Enclosure 2B Statement of Work Site Access Management Solution.pdf

Statement of Work for

Site Access Management Solution

UChicago Argonne, LLC, Operator of Argonne National Laboratory 9700 South Cass Avenue Argonne, IL 60439

March 10, 2025

1. Introduction

UChicago Argonne, LLC (“Argonne” or “Laboratory”) is a non-profit scientific research and development institution that manages and operates the Argonne National Laboratory facility based in Lemont, Illinois for the U.S. Department of Energy (“DOE”) as a Management and Operator

“M&O” contractor in accordance with the Federal Acquisition Regulation (“FAR”) Subpart 17.6 and the DOE Acquisition Regulation (“DEAR”) Part 970 and pursuant to DOE Prime Contract accessible at http://www.anl.gov/contract/. More information about Argonne, its mission and activities is available at www.anl.gov.

2. Background

Argonne is a controlled access facility and approval for site access is required. Argonne consists of approximately 100 buildings located on 1,500 acres and is occupied by approximately 5,000 people daily (during normal business hours) ranging from employees, facility users, contractors, students and visitors amongst other groups.

Argonne hosts approximately 50,000 visitors each year, each visitor requires the issuance of a visitor site access credentialing solution. Most of these visitors remain onsite for approximately five days or less. Foreign Nationals account for approximately 5,000 of those visitors, which require additional screening procedures. Additionally, the Site Access team issues over 10,000

Local Site Specific Only (LSSO) badges each year to on-site workers.

The current process used to create and print site access credentials involves outdated systems resulting in inefficient work process and the potential for inaccurate data entry.

3. Objective

Argonne is seeking to improve the visitor/worker experience throughout all points of the site access process by requesting the purchase of a Site Access Management Solution(SAMS).

SAMS will satisfy DOE order and Laboratory requirements which mandate that visitors be screened, processed and recorded and all workers be issued an LSSO for acessing the site.

SAMS will replace our current Gatepass (homegrown vistor management system). and 3rd party

DSX (LSSO badging system). All services and activities performed under the terms of this contract must meet or exceed United States Department of Energy (DOE), and Argonne orders and requirements. Integrating the new system to existing Argonne systems is also a critical component to this Statement of Work (SOW).

http://www.anl.gov/

4. Requirements

Proposal will be evaluated in accordance with the criteria presented in the below table.

Criteria

No.

Criteria Type

General Capabilities

1. Solution must be compatible with various browsers

(mobile and desktop) including but not limited to Chrome, Firefox, Safari, Edge without the inclusion of third-party plugins.

Required

2. Solution must be able to Integrate with Active Directory along with SAML 2.0 to provide a single sign-on experience.

Required

3. Solution must be scalable to support over 50,000 annual visitors and multiple buildings to be visited.

Required

4. Solution must have the ability to integrate with existing internally developed Laboratory systems and 3rd party systems through an open API as defined in the integrations section.

Required

5. Solution must be able to identify different roles such as general user, administrative user, etc. and assign permission granularly to each role. Roles must be able to be inherited based on external identity information.

Required

6. Solution must be intuitive and easy to learn. Required

7. Solution must be able to be modified (ex. forms changed) and creatable (ex. create new workflows) by a power user without vendor assistance.

Required

8. Solution must support a typical SDLC and adhere to a governance model to provide oversight of modifications.

Required

9. Solution must have power user creatable reports and have a completely open data model to report on any field /with any filters(s).

Required

10. Solution must be able to print reports and badges on any printer from a given list, selected from within the application, accessible and intuitively by the end user.

Required

11. Solution must be able to send automated emails based on specific criteria (ex. badges about to expire) with this feature being configurable by a power user.

Required

12. Solution must have the ability to create photos, also import / receive photos (from other solutions) and attach to a user profile.

Required

13. Solution must have capability to utilize externally generated criteria, such as Workday Training Module completion, Liability Waiver Completion, or Safety

Orientation Completion as a prerequisite for badge or site access approval.

Required

14. Solution must have the ability to issue conditional site access credentials that will be valid for a period of time.

(For example, valid only on Wednesdays, only on specific dates over the course of a 6-month period, or at limited times of day.)

Required

15. Solution must be able to store and implement additional requirements for site access request approvals based on visitor class, visitor building, or other criteria (for example, a user identified as a building manager must be able to require that visitors to their building have successfully completed a Building Safety Orientation

Document).

Required

16. Solution must provide the ability to integrate with document scanners and parse data from scanned documentation to intelligently populate fields.

Solution must be able to scan and interpret fields from identity documents (via OCR scanning or barcode interpretation) in order to prefill fields or perform lookups against existing available data.

For example, scanning the barcode on the reverse of a

Driver’s License to issue and print a visitor’s site access credential from a kiosk or OCR scanning the front of a passport to identify and log that a Real-ID compliant document was presented prior to printing a site access credential.

