FLETC VSS SOW Federal Protective Service Final.pdf

FOR OFFICIAL USE ONLY (FOUO)

For Official Use Only (FOUO)

Federal Protective Service

U.S. Department of Homeland Security

STATEMENT OF WORK

for

Installation of Video Surveillance System (VSS) August 4, 2024

Federal Law Enforcement Training Center (FLETC) Additions and Renovations, Building 36

Glynco, Georgia

STATEMENT OF WORK

TABLE OF CONTENTS

A. BACKGROUND

B. PURPOSE

B.1.7 CONTRACTOR FURNISHED EQUIPMENT:

C. SCOPE

C.1 GENERAL

C.2 INSTALLATION REQUIREMENTS

C.3 VIDEO STORAGE REQUIREMENTS

C.4 ROOM MONITORS

C.5 NETWORKING EQUIPMENT

C.6 OPERATING SYSTEMS UPDATES, SERVICE PACKS, AND FIRMWARE

C.7 ATTACHMENTS WITH DEVICE/EQUIPMENT LOCATIONS

D.2 MINIMUM WORKSTATION REQUIREMENTS

D.3 DESCRIPTION OF IP NETWORK VIDEO CAMERAS AND SPECIFICATIONS FOR MINIMUM REQUIREMENTS

D.4 NETWORK MANAGED SWITCH

D.5 ADDITIONAL SYSTEM COMPONENT, SOFTWARE, LOCATION ETC. SPECIFICATIONS

E. ADDITIONAL PROJECT REQUIREMENTS

E.1 DESIGN STANDARDS

E.2 MATERIALS AND EQUIPMENT

E.3 ELECTRICAL AND CABLING REQUIREMENTS

E.4 FINAL INSPECTION AND ACCEPTANCE

E.5 CLEANLINESS, PROTECTION, AND PATCHING

E.6 WARRANTY AND MAINTENANCE

E.7 SAFETY AND HEALTH

E.8 QUALITY CONTROL PLAN

E.9 TRAINING

E.10 CONFIGURATION MANAGEMENT

E.11 COMPONENT/DEVICE CONFIGURATIONS

E.12 NETWORK SETTINGS

E.13 WIRELESS NETWORK SECURITY

E.14 AUDIT AND ACCOUNTABILITY

E.15 IDENTIFICATION AND AUTHENTICATION / ACCESS CONTROL

E.16 DATA PROTECTION

E.17 USER ACCOUNTS

E.18 INCIDENT MANAGEMENT AND DISASTER RECOVERY

E.19 SOFTWARE MAINTENANCE

E.20 ENTERPRISE ARCHITECTURE

F. DELIVERABLES

F.1 GENERAL

F.2 REQUEST FOR QUOTATION (RFQ)

F.3 PRE-INSTALLATION DELIVERABLES

F.4 POST-INSTALLATION DELIVERABLES

G. PROJECT ADMINISTRATION

G.1 WORK AUTHORIZATION

G.2 PERIOD OF PERFORMANCE

G.4 CONTACTS

G.5 SPECIAL SCHEDULING REQUIREMENTS

G.6 CONTRACTOR ACCESS AND USE OF PREMISES

G.7 SECURITY REQUIREMENTS

G.8 CONTRACTOR SUITABILITY REQUIREMENTS

H. APPLICABLE STANDARDS

H.1 GENERAL

H.2 ACCESSIBILITY REQUIREMENTS (SECTION 508)

I ACCOUNTABLE PROPERTY:

I.1 DEFINITIONS:

I.2 DELIVERABLES:

I.3 PROPERTY ACCOUNTABILITY:

I.4 PHYSICAL INVENTORY:

I.5 PROPERTY DISPOSAL:

I.6 LOST, STOLEN, DAMAGED OR DESTROYED (LDD) PROPERTY:

J. INFORMATION TECHNOLOGY SECURITY

J.1 SECURITY CERTIFICATION/ACCREDITATION

J.2 SECURITY REVIEW AND REPORTING

J.3 CONTINUOUS MONITORING

A. BACKGROUND

A.1 The Federal Protective Service (FPS) is the federal law enforcement agency responsible for the protection and security of federal facilities, employees, and visitors. FPS actively works to reduce security vulnerabilities of federal facilities from criminal, terrorist, accidental, and natural disaster threats to ensure properties remain safe, secure, and available to the American public and employees of the federal Government.

A.2 The following Statement of Work (SOW) and guidelines have been developed by the

Department of Homeland Security (DHS), Federal Protective Service (FPS) to mitigate threats and vulnerabilities pertaining to federal buildings and Government leased spaces. The SOW and regulations were developed with the notion that the security posture of each federally owned building or Government leased space is unique.

B. PURPOSE

B.1 Description of New System

B.1.1 This SOW is for the purchase and installation of four (4) new standalone, Network

Video Management System (NVMS), fixed cameras, client workstations, flat panel monitors, GPS Time Server, Uninterrupted Power Supply (UPS), video equipment racks and any additional equipment and appurtenances necessary for a fully functional IP VSS located at the Federal Law Enforcement Training Center (FLETC) Building 36.

B.1.2 FLETC Building 36 has four (4) screening entrances, each entrance will have its own camera Video Surveillance System (VSS) with their own standalone client workstation and will NOT be networked to each other.

B.1.3 The VSS camera system will have different brand of make and model at each location, i.e., Bosch, Avigilon, Axis, ViTek to include matching VMS for each system. VSS workstation’s will not be connected to the Internet. See section E (salient characteristics) for all minimum requirements for all equipment. All new equipment that is proposed by the contractor shall be in compliance with section 889 of the 2019 of the NDAA and Trade Agreement Act (TAA) compliant.

