LCB_EACSS_upgrade_SOW_-_Draft_1.pdf

Attachment – 1 Statement of Work

Request for Proposal No.

140R3026R0020

Document Title Electronic Access Control Site Surveillance (EACSS) – Lower Colorado Basin Regional Office (LCBRO)

STATEMENT OF WORK

ELECTRONIC ACCESS CONTROL SITE SURVEILLANCE (EACSS)

LOWER COLORADO BASIN REGIONAL OFFICES (LCBRO)

1.0 Description Of Work:

1.1 General Requirements: This statement of work (SOW) defines general requirements for

Lower Colorado Basin Regional Office (LCBRO) campus located in Boulder City, NV.

We are requesting installation of an approved; Turn-Key Integrated Electronic Access Control Site Surveillance (EACSS). The term EACSS covers Intrusion Detection Systems (IDS), Access Control Systems (ACS), and Closed-Circuit Television (CCTV). EACSS installed will cover all facilities listed in section 1.3, Facility Locations and be guided by security compliance contained within Attachment 1. This scope of work requires activities to include but are not limited to; site surveys, design and development, installation, logistics, and programming plans. This system shall demonstrate it can integrate with other systems as outlined in order to meet the Region’s current and future needs as well as projected growth. The contractor shall develop all the requirements to connect the new systems with the existing EACSS network backbone ensuring minimal outages throughout the Region during this process. This proposal will cover the ACS and CCTV integration requirements with a cost for IDS broken out to allow for that work to be performed at a later date within the near future. The following general requirements will satisfy Physical Security Equipment (PSE)/EACSS requirements:

• Multilevel Lock states or modes i.e. lock downs, holiday or limited access to selected areas and/or zones per operator input or input from other type of device; System should support multiple user defined Threat Levels that can completely change the card holders access ability and security clearance level as well CCTV parameters (i.e. camera block/unblock, camera settings)

• Export Badging and Badge Designs database to be used by others;

• Support IPv6 on all IP based devices installed;

• Encrypted communication between panels and computers which meet current government requirements;

• Hardware or Virtual deployment of Servers, RAIDS in a cloud environment separately ensuring system functionally;

• Use/support Active Directory to manage users on all computers/equipment requiring log in;

• One-click camera call up when an alarm event is presented;

• Support layering of access from one area or group to the next;

• User-friendly, map-based display of all system event information;

Request for

(EACSS) – Lower Colorado Basin Regional

• System will be located on a closed network so all patching and service support will need to be done onsite by certified personnel;

• Visitor management component that can register track, print photo badge normal and self-expiring, scan driver license or other identification to input into system;

• Integrate into mass notification and other systems for tighter security and response;

• Federal Information Processing Standard (FIPS) compliant multi-function security appliance;

• Support existing DMP panels:

• Shall meet all Information Assurance (IA) standards

• Risk Management Framework (RMF) Certified.

• All reports and database queries shall take place within the system without a need for third party software or hooks into the database in order to perform input and/or printing of database reports;

• System be installed with the full version of Microsoft Office to support reports and other functions needed to be performed without the need to move data to separate systems;

• Microsoft Standard SQL Server will be used if used for this project.

The Contractor shall be a security engineering firm that is regularly and professionally engaged in the business of the design, installation, and testing of ESS and equipment. The Contractor shall have a minimum of five years’ experience in the design, installation, and testing of ESS. All installation shall be performed by factory trained, certified technicians with proof of cert for each tech be submitted prior to any work starting and/or taking place.

1.2 Site Specific Requirements:

1.2.1 The LCBRO Main Campus is a multi-building, multistory facility located in Boulder

City, Nevada with some outlaying buildings within a .5-mile radius.

1.2.2 This being a federal campus, Contract personnel must meet established unescorted requirements (e.g., background checks, security clearances) before we can an issue any identification badges. Personnel not meeting the minimal standards will not be issued an contractor badge and will not be allowed access to the campus. Contractors must submit requests for Badge identification to LCBRO following contract award.

Contractor is required to have all required Badge access completed before contract start and for the duration of contract.

1.2.3 All computer equipment needed, i.e. company laptops shall be cleared in advance and approved prior to use within campus.

1.2.4 No personal or private cell phones or cameras allowed in any area within campus. Any request for photos will be submitted and taken by command security to be screened prior to release to contractor.

Request for

(EACSS) – Lower Colorado Basin Regional

1.2.5 All work performed shall be by certified manufacturer-trained personnel. Proof of training to be submitted prior to award to ensure contractor has personnel ready and able to perform contract once awarded.

1.3 Facility Locations:

The following facilities are included and shall be surveyed, designed, integrated, and upgraded as part of the Electronic Access Control Site Surveillance (EACSS) effort.

The Contractor shall perform all required tasks at each identified facility and any associated sub‑areas. This list of facilities is as follows:

• Admin Building

• Annex Building

• Building 100

• Building 200

• Building 500

• Building 700

• Building 900

• Building 1000

• Building 1100

• Building 1200

• Building 1300

• Building 1400

• Comm Building

• Central Plant

2.0 Service Delivery Summary

2.1 Contractor shall conduct site surveys, develop designs. The contractor shall provide a design for Regional Security Officer, Contracting Officer Representative (COR) and Contracting review and revisions no later than 10 working days after award. The contractor must provide a 100% design NLT 10 working days after completion of work.

Contractor shall provide a proposed timeline for each building/area being upgraded.

