RFQ_to_post.doc

Section SF 30 - BLOCK 14 CONTINUATION PAGE

PERFORMANCE WORK STATEMENT PWS

PERFORMANCE WORK STATEMENT (PWS)

as of 18 June 2013

1. Contracting Officer Representative (COR)

a. Primary COR

Name:

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR

Name:

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

1.1. Communications.

The COR may involve additional personnel in communications with the Contractor, but the COR remains the official liaison for any technical communications with the contractor. The contract may require on-site monitoring of the services being performed. If on-site monitoring is required, the DISA Facilities Engineering (ES521) personnel will perform this function, providing input to the COR. Onsite monitoring may include periodic verification and analysis of the services being performed. While ES521 staff may provide technical direction for facility requirements to the COR, they hold no contractual authority.

The Contractor shall not take direction from anyone other than the COR or the Contracting Officer on any technical matter, nor shall the Contractor change operations, priorities or alter standards or specifications based on direction from anyone other than the COR and the Contracting Officer. The Contractor shall comply with administrative and security requirements for each designated site. Communications that are not authorized within this document shall be immediately reported to the Contracting Officer or their representative. All changes shall be directed by the Contracting Office in the form of a formal contract modification.

2. Contract Title.

Integrated Security System

Upgrade/System Replacement, Integration, Maintenance, & Repair

DISA Defense Enterprise Computing Center (DECC) San Antonio

San Antonio, TX

3. Background.

Defense Information Systems Agency (DISA) Enterprise Services (ES) datacenters provide routine and mission-critical computer processing resources and support to numerous government agencies on a fee-for-service basis, 24 hours per day, 7 days a week.

DISA sites are access-controlled and monitored to provide operational and mission security for customer programs and equipment. Changes in operational requirements, on-going and changing security concerns and regulations, DISA transformation initiatives, and aging systems all require that DISA continue to invest in maintaining modern, operational, secure access control systems at its facilities. Maintaining security systems that meet & exceed changing DISA security requirements is a challenge met by this agreement.

The existing security control systems at San Antonio are fragmented, outdated, and unable to meet current and future monitoring & management requirements. This project will (1) provide the framework that will allow integration and future-proofing of the security system components to meet current and future security standards and directives and (2) provide ongoing sustainment, maintenance, & repair of the upgraded system.

4. Objectives:

Replace the existing legacy security systems at the operating location with a modern, integrated, standards-compliant security system, and then provide recurring, scheduled preventative maintenance as well as unscheduled (emergency) maintenance & repair services for that system for the period of performance of the contract. The installed system will be modified as needed over the period of performance of the contract in order to continue to provide a fully functional system that meets all current security and operational requirements.

5. Scope.

An overview of the work to be provided under this contract follows. The Contractor shall:

· Provide, as necessary, emergency repair/sustainment services for existing obsolete security system to maintain the secure environment until a new system is installed and commissioned;

· Design a new nested (2 systems) integrated access control, intrusion detection, and closed circuit television (CCTV) camera system to provide security for DISA-managed facilities;

· Install the new integrated security systems as designed and approved;

· Transfer all database information to the new integrated security system(s);

· Formally commission the new integrated security system(s);

· Fully transition to the new integrated security system(s);

· Decommission and remove hardware components from legacy security systems (as appropriate);

· Document the system layout and connectivity, and provide complete Configuration Management of the system(s) through the life of the contract;

· Provide routine (preventative) and emergency maintenance services to the integrated security system(s) and remaining legacy systems; and,

· Provide services to repair, modify, add, or change components to the system(s) as required during the lifetime of the contract.

· Ensure that the system meets all emergency, safety, and fire regulatory guidance and requirements.

The upgraded security system to be designed and installed shall be a fully integrated Access Control System (ACS), intrusion detection system (IDS), and closed circuit television (CCTV) system. All equipment, systems, and work performed under this contract must be in accordance with Div 28 Electronic Safety and Security:

Div 28 Electronic Safety and Security

28 01 00 Operation and Maintenance of Electronic Safety and Security Electronic security systems (see sections 28 10 00 and 28 20 00) shall be operated, controlled, and monitored locally to the protected site only. Datacenter local security networks shall not be remotely operated & monitored, controlled, or otherwise accessed by commercial sources (for example, remote desktop access of a security system from a security system service provider’s place of business for alarm monitoring, database manipulation, troubleshooting, or similar), except where the datacenter is not located on an installation that has the capability to provide security support services.

Monitoring of specific alarm contacts (main door breach, duress alarm, et cetera) by host installation security forces are acceptable. After-hours and duress alarm remote monitoring of intrusion detection for strictly administrative facilities by the Federal Protective Service (FPS) is acceptable.