B.1.4 At each screening entrance will be a walkthrough metal detector (WTMD) with a built-in overhead camera to view personnel during screening. The WTMD camera system will be a standalone VSS camera system with its own Network Video Recorder (NVR) laptop to allow for review and playback of video.

B.1.5 Each screening entrance will have four (4) cameras. One overhead camera above the X-ray infeed table and one overhead camera at the X-ray outfeed table, and two cameras viewing the handheld metal detector (HHMD) and queuing area that will occur on the secure side of the WTMD, as shown on drawing attachment A.

B.1.6 Each of the VSS NVRs shall retain video for a minimum of 30 days with 25% additional storage space for future expansion. Each entrance VSS shall be a standalone system with storage calculated at full camera resolution, full frame rate, and low compression.

B.1.7 Contractor Furnished Equipment:

ITEMS QTY LOCATION UNIT

IP Fixed Ceiling Overhead Camera

8 Two at each entrance above the X-ray machine, in rooms:

147, 155, 161, and

167 EA

IP Fixed Camera

8 Two at each entrance, in rooms: 147, 155, 161, and 167

Camera Mounts 16 At camera locations EA Camera License 16 EA

NVR Workstation

4 In VSS rack – rooms:

147, 155, 161, and

167 EA

Network Switch (PoE) – One for each VSS

4 In VSS rack – rooms:

147, 155, 161, and

167 EA

Monitor 32-inch 4K - one for each VSS

4 Above racks - rooms:

147, 155, 161, and

167 EA

Full Motion Commercial Monitor Wall Mount – one above each NVR workstation

Above racks - rooms:

147, 155, 161, and

167 EA

Uninterruptable Power Supply (UPS) for VSS rack equipment - one for each VSS

In VSS rack - rooms;

147, 155, 161, and

167 EA

Master Network Time Protocol GPS Time– one for each VSS

4 In VSS rack - rooms;

147, 155, 161, and

167 EA

Video Rack

4 VSS rack rooms - 147, 155, 161, and

167 EA

C. SCOPE

C.1 General

C.1.1 As part of the pre-bid process, FPS will have a site visit scheduled for April 1, 2025 from 1:00PM to 4:00PM. The point of contact for the site visit will be Mr. Dan Handschin, who can be reached at via email at daniel.j.handschin@fpds.dhs.gov or 912-261-4115. Mr. Handschin will be available to provide guidance during the visit.

Please note that attendance at the site visit is not mandatory. Location details and specific instructions regarding the meeting point for the site visit will be provided by Mr. Handschin. All questions concerning this solilcitation shall be submitted via email no later than April 4, 2025 to jimmy.dolloff@fletc.dhs.gov. Questions received after this date may not be answered prior to the closing date of the solicitation. An area diagram of the locations is available once a Non-Disclosure Agreement (NDA) is provided to the Contracting Officer at jimmy.dolloff@fletc.dhs.gov. The Contractor shall not make or assume any changes to this SOW without written approval from the FPS CO.

C.1.2 The Contractor shall provide and install and configure the system as described and/or shown herein. The system shall include all connectors, adapters, terminators, and appurtenances to interconnect all equipment. The Contractor shall also supply all cabling and miscellaneous materials necessary to interconnect all equipment installed in accordance with this SOW.

C.1.3 The Contractor shall provide, install, and configure the system as described and/or shown herein. The new system shall include all equipment, cabling, connectors, adapters, terminators, and appurtenances to interconnect all equipment installed in accordance with the requirements of this SOW.

C.1.4 The Contractor shall follow all applicable codes in Section H while carrying out the work outlined in this SOW.

C.1.5 The Contractor shall furnish all tools and equipment necessary to complete all work outlined in this SOW. The Contractor is NOT authorized to use Government-owned property, tools, or equipment to complete work in accordance with this SOW, unless otherwise specified.

C.1.6 In the event any operational system or utility (e.g., fire, IDS, HVAC) is required to be disabled or turned off, forty-eight (48) hour notice shall be required and approved by the Building Manager, and/or FPS COR/TPOC prior to deactivation.

a) The Contractor, prior to departing for the day, shall ensure all system(s) previously disabled or turned off are functioning properly. A basic functional test shall be required to determine proper functionality of the system(s) and should be reported to the FPS COR/TPOC.

mailto:daniel.j.handschin@fpds.dhs.gov mailto:jimmy.dolloff@fletc.dhs.gov mailto:jimmy.dolloff@fletc.dhs.gov

b) In the event a system is non-functional once enabled or turned on, it shall be the responsibility of the Contractor, at no additional cost to the Government, to restore the system(s) prior to departure from the site.

c) If the Contractor fails to restore all system(s) before departing, they shall be liable for all costs incurred by the Government to restore system(s) functionality.

C.1.7 All personnel engaged in installation activities pursuant to this SOW shall be licensed by the state, local authority, and/or the city local authority in the required trades or professions which require licensing by such jurisdictions. The type and level of license shall be consistent with requirements of the jurisdictions and work to be performed by this SOW.

C.1.7.1 The contractor shall provide and submit with their proposal documentation from the manufacturer that they are trained, certified, and authorized to install, integrate, test, and commission the system.

C.1.8 It shall be the sole responsibility of the contractor to employ personnel licensed and qualified to carry out all tasks outlined in this SOW. At no time during the installation shall the contractor require Government personnel to complete tasks required to be completed by the contractor as covered by this SOW.

C.1.9 The Contractor shall be solely responsible for ensuring their employees and subcontractors abide by all requirements of the contract. At all times while work is being performed in accordance with this contract, the Contractor shall have a supervisory representative available to answer questions, resolve issues, supervise company employee(s), and subcontractor(s).