Contractor is responsible for completing all forms, attachments, certificates, etc. to ensure a fully functional approved EACSS system is delivered to the government.

2.2 Contractor is required to resource the project with sufficient clear personnel to support the integration plan as outlined in the project Plan of Action & Miliestones (POA&M).

2.3 Contractor personnel must be familiar with and have knowledge of fiber optic networks and CISCO switches or related equipment supporting current hardware and software systems.

2.4 All details of workmanship shall be in accordance with the highest standards and best practices for low voltage electronic maintenance in accordance with Federal, State and manufacturer’s specifications.

Request for

(EACSS) – Lower Colorado Basin Regional

2.5 Any infrastructure installed as part of this contract shall conform to the latest issue of the NEC in effect at the time of contract award. Poor workmanship or unacceptable performance shall be grounds for withholding payment until the problem is equitably resolved.

2.6 100% design shall be provided electronically in AutoCAD, with 5 sets of bound hard copies, red-line drawings; assuming 100% design becomes mandatory "as built" drawings without change.

2.7 Period of performance will be 12 months from the date of contract award.

2.8 Place of performance is LCBRO campus located in Boulder City, NV.

3.0 Specific Requirements

3.1 The scope of work covers more than 15 facilities requiring over 130 fielded premise control units (PCUs) and excess of 12,000 alarm “points”. A list of affected facilities can be found in section 1.3, facility locations. All new ESS components shall fully integrate into existing infrastructure in the Administration building. All existing CCTV monitoring locations shall be upgraded for inclusion into final ESS solutions. All physical infrastructure, sensors, communication pathways, connectivity, distribution boxes, etc. shall be provided under this contract.

3.2 Site Survey

• Installation Design - Prior to commencement of design activities, the Contractor is required to receive approval from the Regional Security Officer (RSO) or COR and the Contracting Officer (CO) to begin design.

• Installation Design Package (IDP) - After approval of the Site Survey Report and the POA&M, the Contractor may begin installation design. The Contractor will update all existing drawing packages. IDPs will be designated in the 50%, 100%, and Final IDP phases and will be submitted in accordance with the approved POA&M, detailed installation plan, referenced drawing standards, and previous drawing packages (if applicable) following the instructions below:

• The 50% design will include the proposed equipment arrangement/mounting locations/mounting designs, elevation drawings, system cable flow, system power connections to include outlet/breaker reference, RF system signal and cable diagrams, and conduit paths. The Contractor will provide two (2) 11x17 hard copies of the 50% IDP to the RSO EACSS personal and others needing input, who will review and provide comments within ten (10) working days from receipt of package.

• The 100% IDP will include approved 50% IDP drawings and finalized system power flow diagrams, interconnecting wiring diagrams, and fabrication and assembly details.

The Contractor will include marked up review comment sheets from the previous review.

The Contractor will provide two (2) 11x17 hard copies to the RSO EACSS personal and

Request for

(EACSS) – Lower Colorado Basin Regional others needing input, who will review and provide comments within ten (10) working days from receipt of package.

• The Final IDP is the 100% IDP with all comments incorporated and is used/followed during the installation of the system. The Contractor will include marked up review comment sheets from previous reviews. The Contractor will provide two (2) 11x17 hard copies, and all AutoCAD files on a password protected CD-ROM or USB thumb drive to the RSO EACSS personal and others, who will review and provide comments within five

(5) working days from receipt of package. Installation activities may not begin without RSO written approval of the Final IDP.

• The Contractor will ensure that the IDP submissions for As-Built IDPs shall include a completely integrated version of the revised drawing packages, including newly revised sheets as well as the unrevised sheets, making up a complete hard copy of the drawing package. The electronic copy submitted shall include all the current versions to make a complete drawing package as well.

3.2.1 Cutover and System Transition Plan - The Contractor will develop a detailed Cutover and System Transition Plan using MS Word that includes a detailed schedule for system installation and will submit electronically to the PM for review and approval at the 50% IDP review. The document should include the Contractor’s cutover approach for all installations that replace existing active circuits to ensure uninterrupted support for the site. The cutover portion of the plan will also include the cutover schedule and the order in which connections should be made, broken, and checked. The plan will detail the Contractor’s approach for labeling all disconnected wires and cables in accordance with references in Attachment 2, so that old connections can be restored if new connections do not work. If operations will transition from an existing system to a newly installed system, the Contractor should identify within the plan any special considerations or actions that must be taken by the site or other participating activities in the plan;

specifically, the Contractor will identify and document the steps they will follow to transition from the existing system to the new system. The Contractor will include the plans for testing of existing equipment that will interface with the equipment being installed for this project. The transition planning section will address potential questions/ issues with running the existing system along with the new one, the schedule to execute until a level of confidence is attained, and whether all installations are to be turned on simultaneously or sequentially based on how well the system is responding. This plan will be developed using Microsoft Word and will be submitted electronically to the RSO EACSS personal for review and approval.

3.2.2 Procurement Lists - The Contractor will electronically submit to the RSO EACSS personnel to review a preliminary list of equipment and major material to be procured no later than at the 50% IDP review. The Contractor will electronically submit a list of the remaining equipment and major material to be procured at the 100% IDP review. Each list will be created using Microsoft Excel and will include expected delivery dates for long lead items, part name/nomenclature, manufacturer, part number, unit cost (if

Request for

(EACSS) – Lower Colorado Basin Regional available) and quantity needed. Approval of each list by the RSO EACSS personal indicates authorization for procurement of stated items.

