NIGC_Draft_PWS_-_Access_Control_System_1.docx

NATIONAL INDIAN GAMING COMMISSION (NIGC)

Performance Work Statement

(PWS)

NIGC Headquarter Relocation Physical Access Services

25 April 2024 Content

BACKGROUND

The National Indian Gaming Commission (NIGC) was created by Congress through the Indian Gaming Regulatory Act of 1988 (P.L. 100-497). The NIGC’s mission is to (1) promote tribal economic development, self-sufficiency, and strong tribal government; (2) maintain the integrity of the Indian gaming industry; and (3) ensure that Tribes are the primary beneficiaries of their gaming activities.

NIGC is relocating the headquarter office to 550 12th St NW, Washington DC.

SCOPE

The NIGC is seeking security system installation, monitoring, and maintenance services for its office headquarters located at 550 12th Street SW, Washington, DC 20024 on the ninth floor. The selected contractor will install PIV-capable card readers and provide 24x7 physical access control to secure the premises, employees, guests, and valuable assets. The areas that need card readers installation and maintenance are the entrance double door, staircase access, 30 offices, and the Local Area Network (LAN) room. One panic button will be installed at a strategic location.

All equipment shall be new, unused, and covered under the manufacturer’s warranty period. The warranty period shall be no less than 12 months and the warranty period shall start at the time of NIGC acceptance after installation.

ACCESS CONTROL TECHNOLOGY

The contractor will install and maintain a physical access control system (PACS) suitable for U.S. Government buildings including Card readers for identity validation, and the physical access control infrastructure. Card Readers infrastructure must support PIV integration for future HSPD-12 compliance. NIGC wants the option to use mobile apps on selected Apple IOS devices that are integrated with the PACS for cardless entry.

FEATURES:

NIGC authorized staff must be able to:

· Have continuous visibility into the health system components from a central location.

· Grant and revoke user access authorization at any time based on established processes.

· Monitor access to the facility in real-time.

· Review audit logs for unauthorized changes, failed and successful login attempts.

· Securely access the management interface from the internet.

· Configure automated access notifications for selected doors.

· Receive alerts for any component malfunction.

· Obtain automatic usage reports.

· Issue temporary Access Cards, and limit activation time.

The installed system must be temper-resistant, making it extremely difficult to forge or replicate authorized credentials. Components must meet industry standards and comply with the following federal requirements:

· Homeland Security Protection Directive-12: HSPD-12 as outlined in OMB memo M-06-18.

· Federal Information Processing Standards (FIPS) 201-3 as published by NIST. Publication

· FIPS 201 Approved Products List as identified under IDManagement.gov.

HARDWARE AND SOFTWARE

This will be a Firm Fixed Price contract to purchase an access control system. It is anticipated to use NAICS 334290, Other Communications Equipment Manufacturing. The RFQ will be using a Small Business set aside, the Small Business Size Standard is 800 Employees. There is no GFE/GFP provided on this contract. The contractor is responsible for providing the hardware and software along with their installation, maintenance, and updates.

STORAGE

Physical Access logs must be stored online for 90 days to support incident analysis. The access logs can be in any readable format but must capture the card identifier, the owner of the card, the access point, and the time of entry. These logs must be available for both successful entries and failed entry attempts. After the 90-days period, the logs can be archived and remain retrievable for at least 1 year.

CLOUD BASED SYSTEM

NIGC requires a cloud-based solution for administration and storage to eliminate the need for on-premises Database and access management servers.

CONTRACTOR REQUIREMENTS

The contractor will perform the following tasks at the 550 12th Street SW, Washington, DC facility:

· Complete the installation and testing of all Physical Access system components.

· Provide programmable access cards for NIGC users as per provided user list.

· Configure access based on list and authorized location provided by NIGC.

· Validate that NIGC feature requirements are met.

· Provide complete set of “As-Built" system drawing that clearly shows PACS component, server, workstation (Client) and other equipment installed.

· Provide operator training and documentation on the use of the system including how NIGC staff can execute operations tasks such as Provisioning/De-provisioning, privilege administration, log retrieval, systems notification handling, and other pertinent functions.

· Perform required software updates and maintenance so the solution always operates with the latest software and patches.

· Verify operability and functionality of all components and systems.

· Maintain 24x7 availability to troubleshoot and resolve card readers and access issues.

· Ensure the system remains operational to secure the environment during power outages.

· Provide operations and maintenance (O&M) of the system for 12 months from the contract award date and following option years. In accordance with FAR 52.217-9 four option years will be available, for a total of 5 years.

QUALITY CONTROL

The contractor is required to demonstrate that the system runs without offline errors, reader errors, and alarm errors for a period of 15 business days after the installation work is completed. System acceptance requires that this test is fully and successfully completed.

