducted every 90 days, so system must provide a system and procedure for conducting this test and recording / documenting results. System must provide a way to log and retain these test results to be retained for at least 180 days. Test logs are an inspection criteria.

Interior Motion Detection – Where classified equipment and/or associated media is stored in the open, it must be covered with interior motion detection sensors.

Letter of Accreditation – A letter of accreditation is a formal statement on behalf of the IC element head that a facility has been designed, constructed, inspected, and certified for the protection of all Sensitive Compartmented Information (SCI) compartments, programs or special activities in accordance with the provisions of ICD 705.

Line Supervision - Line supervision for all intrusion detection equipment (IDE) components of an IDS (USG and contractor facilities) will employ 128-bit (or greater) encryption whenever the signal line leaves the SCIF. This includes signal lines between any IDE, premise control unit (PCU), and monitoring stations. All lines employing line supervision require certification of the algorithm by the National Institute of Standards and Technology (NIST) (i.e., a NIST certificate). An alternate form of line supervision may be approved on a case-by-case basis.

Monitoring Stations - Monitoring stations must be continuously supervised and staffed by U.S. personnel. These personnel do not need to be SCI-indoctrinated unless the system was configured to allow them to reset or shunt an alarm condition.

Open Storage – The Operations Wing of the MSC HQ Facility, Bldg. SP-64 is designated as Open Storage Secret.

This SCIF will be designated as “Open Storage”, Collateral Secret.

Scheduled Maintenance – Periodic prescribed inspections or servicing of Intrusion Detection System (IDS) or equipment, accomplished on a calendar, basis to ensure the IDS is not just functional, but fully operational to execute mission.

SCIF Type – Within the Letter of Accreditation, the SCIF Type will be identified. This letter will provide SCIF identity (unique identifier and/or location), and SCIF Type: Closed Storage for all SCI material. The letter will provide Acoustic requirements (e.g., discussions or non-discussion, amplified or non-amplified; Effective date of accreditation, and a statement that SCIF meets all physical, TEMPEST, and technical security standards in place;

and approved waivers, to include details of the standard9s) not met and when they are scheduled to be met, or standard(s) exceeded.

Masking of IDS Sensors – Shunting or Masking of IDS internal zone or sensor must be appropriately logged, therefore, contract must provide a system of logging and archiving masked or shunted sensors

TEMPEST inspection – A Certified TEMPEST Technical Authority (CTTA) Inspection is a necessary part of the accreditation process. The Regional SSO will schedule and/or facilitate this inspection.

Transmission Line Security – Check that Class-I or Class II line supervision is being used in accordance with DoD Manual 5200.01, with the exception of portions of the transmission line running entirely through spaces or areas where unescorted access is controlled to at least the Secret level.

Automated Access Control Systems (AECS) – Also known as Two Factor Authentication – Automated Access Control Systems for the purposes of this SCIF is a mandatory requirement in this contract. Automated Access control system installed must use at least two technologies (badge. PIN, biometrics.), etc.

Battle Watch Center (BWC) – A continuously manned watch station in MSC HQ SP-67 adjacent to this SCIF.

Closed Circuit Television (CCTV) – There will be one Closed Circuit Television (CCTV) system with camera installed as part of this contract. The one (1) SCIF primary entry / exit door must have CCTV camera. Primary (only) entrance to SCIF must be continuously monitored by cleared employees (inside or outside the room or area) whenever the FF-L-2740 combination lock is disengaged for daytime or other routine access.

DIA Office of Counterintelligence and Security (DAC) – Defense Intelligence Agency (DIA) Office of Counterintelligence and Security (DAC)

Federal Acquisition Regulation (FAR) – Federal Acquisition Regulation or Federal Aviation Regulation. Context shall dictate which applies.

Personal Protective Equipment (PPE) – Gear worn by personnel designed to increase safety, reduce risk, and/or preserve life required by those personnel in accordance with all applicable regulations.

3.0 ACRONYMS

Special Compartmental Information Facility (SCIF) - A secure room or datacenter that foils electronic surveillance and suppresses data leakage. An SCIF includes the use of passive methods such as a room enclosed in a tightly sealed metal shield (Faraday cage) and active methods (jamming).

Special Security Officer (SSO) – MSC HQ USG Civilian responsible for facility Special Security.

TSCM Technical Surveillance Countermeasures (TSCM) – When deemed necessary by Defense Intelligence Agency, or designated representative, a Technical Surveillance Countermeasures (TSCM) inspection may be required for the new SCIF.

