18Q0024 SOW.docx

Performance Work Statement Maintenance and Repair of the Intrusion Detection and Access Control Systems with Intercom and CCTV at the Space and Naval Warfare Systems Center Pacific (SSC Pac).

1. SCOPE

This is a service acquisition. The work will be separated into two contract line items with two separate Contracting Officer Representatives (CORs), one for each line item covering system 1 and system 2. The scope of this effort will cover the following areas:

1) Maintain and ensure operability of all equipment associated with the Intrusion Detection System (IDS) in use at the Space and Naval Warfare System Center Pacific (SSC Pac).

2) Maintain and ensure operability of all equipment associated with the Access Control System (ACS) in use at SSC Pac. Perform preventive maintenance and testing on a six-month recurring basis for all equipment associated with the Access Control System.

3) Maintain and ensure operability of all equipment associated with the Sensitive Compartmented Information Facility (SCIF) level IDS/ACS performing the preventive maintenance and testing on a six-month recurring basis for all equipment associated with the IDS/ACS.

1.1. Background

The Space and Naval Warfare System Center Pacific (SSC Pac) has a SCIF level IDS/ACS and an intrusion detection system and an access control system with associated intercom and video subsystems that require regular maintenance, troubleshooting, and repair.

System 1 - Intrusion Detection System (IDS) consists of:

· Monitor Dynamics SAFEnet Ver. 6.2.1.6 sp4

· Virtual VMWare

· Windows Server 2008 R2 operating system

· SQLServer 2008 R2

· Associated Pre-Processor Unit

· Fileservers

· Remote Terminal Units (RTU)

· Primarily model RTU-100 There are approximately 117 RTUs + 20 Network Local Controllers (IDS) and 31 Dual Door Controllers (ACS) located throughout the Point Loma and Old Town area.

Access Control System (ACS) consists of:

MDI operating system: controlling approximately 30 Dual Door Control (DDC) Units located throughout the Point Loma and Old Town areas. These ACUs control approximately 60 card readers at various entry control points.

Subsystems:

ACS also integrates and controls portions of the intercom and video subsystems.

The intercom subsystem consists of:

· A Stentofon master

· 3 sub masters with approximately 47 stations.

The video subsystem consists of:

· A Vicon master switcher

· 5 monitors

· 50 fixed cameras

· 23 Pan/Tilt/Zoom cameras

System 2 - SCIF Level IDS/ACS consisting of:

· Monitor Dynamics SAFEnet Ver. 6.2.1.6 sp4

· Windows Server 2008 R2 operating system

· SQLServer 2008 R2

· Fileservers

· Remote Terminal Units (RTU)

· Model RTU-100 (27) and RTU-200 (18) There are approximately 45 RTUs (IDS) located throughout the Point Loma and Old Town area.

Access Control System (ACS) consists of:

MDI operating system: these ACUs control approximately 85 card readers at various entry control points and 2 Read-Only Memory (ROM) panels.

System 2 is a combined IDS/ACS system.

2. APPLICABLE DOCUMENTS

OPNAV INSTRUCTION 5530.14C, Navy Physical Security Manual

3. REQUIREMENTS

The contractor shall be a MDI certified to troubleshoot, repair, and/or replace all defective components comprising these systems. The contractor shall have on staff a minimum of –

1) Manufacturer Certified Engineer with SAFEnet Networking and SQL Database Certification.

2) Manufacturer Certified Technicians on the SAFEnet system at an Administrator level.

3) Technicians must be IAT 2 qualified per DoD 8570.01-M, to include below certification requirements:

a. Security+

b. Windows 10 Admin Configuring Windows 10 (70-697)

c. Windows Sever 2012 Installing and Configuring Windows Server 2012 (70-410)

d. Windows Server 2012 Administering Windows Server 2012 (70-411)

4) Contract will be classified at the Top Secret level and require a DD-254.

5) Technicians performing work or service on System 2 are required to be cleared at the Top Secret Level.

6) Technicians providing work or service on System 1 are required to be cleared at the Secret Level.

3.1. Maintenance of IDS/ACS System. Maintain and ensure operability of all equipment associated with the Access Control System in use at SSC Pacific (3.1.1.1 through 3.1.1.6) as identified below: The contractor shall perform preventive maintenance and testing on a six-month recurring basis for items (3.1.1.1 through 3.1.1.6). (This equates to 2 Local Controllers per week.)

3.1.1. Description. The electronic Access Control System (IDS/ACS), and all related subsystems require maintenance and repair to remain in a continuous operational status. These subsystems include the server, communications and distribution equipment, video subsystem, intercom subsystem, local control units, and local devices/wiring. Troubleshooting, repair, and replacement of all defective components comprising these systems are required.