Operations of all electronic security-related systems are restricted by the systems’ security accreditation(s) and security technical implementation guidance (STIGs) as described below:

01 35 53 Security Procedures All Information Technology (IT) systems designed, implemented, and operated in the DISA environment are subject to a strict set of Information Assurance (IA) requirements before those systems are allowed to operate or connect to any other system. Prior to operation or connection of any system, the Service Provider for that system shall obtain all necessary certification(s), accreditation(s), and authorization(s). This requirement applies to services covering

· Building Automation Systems (BAS) (see section 25 10 00)

· Access Control & Closed Circuit Television Systems (see division 28)

· Computerized Maintenance Management Systems (CMMS) (see section 01 95 00)

· Condition Management Estimation Technology (COMET) (see TIM O&M Module 7)

· Equipment RFID Tagging (see TIM O&M Module 7) The contracted Service Provider shall conduct all necessary IA activities to achieve and maintain certification and accreditation of any IT systems during the performance of any contract involving the operations and maintenance of IT systems.

Security System Accreditation Agreement (SSAA) worksheets submitted for the DoD Information Assurance Certification and Accreditation Process (DIACAP) Implementation Plan must take into account modular updates to the systems, patches and how they will be tested and installed, access to out-of-band (OOB) network systems for LAN access, who will be designated as the system administrator(s) for the system(s), how backups will be performed, et cetera..

The processes involved in obtaining and maintaining certification and accreditation are complex and beyond the scope of this Standard to fully define. The publications listed herein and other mandatory guidance that can be obtained from http://iase.disa.mil/ are critical to ensuring that IT systems supporting the enterprise are safe.

The security system service provider and site security management office shall obtain and manage the accreditation for the security system(s) in use at each site.

28 01 10 Operation and Maintenance of Electronic Access Control and Intrusion Detection At each datacenter location, there shall be one (1) single security system service provider (subcontractors and service partners to the primary service provider are acceptable). In the case of internal physical security divisions within the facility (e.g., SCIFs or other areas potentially under the control of outside entities), the separated internal security systems for these areas shall be installed and maintained by the single site security systems provider. These systems shall be separated physically and logically from the main building system(s) as required by all applicable regulations, but shall be compatible with other building systems in the event the area(s) revert to a lower security level or additional surrounding areas are added to the higher security level, in order to alleviate rework and reduce installation and operation costs to the Government.

Lifecycle replacement of access control and intrusion detection equipment shall upgrade individual components and systems according to the critical power distribution schema discussed in section 28 01 30.

The security system service provider shall provide semi-annual preventative maintenance services for the security system to include assembly/disassembly of door controls and equipment, maintenance and routine inspection of access control and intrusion detection hardware, and review of site access control software setup and database(s) to ensure proper and efficient operation of all system components. Firmware releases to all system hardware released by the manufacturer shall be installed within a month of firmware release date (not necessarily coinciding with other scheduled maintenance services). Databases shall be backed up and stored onsite, and shall be cleaned and optimized semi-annually by the security system service provider.

Preventative maintenance shall include a “Premium Software Support” agreement with the ACS software manufacturer. The security system service provider must be an authorized representative of the ACS software and must be fully trained and certified to operate and maintain that system. This “Premium Software Support” agreement shall include software patches and installation of such within one month of release (not necessarily coinciding with other scheduled maintenance services).

Emergency maintenance services shall include all troubleshooting and repair using Government-owned inventory as well as all items covered in preventative maintenance services. Emergency services shall be available to the Government 24 hours per day, 7 days per week, with a 2-hour response time by Contractor personnel (report to site or as directed by site representative).

28 01 10.51 Maintenance and Administration of Electronic Access Control and Intrusion Detection Administration of intrusion detection shall not be conducted by offsite commercial providers at datacenter facilities or facilities with SCIFs. Administration of intrusion detection for strictly administrative facilities by the Federal Protective Service (FPS) is acceptable.

Monitoring of intrusion and duress alarms from other Governmental security offices (for example, host installation security forces) for purposes of alarm response is acceptable.

Any other administration of security systems by a third party is specifically disallowed.

28 01 10.71 Revisions and Upgrades of Electronic Access Control and Intrusion Detection All modifications to security system IT equipment (including but not limited to system firmware updates, operating system patches, and upgrades to security system component software packages) must be coordinated through an approved information assurance process described in the system security accreditation (see section 01 35 53).

28 01 20 Operation and Maintenance of Electronic Surveillance All guidelines, standards, and directives noted in 28 01 10 apply to electronic surveillance systems. As described in section 28 10 00 these systems are to be fully integrated with the access control and intrusion detection systems.

Lifecycle replacement of CCTV equipment shall upgrade individual components and systems according to the critical power distribution schema discussed in section 28 01 30.

