1. PERFORMANCE WORK STATEMENT_REVISED 09062023.pdf

DHA PWS Template V13 November 16, 2021

Department of Defense Defense Health Agency

Performance Work Statement

Repair and Maintenance for Security, Intercom, Video system

NAVAL Hospital Camp Pendleton

Solicitation Number:

Version:

Date: August 18, 2023

November 16, 2021

PART 1

1.0 GENERAL INFORMATION

SCOPE OF WORK:

The effort required hereunder will be performed in accordance with this Performance Work Statement (PWS) and in accordance with all other terms and conditions set forth herein.

The contractor shall provide all services, materials, and equipment necessary for installation and services/maintenance of the NHCP Security Surveillance Cameras System and access control, located in and around Building H-95, H-135, H-136, and H-200 at Naval Hospital, Camp Pendleton (NHCP) to ensure dependable and reliable equipment operation. The scope of work performed under these specifications includes the furnishing of all labor and parts to perform all installation and repairs on equipment listed, to assure continue operation at their designed efficiency and capacity.

The requirements and tasks include quarterly inspections of all equipment, which involve cleaning, focal adjustments, and necessary adjustments. The contractor is responsible for all parts and labor for the Stentafone and network switch for PACS & CCTV systems.

1.1 This is a non-personal services contract to provide Repair and Maintenance for Security, Intercom, Video system

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Repair and Maintenance for Security, Intercom, Video system as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3 Background:

The requirements and tasks include quarterly inspections of all equipment, which involve cleaning, focal adjustments, and necessary adjustments. The contractor is responsible for all parts and labor for the Stentafone and network switch for PACS & CCTV systems.

For the Bachelor Enlisted Quarters (BEQ)/Building H-95, an IP-based NVR solution will be implemented, and all viewing software on the quoted laptop will be serviced. Additionally, 2 HD storage rack mounts will be provided.

In the Pharmacy, there are 32 Axis cameras installed and an Exacqvison NVR (new 2018). The Avigilon system in the Pharmacy needs to be repaired or replaced.

For Building 135-136, a video appliance 8-port 2TB unit with an 8-inch license will be installed.

Enterprise licenses will also be provided. NVR and viewing laptop appliances will be placed in

November 16, 2021 the Materials Management office, along with a rack cabinet, side panels, a black blank panel, a locking plexiglass front door, a locking solid rear door, and a pedestal. Personnel will be set up and trained on the system, and the contractor will supply a man lift for service requirements.

The Building H-200 Surveillance System will use Avigilon or a comparable VMS. All existing servers will be used but are not covered under this service agreement. The system will include all existing 357 cameras. Setup and training for ACC (Access Control) will be performed once the system is operational.

For the Building H-200 Access Control System, an ACM server will be installed. Existing 286 proximity readers, wiring readers, contacts, REX, and locks will be used. Training will be provided on a quarterly basis, up to four (4) times per year in conjunction with the inspection schedule.

The Stentafone System will consist of 29 standalone Stentafone Intercom units connected to the PACS system and integration modules. The network switch and all network wiring from the switch to device locations are covered under this agreement.

1.4 Objectives: To maintain the physical security standard of the Naval Hospital Camp Pendleton, Security Survellance cameras System, and access control.

1.5 Scope:

The general requirements include four (4) Dell R520 Servers at 24 terabytes each, two (2) Avigilon Appliances at 9 terabytes each, and two (2) six-monitor video monitoring stations. One station will be located in the Security Office, and the other will be located on the Quarter Deck.

There will be a total of 322 cameras, 32 PTZ units, 254 HID Multi Class RP40, 254 electrified mortise locks, magnetic door locks on double doors, Von Duprin electrified trim sets, and auto door activations. The site will provide 110vac power.

Quarterly inspections of all equipment includes cleaning, focal adjustments, and adjustments as needed. All part and labor on the below systems. Includes Stentafone and network Switch for PACS & CCTV (new for 2018) Bachelor Enlisted Quarters (BEQ)/Building h-95:

• IP based NVR solution in BEQ.