C.1.10 The Contractor shall provide a daily access schedule to coordinate installation activities. The schedule shall be submitted with their proposal documentation.

C.1.11 The Contractor shall maintain a separate set of drawings, schematics, and wiring diagrams of the VSS to be used for creating as-built drawings. This set shall be accurately kept up to date by the Contractor, noting all changes and additions to the VSS and shall be available for the final inspection walkthrough.

C.1.12 The Contractor may be required to attend installation construction meetings.

C.2 Installation Requirements

C.2.1 The Contractor shall install all system components and appurtenances in accordance with manufacturer’s instructions following all applicable local, state, and federal codes and policies. All appurtenances, such as, but not limited to connectors, terminators, and mounting hardware shall be supplied by the Contractor, as well as, all adjustments, alignments, programming, and configuration required for a complete and optimal VSS operating system.

C.2.2 The Contractor shall provide and install a complete statically assigned IP based VSS to include, but not limited to, Network Video Management System (NVMS) capable of viewing, recording, playback, and exporting of video, cameras, servers, video storage, workstations, and network routers/switches. Provide and install camera mounts and other appurtenances, premise wiring, and system hardware as required for a complete and fully operational system as specified in this SOW. The installed system shall easily be expandable for future growth.

C.2.3 The Contractor, for all equipment/device(s) requiring licensing, shall purchase/install license(s) as required by the manufacturer. All licensing fees shall be nonrecurring.

Documentation of all software and hardware licenses shall be provided to FPS as part of the final system documentation.

C.2.4 The Contractor shall be responsible to provide the necessary equipment and tools to access all equipment which is not accessible by ladder. The contractor is accountable for all tool and equipment used during the course of installation; potentially dangerous items must remain under the physical control of the installer at all times. All tools and equipment to include electronic equipment and computers are subject to inspection by

FPS.

C.2.5 All measurements and equipment locations are approximate and shall be verified by the

Contractor for accuracy and installation feasibility. The Government shall not be held responsible for any error or variation in any measurements or other data listed, nor shall the Contractor, because of an error or variation in any measurement listed, be relieved of the responsibility to carry out the requirements in accordance with the true intent and meaning of the specifications without additional cost to the Government.

C.2.6 All ceiling tiles removed to accommodate installation shall be returned at the end of the workday. Any ceiling tiles damaged from the contractor shall be replaced with like type.

C.2.7 The Contractor shall remove and haul debris from the project site daily and dispose of in a proper, acceptable manner in accordance with all federal, state, and local laws and regulations, off of the job site property. The debris created from this project shall not be disposed of at the job site, in Government dumpsters, or on Government property.

C.2.8 The Contractor shall install and configure cameras in accordance with manufactures recommendations and industry best practices for optimal live view and recording.

C.2.9 The Contractor shall verify all camera views with the FPS COR/TPOC prior to installation.

C.3 Video Storage Requirements

C.3.1 The Contractor shall calculate appropriate storage for all cameras recording at thirty

(30) frames per second (fps) at the device (Camera, not total system), with maximum resolution, and minimum compression. Storage capacity shall be capable of storing video for a minimum of thirty (30) days. The Contractor shall calculate and provide video storage requirements; the Contractor shall include enough storage for an additional four (4) cameras for future expansion on each standalone system maintaining the thirty (30) day minimum requirement.

C.3.2 Microsoft Windows and the NVMS software shall be configured to use MS Active

Directory for authentication. If the NVMS software is not capable of authenticating to the Active Directory, then separate NVMS accounts will be configured in accordance with account management plan.

C.3.4 The Contractor shall not apply power to the NVMS until, at a minimum; the following checks have been completed.

a) All equipment has been installed and connected in accordance with manufacturer’s instructions.

b) All installed and/or reused wiring has been tested accordingly (e.g. shorts, opens, continuity).

c) Power supplies have been verified to operate at the correct voltage, phase, and frequency. Satisfaction of the above requirements shall not relieve the Contractor of responsibility for incorrect installation, defective equipment, or collateral damage as a result of Contractor work/equipment.

C.3.5 The Contractor shall ensure all system devices are configured appropriately for time synchronization. The local time zone where the system physically resides will be utilized. All devices shall be configured for time synchronization with a GPS enabled network time source. The GPS time source will not have any connectivity capability beyond receive functionality.

C.3.6 The Contractor shall demonstrate to the FPS COR/TPOC that the completed NVMS installation complies with the contract requirements. Using an approved test procedure, all physical and functional requirements of the project shall be demonstrated and shown. The test procedure shall include techniques and requirements for validating all significant system functions. The Contractor shall provide all test equipment and personnel required for final testing.

C.4 Room Monitors

C.4.1 Each workstation will have a computer video monitor for viewing and playback of all cameras. The Contractor shall install one 32-inch LCD 4K UHD, 16:9 (M4K43-G2-NA or equivalent) monitor above video rack at each of the four (4) entrance locations. Final mounting location shall be approved by the FPS PM.

C.5 Networking Equipment

C.5.1 As required per this SOW, the contractor shall purchase, install, and configure all equipment, components, and necessary appurtenances for a complete and appropriately configured Ethernet network connecting all devices of the NVMS.

C.5.2 The Contractor shall install a rack mounted combination display, keyboard, and mouse at a usable height, at each rack location connected to the new NVMS Server for system configuration and administration.

C.5.4 The Contractor shall install four (4) VSS client workstation in VSS rack – one workstation in each room: 147, 155, 161, and 167. Exact location of each workstation shall be coordinated with the FPS COR/TPOC before installation.

C.5.5 The Contractor shall enable software based, packet filtering firewalls on the VSS network. Firewalls will be enabled to permit only authorized network devices and protocols. A list of ports and protocols shall be provided as part of the system documentation for each unique device model and software suite. The VSS shall be functionality tested to ensure enabled firewall rules and port restrictions do not interfere with the overall functionality of the systems.