The security system service provider shall provide semi-annual preventative maintenance services for the CCTV system to include setup and organization of hardware and cabling, cleaning of all camera equipment, checking of all multiplexer and DVR ports and cables, checking and testing of all batteries, and alignment/tweaking of cameras for proper aperture, aim, and resolution. Preventative maintenance shall include thorough cleaning, adjustments, services, and recommendations for support of interior and exterior camera equipment.

28 01 30 Critical Power Distribution for Electronic Security Systems DISA security requires an extremely high level of availability of equipment and systems, similar to that provided for raised floor IT equipment. Security equipment shall be powered by a centralized, redundant, UPS-backed, dedicated power distribution system. Where possible, power shall be installed or retrofitted to a single, secure power distribution panel to ensure that all equipment is continuously available during contingency events. Stand-alone batteries shall not be used to power or to provide emergency power for security system equipment or devices in facilities with facility-wide UPS capabilities.

Existing equipment and power distribution for that specific equipment is intended to be used until failure using the current communications and power technologies in place (generally coaxial and 24VDC). A complete list of individual systems and components that are not powered redundantly or from technical power circuits shall be created and maintained by the site security service provider for prioritization of power distribution upgrades planned by ES521.

All new security devices shall be network systems communicating on CAT6 copper and powered by PoE (Power Over Ethernet). This will reduce the cost of future system installations by eliminating installation of UPS circuits to each device location. An example of the desired dedicated power system for security systems is shown.

Traditional devices will utilize standard, 120V power on an existing dedicated 100A panel supported by two UPS busses and a static switch. New small devices such as motion sensors and cameras, where available, will be run using PoE. Using a PoE infrastructure enables centralized power management capabilities for these mission critical network devices.

A PoE switch system shall be collocated with security system centralized server equipment.

Each PoE switch shall have a minimum of 24 ports for system expansion. The PoE system shall be expandable for addition of future equipment or replacement of non-IP system components with PoE equipment in the future.

The dedicated technical power scheme shown exceeds the requirements of DoD 5200.1 Volume 3, 2.d.(7).(a) for emergency power in facilities with a facility-wide UPS. In other facilities, meet the guidance of that reference (8 hours of battery and/or generator power, with automatic charging circuits for any batteries).

28 10 00 ELECTRONIC ACCESS CONTROL AND INTRUSION DETECTION

DISA sites are access-controlled and monitored to provide physical operational and mission security for customer programs and equipment. Changes in operational requirements, on-going and changing security concerns and regulations, DISA transformation initiatives, and aging systems all require that DISA continue to invest in maintaining modern, operational, secure systems at its facilities.

Legacy security system equipment has been based on independent, stand-alone systems. Future and replacement systems shall take advantage of the maturation of security system technologies and provide a single, multi-purpose, integrated security system at each site. These systems shall be able to be electronically connected to other ‘local/area/regional’ systems such as the host installation security police, for remote monitoring and armed response. Integrated security systems provide multi-purpose solutions that accentuate employee safety, ensure accountability, allow personnel to be located and accounted for under emergency situations, as well as providing superior security solutions needed to protect the assets at DISA sites.

Integrated security systems are provided and maintained by Facilities Engineering (ES521) to provide multi-purpose solutions at DISA sites. Local site security teams are the primary users and benefactors of these systems, but their other alternative uses shall not be constrained. For example, provision of an “evacuation” emergency code that prints a roster of all employees currently located in the facility for use in accountability at a muster point, post-evacuation, provides a solid benefit to the organization. ES521 may require security system service providers to access data, build tools, and otherwise modify the programming of the multi-purpose, integrated security systems through centralized maintenance and support contracts.

Under no circumstance shall the security system be tied to the BAS, CMMS, or other facility management control system.

The three systems that shall be integrated in future security systems are the Access Control System (ACS), Intrusion Detection System (IDS), and Closed Circuit Television (CCTV) system. All portions of section 28 20 00 (electronic surveillance) shall meet guidance in this section.

Specific security-related references apply to this section:

· DoD 5200.01-R, Information Security Program, Vols 1-3

· DoD 5200.8-R, Physical Security Program

· UFC 4-022-01 Security Engineering: Entry Control Facilities / Access Control Points

· UFC 4-010-01 DoD Minimum Antiterrorism Standards for Buildings

· FIPS 201-1 Personal Identity Verification (PIV) of Federal Employees and Contractors

· IC Tech Spec for ICD/ICS 705, Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Security system components shall be powered on generator-supported circuits. Redundant power for components (including but not limited to the Card Access Controllers (CACs) and controlled access points (door strikes, PIRs, card/biometric readers), CCTV controllers, cameras, recording devices, automated key repositories and server/terminal computer equipment) is required per the schema discussed in section 28 01 30.