3.3 Perform the following activities in accordance with SOW. Installation activities in this

Task may not begin without RSO Approval of the Final IDP.

3.3.1 Installation In-Brief - The Contractor’s Lead Installer will attend the Installation In-Brief with the RSO (or identified Government Representative) and Site Personnel. The purpose of the In-Brief is to introduce the key installation team members, discuss the roles of RSO EACSS personal and the site during the installation, discuss the schedule of installation activities, and address any issues or concerns prior to beginning the installation.

3.3.2 On-Site Pre-Installation Test - Before beginning the installation, the Contractor and the RSO EACSS Maintenance Technician will conduct a test of the existing equipment that will interface with the equipment being installed for this project to ensure it is in good working order. Government will be responsible for repair or replacement of any existing damaged/nonfunctional equipment. The Contractor will complete a Pre-Installation Test Report using Microsoft Word documenting test results and will submit electronically to the RSO EACSS personal for review and approval within five (5) working days following the test.

3.3.3 Project Installation Descriptions - The Contractor will install all equipment and material in accordance with the dates submitted in the approved POA&M and approved Final IDP.

During the installation activities through Government Test and Acceptance, the Contractor will mark the Final IDP depicting “actual” installation views called Redlines.

Use red ink to mark items that have been removed, green ink for items that have been added, and blue ink to make notes about the changes. Submit one (1) color hard copy of the Redlined IDP to the RSO EACSS personal for use during formal Government Test and Acceptance.

3.3.4 Pre-Acceptance Test - The Contractor will develop and submit an Acceptance Test Plan to the RSO EACSS personnel for review and approval prior to IDS Installation. The Contractor will use the approved Acceptance Test Plan and redlined IDPs as guides to conduct a Pre-Acceptance Test of the newly installed equipment. Within five (5) days after successfully completing the Pre-Acceptance Test, the Contractor will provide a report using MS Word detailing test results, discrepancies, and resolution strategies and submit electronically to the ESS personnel for review and approval thereby indicating readiness for scheduling of the Government Test and Acceptance with Site Personnel.

3.3.5 Burn-In Period - The Contractor will conduct a thirty (30) day Burn-In Period allowing the installed system to run as day-to-day operations continues. The Contractor will complete a report using MS Word, logging issues found during the Burn-In period, dates, and resolution strategies and will submit electronically to the RSO EACSS personal for review and approval within five (5) days of completion of the Burn-In Period.

Request for

(EACSS) – Lower Colorado Basin Regional

3.3.6 List of Replaced, Removed and Excess Equipment/ Major Material - At the completion of the installation, the Contractor will consolidate, and inventory replaced removed and / or excess equipment and major materials. The Contractor will electronically submit a list of these items using MS Excel and include equipment name/nomenclature, manufacturer name, part number, serial number, quantity and location within ten (10) working days to the RSO EACSS personnel to review. The Contractor will disburse in accordance with RSO EACSS personal instructions. The Contractor will return any components that were not installed to the Government for placement in our Spare Parts Warehouse.

3.3.7 Government Test and Acceptance - The Contractor will use the approved Acceptance

Test plan and redlined IDPs to conduct formal Government Test and Acceptance to demonstrate that the new system/equipment has been properly installed according to the IDP and is ready for site acceptance. The Contractor will complete a Government Test and Acceptance Plan Report in MS Word detailing test results and will ensure the System Acceptance Signature Page is completed with required signatures. The Contractor will submit the completed report and signature page electronically to the RSO EACSS personnel within five (5) working days of completing the Government Acceptance Test.

3.3.8 List of Newly Installed Equipment/ Major Material for Maintenance Inventory - The Contractor will create a separate list of all newly installed equipment and major material and will give to the Electronic Security System (ESS) personnel within five (5) working days of Government Test and Acceptance. The purpose of this list is to clearly indicate which equipment items are new so that the ESS personnel can provide this information to the Maintenance Team for system support and inventory tracking. The list should be provided using Microsoft Excel and include part name/ nomenclature, firmware version, manufacturer, part number, serial number, quantity, and location, and be submitted electronically.

3.3.9 Installation Out-Brief - After conducting the Government Test and Acceptance, the

Contractor will attend the Installation Out-Brief with the RSO and other personnel. The results of the formal Government testing will be provided to the site for review, and feedback from the site will be collected.

3.3.10 Installation Close-Out and As-Built Drawings - Once the Site has accepted the system, the Contractor will complete installation close-out activities to include disbursement of equipment and major materials in accordance with RSO EACSS personnel instruction, transfer of vendor provided product documentation, and turnover of the Redlined IDP.

3.3.11 The Contractor will provide all vendor provided system/equipment documentation to the

RSO EACSS personal at the conclusion of Government Acceptance Testing to include As-Built drawings. At this time the Contractor shall destroy all electronic material and provide written documentations stating all related material has been accounted.

Request for

(EACSS) – Lower Colorado Basin Regional

4.0 Warranty Response Times.

• Catastrophic Failure, Major Malfunction or a Partial Failure shall require an onsite response of 6 hours or less.

• Next day service may be authorized by RSO only, if outage is determined to have little impact if next day service is rendered.