C.5.6 The Contractor shall ensure that all installed network devices that are Wi-Fi-capable have that capability disabled.

C.6 Operating Systems Updates, Service Packs, and Firmware

C.6.1 Operating systems and software applications shall be capable of being updated/patched after delivery. The Contractor shall ensure that all installed server(s) and client workstation(s) Operating System Software (OS), at the time of installation, are current with all security updates/patches, service packs, revisions, and shall provide through the warranty period. The NVMS and all other installed software shall be the current version with all applicable updates and installed in accordance with manufacturers recommendations.

C.6.2 The Contractor shall remove and/or disable all software components (bloatware) that are not required for the operation and maintenance of the camera system; and shall provide documentation on what is removed and/or disabled. The software to be removed and/or disabled shall include, but is not limited to games, device drivers for network devices not delivered, messaging services (e.g., MSN, AOL IM), Servers or clients for unused Internet services, unused networking and communications protocols, unused document processing utilities (Microsoft Word, Excel, PowerPoint, Adobe Acrobat, OpenOffice, etc.).

C.6.3 The Contractor shall provide notification of patches affecting security within the warranty period as identified in the patch management process.

a) Pre-Contract Award – The Contractor shall provide details on their patch management and update process. Responsibility for installation and update of patches shall be identified.

b) Post-Contract Award - The Contractor shall provide notification of known vulnerabilities affecting Contractor-supplied or required OS, application, and third-party software within 30 days after public disclosure.

C.6.4 The Contractor shall ensure that all VSS components have the latest manufacture approved firmware version installed. Firmware version is to be documented on the device inventory.

C.7 Attachments with Device/Equipment Locations

C.7.1 VSS Locations: See floor plan drawing (Attachment A) for all camera and equipment locations. The Contractor and FPS TPOC shall verify all camera installation locations to provide the optimal view prior to any installation. Each entrance location shall have the following cameras and equipment:

a) Two (2) fixed overhead cameras, one located to view the X-ray infeed table and one located to view the outfeed table. Each entrance location will have one of the brands (Avigilon, Bosch, Axis, or ViTek or Equivalent) full VSS system. Location of the NVMS shall be coordinated with the FPS COR/PM before installation.

b) Two (2) fixed cameras viewing the handheld metal detector (HHMD) and queuing area that will occur on the secure side of the WTMD. Each entrance location will have one of the brands full VSS system (Avigilon, Bosch, Axis, or ViTek or Equivalent). The NVMS shall be coordinated with the FPS COR/PM before installation.

c) One (1) Remote Monitoring Workstation to match same camera VSS brand at each of the entrance locations for a total of four (4). Workstation location shall be coordinated with the FPS COR/PM before installation.

d) One (1) Network Power over Ethernet (PoE) Switch in video rack for a total of four

(4) one at each VSS.

e) One (1) Uninterrupted Power Supply (UPS) in video rack for a total of four (4) one at each VSS location.

f) One (1) Time Server (VTN-TN-PRO) GPS NTP installed in video rack for a total of four (4), one at each video rack location. External building antenna location shall be coordinated with the FPS COR/PM before installation.

g) One (1) 32-inch LCD 4K UHD workstation monitor. For a total of four (4) one at each workstation location. Monitor location shall be coordinated with the FPS COR/PM before installation.

D. Network Video Management System

D.1.1 The NVMS shall support these essential software capabilities:

a) Live video monitoring

b) Recording of video

c) Playback of video from local or remote location(s)

d) Integral alarm/event management

e) Video export

D.1.2 The NVMS shall store/archive video using one of the following techniques:

a) Internal Disk Storage

b) Direct Attached Storage

c) Storage Area Network

D.1.3 The NVMS shall include image storage with configurable resolutions and frame rates.

D.1.4 The NVMS shall be compatible with, but not limited to: H.264, H.265, MPEG4, and

MJPEG video compression formats.

D.1.5 All components/equipment licensing fees for the newly installed NVMS shall be nonrecurring.

D.2 Minimum Workstation Requirements

Multimedia Storage Requirements

General • Multimedia storage shall be dedicated for archiving.

• Archiving shall be physically separated from

OS/DB drives.

• OS/DB and Archive drive may be housed in the same chassis.

• Archive drives configuration

Total Storage Capacity • Shall be calculated by the Contractor based on the requirements of the SOW.

Workstation Minimum Requirements

CPU Intel Core i3 1 (10th Gen) or higher

OS Windows 10 IoT Enterprise (2019) or higher

RAM 32 GB DDR4

OS Hard Drive M.2 256 GB PCIe NVMe Class 40 SSD Network Interface 2 x GbE Ethernet RJ-45 (or equivalent) 4K Capable Support 4K Stream Warranty 3 Years or better

D.3 Description of IP Network Video Cameras and Specifications for Minimum Requirements

D.3.1 Interior Fixed PoE IP Camera: The Contractor shall determine the necessary lens based on the required field of view and lighting for each camera.

a) ONVIF Compliant

b) Varifocal lens with auto-iris, remote focus

c) Multiple, H.264/H.265 Motion JPEG Video Streams

d) Controllable frame rate and bandwidth

e) Video Resolution: 5MP

f) Minimum 0.1 (color), 0.001 (B/W) lux

g) Image Sensor 1/2.3 or 1/2

h) Day/Night automatic infrared-cut filter, range from 10m to 20m

i) Multi-exposure Wide Dynamic Range (WDR)

j) 30 frames per second (fps)

k) IPv4/IPv6 and QoS compatible

l) PoE IEEE 802.3af, Class 3, 24V AC

D.4 Network Managed Switch

a) Physical Aspects

(1) 24 auto-sensing RJ45 10/100/1000 ports; Layer 3 managed

(2) 4 SFP ports 100/1000

(3) Serial DB9 RS-232 console port

(4) Rack Mountable

b) Power over Ethernet (PoE)

