FEMA Security Enterprise Services and National Maintenance Acquisition Draft SOW dated 3-3-25.docx

Statement of Work Security Enterprise Services and National Maintenance Acquisition Full Maintenance, Repair, Modification, & Installation Services

Federal Emergency Management Agency | FEMA Office of the Chief Security Officer | OCSO Department of Homeland Security | DHS March 3, 2025

Version Control

Table of Contents

General

This Order supports the sustainment and maintenance, enterprise standardization, modernization, integration, and convergence of the Federal Emergency Management Agency (FEMA) Security Enterprise Services (SES) nationwide.

1. Introduction

The FEMA SESNMA BPA is an enterprise standardization, infrastructure modernization, and security convergence approach for providing integrated Electronic Security Systems (ESS) at FEMA headquarters, regional offices, and all FEMA leased or owned facilities nationwide aligned with federal and industry guidelines, standards, and best practices.

All contractor personnel who possess administrator rights to the SES systems application, server, Secure Access Facilities (SAFs), and Sensitive Compartmental Information Facilities (SCIFs) shall be employees of the contractor and shall have an active Top-Secret Clearance verifiable by FEMA Personnel Security. The contractor's selected individuals to various required key personnel outlined in section 7, Key Personnel, shall possess, and maintain a Top Secret (TS) security clearance in accordance with the NISPOM and meet FEMA's suitability requirements for access to National Security Information. Where applicable these positions as outlined in section 7, Key Personnel may require a Tier 3 Clearance due to elevated network access. Additional guidance on security clearance compliance requirements will be identified in subsection F7, Security Clearance and throughout the Statement of Work where applicable.

Key capabilities and competencies to be provided by the SES contract include:

A. Convergence of physical, electronic, and cyber security assets, operations, processes, and technology, including but not limited to the following: networks, servers, switches, workstations, and other assets; artificial intelligence (AI), machine learning (ML), internet of things (IoT), machine to machine (M2M), server virtualization, network monitoring, and other technology; monitoring, identification, response, and other operations; automation, integration, and standardization of process.

B. Subject Matter Expertise (SME) and implementation of Interagency Security Committee (ISC) compliance and countermeasure related to ESS and physical security requirements.

C. Policy, procedure, and plan recommendations and updates, including but not limited to, the following: assisting in the development of a security roadmap ensuring compliance with federal and industry standards and best practices; assisting in the execution of performance goals; developing and tracking metrics; measuring success; and conducting studies and analysis.

D. ESS including, but not limited to, the following: physical access control systems (PACS); intrusion detection systems (IDS); video surveillance systems (VSS); visitor management system (VMS); internet protocol (IP) cameras; security operations center (SOC) collaboration and visualization systems; audio/video intercoms; and other ESS technologies, software, hardware, and components.

E. Physical security systems and equipment including, but not limited to, the following: personnel, vehicle, cargo, and parcel screening systems including x-rays, magnetometers, and other emerging standard physical security equipment or resources such as; ballistic rated glass, booths, kiosks, and others; blast-resistant waste receptacles; doors, locks, door hardware and others; passive and active barriers, including turnstiles, fencing, bollards, gates, traffic control gate arms, active vehicle barriers (AVB) and others.

F. Homeland Security Presidential Directives, Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST) Special Publications, Federal Information Security Management Act (FISMA), and Federal Identity Credential and Access Management (FICAM) including, but not limited to, the following: HSPD-12, Federal Information Processing Standards (FIPS) 201, OMB 05-24, M-11-11, M-19-17, NIST SP800-116, FISMA and FICAM compliance, Personal Identity Verification (PIV) card issuance facility (PCIF) services and operations; physical access assignments; visitor management; automation and integration of systems and processes; audit remediations; and other related functions.

G. Infrastructure supporting the above systems, as required by the government including, but not limited to, the following: cabling, conduit, electrical; and other types of infrastructure.

H. Continuous service to provide systems and logistics support, repair, maintenance, sustainment, integration, and engineering throughout the life of the contract.

I. Travel, ODCs, and OLMs are expected under this BPA and subsequent orders. Travel will be billed in accordance with FAR part 31 regulations. ODCs will be reimbursed without G&A and indirect costs added. OLMs will be paid in accordance with GSA rules and may not exceed 33.33% of the total award value.

2. Background

The FEMA, Office of the Chief Security Officer (OCSO) manages and implements all enterprise, electronic, and physical security functions for all federally owned or leased facilities operated by FEMA personnel, including Disaster Facilities. Responsibilities include:

A. Managing and overseeing the day-to-day operations and contract management of ESS, badging offices, armed security guards, physical security support, visitor management, parking management, and emergency management.

B. Developing and implementing security strategies, standards and procedures for FEMA headquarter sites, security operations centers, regional offices. Reviewing mitigation strategies to ensure risks to personnel, facilities, and operations are minimized.

