HCBOC Modernized Video Surveillance System (VSS) Upgrade

VA-26-00078767

DRAFT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Hickory Community Based Outpatient Clinic (HCBOC)

HCBOC Modernized Video Surveillance System (VSS) Upgrade

Date: 8/18/2026

VA-26-00078767

PWS Version Number: 2.0

Contents

BACKGROUND

The Department of Veterans Affairs Office of the Senior Security Office/Physical Security and Infrastructure Office, along with the Western North Carolina VA Health Care System (WNCVAHCS) Executive Directors Office and VA Police Service requires a modernized security camera system with analytics in order to comply with the Presidential Mandates below, VA 0730 Handbook, Security and Law Enforcement, and the OIT VA Directive 6517, 6518, 6500 (6500.6 and 6500.11), 6008 along with the OIT Strategic Plan and VA EA Principles. Additionally, the VA has been charged by the U.S. Office of Management and Budget and the White House with the following:

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

83. VA 0730 Handbook, Security and Law Enforcement,

84. OIT VA Directives 6517, 6518, 6008

SCOPE OF WORK

The Contractor shall provide all equipment, services, and solutions as a service. This shall include assessing the area to be covered, installation of all equipment, software and hardware configuration of the system, testing of the system, and necessary training. The contractor shall provide, as per the contract, all materials needed to properly install and configure the physical security system, which will be delivered to the addresses specified in the contract, which is the HCBOC. Installation shall be completed by the vendor as per the contract and the contract documents. The contracted company shall have the SaaS solution either FedRAMP Approved or FedRAMP Ready on the FedRAMP Marketplace (FedRAMP Marketplace) and be willing to do the VA OIT’s FedRAMP Validation and ATO process as part of the contract.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award with four (4) 12-month option periods The overall PoP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed in VA facilities located in Hickory, NC, CBOC. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR).

TRAVEL

The Government does not anticipate travel under this effort.

SPECIFIC TASKS AND DELIVERABLES

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with monthly Progress Reports in electronic form in Microsoft Word and Project formats until production begins and then move to weekly Progress Reports. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding

The Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly, then Weekly Progress Report INSTALLATION AND SETUP OF mODERNIZED SECURITY SYSTEM The Installation process shall begin in Parrell while obtaining FedRAMP or VA ATO approval.

The Contractor shall execute the installation and programming of the proposed Modernized Security System at the HCBOC.

The Contractor shall provide a SaaS solution operating in FedRAMP Government Cloud (AWS GovCloud, Microsoft Azure, or equivalent) SaaS browser-based solution with Single Sign On with PIV/CAC Multifactor Authentication that includes:

· FedRAMP Control process approved

· Role-based access control natively in the SaaS

· Have unlimited archive clip storage capabilities in the SaaS solution

Required HCBOC staff and Veterans Affairs (VA) Police shall have access to the Cameras and the SaaS products for proper CCTV Physical Security surveillance practices and FedRAMP ATO process, SOP, and controls.

Each camera shall come with access to the SaaS back-end product for the VA Police and VA Staff to view said Physical Security surveillance needs and proper 5-year Camera Licenses for Government use.

The VA will provide all the approvals and network security to allow the CCTV Physical Security Surveillance System to communicate with the SaaS solution.

The solution shall have the ability to enhance security and have motion intrusion and alerting capabilities on a server. In addition, it must provide an easy-to-use system, minimize on-premises infrastructure, while meeting the National Defense Authorization and TAA manufacturing rules according to the 2023 FAR clauses while complying with the Federal Information Security Management Act (FISMA).

The Contractor shall provide a solution that is a fully integrated architecture of easy-to-scale hardware and an easy-to-use video management SaaS solution, weapons detection and systems and communications platforms employed by VA Police while managing bandwidth efficiently at scale. The solution shall utilize a SaaS solution that allows for advanced analytics, including the ability to quickly locate people or vehicles of interest across a site, thus quickly reducing incident response time and minimizing the time security personnel devote to the technological side of investigations.

The Contractor shall provide the following capabilities and features in a Hybrid-cloud security platform with all products managed through a single pane of glass and:

The Contractor must provide a solution that is either FedRAMP Authorized or FedRAMP Ready and shall go through the VA's validation process to receive a VA ATO.