(1) 24 PoE+ ports

(2) IEEE 802.3at (up to 60 Watts/port)

D.5 Additional System Component, software, location etc. specifications

D.5.1 At a minimum, the CCV Equipment Rack shall have the following characteristics;

a) Metal lockable rack

b) Glass doors with handle

c) On rolling casters

d) Equipment cooling fans

e) 42” high

D.5.2 At a minimum, the UPS shall possess the following characteristics;

a) Heavy duty surge protector

b) Rack Mountable

c) Sized to provide at least four (4) hours of back up battery power

D.5.3 At a minimum, the GPS Time Server shall have the following;

a) Protocol NTP Stratum 1 Time Server

b) Accuracy Ethernet NTP ± 1ms overall

c) GPS source ±0.1μS

d) ANTENNA

e) Connector SMA Male

f) Cable 5-meter cable, (optional 10-meter extension)

g) Antenna head GPS sensor, in externally rated magnetic housing (+ adhesive pad/window fixing)

h) Unit power 1.5W

i) POE type Class 1

j) Alternative power input 10-40V DC (max current 150mA at 12V)

k) ETHERNET

l) Connector type RJ45

m) Rate 10Base-T/100Base-TX full-duplex with auto-negotiation

n) Data security Shared Keys system (server authentication)

o) Dimensions L 87mm W 75mm H 22mm. L 3.42 inches W 2.95 in H 0.86 in.

p) Weight 123g [ 4.3oz] (with mounting brackets) 121g [4.2oz].

q) Operating temperature -15oC to 75oC [5oF to 167oF].

r) Relative humidity 95% non-condensing.

s) Compliance CE, FCC, RoHS

E. ADDITIONAL PROJECT REQUIREMENTS

E.1 Design Standards

E.1.1 Design Limitations – During design and planning activities, the Contractor shall advise the FPS COR/TPOC of all functional incompatibility issues and/or system interoperability limitations of any equipment to be installed. This shall include, but is not limited to, limitations as a result of insufficient heating, ventilation and HVAC, power, rack, console, and space requirements.

E.1.2 Infrastructure Design – The system design shall include all conduit, junction boxes, cabling, fiber, network topology, and HVAC and power requirements for the proposed Network Video Management System (NVMS).

E.1.3 Equipment Selection – The Contractor shall use commercial off the shelf (COTS) components in system design.

E.1.4 Backup Power Requirements –All VSS electrical and electronic equipment installed shall be powered from an Uninterruptable Power Supply (UPS). It is expected that all equipment necessary for continuous live viewing, recording, and archiving VSS video will be uninterrupted during a power outage. The UPS shall be sized to provide at least four (4) hours1 battery back-up in the event the primary power source is interrupted.

The Contractor shall include load calculations with their bid proposal.

E.1.5 Wiring Schematics – The Contractor shall provide complete system design wiring schematic diagrams representing planned device terminations to and between system equipment and components.

E.1.6 Riser Diagrams – The Contractor shall supply a system riser diagram. The diagram shall indicate the location of all associated system components.

E.2 Materials and Equipment

E.2.1 Items of the same type shall be products of a single manufacturer. All material, software and hardware, shall be new, the most current version, and presently being produced.

E.2.2 The Contractor shall provide enclosures as necessary for equipment not mounted in racks or supplied with an appropriate housing.

a) Interior: Enclosures to house equipment in an interior environment shall meet the requirements of NEMA 250 Type 12.

E.2.3 Camera housings shall match the color and architecture of the building.

E.3 Electrical and Cabling Requirements

E.3.1 Wires, cables, and fiber shall meet applicable requirements of NFPA 70 and UL listings for type and method of installation.

E.3.2 Materials, equipment, and devices shall, at a minimum, meet requirements of UL, where UL standards are established, and requirements of NFPA 70. Grounding and Bonding: UL standard 467 for standard grounding and bonding equipment (1), to include Section 250.4 (A)(1).

E.3.3 All wire, cable, and fiber runs shall be installed in accordance with all federal, state, and local codes and/or regulations. In the instance there is a conflict between applicable codes and regulations, the most stringent shall apply.

1 ISC RMP Criteria 70 - Provide uninterruptible emergency power to essential electronic security systems for a minimum of four hours.

E.3.4 All wire, cable, and fiber runs shall be installed inside conduit and sized according to NFPA 70 for fill requirements. As an alternative, if allowed by applicable codes and/or regulations, wire, cable, and fiber may be installed utilizing wire molding, cable trays, and inner duct. Industry approved hangers/hooks may be substituted for conduit, if allowed by applicable codes and/or regulations, in the advent wire, cable, and fiber runs are installed above a suspended ceiling. No wire, cable, or fiber shall be left unsupported or hanging across ceiling tiles, HVAC ductwork, sprinkler pipes, water pipes, or other appurtenances previously installed.

E.3.5 All wire, cable, and fiber shall not contain splices between equipment termination points.

E.3.6 All wire, cable, and fiber shall be clearly labeled at both ends utilizing a permanent type of label using a common labeling convention.

E.3.7 There shall be no crimp type fittings utilized during cable/wire termination unless specified by the equipment manufacturer.

E.3.8 All equipment connected to AC power shall be protected from surges as described in

IEEE C62.41 and IEEE C62.43. Fuses shall not be used for surge protection.

