amdenment_3_to_post.doc

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE

The following have been added by full text:

ASNWERS TO ROUND 1 QUESTIONS

Questions for HC1028-13-T-0122: DHQCAP13MP60005

1. Question: The site visit presentation was not sufficient to get number, locations, and type of currently installed equipment. We request that a summary of counts of currently installed equipment and devices be made available to us; as well as the plans indicating the layout of existing security equipment as indicated in paragraph 3 of section 28 23 29 (Page 16 of 151).

Response: Contact Corinne.r.huff.civ@mail.mil for drawings.

2. Question: Section 28 23 19 (Page 14 of 151) calls for sizing Recording storage for continuous recording for no less than 30 days at 10 fps….; whereas section 6.1.2.4.1 (Page 28 of 151) calls for …. 30 fps…. Sizing for continuous recording at 30 fps will require a very large amount of storage. Is this the intention?

Response: RFQ, paragraph 6.1.2.4.1 was changed as follows: … “not less than 10fps for 30 calendar days.”

3. Question: The requirement for Dual-throw devices/readers at secure complex exits to report to the separate panels does not seem clear as readers cannot report to separate panels. Please, further clarifications are required.

Response: The reader should disclose information to two separate systems informing about entry to that specific area. The vendor should provide a solution that allows this information to be accessed in both areas while keeping the two panels on separate security systems.

4. Question: We will need a count of the current installed Intrusion Detection devices as this could not be ascertained during site visit.

Response: See attached documentation, the excel spreadsheet entitled SATX IDS Device Configuration.

5. Question: The count for new/replacement CCTV cameras on Page 28 of 151 is about 63. Are these all the cameras on the upgraded system? Page 27 of 151 paragraph 6 talks about capability of re-using analog cameras. Are we replacing all current analog cameras or shall some remain?

Response: The PWS was changed to remove “re-using analog cameras.” The upgrade is replacement of all cameras.

6. Question: For systems F2 and F3, shall the separation of areas just be by the addition of arm/disarm keypads and programming to separate or is it necessary to add IDS control panels?

Response: Additional IDS control panels would be required.

7. Question: Would you please provide the name of the current incumbent, the Contract number, and the value of the Contract?

Response:

Condortech: HC102812F0137; life cycle cost $235,204.74.

Texas Dynamics: HC102811P0268; life cycle cost $458,741.40.

8. Question: Would you please clarify the page limit total for the Technical Proposal? Is it 10 pages total for both the Technical and Management Approach as referenced on p.63, or 10 pages each for the Technical and Management approaches as referenced on p. 64?

Response: Request for Quote Letter, paragraph 3c.(1) was changed to clarify that 10 pages for the Technical Approach Factor and 10 pages for the Management Approach Factor will be allowable.

9. Question: We wanted to get clearance to look at some of the current access panels.

Response: The government will not be conducting another site visit; therefore, building access clearance will not be granted.

10. Question: Will scale drawings of the facility and zones within then be released?

Response: AutoCAD.dwg drawings of the facility and zones within are being provided as attachment, San Antonio floorplan

11. Question: Will these drawings note the existing systems, including conduit with devices count?

Response: Contact Corinne.r.huff.civ@mail.mil for drawings.

12. Question: Section 6.1.6.1 Power Support for Security Systems.

The locations of the dedicated, centralized power panel to support the integrated security system will be central to the DISA main computer room, for access control and centralization/one-median shortest average conductor run reasons.

Please elaborate further on what was meant.

Resonse: The dedicated security system power panel will be on the raised computer room floor. It will not be put in one corner of the building, and there will not be multiple primary power panels for the system. More of the conductor runs to various points in the building will be of 'average' length, so that there are not so many really short ones and/or a lot of really long ones.

13. Question: The Contractor shall provide custom program to develop, implement, and transition personnel, groups, and interior spaces to logical sets allowing (and limiting) access based on Security Manager requirements. This programming shall include but is not necessarily limited to the definition and programming of individual doors (bi-directionally), access zones, controlled access zones, groups of users based on factors such as job, role, function, clearance level, and shift, time-of-day access, anti-passback rules, and similar. The Contractor shall propose sufficient hours to complete this task for the primary integrated system as well as for the two nested systems.

What would be all the security managers’ requirements?

Response: This is a basic setup time. There should not be additional requirements outside of what is normal for these types of systems.

14. Question: The nested systems would be considered part of the new install and not the legacy one i.e. for F1, F2, & F3 and not L1, L2, L3 and L4 correct?

Response: Each nested system remains independent in the future, but an old legacy nested system is indeed replaced by a new nested system.

15. Question: 6.1.6.1 Power Support for Security Systems

If the DISA primary and backup power infrastructure should both be offline what threshold of time should the UPS being proposed be capable of supporting the IDS/ACCS systems?

