Statement_of_Work.pdf

STATEMENT OF WORK

Overspeed Directional Detection System on

Joint Base McGuire-Dix-Lakehurst, NJ

DEPARTMENT OF THE AIR FORCE

87TH AIR BASE WING (AMC)

1. DESCRIPTION OF SERVICES

1.1 REQUIREMENTS: This project consists of purchasing, installing and testing an Overspeed Directional Detection System (ODDS) at the installation gates for Joint Base McGuire-Dix-Lakehurst, to include the following locations: McGuire Main Gate (4 lanes), Ft Dix Main Gate (4 lanes), Wrightstown Gate (2 lanes), Pemberton Gate (2 lanes), Browns Mills Gate (2 lanes), Falcon Courts North Gate (2 lanes), Lakehurst Main Gate (2 lanes), Lakehurst Commercial Gate (2 lanes).

1.2 LIABILITY: The contractor shall be liable for any damages resulting from any carelessness or failure to follow proper safety, installation, engineering, or maintenance procedures and standards.

1.3 GOVERNMENT FURNISHED SERVICES: The government will provide emergency medical transportation and treatment if required. The contractor shall reimburse the Government for the cost of these medical services at current rates.

2. GENERAL INFORMATION

2.1 HOURS OF OPERATION: The normal hours of operation for the project are from 0730 to 1630, Monday through Friday, excluding holidays and AMC Family days.

2.2 CONTRACTOR PERSONNEL: The contractor shall provide point of contact (POC) for all contractual matters during all hours of operation. The POC shall respond on-site within 1 hour during normal duty hours of operation and within 2 hours during non-duty hours to discuss concerns with government personnel designated by the CO to discuss problem areas.

3 SECURITY

3.1 PASS AND IDENTIFICATION ITEMS: The contractor shall ensure the pass and identification items required for contract performance are obtained for employees.

3.2 RETRIEVING IDENTIFICATION MEDIA: The contractor shall return all identification media and/or visitor passes from employees who depart for any reason before the contract expires; i.e. terminated for cause, reassignment, retirement, etc.

3.3 TRAFFIC LAWS: The contractor and its employees shall comply with base traffic regulations. Traffic regulations include, but are not limited to:

Employees shall wear seatbelts when operating or riding in any vehicle (military, company or private owned) while on installation.

Speed limits on Joint Base McGuire-Dix-Lakehurst (JB MDL) are 25 MPH unless otherwise posted. Be aware of reduced speed limits and exercise caution when driving in base housing and school zones.

All vehicle operators on the installation shall not use cell phones unless the vehicle is safely parked or they are using a 100% hands free device. The wearing of any other portable headphones, earphones or other listening devices while operating a motor vehicle is prohibited.

3.4 WEAPONS, FIREARMS, AND AMMUNITION: Employees are prohibited from possessing weapons, firearms, or ammunition on themselves or within vehicles (military, contractor-owned, or privately owned) while on JB MDL.

3.5 FOR OFFICIAL USE ONLY (FOUO): The contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

3.6 REPORTING REQUIREMENTS: Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified/unclassified defense information. Employees shall be briefed by their immediate supervisor upon initial on-base assignment.

3.7 PHYSICAL SECURITY: The contractor shall be responsible for safeguarding all Government property and controlled forms provided for contractor use. At the end of each work period, all Government facilities, equipment and materials shall be secured.

3.8 CONTROLLED/RESTRICTED AREAS: The contractor shall implement local base procedures for entry to AF Controlled/Restricted areas where contractor personnel will work. An AF Form 2586, Unescorted Entry Authorization Certificate, must be completed and signed by 87th Security Forces Squadron security manager before restricted area badges (RAB) will be issued. Employees must have a completed and favorable NACI investigation before receiving a RAB. Interim access can be granted in accordance with AFI 31-501, Personnel Security Program Management.

3.9 MILITARY EXERCISES: No compensation will be claimed for any delays resulting from re-entry procedures due to exercises.