5.0 Salient Characteristics

5.1 This section contains the salient characteristics of major equipment required for the ESS.

Ancillary equipment necessary to make the EACSS complete and usable is not listed in this section. The contractor must include in his quote all ancillary equipment required to make the EACSS complete and usable. For this project, the contractor is expected to integrate and/or replace security devices as needed to ensure delivery of complete system. The contractor shall inspect existing components using the following characteristics as a basis and procure a new workstation for the system administrator.

5.2 Access Control System (ACS)

• The ACS shall be an enterprise class IP access control software solution. It shall be fully embedded within a Unified Security Platform (USP). The USP shall allow the seamless unification of the ACS with an IP video management system (VMS), IDS, Intercom and other physical security components. All aspects of the solution should be configurable by a single unified Client application and be monitored by a single unified

GUI.

• Provide an access control system, including engineering, components, installation and commissioning. This system shall interface and be totally unified with IDS and CCTV.

• ACS Server Requirements o Operating System: Windows Server 2016/2019/2022 (Genetec requires 2016+) o Virtualization: Compatible with VMware ESXi 7.x/8.x or Microsoft Hyper-V on

Windows Server 2016+ o Processor: Intel Xeon E5-2620 v4 @ 2.1 GHz or Xeon Silver 4210+ (v3 acceptable for smaller scale) o Memory: 32 GB RAM (recommended for large-scale deployments) o Storage: RAID 1 dual SSD for OS/Application drives; additional RAID 5/6 storage for Archiver/video data o Database: Centralized SQL Server Standard (2014–2022 supported) o Backup: SD card on motherboard for system image, database, license, and config files o Power: Dual power supplies o Certification: PACS vendor certified for up to 248 readers

Request for

(EACSS) – Lower Colorado Basin Regional o Warranty: 5-year Next Business Day onsite warranty

• ACS Client Requirements o Operating System: Windows 11 Pro/Enterprise (fully supported) o Recommended Profile: Intel Core Ultra 7 or better, 1TB RAM, 1TB M.2 SSD

1GbE RJ35

• External System Interfaces: The current system consists of an “open architecture” -operating environment with many external system interfaces. New systems must be designed and certified to meet government standards of operations in support of large commercial/government facilities and be capable of fully integrating Access Control, Visitor Control, Intrusion Detection, Video Surveillance (HD and thermal) and Electronic Key Control systems in a comprehensive EACSS environment.

• Use full versions of third-party applications, i.e. full version of SQL if SQL is used.

• Must incorporate alarm monitoring, access control, support Active Directory, support map design into main displays.

• Capable of storing significant amounts of history depending on the storage options selected by the user. A minimal configuration will store 50,000 events. History shall be accessible for a minimumof 5 years. Additionally, the information can be offloaded, in real-time, to a database for logging, expanded storage and future report generation.

• Utilizing standard user report forms provided within the system, the user is able to use or create powerful queries and specific sorting of data information.

• NIST AES Encryption of all information transmitted in packets from one device to another device throughout the system.

• SEOS and Wiegand interface modules. Standard Wiegand reader technologies that output bit serial information on separate data 0 and data 1 signal lines. Provision for modulated BI-color (Red/Green) LED control is provided per reader to achieve a tri-color (Red/Green/Yellow) visual feedback.

• Enable operator to lock/unlock doors or to even “lock down” an entire location in the event of an emergency.

• One click Mustering functionality reporting;

• ACS Capacities:

a) Local Wiegand Readers – 6 maximum via PCMs

b) Maximum reader buses – 8 maximum, consisting of any mix of supported models: Mercury & Recognition Systems.

c) Mercury Security Devices – Maximum of 16 devices per bus (128 total via eight buses) in any mix of allowable MR-14/24, MR-50, MR-52 and PW5K devices.

Request for

(EACSS) – Lower Colorado Basin Regional

d) Mercury MR-14/24 Readers – Maximum of 8 per bus.

e) Mercury MR-50/52 Controllers – Maximum of 16 per bus.

f) Honeywell PW5K1R2 Controllers – Maximum of 16 per bus.

g) Recognition Systems – 16 per bus (128 total via eight busses).

h) Local sensor supervision – 48 supervision window definitions available with up to a maximum of 48 analog inputs via SIMs.

i) MCT sensor supervision – Dual State (Alarm/Secure) for each sensor input.

Console Operators – *70

j) Controlled Locations – *1000

k) Access Authority Levels – *256

l) Personnel Groups – *256

m) Access Rules – *4000

n) Schedules – *2000 (any combination of Weekly & One time)

o) Card Formats – 10 (user definable)

p) Cards – *40,000+

• ACS Hardware Compatibility List o The ACS shall have an open architecture that supports the integration of third-party IP-based door controllers and IO modules. The ACS shall simultaneously support mixed configurations of access control hardware from multiple vendors.

o The ACS shall support multiple types of hardware devices: single-reader controllers, 2-reader controllers, 1- to 64-reader controllers, integrated readers and door controllers, and Power-over-Ethernet (PoE) enabled door controllers.

o The ACS shall support most industry standard card readers that output card data using the Wiegand protocol and Clock-and-Data.