Response: RFQ, paragraph 6.1.6.1, as depicted in the DECC San Antonio Dedicated Technical Power Concept v1.0 diagram. The entire system is to be on A/B UPS power. Another nested (downstream) UPS system is not allowable.

16. Question: Do you have a local POC which might be able to address questions?

Response: RFQ Letter, paragraph’s 8 and 9, all questions are to be addressed to the DITCO Contract Specialist, Corinne Huff, at corinne.r.huff.civ@mail.mil. Additional questions can be submitted by 3:00 pm CST, August 28, 2013.

17. Question: “all current STIG requirements to the satisfaction of the DECC San Antonio site Security Manager prior to procurement and/or installation”

Do you have a document that is outline in this section?

Response: PWS references to the STIG were taken from the Security Technical Implementation Guides, which can be found at: http://iase.disa.mil/stigs/.

18. Question: Regarding repair or services for existing equipment do you have a list of existing equipment?

Response: Included an excel spreadsheet, SATX IDS Device Configuration Attachment

19. Question: Will the existing Coax CCTV system will be totally replaced with an IP system?

Response: Yes.

20. Question: Are all rooms that will house the ACS / IDS and CCTV system components secured?

Response: No, some of the cameras and equipment are located outside of the building.

21. Question: Is there currently a dedicated IT grounding system?

Response: There is a grounding system on the computer room floor.

22. Question: Will the CCTV system be conduit encased?

Response: Yes, this is in the requirements.

23. Question: Is there a UPS system currently installed to cover down time between Utility power and Backup generator power transfer?

Response: Yes.

24. Question: Will the government be providing drawings or building specs of the facility?

Response: Please contact Corinne.r.huff.civ@mail.mil for those drawings.

25. Question: Under Section 28.01.10 Operation and Maintenance of Electronic Access Control and Intrusion Detection, states that emergency maintenance services shall have a 2-hour response time by Contractor personnel. Page 48 of the RFP states that emergency maintenance services have a 4-hour response time by Contractor personnel. Please confirm if the response time is 2-hours or 4-hours.

Response: All references to emergency maintenance services response time have been changed to 2-hour response time.

26. Question: Will 110 volt power be provided at the panels?

Response: The contractor will work with SSI on site to provide power to the panels.

27. Question: Will mounting boards be provided for the panels?

Response: No, the contractor will either be mounting them to the walls (which has been done in the past) or provide mounting boards at the request of the site manager.

The following have been modified:

PERFORMANCE WORK STATEMENT PWS

Integrated Security System

Upgrade/System Replacement, Integration, Maintenance, & Repair

DISA Defense Enterprise Computing Center (DECC) San Antonio

San Antonio, TX

3. Background.

Defense Information Systems Agency (DISA) Enterprise Services (ES) datacenters provide routine and mission-critical computer processing resources and support to numerous government agencies on a fee-for-service basis, 24 hours per day, 7 days a week.

DISA sites are access-controlled and monitored to provide operational and mission security for customer programs and equipment. Changes in operational requirements, on-going and changing security concerns and regulations, DISA transformation initiatives, and aging systems all require that DISA continue to invest in maintaining modern, operational, secure access control systems at its facilities. Maintaining security systems that meet & exceed changing DISA security requirements is a challenge met by this agreement.

The existing security control systems at San Antonio are fragmented, outdated, and unable to meet current and future monitoring & management requirements. This project will (1) provide the framework that will allow integration and future-proofing of the security system components to meet current and future security standards and directives and (2) provide ongoing sustainment, maintenance, & repair of the upgraded system.

4. Objectives:

Replace the existing legacy security systems at the operating location with a modern, integrated, standards-compliant security system, and then provide recurring, scheduled preventative maintenance as well as unscheduled (emergency) maintenance & repair services for that system for the period of performance of the contract. The installed system will be modified as needed over the period of performance of the contract in order to continue to provide a fully functional system that meets all current security and operational requirements.

5. Scope.

An overview of the work to be provided under this contract follows. The Contractor shall:

· Provide, as necessary, emergency repair/sustainment services for existing obsolete security system to maintain the secure environment until a new system is installed and commissioned;

· Design a new nested (2 systems) integrated access control, intrusion detection, and closed circuit television (CCTV) camera system to provide security for DISA-managed facilities;

· Install the new integrated security systems as designed and approved;

· Transfer all database information to the new integrated security system(s);

· Formally commission the new integrated security system(s);

· Fully transition to the new integrated security system(s);

· Decommission and remove hardware components from legacy security systems (as appropriate);

· Document the system layout and connectivity, and provide complete Configuration Management of the system(s) through the life of the contract;

· Provide routine (preventative) and emergency maintenance services to the integrated security system(s) and remaining legacy systems; and,

· Provide services to repair, modify, add, or change components to the system(s) as required during the lifetime of the contract.