Federal Order Compliance

1. The solution must be Fed Ramp Moderate or the ability to run on-prem.

Required

2. Solution must be able to harvest information from

Homeland Security Presidential Directive 12 (HSPD-12)

Personal Identity Verification (PIV) credentials using ISO

14443 standard, store that information, and make the data available to external systems.

Required

3. Solution must be able to identify if a presented ID complies with the REAL ID Act of 2005 and modify workflow based on those criteria.

Required

Processing Site Access Visit Request

1. Solution must be able to utilize an external database (for example, the in-progress Argonne Enterprise Registration

System through ServiceNow or existing Visitor

Registration System) as the authoritative source for identities.

Required

2. Solution must be able to provide the ability for authorized users to generate approved site access credentials immediately to support walk-up/unexpected visitors using a visitor identity generated within the Argonne Enterprise

Registration System or Visitor Registration System.

Required

3. Solution must provide Argonne-defined approval workflows that account for specific criteria associated with the visit request such as visit duration, visit location, visit time-of-day, visitor type, or any other defined criteria. Approval workflows must be configurable and have the ability to be modified by power-users without vendor-required assistance.

Required

4. Solution must be able to automatically send informative and configurable notifications to both the visitor and host at key steps in the visit process.

5. Solution most provide a configurable dashboard based on user type to review items such as status, manage, request, approve, reject, and organize visitors and groups.

Required

6. Solution must be able to create and manage a list of identities that are not authorized to access Argonne (a

"Stop-Order" list) that automatically checks requests against it. This automated review must be able to check multiple criteria, including “like names”, of the visitor identity and notify users of the "Stop-Order" in a configurable manner. It must also be able to categorize and display levels of risk and instructions to the requestor/other users.

Required

7. Solution must be able to add identities or credentials to the Stop-Order list based on modifications to a physical credential's status (for example, if a credential is identified as "lost" or "not returned" the identity or credential must be added to the Stop-Order list).

Required

8. Solution must have the ability to recognize identities that are already authorized for site access and prevent users from requesting redundant site access authorization.

Required

9. Solution must be able to identify if a credential has been physically printed ("issued") and revoke the visitor's permission to print additional credentials without Argonne

Representative's approval. For example, a visitor can have a credential printed at a kiosk without assistance of an Argonne Representative once, but additional attempts to print a credential without assistance must be denied at a kiosk.

Required

10. Solution must be able to provide users within an approval workflow the ability to modify site access criteria as a condition of their approval (for example, an employee's supervisor that is routed to approve a request must be able to adjust buildings, dates, and times of the request). This process must route the modifications to the initial requestor for additional approval.

Required

11. Solution must provide users the ability to view some or all of their visitor requests/details and display progress of the requests. Users must also be able to view requests that they are associated with by building, approval, or subordinate.

12. Solution must allow authorized users to print site access credentials individually or in bulk using configurable criteria (for example, a user can print all site access credentials associated with visitors visiting one building in a single week).

Required

13. Ability to maintain a history by visitor that is accessible by the end user.

Required

14. Solution must have the ability to create / modify business rules for site access approval without vendor assistance.

Required

15. Solution must be able to apply Argonne defined data retention policies to internally stored visitor identities and visit history.

Required

16. Solution must be able to apply additional approval workflow requirements to visitors identified as Foreign

National and provide users within the approval workflow the ability to quickly review the visitor's history.

Required

17. Solution must provide users with the ability to search visitor identities, visit history, or any other stored criteria dynamically including wild card criteria.

Required

Issuing Site Access to Visitors

1. The SAMS must have the ability to print passes using

Argonne provided printers leveraging specific templates defined by visitor type from within the solution.

Required

2. Allow visitor QR codes/barcodes to be scanned at the security post from a mobile device or hard copy and automatically print a site access credential. The scannable object must be configurable to meet the requirements of existing Argonne systems.

Required

3. The SAMS must allow multiple visitor gate pass templates and accommodate Argonne’s site access template requirements and include the printing of unique photo

Required

4. Credential templates must be modifiable within the

SAMS without vendor assistance.

5. SAMS must support scanning IDs and capturing data using a scanner reader or similar device (driver’s licenses, passports, etc.).

6. Ability to capture a visitor’s photo at security post, kiosk or AWC reception desk and the ability to store them

(There may be cases where photos are not allowed to be stored and the system must be able to recognize those cases.

Required

7. Prevent issuance of site access credential for visitors who are on an active stop order.

Required

8. Allow bulk issuance and printing of multiple visitors with configurable parameters, including pre-printing of passes.

Required

9. Immediately export data based on issued visitor gate passes into existing Xpress Entry database for site access purposes at entry gates.

Required

Local Site Specific Only (LSSO) Badging Application

1. Worker information from our Human Resource System

(HRS/Workday) needs to be available in the badging application through a secured automated integration to print badges based on their HRS job profile and U.S.

citizenship indicator (see integrations).