C. Conducting risk assessments per ISC guidelines, inspecting facilities, and evaluating the effectiveness of existing security practices and procedures. Identifying physical security conditions requiring corrective actions, determining FSLs, and determining additional requirements and countermeasures to mitigate security vulnerabilities.

D. Strategic planning in the development and integration of new and existing ESS and physical security technology and operations to meet short- and long-range mission needs and OCSO’ strategic goals and objectives. Managing projects through the full project lifecycle (initiation, planning, execution, monitoring, controlling, and closing) including, but not limited to, the following: identifying and managing stakeholders; collecting and analyzing requirements; identifying and communicating risks; quality assurance and control; budget and control; and others.

E. Conducting security investigations and inquiries to identify and analyzed incidents and threats, persons of interest, suspicious activity, and other security concerns. Analyzes a variety of unusual or complex security problems, formulates and presents ideas and solutions, conduct studies and analysis, and makes well-informed and defensible recommendations.

F. Ensures the deployment of security measures are aligned with security directives and publications including, but not limited to, the following: General Services Administration (GSA) specifications, NIST Special Publications, FIPS-201, OMB 11-11, 05-24, M-19-17, HSPD-12, Public Laws, executive Orders, Underwriter’s Laboratory (UL), and industry standards and best practices.

FEMA maintains electronic security systems, infrastructures and equipment located throughout the 10 (ten) FEMA regions, FEMA Headquarters, Alaska, Hawaii, Guam, Puerto Rico and the U.S. Virgin Islands. The regions are comprised of the following:

FEMA’s goal for its Electronic Security Systems (ESS) is to meet the requirements set Interagency Security Committee Policies and Standards. FEMA’s objectives to accomplish this requirement are as follows:

A. To accomplish the ESS Maintenance, Repair and Modification Services through a single service nationwide 24 hour on-call contractor.

B. To consistently maintain the ESS in a secure and reliable condition at all times and with minimal parameters for down time.

C. To respond to service calls and perform the necessary repair or action effectively, efficiently and with utmost priority.

D. To establish and implement an effective quality control program that results in continuous improvement and reliability of the ESS performance.

E. To know the operational status and functional performance of the ESS at all times and with minimal parameters for down time.

F. Maintain industry best practices and follow recognized standards in the development, maintenance, and delivery of technical support services within the FEMA environment.

3. Summary

The contract is intended to provide complete, comprehensive preventive maintenance, repair, modification and installation services for existing and new ESS equipment, security network infrastructure, Physical Access Control (PACS), Video Surveillance Systems (VSS), various security detection and initiating devices, perimeter detection, dedicated uninterruptible power supplies and batteries as described herein. The Contractor shall provide all supervision, labor, administrative support, materials, tools, parts, supplies, equipment, and transportation necessary to effectively and efficiently fulfill all requirements of this Statement of Work (SOW).

The scope of services has been categorized into four general areas of discipline. These areas are as follows and include the following general tasks and functions.

A. Network/System Administration - includes routine and preventive maintenance (PM), immediate response to service calls, and emergency repair of all hardware and physical components of the existing ESS security network infrastructure and equipment including but not limited to the servers, switches, databases, and work stations including dedicated uninterruptible power supplies and batteries

B. System Maintenance and Repair – includes but not limited to routine quarterly preventive maintenance (PM), immediate response to service calls, and emergency repair of all hardware and physical components of the existing ESS equipment (excluding items identified in the Network/System Administration), the mobile card reader system, PACS, video imaging systems, VSS, various security detection and initiating devices, perimeter detection, dedicated uninterruptible power supplies and batteries for all FEMA locations as described herein or emerging.

C. New ESS component installation, configuration, and integration – Includes the installation, configuration, and/or integration of new components such as cameras, door locks, card readers, or other components and all ancillary and related items and actions to affect such installations, configuration, and integration at the request of the Authority.

D. New ESS components brought online during the duration of the contract will be maintained under this ESS maintenance contract at no additional cost to the contract. The Contractor will coordinate with the system integrator involved in any new component implementation to ensure that any project related warranty and contractual service on new hardware/software remains in force.

E. With 90 calendar day written notice, the Authority reserves the right to discontinue all or certain portions of this contract. The Authority reserves the right to directly hire some or all contractor personnel upon the discontinuance of all or certain portions of this contract.

F. Various security monitoring systems at remote locations are connected to Central Monitoring Systems (CMS) located at Mount Weather, VA and other locations. The CMS are open architecture, Bosch (Radionics), DMP, General Electric (Edwards/EST) and Honeywell (Ademco) systems. The CMS monitor all intrusion alarms, is National Fire Protection Association (NFPA) rated for monitoring fire alarms, and are monitored by Federal Protective Services, FEMA Security Command Center or by other monitoring organizations/facilities. FEMA also maintains a nationwide HSPD-12 compliant access control system, a VMS, VSS and various perimeter control protection systems and screening control systems.