· Ensure that the system meets all emergency, safety, and fire regulatory guidance and requirements.

The upgraded security system to be designed and installed shall be a fully integrated Access Control System (ACS), intrusion detection system (IDS), and closed circuit television (CCTV) system. All equipment, systems, and work performed under this contract must be in accordance with Div 28 Electronic Safety and Security:

Div 28 Electronic Safety and Security

28 01 00 Operation and Maintenance of Electronic Safety and Security Electronic security systems (see sections 28 10 00 and 28 20 00) shall be operated, controlled, and monitored locally to the protected site only. Datacenter local security networks shall not be remotely operated & monitored, controlled, or otherwise accessed by commercial sources (for example, remote desktop access of a security system from a security system service provider’s place of business for alarm monitoring, database manipulation, troubleshooting, or similar), except where the datacenter is not located on an installation that has the capability to provide security support services.

Monitoring of specific alarm contacts (main door breach, duress alarm, et cetera) by host installation security forces are acceptable. After-hours and duress alarm remote monitoring of intrusion detection for strictly administrative facilities by the Federal Protective Service (FPS) is acceptable.

Operations of all electronic security-related systems are restricted by the systems’ security accreditation(s) and security technical implementation guidance (STIGs) as described below:

01 35 53 Security Procedures All Information Technology (IT) systems designed, implemented, and operated in the DISA environment are subject to a strict set of Information Assurance (IA) requirements before those systems are allowed to operate or connect to any other system. Prior to operation or connection of any system, the Service Provider for that system shall obtain all necessary certification(s), accreditation(s), and authorization(s). This requirement applies to services covering

· Building Automation Systems (BAS) (see section 25 10 00)

· Access Control & Closed Circuit Television Systems (see division 28)

· Computerized Maintenance Management Systems (CMMS) (see section 01 95 00)

· Condition Management Estimation Technology (COMET) (see TIM O&M Module 7)

· Equipment RFID Tagging (see TIM O&M Module 7) The contracted Service Provider shall conduct all necessary IA activities to achieve and maintain certification and accreditation of any IT systems during the performance of any contract involving the operations and maintenance of IT systems.

Security System Accreditation Agreement (SSAA) worksheets submitted for the DoD Information Assurance Certification and Accreditation Process (DIACAP) Implementation Plan must take into account modular updates to the systems, patches and how they will be tested and installed, access to out-of-band (OOB) network systems for LAN access, who will be designated as the system administrator(s) for the system(s), how backups will be performed, et cetera..

The processes involved in obtaining and maintaining certification and accreditation are complex and beyond the scope of this Standard to fully define. The publications listed herein and other mandatory guidance that can be obtained from http://iase.disa.mil/ are critical to ensuring that IT systems supporting the enterprise are safe.

The security system service provider and site security management office shall obtain and manage the accreditation for the security system(s) in use at each site.

28 01 10 Operation and Maintenance of Electronic Access Control and Intrusion Detection At each datacenter location, there shall be one (1) single security system service provider (subcontractors and service partners to the primary service provider are acceptable). In the case of internal physical security divisions within the facility (e.g., SCIFs or other areas potentially under the control of outside entities), the separated internal security systems for these areas shall be installed and maintained by the single site security systems provider. These systems shall be separated physically and logically from the main building system(s) as required by all applicable regulations, but shall be compatible with other building systems in the event the area(s) revert to a lower security level or additional surrounding areas are added to the higher security level, in order to alleviate rework and reduce installation and operation costs to the Government.

Lifecycle replacement of access control and intrusion detection equipment shall upgrade individual components and systems according to the critical power distribution schema discussed in section 28 01 30.

The security system service provider shall provide semi-annual preventative maintenance services for the security system to include assembly/disassembly of door controls and equipment, maintenance and routine inspection of access control and intrusion detection hardware, and review of site access control software setup and database(s) to ensure proper and efficient operation of all system components. Firmware releases to all system hardware released by the manufacturer shall be installed within a month of firmware release date (not necessarily coinciding with other scheduled maintenance services). Databases shall be backed up and stored onsite, and shall be cleaned and optimized semi-annually by the security system service provider.

Preventative maintenance shall include a “Premium Software Support” agreement with the ACS software manufacturer. The security system service provider must be an authorized representative of the ACS software and must be fully trained and certified to operate and maintain that system. This “Premium Software Support” agreement shall include software patches and installation of such within one month of release (not necessarily coinciding with other scheduled maintenance services).

Emergency maintenance services shall include all troubleshooting and repair using Government-owned inventory as well as all items covered in preventative maintenance services. Emergency services shall be available to the Government 24 hours per day, 7 days per week, with a 2-hour response time by Contractor personnel (report to site or as directed by site representative).