• The ACS shall support the following IP-enabled controllers.

o Synergis Master Controller o Synergis Cloud Link o HID VertX o HID VertX EVO o HID Edge o HID Edge EVO o Mercury controllers and SIO modules o Mercury M5 Bridge

Request for

(EACSS) – Lower Colorado Basin Regional o Assa Abloy Aperio RS485 8 to 1 hub o Assa Abloy IP Locks (no DSR required)

Corbin Russwin

Sargent Passport

Sargent Profile

IN120

IN220

o Salto Sallis RS485 and PoE routers o Schlage AD-300 and AD-400 electronic locks o Axis A1001 o STid RS485 readers o DDS AS34/TPL4

• The following USB enrollment readers shall be supported o RF Ideas pcProx HID USB reader for enrolling proximity cards o RF Ideas AIR ID Enroll iCLASS ID# USB reader for enrolling HID iCLASS cards o RF Ideas AIR ID Enroll 14443/15693 CSN USB reader for enrolling a MIFARE card using the CSN (card serial number) o RF Idea AIR ID Enroll pcProx Plus w/iCLASS reader for enrolling proximity and iCLASS cards o STid STR-W35-E/PH5-5AA o HID Omnikey 5x2x USB readers

• Access Control Alarms: The access control subsystem shall be UL-294 approved. The

Server shall provide a per-portal event display of:

1. Forced door.

2. Held door.

3. Access Denied.

4. Equipment Tamper.

5. Duress PIN entry.

6. 32 Auxiliary IDS Alarms.

Request for

(EACSS) – Lower Colorado Basin Regional

7. Procedure violations.

8. Transaction rollback.

9. Entry confirmation.

10. Entrapment.

11. PIN/Transaction Retry Limits.

• Relay Outputs:

1. Manual, automatic, and test. Automatic output activation is fully configurable via control logic.

2. Relays may be controlled by combinatorial equations, or explicitly activated and deactivated by separate equations. Relays may be latched or pulsed.

• USP Dynamic Graphical Maps (DGM) o The USP shall support mapping functionality for access control, video surveillance, intrusion detection, ALPR, and external applications.

o The USP shall provide a map centric interface with the ability to command and control all the UPS capabilities from a full screen map interface.

o It shall be possible to span the map over all screens of the USP client station. In the scenario where the map is spanned over all the screens of the USP client station it shall be possible to navigate the map including pan and zoom, and the map’s moves shall be synchronized between all screens. Spanning the map over multiple screen must provide the same command and control capabilities than in a single screen display.

o The DGM shall support the following file format and protocol for importing map background:

(1) PDF

(2) JPG

(3) PNG

(4) Web Map Service (WMS) defined by the Open Geospatial Consortium (OGC)

(5) BeNormad o The DGM shall provide the following online map providers for use as map background and provide the ability to manage their service license if they require one:

Request for

(EACSS) – Lower Colorado Basin Regional

(a) Google Map, aerial, terrain (Licensed)

(b) Bing Map, aerial, satellite, hybrid (Licensed)

(c) OpenStreet Map aerial

(d) OVI hybrid o It shall be possible to configure a mixed set of maps made of GIS, online providers and private imported files and link them together.

o The DGM shall provide the ability to display all native entities of the UPS including:

(a) Cameras, fix, and PTZ

(b) Doors

(c) Camera sequences

(d) Areas

(e) Intrusion areas

(f) Intrusion zones

(g) License Plate Recognition cameras

(h) Digital inputs

(i) Digital outputs

(j) Intercoms

(k) Alarms

(l) Macros

(m) Police Car Patrollers o The DGM shall provide the ability to draw and display information over the map in the form of:

(a) Vectoriel shapes: line, rectangles, polygones, ellipse

(b) Pictures

(c) Text o The DGM shall provide the ability to display any type of third-party entities integrated through an SDK.

o The DGM shall provide the ability to display layer of information in Keyhole Markup Language (KML) format.

Request for

(EACSS) – Lower Colorado Basin Regional o The DGM shall provide the ability to the operator to manage layers of entities displayed over the map, being able to turn them on and off and changing the superposition order.

o The DGM shall offer built-in map data backup and restore both map background and layers of entities.

o The DGM shall offer failover capabilities.

o The DGM shall scale up to several thousands of entities on a single map and hundreds of maps.

o The DGM shall provide a means to update a map background without affecting the map object configuration.

o The DGM shall offer a user-friendly graphical map designer to configure the maps.

o The DGM shall provide user friendly and intuitive navigation that includes:

(a) The ability to create hierarchies of maps to facilitate navigation within and between various sites and buildings.

(b) The ability to define favorites for recurrent position recall.

(c) The possibility to create links between maps. The map links shall allow the link from one map to multiple maps representing the floors of a building.

(d) A common user experience regarding navigation into the map for both GIS and private maps.

(e) A history log of positions.

o It shall be possible to monitor the state of entities on the map. It shall be possible to customize the icons of any entities represented on the map.

o The DGM shall offer the ability to optionally set a graphical display notification of the motion detection.

o The DGM shall offer a smart selection tool to access the video. By clicking the location, the user wants to see, the DGM will automatically select the cameras that can see this location and move the PTZ towards that location. This smart selection tool should take obstacles into consideration and not display cameras that cannot see the location because of a wall.

o It shall be possible to select a location by drawing a zone of interest on the DGM, and to display all the entities that are part of that zone of interest at once.

o The user shall be able to select and display the content of multiple USP entities on the map in popup windows.

Request for

(EACSS) – Lower Colorado Basin Regional o It shall be possible to access live and playback videos from the map.

o It shall be possible to monitor from the DGM all entities event notifications. Users shall be able to turn notifications on and off per entity.

o The DGM shall offer the ability to fully operate alarm monitoring. It shall be possible to:

(a) Center the map on entities related to the alarm.