All security system conductors (power and communications, to include fiber optics, coaxial, CAT 5/6, 24v, and 120v) shall be protected in continuous conduit runs. Installation of power and communications conductors to support security system requirements shall be conducted by the security system service provider.

28 13 00 Access Control The ACS (Access Control System) is the core application in the integrated security system. Its database driven design and function allow cross referencing of other system inputs to be conducted by an operator of this single system.

ACS systems and components used to secure SCIFs shall meet all requirements of the current version of the IC Tech Spec for ICD/ICS 705 and the classified collateral rooms shall meet the requirements of the current version of the applicable DoD 5200 series regulations.

The ACS shall allow both global and local anti-passback features to be turned on and off by a system administrator. Global anti-passback shall require an ACS event to query the central ACS headend and database to permit access. Local anti-passback shall require an ACS event to query a cached version local to the ACS device or its controller, without querying the central system. Local anti-passback shall be able to be enacted on a device-by-device basis.

ACS delays in granting access to a user (read card, query system, deactivate locking devices) shall not exceed 0.5 seconds in any anti-passback configuration.

28 13 13 Access Control Global Applications Security software systems are to be local to the protected site only. There are no centralized or enterprise-wide connected security software systems. Individual site security management remains delegated to the individual site security managers.

28 13 19 Access Control Systems Infrastructure Integrated security systems shall operate on a dedicated, private data (IP) network that connects select workstations, and thin or thick client terminals to the head-end system(s) for full access to ACS, IDS, and CCTV system components.

Security network information must not be passed onto the DISA or other LAN (security systems communicate only on the private network), to include passing through LAN network equipment used for other systems. Depending on IT security solutions available, this may limit or prohibit the use of computer workstations as client terminals for the security system.

The ACS server(s) shall be physically located in the datacenter with other facility security server hardware. The rack for the security system shall be locked at all times. Access to the security system shall be primarily conducted through dedicated client terminals on the private IP security network, located in the security office (and other locations determined by the site security management team).

Where ACS server(s) do not have redundant power supplies, ATS equipment shall be built into the security system rack to provide redundant power to the equipment.

28 13 19.10 Access Control Systems Head-End Equipment A fully-redundant head-end system (minimum of two physical systems to keep the security systems operational in case of hardware failure) to monitor and control the integrated security system is required. A system configured with a single control computer running the network represents a single point of failure (SPOF) that yields an unacceptable level of risk to the security system. All future systems shall be configured with physically separated primary and secondary control computers, with mirrored databases. Either system should be able to be removed from the network without loss of control of the access control system. The use of a single RAIDed head-end server may be considered fully redundant in certain circumstances.

28 13 19.20 Access Control Systems Operations Terminal Equipment Selected operations terminals (whether thick or thin client, or accessed over the dedicated private IP network on DISA computer workstations) shall have the ability to operate and maintain the entire integrated security system.

The primary operations terminal shall consist of (at a minimum) the workstation, a monitor, a badge printer/encoder, a signature capture pad, a mag card reader, and a proximity card reader with keypad. This operations terminal shall be the primary location to manage the integrated security system, to edit and operate the ACS software, and to create employee badges. The station shall have full capabilities to troubleshoot individual proximity cards.

A backup/remote operations terminal workstation shall consist of a workstation and monitor only. This system shall be fully capable of operating and troubleshooting the security system. The system shall be mirrored such that the loss of the primary terminal will not prevent operation of the security system or cause loss of the security system database(s).

28 13 19.30 Access Control Systems Imaging & Badging Equipment The security system shall have the capability to capture, process, and apply images to personalized, site-specific security badges for use as identification and for access control. Each system shall have a 5 megapixel (minimum) camera and tripod for capturing cardholder images. The camera shall be provided with a simple imaging software tool (either from the camera manufacturer or outside vendor) to crop and correct color on captured images (Photoshop Elements 3 or similar). Imaging software shall be installed onto the primary operations terminal.

Badge printing equipment shall support all FIPS 201-1 requirements and provide the ability to encode proximity cards, print in full CYMK color, and install a protective overcoating to printed cards.

28 13 26 Access Control Remote Devices Access control card readers must meet the requirements of FIPS 201-1.

The legacy access control devices in use in DISA datacenters are generally Hirsch CR22L HID proximity readers and Hirsch ScrambleProx readers, or similar (not FIPS 201-1 compliant). Replacement systems must be capable of reading PIV application data for authentication.

28 16 00 Intrusion Detection The IDS (Intrusion Detection System) shall be physically and logically integrated into the ACS. IDS systems and components used to secure SCIFs shall meet all requirements of the current version of the IC Tech Spec for ICD/ICS 705 and the classified collateral rooms shall meet the requirements of the current version of the applicable DoD 5200 series regulations.