E.3.9 All cable and fiber installed in conduit shall include a pull string for future use. If an existing pull string is used in any location, it shall be replaced with a new one.

E.3.10 All cable and fiber installed in support of this SOW shall be tested and test reports included in the O&M manual.

E.3.11 All wire, cable, or fiber that is existing and to be reused in support of this SOW shall be tested prior to use. Test report(s) shall be provided with final installation documentation and denoted that wire, cable, or fiber was previously installed.

E.3.12 All Ethernet network cabling shall be CAT 6 metallically shielded cable or multimode fiber optic cable, UL listed for its intended use (e.g., indoor, outdoor, plenum).

E.3.13 All CAT 6/7 cabling shall be installed in accordance with ANSI/TIA/EIA-568-B

Commercial Building Telecommunications Cabling Standard. All cable terminations shall conform to ANSI/TIA/EIA-568-B standards. A few key areas of concern, but not all inclusive are:

a) Pair twists shall be maintained as close as possible to the point of termination.

b) Strip back only as much jacket as is required to terminate individual pairs.

c) All four pairs shall be terminated.

d) Pin/Pair assignments shall follow the T568B configuration.

E.3.14 All CAT 6/7 cabling shall be tested to certify that the cable conforms to ANSI/TIA/EIA- 568.2-D standards. The test device shall provide an electronic copy of the test results. Test results shall be printed and included in the O&M manual.

E.4 Final Inspection and Acceptance

E.4.1 Upon completion of the installation the Contractor shall perform a Contractor

Verification Test (CVT) in accordance with approved Perform Performance Verification Test (PVT) procedures to ensure installed system is fully operational. A copy of the test results shall be available for review by the FPS PM prior to commencing PVT testing and final inspection.

E.4.2 The Contractor shall submit, at a minimum fifteen (15) business days in advance of

PVT testing, a proposed testing plan to the FPS COR/TPOC. The plan shall include test procedures, actions, and expected results demonstrating system functionality and compliance with this SOW. The test plan shall also include means for documenting test results. The test plan shall be approved by the FPS COR/TPOC prior to the Contractor requesting Final Inspection and PVT testing.

E.4.3 The Contractor shall notify the FPS COR/TPOC in writing when requesting a date and time for Final Inspection and PVT testing. Request must be received, at a minimum, fifteen (15) business days in advance.

E.4.4 The Contractor shall provide all equipment and manpower necessary to perform Final

Inspection and PVT testing.

E.4.5 Final Inspection Minimum Requirements

a) Review of Redline drawings.

b) Walk-through and inspection of all installed components and workmanship.

c) Perform Performance Verification Test (PVT) in accordance with approved test plan.

d) All equipment default or contractor entered user IDs and passwords shall be relinquished by the Contractor to the Government.

e) In the event a deficiency is found, or a test fails the Contractor shall have personnel available onsite to resolve the issue so inspection and testing may continue. Once the Contractor deems the issue has been resolved, a re-inspection or re-test shall occur.

f) The Final Inspection and PVT testing shall be performed during a single site visit.

g) Installation Acceptance by the Government shall be given only after the satisfactory completion of the Final Inspection, PVT testing, training, and receipt of all required deliverables outlined in this SOW.

E.5 Cleanliness, Protection, and Patching

E.5.1 The Contractor shall take necessary precautions to avoid damage to existing items that will remain in place, be reused, or remain the property of the Government. It shall be the sole responsibility of the Contractor to repair or replace damaged items, at no cost to the Government. Contractor shall notify the FPS COR/TPOC of any damage immediately.

E.5.2 The Contractor shall not disturb existing construction beyond the extent indicated or necessary to fulfill installation requirements. In the event excessive damage is caused it shall be the sole responsibility of the Contractor to repair damage, at no cost to the Government. Contractor shall notify the FPS COR/TPOC of any damage immediately.

E.5.3 The Contractor shall provide protective methods to control accumulation and migration of dirt and dust in and around all work areas. Removal of dirt, dust, and debris shall be completed daily and in accordance with all applicable federal, state, and local laws and regulation.

E.5.4 It shall be the sole responsibility of the Contractor to protect all existing building systems and utilities, to include, but not limited to, equipment, cabling, and appurtenances (e.g. fire, VSS, IDS, HVAC) during demolition, installation and construction. If any system, service, utilities, equipment, or cabling are damaged due to installation construction the Contractor shall repair damage at no cost to the Government.

E.5.5 If necessary, the Contractor shall be responsible for moving furniture and/or equipment to protect it from damage during installation. All items relocated during installation shall be returned to their original location at the completion of work in the area. Any items that are unable to be relocated shall be protected from damage. In the event damage is incurred during this time it shall be the sole responsibility of the Contractor to replace damaged items without cost to the Government.

E.5.6 The Contractor shall prepare and lay out work in advance. Exercise care when cutting, channeling, chasing, or drilling of floors, walls, partitions, ceilings, or other surfaces as necessary for installation, support, or anchoring of conduit, raceways, and equipment.

E.5.7 The Contractor shall provide a qualified installer to install fire-stopping material to all penetrations and openings created during the installation. All existing penetrations or openings utilized by the contractor during the installation shall have fire-stopping material installed, regardless if it was previously installed. Fire-stopping shall consist of furnishing and installing tested and listed fire-stop systems, combination of materials, or devices to form an effective barrier against the spread of flame, smoke, and gases, and maintain the integrity of walls, fire resistance rated walls, partitions, floors, and ceiling-floor assemblies, including through-penetrations. Firestop systems shall be UL Fire Resistance listed or FM P7825a approved with ''F" and/or “T” rated to at least be equal to fire-rating of the wall, fire wall, or floor in which penetrated openings are to be protected.