The contractor shall design, develop, and implement artificial intelligence (AI) solutions that enhance the efficiency, accuracy, and timeliness of government operations, in alignment with applicable laws, regulations, and ethical guidelines. The AI systems must be transparent, explainable, and auditable, ensuring that decision-making processes can be reviewed and validated. Solutions shall incorporate robust data governance, privacy protections, and bias mitigation strategies, while delivering measurable performance improvements against defined operational metrics. The contractor will provide ongoing monitoring, maintenance, and training to ensure sustained system performance, adaptability to evolving mission needs, and compliance with federal AI standards.

In accordance with the Physical Security Design and Resiliency Manual dated October 1, 2020, and Revised June 1, 2023, the Contractor shall provide in the Video Security System capabilities:

All cameras must meet the following requirements. Cameras must conform to National Television System Committee (NTSC) formatting criteria.

• Cameras must be color and auto-day/night feature to digitally switch from color to black and white at dusk and vice versa at dawn.

• Cameras must be rated for continuous operation.

• Each camera function and activity must be addressed within the system by a unique twenty-character user defined name; the use of codes or mnemonics identifying the SSTV action will not be accepted.

• Cameras must have built-in video motion detection that automatically monitors and processes activity information from each camera, based upon how the surveillance field-of-view is programmed.

• When the camera is used as part of a SSTV computer network, a video encoder must be used to convert the signal from the NTSC criteria to Moving Picture Experts Group (MPEG) format.

• All cameras must be home run to a monitoring and recording device via controlling video equipment such as a matrix switcher or network server that is monitored from a designated SCC location. The use of wireless cameras is discouraged for any long-term application (more than one (1) year period of use) and must not be used for Critical assets.

• SSTV cameras must be fixed mounted.

• Fixed cameras must be the primary means of surveillance to monitor designated access control and monitoring points.

• Fixed cameras must be used to monitor interior building areas; P/T/Z cameras may be used to provide supplemental surveillance coverage of building interiors where necessary.

• SSTV cameras must be hardwired directly connected to a monitoring device using video signal imaging cable. Hardwired or Internet protocol (IP) cameras must be the method of installation. Hardwired cameras must be connected to the monitoring equipment with continuous wiring used as the media transmission system.

• Camera Lenses must be used in a manner that provides maximum coverage of the area being monitored and meets the following requirements. Two types of lenses must be used for both interior and exterior fixed cameras.

• Manual variable focus lenses must be used in large areas monitored by the camera and allow for settings at any angle of field to maximize surveillance coverage.

• Auto iris fixed lenses must be used in areas where a small specific point of reference is monitored.

• Specific lens size must be determined using a field-of-view calculation provided by the manufacture.

Camera Enclosures: All cameras and lenses must be enclosed in tamper-resistant housings.

• Both interior and exterior cameras must be housed within a tamper-proof camera enclosure.

• Exterior camera enclosures must be rated to protect against unique weather elements associated with the specific facility conditions and geographical area.

Camera Installation, Mounts, Poles, and Bases: All camera equipment must be installed to ensure all components are fully compatible as a system. Adhere to the National Electrical Contractors Association Standard, NECA 303-2005, Installing Closed-Circuit Television (CCTV) Systems.

• Camera mounts must be installed on approved mounting surfaces structured for weight, wind load, and extreme weather conditions.

• Camera mounts must be installed in a manner that will not inhibit camera operation or field-of-view.

• Where a camera is mounted to a rooftop or within a parapet, ensure that the mount is designed and installed in a manner that the equipment can be swiveled inward for maintenance and upkeep purposes.

• All camera poles must be constructed of metal with a concrete base and must be installed and grounded in accordance with the NEC.

• Camera poles must be weather resistant.

• Cameras and their mounts may share the same pole with lighting when the following conditions are met:

• A hardened wire carrier system is installed inside the pole to separate the high voltage power cables for the lighting from the power and signal cables for the camera and mount.

•The camera and mount are installed and positioned in a manner that the lighting will not deter from, cause blind spots or shadows, or interfere with the video picture and signal.

• All camera poles and mounts must be installed in locations that will allow for optimum view of the area of coverage.

Power Source: All SSTV cameras and mounts must be powered remotely by a UL listed power supply unit (PSU) as follows:

• The PSU must have the ability to power at least four exterior cameras or eight interior cameras.

• A back-up with dedicated power feed from a security system power panel must be provided to the camera and mount; a step-down transformer must also be installed at the camera location to ensure a proper operating voltage is provided to the camera and mount.