G. The Government's objective is to ensure that all security management systems and infrastructures are installed and maintained to maximize operational and emergency readiness. OCSO five (5) inter-related high-level objectives are:

G.1 Enterprise Convergence and Modernization: Physical, electronic, and cyber security convergence and modernization of assets, operations, processes, and technology. This may involve the use of current or new technology, integration with 3rd party or other FEMA systems (HR, Personnel Security, etc.), revision of policies, procedures, and other requirements. This will require heavy engagement with the FEMA Chief Information Office (CIO) and their respective Other Government Contractors (OGC).

Examples as follows:

· Assets: data centers, server rooms, information, critical infrastructure, inventory, software, hardware, and other assets

· Operations: enterprise monitoring, identification and verification, response, and other operations.

· Processes: automation, integration, and standardization of processes in order to recognize operational and functional efficiencies.

· Technology: IP devices and sensors, artificial intelligence (AI), machine learning (ML), internet of things (IoT), machine to machine (M2M), and other technology modernization efforts.

H. Scalability and Interoperability:

Systems shall be capable of scaling to accommodate additional users, sensors, capabilities, and facilities. Similarly, systems shall be able to adjust down as facilities are closed, locations are decommissioned, or requirement adjusted. Systems and their components shall, to the maximum extent possible, utilize open standards and commercial-off-the-shelf (COTS) technology. Standard network protocols shall be used to traverse FEMA’s network. Wherever computers are required, they shall be widely available models based on open systems architecture and able to support a FEMA provide image.

Standard operating systems shall be used, such as, but not limited to: Microsoft Windows, UNIX, and RedHat Linux based for the computer-based systems provided under the SES contract.

I. Availability and Resiliency: FEMA maintains a current state practice of operating its systems at or near a 100% operational level. Systems shall be designed and implemented to be resilient to failure such that a failure of a single component should not incapacitate the entire system. To achieve this goal, the contractor shall leverage industry best practices for assuring resiliency and availability, including but not limited to:

I.1 Built-in redundancy I.2 Automatic failover I.3 Fault tolerance I.4 Virtual environments I.5 Data backups I.6 Data archiving I.7 Automatic updates of operating systems (OS) and applications I.8 Notification of software/hardware approaching end of life I.9 Power-on replacement example hot swapping components or peripherals I.10 Continuous power example uninterruptible power supplies, (UPS) I.11 Backup power example batteries or generators I.12 Surge suppressors

For the purpose of this requirement, system reliability is defined as the probability that a system or subsystem, including all hardware, firmware, and software will satisfactorily perform the intended functions for which it was designed, during for which it is in operation, and in the operational environment. The contractor shall maintain reliability, at a minimum, to the systems documented percentage of failure rate provided by the manufacture.

For the purpose of this requirement, system availability is defined as the ratio of time a system, subsystem, or component is functional to the total time it is required or expected to function.

For the purpose of this requirement, system serviceability is defined as the ease with which a component, device, or system can be maintained and repaired. All precautions should be taken to maintain and repair systems to cause as little downtime or disruption as possible and within the expected reliability and availability standards stated in this contract. The contractor shall notify FEMA of any potential problems or recommended actions critical to systems operations that can be addressed by maintenance and repair, as far in advance as possible, to minimize downtime or failure.

Factors that do not impact contractual requirements for system reliability, availability, or serviceability are root causes triggered as a result of network, power, or other external factors outside the scope of this contract managed by the FEMA CIO and OGC. Outages caused by external factors shall not count against the availability or reliability statistic until the network, power, or other external factor has been restored and/or ruled out.

(1) Reliability and Cost Sustainability: Systems and services shall be affordable across the full lifecycle while meeting FEMA’s requirements, minimizing the use of custom and proprietary solutions, and removing systems, hardware, and software before they incur excessive sustainment costs or reach end of life.

(2) Accountability and Customer Satisfaction: Systems and services shall be designed and implemented to be cost effective, user friendly, mindful, of the impact and sensitivities of the customer workspace, high performing, and to meet contractual service requirements. Strong management of subcontractor work and cost is expected.

4. Period of Performance

1. The contract period of performance (PoP) shall consist of a base period of one (1) twelve (12) month period and one (1), twelve (12) month option period.

· Upon award of the contract a transition schedule of 30 days shall be granted for ramp up. Contract period of performance starts 30 days after award.

· The contract kick-off meeting shall be held within five (5) business days after contract award.

· At the close of the final executed option year, any ongoing projects impacted by delays which will exceed the final period of performance timelines will be completed in full regardless of contract status for any follow-up award cycles. Service to the Government should be complete in total prior to billing. The projects should be completed past the final option year PoP dates in accordance with the scope of work and without any change orders accepted in these cases. The transition period should not exceed a 6-month period bar exigent circumstances causing remarkable delays to project completion outside of standard controls.