28 16 13 Intrusion Detection Control, GUI, and Logic Systems Intrusion detection GUIs shall report and identify the physical location of all alarms in graphical (map) format.

28 16 16 Intrusion Detection Systems Infrastructure IDS systems shall be physically and logically integrated into the ACS.

28 20 00 ELECTRONIC SURVEILLANCE

Electronic surveillance at DISA facilities shall be integrated with electronic access control and intrusion detection as detailed in section 28 10 00 above. All designs, implementations, expansions, and retrofits of existing systems shall take the integrated security system concept into account. All electronic surveillance systems shall be specifically designed and installed to integrate into future security systems as described in section 28 10 00.

28 23 00 Video Surveillance Video surveillance systems at DISA facilities are referred to as CCTV (closed circuit television) systems. Site security management has wide latitude in deciding how and where to place surveillance devices to manage their facilities. Extensive and redundant coverage, along with protection for the camera systems, is strongly encouraged.

28 23 13 Video Surveillance Control and Management Systems CCTV systems shall be physically and logically integrated into the ACS.

All terminals connected to the integrated security network shall be able to view video from any camera. The remote IP viewing solution provided may be either server-based or run on individual terminals. The solution must be capable of switching between cameras, viewing multiple camera inputs simultaneously, viewing live images, and viewing saved images. The solution must provide at least 10fps playback in both live and recorded images to remote terminals. The solution must provide for PTZ control at the primary and backup operations terminals and at all remote terminals.

28 23 19 Digital Video Recorders and Analog Recording Devices CCTV systems shall be sized for continuous recording for no less than thirty (30) days at 10fps, 640x480 resolution, using MPEG-4 encoding before being recorded over. All recording devices shall be digital video recorders (DVRs) able to send data over the security network. The DVRs and other network-attached equipment must be STIG compliant IAW section 01 35 53.

Video servers and multiplexers shall be physically located in the datacenter with other facility security server hardware. The rack for the security system shall be locked at all times. Access to the security system shall be primarily conducted through dedicated client terminals on the private IP security network, located in the security office (and other locations determined by the site security management team).

Where DVRs do not have redundant power supplies, ATS equipment shall be built into the security system rack to provide redundant power to the equipment.

The sizing and number of DVRs shall be consistent with the number of cameras at the facility. DVR systems shall be fully scalable through the addition of modules in the event of additional camera recording requirements.

28 23 23 Video Surveillance Systems Infrastructure Future CCTV systems will operate over the dedicated IP security network described in section 28 13 19.

The majority of legacy CCTV equipment is operated over coax cable with servers, multiplexers, VCRs, and DVRs physically located in a central security office. This infrastructure is significantly less efficient, redundant, and secure than the future system model required by these standards.

Future infrastructure shall be run from a central server location in the datacenter with thin or thick client terminals providing access to the security system components, with data and power transmitted over the same CAT6 copper between remote devices and servers, and over fiber between terminals and servers.

28 23 26 Video Surveillance Remote Positioning Equipment Joystick-style remote control devices shall be installed at all client terminals as well as at the video server for control over PTZ cameras at the facility. Keyboard interfaces for this equipment are not acceptable.

28 23 29 Video Surveillance Remote Devices and Sensors Both fixed and point-tilt-zoom (PTZ) camera systems shall be used. Definition of which systems to use in which locations is the responsibility of the site security management team. Existing equipment is intended to be used until failure using the current communications technologies in place (generally coaxial). All new CCTV camera systems will be network systems communicating on CAT6 copper and powered by PoE (Power Over Ethernet) (see section 28 01 30).

All cameras shall be color, and must be infrared (IR)/low-light compatible. All external cameras shall have sealed, environmental enclosures with automatic heaters and sun shrouds. Internal cameras shall be installed in sealed dome enclosures to resist tampering.

Motion- or alarm-based recording, conducted frequently in the past because of analog manual tape recording operations, is not authorized for these systems. All cameras shall record continuously as discussed in section 28 23 19 above.

IDS installations and remote monitoring stations shall be fully compliant with UL2050. An updated UL2050 certificate shall be provided for each individual IDS system and for the remote monitoring station annually.

Analog layout plans of the facilities indicating the layout of existing security equipment are available solely to bidding vendors through the contracting office. These informational layout diagrams are restricted for security reasons and will not be disseminated through other channels. Digital (Computer Aided Design (CAD)) layout plans of the facilities, generally without existing security equipment and communications layout information, will be provided at time of award to the successful bidder.

Associated equipment and hardware such as electronic door strikes, magnetic locks, panic/crash bars, door hardware (including hinges, handle sets, lock sets, power openers, & latch guard plates), X-09 (and similar) high-security locksets, strobe lights and switches, legacy emergency backup batteries, controller units and enclosures, and control and power wiring for the system is included in the scope of this agreement. The Contractor will be responsible for maintenance and repair of these additional components.