E.5.8 Where removal of equipment or materials leaves holes or damaged surfaces, the Contractor shall patch the holes and damaged surfaces, as well as, paint the surface to match adjacent finished surfaces. Finished surfaces of patched area shall be flush and match the existing adjacent surface as closely as possible. If new work is to be applied to existing area, then removal and patching shall be adequate for installation of new work.

E.5.9 GSA is the final authority of approving any and all penetrations in a federal facility.

Ensure to receive approval from GSA prior to any physical penetration during construction to include but not limiting to interior and exterior walls, floors and ceiling.

The Contractor, in accordance with deliverable guidelines, shall submit a Roof Work Safety Protection Plan.

E.6 Warranty and Maintenance

E.6.1 The Contractor shall warranty all Contractor supplied components, workmanship and guarantee that all installed parts meet the specifications set forth in this SOW. Warranty will be for a (minimum) period of 12 months from the date of Government acceptance.

E.6.2 After the one-year base warranty period the contractor shall include four (4) one year option periods for technical services, support, testing, maintenance and repair of the system and components installed in this SOW.

E.6.3 In the event any Contractor supplied equipment, component, part fails within the specified warranty period; the Contractor shall immediately replace or repair the item within 24 hours at no additional cost to the Government. If the Contractor is unable to rectify the issue(s) within the allotted time, the Contractor shall be liable for all costs incurred by the Government to correct the issue(s).

E.6.4 The Contractor shall not be held responsible for failures due to fire, flood, vandalism, and/or misuse of Government equipment.

E.6.5 The Contractor shall include in the O&M manual a copy of all manufacturer warranties, terms, and conditions.

E.6.6 Network components shall be capable of disabling maintenance ports during normal system operation and enabling them only during approved maintenance activities.

E.6.7 Remote maintenance paths shall be encrypted to the firewalls.

E.6.8 The Contractor shall maintain an incident log as part of the software maintenance program, recording therein all deviations from normative operations, and all corrective actions taken. The incident log shall be submitted to FPS upon detection of anomalies, quarterly, and at the end of the contract period.

E.7 Safety and Health

E.7.1 All work shall comply with federal, state, and municipal safety and health regulations.

If there is a conflict between the regulations, the most stringent shall supersede all others.

E.7.2 The Contractor shall assume full responsibility and liability for compliance with all applicable regulations relating to the health and safety of personnel during the execution of work as outlined herein. The Contractor shall not fault the Government for any action on its part or that of its employees or subcontractors which results in injury, illness, or death.

E.7.3 Where pedestrian safety may be endangered the Contractor shall provide appropriate signage, barricades, or other means of notification.

E.7.4 The Contractor shall provide all required safety equipment and ensure the equipment is adequate and utilized appropriately for the work being performed.

E.7.5 The Contractor, in accordance with deliverable guidelines, shall submit a Roof Work

Safety Protection Plan.

E.8 Quality Control Plan

E.8.1 The Contractor shall have a formal Quality Control Plan (QCP) in place covering areas of concern, such as, but not limited to equipment and cabling installation, maintenance, and customer service standards. The QCP shall also address equipment and cable labeling, system performance, installation aesthetics, programming and configuration conventions, and timeliness of service.

E.8.2 The QCP shall cover the Contractor’s quality control policies and procedures to ensure compliance with the requirements of this SOW.

E.8.3 The Contractor shall report non-compliance issues with the QCP to the FPS

COR/TPOC.

E.8.4 The QCP shall include a routine review process that addresses all the areas of the

Contractor’s performance and each of the elements of this SOW.

E.8.5 The QCP shall include the necessary processes for tracking identified deficiencies from initiation through to an acceptable corrective action. The process shall include a means to verify the identified deficiency has been reported, corrected, and accepted by the FPS

COR/TPOC.

E.9 Training

E.9.1 The Contractor shall submit a standardized Training Plan in accordance with manufacture’s recommendations for the type system installed to the FPS COR/TPOC for approval.

E.9.2 The Contractor shall provide operator, administrator, and maintenance training to required personnel. Training shall be conducted onsite and during normal business hours from 8:00 a.m. to 4:30 p.m.

E.9.3 Operator Basic, Operator Advanced and Administrator/Maintenance training shall be conducted as three (3) different sessions. Training sessions shall be a minimum of two

(2) hours in length. Each session shall utilize a mixture of lecture and “hands-on” training.

E.9.4 Instruction materials and manuals shall be included for reference, as well as, allowing

FPS to train additional personnel at a later date.

E.9.5 At a minimum, training shall include:

a) Operator Training Basic

(1) With equipment powered off, conduct a complete system startup.

(2) General operating instructions.

(3) Video review procedure.

(4) Changing and selecting different cameras and views.

b) Operator Training Advanced

(1) All elements of Operator Training Basic

(2) Saving and Archiving video.

(3) Video Analytics Use

c) Administrator/Maintenance Training

(1) All elements of Operator Training Basic and Advanced

(2) Full System Configuration

(3) Video Analytic Configuration

(4) System Backup and Recovery

(5) Remote Network Operation

(6) Technical Support Information and Procedures

E.10 Configuration Management

E.10.1 Upon installation, all server(s)’ and client workstation(s)’ Operating System (OS) must be current with security updates/patches, service packs, and revisions.

E.10.2 All installed software shall be the current version with all applicable updates and installed in accordance with manufacturers recommendations.

E.11 Component/Device Configurations

E.11.1 All devices connected to the VSS network shall have default credentials changed and provided to FPS in the contract deliverable documentation. All VSS user, application, and device, and service accounts shall be documented. Strong passwords will be used to the maximum extent possible only all devices. Reference section for E.15.4

E.11.2 All components that have remote access capability, e.g., web interfaces, remote configuration, shall be capable of being configured to restrict access by user ID and password.

