WPC_CAC_Access_Control_SOW_2_Jun_16.doc

Statement of Work

Execution of this contract includes four (4) parts:

1. Install a Common Access Control (CAC) Access Control System.

2. Remove and dispose of legacy access control readers and central control system.

3. Testing and acceptance, training and documentation.

4. Warranty and repair.

1.0 Install a New Common Access Control (CAC) Access Control System:

1.1. The Warrior Preparation Center (WPC) requires a new physical access control system to replace its legacy proximity badge reading system. The new system should automate physical security functions as much as possible to support military exercises and event in and out processing.

1.2. The new CAC enabled badging system must be capable of handling up to eight thousand (8,000) annual participants allowing access to buildings and specifica areas at the WPC. Due to classification of events and security clearance of personnel attending events, the system must have no false positives and grant a visitor to a building or area they are not cleared to attend.

1.3. The WPC currently uses a proximity badge reading system that controls approximately thirty (~30) badge readers and door locks. The proximity badges are manually issued by security staff after the attendee has been validated to attend (usually by roster) and their security clearance verified in Joint Personnel Adjudication System (JPAS).

1.4. The new system must use DoD smart-card Common Access Cards (CAC) and avoid the manual issuance and turn-in of badges.

1.5. The new system must also include a “badge out” feature for people exiting. Currently, exiting can only occur at either building 708/1st floor or the turnstile in front of building 712. Adding this feature to the whole new system enhances security and safety as it will allow WPC security personnel to know if someone is still in a building and allow first responders to know if someone was still in a building after a catastrophic event.

1.6. The contractor will supply Commercial- Off-the-Shelf (COTS) components for contract performance wherever possible. The Contractor shall identify all materials or equipment required for the specific projects in this SOW and shall list the manufacturer and part number of the proposed material in the proposal. Unless otherwise specified, the contractor will provide copies of existing COTS technical or equipment manuals and warranty documentation and procedures for Contractor-furnished end-item system equipment maintenance. The contractor will also transfer warranties to the Government prior to invoicing.

1.7. Requirements:

1.7.1. Replace the existing proximity badge reading system with a new CAC enabled system that can support up to forty (40) readers with locks located around the Warrior Preparation Center. The system must be centrally managed and networked using existing IT infrastructure to the maximum extent possible. Ideally, the system should meet DoD network certification and/or accreditation requirements and be allowed on Air Force (AF) systems; however, if that is not possible, a closed local private networked system could suffice.

1.7.2.

Due to the nature of the exercises/events and their associated security clearance requirements, the new access control system must meet the following criteria:

1.7.2.1. The system must provide identity verification using existing DoD CACs.

1.7.2.2. The WPC must have the ability to issue smart cards (CAC equivalents) to foreign nationals and other guests who do not have a CAC allowing them to enter facilities like other event participants.

1.7.2.3. The system must ensure that those attending exercises/events are cleared and vetted using a criteria established by the event project officer—i.e., a roster.

1.7.2.4. Individuals attending events must have their security clearance vetted against the DoD authoritative system (JPAS) and that information can then be entered into a contractor’s system.

1.7.2.5. The new system must require CAC PIN verification when participants first arrive at the WPC and all access points should have the ability for 2-factor verification points (i.e., PIN and CAC). As an example, a participant should be able to wave their CAC near a reader and then enter their CAC’s PIN on a keypad.

1.7.2.6. Access control of the system must be reliable and only allow members to enter buildings and areas required for the event. Due to security classifications of events, they system must perform with no false positives.

1.7.2.7. The system must allow up to four (4) WPC security personnel to enter participant information into the contractor’s system concurrently (i.e., four (4) personnel must be able to both vet participant clearances in JPAS and enter participant information in the contractor’s system at the same time).

1.7.2.8. The system must be able to be controlled by WPC defined dates and times. WPC security personnel enter the start date/time and the finish date/time, and at the end of the predefined date/time, access will be immediately terminated.

1.7.2.9. Redundant (battery) power must be available so the entire system still functions in the event of a power outage—this is to include the server and readers/locks at each door.

1.7.2.10. The system must be scalable and support future door reader/lock expansion up to a minimum of fifty (50) readers/locks.