28 01 10.51 Maintenance and Administration of Electronic Access Control and Intrusion Detection Administration of intrusion detection shall not be conducted by offsite commercial providers at datacenter facilities or facilities with SCIFs. Administration of intrusion detection for strictly administrative facilities by the Federal Protective Service (FPS) is acceptable.

Monitoring of intrusion and duress alarms from other Governmental security offices (for example, host installation security forces) for purposes of alarm response is acceptable.

Any other administration of security systems by a third party is specifically disallowed.

28 01 10.71 Revisions and Upgrades of Electronic Access Control and Intrusion Detection All modifications to security system IT equipment (including but not limited to system firmware updates, operating system patches, and upgrades to security system component software packages) must be coordinated through an approved information assurance process described in the system security accreditation (see section 01 35 53).

28 01 20 Operation and Maintenance of Electronic Surveillance All guidelines, standards, and directives noted in 28 01 10 apply to electronic surveillance systems. As described in section 28 10 00 these systems are to be fully integrated with the access control and intrusion detection systems.

Lifecycle replacement of CCTV equipment shall upgrade individual components and systems according to the critical power distribution schema discussed in section 28 01 30.

The security system service provider shall provide semi-annual preventative maintenance services for the CCTV system to include setup and organization of hardware and cabling, cleaning of all camera equipment, checking of all multiplexer and DVR ports and cables, checking and testing of all batteries, and alignment/tweaking of cameras for proper aperture, aim, and resolution. Preventative maintenance shall include thorough cleaning, adjustments, services, and recommendations for support of interior and exterior camera equipment.

28 01 30 Critical Power Distribution for Electronic Security Systems DISA security requires an extremely high level of availability of equipment and systems, similar to that provided for raised floor IT equipment. Security equipment shall be powered by a centralized, redundant, UPS-backed, dedicated power distribution system. Where possible, power shall be installed or retrofitted to a single, secure power distribution panel to ensure that all equipment is continuously available during contingency events. Stand-alone batteries shall not be used to power or to provide emergency power for security system equipment or devices in facilities with facility-wide UPS capabilities.

Existing equipment and power distribution for that specific equipment is intended to be used until failure using the current communications and power technologies in place (generally coaxial and 24VDC). A complete list of individual systems and components that are not powered redundantly or from technical power circuits shall be created and maintained by the site security service provider for prioritization of power distribution upgrades planned by ES521.

All new security devices shall be network systems communicating on CAT6 copper and powered by PoE (Power Over Ethernet). This will reduce the cost of future system installations by eliminating installation of UPS circuits to each device location. An example of the desired dedicated power system for security systems is shown.

Traditional devices will utilize standard, 120V power on an existing dedicated 100A panel supported by two UPS busses and a static switch. New small devices such as motion sensors and cameras, where available, will be run using PoE. Using a PoE infrastructure enables centralized power management capabilities for these mission critical network devices.

A PoE switch system shall be collocated with security system centralized server equipment.

Each PoE switch shall have a minimum of 24 ports for system expansion. The PoE system shall be expandable for addition of future equipment or replacement of non-IP system components with PoE equipment in the future.

The dedicated technical power scheme shown exceeds the requirements of DoD 5200.1 Volume 3, 2.d.(7).(a) for emergency power in facilities with a facility-wide UPS. In other facilities, meet the guidance of that reference (8 hours of battery and/or generator power, with automatic charging circuits for any batteries).

28 10 00 ELECTRONIC ACCESS CONTROL AND INTRUSION DETECTION

DISA sites are access-controlled and monitored to provide physical operational and mission security for customer programs and equipment. Changes in operational requirements, on-going and changing security concerns and regulations, DISA transformation initiatives, and aging systems all require that DISA continue to invest in maintaining modern, operational, secure systems at its facilities.

Legacy security system equipment has been based on independent, stand-alone systems. Future and replacement systems shall take advantage of the maturation of security system technologies and provide a single, multi-purpose, integrated security system at each site. These systems shall be able to be electronically connected to other ‘local/area/regional’ systems such as the host installation security police, for remote monitoring and armed response. Integrated security systems provide multi-purpose solutions that accentuate employee safety, ensure accountability, allow personnel to be located and accounted for under emergency situations, as well as providing superior security solutions needed to protect the assets at DISA sites.

Integrated security systems are provided and maintained by Facilities Engineering (ES521) to provide multi-purpose solutions at DISA sites. Local site security teams are the primary users and benefactors of these systems, but their other alternative uses shall not be constrained. For example, provision of an “evacuation” emergency code that prints a roster of all employees currently located in the facility for use in accountability at a muster point, post-evacuation, provides a solid benefit to the organization. ES521 may require security system service providers to access data, build tools, and otherwise modify the programming of the multi-purpose, integrated security systems through centralized maintenance and support contracts.