(b) Visualize the Alarm notifications on the map and access the related videos from the map.

(c) Trigger and receive alarms.

(d) Act on the alarm from the DGM, including acknowledgements, forwarding, and investigation.

(e) Visualize that an alarm occurred in an underlying linked map.

o The DGM shall provide the following search capabilities:

(a) Search and center by entity name.

(b) From the Display of an entity in the USP, locate the entity on the map and offer the ability to select another one close-by.

o Any update of map content by an administrator shall be immediately and dynamically pushed to all DGM users.

o The DGM shall support the use of GIS maps or private maps or a combination of both for map background.

o The DGM shall be compatible with any GIS compliant maps with the OGC and supporting WMS. This includes, but is not limited to, ESRI maps. The DGM shall allow the selection of the appropriate GIS layers.

o The DGM shall provide an intuitive built-in map designer for entity positioning on the map using drag and drop. Any configuration shall be graphic.

o It shall be possible to edit and configure multiple map objects at once.

o Various actions shall be available within maps for execution through simple and intuitive double-click, right-click, or drag-and-drop functionality. Examples of actions available through maps shall include unlocking a door and acknowledging an alarm.

o Through the following functionality, the DGM shall allow the management of USP alarms from the map:

Request for

(EACSS) – Lower Colorado Basin Regional

(a) Locate on the map entities related to the alarm.

(b) Display entities of the alarm with a specific icon, color, transparency level, and blinking rate.

(c) List, select, and locate alarms.

(d) Auto center the map on the highest priority alarm.

(e) Handle the alarm from the map, including acknowledgement, forwarding and investigation.

(f) All map containers, such as hotspots or map links, shall reflect the alarm status of the contained entities.

o It shall be possible to add advanced functionality to map objects using the SDK.

Any functionality available through the USP SDK shall be available within maps.

o The DGM shall offer lasso tools for:

(a) Displaying entities at one location through a single action.

(b) Triggering an action on all entities at one location in a single click.

(c) Editing multiple entities at one location simultaneously.

o The DGM shall allow the display of USP entities selected from the map on a remote monitor (video wall) o The DGM shall provide the following search capabilities:

(a) Search within the map by entity name, street name, or point of interest.

(b) Drag and drop entities from the USP to the map to center their location.

o The DGM shall allow the use of KML overlay map information for both GIS and private maps. Movable objects shall be supported through the use of KML.

o Any updating of map content by an administrator shall be immediately and dynamically pushed to all operators displaying the map.

o The Contractor shall provide licenses for each entity that is required to be shown on the graphical maps.

• USP Audit and User Activity Trails (Logs) o The USP shall support the generation of audit trails. Audit trails shall consist of logs of operator/administrator additions, deletions, and modifications.

Request for

(EACSS) – Lower Colorado Basin Regional o Audit trails shall be generated as reports. They shall be able to track changes made within specific time periods. Querying specific users, changes, affected entities, and time periods shall also be possible.

o For entity configuration changes, the audit trail report shall include detailed information of the value before and after the changes.

o The USP shall support the generation of user activity trails. User activity trails shall consist of logs of operator activity on the USP such as login, camera viewed, badge printing, video export, and more.

o The ACS shall support the following actions on an audit and activity trail report:

print report and export report to a PDF/ Microsoft Excel/CSV file.

• USP Incident Reports o Incident reports shall allow the security operator to create reports on incidents that occurred during a shift. Both video-related and access control-related incident reports shall be supported.

o The operator shall be able to create standalone incident reports or incident reports tied to alarms.

o The operator shall be able to link multiple video sequences to an incident, access them in an incident report, and change the date or time of the sequences later on.

o It shall be possible to create a list of Incident categories, tag a category to an incident, and filter the search with the category as a parameter.

o Incident reports shall allow the creation of a custom form on which to input information on an incident.

o Incident reports shall allow entities, events, and alarms to be added to support at the report’s conclusions.

• Training

a) Conduct on-site factory system training or authorization to attend Manufactory certification at their facility, with the number of sessions and length of sessions as recommended by the manufacturer. Training shall include administration, provisioning, configuration, operation and diagnostics. Trainer must be a Certified Manufactory trainer.

b) Provide Badge Operation, End user Alarm operator training on-site or web-based training for five (5) users with an option for more if suggested by manufacturer.

Request for

(EACSS) – Lower Colorado Basin Regional

5.3 Entry Card Readers: Card readers installed shall be Multi-Technology Access Readers.

Existing badges are required to remain operational during period of performance as to limit impact of Command personal throughout. The critical salient characteristics for entry card readers are:

5.3.1 Supported Credential Technologies

Credential Type Technology / Format High‑Assurance Smartcards MIFARE DESFire + cards with SAMs Secure Readers OSDP communications Mobile Credentials HID Mobile Access; Readerless NFC

(Sentry) Federal / PIV Compliant HID pivCLASS, HID Signo, Veridt, Assa

Abloy Automatic License Plate Recognition

(ALPR)

SharpV camera plate credentials

5.4 Reference Standards: Provide systems which meet or exceed the requirements of the following publications and organizations as applicable to the Work of this Section:

o HSPD-12 → mandates secure identity credentials o FIPS 201–3 → specifies PIV credential standards o NIST SP 800-116 → guides facility access implementation o FICAM (GSA APL) → architecture and product approval o OMB M-19-17 → enforces PIV usage across agencies o OSDP/IEC → ensures secure device communication in PACS o FIPS Pub 197 Advanced Encryption Standard (AES versions).

o UL 1076- Burglary.

o UL 294- Access Control.