1.7.2.11. The new system must validate a CAC and read/unlock a door in two (2) seconds or less.

1.7.2.12. The new system’s database should be able to hold participant information for a minimum of one (1) year.

1.7.2.13. A mechanism must be installed at building 708 and the turnstile at building 712 so event participants must swipe their badge to exit the WPC campus. However, it must have the ability for mass exit in case of an emergency.

1.7.2.14. The contractor will perform all work in accordance with applicable German and US Air Force environmental laws, regulations and operating standards, including but not limited to the Final Governing Standards (FGS) for Germany. The contractor shall be immediately capable of understanding and addressing environmental laws and regulations as they pertain to work performed under this contract.

1.7.2.15. Installation hours of work. The contractor shall work during normal WPC operating hours of 8:00 AM – 4:00 PM, Monday through Friday, excluding Federal holidays and site-specific down-days. Performance of work outside normal duty hours shall be approved by WPC/MS.

1.8. Notional Schematic:

As depicted below under “Event In-processing”, as a notional design, the new system must allow up to three participants to concurrently authenticate onto the system. Once a user inserts their CAC, they will be asked to enter their PIN. This verification is to ensure someone is who they say they are and that they didn’t find or steal a CAC. Assuming the PIN they enter is correct, the system should then compare their CAC information with pre-entered information in the established database. Based on this, the user’s information will then be passed to the access control server where affected readers and locks at facility locations allow (or deny) entry.

1.9. Facility Locations:

Below is an aerial view of the WPC facilities. The WPC is a controlled environment where all personnel must enter through building 708 or a turnstile in front of building 712. However, all new participants must enter building 708 (shown as “WPC Entrance” on the map.) Currently, there are no mechanisms in place that require personnel to “badge out“ of the WPC campus. The new system must include these mechanisms at building 708 and 712 so personnel must swipe their badge for a mechanism to allow exit. In case of an emergency, WPC security personnel must have the ability to disarm the mechanisim to allow mass exit.

Additional information and specific locations can be found in the attached CAC Access Control diagram.

2.0 Remove and Dispose of Legacy Access Control Reader and Central Control System

2.1. The contractor will remove and dispose of legacy readers and locks that no longer function with the new CAC enabled access control system.

2.2. The contractor will also remove and dispose of legacy switches, power supplies and other equipment from communication closets that house the old badging system.

3.0 Testing and Acceptance, Training and Documentation:

3.1. Testing and Acceptance: The contractor will test and inspect all aspects of the installation to ensure the technical adequacy and accuracy of all work, including reports and other documents required in support of that work. The contractor will conduct on-site testing IAW OEM installation manuals and practices, and the appropriate contractor’s test procedures. The contractor will participate with the Government in testing the complete system end-to-end. When any system, subsystem, component or requirement test fails to meet the requirements of the test, Government acceptance and payment shall be withheld until the cause of the failure is corrected to the Government’s satisfaction. After appropriate corrective action has been taken, the contractor shall repeat all previously completed tests that related to the failed test, until all tests are completed satisfactorily.

3.1.1. Pre-cutover audits will determine if the system is ready for functional cutover, and shall consist of Government verification of all contractor test results. Post-cutover audits shall verify that all post-cutover acceptance testing has been performed IAW standard practices and this SOW, and will identify those tests, if any, which have not been successfully completed. Any unsuccessful tests shall be re-accomplished prior to acceptance.

3.1.2. Testing shall be performed in two steps: operational testing, then system acceptance testing. The contractor will provide a logical test process that minimizes interruptions, avoids sustained downtime, and presents a contingency procedure to be implemented in the event of systems failure during testing.

3.1.3. The contractor shall furnish all test equipment and personnel required to conduct all required testing. The contractor will document all test results in a “Test Report(s)” and submit to the Government. During any testing phase, the Government reserves the right to perform any of the contractor-performed inspections and tests to ensure solutions conform to prescribed requirements. The contractor shall provide on-site support during the acceptance testing. The Test Report(s) shall be provided to the Government no later than ten (10) days after test(s) have been completed.

