ESS SOW Albeni Falls Dam_DRAFT.pdf

Statement of Work (SOW) Albeni Falls Dam, Oldtown ID Electronic Security System

Servers and Workstations Upgrade

1. GENERAL INFORMATION

1.1 Purpose

The objective of this contract is the acquisition of upgraded servers and workstations for the Albeni Falls Dam (AFD) Electronic Security System (ESS). In addition to equipment procurement, this contract requires on-site support for installation, commissioning, extended support services, and comprehensive implementation of DoD cybersecurity controls.

1.2 Background and System Description

The AFD ESS consists of a Closed-Circuit Television (CCTV) system and an Access Control System (ACS). The system uses dedicated servers and operator workstations and is a fully air-gapped and isolated local network.

Upgrades are required to ensure that both systems are functioning properly and to provide for future upgrades and scalability. Compatibility with existing hardware and software (Milestone and Identiv) is required as not all current system components are being replaced.

2. REQUIRED EQUIPMENT

2.1 Hardware and Software Requirements: CCTV Server

2.1.1 Processing, RAM, and networking capability to support 25 cameras with 4k resolution, 60 fps frame rate, and PTZ capability.

2.1.2 Storage capacity for 30 days of continuous footage for 25 cameras with 4k resolution and 60 fps frame rate.

2.1.3 RAID configuration that provides fault tolerance and redundancy.

2.1.4 Operating System: Latest version of Windows Server.

2.1.5 Software: Latest versions of Milestone Xprotect Professional Plus and SQL Server.

2.2 Hardware and Software Requirements: ACS Server

2.2.1 Capability to support all existing ACS devices (Hirsch MX Series controllers, readers, sensors, etc.).

2.2.2 Adequate storage capacity for all ACS components and data.

2.2.3 RAID configuration that provides redundancy.

2.2.4 Operating System: Latest version of Windows Server.

2.2.5 Software: Latest versions of Identiv Hirsch Velocity and SQL Server.

2.3 Hardware Requirements: Workstations (Qty 2)

2.3.1 Processing, RAM, and graphics capacity for all camera feeds at 4k resolution and 60 fps.

2.3.2 Capability for all camera control functions (e.g., PTZ).

2.3.3 Capability for simultaneous operation of both ACS and CCTV systems without performance degradation.

2.3.4 Operating System: Latest version of Windows 10 or 11

Professional.

2.3.5 Software: Latest client versions of Milestone Xprotect and Identiv Hirsch Velocity.

2.4 Software License and Support Requirements

2.4.1 CCTV Software: Milestone Xprotect Professional Plus base license and licenses for 25 cameras, with a 5-Year Milestone Care Plus support agreement.

2.4.2 ACS Software: Identiv Hirsch Velocity server licensing, with a 5-year Velocity Software Support Agreement.

2.4.3 Database Software: SQL Server + CAL Licensing option.

3. REQUIRED SERVICES AND CYBERSECURITY EXECUTION

The contractor shall procure, deliver, install, program, and commission all equipment of this procurement. During installation and configuration, the contractor shall deliver a fully hardened system by implementing the following cybersecurity controls:

3.1 System Hardening, SRGs, and STIGs Requirements

The contractor shall install, configure, and harden all hardware and software in accordance with the manufacturers’ documentation and the Defense Information Systems Agency’s (DISA) Security Requirements Guide (SRG) and the Security Technical Implementation Guide (STIG).

Requirements for SRGs and STIGs can be found in the Unified Facilities Guida Specification, UFGS 25 05 11, Cybersecurity for Facility-Related Systems.

At a minimum, the following STIG(s) and SRG(s) shall be applied:

3.1.1 Windows Server STIG: Applicable to the CCTV and ACS servers.

3.1.2 Windows 10 / Windows 11 STIG: Applicable to the two new operator workstations.

3.1.3 Microsoft SQL Server STIG: Applicable to the database software on the servers.

3.1.4 Application Security and Development SRG: Applicable as baseline guidance for securely configuring Milestone and Identiv.

3.1.5 Any deviation(s) from the manufacturer(s)’ instructions shall be documented as needed with the SRG and STIG submittals.

3.2 Access Control and Authentication Requirements

3.2.1 User Accounts: Operating systems must fully support user accounts. Applications must not require administrator privileges for normal operation. Configure the system with at least three account privilege levels: operator, service, and administration.

3.2.2 Logon Limits: Lock user accounts after three (3) unsuccessful logon attempts within a 15-minute interval.

3.2.3 Password Complexity: Enforce a minimum password length of 12 characters requiring at least one uppercase, one lowercase, one numeric, and one special character. Passwords must have a maximum lifetime of 60 days and maintain a history of the previous five passwords.