• Service all viewing software on the quoted laptop.

• 2 HD Storage Rack Mount

Pharmacy:

• 32 Axis cameras as installed and Exacqvison NVR (new 2018)

Building 135-136

• Video Appliance 8-port 2TB unit with 8-inch license

November 16, 2021

• Enterprise licenses

• NVR and viewing Laptop appliances in the Materials Management office. Rack cabinet

• Side Panels (Pair)

• Black Blank Panel

• Locking Plexiglas Front Door

• Locking Solid Rear Door

• Pedestal

• Set up and train personnel on system.

• Contractor will supply a man lift for service requirements.

Other terms and conditions include 24/7 availability of service support from technicians, with all parts and labor included. Preventative maintenance will be conducted semi-annually, in addition to test and inspection services. Training will be provided up to semi-annually, as needed. The response time range is six (6) working hours for remote support and dispatch, with same-day service following receipt of a service call. If a call is received after 3:00 pm local time, onsite support is guaranteed by noon of the following day. The call must be placed by an authorized person.

1.6 Period of Performance (PoP):

September 7, 2023- September 6, 2024

1.7 Administrative specifications

1.7.1 Place of performance: The work to be performed under this contract will be onsite at Naval Hospital Camp Pendleton, California.

1.7.2 Recognized Federal holidays: Contractor is not required to perform services on holidays except in emergency situations.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services:. On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.8 Contractor travel: Not applicable

1.9 Other Direct Costs (ODC): RESERVED

1.10 Quality: RESERVED

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook at Part 7 Section 7.1.4.

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.12 Key personnel (Contractor): Not applicable

https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx

November 16, 2021

1.13 Data rights: RESERVED

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel.

Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care

November 16, 2021

Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM

5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

November 16, 2021

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

AIS Automated Information System APL Approved Products List APL AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme CDI Covered Defense Information CE Computer Environment

November 16, 2021

CDRL Contract Data Requirement List CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CMR Contractor Manpower Reporting CNSSI Committee on National Security Systems Instruction CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CSP Cloud Service Provider CSSP Cyber Security Service Provider CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DD Form 254 Department of Defense Contract Security Requirement List (if applicable) DB Design-Build DBB Design-Bid-Build DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDM Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement eMSM Enhanced Multi-Service Markets EULA End User License Agreement EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FE Facilities Enterprise FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FRCS Facility Related Control Systems FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity HIT Health Information Technology IGCE Independent Government Cost Estimate IA Information Assurance

November 16, 2021

IO Initial Outfitting I/O In/Out Processing Portal IPv Internet Protocol Version IS Information System ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MedCOI Medical Community of Interest MHS Military Health System MIL-STD Military Standard MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PGI Procedures, Guidance and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework

November 16, 2021

SP Special Publication SPRS Supplier Performance Risk System SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides TOS Terms of Service US United States UFC Unified Facilities Criteria VPN Virtual Private Network XML Extensible Markup Language

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.

November 16, 2021

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☒ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below:

3.2 Facilities: The Government:

☒ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Facilities in support of this contract/task orders. The Government provided Facilities are described below

3.3 Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

3.4 Equipment: The Government:

☐ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

The following Government furnished equipment will be available to the contractor.