3.1.4. The contractor will identify a Plan of Action and Milestones (POA&M) of all major tasks and sub tasks required to complete this installation. This will include an outline with the start date and completion date for system testing, acceptance, and training with WPC personnel. Testing will commence upon completion of the system installation. A successfully tested system, including 90-day burn-in period, with no system failures shall constitute acceptance of the system. Training shall be scheduled prior to system acceptance.

3.2. Training: Customer will require hands on training on how to operate and customize the system. The contractor will also provide a “How To” guide detailing all steps to operate and maintain the system. One hard copy and one soft copy of the “How To” manual must be provided to the Government.

3.3. Documentation:

3.3.1. The contractor will provide drawings with floor plans and red line them to show the locations of installed equipment.

3.3.2. The contractor will provide documentation that provides a project description, identifies contractor points of contact, identifies installed equipment, identifies maintenance responsibilities, and provides maintenance help desk phone numbers and an email address.

4.0. Warranty and Service:

4.1. The contractor warrants the entire system (software and hardware) and components and their functionality as described in this document for a period of one (1) year after final delivery and acceptance. The contractor will replace or repair the system or components at no charge to the government during this one (1) year period. The complete system must also have the option to purchase future-year warranties.

4.2. The contractor shall receive all service call requests directly from WPC security personnel. Calls will be classified as emergency, urgent, or routine. The contractor shall respond accordingly for emergency and urgent calls. A log shall be maintained for all service calls received, to include: a description of the problem and/or requested work, the date and time each call was received, the building (or area) number identified, and each caller’s name/telephone number. The contractor will plan and schedule work to assure material, labor, and equipment are available to complete necessary repairs.

4.2.1. Emergency service calls will be classified as emergency at the discretion of WPC Mission Support Division Chief, WPC/MS. Generally, emergency calls consist of correcting failures that constitute an immediate danger to personnel, threaten damage to property, or threaten to disrupt complete operations (i.e., a system-wide outage).

4.2.2. Urgent service calls will be classified as urgent at the discretion of WPC security personnel. Generally, urgent calls consist of providing services or correcting failures which do not immediately threaten personnel, property, or complete WPC mission.

4.2.3. Routine service calls will be classified as routine when the work does not qualify as an emergency or urgent call.

4.3. The contractor shall have procedures for receiving and responding to emergency service calls within the specified response time of four (4) hours, seven (7) days a week, 24 hours a day, including weekends and holidays. The contractor must be on the job site and working within four (4) hours after receipt of an emergency service call. The contractor shall work continuously, without interruption, 24 hours a day, seven (7) days a week until the failure is corrected and the system is operational. WPC/MS must approve the work before the contractor departs the job site.

4.3.1. The contractor will have procedures for receiving and responding to urgent service calls within eight (8) hours after receipt of an urgent service call received during the WPC normal work hours of 8:00AM – 4:00PM, Monday through Friday, and within sixteen (16) hours for urgent calls received after normal work hours, on weekends, or holidays.

4.3.2. All routine service calls shall be completed within two (2) working days after receipt. Routine calls shall be normally accomplished during normal work hours of 8:00AM – 4:00PM, Monday through Friday.

4.4. Recurring work includes preventive maintenance (PM) and start-up/shutdown of systems. The contractor shall maintain sufficient parts, materials, and equipment on hand to perform all recurring work. Preventive maintenance consists primarily of: inspection; lubrication; calibration; adjustment; minor part and component replacement as necessary to minimize equipment malfunction, breakdown, or deterioration; and the identification of and/or performance of any repairs required to ensure the equipment is operating per manufacturer’s standards. The contractor shall complete all identified repairs and provide all necessary services, parts, and materials as part of the PM.

4.5. The contractor must provide a detailed PM schedule to the WPC, that covers the entire one-year warranty term and includes PM for each system/piece of equipment and the week of the month the PM will be performed. The contractor will submit the detailed PM schedule to the WPC for approval no later than fifteen (15) calendar days after the start date of the contract.

4.6. The contractor will arrange work to avoid interference with the normal occurrence of Government business. In those limited circumstances where some interference is unavoidable, the contractor must make every effort to minimize the impact of the interference and its effects.