4.0 Detailed Work Requirements:

4.1 GENERAL WORK REQUIREMENTS:

a) Comply with National Electrical Code Standards.

b) All work shall be completed between 0730 and 1630 unless otherwise approved.

c) Request and obtain 100% approval on a Dig Permit (AF Form 103) prior to any digging/trenching/construction work. The contractor must maintain utility marking throughout the project.

d) Perform work with minimal impediment of any daily operations. Should the contractor need to impede any operations, the contractor must obtain approval for each impediment and get any Course of Action (COA) plans for comp measures approved prior to the impediment.

e) Perform work without impeding traffic at the above listed vehicle gates. Should the contractor need to impede traffic, the contractor must coordinate impediments with the 87th Security Forces Squadron at least 72hrs in advance. It is preferred that the contractor produce a schedule of lane closures and that this schedule is staggered with only one gate exit closed at a time.

f) The limits of construction shall be within the general areas around the Installation Entry Control points where the ODDS are to be installed. Protect areas were construction is not being conducted so as not to disturbed the non-construction areas.

The contractor shall restore all areas to pre-construction conditions.

g) The contractor shall coordinate any and all power shut downs that are required to accomplish the connection of electrical power to the ODDS. If the power shut down will affect any operations, coordination must first be made and a plan developed to compensate for the power being down, if for more than 1 hour.

h) The contractor shall provide all material/equipment to be used and installed at all of the locations were work is being done.

i) Demolition work shall include but is not limited to cutting and trenching of possible concrete, asphalt, and earth for installation of new underground loop sensors and associated conduit and to gain access to existing conduit.

j) Remove and haul demolition material. All demolition material becomes the property of the contractor and must be removed off the base.

k) Should the contractor damage any existing infrastructure or structure he will repair/replace at no additional cost to the government.

l) New construction shall include but is not limited to:Remediation for the cutting and trenching. Remediation material must be equal to the material and quality of the material removed.

m) Install new conduit on or under the surface to each ODDS location and to the power source if needed.

n) Install new sensors associated with the ODDS.

o) Install all associated computer equipment inside each of the Installation Entry Control Point facilities for the gate guards to be able to monitor the ODDS.

p) Install all switches and converters associated with the ODDS.

q) Install and connect all electrical connections with the associated equipment.

r) Install digital display for the gate guards to be able to monitor from the outside of the facilities. The display should be capable of displaying the speed or if it is the wrong way sensors.

s) The ODDS should have audible and visible alarms that can be seen/heard by the gate guard on the outside of the building as well as on the inside of the facility. The alarms should have two distinct different sounds to be able to identify whether the vehicle is going over speed or the wrong way via the alarm sounds.

t) Test each ODDS to ensure they operate properly and pick up vehicles at the desired designated locations and direction.

u) Restore all disturbed areas to pre-construction conditions.

4.2 Location Specific Details:

4.2.1 Wrightstown Gate, Pemberton Gate, Browns Mills Gate, Falcon Court North Gate, Lakehurst Gate and Lakehurst Commercial Gate - Over Speed & Directional Detection System each consist of the following;

a) One (1) ODDS Computer with Software

b) 15" Computer Monitor

c) Multiplexer with a NEMA 4 enclosure

d) RS-485/Ethernet - converters power supplies, web relays, and terminal blocks.

e) Over Speed and Wrong Way Detection Sensors:

i. One (1) Zone One Over Speed Detection Sensor - Includes Sensor, Mounting Bracket, and preformed cable

ii. One (1) Zone Two Over Speed Detection Sensor - Includes Sensor, Mounting Bracket, and preformed cable

iii. One (1) Wrong Way Detection Sensor - Includes Sensor, Mounting Bracket, and preformed cable

f) One (1) Over Speed I Wrong Way Display Board Illuminated single-sided display board for mounting under canopy

g) ODDS Audible Alarm:

i. One (1) Variable volume alarm to be mounted externally.