3.1.1.1. IDS/ACS Servers: The IDS/ACS server is a SQL based Server running MDI SAFEnet 6.2.1.6 sp4 control software. This server requires standard SQL operating system maintenance, and indicates the current operating status of the primary components of the system. The servers shall be checked for indications of problems with itself and other components on a regular basis, sufficient that acceptable quality levels of all equipment can be met. As this component is system critical, the acceptable quality level of repair is 100%. Additionally, a second system 2 IDS/ACS which utilizes the MDI SAFEnet software server running Windows Server 2008 R2 with SQL 2008 R2.

IDS/ACS

Critical Components are those components that, without which, the system cannot function and operate as designed.

Non-Critical Components are those components that cause local site malfunctions, but still allow the System to operate as designed.

3.1.1.2. IDS/ACS Communications and Distribution Equipment: This equipment is primarily the transmit and receive interfaces for equipment that communicates via government-owned or rented fiber, telephone lines, and intranet (TCP/IP protocol). Problems with communications are generally indicated during the IDS/ACS Server checks referenced in 3.1.1.a, or daily reports generated by the security force monitoring personnel.

3.1.1.3. Video subsystem: The video subsystem consists primarily of a Server running a Viconnet 5.0 Application Software. This subsystem is controlled by the MDI Server and the Stentofon Intercom System (via a virtual Matrix), as well as having its own control equipment. The security force monitoring personnel generate a daily log of each camera status, which will provide the basis for detailing required repair. The discrepancy will be forwarded for repair when the Physical Security Point of Contact (POC) decides it requires repair under this contract. As a Critical part of the IDS/ACS shall include this testing with the Semi-Annual testing of the IDS/ACS.

3.1.1.4. Intercom subsystem: The intercom subsystem integrates with the video system through outputs from the MDI IDS/ACS server, and utilizes a Stentofon P-9600 Master station, and three substations. The Physical Security Office receives discrepancy reports from the security force monitoring station when an apparent problem arises with a portion of the ACS. The discrepancy will be forwarded for repair when the Physical Security POC decides it requires repair under this contract. As a Critical part of the IDS/ACS shall include this testing with the Semi-Annual testing of the IDS/ACS.

3.1.1.5. Local Control Units: The IDS/ACS utilizes a Network Based MDI Dual Door Controllers to provide access control. The Physical Security Office receives discrepancy reports from the security force monitoring station when an apparent problem arises with a portion of the IDS/ACS. The discrepancy will be forwarded for repair when the Physical Security POC decides it requires repair under this contract.

3.1.1.6. Local Devices/Wiring: This equipment is the detection, activation, and monitoring devices connected to the systems described in 3.1.1.a-d, and all wiring that locally connects these devices to the systems. Samples are: coax from the camera to a fiber interface device; CATV cable from a device to an intranet router; twisted pair from an intercom station to a sub master. Operational discrepancies may be initiated from ACS server checks or reports from the monitoring personnel, or user complaints. The discrepancy will be forwarded for repair when the Physical Security POC decides it requires repair under this contract.

3.1.2. Acceptable Quality Level. Where reported problems do not require parts, components will be operational within 2 working days. When replacement parts are necessary, components will be operational within 2 working days of receipt of parts. An acceptable quality level of all component repairs within these time frames is 95%. The IDS/ACS server (and distribution components affecting more than 25% of the system) is considered system critical, and will require a 4-hour response time. Components affecting proper operation of perimeter access points are also considered system critical, and will also require a 4-hour response time. These system critical components must be repaired within 1 day, (including after hours and weekends) with an acceptable quality level of 100% of the time. Where parts are required, repair is to be accomplished upon of receipt of parts. All SCIF IDS/ACS (system 2) issues are considered system critical with a 4-hour response time and repair within 1 day or immediately upon receipt of parts.

3.1.3. Method of Surveillance. Reported problems are generated from various daily reports, and will continue to be reported until repaired. The Physical Security POC will compile the reported problems, forward pertinent items to the contractor, and track completion of repair.

3.2. Maintenance of Intrusion Detection System.

3.2.1. Description. The contractor shall maintain the electronic Intrusion Detection System, and all related subsystems in order to maintain a continuous operational status. These subsystems include a server, communications and distribution, local control units and local devices/wiring (3.2.1.1 through 3.2.1.4 below). The contractor shall provide troubleshooting, repair, and replacement of all defective components comprising these systems as required. Per the requirements of OPNAV INSTRUCTION 5530.14C, Navy Physical Security Manual, the contractor will provide each component with preventive maintenance and routine testing on a yearly basis (This equates to an average of 4 local controls with associated detection devices per week). As components fail, the contractor will perform troubleshooting and repair to limit loss of service to a minimum.