5.5 CCTV Unification. The system shall demonstrate its ability to support existing cameras installed as well as provide increased capability in future phase. Currently there are 30 IP based cameras displaying at 6 current monitoring locations.

5.5.1 CCTV Requirements.

• IP-based Video Management System (VMS) hardened for demanding critical infrastructure requirements;

• all camera views are available to all users without limits due to licensing or connection restrains;

Request for

(EACSS) – Lower Colorado Basin Regional

• support programing of input from ACS/IDS alarms to trigger hands free video call up to monitor location;

• System should also allow for displaying of all streams at one location at one time;

• Cameras are to require maintaining no less than 30 days storage, this would need support 50 IP cameras at 15FPS, 1080PHD resolution

• Video Archiver servers must be certified by the manufacturer to support up to

100cams. Video Archivers should be configured in RAID5 for video storage using SAS Hard Disks, RAID 1 Mirrored SSD OS/App Drives, and local SD card on the motherboard for backup of Server image, database, config and license files. A 5yr NBD warranty and Win2022 Server Standard OS is also required. The video recording performance must be guaranteed by the manufacture even during a RAID5 rebuild.

• Video workstations should support H.264 and H.265 GPU decoding across all supported camera manufacturers. Dual GPU workstations should be certified by the Manufacturer to be able to support 100 cameras @ 720P, 30FPS, 2.3mbps and 52 cameras @1080P, 30FPS, 5.5 mbps. Single GPU workstations should be certified by the manufacturer to support 50 cameras @720P, 30FPS, 2.3mbps and 26 cameras @ 1080P, 30FPS and 5.5 mbps Windows 10 is required.

• License plate integration into the system, preference with AutoVu SharpV camera or other product allowing us to track and display in real time at check points that require this information. This should not only display but also trigger an external light/sounder to guard of unauthorized plate read;

• use full versions of third party applications;

• Support Active Directory with up to 10 Domains; must support the ability to have user accounts that are tied to AD as well as non-AD users simultaneously.

• support IPv6 on all IP based devices installed;

• system needs to take alarm inputs from intrusion panels or IO triggers; displaying cameras in real time to stated alarms allowing for a hands-free response by dispatch personal;

• Camera monitoring & control distributable to any authorized workstation on the network;

• Intelligent queuing logic for multiple alarm scenarios;

• Deliver Live AND Pre/Post alarm video simultaneously;

• Support Advanced Analytics i.e. Axis ARTPEC-8/9 or CV25, Kiwi, Agentvi, Briefcam (i.e. Privacy protector, Intrusion Detector, Color/Size/Directional based searching)

• Support for the following compression types MPEG-4, MPEG-2, MJPEG, H.264, , H.265,Wavelet, or JPEG2000

• A separate video library server shall be installed to support saved clips for storage until those clips are no longer required by command.

• System shall be licensed to support 20% additional camera to be tied in at a later date.

Request for

(EACSS) – Lower Colorado Basin Regional

5.5.1.1 All audio streams supplied from IP video servers shall be digitally encoded in g711 (u-law), g721, g723, or AAC compression formats and recorded simultaneously in real time.

5.5.1.2 Each camera’s bit rate, frame rate, and resolution shall be set independently from other cameras in the system, and altering these settings shall not affect the recording and display settings of other cameras.

5.5.1.3 The VMS shall be able to use multiple CCTV keyboards to operate the entire set of cameras throughout the system, including brands of cameras from various manufacturers and including their PTZ functionalities (i.e.: Pelco keyboard controls Panasonic dome or vice-versa).

5.5.1.4 The VMS shall be able to retrieve and set the current position of PTZ cameras using XYZ coordinates.

5.5.1.5 The VMS shall support PTZ camera protocols from multiple manufacturers, including analog and IP protocols.

5.5.1.6 The VMS shall arbitrate the user conflict on PTZ usage based on user levels per camera.

5.5.1.7 The VMS shall support the following list of CCTV keyboard protocols:

(a) American Dynamics 2078 ASCII, and American Dynamics 2088 ASCII

(b) Bosch Autodome, Bosch Intuikey.

(c) DVTel.

(d) GE ImpactNet.

(e) Panasonic, Pelco ASCII, Pelco KBD-300, and Pelco P.

(f) Radionics.

(g) Samsung SSC-1000.

(h) Video alarm.

5.5.1.8 The VMS shall support the following list of joysticks and control keyboards:

(a) Axis 295.

(b) Axis T8310 Video Surveillance Control Board.

(c) Panasonic WV-CU950 Ethernet keyboard.

(d) Any USB joystick detected as a Windows Game Controller.

Request for

(EACSS) – Lower Colorado Basin Regional

5.5.1.9 The VMS shall allow for the configuration of a time zone for each camera connected to a DVS. For playback review, users shall have the ability to search for video based on the following options:

(a) Local time of the camera.

(b) Local time of the SSM.

(c) Local time of user’s workstation.

(d) GMT Time.

(e) Other time zone.

5.5.2.1 The USP shall be an IP enabled solution. All communication between the SSM and CSA shall be based on standard TCP/IP protocol and shall use TLS encryption with digital certificates to secure the communication channel.