The Contractor is responsible for surveying the existing building and security systems to confirm the number, location, and type of installed equipment and the support requirements for each. All new conductors (power and data) are required to be installed into conduit (not free-run). Where existing (legacy) equipment is used, retrofit of existing conductors into conduit is not required until that legacy equipment is replaced. Proposals and designs shall explicitly indicate where legacy free-run conductors (power and data) are located. Where legacy equipment is replaced, conductors shall be replaced and installed into conduit (not free-run). The conduit containing these security system conductors must be clearly labeled to indicate what it contains every 5-7 feet.

6. Performance Requirements.

6.1 Security System Equipment Upgrade/Replacement

The Contractor shall plan, design, procure, and install a comprehensive upgrade to the current security system that will result in an integrated security system, and remove older (unnecessary) security system components when the new system is operational. The Contractor shall provide a security system cutover schedule and allow a minimum of 14 calendar days of notice prior to any outages in the security system. The maximum downtime for any portion of the security system during this installation shall be four (4) hours.

Design of the upgraded/replacement security systems, to include all necessary revisions and acceptance by the Government, shall be completed within four (4) months of contract award. Completion of system upgrade/replacement for all tasks, to include commissioning and final acceptance by the Government, shall be completed within ten (10) months of contract award.

“Integration” of a security system means that, at a minimum, the security system is natively and seamlessly able to:

· Provide automated “push” provision of ACS and CCTV records of recent events when an IDS event is triggered, allowing system operators instant access to relevant situational awareness and the ability to respond to situations rapidly

· Track and report individuals’ progress through the facility with both ACS records and CCTV footage, without having to manually access separate systems

· Provide a “contingency report” hot-key to determine where all assigned and visitor personnel are in the facility at any time

· Automatic “intelligent” arming and disarming of IDS zones based on ACS system inputs

· Order automatic alarm recording when ACS and/or IDS alarm ‘events’ defined by the operator occur

· Change operation modes of individual cameras (day/night or visible/infrared modes, as well as frame rate or fixed/automatic pan) on schedule or alarm conditions

· View recorded video at workstations programmed or authorized to allow such while other workstations and monitors continue to display real-time views

· Integrate with analytic alarm modes (more complex sequences than a simple IDS alarm) as programmed to meet future threats

· Allow use of additional advanced electromagnetic detection sensors (laser, radar, thermal) to meet future threats

· Provide automatic playback of recorded video during investigation of all time- or alarm-based events (alarm database is connected to DVR database and pulls video without user intervention)

None of these sample requirements are anticipated to be achievable with a stand-alone, non-integrated solution that does not leverage an integrated system’s full ACS, IDS, and CCTV management capabilities. All of these tasks shall be automated and confirmed by commissioning integrated systems testing to the satisfaction of the Government representatives.

Existing components shall be reused where possible and when they meet or exceed the requirements of the new system as described herein.

Specific bullets in tasks and subtasks below call out equipment that is anticipated to be required to meet the technical and design requirements of this upgrade/replacement. This is not a complete listing of the equipment, systems, or connectivity that will be necessary to successfully upgrade/replace the security system. Cooperative (Government and Contractor) determinations of how the system shall be designed and stood up to meet all of the operating requirements shall not be interpreted in any manner as changing the scope of the project.

DISA has 24x7x365 security system monitoring and armed response requirements that are met by having specified IDS alarms reported directly to a remote vendor monitoring station, with alarms being responded to by Lackland AFB security police and/or City of San Antonio police. Unlike at other DISA DECC facilities, DECC San Antonio is not located on an installation and is not tied directly to a host installation security police monitoring system. In the existing configuration, these alarms are not monitored locally, which inhibits DISA security team’s situational awareness of ongoing events; this will be remedied during this upgrade. Specific additional alarm points reported may be developed by the Government and the Contractor during future modification requirements.

6.1.1 Legacy Security System Overview

· System Legacy 1 (L1): A primary, facility-wide access control system (ACS) controls physical access to all electronically secured doors in the building (except “secure rooms”). This system is run on a single desktop PC and is administered by the site Security Manager.

· The L1 ACS controls access to all electronically-secured external doors, perimeter gates, hallway doors, and doors to all controlled areas (except “secure rooms”).

· System Legacy 2 (L2): A primary, facility-wide intrusion detection system (IDS) monitors alarms at the site perimeter and for selected doors and areas in the building (except “secure rooms”). This system roughly parallels system L1, but is monitored on individual IDS arm/disarm panels, and a master IDS arm/disarm panel that receives alarms from facility IDS zones (except “secure rooms”). L2 does not have remote monitoring.