3.2.1.1. IDS Server: The IDS server is a SQL based computer running Monitor Dynamics Incorporated software, SAFEnet ver. 6.2.1.6 sp4. The system 2 SCIF level IDS server is an IDS/ACS running Software Monitor Dynamics SAFEnet 6.2.1.6 SP4 on a Windows 2003 server and SQL 2000. This server requires standard operating system maintenance, and indicates the current operating status of the primary components of the system. This server shall be checked for indications of problems with itself and other components on a regular basis, sufficient that acceptable quality levels of all equipment can be met. As this component is system critical, the acceptable quality level of repair is 100%. These system critical components must be repaired within 1 day, (including after hours and weekends) with an acceptable quality level of 100% of the time. Where parts are required, repair is to be accomplished upon of receipt of parts. A history log provides an itemized list of events, and will be the primary source of problem indications. Discrepancy reports from the monitoring security force will also be provided. The discrepancy will be forwarded for repair when the Physical Security POC decides it requires repair under this contract. This requirement will be applicable to system 1 and system 2.

3.2.1.2. IDS Communications and Distribution Equipment: This equipment is a combination of single-pair communications network that utilizes active and passive bridging throughout a wiring network of Navy-owned and leased telephone lines and an Ethernet Private Security Alarm VLAN. Problems with communications, false alarms, equipment malfunction are generally indicated during the IDS Server checks for both system 1 and system 2 referenced in 3.2.1.1, or daily reports generated by the security force monitoring personnel.

3.2.1.3. Local Control Units: The IDS utilizes Monitor Dynamics Remote Terminal Units, primarily RTU-100s and Network Local Controllers (NLC). The Physical Security Office receives discrepancy reports from the security force monitoring station when an apparent problem arises with a portion of the IDS. The discrepancy will be forwarded for repair when the Physical Security POC decides it requires repair under this contract.

3.2.1.4. Local Devices/Wiring: This equipment is the detection devices connected to the systems described in 3.2.1.a-c, and all wiring that locally connects these devices to the systems. Detection devices are door switches and PIR motion detectors of various makes and models. Discrepancies may be initiated from IDS server checks or reports from the monitoring personnel, or user complaints. The discrepancy will be forwarded for repair when the Physical Security POC decides it requires repair under this contract.

3.2.1.5. Preventive Maintenance and Routine Testing: This requirement is mandated in OPNAV INSTRUCTION 5530.14C for system 1 and in ICD 705 for system 2 SCIF level IDS/ACS. A flexible schedule will be agreed on between the Physical Security POC and the contractor to complete functional testing on all components of the system as described in 3.2.1.a-d. The goal is to test the components of the system at least once per year.

3.2.2. Acceptable Quality Level. Where reported problems do not require parts, components will be operational within 2 working days. When replacement parts are necessary and not available, parts will be ordered within two days, and components will be operational within 2 working days of receipt of parts. An acceptable quality level of all component repairs within these time frames is 95%. The IDS server (and distribution components affecting more than 25% of the system) is considered system critical, and will require a 4-hour response time. These system critical components must be repaired within 1 day, (including after hours and weekends) with an acceptable quality level of 100% of the time. Where parts are required, repair is to be accomplished within 1 day, including after hours and weekends) of receipt of parts.

3.2.3. Method of Surveillance. Reported problems are generated from various daily reports, and will continue to be reported until repaired. The Physical Security POC will compile the reported problems, forward pertinent items to the contractor, and track completion of repair.

3.3. Parts and Material. Replacements parts and Emergency Services.

Emergency Services are response(s)/service(s) provided during non-business hours deemed to be Critical Components IAW paragraph 3.1.1.1 by government personnel.

4. SECURITY

The security requirements for personnel assigned shall be in accordance with the requirements of SECNAV M5510.30 series and DoD 5105.21 V1-3. The highest-level security required is TOP SECRET with incidental Sensitive Compartmented Information. Personnel performing classified work or requiring access to classified material or spaces order shall possess both a DoD security clearance at the appropriate level and the need to know. Request for visit authorization shall be submitted in accordance with DoD 5220.22M (Industrial Security Manual for Safeguarding Classified Information), utilization of JPAS is acceptable, not later than 1 week prior to visit.

Contractor personnel assigned to this effort who require access to SCI data and spaces must possess a current SSBI with ICD 704 eligibility (which replaced DCID 6/4 eligibility).