Under no circumstance shall the security system be tied to the BAS, CMMS, or other facility management control system.

The three systems that shall be integrated in future security systems are the Access Control System (ACS), Intrusion Detection System (IDS), and Closed Circuit Television (CCTV) system. All portions of section 28 20 00 (electronic surveillance) shall meet guidance in this section.

Specific security-related references apply to this section:

· DoD 5200.01-R, Information Security Program, Vols 1-3

· DoD 5200.8-R, Physical Security Program

· UFC 4-022-01 Security Engineering: Entry Control Facilities / Access Control Points

· UFC 4-010-01 DoD Minimum Antiterrorism Standards for Buildings

· FIPS 201-1 Personal Identity Verification (PIV) of Federal Employees and Contractors

· IC Tech Spec for ICD/ICS 705, Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Security system components shall be powered on generator-supported circuits. Redundant power for components (including but not limited to the Card Access Controllers (CACs) and controlled access points (door strikes, PIRs, card/biometric readers), CCTV controllers, cameras, recording devices, automated key repositories and server/terminal computer equipment) is required per the schema discussed in section 28 01 30.

All security system conductors (power and communications, to include fiber optics, coaxial, CAT 5/6, 24v, and 120v) shall be protected in continuous conduit runs. Installation of power and communications conductors to support security system requirements shall be conducted by the security system service provider.

28 13 00 Access Control The ACS (Access Control System) is the core application in the integrated security system. Its database driven design and function allow cross referencing of other system inputs to be conducted by an operator of this single system.

ACS systems and components used to secure SCIFs shall meet all requirements of the current version of the IC Tech Spec for ICD/ICS 705 and the classified collateral rooms shall meet the requirements of the current version of the applicable DoD 5200 series regulations.

The ACS shall allow both global and local anti-passback features to be turned on and off by a system administrator. Global anti-passback shall require an ACS event to query the central ACS headend and database to permit access. Local anti-passback shall require an ACS event to query a cached version local to the ACS device or its controller, without querying the central system. Local anti-passback shall be able to be enacted on a device-by-device basis.

ACS delays in granting access to a user (read card, query system, deactivate locking devices) shall not exceed 0.5 seconds in any anti-passback configuration.

28 13 13 Access Control Global Applications Security software systems are to be local to the protected site only. There are no centralized or enterprise-wide connected security software systems. Individual site security management remains delegated to the individual site security managers.

28 13 19 Access Control Systems Infrastructure Integrated security systems shall operate on a dedicated, private data (IP) network that connects select workstations, and thin or thick client terminals to the head-end system(s) for full access to ACS, IDS, and CCTV system components.

Security network information must not be passed onto the DISA or other LAN (security systems communicate only on the private network), to include passing through LAN network equipment used for other systems. Depending on IT security solutions available, this may limit or prohibit the use of computer workstations as client terminals for the security system.

The ACS server(s) shall be physically located in the datacenter with other facility security server hardware. The rack for the security system shall be locked at all times. Access to the security system shall be primarily conducted through dedicated client terminals on the private IP security network, located in the security office (and other locations determined by the site security management team).

Where ACS server(s) do not have redundant power supplies, ATS equipment shall be built into the security system rack to provide redundant power to the equipment.

28 13 19.10 Access Control Systems Head-End Equipment A fully-redundant head-end system (minimum of two physical systems to keep the security systems operational in case of hardware failure) to monitor and control the integrated security system is required. A system configured with a single control computer running the network represents a single point of failure (SPOF) that yields an unacceptable level of risk to the security system. All future systems shall be configured with physically separated primary and secondary control computers, with mirrored databases. Either system should be able to be removed from the network without loss of control of the access control system. The use of a single RAIDed head-end server may be considered fully redundant in certain circumstances.

28 13 19.20 Access Control Systems Operations Terminal Equipment Selected operations terminals (whether thick or thin client, or accessed over the dedicated private IP network on DISA computer workstations) shall have the ability to operate and maintain the entire integrated security system.

The primary operations terminal shall consist of (at a minimum) the workstation, a monitor, a badge printer/encoder, a signature capture pad, a mag card reader, and a proximity card reader with keypad. This operations terminal shall be the primary location to manage the integrated security system, to edit and operate the ACS software, and to create employee badges. The station shall have full capabilities to troubleshoot individual proximity cards.

A backup/remote operations terminal workstation shall consist of a workstation and monitor only. This system shall be fully capable of operating and troubleshooting the security system. The system shall be mirrored such that the loss of the primary terminal will not prevent operation of the security system or cause loss of the security system database(s).