· System Legacy 3 (L3): A secondary ACS controls access to a “secure room complex” (rooms S-3, D-10, and E-3). Controls for this nested system are located interior to the “secure room complex.”

· L3 has a multiply-zoned IDS with motion sensors, door contact switches, and an arm/disarm pad internal to each IDS zone within the “secure room complex.” This IDS is remotely monitored (for armed response) via a UDP panel that receives encrypted data from the installed arm/disarm panels in each room of the complex.

· A secondary CCTV system monitors (does not record) the entrances to the DISA “secure room complex.” This nested system is located interior to the “secure room complex.” The approximate views captured on these cameras are duplicated in the separate, primary system via dual physical cameras at each location.

· System Legacy 4 (L4): A secondary ACS controls access to a “secure room complex” (rooms D-40, D-40 extension, PGS-1, and PGS-2). Controls for this nested system are located interior to the “secure room complex.”

· L3 has a multiply-zoned IDS with motion sensors, door contact switches, and an arm/disarm pad internal to each IDS zone within the “secure room complex.” This IDS is remotely monitored (for armed response) via a UDP panel that receives encrypted data from the installed arm/disarm panels in each room of the complex.

· A secondary CCTV system monitors (does not record) the entrances to the DISA “secure room complex.” This nested system is located interior to the “secure room complex.” The approximate views captured on these cameras are duplicated in the separate, primary system via dual physical cameras at the main D-40 entry.

· System Legacy 5 (L5): The entire facility has a single, single-zone public address (PA) system. The PA system does not extend inside the perimeter of any of the secure room areas.

6.1.2 Task 1: Upgraded Primary Integrated Security System

Task 1: Upgrade Legacy Systems L1/L2. The Contractor shall install a new, fully redundant head-end system (minimum of two physical servers to keep the security systems operational in case of hardware failure) to monitor and control access control system (ACS), intrusion detection system (IDS), and closed circuit television (CCTV) security system components for the main facility and secured perimeter. These systems shall be located in a DISA-determined location in the main computer room for security and climate control-related issues. This system will be referred to as “primary” throughout this document for clarity. This upgraded system shall be referred to as System F1.

All conductors, and conduit from systems that are being removed or replaced shall be completely abated from the facility by the vendor, and all penetrations sealed appropriately. Abatement requires restoration of the facility and all objects, equipment, and surfaces affected to match existing surrounding objects, equipment, and surfaces. Re-use of conduit and conductors, where they meet current standards or will be modified to meet such, is acceptable.

All newly-installed equipment shall be installed properly, in compliance with the National Electric Code and penetrations sealed appropriately. Installations shall be aesthetic and designed for sustainability of the system, in order to support future maintenance and system modifications.

A graphical representation of the intended resulting integrated security system F1 from Task 1 is shown below. This representation does not show all devices or connections necessary. Note that the “Nested Mirror Systems” in the secure complexes are shown in this graphic but are not part of Task 1.

The new primary integrated security system F1 shall operate on a new private data (IP) network that will connect new, Contractor-provided workstations to the head-end system(s) for partial or full access to ACS, IDS, and CCTV system components (depending on the specific workstation location/function). The primary system will have the capability to connect not less than six (6) additional (future) terminals or monitoring stations to the private network with read-only live monitoring, no controls access to CCTV monitoring access only.

6.1.2.1 Head-end System & Workstations

All IT equipment associated with the new integrated security system F1 (including PoE switches, NVRs (Network Video Recorders), and main head-end servers) shall be located at a DISA-determined location in the main computer room, where it can be secured in a security-dedicated, power- and environmentally-controlled IT equipment rack. Remote workstations for the integrated security system will be located at four (4) locations in the facility.

6.1.2.1.1 Head-End System Hardware Requirement: Install IT Equipment Rack

The Contractor shall provide and install one or more (as necessary) IT equipment racks meeting the specifications of Appendix B, Facility Standards, section 27 10 01, IT & Network Equipment Racks (Raised Floor Equipment), to house the head-end integrated security system F1 equipment to include but not limited to servers, NVRs, PoE switches, other network switches, multiplexers, transceivers, etc). The rack(s) installed shall be filled no more than 75%, shall not exceed the power/heat density limitations in the rack specifications, and shall be organized to support logical scalability of systems (particularly PoE switches and DVR/NVRs). Rack installation location shall be coordinated with the site Facility Manager. Power to the rack location shall follow guidance in section 6.1.6.1.

Main Computer Room (Specific rack location TBD):

· One (1) (or more as necessary) IT equipment rack(s) to house head-end system.

· Equipment racks must be physically lockable with non-standard keying, all accesses keyed alike on all racks; provide six (6) copies of the key.