Although there is no requirement for the contractor to access NATO on this contract per Naval Intelligence Security Policy Directive 17-008 those contractors that have SCI access shall be North Atlantic Treaty Organization (NATO) read-on and complete the derivative classification training; training is provided by the facility security officer. Specific requirements provided in the Department of Defense Contract Security Classification Specification, DD Form 254.

Anti-Terrorism/force Protection (AT/FP) briefings are required for all personnel (military, DOD civilian, and contractor) prior to commencement of foreign travel. Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO): https://jkodirect.jten.mil (prefix): JS; course number: US007; title: Level 1 Anti-terrorism awareness training, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. note: per OPNAVINST F3300.53C contractor employees must receive the AT/FP briefing annually.

As required by National Industrial Security Program Operating Manual (NISPOM) Chapter 1, Section 3, contractors are required to report certain events that have an impact on: 1) the status of the facility clearance (FCL); 2) the status of an employee's personnel clearance (PCL); 3) the proper safeguarding of classified information; 4) or an indication that classified information has been lost or compromised. Contractors working under SSC Pacific contracts will ensure information pertaining to assigned contractor personnel are reported to the Contracting Officer Representative (COR)/Technical Point of Contact (TPOC), the Contracting Specialist, and the Security's COR in addition to notifying appropriate agencies such as Cognizant Security Agency (CSA), Cognizant Security Office (CSO), or Department Of Defense Central Adjudication Facility (DODCAF) when that information relates to the denial, suspension, or revocation of a security clearance of any assigned personnel; any adverse information on an assigned employee's continued suitability for continued access to classified access; any instance of loss or compromise, or suspected loss or compromise, of classified information; actual, probable or possible espionage, sabotage, or subversive information; or any other circumstances of a security nature that would affect the contractor's operation while working under SSC Pacific contracts.

4.1. Operations Security (OPSEC). OPSEC is a five step analytical process (identify critical information; analyze the threat; analyze vulnerabilities; assess risk; develop countermeasures) that is used as a means to identify, control, and protect unclassified and unclassified sensitive information associated with U.S. national security related programs and activities. All personnel working under this task will at some time handle, produce or process Critical Information or Critical Program Information, and therefore all Contractor personnel must practice OPSEC. All work is to be performed in accordance with DoD OPSEC requirements, and in accordance with the OPSEC attachment to the DD254.

4.2. Cyber Security. None.

4.3. Base Access. Access to any Government facility for work performed under this requirement shall be at the unclassified security level. The technical requirements of this contract are unclassified. Contractor staff must be U.S. citizens, have a valid state of California driver’s license, and no record of a felony conviction. The contractor shall ensure all sub-contractors utilized during performance meet security requirements. The contractor is responsible for ensuring all personnel scheduled to perform work under this contract are enrolled in Defense Biometric Identification System (DBIDS) or have a Common Access Card (CAC) if computer Navy/Marine Corps Intranet (NMCI) access is required, are able to obtain a SPAWAR badge, and can be cleared for physical access to the San Diego Naval Bases by CNRSW Security. For contractors who do not already possess a favorably adjudicated background investigation, the company will be required to provide information to the SSC Pacific security office so a background investigation may be initiated. The COR on the contract will be the company’s interface between Industry and the SSC Pacific security office.

5. PLACE OF PERFORMANCE

Performance shall be within SSC Pacific commands located in Point Loma, Old Town Campus and within the San Diego metropolitan area.

6. PHYSICAL SECURITY POINT OF CONTACT

System 1: Lee Howell, Code 83352, 619-553-4620, Cell 619-887-6759 System 2: John Hume, Code 87100, 619-553-5148, Pager 888-520-8423

7. GOVERNMENT FURNISHED PROPERTY

Government furnished property is not anticipated.

8. OTHER REQUIREMENTS

8.1. Enterprise-Wide Contract Management Application (ECMRA).

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for SSC Pacific via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) D, Automatic Data Processing and Telecommunications, IT and Telecom- Telecommunications Transmission (D304) and Internet (D322) ONLY;

(5) S, Utilities ONLY;

(6) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address: https://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://www.ecmra.mil.”

For purposes of ECMRA reporting, the Product Service Code applicable to the contract/order is J063.

8.2. Deliverables. The Contractor shall provide the deliverables listed in the Contracts Data Requirements List (CDRL), Exhibit A, Contracts Data Requirements List, DD1423. Deliverables shall be prepared in contractor format where not otherwise specified by the Government.

9. PERFORMANCE REQUIREMENTS