5. Ordering Procedures

The Contracting Officer shall place task orders (TO) against this BPA using task specific Statements of Work (SOWs), Performance Work Statement (PWS), Statement of Objectives (SOO), or other documentation which are confined to the scope of this BPA SOW. TO SOWs shall include tasks and deliverables; the Contracting Officer may include Optional Tasks or Option Line Items to be exercised after the award of the task order in order to efficiently procure services within the scope of this BPA.

The Contracting Officer or COR will provide the TO SOW to the Contractor in order to receive a quotation. Any included labor rates must comply with the BPA labor rates established at the time of award or provide discounts from the BPA rates. All optional tasks and option line items will be priced and evaluated at the time of task order award. Evaluation of optional tasks and option line items does not obligate the Government to exercise these options after award. The contractor shall provide comprehensive quotes identifying the contractor’s approach and solution to FEMA requirements as identified in the associated task order work statements.

The contractor responsibilities in the areas may include:

A. The contractor shall include detailed costs for prime/subcontractor labor hours per labor type and materials. Materials shall be listed line items for accounting transparency excepting small, routine consumable parts. All other items must be detailed for quality review processes.

B. The contractor shall return requested quotes within a mutually agreed upon timeline with minimal variance to meet process and workflow continuity requirements. This timeline will be set in the contract kick-off cycle within the first 5 days of contract award.

C. Proposals shall include site survey data including sketches, photographs, survey questionnaires, and annotated site drawings. The proposals shall include details about the current site as well as conditions/considerations that may impact proposed system performance or schedule for consideration by FEMA.

D. The contractor is encouraged to identify areas which may provide quantifiable improvements in price, schedule, or performance.

6. Project Management Plan

The Contractor shall provide, for COR review and approval, a Project Management Plan (PMP) in draft form with proposal submission. Finalized PMP submission shall be within fifteen days after award of the contract, including an organizational chart and contact information for each member of the team. The PMP shall include the following items:

A. Scope Management Plan B. Schedule Management Plan C. Quality Control Plan D. Resource Management Plan E. Communications Management Plan F. Change Management Plan

7. Key Personnel

FEMA reserves the right to review the resumes of the Key Personnel recommended by the contractors for hire. Key Personnel resumes shall be included in the vendors technical proposal as part of the staffing plan. FEMA reserves the right to add key personnel within the below listed competencies which should not be priced as specialty additions to the scope, they should be capable line items available to be executed at the needs of the Agency.

A. MANDATED CLIN Program Manager (qty. 1) - Duty station: FEMA Headquarters/Telework Full time

A.1 Required Qualifications:

· Demonstrate the supervision and management of personnel and technical functions.

· Demonstrate experience managing the full project lifecycle of initiation, planning, execution, and coordination of all aspects of an ESS project installation.

· Demonstrate installation management experience in the installations of complex security systems.

· Demonstrate experience in the maintenance, and sustainment of complex security systems.

· Familiar with the following: ESS requirements development; design; integration; implementation; and lifecycle planning.

· Familiar with reviewing, updating, and following security directives, policies, guidelines, and publications.

· Comprehensive knowledge of physical security principles, methods, and practices as applied to the planning, design, review, and construction of multi-use buildings and compounds.

· Ability to communicate, both written and orally (read, write, and comprehend), position papers, technical documents, memorandums, reports, power point presentations, ideas, and solutions to physical security challenges.

· Ability to conduct comprehensive physical security analysis, evaluate compliance, and enforce physical security standards.

· Ability to meet and work effectively with a variety of stakeholders at various levels to develop cooperation and understanding necessary to support security program objectives.

· Ability to diagnose, isolate, and resolve critical and complex electronic and physical security problems associated with the security standards that govern the building, planning, design, and construction phases.

A.2 Desired Qualifications:

· The Program Manager (PM) have at a minimum, ten (10) years of experience in the implementation and sustainment of complex security systems, and a master’s degree in Management, Engineering, or other related technical fields. The baccalaureate degree can be substituted by the candidate having 15 or more years of experience.

· Project Management Professional (PMP).

· CSEIP (Certified Systems Engineer ICAM PACS) Certified.

A.3 Duties:

· Serve as the single focal point accountability for all services and activities and the quality of personnel and deliverables.

· Be responsible for briefing a wide range of individuals on services, activities, and deliverables.

· Assure all personnel have the necessary qualifications (technical, engineering, maintenance) including training, security clearance, badging, and access privileges.

· Manage and de-conflict multiple ongoing baseline support and technical tasks.

· Lead monthly Program Monthly Review (PMR) presentations to the FEMA.

· Be responsible for managing and controlling overall contractor program coBe the contract lead for interfacing with industry, vendors, and OGC on applicable systems installed, administrated, and maintained under FEMA.

· Identify system dependencies of FEMA and non-FEMA systems. Document concerns and findings and present to the FEMA.

· Communicate to the FEMA emerging trends and technologies in the security industry

· Serve as the focal point for all delivery orders issued under the ESS contract.