3.3 System Integrity and Auditing

3.3.1 Auditing: Configure computers to audit successful/unsuccessful logon attempts, attempts to modify privileges, account creation/modifications, and privileged system-level access.

3.3.2 BIOS/UEFI Protection: Provide a password/passphrase to prevent unwanted changes to the system BIOS/UEFI on all devices and enable UEFI Secure Boot.

3.3.3 Malicious Code Protection: Install and configure DoD-approved malware protection software. Systems must have up-to-date definitions (not older than 10 days) prior to deployment.

4. CYBERSECURITY DURING CONSTRUCTION

4.1 Dedicated Contract Equipment Strategy

4.1.1 The contractor shall use the Dedicated Contract

Equipment strategy for all programming, configuration, and diagnostic activities.

4.1.2 Dedicated Contract Equipment is defined as equipment purchased specifically through this contract that will never be utilized as general contractor equipment, serving the sole purpose of supporting the Albeni Falls ESS project.

4.1.3 Execution: The contractor shall use one of the new workstations being delivered under this contract to perform all programming and configuration tasks. This workstation must be fully configured to meet all security requirements outlined in Section 3 of this SOW before it is connected to the network or used to program any other component of the ESS. Upon project completion, this equipment remains property of the Government.

5. SUBMITTAL PROCEDURES AND REQUIREMENTS

5.1 Submittal Preparation and Delivery

5.1.1 Format: All submittals must be provided in electronic PDF format.

Files must be complete, legible, and text-searchable (using OCR if scanned).

5.1.2 Identification: Mark each submittal with the project title, contract number, and submittal description.

5.1.3 Transmittal: Transmit each submittal using ENG Form 4025-R.

Sensitive or encrypted submittals must be transmitted securely via DoD SAFE.

5.1.4 Government Review: Submittals will be returned as "Approved," "Approved as Noted," or "Revise and Resubmit." Work associated with a submittal cannot proceed until it is Approved or Approved as Noted.

5.2 Required Cybersecurity Submittals

The contractor shall provide the following documentation to prove compliance with all cybersecurity controls:

5.2.1 Pre-Construction Submittals:

5.2.1.1 Contractor Personnel Certifications: Proof that personnel performing cybersecurity functions possess a current Information Assurance Technical (IAT) Level II certification.

5.2.1.2 Pre-Construction Control System Inventory Report: A

baseline inventory of all hardware and software.

5.2.1.3 Proposed STIG and SRG Applicability Report: A formal

report confirming the specific STIGs and SRGs (listed in Section 3.1) that will be applied to the system components.

5.2.2 Execution and Shop Drawing Submittals:

5.2.2.1 Network Communication, Ports, Protocols and Services

(PPS) Report: Document all communication protocols, services, and TCP/UDP ports used by the system.

5.2.2.2 System Data Flow and Cybersecurity Network Diagrams

(Encrypted).

5.2.3 Testing Submittals:

5.2.3.1 Control System Cybersecurity Testing Procedures: Step-by-step procedures to verify that all cybersecurity requirements have been met.

5.2.3.2 Control System Cybersecurity Testing Report: Final report documenting the execution and results of the approved testing procedures (must be Government-witnessed).

5.2.3.3 Antivirus/Antimalware Scan Results: Results

demonstrating clean scans prior to system commissioning.

5.2.4 Closeout Submittals:

5.2.4.1 STIG, SRG, and Vendor Guide Compliance Result Report

(Encrypted): A report documenting compliance with all STIGs. This MUST include a Deviations List detailing any security controls that could not be applied, along with justifications and risk-mitigation actions.

5.2.4.2 Software and Configuration Backups (Encrypted): A bare-metal recovery image of the final as-built configuration for each server and workstation on an encrypted external hard drive.

5.2.4.3 Final Control System Inventory Report (Encrypted).

5.2.4.4 Confidential Password Report: A secure turnover of all administrative passwords.

6. TRAINING

6.1 Classroom and Hands-On Training

6.1.1 The contractor shall provide eight (8) hours of classroom and hands-on training for up to six (6) Government personnel.

6.1.2 Training must cover both standard system operation (CCTV and ACS) and cybersecurity maintenance (applying updates, user account management, and system configuration).

7. WARRANTY AND GENERAL SECURITY

7.1 Warranty

7.1.1 The contractor shall provide a one (1) year warranty against any defects in material or workmanship, with a maximum 14-day turnaround for repairs or replacements at no cost to the government.

7.2 Hours of Operation

7.2.1 Work is required between 0630 – 1700, Monday through Thursday, excluding Federal holidays.

7.2.2 Deliveries shall be scheduled between 0730 and 1600, Monday through Thursday.