E.11.3 Servers and workstations shall be configured to automatically lock a user’s account after three consecutive failed logon attempts during a twenty-four (24) hour time period.

E.11.4 Automatic lockout period for accounts locked due to failed login attempts shall be set for twenty (20) minutes.

E.11.5 Shall have capability of manually unlocking accounts prior to the expiration of the twenty (20) minute period, after sufficient user identification is established.

E.11.6 User sessions on servers shall automatically be terminated after sixty (30) minutes of inactivity. VSS workstations used for the monitoring of cameras shall be configured to NOT automatically lock during periods of inactivity.

E.11.7 All system components shall have unnecessary/unused ports, protocols and services disabled. A list and justification for each open port, protocol and service shall be provided. A list of ports, protocols, and services that were disabled or removed during the installation shall be documented and provided to FPS.

E.12 Network Settings

E.12.1 Port-forwarding settings on network devices shall be configured to only run the necessary ports for the network address translation for the system.

E.12.2 Networked components shall be configured for a network domain environment, not as a workgroup.

E.12.3 Components shall implement identification and strong authentication (in accordance with DHS 4300A 5.1.1.1 for administration of the firewalls and Policy Enforcement Points (PEP).

E.12.4 Firewalls and PEPs shall be configured to prohibit any protocol or service that is not explicitly permitted.

E.12.5 System components shall not use the Telnet protocol. A connection protocol such as Secure Shell (SSH) that employs secure authentication (two factor, encrypted, key exchange) and is approved by FPS shall be used instead.

E.12.6 System components shall not use the File Transfer Protocol (FTP). A connection protocol that employs secure authentication (two factor, encrypted, key exchange) and is approved by FPS shall be used instead.

E.12.7 System components shall not use Remote Desktop connections, such as Microsoft’s

Remote Desktop Protocol (RDP), without the use of an authentication method that employs secure authentication (two-factor, encrypted, key exchange).

E.12.8 Configure Virtual Local Area Networks (VLANs) to create trust boundaries around the operational VSSs within each connected building.

E.13 Wireless Network Security

E.13.1 There are no wireless devices on this system.

E.14 Audit and Accountability

E.14.1 Audit logs on servers and workstations shall contain at least the following information:

a) Identity of each user and device accessing or attempting to access the system.

b) Time and date of the access and the logoff

c) Activities that might modify, bypass, or negate information security safeguards.

d) Security-relevant actions associated with processing.

e) All activities performed using an administrator’s identity.

E.14.2 Audit records and logs shall be protected from unauthorized modification, access, or destruction, when on located on local hard drives, network attached storage devices, or removable media.

E.14.3 System audit trail records shall be maintained online for at least ninety (90) days.

E.15 Identification and Authentication / Access Control

E.15.1 Servers, workstations, and devices with user interfaces (i.e., routers, firewalls, and cameras) shall be capable of using positive user identification and authentication mechanisms through the use of uniquely assigned user IDs.

E.15.2 Systems with authentication controls shall require each user to authenticate prior to system access. VSS camera monitoring and display stations shall be configured with NO automatic screensaver of screen lock as a result of user inactivity.

E.15.3 Systems shall NOT disable user identifiers as a result of the account not being used for any length of inactivity on the account. Systems shall be capable of disabling user identifiers.

E.15.4 Systems shall enforce password composition and complexity requirements:

a) Are at least 12 characters in length.

b) Are not the same as any of the user’s previous 8 passwords.

c) Do not contain any dictionary word.

d) Are not the same as the User ID

e) Contains at least one number (e.g., 1, 2, 3) and one special character (e.g., @, #, $, E.15.5 Systems shall store all passwords in encrypted form.

E.15.6 Systems shall provide role-based accesses that allow different levels of privilege. For example, administrators, general users, etc. The following user accounts will be configured on the VSS:

FPSadministrator = Domain Administrator (all permissions)

FPSrepresentative = Local Administrator (configure cameras, add/remove media, install software)

PSOuser = Limited (login and monitor cameras) (this account cannot make system changes or remove video footage from the VSS)

E.15.7 All default vendor or factory-set administrator accounts or passwords shall be changed before operational use.

E.16 Data Protection

E.16.1 Cryptographic functions provided by any system component shall use only cryptographic modules that are Federal Information Processing Standard (FIPS) 197 (AES-256) compliant and have received FIPS 140-2 validation at the level appropriate to their use.

E.16.2 The Contractor shall provide configuration specifications for implementing encryption and authentication between the cameras and the network and specifically note all security measures associated with the system.

E.16.3 When the contract ends, the contractor shall return all information and information resources provided during the life of the contract and certify that all DHS information has been purged from any contractor-owned system(s) that have been used to process DHS information.

E.17 User Accounts

E.17.1 The Contractor shall provide user accounts with configurable access and permissions associated with the defined user role.

E.17.2 The Contractor shall adhere to least privileged permission schemes for all user accounts, and application-to-application communications.

E.17.3 The Contractor shall recommend which accounts need to be active and those that can be disabled, removed, or modified. The FPS COR/TPOC shall approve in writing the Contractor’s recommendation.

E.17.4 The Contractor shall disable, remove, or modify all the accounts pursuant to the approved recommendation.

E.17.5 The Contractor shall provide documentation defining access and security permissions, user accounts, applications, and associated roles.

E.17.6 The Contractor shall disable or remove all default and guest accounts prior to the system acceptance.

E.17.7 The Contractor shall provide documentation on all Contractor-configured or manufacturer default accounts, usernames, passwords, security settings, security codes, and other access methods are changed, disabled, or removed prior to system acceptance.

E.17. 8 After the system acceptance, the Contractor shall…