· Provide Period of Performance (POP), schedule, and deliverable management as outlined in individual delivery orders. Identify reasonable schedules as part of proposal development.

· Provide detailed, justified labor mixes and subcontractor costs on all delivery order proposals.

· Maintain an Integrated Master Schedule (IMS) of all installation delivery orders with associated POP. The IMS shall identify inter-dependencies between installations task orders and baseline ESS support and preventive maintenance work. The IMS shall also identify dependencies on non-ESS work such as IT infrastructure or facilities that are the responsibility OGA/OGC. The IMS shall be delivered monthly as a deliverable at the PMR. Provide advanced notice of project impacts, dependencies, and critical path in writing to the COR and project officer.

· Respond to request for proposal in accordance with applicable contract requirements.

· Provide detailed breakdown of sub-contractor costs.

· Identify cost savings and value engineering opportunities as part of proposal development.

· Serve as lead on all established individual project meetings and distribute meeting minutes.

· Provide an Installation Status Report. The Installation Status Report shall provide a comprehensive status of all active and completed task orders. Items needing to be included in the report include: POP, location, cost analysis (base + options/changes/requests for equitable adjustment), project health tracking schedule/cost performance, issues needing attention, and pending actions on behalf of FEMA or contractor.

· Be responsible for managing all aspects of the maintenance and support of FEMA electronic and physical security systems.

· Develop and maintain the Preventative Maintenance Plan based on manufacturer recommendations. Identify systems requiring a higher level of preventative maintenance due to usage or ambient conditions.

· Oversee the execution and quality of all preventative maintenance activities.

· Oversee the completion of all repair activities in accordance with contract requirements.

· Track and report on preventative maintenance and repair at monthly PMR as requested.

· Predict and identify systems or system components reaching end-of-life, end-of-service, or requiring lifecycle replacement and notify the government in writing.

· Identify reoccurring causes of system or component failure and propose options to remedy.

· Be responsible for the quality and integrity of the FEMA identified configuration management tool.

· Ensure an adequate stock of frequently used equipment and consumables to minimize down times.

B. OPTIONAL CLIN Senior Technician (qty. 1) - Duty station: FEMA Headquarters/Minimal Telework

B.1 Required Qualifications:

· Minimum high school diploma or equivalent and seven (7) years of experience working with security systems to include service and maintenance across a broad spectrum of PACS, IDS, and VSS.

· CSEIP (Certified Systems Engineer ICAM PACS) Certified

· One (1) year experience inspecting PACS, IDS, and VSS.

· Knowledge and experience of compliance with industry standards, policies, and guidelines such as: physical and electronic security; access and key control; HSPD; NIST SP; FICAM; OMB; and ISC.

· Knowledge of other security disciplines and their relationship to the electronic and physical security program in order to respond to and troubleshoot system problems.

· Demonstrate experience in team lead supervision of personnel and technical functions, project execution and coordination of all aspects of complex ESS projects and installations.

· Demonstrate experience in the management, maintenance, and sustainment of complex security systems.

· Demonstrate the ability to comprehend technical language, read, and interpret blueprints, wiring diagrams, and schematics.

· Demonstrate the ability to effectively communicate both in writing and verbally.

· Demonstrate the ability to exercise considerable judgement and initiative.

· Working knowledge of low voltage systems.

· Working knowledge of network principles

B.2 Duties:

· Supervise and delegate assigned tasks to junior level technicians as appropriate.

· Assist with the design, procurement, logistics, installation, routine maintenance, sustainment, configuration, programming, and lifecycle replacement of PACS, IDS, VSS, and physical security systems within this contract, as well as the integration of other safety and security subsystems.

· Ensure equipment is updated and operational, meeting required local, state, federal, and ADA requirements.

· Assist with 3rd party security systems integrations, software updates, and helps train field verification of systems and inspection of work in progress for compliance with applicable regulations and standards.

· Makes recommendations for security equipment and systems.

· Assist with issuing, assigning, and removing access rights for access control cards (PIV, non-PIV, visitor, etc.)

· Maintains inventory of essential parts and equipment to ensure repairs and installation in a timely manner.

· Ensure monitoring and timely resolution of service and repair issues.

· Maintains appropriate records as required.

· Create and run reports for ESS/physical security systems, as required.

· Provides onsite ESS training of FEMA and OGC personnel, as required.

· Performs other related duties as assigned.

C. OPTIONAL CLIN Mid-level Technician (qty. 1) - Duty station: FEMA Headquarters/Minimal telework

C.1 Required Qualifications:

· Minimum high school diploma or equivalent and five (5) years of experience working with security systems to include service and maintenance across a broad spectrum of PACS, IDS, and VSS.

· CSEIP (Certified Systems Engineer ICAM PACS) Certified.

· One (1) year of experience inspecting PACS, IDS, and VSS.