28 13 19.30 Access Control Systems Imaging & Badging Equipment The security system shall have the capability to capture, process, and apply images to personalized, site-specific security badges for use as identification and for access control. Each system shall have a 5 megapixel (minimum) camera and tripod for capturing cardholder images. The camera shall be provided with a simple imaging software tool (either from the camera manufacturer or outside vendor) to crop and correct color on captured images (Photoshop Elements 3 or similar). Imaging software shall be installed onto the primary operations terminal.

Badge printing equipment shall support all FIPS 201-1 requirements and provide the ability to encode proximity cards, print in full CYMK color, and install a protective overcoating to printed cards.

28 13 26 Access Control Remote Devices Access control card readers must meet the requirements of FIPS 201-1.

The legacy access control devices in use in DISA datacenters are generally Hirsch CR22L HID proximity readers and Hirsch ScrambleProx readers, or similar (not FIPS 201-1 compliant). Replacement systems must be capable of reading PIV application data for authentication.

28 16 00 Intrusion Detection The IDS (Intrusion Detection System) shall be physically and logically integrated into the ACS. IDS systems and components used to secure SCIFs shall meet all requirements of the current version of the IC Tech Spec for ICD/ICS 705 and the classified collateral rooms shall meet the requirements of the current version of the applicable DoD 5200 series regulations.

28 16 13 Intrusion Detection Control, GUI, and Logic Systems Intrusion detection GUIs shall report and identify the physical location of all alarms in graphical (map) format.

28 16 16 Intrusion Detection Systems Infrastructure IDS systems shall be physically and logically integrated into the ACS.

28 20 00 ELECTRONIC SURVEILLANCE

Electronic surveillance at DISA facilities shall be integrated with electronic access control and intrusion detection as detailed in section 28 10 00 above. All designs, implementations, expansions, and retrofits of existing systems shall take the integrated security system concept into account. All electronic surveillance systems shall be specifically designed and installed to integrate into future security systems as described in section 28 10 00.

28 23 00 Video Surveillance Video surveillance systems at DISA facilities are referred to as CCTV (closed circuit television) systems. Site security management has wide latitude in deciding how and where to place surveillance devices to manage their facilities. Extensive and redundant coverage, along with protection for the camera systems, is strongly encouraged.

28 23 13 Video Surveillance Control and Management Systems CCTV systems shall be physically and logically integrated into the ACS.

All terminals connected to the integrated security network shall be able to view video from any camera. The remote IP viewing solution provided may be either server-based or run on individual terminals. The solution must be capable of switching between cameras, viewing multiple camera inputs simultaneously, viewing live images, and viewing saved images. The solution must provide at least 10fps playback in both live and recorded images to remote terminals. The solution must provide for PTZ control at the primary and backup operations terminals and at all remote terminals.

28 23 19 Digital Video Recorders and Analog Recording Devices CCTV systems shall be sized for continuous recording for no less than thirty (30) days at 10fps, 640x480 resolution, using MPEG-4 encoding before being recorded over. All recording devices shall be digital video recorders (DVRs) able to send data over the security network. The DVRs and other network-attached equipment must be STIG compliant IAW section 01 35 53.

Video servers and multiplexers shall be physically located in the datacenter with other facility security server hardware. The rack for the security system shall be locked at all times. Access to the security system shall be primarily conducted through dedicated client terminals on the private IP security network, located in the security office (and other locations determined by the site security management team).

Where DVRs do not have redundant power supplies, ATS equipment shall be built into the security system rack to provide redundant power to the equipment.

The sizing and number of DVRs shall be consistent with the number of cameras at the facility. DVR systems shall be fully scalable through the addition of modules in the event of additional camera recording requirements.

28 23 23 Video Surveillance Systems Infrastructure Future CCTV systems will operate over the dedicated IP security network described in section 28 13 19.

The majority of legacy CCTV equipment is operated over coax cable with servers, multiplexers, VCRs, and DVRs physically located in a central security office. This infrastructure is significantly less efficient, redundant, and secure than the future system model required by these standards.

Future infrastructure shall be run from a central server location in the datacenter with thin or thick client terminals providing access to the security system components, with data and power transmitted over the same CAT6 copper between remote devices and servers, and over fiber between terminals and servers.

28 23 26 Video Surveillance Remote Positioning Equipment Joystick-style remote control devices shall be installed at all client terminals as well as at the video server for control over PTZ cameras at the facility. Keyboard interfaces for this equipment are not acceptable.

28 23 29 Video Surveillance Remote Devices and Sensors Both fixed and point-tilt-zoom (PTZ) camera systems shall be used. Definition of which systems to use in which locations is the responsibility of the site security management team. Existing equipment is intended to be used until failure using the current communications technologies in place (generally coaxial). All new CCTV camera systems will be network systems communicating on CAT6 copper and powered by PoE (Power Over Ethernet) (see section 28 01 30).

All cameras shall be color, and must be infrared (IR)/low-light compatible. All external cameras shall have sealed, environmental enclosures with automatic heaters and sun shrouds. Internal cameras shall be installed in sealed dome enclosures to resist tampering.