• The SSTV must be supported by UPS equipment and standby electrical system (see Chapter 9 Building Systems).

Lightning and Surge Protection: With the exception of fiber optic cables, all cables and conductors that act as control, communication, or signal lines must include surge protection when extending beyond the building envelope.

Site Coordination: Site and building exterior lighting must be coordinated and installed in a manner that allows the SSTV system to provide positive identification of a person, vehicle, incident, and location.

• Lighting must not provide bright illumination behind the main field of camera view.

• Cameras must be installed in a manner that no lighting will point directly at the camera lens causing blind spots and blackouts.

• Provide routine maintenance of lighting systems and replacement of lighting fixtures that are necessary for operational integrity of the SSTV system.

• SSTV cameras must be installed so that landscaping will not deter from the intended field of view.

• Cameras must not be mounted in trees, bushes, or any other natural landscape that will in the long term degrade the view or operation of the SSTV system.

• Cameras must not be installed behind, next to, or on any natural or manmade object that will restrict the field of view, cause signal loss, or prevent the camera from being fully operational.

• Perform routine landscape maintenance that is necessary for operational integrity of the SSTV system.

Additional Components:

• Monitors must be color and able to display analog, digital, and other images in either NTSC or MPEG format associated with the operation of the security management system (SMS).

• Matrix Switcher/Network Server (controlling equipment) must be used to call up, operate, and program all cameras associated SSTV components. Controlling equipment must have the ability to operate the cameras locally and remotely. A matrix switcher or a network server must be used as the SSTV controller. The controlling equipment must allow the transmission of live video, data, and audio over an existing Ethernet network or a dedicated security system network, requiring an IP address, or Internet Explorer. The controlling equipment must be able to perform as an analog-to-Ethernet “bridge,” allowing for the control of matrices, multiplexers, and P/T/Z cameras.

• Keyboards and Joysticks must provide direct operator interface with the controlling equipment to allow for call-up, operation of cameras and mounts, and programming of controlling equipment as well as cameras and monitors. Where a matrix switcher is used, ensure the keyboard is outfitted with a joystick to provide direct interface with SSTV camera controls.

Controlling and Recording Equipment:

• All cameras on the SSTV must be recorded in real time using a digital video recorder (DVR), network video recorder (NVR), or a time lapse video recorder (VCR). The type of recording device must be determined by the size and type of SSTV designed and installed, as well as the extent to which the system is to be used. The following criteria must be followed when choosing a SSTV camera recording device.

•DVR must be used within the SSTV for large or small SSTV system set-ups. The DVR may be used in place of a time lapse VCR regardless of how the SSTV is designed and installed. The DVR may be installed with the SMS or as part of a SSTV network. The

•DVR must be IP addressable. Programming, troubleshooting, and all general maintenance and upgrades to the DVR must be done locally at the recording unit.

• The DVR must have a built-in compact disc-recordable (CD-R) or Digital Versatile Disc Recordable (DVD-R) for downloading of the buffer to compact disc (CD) or Digital Versatile Disc (DVD) for back-up.

• The DVR buffer must be cleared, and all information transferred to CD when the buffer is at no greater than 60 percent of capacity.

• CDs and DVDs must be stored in a dry, cool, central location that is secure; recordings must be stored in accordance with VA Police directives.

NVR must be used within the SSTV for large or small SSTV system set-ups. The NVR must be used when the SSTV is configured as part of the SMS only. Input to the NVR must be considered when designing and installing all cameras that will be connected to the NVR.

• Ensure the proper signal converter is used to interface non-IP cameras over to an ethernet cable.

• The NVR must provide for either direct download of data to a computer storage device or CD/DVD; all storage media must be stored in a dry, cool, central location that is secure, and storage media must be held as directed by the VA Police.

Video Motion Detection:

SSTV cameras must have built-in video motion detection capability that automatically monitors and processes information from each SSTV camera. Cameras must be programmed to automatically change viewing of an area of interest without human intervention and must automatically record the activity until reset by the SSTV operator.

•Timing: This feature must detect motion within the camera’s field of view and provide the SCC monitors immediate automatic visual, remote alarms, and motion-artifacts as a result of detected motion.

•Interface with IDS: The video motion detection must be interfaced with the IDS to provide redundancy in the security alarm reporting system.