· Knowledge and experience of compliance with industry standards, policies, and guidelines such as: physical and electronic security; access and key control; HSPD; NIST SP; FICAM; OMB; and ISC.

· Knowledge of other security disciplines and their relationship to the electronic and physical security program in order to respond to and troubleshoot system problems.

· Demonstrate the ability to comprehend technical language, read, and interpret blueprints, wiring diagrams, and schematics.

· Demonstrate the ability to effectively communicate both in writing and verbally.

· Demonstrate the ability to exercise considerable judgement and initiative.

· Working knowledge of low voltage systems.

· Working knowledge of network principles.

C.2 Duties:

· Assist with the design, procurement, logistics, installation, routine maintenance, sustainment, configuration, programming, and lifecycle replacement of PACS, IDS, VSS, and physical security systems within this contract, as well as the integration of other safety and security subsystems.

· Make sure equipment is updated and operational, meeting required local, state, federal, and ADA requirements.

· Assist with 3rd party security systems integration and software updates and helps train other personnel in the use of these systems.

· Assists with security assessments, technology upgrades, product selections, testing, field verification of systems and inspection of work in progress for compliance with applicable regulations and standards.

· Makes recommendations for security equipment and systems.

· Assists with organization and management of parts stock and tools.

· Assists with issuing, assigning, and removing access rights for access control cards (PIV, non-PIV, visitor, etc.).

· Instructs employees in the use of systems. Establishes and coordinates alarm codes and keeps a record of those having access to such codes.

· Maintains inventory of essential parts and equipment to ensure repairs and installations in a timely manner.

· Ensure monitoring and timely resolution of service and repair issues. Maintains appropriate records as required.

· Create and run reports for ESS/physical security systems as required.

· Provides onsite ESS training of FEMA and OGC personnel as required.

· Performs other related duties as assigned.

OPTIONAL CLIN Junior Technician (qty. 1) - Duty station: FEMA Headquarters/Minimal Telework

C.3 Required Qualifications:

· Minimum high school diploma or equivalent and three (3) years of experience working with security systems to include, service, and maintenance across a broad spectrum of PACS, IDS, and VSS.

· Knowledge of compliance with industry standards, policies, and guidelines such as: physical and electronic security; access and key control; HSPD; NIST SP; FICAM; OMB; and ISC.

· Knowledge of other security disciplines and their relationship to the electronic and physical security program in order to respond to and troubleshoot system problems.

· Demonstrate the ability to comprehend technical language, read, and interpret blueprints, wiring diagrams, and schematics.

· Demonstrate the ability to effectively communicate both in writing and verbally.

· Demonstrate the ability to exercise considerable judgement and initiative.

· Working knowledge of low voltage systems.

· Working knowledge of network principles

C.4 Duties:

· Assist with the design, procurement, logistics, installation, routine maintenance, sustainment, configuration, programming, and lifecycle replacement of PACS, IDS, VSS, and physical security systems within this contract, as well as the integration of other safety and security subsystems.

· Ensure equipment is updated and operational, meeting required local, state, federal, and ADA requirements.

· Assist with 3rd party security systems integrations and software updates and helps train other personnel in the use of these systems.

· Assists with security assessments, technology upgrades, product selections, testing, field verification of systems and inspection of work in progress for compliance with applicable regulations and standards.

· Makes recommendations for security equipment and systems.

· Assists with issuing, assigning access rights for access control cards and decommissioning of access control cards.

· Maintains inventory of essential parts and equipment to ensure repairs and installation in a timely manner.

· Ensure monitoring and timely resolution of service and repair issues. Maintains appropriate records as required.

· Create and run reports for ESS/physical security systems as required.

· Provides onsite ESS training of FEMA and OGC personnel as required.

· Performs other related duties as assigned.

D. MANDATED CLIN Project Manager/Senior Network Engineer, HQ (qty. 1) - Duty station: FEMA Headquarters/Telework

D.1 Required Qualifications:

· Minimum ten (10) years of experience designing, implementing, managing, architecting, integrating, and maintaining large-scale enterprise ESS to include, but not limited to, the following: PACS; IDS; CCTV; VMS; PSIM; FICAM; biometrics; LPR; and others.

· Certifications in four (4) of the following areas:

· CSEIP (Certified Systems Engineer ICAM PACS)

· PACS (Physical Access Control Systems)

· IDS (Intrusion Detection Systems)

· VSS (Video Surveillance Systems)

· VMS (Visitor Management Systems)

· CISSP (Certified Information Systems Security Professional)

· Experience deploying and migrating ESS applications across IT networks, ports, and protocols ensuring compliance with security requirements.

· Knowledge and real-world implementation of federal mandates, guidance, policies, industry standards, and best practices related to ESS, PIV, and FICAM including, but not limited to, the following:

· HSPD-12

· OMB publications 05-24, M-11-11 and others

· NIST FIPS 201

· o NIST SP 800-116, 800-53, 800-76, 800-79, and others

· FICAM Roadmap and Implementation Guidance

· o UL 2050, 294, 1076, and others

· Experience in implementing both Commercial Off the Shelf (COTS) and custom development and/or systems integration projects.