ITEM ID NOMENCLATURE MANUFACTURE MODEL

7435BM00L0139

LSCAN AND FINGERPRINT

ENROLLEMENT SYSTEM

CROSS MATCH

TECHNOLOGIES INC LSCAN GUARDIAN

7021BM0000006 COMPUTER, PERSONAL, LAPTOP HEWLETT PACKARD FM805UT

6530BM0018567

IDENTIFICATION/TRACKING/SECURITY

SYSTEM, PERSON

ROCKWEST TECHNOLOGY

GROUP, INC. ISG-E300

7035BM00L0050 PRINTER, SECURITY BADGE DATACARD CP80

7025BM0020464 DIGITIZER, VIDEO

PANASINIC CORPORATION

OF NORTH AMERICA MATRIX SWITCHER

7025BM0020464 DIGITIZER, VIDEO PANASONIC MATRIX SWITCHER

5820BM00C0172 CONTROLLER, COMMUNICATION PANASONIC WV-CU650

5820BM00C0172 CONTROLLER, COMMUNICATION PANASONIC WV-CU650

5820BM00C0172 CONTROLLER, COMMUNICATION PANASONIC WV-CU650

7010BM00C0303

DATA STORAGE DEVICE, DIRECT

ATTACHED STORAGE

PANASONIC CORPORATION

OF NORTH AMERICA W J-HD316A/1500

7010BM00C0303

DATA STORAGE DEVICE, DIRECT

ATTACHED STORAGE

PANASONIC CORPORATION

OF NORTH AMERICA W J-HD316A/1500

7010BM00C0303

DATA STORAGE DEVICE, DIRECT

ATTACHED STORAGE

PANASONIC CORPORATION

OF NORTH AMERICA W J-HD316A/1500

7010BM00C0303

DATA STORAGE DEVICE, DIRECT

ATTACHED STORAGE

PANASONIC CORPORATION

OF NORTH AMERICA W J-HD316A/1500

7010BM00C0303

DATA STORAGE DEVICE, DIRECT

ATTACHED STORAGE

PANASONIC CORPORATION

OF NORTH AMERICA W J-HD316A/1500

November 16, 2021

7010BM00C0303

DATA STORAGE DEVICE, DIRECT

ATTACHED STORAGE

PANASONIC CORPORATION

OF NORTH AMERICA W J-HD316A/1500

7010BM00C0303

DATA STORAGE DEVICE, DIRECT

ATTACHED STORAGE

PANASONIC CORPORATION

OF NORTH AMERICA W J-HD316A/1500

7050BM00C125 MONITOR, COMPUTER TOTE VISION LCD-2007HDL

7050BM00C125 MONITOR, COMPUTER TOTE VISION LCD-2007HDL

7050BM00C125 MONITOR, COMPUTER TOTE VISION LCD-2007HDL

7050BM00C125 MONITOR, COMPUTER TOTE VISION LCD-2007HDL

7050BM00C125 MONITOR, COMPUTER TOTE VISION LCD-2007HDL

7050BM00C125 MONITOR, COMPUTER TOTE VISION LCD-2007HDL

7050BM00C125 MONITOR, COMPUTER TOTE VISION LCD-2007HDL

7035BM00L0050 PRINTER, SECURITY BADGE TID GLOBAL DTC4500.

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application

The contractor shall be responsible for obtaining and maintaining access, training and successful operation of the PIEE/GFP Module application for the entirety of the contract/task order PoP.

The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office, and requested within the PIEE/GFP Module system.

https://wawf.eb.mil/piee-landing/ https://wawf.eb.mil/piee-landing/ https://dodprocurementtoolbox.com/

Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation.

Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance.

3.5 Materials: The Government:

☒ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below:

November 16, 2021

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☒ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Contractor Furnished Services required in support of this contract/task orders.

These Services are described below:

4.2 General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

November 16, 2021

PART 5

5.0 SPECIFIC TASKS

Building H-200 Surveillance System:

• Avigilon/ comparable VMS

• All existing servers will be used but not covered under this service agreement. T&M only.

• All existing 357 cameras

• Setup and train personnel for ACC (Access Control) will be performed once the system is operational.

Building H-200 Access Control System:

• ACM server

• Existing 286 proximity readers, wiring readers, contacts, REX, and locks.

• Training as required up to 4 times per year in conjunction with Inspection Schedule

Stentafone System:

29 standalone Stentafone Intercom units as connected to the PACS system and Integration Modules Network switch is now covered under this agreement plus all network wiring from switch to Device locations.

