STATEMENT OF WORK

Lenel HSPD-1 2 / FIPS 201 -3 Compliant Physical Access Control System Upgrade

INTRODUCTION

The mission of the Indian Health Service (IHS) is to raise the physical, mental, social, and spiritual health of American Indians and Alaska Natives to the highest level. As part of this mission, the IHS is committed to ensuring the safety and security of its patients, staff, and facilities while providing high-quality healthcare services across its regions.

To support this mission, the purpose of this contract is to upgrade existing Homeland Security Presidential Directive 1 2 (HSPD-1 2) compliant Physical Access Control Systems (PACS) in Indian Health Service facilities located throughout the Great Plains Area. These upgrades will enhance the protection of federal facilities, patients, staff, and property through compliance with HSPD-1 2, Federal Information Processing Standard (FIPS) 201 -3 , and all applicable federal security and privacy regulations.

The implementation of these system upgrades will ensure standardized, secure, and efficient access control for all IHS facilities, promote accountability, and safeguard critical federal healthcare infrastructure. By modernizing physical security technologies and eliminating obsolete PAM modules, the IHS will continue to uphold its mission of providing safe and secure environments where quality healthcare can be delivered to the Native communities it serves.

OBJECTIVES

o Ensure compliance with HSPD-1 2 and FIPS 201 -3 requirements o Replace outdated Lenel hardware with current-generation controllers o Modernize PIV reader infrastructure with HID Signo readers o Enable direct Federal Bridge connectivity through Lenel PIV licenses o Eliminate dependency on Physical Access Modules (PAM) o Maintain fully functional access control systems throughout the upgrade process

SCOPE OF WORK

The Contractor shall perform the following work across fifteen (15 ) designated IHS facilities in the Great Plains Area:

• Hardware Replacement

• Lenel Controller Upgrades o Replace existing Lenel 4420 controllers with Lenel X4420 controllers (20 total units) o Replace existing Lenel 1 320-S 1 and 1 320-S 2 controllers with Lenel 1 320-S 3 controllers (3 6 total units)

HID Reader Replacement o Remove all existing HID PIV readers o Install new HID Signo PIV readers with Card + PIN and Prox antenna, OSDP and Bluetooth enabled (1 34 total readers)

Software Licensing o Provide and install Lenel PIV authentication licenses (LNL-SWG-AUTH-002) for all installed readers (1 34 licenses total, enabling 268 authenticating readers) o Configure PIV licenses to enable direct Federal Bridge connectivity o Eliminate the need for separate Physical Access Modules (PAM)

Installation Requirements

The Contractor Shall o Provide all cabling, conduit, junction boxes, and associated materials required for installations o Install cabling in accordance with IHS Cabling standards and Levington certification standards o Label all cables at both ends with permanent, clearly legible labels o Perform all work in a professional and workmanlike manner o Protect government property and repair any damage caused by installation activities o Coordinate work schedules with facility personnel to minimize operational disruptions o Ensure emergency access procedures remain functional at all times

Configuration and Testing

The Contractor Shall o Configure all new hardware within the existing Lenel OnGuard system o Migrate existing cardholder data and access permissions to new controllers o Test PIV card authentication at each reader location o Verify certificate chain validation through Federal Bridge o Conduct comprehensive end-to-end system testing o Test all door points, request-to-exit devices, and lock mechanisms o Verify alarm and monitoring functions are operational o Document all test results and remediate any deficiencies

2. PLACE OF PERFORMANCE

Work shall be performed at the following IHS facilities in the Great Plains Area:

Facility Readers X4420 Controllers 1 320-S3 Modules Belcourt Hospital, ND

1 5 3 4

Fort Yates Hospital, ND

7 1 3

Cannonball Clinic, ND

1 1 0

Youth Treatment Center, SD

1 0 0

Fort Thompson Health Center, SD

4 1 1

Kyle Health Center, SD

6 1 1

Wanblee Health Center, SD

8 0 2

Lower Brule Health Center, SD

4 1 1

McLaughlin Health Center, SD

1 0 1 3

Pine Ridge Hospital, SD

21 3 5

LaCreek Clinic, SD 2 0 0 Rosebud Hospital, SD

1 3 3 4

Sisseton Health Care Center, SD

1 8 3 5

Wagner Health Clinic, SD

6 0 2

Eagle Butte Hospital, SD

1 9 3 5

TOTALS 1 34 20 36

3. APPLICABLE STANDARDS AND REGULATIONS

All work shall comply with:

o Homeland Security Presidential Directive 1 2 (HSPD-1 2) o Federal Information Processing Standard (FIPS) 201 -3 o NIST SP 800-1 1 6r1 (Guidelines for the Use of PIV Credentials in Facility

Access) o TIA/EIA 568 Commercial Building Telecommunications Cabling Standard o National Electrical Code (NEC) o Lenel S 2 OnGuard manufacturer specifications o HID reader manufacturer specifications

8. GOVERNMENT-FURNISHED PROPERTY/INFORMATION

The Government will provide o Access to facilities during approved work periods o Existing Lenel OnGuard system access and documentation o Current cardholder database and access permissions o Network connectivity and IP addresses as required o Coordination with facility personnel o PIV test cards for authentication testing

7. CONTRACTOR-FURNISHED PROPERTY/SERVICES

The Contractor shall provide o All hardware as specified in Section 3 and priced in Section 6 o All software licenses (1 34 Lenel PIV authentication licenses) o All cabling materials and installation supplies o All tools and equipment necessary to complete the work o Transportation of personnel and equipment to work sites o Qualified installation and configuration technicians

Project management and coordination

1 0. SECURITY REQUIREMENTS

Personnel Security o All Contractor personnel must undergo background investigation appropriate for facility access o Contractor personnel must comply with all IHS security policies and procedures o Contractor shall provide list of personnel requiring facility access 1 0 days prior to start of work

Data Security o Contractor shall protect all sensitive information encountered during performance o Proper handling of PIV cardholder information per Privacy Act requirements o No removal of data or documentation from Government premises without

COR approval

Physical Security o Work in sensitive areas must be coordinated with facility security o All security vulnerabilities discovered during work must be immediately reported to COR o All work areas must be left clean and secure at end of each workday

9. PERIOD OF PERFORMANCE

The period of performance shall be 6 months from the date of contract award

1 0. QUALITY ASSURANCE

Inspection and Acceptance o All hardware installations subject to Government inspection o All testing performed in presence of COR or designee o Final acceptance requires COR signoff on all deliverables

Warranty o Contractor shall provide minimum one year warranty on all labor and materials o Warranty shall cover defects in workmanship and materials