· Ability to solve practical problems and deal with a variety of concrete variables in situations where only limited standardization exists.

· Excellent customer facing skills and a demonstrated proactive approach to problem solving to include demonstrated experience in the below skillset:

· Interviewing—able to talk with individuals and groups about needs and ask appropriate questions to surface essential requirements information.

· Listening skills—able to comprehend what people say and detect what they may be hesitant to say.

· Analytical skills—able to critically evaluate information gathered from multiple sources, reconcile conflicts, decompose high-level information into details, abstract up from low-level information to a more general understanding and distinguish solution ideas from requirements.

· Facilitation skills—able to lead requirements elicitation workshops.

· Observation skills—able to validate data obtained via various techniques and expose new areas for elicitation.

· Writing skills—able to communicate information effectively to customers, managers, end-users, and technical staff.

· Organizational skills—able to work with a vast array of information gathered during elicitation and analysis and cope with rapidly changing information.

· Interpersonal skills—able to help negotiate priorities and resolve conflicts among project stakeholders.

· Modeling skills—able to represent requirements information in various formats and context including graphical, visual, textual, and others.

· Experience with all phases of a typical project life-cycle including, but not limited to, business analysis, design, configuration, testing, data conversion, change management, and immediate post go-live support.

· Experience in supporting decision making and problem-solving processes leveraging analytical skills.

· Excellent communication skills both written and verbal.

D.2 Duties:

· Conduct site surveys and studies to collect information relevant to performing requirements analysis.

· Assist in analysis, development, and transition of ESS complex requirement for existing and new technology implementations and integrations into ESS architecture, hardware, and software designs and interface specifications. Research and evaluate alternative solutions.

· Ensure new ESS under evaluation and/or consideration aligns with security operation’s needs, policies, procedures, and the FEMA mission, goals, and objectives.

· Plan and manage site ESS installations and conduct system acceptance testing.

· Assist in the development of cost benefit analysis; cost projections, lifecycle replacement and technology refresh plans, system designs, installation plans, configuration and quality management documentation, test and acceptance checklists, sustainment and maintenance plans, and other documentation relevant to establishing a baseline, robust, and evolving ESS program.

· Lead testing and validation work on complex ESS designs to assure that operational and functional requirements are met.

· Work with stakeholders to develop program test strategies.

· Manage performance of critical stakeholders and dependencies to ensure systems integration and compliance with requirements.

· Conduct program independent reviews and report results to FEMA

· Provide guidance for critical support of fielded hardware and software over the entire product lifecycle.

· Make recommendations for technology investments.

· Elicit, analyze, validate, specify, verify, and manage the needs of project stakeholders.

· Elicit requirements using interviews, document analysis, requirements workshops, surveys, site visits, business process descriptions, use cases, scenarios, business analysis, product analysis, task, and workflow analysis.

· Serve as the conduit between the project manager, customers, end users, vendor community and other stakeholders with related or interrelated processes and requirements.

· Management of the requirements specification and verifying the fulfillment of all requirement.

· Work with the project manager and/or project sponsor to document vision and scope.

· Write requirements specifications according to standard templates using natural language simply, clearly, unambiguously, and concisely.

· Decompose high-level business and user requirements into functional requirements, and then corresponding technical and operational requirements.

· Define quality attributes, external interfaces, constraints, and other nonfunctional requirements.

· Lead requirements analysis and verification, ensuring that requirement statements are complete, consistent, concise, comprehensible, traceable, feasible, unambiguous, verifiable, and that they conform to standards.

· Document as-is and to-be process flows.

· Participate in peer reviews and inspections of requirements documents. Participate in peer reviews of work products derived from requirements specifications to ensure that the requirements were interpreted correctly.

· Manage requirements traceability information and track requirements status throughout the project.

· Manage changes to baselined requirements through effective application of change control processes and tools.

· Identify business process improvement opportunities.

· Assist with the development of physical security requirements engineering policies, procedures, and tools.

· Write test plans, test scripts, organize and execute testing, and track issues to resolution.

· Provide timely status updates to project management.

· Supports and ensures adherence to FEMA policies and procedures.

E. OPTIONAL CLIN On-Call Systems Administrator (qty. 1) – Duty Station: FEMA HQ & Enterprise service/Telework

E.1 Required Qualifications:

· Minimum of 7 years’ experience with Security Enterprise Services/Systems with a practical understanding of hardware, software, and application support requirements in a enterprise deployment using Master Application Server (MAS) and Satellite Application Server.

· The administrator shall also demonstrate knowledge in Microsoft in Windows Server, SQL 2008,2012, or later and Linux Red Hat.