5.5.2.2 The USP shall support user authentication with claims-based authentication using external providers. External providers shall include:

• ADFS (Active Directory Federation Services)

5.5.2.3 The USP shall limit the IP ports in use and shall provide the Administrator with the ability to configure these ports.

5.5.2.4 The VMS shall support only secured media stream requests, unless explicitly configured otherwise. Secured media stream requests shall be secured with strong certificate-based authentication leveraging RTSPS (aka RTSP over TLS). Client authentication for media stream requests is claims-based and may use a limited lifetime security token.

5.5.2.5 The VMS shall offer the ability to encrypt the media stream, including video, audio, and metadata with authenticated encryption. Media stream encryption shall be done at rest and in transit and be a certificate-based AES 128b bits encryption.

The VMS shall:

• Allow encryption to be set on a per camera basis for all or some of the cameras.

• Provide up to 20 different certificates for different groups of CSA or users who have been granted access to decrypted streams.

• Not decreasing the recording performance by more than 50% when encryption is enabled.

• Use Secure RTP (SRTP) to encrypt the payload of a media stream in transit and allow multicast and unicast of the encrypted stream.

• Use a random encryption key and change periodically.

Request for

(EACSS) – Lower Colorado Basin Regional

• Allow encrypted streams to be exported.

5.5.2.6 The VMS shall support end-to-end encrypted streams with cameras supporting Secure RTP (SRTP) both in unicast and multicast from the camera.

5.5.3 VMS Media Streaming

5.5.3.1 The Media Router Role shall be responsible for routing video and audio streams across local and wide area networks from the source (e.g. DVS) to the destination (e.g. CSA).

5.5.3.2 The Media Router Role shall support multiple transport protocols, such as unicast TCP, unicast UDP, and multicast UDP.

5.5.3.3 The Media Router shall support IGMP (Internet Group Management Protocol) to establish multicast group memberships:

• IGMP v3, including SSM (Source-Specific Multicast) shall be supported.

5.5.3.4 The Media Router Role using Redirector Agents shall be responsible for redirecting a stream from a source IP endpoint to a destination IP endpoint.

5.5.3.5 The Redirector Agents shall be capable of converting a stream from and to any supported transport protocols:

• Multicast UDP to Unicast TCP.

• Multicast UDP to Unicast UDP.

• Unicast TCP to Multicast UDP.

• Unicast UDP to Multicast UDP.

5.5.3.6 It shall be possible to limit the number of concurrent live and playback video redirections for each Redirector Agent to better control the bandwidth across multiple sites.

5.5.3.7 It shall be possible to protect the Media Router Role against hardware or software unavailability by configuring another Media Router Role to act as a hot standby server.

5.5.3.8 Multiple Redirector Agents shall be used on a large VMS installation to increase service availability and to provide automatic load balancing.

5.5.4 VMS Video Archives Transfer capabilities

5.5.4.1 Archive transfer shall provide the ability to:

• Transfer video from one server to another server in the same system.

Request for

(EACSS) – Lower Colorado Basin Regional

• Transfer video from a federated server to another server.

• Transfer video from camera storage to a server.

5.5.4.2 It shall be possible to program video transfers either on a recurrent schedule, or to trigger them manually or upon connection.

5.5.4.3 It shall be possible to filter the video of interest for a transfer. The video of interest shall be defined with the following filters:

(a) All archives when the camera was offline.

(b) Alarms.

(c) Playback request from the edge.

(d) Video analytics events.

(e) Motion events.

(f) Bookmarks.

(g) Input triggers.

(h) Time range.

5.5.4.4 It shall be possible to define the length of video before and after the event used as a filter to determine the video of interest.

5.5.4.5 The USP shall offer an interface for displaying all video archive transfer requests.

This interface shall display all the current, requested and scheduled video transfer requests. It shall be possible to edit, trigger, and cancel video archive transfers from this interface.

5.5.4.6 The Monitoring UI shall leverage the Graphical Processing Unit (GPU) for video decoding.

(a) The following GPU technologies shall be supported:

(i) NVidia CUDA

(ii) Intel Quick Sync

(b) The Monitoring UI shall have the ability to decode video through the optimal simultaneous use of the GPU and Computer Processing Units (CPU).

5.6 Communications Backbone. Government owned ESS network is a Cisco 4900 Campus

Solution using Cisco 2960 series throughout. The ISMS will utilize this network as it’s only communications backbone. Any and all updates needed to support this system shall take place over this closed network, onsite. At no time will systems connect or be required to make connections to any other network.

Request for

(EACSS) – Lower Colorado Basin Regional

6.0 Intrusion Detection System (IDS), including engineering, components, installation and commissioning. Priced out as optional for follow on to this award.

• Reference Standards: Provide systems which meet or exceed the requirements of the following publications and organizations as applicable to the Work of this Section:

o UL 294: Access Control System Units.

o UL 864: Control Units for Fire Protective Signaling Systems.

o UL 1076: Proprietary Burglar-Alarm Units and Systems.

o UL Grade AA Line Security Requirements o ICID 705 Security Requirements with optional FIPS pub 46-3 AES option.

o FCC Part 15, Subpart J, Class A computing devices regarding EMI and RFI.

o FIPS Pub 46-3 Advanced Encryption Standard (AES Option) o FIPS 140-2 Compliant o NIST Certified AES Encryption o SIA Computer Interface and Digital Communications Standards o DIACAP ATO Certification…