General Requirements:

Four (4) Dell R520 Servers at 24 terabytes each Two (2) Avigilon Appliances 9 Terabytes each Two (2) Six Monitor Video Monitoring Stations. One located in Security Office, one (1) located on the Quarter Deck 322 Cameras 32 PTZ units 254 HID Multi Class RP40 254 Electrified Mortise Locks Magnetic Doors Locks on Double doors Von Duprin electrified Trim Sets Auto door activations 110vac power is provided By Site

Parts Coverage: Labor Coverage: Items Not Covered:

Preventative Maintenance:

All parts are covered as part of this plan. All labor is covered under this plan. Except damage caused by misuse, abuse, accident, disaster, fire, flood, water, wind, lightning, and Acts of God.

November 16, 2021

In addition, items designed to fail in order to protect the equipment, such as power and/or lightning suppressors, are also not covered by this plan.

November 16, 2021

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is Unclassified.

6.2 The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is: (Requirement must be checked in order to be a requirement for this PWS.) Not applicable.

6.2.1 TIER I: Critical sensitive position: Not applicable

OR 6.2.1 TIER II: Non-critical sensitive position : Not Applicable

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements: RESERVED

6.4 Training

6.4.1 Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements:

6.4.1.1 Training: All contractor and associated subcontractor employees working Cybersecurity Information Assurance (IA)/Cyberspace functions must comply with DoD training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD 8570.01-M. Contractors shall identify, document, track, and report qualifications of contract support personnel who perform cyberspace work roles.

6.4.1.2 Certification: The contractor shall ensure that personnel accessing IS have the proper and current IA certification to perform IA functions at contract award in accordance with DoD 8570.01–M, IA Workforce Improvement Program. The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-2001, including:

6.4.1.2.1 DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

6.4.1.2.2 Appropriate operating system certification for IA technical positions as required by DoD 8570.01–M.

6.4.1.2.2.1 Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

6.4.1.2.2.2 Contractor personnel who do not have proper and current certifications shall be denied access to DoD IS for the purpose of performing IA functions.

November 16, 2021

6.4.2 User requirements: All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5.15. The contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT - RESERVED

6.7 Facility Related Control System – RESERVED

6.8. System Communications - RESERVED

6.9 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Business-

RESERVED

6.14 Contractors Located On Military Installations

6.14.1 The contractor(s) shall coordinate/obtain the connections with the local MTFs/ Enhanced Multi-Service Markets (eMSMs) and Base/Post/Camp communication personnel located on a military installation who require direct access to Government systems.

6.14.2 These connections will be furnished by the Government.

6.14.3 Contractors located on military installations that require direct connections to their networks shall provide an isolated IT infrastructure. They shall coordinate with the Base/Post/Camp communications personnel and the MTF/eMSM in order to get approval for a contractor procured circuit prior to installation to ensure the contractor is within compliance with the respective organizational security policies, guidance and protocols.

Note: In some cases, the contractor may not be allowed to establish these connections due to local administrative/security requirements.

6.14.4 The contractor shall be responsible for all security certification documentation as required to support DoD IA requirements for network interconnections.

6.14.5 The contractor shall provide, on request, detailed network configuration diagrams to support IA accreditation requirements.

6.14.6 The contractor shall comply with IA accreditation requirements. All network traffic shall be via Transmission Control Protocol/Internet Protocol using ports and protocols in accordance with current Service security policy. All traffic that traverses MHS and/or military Service https://aplits.disa.mil/processAPList

November 16, 2021

Base/Post/Camp security infrastructure is subject to monitoring by security staff using Intrusion Detection Systems.

DODIN Decision Tree_160929.pptx

November 16, 2021

PART 7

7.0 ATTACHMENTS/TECHNICAL EXHIBIT LISTING

7.1 The following forms are to be completed by the FSO/Security POC, or COR once the contractor is granted the proper background investigation.

7.1.1 Contractor CAC Request Process.

DHA CAC Request Process.pdf

DMDC TASS

Application.xlsx

7.1.2 DHA’s contractor training instructions.

DHA FY22 Annual

Training List_Oct 2021

7.1.3 DHA’s new employee handbook.

DHA CAE (J-4) New Employee Handbook