· Required CSEIP (Certified Systems Engineer ICAM PACS)

· Requires a Top-Secret clearance for administrator privileges on the Security Enterprise Systems

· Requires a Tier 3 Clearance due to elevated network access.

E.2 Desired Qualifications:

Certifications in three (3) of the following areas:

· PACS (Physical Access Control Systems)

· IDS (Intrusion Detection Systems)

· VSS (Video Surveillance Systems)

· VMS (Visitor Management Systems)

· CISSP (Certified Information Systems Security Professional)

E.3 Duties:

· Administration of accesses, permissions, alarms, door schedules, maintenance

· Perform software upgrades, patches, updates, etc.

· Perform data backups, system migration, lab testing, staging, production, system deployments

· Manage and maintain SES databases, applications

· Programming, configuration management

· Provides reports, O&M technical support

Cybersecurity support such as:

· Maintain all Security Enterprise Systems in compliance with regulations, vendor recommendations, and announcements, and FEMA CIO directives.

· Provide advance notification of configuration changes, security patching, and application updates as required and should be communicated through the Government system owner and COR via ASI (Approved System Interruption) notice

· Mitigate and eliminated system vulnerabilities that exist within the SES systems, applications, and edge devices

· Perform and maintain SES systems C&A (Certification and Accreditation) requirements

F. MANDATED CLIN Systems Administrator (qty. 2) – Duty Station: FEMA HQ & Enterprise service/Telework

F.1 Required Qualifications:

· Minimum of 7 years’ experience with Security Enterprise Services/Systems with a practical understanding of hardware, software, and application support requirements in a enterprise deployment using Master Application Server (MAS) and Satellite Application Server.

· The administrator shall also demonstrate knowledge in Microsoft in Windows Server, SQL 2008,2012, or later and Linux Red Hat.

· Required CSEIP (Certified Systems Engineer ICAM PACS)

· Requires a Top-Secret clearance for administrator privileges on the Security Enterprise Systems

· Requires a Tier 3 Clearance due to elevated network access.

F.2 Desired Qualifications:

Certifications in at least three (3) of the following areas:

· PACS (Physical Access Control Systems)

· IDS (Intrusion Detection Systems)

· VSS (Video Surveillance Systems)

· VMS (Visitor Management Systems)

· CISSP (Certified Information Systems Security Professional)

F.3 Duties:

· Administration of accesses, permissions, alarms, door schedules, maintenance

· Perform software upgrades, patches, updates, etc.

· Perform data backups, system migration, lab testing, staging, production, system deployments

· Manage and maintain SES databases, applications

· Maintain all Security Enterprise Systems in compliance with regulations, vendor recommendations, and announcements, and FEMA CIO directives.

· Provide advance notification of configuration changes, security patching, and application updates as required and should be communicated through the Government system owner and COR via ASI (Approved System Interruption) notice

· Mitigate and eliminated system vulnerabilities that exist within the SES systems, applications, and edge devices

· Perform and maintain SES systems C&A (Certification and Accreditation) requirements

G. OPTIONAL CLIN Senior Technician (qty. 2) - Duty station: Regional location(s) - Minimal Telework

G.1 Required Qualifications:

· Minimum high school diploma or equivalent and seven (7) years of experience working with security systems to include service and maintenance across a broad spectrum of PACS, IDS, and VSS.

· CSEIP (Certified Systems Engineer ICAM PACS) Certified

· One (1) year experience inspecting PACS, IDS, and VSS.

· Knowledge and experience of compliance with industry standards, policies, and guidelines such as: physical and electronic security; access and key control; HSPD; NIST SP; FICAM; OMB; and ISC.

· Knowledge of other security disciplines and their relationship to the electronic and physical security program in order to respond to and troubleshoot system problems.

· Demonstrate experience in team lead supervision of personnel and technical functions, project execution and coordination of all aspects of complex ESS projects and installations.

· Demonstrate experience in the management, maintenance, and sustainment of complex security systems.

· Demonstrate the ability to comprehend technical language, read, and interpret blueprints, wiring diagrams, and schematics.

· Demonstrate the ability to effectively communicate both in writing and verbally.

· Demonstrate the ability to exercise considerable judgement and initiative.

· Working knowledge of low voltage systems.

· Working knowledge of network principles

G.2 Duties:

· Supervise and delegate assigned tasks to junior level technicians as appropriate.

· Assist with the design, procurement, logistics, installation, routine maintenance, sustainment, configuration, programming, and lifecycle replacement of PACS, IDS, VSS, and physical security systems within this contract, as well as the integration of other safety and security subsystems.

· Ensure equipment is updated and operational, meeting required local, state, federal, and ADA requirements.

· Assist with 3rd party security systems integrations, software updates, and helps train field verification of systems and inspection of work in progress for compliance with applicable regulations and standards.

· Makes recommendations for security equipment and systems.

· Assist with issuing, assigning, and removing access rights for access control cards (PIV, non-PIV, visitor, etc.)

·…