Required

2. The SAMS must allow multiple Local Site Specific Only

(LSSO) badge templates and accommodate Argonne’s

LSSO template requirements.

Required

3. Credential templates must be user modifiable within the solution without vendor assistance.

Required

4. The badging application needs to be able to print temporary site access credentials if an LSSO holder forgets their badge and be able to deactivate the credential that is no longer under the holder’s control.

Required

5. Ability to record and report on LSSO badge issuance, returned, lost, stolen, or damage badges.

Required

6. Ability to capture a photo at reception desk and the ability to store them and print them on LSSO badges.

Required

7. Immediate export data based on issued LSSO credentials into existing Xpress Entry database for site access purposes at entry gates.

Required

8. System is able to integrate into an external certificate-based credential minting system (for example, Unifyia) to identify temporary or short-term credentials issued in

Optional instances where existing credential-holders forgot or misplaced their primary credentials.

Reporting

1. Ability to have scheduled reports and data available in a dashboard (charts, graphs, etc.). and automate email of those reports.

Required

2. Ability to export data in a user-friendly non-proprietary format.

Required

Integrations

1. Describe integration capabilities for inbound/outbound data with existing Argonne systems, both custom and 3rd party products, and external applications. Describe the interfaces that are available both inbound and outbound and for what data elements. Solution should provide an open API for the building of additional integrations as needed.

Required

2. Integrate with Argonne SSO (preferably SAML 2.0) to provide a single sign-on experience.

Required

3. System supports external data sources for populating drop-down lists (building locations).

Required

4. System should support data-entry workflows that redirect to external systems for additional data collection and return the user (application user such as an administrator or a registrant) of the system when this workflow is completed.

Required

5. System has the ability to export data in a fully filterable format through the user interface. Please describe the formats that are available for exporting data.

Required

Technical System Architecture

1. Solution must be capable of secure transmission of sensitive information to downstream relevant systems.

Required

2. Solution supports the migration of historical records, where needed, into the new system. Vendor should note capabilities they provide for professional services, or system/software capabilities to assist with migration of historical data into the new system.

Required

3. Argonne dedicated environments to include sandbox, dev and production.

4. Vendor should note if their solution is certified to store and maintain PII or sensitive information at the NIST

Moderate level. Cloud based solutions must provide

FedRAMP authorization details at a moderate or high level and a completed SaaS Questionnaire (see attached).

Required

5. Cloud solutions must be able to operate exclusively on

IPv6.

Optional

5. Project Implementation Plan

Offeror shall prepare and submit a plan and timeline to configure and implement a system to meet the functional and technical requirements described in this document.

6. Training

Argonne anticipates the need for remote training for all system roles. Offerors should be prepared to submit training options and associated prices.

7. Testing

A “sandbox”/”non-production” environment(s) is required to test system functionality and system configurations.

8. Deliverables

Deliverables must include software development, implementation, training and support services.

Expectation on go live date is for the system to be complete and ready to implement between the months of June and December of 2025.

9. Argonne Responsibilities

• Argonne shall provide the Contractor access to the appropriate personnel as required for the successful completion of this project.

• Argonne shall provide interfacing code required to connect the new system to Argonne’s existing systems with assistance from Vendor.

• Argonne shall perform acceptance testing and verification.

10. Security

The Cyber Security Program Office follows the National Institute of Standards and Technology

(NIST) Cyber Security Framework. All subcontracts, where applicable, will work within the same requirements as though the subcontractor was part of the Laboratory’s cyber program.

Argonne’s Cyber Security Program requires that all persons who access sensitive data or applications must learn and adhere to protection requirements of the data or application, must not bypass procedures established to protect data and applications, and must immediately report any findings of inadequacies in protection procedures to the Cyber Security Program Office

(cyber@anl.gov).

In cases where staffing is required, vetting of identity (NIST 800-63 Identity Assurance Level 3) and strong authentication (NIST 800-63 Authentication Assurance Level 3) will be required.

Argonne uses the HSPD-12 smart card for staff relationships that last longer than 6 months.

Argonne may provide relevant information requested from the vendor or remote access as required to gather information. U.S. citizenship will be required for any access to systems or data.

The manager of the contract and the Cyber Security Program Office must approve authorization for remote work.

11. Government-Furnished Property

Government-Furnished Property may be required for this endeavor.

12. Place of Performance

Selected contractor may perform the contract at remote locations within the U.S. On-site visits may be required for development of this platform.

13. Period of Performance

The selected Contractor shall be prepared to begin executing the aforementioned requirements within 15 days of the award. The Contractor shall provide a period of performance schedule, which will include the Software Implementation Plan and time for training for key Laboratory personnel. The Laboratory intends to award a purchase order for a three-year base period with options to extend annually for an additional two years. The entire term of the award, with all option years exercised, shall not exceed five years.