Attachment 1 - SOW 19 May 2025.pdf

--FOR OFFICIAL USE ONLY—

Statement of Work (SoW) for Automated Entry Control System (AECS) Building 24 – Spangdahlem AB, Germany

1. Requirement Description: The proposed open storage area contains five (5) separate rooms including two (2) entry ways. This prevents proper visual control of the entry when the area is manned, and the area does not have an Automated Entry Control System (AECS) installed in accordance with DoDM 5200.01 Volume 3 AFMAN 16-1404 Volume 3, Information Security Program: Protection of Classified Information (https://static.e-publishing.af.mil/production/1/saf_aa/publication/dodm5200.01v3_dafman16- 1404v3/dodm5200.01v3_dafman16-1404v3.pdf). Contractors must be approved and certified to perform work in US classified areas with secure information.

2. Requirement Background: To position classified networks supporting Spangdahlem and its Geographically Separated Units (GSU) into a more resilient system, it is necessary to move a portion of Spangdahlem’s network into a second Open Storage location. During a site survey to determine the ability of Building 24 to be certified for Open Storage, it was determined that the building was missing an AECS. Without this AECS, Building 24 cannot be Open Storage certified, impeding our ability to harden our network posture supporting Command and Control supporting USAFE and our coalition partners within NATO.

3. Requirement Specifications:

The requirement is to install a stand-alone AECS. This system should control entry on two

(2) doors in Building 24 to limit access into the open storage area and prevent entry by unauthorized personnel. The open storage area will include Rooms 101, 102, 103, 109, and

110. The first door is at the exterior building, Room 110, equipment room. The second door is in the interior of the building, Room 102, tech control office from hall. See Attachment A

– Building 24 Floor Plan.

The AECS must comply with the requirements listed in AFMAN 16-1404 Volume 3, subparagraph 3.a.(2), which states “The AECS shall identify an individual and authenticate the person’s authority to enter the area through the use of an identification (ID) badge or card.” Subparagraph 3.2(2)(a) states, “The ID badge or key card shall use embedded sensors, integrated circuits, magnetic stripes, or other means of encoding data that identifies the facility and the individual to whom the card is used.” The key cards must use RFID or similar technology for close proximity reading. Level 2 AECS is required which includes an access card plus Personnel Identification Number (PIN). In accordance with AFMAN 16-1404 Volume 3, subparagraph 3.b.(2), “The key card system shall meet the level 2 requirement, with the AECS providing a 0.97 probability of granting access to an authorized system to an authorized user providing the proper identifying information within three attempts. In addition, the system shall ensure an unauthorized user is granted access with less than 0.010 probability after three attempts to gain entry have been made.”

Page | 2

The AECS shall require the use of a PIN to be used in conjunction with the ID badge/card or the biometrics authentication method, and it must be listed on the USAF Configuration Management Database (CMD). AFMAN 16-1404 Volume 3, subparagraph 3.a.(3) states, “In conjunction with subparagraph 3.a.(2)(a) of this section, a personal identification PIN (PIN) may be required. The PIN shall be separately entered into the system by each individual using a keypad device and shall consist of four or more digits, randomly selected, with no known or logical association with the individual.” Subparagraph 3.a.(5)(c) states, “Keypad devices shall be designed or installed to prevent unauthorized persons in the immediate vicinity to observe the selection of input numbers.”

AFMAN 16-1404 Volume 3, subparagraph 3.a.(5)(b) states, “All card readers, keypads, communication or interface devices located outside the entrance to the controlled area shall have tamper resistant enclosures and be securely fastened to the wall or other permanent structure.” Transmission lines between all devices must be kept separate from existing communications cabling. AFMAN 16-1404 Volume 3, subparagraph 3.a.(5)(e) states, “Electric strikes used in access control systems shall be heavy duty, industrial grade.” In accordance with AFMAN 16-1404 Volume 3, subparagraph 3.b.(4), Electrical components, including wiring, or mechanical links shall be accessible only from inside the controlled area, or, if they traverse an uncontrolled area, they shall be secured within conduit to preclude surreptitious manipulation of components.” Any AECS cabling inside the controlled area does not require a conduit. All AECS cabling should be within the controlled area.

The computer managing the AECS, and allowing authorized personnel to be entered, or removed from the system, must be located in Building 24, Room 102 in the corner against the male restroom, within the open storage area and have connectivity to the systems installed at both doors. This management computer will require only a minimal degree of physical security designed to prevent unauthorized access to the panel. The computer must have the ability to remove or add an individual’s authorization to enter the area and must come with a printer to print information like name, badge number, signature of holder. The computer must have its own uninterruptable power supply (UPS), capable of providing 30 minutes backup runtime for generator transfer or a graceful shutdown. The contractor must supply electrical power to the system. Steps could be taken to take advantage of existing power outlets, if possible.

The workstation must only be accessible by individuals with a username and password, and it must meet the government’s Security Technical Implementation Guide (STIG) standards.

AFMAN 16-1404 Volume 3, subparagraph 3.a.(5)(d) states, “Systems that use transmission lines to carry access authorizations, personal identification data, or verification data between devices or equipment located outside the controlled area shall have line supervision.” The key cards will not show a picture of the person they are assigned to and the workstation will not have a camera system. The contractor is to deliver an initial batch of 100 key cards.

The existing entry control system located at both doors shall be removed after the AECS system is installed, operational, and whose function is verified by authorized personnel.

Page | 3

This requirement also includes all manuals and other documentation necessary to operate and maintain the AECS. The contractor must provide Installation Design Plan (IDP) design as a PDF. All equipment must be Trade Agreements Act (TAA) compliant, ensuring that products are made in the USA or an approved country. Finally, training on the administration, daily usage, and troubleshooting of the AECS for 5 to 10 personnel must also be included.

A post award site survey is not required. However, the Government will require a kick-off meeting, either virtual or in-person.

Attachment:

1. Attachment 2 – Building 24 Floor Plan