Underwriters Laboratories (UL) 2050 Standards for USG SCIFs - All IDS installed in DIA accredited SCIFs will meet UL 2050 standards, unless otherwise approved. UL 2050 certification is not required for USG SCIFs utilizing USG-managed systems until the monitoring or IDS head is replaced. A copy of the UL certificate must be provided to DAC. If the alarm system was installed by a contractor, a copy of the UL 2050 certificate is required.

Voice Over Internet Protocol Telephones (VoIP) – Voice Over Internet Protocol; Telephone; designed to transmit and receive asynchronous data for voice and data communications. Voice Over Internet Protocol Telephones and telephonic equipage will be installed in this SCIF; providing occasional amplified voice capabilities.

Military Sealift Command (MSC) has an immediate requirement for the servicing and maintenance of an installed and accredited SCIF Intrusion Detection System, which meets Underwriters Laboratories (UL-2050) standards to support a secure enclave within MSC Headquarters (HQ) Norfolk, VA, with the exception of fiber-optic connectivity to the police dispatch center at Navy Base Norfolk. The purpose of the MSC HQ IDS is to provide an accredited Access Control System IDS. IDSs will comply with basic requirements contained in References (a) and (b) unless otherwise approved by Defense Intelligence Agency (DIA) Counterintelligence and Security Office (DAC).

References (a) and

(b) are as follows:

a. Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Ver. 1.4, ICD 705 Series.

b. Intelligence Community Standard 705-2, “Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information,” Series.

The contractor will annually inspect the accredited UL-2050 SCIF Intrusion Detection System, its installed battery, and its automated electronic access control system (AECS), ensuring the system meets Underwriter Laboratory- 2050 Standard, and issuing the appropriate waiver letter to Headquarters Military Sealift Command for lack of fiber optic connectivity to base dispatch until the fiber hub is installed at Naval Support Activity Hampton Roads. The purpose of the MSC HQ IDS Single Award Contract (SAC) is to provide an accredited Access Control System IDS.

Installation shall be in accordance with all applicable Department of Defense, Department of the Navy, DIA, MSC, and theater directives, policies, and guidance.

a. Performance Period. The period of performance will be as defined in the table below.

Period Start Date End Date Base Period (First Year) 01 Oct 2025 30 Sep 2026

Option Period One 01 Oct 2026 30 Sep 2027 Option Period Two 01 Oct 2027 30 Sep 2028 Option Period Three 01 Oct 2028 30 Sep 2029 Option Period Four 01 Oct 2029 30 Sep 2030 FAR 52.217-8 01 Oct 2030 31 March 2030

b. Scope of Work.

The contractor will conduct a SOVT and train operators to perform basic system functions involving operation of the IDS. The contractor will provide system maintenance for 5 years: Base period plus 4

4.0 SERVICES

5.0 DELIVERY AND PERFORMANCE

https://www.bing.com/search?q=Faraday%2BCage&filters=sid%3a88efd0b2-3080-975b-7291-babbd8b65db1&form=ENTLNK one-year option periods. The contract will include a Quality Service Plan which involves all maintenance, repair, and battery replacement actions necessary throughout the fiscal year. MSC will receive priority, 4-hour repair response, annual (yearly) inspections, as scheduled by the MSC SSO, device inspections and repairs as required, and at least one annual training, per year, of 2 hours duration, for one operator. MSC will receive annual software support.

a. The maintenance and system support shall include all required labor, material, and travel necessary to complete the service. The initial service and support will commence on 01 Oct 2025 or contract award and shall be continue until contract termination date.

b. The Contractor shall maintain and comply with its installation plan.

c. Operational Testing and Acceptance: The following will be successfully demonstrated for technical acceptance by the Government:

6.c.1 SOVT (US Navy) will be completed and the system must be demonstrated as 100% operationally sound prior to MSC REP signature acknowledging acceptance of the IDS as complete.

6.c.2 Documentation supporting proper UL-634 standard installed on Room 104 door in BLDG. SP-64 will be provided.

6.c.3 AECS Head-End Equipment Protection – Check to ensure the physical location of the primary IDS head-end equipment (server and/or work station/monitoring equipment) is in a continuously occupied location (e.g. guard monitoring station for alarms and CCTV.) MSC HQ continuously manned station is the police connection after hours, and the Battle Watch Center (BWC) during normal working hours, and after hours (as a back up to the police connection) as defined by MSC Operational description. (See Glossary – Battle Watch Center)

6.c.4 Scheduled Maintenance – Periodic prescribed inspections or servicing of IDS or equipment, accomplished on a quarterly and yearly basis, to ensure the IDS is not just functional, but fully operational to execute mission. Quarterly checks to be conducted by MSC Personnel. Annual System operational test to be conducted by qualified Lenel Technician and documentation of completion will be provided to MSC HQ SSO.