ii. Two separate tones for Over Speed & Wrong Way

4.2.2 McGuire Main and RT 68 Gate - Over Speed & Directional Detection System each consist of the following;

a) One (1) ODDS Computer with Software

b) 15" Computer Monitor

c) Multiplexer with a NEMA 4 enclosure

d) RS-485/Ethernet - converters power supplies, web relays, and terminal blocks.

e) Over Speed and Wrong Way Detection Sensors:

i. Two (2) Zone One Over Speed Detection Sensor - Includes Sensor, Mounting Bracket, and preformed cable

ii. Two (2) Zone Two Over Speed Detection Sensor - Includes Sensor, Mounting Bracket, and preformed cable

iii. Two (2) Wrong Way Detection Sensor - Includes Sensor, Mounting Bracket, and preformed cable

f) Two (2) Over Speed I Wrong Way Display Board Illuminated single-sided display board for mounting under canopy

g) ODDS Audible Alarm:

i. Two (2) Variable volume alarm to be mounted externally.

ii. Two separate tones for Over Speed & Wrong Way

4.3 Additional Training Requirements:

a) Provide training to operators on the system. Also, provide administrator and basic trouble shooting training to 87th SFS Physical Security personnel, along with providing training material for 87 SFS Physical Security personnel to train 87th SFS Operations Flight personnel.

b) Provide a minimum of one year commerical warranty maintenance for the ODDS.

This should include but not limited to programming, replacing parts, and trouble shooting.

5.0 Information Assurance:

5.1 Information Assurance Documentation: The new system shall comply with the following DoD policy documents or latest versions (http://iase.disa.mil provides the latest version of the following DoD documents and STIGs):

DoD Directive 5000.1, The Defense Acquisition System (ref (a), (j), and (k)).

Department of Defense Directive (DoDD 8500.1, Information Assurance (IA).

Department of Defense Instruction (DoDI 8500.2, Information Assurance (IA) Implementation.

10 U.S.C. Section 2224, Defense Information Assurance Program.

Office of Management and Budget Circular A-130, Appendix III, Management of Federal Information Resources.

Database Security Requirements Guide (SRG), Version 2, Release 8, 26 Jan 2018.

Network L2 Switch STIG, Version 8, Release 25, 20 Jul 2018.

WEB Server Security Requirements Guide (SRG), Version 2, Release 2, 23 Oct 2015

Windows 10 STIG, Version 1, Release 14, 20 Jul 2018

5.2 Information Assurance Support Requirements: Systems that are not considered "information systems" do not need to comply with IA related guidance listed below. In order to be classified as such, the system must not store, process, transmit, or transfer data. DoDD 8500.1 states "Information assurance requirements shall be identified and included in the design, acquisition, installation and operation, upgrade, or replacement of all DoD information systems in accordance with 10 U.S.C. Section 2224, Office of Management and Budget Circular A-130, Appendix III, DoD Directive 5000.1 (reference (a), (j) and (k)), DoDD 8500.1 and DoDI

8500.2, and other IA related DOD and Air Force regulations and guidance as issued.

All DoD information systems shall maintain an appropriate level of confidentiality, integrity, authentication, non-repudiation, and availability that reflect a balance among the importance and sensitivity of the information and information assets; documented threats and vulnerabilities, the trustworthiness of users and interconnecting systems; the impact of impairment or destruction to the DoD information system; and cost effectiveness.

Interoperability and integration of IA solutions within supporting the Department of Defense shall be achieved through adherence to an architecture that will enable the evolution to network centric warfare by remaining consistent with the Command, Control, Communications, Computers, Intelligence, Surveillance, Reconnaissance Architecture Framework, and a defense-in-depth approach. This combination produces layers of technical and non-technical solutions that: provide appropriate level of confidentiality, integrity, authentication, non-repudiation, and availability; defend the perimeters of enclaves; provide appropriate degrees of protection to all enclaves and computing environments; and make appropriate use of supporting IA infrastructures, to include robust key management and incident detection and response."