•Other System Interface: Cameras must be designed to interface and respond to exterior and interior alarms, security phones/call-boxes, duress alarms, and intercoms upon activation.

The solution must have the ability to enhance security and have motion intrusion and alerting capabilities in a cloud-managed platform. In addition, it must provide an easy-to-use system, minimize on-premises infrastructure, and increase the VA’s cybersecurity posture while meeting the National Defense Authorization and TAA manufacturing rules according to the 2023 FAR clauses while complying with the Federal Information Security Management Act (FISMA).

· SaaS compliance with:

· FISMA Law FedRAMP Ready or Approved

· NDAA and TAA

· SOC 2 Type II

· UL / CUL 62368-1 certification for video, information, and communication technology equipment

The solution must provide a fully integrated architecture of easy-to-scale hardware and an easy-to-use video management SaaS solution provided by the same manufacturer viable on many devices while managing bandwidth efficiently at scale. The solution must utilize a SaaS solution that allows for advanced analytics, including the ability to quickly locate people or vehicles of interest across a site, thus quickly reducing incident response time and minimizing the time security personnel devote to the technological side of investigations.

All data must be encrypted and able to be stored locally on each physical camera device on a solid-state drive to prevent any data breach, along with the ability to stream and archive data continuously and indefinitely to the cloud to prevent any loss of data. This solution must have the hardware and software offered as a single solution. A graphical interface must be provided by the same manufacturer and have role-based access control (RBAC) that is configurable by government personnel. Audit trails must be built into the software solution and provided natively, as well as notifications, alerts, and the ability to operate the products without adding or needing any servers.

The Contractor must provide the following capabilities and features in a Hybrid-cloud security platform with all products managed through a single pane of glass and:

1. The Contractor must provide a solution that is either FedRAMP Authorized or FedRAMP Ready and must go through the VA's validation process to receive a VA ATO.

2. The contractor must provide a SaaS solution operating in FedRAMP Government Cloud (AWS GovCloud, Microsoft Azure, or equivalent)

3. Provides 24/7 US-Based 1-800 technical support team that can be reached by phone, email, or in-platform chat included at no additional cost

4. SaaS browser-based solution with Single Sign On with PIV/CAC Multifactor Authentication that includes

a. FedRAMP Control process approved

b. Identity Provider Integrations via SAML & SCIM (ADFS, Azure AD, Okta)

c. Capability for a browser-based client that can be accessed across multiple platforms (to include Windows, Chrome OS, MacOS, iOS, and Android) without using proprietary plugins like Java, Silverlight, or Flash

d. Audit logs

e. Role-based access control natively in the SaaS

f. Auto software updates, updates, and continuous penetration testing at no cost

g. System to have mobile client or mobile device accessibility to securely access and view footage both on and off site at any time and to conduct person/vehicle analytics via the mobile device as well.

h. Emergency Access, audited for usage, sharable content to authorized law enforcement that can view selected cameras

i. Ability to remotely manage users and cameras across multiple sites

j. Certain custodians may view cameras at multiple locations

5. Data encryption in transit and at rest- FIPS 140-2 encryption standard

a. In Transit AES-128

b. At Rest AES-256

6. Archive video footage with unlimited cloud storage stored indefinitely

7. Software licensing for 5-year option

8. Does not require an NVR or DVR

9. The solution should be modular to allow additional devices at any time

10. The solution should have the ability to add cameras from multiple manufacturers if required.

Camera Specifications

· Have built in solid-state hard drive capable of recording for immediate use of 30 days of continuous recording

· Has the ability for future use of up to 365 days of continuous video

· Are FIPS 140-2 validated, TAA and FY 2019 NDAA compliant

· Are plug-and-play IP, PoE-based cameras

· Receive firmware and software updates pushed automatically via the cloud at no additional cost as part of the camera or product licenses

· Have a minimum of resting bandwidths 20-50kbs and low bandwidth mode options

· Bandwidth Management Tuning Capabilities

· Must have a 10-year warranty on all fixed camera hardware

· Include all of the following Artificial Intelligence (AI) and analytics capabilities at no additional cost:

· People/vehicle analytics

· Occupancy Trends

· Trajectory Tracking

· Line Crossing

· AI Search

· Loitering

· Live & Historical Face Blur

· License Plate Recognition (Bullet cameras only)