6.c.5 Documentation supporting that installation provides appropriate line supervision will be provided to MSC SSO prior to installation. Line supervision for all intrusion detection equipment (IDE) components of an IDS (USG and contractor facilities) will employ 128-bit (or greater) encryption whenever the signal line leaves the SCIF. This includes signal lines between any IDE, premise control unit (PCU), and monitoring stations.

All lines employing line supervision require certification of the algorithm by the National Institute of Standards and Technology (NIST) (i.e., a NIST certificate). An alternate form of line supervision may be approved on a case-by-case basis by the COMSC HQ SSO.

6.c.6 Method of logging and archiving the Shunting or Masking of IDS internal zone or sensors must be a capability of the IDS system installed. Contractor will provide proof that system provides method of logging and archiving shunted or masked IDS internal zone or sensors. A solution for any installed IDS equipment causing SCIF to fail TEMPEST inspection must be provided and implemented prior to acceptance of SOVT (US Navy).

Contractor must provide documentation supporting Class-I or Class-II line supervision was installed and is being used in accordance with DoD Manual 5200.01, with the exception of portions of the transmission line running entirely through spaces or areas where unescorted access is controlled to at least the Secret level. Documentation will be provided to MSC SSO.

6.0 INSTALLATION AND MAINTENANCE

6.c.7 A copy of the UL 2050 certificate is required from the IDS installation Contractor and will be provided to the COMSC HQ SSO prior to the completion of the Class- I installation.

6.c.8 Closed Circuit Television (CCTV) – There will be one CCTV system with camera installed as part of this contract. The one (1) SCIF primary entry / exit door must have CCTV camera. Primary (only) entrance to SCIF must be continuously monitored by cleared employees (inside or outside the room or area) whenever the FF-L-2740 combination lock is disengaged for daytime or other routine access.

a. The Contractor shall maintain and comply with its Maintenance Plan.

b. Specific Maintenance Terms

7.b.1 Scheduled Maintenance – Periodic prescribed inspections or servicing of IDS or equipment, accomplished on a quarterly and yearly basis to ensure the IDS is not just functional, but fully operational to execute mission. Quarterly checks to be conducted by MSC Personnel. Annual System operational test to be conducted by qualified Lenel Technician and documentation of completion will be provided to MSC SSO.

c. Maintenance Schedule.

7.c.1 The vendor shall provide a proposed maintenance schedule as outlined in References (a) and (b).

a. The Contractor shall provide user training, training guide, and manuals.

8.a.1 In coordination with MSC Security, schedule and pay for one (1) Contractor Sponsored User training course. The first course will be attended by the COMSC HQ Special Security Representative (SSR) in February 2026, or as available, with awarded contracted IDS technician. The expense of this training course should be quoted in the contract bid.

8.a.2 Provide on-site training for the COMSC HQ SSO and his alternate once the installation is complete on the basic functions and usability of the system.

8.a.3 Provide user manuals or training guides for basic system operation.

a. The Contractor shall not anticipate use of Government furnished supplies or property in the performance of this Contract, other than those explicitly stated herein.

b. Government Furnished Services.

9.b.1 A requirement for additional escorts beyond N2 personnel for this service contract is not anticipated. Cleared and trained escorts will be required throughout the course of this installation. Attempt at securing escorts through N4 will be attempted based upon the installation schedule. In the event MSC HQ N4 cannot provide escorts, MSC HQ N21/N3/N5 personnel will provide escorts. The government will provide cleared and trained escorts and the ratio required will be one cleared and trained government escort per three IDS installation

7.0 MAINTENANCE REQUIREMENTS

8.0 TRAINING REQUIREMENTS

9.0 GOVERNMENT FURNISHED SERVICES/PROPERTY

contractors. Contractors engaged in this IDS installation shall follow direction from the government escorts while within the confines of MSC spaces, and shall not wander unaccompanied / unattached from government escort at any time. For the initial installation, contractors are not required to be cleared to any particular security clearance with the exception of vetting by corporate Human Resources. However, any subsequent installation or maintenance contractors supporting follow-on, maintenance duties in support of services portion of this award must be cleared at the SECRET level. Details will be stipulated within associated DD-254; Department of Defense Contract Security Classification Specification.

a. Facility Security Clearance. The Contractor shall handle, store, and maintain classified material and shall comply with the requirements set forth in the National Industrial Security Program Operating Manual (NISPOM) DoD 5220.22-M, DD Form 254, DoD Contract Security Classification Specification, and maintain appropriate facility clearance levels with approved security containers.