· Depending on the Contractor’s solution for the new integrated security system, this may involve copper and/or fiber communications cabling, protected in conduit or raceway, between the rack locations and to system components and interfaces (controller board locations, user workstations, CCTV monitors, and similar). Additional electronic equipment (including but not necessarily limited to transceivers, splice boxes, patch panels, GBICs, et cetera) may also be necessary to complete the network connections, and shall be included in the design.

The specific rack location on the main computer room (CR1) floor is to be determined (TBD). For planning purposes, assume that it will be in the NW corner of CR1, and within fifty (50) feet of the designated location of the dedicated power distribution system for the security system.

6.1.2.1.2 Head-End System Hardware Requirement: Provide Redundant Head-End System Provide and install a security server system:

· New, server-class redundant head-end security system servers (minimum of 2) sized to fit into standard 19” EIA/TIA IT equipment racks

· Servers shall be mirrored so that a loss of either device immediately fails over to the other device, identically configured and maintained.

· Local KVM equipment to operate servers from installed location in main computer room; this KVM equipment shall have full systems access equivalent to that in the DISA security offices, and requires both physical and logical access control

· The head-end rack location is a primary control location for the security system. With appropriate physical and logical access, the entire system shall be able to be accessed from this location.

· Non-redundant CCTV system NVRs

· All security system networking devices (PoE switches, other network switches, multiplexers, transceivers, et cetera)

Head-end servers shall be server-class and designed for installation in a standard 19” rack. Because of the dedicated redundant power system for the security system, IT equipment supporting the system may be configured with single (non-redundant) power supplies. No systems or manufacturers are specified.

6.1.2.1.3 Head-End System Hardware Requirement: Add Workstations & Peripherals The Contractor shall provide, install, and configure new workstations with specified peripheral equipment to replace existing Government-owned equipment. The future configuration of each security network location should functionally resemble the following:

Visitor Control Center (VCC):

· One (1) stand-alone security workstation (PC or similar) to interface with integrated security system head-end

· This workstation shall be securable (physical and logical) due to its location in a public space. Provide proposed method(s) of securing this workstation and access to it in the system proposal.

· System access shall be user-configurable by the site Security Manager. Default access shall be:

· Access to live & recorded video on all primary system cameras

· Access to all primary and “secure complex” system alarm (IDS) information, except duress alarms

· Access to all integrated alarm information from the ACS or CCTV, such as ‘forced door’ or ‘door left open’ alarms

· No access to access control or personnel databases at this workstation

· No access to add, modify, delete, or otherwise access records of doors, alarms, or personnel on the security database

· Four (4) flat screen monitors for IDS & CCTV operation and monitoring, physically located on the user desk in a quad monitor stand (see graphic concept above).

· One (1) new PTZ controller

Security Manager’s Office:

· One (1) stand-alone security workstation (PC or similar) to interface with integrated security system head-end

· Full systems access from this workstation

· Adobe Photoshop Elements (current version) for photo editing

· Proximity card printer/encoder

· Proximity card reader (contact/keypad) (for badge testing)

· Signature capture pad

· Biometrics capture pad (to match biometrics devices to be used in the facility)

· Digital camera, tripod, screen, & light (flash or continuous) with softbox/umbrella reflector (as appropriate)

· Full-color, two-sided badge printer/encoder

· One (1) color network laser printer, networked through head-end

· One (1) flat screen monitor for ACS & IDS operation and alarm monitoring

· Two (2) flat screen monitors for CCTV monitoring

· Physically mounted on the wall visible from the user’s desk/workstation

· Physical size of screens should be at least 36” each

· One (1) new PTZ controller

Alternate Security Manager’s Office:

· One (1) stand-alone security workstation (PC or similar) to interface with integrated security system head-end

· Full systems access from this workstation

· One (1) flat screen monitor for ACS & IDS operation and alarm monitoring

· Two (2) flat screen monitors for CCTV monitoring

· Physically mounted on the wall visible from the user’s desk/workstation

· Physical size of screens should be at least 36” each

· One (1) new PTZ controller

Facility Manager Office:

· One (1) flat screen monitor for CCTV monitoring

· Physically mounted on the wall visible from the user’s desk/workstation

· Physical size of screen should be at least 42”

· Set number of live access video feeds in physical plant areas

Facilities TIM Office:

· One (1) flat screen monitor for CCTV monitoring

· Physically mounted on the wall visible from the user’s desk/workstation

· Physical size of screen should be at least 42”

· Set number of live access video feeds in physical plant areas

Facilities TIM Workshop:

· One (1) flat screen monitor for CCTV monitoring

· Physically mounted on the wall

· Physical size of screen should be at least 42”

· Set number of live access video feeds in physical plant areas

Access to recorded video at workstations in common areas (Facility Manager office, TIM office, TIM workshop, and VCC), where enabled, shall be limited…