The contractor shall incorporate all applicable technical, procedural, and system documentation associated with federal, Department of Defense (DoD), and Air Force information assurance (IA) policy and requirements for systems that transmit and manage sensitive but unclassified (SBU) data traffic.

The contractor shall also provide support to the following IA requirements:

An IA-enabled product is a product or technology whose primary role is not security, but which provides security services as an associated feature of its intended operating capabilities. To meet the intent of NSTISSP #11, acquired IA-enabled products must be evaluated if the IA features are going to be used to perform one of the security services (availability, integrity, confidentiality, authentication, or non-repudiation). Therefore, the determination of whether an IA-enabled product must be evaluated will be dependent upon how that particular product will be used within the consumer's system architecture.

Examples include such products as security-enabled web browsers, screening routers, and security-enabled messaging systems. Although NSTISSP #11 uses both terms, the policy as stated applies equally to both types of products.

Provide support and documentation for the initial "type accreditation" in process.

Provide system information up to the component and program level to the Base security engineering team at the Critical Design Review (CDR).

Provide access to the system and engineering support to the security engineering team so that the team can perform requisite system security assessment(s), and catalog identified risks and mitigating security controls into a plan of action and milestones (POA&M) prior to acceptance test.

Implement technical security controls, settings, and mitigation measures identified by the security engineering team prior to acceptance test.

Provide system administration, access, and engineering support to the certification engineering team and installation management personnel during installation certification activities after acceptance test and prior to system burn-in.

Provide system information and security assistance to the certification authority and certification agents during certification recommendation and accreditation decisions.

Obtain information assurance vulnerability alert (IAVA), system patches, and anti-virus updates from applicable original equipment manufacturers (OEM), industry, and government sources when published; evaluate each update against system components for operational impact; and periodically deliver and implement each update onto applicable system components throughout the operations and maintenance phase of the system lifecycle. This contractor support shall occur on a quarterly basis, or as required by the Department of the Air Force at a minimum, however, the contractor shall obtain, evaluate, deliver, and implement applicable updates more frequently should update sources indicate a particular update requirement to be a high priority (e.g., required response to a significant virus or denial of service attack) and also IAW DISA Security Technical Implementation Guidance (STIG). The contractor shall report all associated update activity to the Base POC on a quarterly basis. Ensure that all Prime Sites comply with all applicable physical and environmental security controls for MAC III systems processing sensitive information identified within DoDI 8500.2, Information Assurance Implementation. Systems that connect to DoD systems must maintain a level of security equal to the DoD system. Outside agencies have to follow the same policies as DoD and a Memorandum of Agreement has to be established. Outsourcing of management or IA has to be approved by the COI and a formal risk assessment is required.

Provide list of equipment Serial Numbers, Model Numbers, IP Addresses, and OS versions used and how system is connected.

Provide contact for management of information system being utilized. Provide maintenance plan for system.

5.3 Information Assurance System Requirements: The new system shall provide the additional features to support the IA requirements:

Time Reference Subsystem - To synchronize log and event recording and maintain a time reference to facilitate data analysis and evaluation. The proposal shall indicate the criteria for and the stability level (stratum) selected and system implementation.

System Update Service - Provide a centralized distribution point for patch management and anti-virus updates for all the components within the system using Citadel Hercules management system. Software license for Hercules will be provided by the Government.

Centralized Log Server - Consolidate all of the log files from all components and provide a mechanism to backup the log files to media.

Auditing - Audit the logon and actions for all system components by user and send the audit logs to different media or a centralized server.

Backup/Restore - Provide a mechanism to backup configuration files and operating systems and a capability to restore the data.

Include and support all IA activities necessary to meet DoD and Air Force IA requirements and comply with RMF as a part of the Camera implementation.

5.4 Information Assurance Certification Support: The contractor shall provide system administration, access, and engineering support to the 87 CE who will then coordinate with the IA certification team during the IA certification activities after acceptance test and prior to system burn-in. IAW AFMAN 17-1303 Cybersecurity Workforce Improvement Program meet the minimum 8570 Baseline requirement for Certification.