b. Information Security Requirements. The Contractor shall handle, store, and maintain classified material in compliance with requirements set by DoD Industrial Security Manual for Safeguarding classified Information, and the DD Form 254, DoD Contracts Security Classification Specification for classified contracts provided as a solicitation attachment.

c. Personnel Security Requirements. All Detachment Personnel, Program Manager, and Contractor personnel handling classified information necessary to carry out their duties and responsibilities with respect to this contract shall have a SECRET security clearance. The individuals shall possess the SECRET security clearance prior to the commencement of the contract and maintain the clearance throughout the duration of contract performance. Loss of a Secret clearance while performing under the contract will result in the Contractor employee being unqualified for the position. At that time, the Contractor will be responsible for replacing that individual with a qualified employee.

a. Each package, report, or other deliverable shall be accompanied by a cover letter (if submitted in hard copy) or the email shall contain the following information:

a. The contract number under which the item is being delivered.

b. The deliverable item and the specific contract reference that requires the delivered item(s).

c. Providing the users course for the COMSC HQ SSO and one back up (Cameron Bembry, (COMSC Special Security Representative. cameron.a.bembry.mil@us.navy.mil))

d. On-site operator training.

e. Operator’s manual/training guide.

a. Meetings and Communications.

12.a.1 Post-Award Conference. The Contractor shall attend a Post-Award Conference at MSC, Norfolk, VA, to include contracts and management personnel no later than 10 days after contract ward. Additionally, the Contractor shall demonstrate its management procedures, provide progress assessments, and schedule dates for near term critical milestones.

12.a.2 Post-Contract Debriefs. The Contractor may request a face-to-face post-contract debriefs to the Contracting Officer, but any costs associated with this face-to-face meeting are the Contractor’s responsibility. The post-contract debrief may also be held via telephone or email correspondence.

10.0 SECURITY REQUIREMENTS

11.0 CONTRACT DELIVERABLES

12.0 GENERAL CONTRACT ADMINISTRATION

mailto:cameron.a.bembry.mil@us.navy.mil

b. Authorized Changes Only By the Contracting Officer.

12.b.1 No order, statement, or conduct of Government personnel who visit the Contractor’s facility, or in any other manner communicates with Contractor personnel during the performance of this Contract, shall constitute a change under the Changes clause of this Contract.

12.b.2 The Contractor shall not comply with any order, direction or request of Government personnel unless it is issued in writing and signed by the Contracting Officer, or is pursuant to specific authority otherwise included as part of this Contract.

12.b.3 The Contracting Officer is the only person authorized to approve changes in any of the requirements of this Contract and notwithstanding provisions contained elsewhere in this Contract, said authority remains solely the Contracting Officer. In the event the Contractor effects any change at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the order price to cover any increase incurred as a result thereof. The address and telephone number of the Contracting Officer is:

Name: Alvinia R. Jenkins Address: 471 East C Street, Bldg SP-64 Norfolk, VA 23511-2419 Telephone: 757-443-5949

Or: any Warranted Contracting Officer at MSC in her absence.

c. Contracting Officer’s Representative (COR) – Functions and Limitations.

12.c.1 The COR will represent the Contracting Officer in the administration of technical details within the scope of this Contract and will manage inspection of products and services. The COR is not otherwise authorized to make any representations or commitments of any kind on behalf of the Contracting Officer or the Government. The COR does not have the authority to alter the Contractor's obligations or to change the specifications in the Contract. If, as a result of technical discussions, it is desirable to alter contractual obligations or the statement of work, a modification must be issued in writing and signed by the Contracting Officer.

The following individual is appointed as Contract Officer’s Representative under this Contract:

Name: David Kristofer Milford, COMSC HQ N21/SSO Address: 471 E C St, Bldg SP-64, 1st Deck, C Wing, Room 104, Cubicle 4, Norfolk, VA 23511 Telephone Number: Desk (757) 341-6659, Personal Cell (757) 287-5322

Deliverable or Service

Requirement

Measurement/Metric

Performance Standard

Acceptable Quality Level

(AQL)

Consequence

Installation, Operation, and Acceptance

System Operability Verification Test

Within 60-days of Start of PoP. Para 6.0.c.

through 6.c.8.

100%

Government not accepting work.

Penalty of 1% per day up to a maximum of 15 days.

Negative

CPARS

Rating.

Annual Service Maintenance

Annual System Checks by qualified

LENEL

operators

Completed within the first 45 days of beginning of the fiscal year once the option is exercised.

100%

After 45 days, a penalty of 1% per day up to 30 days.

Negative

CPARS

Rating

13.0 PERFORMANCE REQUIREMENT SUMMARY