· Privacy Zones

· Tamper Alerts

· People, Vehicle, Motion, Loitering, Crowd Alerts

· Status (Online/Offline) & Tamper Alerts

· Vehicle Query by Color, Type, Make, Model, Identifiers

· Included 30-day Cloud Backup, with additional retention able to be purchased

· Must provide RTSP capabilities for up to 2 streams

· Operate in Temperature ranges of: -40°F to 122°F

· Have unlimited archive clip storage capabilities in the SaaS solution

· Ability to provide 5MP to 4k (8MP) image resolution (3840 x 2160)

· IP67 rating to protect against dust and environmental elements for outdoor cameras

· Accelerometers for tamper-proof capability

· IK8 vandal resistant rating or above

· Built-in Infrared illumination

· Capability to produce video at a minimum 24 FPS or more

· Image stabilizing to reduce blurring

· Day and Night viewing and recording capability

· Standard ethernet connectivity, including Power Over Ethernet (PoE)

· Motion detection

· Capability to perform computer vision analytics at the edge (on device)

· Ability to see remote locations and run analytics with offsite viewing

· Provide all the proper device mounting kits and proper installation

· Ability to share live links with authorities

· Granular permissions with Role Based Access Control (RBAC)

· Remote deployment capabilities via cellular gateway as required

The Contractor shall provide on-site training for both VA Police Services and OI&T for new system requirements as well as continued training during additional product enhancements, which happen semi-annually

SaaS FEDRAMP ASSESSMENT AND AUTHORIZATION AND CONTINUOUS MONITORING REQUIREMENTS

IF THE SOLUTION IS NOT FedRAMP AUTHORIZED:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements at the <<Insert Impact Level from the Data Security Categorization. This should be done by DTC>> Impact Level, as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance. In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

4. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is: <<Insert Impact Level from the Data Security Categorization. This should be done by DTC>>.

6. The Contractor shall comply with FedRAMP requirements surrounding data location within the Continental United States. FedRAMP specifies data location requirements in the High Baseline as part of control SA-9 (5); however, FedRAMP does not provide or specify data location requirements for other baselines.

7. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments.

8. The Contractor shall work with a VA DTC Subject Matter Expert to develop and provide a VA system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA.

9. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP).

10. The Contractor shall complete a 3PAO Security Assessment Report (SAR).

11. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall bring the situation to the attention of the other party within one hour in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

12. The Contractor shall comply with FedRAMP data management requirements.

13. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

14. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP website.

15. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

16. The Contractor shall provide continuous monitoring activities including, but not limited to, scans, security artifacts, and provide Continuous Monitoring Monthly Scans and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

17. The Contractor shall provide a Monthly VA License Report of VA sites currently utilizing the cloud product post ATO award. The license report shall include the number of subscription licenses being utilized and the specific VA site where they’re in use.

Deliverables:

A. FedRAMP System Security Plan (SSP) and required Attachments B. VA Implementation Diagram C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. Plan of Action and Milestones Reports.

F. Monthly VA License Report

IF THE SOLUTION IS FedRAMP AUTHORIZED BUT NOT VA AUTHORIZED:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The system must be FedRAMP Authorized at no less than the <<Insert Impact Level from the Data Security Categorization. This should be done by DTC>>

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall provide confirmation of the completion of its FedRAMP System Security Plan (SSP) and supporting documentation by providing, to the VA PM, COR, and DTC, its repository ID number and associated link for VA to download the SSP and all required artifacts within five calendar days of contract award.

6. The Contractor shall work with a VA DTC Subject Matter Expert to develop and provide a VA specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP).

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR).

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall bring the situation to the attention of the other party within one hour in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

12. The Contractor shall comply with FedRAMP data management requirements.

13. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

14. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy.

15. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

16. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and provide Continuous Monitoring Monthly Scans and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

17. The Contractor shall provide a Monthly VA License Report of VA sites currently utilizing the cloud product post ATO award. The license report shall include the number of subscription licenses being utilized and the specific VA site where they’re in use.

Deliverables:

A. VA Implementation Diagram B. 3PAO Security Assessment Plan (SAP) C. 3PAO Security Assessment Report (SAR) D. Plan of Action and Milestones Reports E. Monthly VA License Report

IF THE SOLUTION IS FedRAMP AUTHORIZED AND VA AUTHORIZED:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as <<Insert Impact Level from the Data Security Categorization. This should be done by DTC>>.

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide subscription licenses…