Motion- or alarm-based recording, conducted frequently in the past because of analog manual tape recording operations, is not authorized for these systems. All cameras shall record continuously as discussed in section 28 23 19 above.

IDS installations and remote monitoring stations shall be fully compliant with UL2050. An updated UL2050 certificate shall be provided for each individual IDS system and for the remote monitoring station annually.

Analog layout plans of the facilities indicating the layout of existing security equipment are available solely to bidding vendors through the contracting office. These informational layout diagrams are restricted for security reasons and will not be disseminated through other channels. Digital (Computer Aided Design (CAD)) layout plans of the facilities, generally without existing security equipment and communications layout information, will be provided at time of award to the successful bidder.

Associated equipment and hardware such as electronic door strikes, magnetic locks, panic/crash bars, door hardware (including hinges, handle sets, lock sets, power openers, & latch guard plates), X-09 (and similar) high-security locksets, strobe lights and switches, legacy emergency backup batteries, controller units and enclosures, and control and power wiring for the system is included in the scope of this agreement. The Contractor will be responsible for maintenance and repair of these additional components.

The Contractor is responsible for surveying the existing building and security systems to confirm the number, location, and type of installed equipment and the support requirements for each. All new conductors (power and data) are required to be installed into conduit (not free-run). Where existing (legacy) equipment is used, retrofit of existing conductors into conduit is not required until that legacy equipment is replaced. Proposals and designs shall explicitly indicate where legacy free-run conductors (power and data) are located. Where legacy equipment is replaced, conductors shall be replaced and installed into conduit (not free-run). The conduit containing these security system conductors must be clearly labeled to indicate what it contains every 5-7 feet.

6. Performance Requirements.

6.1 Security System Equipment Upgrade/Replacement

The Contractor shall plan, design, procure, and install a comprehensive upgrade to the current security system that will result in an integrated security system, and remove older (unnecessary) security system components when the new system is operational. The Contractor shall provide a security system cutover schedule and allow a minimum of 14 calendar days of notice prior to any outages in the security system. The maximum downtime for any portion of the security system during this installation shall be four (4) hours.

Design of the upgraded/replacement security systems, to include all necessary revisions and acceptance by the Government, shall be completed within four (4) months of contract award. Completion of system upgrade/replacement for all tasks, to include commissioning and final acceptance by the Government, shall be completed within ten (10) months of contract award.

“Integration” of a security system means that, at a minimum, the security system is natively and seamlessly able to:

· Provide automated “push” provision of ACS and CCTV records of recent events when an IDS event is triggered, allowing system operators instant access to relevant situational awareness and the ability to respond to situations rapidly

· Track and report individuals’ progress through the facility with both ACS records and CCTV footage, without having to manually access separate systems

· Provide a “contingency report” hot-key to determine where all assigned and visitor personnel are in the facility at any time

· Automatic “intelligent” arming and disarming of IDS zones based on ACS system inputs

· Order automatic alarm recording when ACS and/or IDS alarm ‘events’ defined by the operator occur

· Change operation modes of individual cameras (day/night or visible/infrared modes, as well as frame rate or fixed/automatic pan) on schedule or alarm conditions

· View recorded video at workstations programmed or authorized to allow such while other workstations and monitors continue to display real-time views

· Integrate with analytic alarm modes (more complex sequences than a simple IDS alarm) as programmed to meet future threats

· Allow use of additional advanced electromagnetic detection sensors (laser, radar, thermal) to meet future threats

· Provide automatic playback of recorded video during investigation of all time- or alarm-based events (alarm database is connected to DVR database and pulls video without user intervention)

None of these sample requirements are anticipated to be achievable with a stand-alone, non-integrated solution that does not leverage an integrated system’s full ACS, IDS, and CCTV management capabilities. All of these tasks shall be automated and confirmed by commissioning integrated systems testing to the satisfaction of the Government representatives.

Existing components shall be reused where possible and when they meet or exceed the requirements of the new system as described herein.

Specific bullets in tasks and subtasks below call out equipment that is anticipated to be required to meet the technical and design requirements of this upgrade/replacement. This is not a complete listing of the equipment, systems, or connectivity that will be necessary to successfully upgrade/replace the security system. Cooperative (Government and Contractor) determinations of how the system shall be designed and stood up to meet all of the operating requirements shall not be interpreted in any manner as changing the scope of the project.

DISA has 24x7x365 security system monitoring and armed response requirements that are met by having specified IDS alarms reported directly to a remote vendor monitoring station, with alarms being responded to by Lackland AFB security police and/or City of San Antonio police. Unlike at other DISA DECC facilities, DECC San Antonio is not located on an installation and is not tied directly to a host installation security police monitoring system. In the existing configuration, these alarms are not monitored locally, which inhibits DISA security team’s situational awareness of ongoing events; this will be remedied during this upgrade. Specific additional alarm points reported may be developed by the Government and the Contractor during future modification requirements.

6.1.1 Legacy Security System Overview

· System Legacy 1 (L1): A primary, facility-wide access control system (ACS) controls physical access to all electronically secured doors in the building (except “secure rooms”). This system is run on a single desktop PC and is administered by the site Security Manager.

· The L1 ACS controls access to all electronically-secured external doors, perimeter gates, hallway doors, and doors to all controlled areas (except “secure rooms”).

· System Legacy 2 (L2): A primary, facility-wide intrusion detection system (IDS) monitors alarms at the site perimeter and for selected doors and areas in the building (except “secure rooms”). This system roughly parallels system L1, but is monitored on individual IDS arm/disarm panels, and a master IDS arm/disarm panel that receives alarms from facility IDS zones (except “secure rooms”). L2 does not have remote monitoring.

· System Legacy 3 (L3): A secondary ACS controls access to a “secure room complex” (rooms S-3, D-10, and E-3). Controls for this nested system are located interior to the “secure room complex.”

· L3 has a multiply-zoned IDS with motion sensors, door contact switches, and an arm/disarm pad internal to each IDS zone within the “secure room complex.” This IDS is remotely monitored (for armed response) via a UDP panel that receives encrypted data from the installed arm/disarm panels in each room of the complex.

· A secondary CCTV system monitors (does not record) the entrances to the DISA “secure room complex.” This nested system is located interior to the “secure room complex.” The approximate views captured on these cameras are duplicated in the separate, primary system via dual physical cameras at each location.

· System Legacy 4 (L4): A secondary ACS controls access to a “secure room complex” (rooms D-40, D-40 extension, PGS-1, and PGS-2). Controls for this nested system are located interior to the “secure room complex.”

· L3 has a multiply-zoned IDS with motion sensors, door contact switches, and an arm/disarm pad internal to each IDS zone within the “secure room complex.” This IDS is remotely monitored (for armed response) via a UDP panel that receives encrypted data from the installed arm/disarm panels in each room of the complex.

· A secondary CCTV system monitors (does not record) the entrances to the DISA “secure room complex.” This nested system is located interior to the “secure room complex.” The approximate views captured on these cameras are duplicated in the separate, primary system via dual physical cameras at the main D-40 entry.

· System Legacy 5 (L5): The entire facility has a single, single-zone public address (PA) system. The PA system does not extend inside the perimeter of any of the secure room areas.

6.1.2 Task 1: Upgraded Primary Integrated Security System

Task 1: Upgrade Legacy Systems L1/L2. The Contractor shall install a new, fully redundant head-end system (minimum of two physical servers to keep the security systems operational in case of hardware failure) to monitor and control access control system (ACS), intrusion detection system (IDS), and closed circuit television (CCTV) security system components for the main facility and secured perimeter. These systems shall be located in a DISA-determined location in the main computer room for security and climate control-related issues. This system will be referred to as “primary” throughout this document for clarity. This upgraded system shall be referred to as System F1.

All conductors, and conduit from systems that are being removed or replaced shall be completely abated from the facility by the vendor, and all penetrations sealed appropriately. Abatement requires restoration of the facility and all objects, equipment, and surfaces affected to match existing surrounding objects, equipment, and surfaces. Re-use of conduit and conductors, where they meet current standards or will be modified to meet such, is acceptable.

All newly-installed equipment shall be installed properly, in compliance with the National Electric Code and penetrations sealed appropriately. Installations shall be aesthetic and designed for sustainability of the system, in order to support future maintenance and system modifications.

A graphical representation of the intended resulting integrated security system F1 from Task 1 is shown below. This representation does not show all devices or connections necessary. Note that the “Nested Mirror Systems” in the secure complexes are shown in this graphic but are not part of Task 1.

The new primary integrated security system F1 shall operate on a new private data (IP) network that will connect new, Contractor-provided workstations to the head-end system(s) for partial or full access to ACS, IDS, and CCTV system components (depending on the specific workstation location/function). The primary system will have the capability to connect not less than six (6) additional (future) terminals or monitoring stations to the private network with read-only live monitoring, no controls access to CCTV monitoring access only.

6.1.2.1 Head-end System & Workstations

All IT equipment associated with the new integrated security system F1 (including PoE switches, NVRs (Network Video Recorders), and main head-end servers) shall be located at a DISA-determined location in the main computer room, where it can be secured in a security-dedicated, power- and environmentally-controlled IT equipment rack. Remote workstations for the integrated security system will be located at four (4) locations in the facility.

6.1.2.1.1 Head-End System Hardware Requirement: Install IT Equipment Rack

The…