The contractor will be responsible for replacing any equipment made deficient through contractor negligence or misconfiguration.

INSURANCE CERTIFICATE

The Service Contractor shall furnish Certificate(s) of Insurance evidencing the coverage requirements for the Potomac Plaza Building. Certificate(s) of Insurance must be provided before Service Contractor commences Contract Duties or Contract Duties will not be allowed to commence. All policies will be written by companies licensed to do business in the State of Washington, DC and which have a rating by Best's Key Rating Guide not less than “A-/VIII”.

NIGC RESPONSIBILITIES

NIGC will be responsible for the following:

· Provide main power source for equipment operation.

· Develop physical access control policies and procedures that determine internal administration and access provisioning. Such internal documents can be shared with the contractor after the award, if required for the PACS configuration.

MEETINGS

Contractor personnel shall attend the following meetings, in addition to other ad-hoc meetings as required. Highly recommend virtual attendance for meetings if possible.

Kickoff Meeting: The Contractor shall schedule a Kickoff Meeting within five business days after award of the contract to make introductions, discuss high level insights, and acclimate the contractor to the new environment.

Ad-Hoc Meetings: The contractor shall also attend meetings within other NIGC groups as required by the COR.

Monthly Meetings: The Contractor shall have a monthly virtual meeting to brief the COR on monthly reports, discuss issues or obstacles impeding progress, recommended solutions, and issues and resolutions in resource planning.

HOURS OF OPERATION

Core Service Coverage: 8:00 AM – 4:30 PM ET Monday – Friday. Contractor personnel shall perform on-site duties as required under this PWS during core service coverage hours.

HOLIDAYS

The NIGC observes the following federal holidays and will not require on-site contractor services during these days.

During federally observed holidays, the Contractor will not be required to provide on-site services. NIGC facilities shall be closed, Physical Access monitoring shall remain functional, but the contractor shall not provide on-site services. The following are the federal holidays observed by NIGC:

i. New Year’s Day: January 1.

ii. Martin Luther King Jr.’s Birthday: 3rd Monday in January

iii. Washington’s Birthday/Presidents’ Day: 3rd Monday in February

iv. Memorial Day: Last Monday in May

v. Juneteenth: June 19

vi. Independence Day: July 4

vii. Labor Day: 1st Monday in September

viii. Columbus Day: 2nd Monday in October

ix. Veterans’ Day: November 11

x. Thanksgiving Day: 4th Thursday in November

xi. Christmas Day: December 25

PERIOD OF PERFORMANCE

The period of performance for this contract is one twelve-month base award and four 12-month option periods. Dates will be dependent upon the contract award date.

OUTGOING TRANSITIONS

When the order is nearing completion, the contractor shall implement a sixty (60) day transition-out period in accordance with the approved Transition-Out Plan. During the transition-out period, the Contractor shall ensure a smooth transition of service, perform a joint inventory and audit of the transferred documentation, and coordinate and address the status of any issues associated with the transition. The plan should be submitted for approval no later than ninety (90) days before order completion.

PLACE OF PERFORMANCE

Installation and Maintenance services are to be performed between 8:00 am and 4:30 PM ET, Monday - Friday. Services shall be performed at the Contractor’s place of business and the NIGC headquarters located at the following addresses:

550 12th Street, SW, Washington, DC 20024

TRAVEL

NO TRAVEL IS ANTICIPATED

SECURITY CONSIDERATIONS

Contractor personnel are required to adhere to personnel security and suitability requirements for public trust positions as outlined in Code of Federal regulations[endnoteRef:2] § 731.106. They shall comply with all applicable provisions of the Privacy Act of 1974 and NIGC regulations concerning the confidentiality and protection of information entrusted to them. [2: https://www.govinfo.gov/content/

ONBOARDING PERIOD

The onboarding period will occur immediately upon award to accommodate all security and access requirements for personnel on contract. The onboarding period will last until all personnel on contract have completed all required clearances and access requirements and are able to begin the transition-in period of work. THE ONBOARDING PERIOD IS NON-BILLABLE. The contractor shall not invoice for hours burned during the onboarding period.

Background Checks Must obtain and maintain, a favorably adjudicated background investigation (BI) at a level equal to that which would be conducted for a federal employee with similar duties and responsibilities.

All contractor personnel and any subcontractor personnel who will need access to Government facilities or information for the performance of work under this Order must first have a favorably adjudicated BI conducted by the Office of Personnel Management (OPM). This determination is made as part of the onboarding process.

The costs for performing the investigations are the responsibility of the contractor and the contractor is responsible for any costs associated with contractor personnel applying for a BI.

Hours spent by any individual, contractor employee or otherwise, to complete the forms and any other paperwork required by the Government to process background clearances, or for the purpose of obtaining required fingerprints, are not billable to the Government.

Time spent by any individual to participate in interviews conducted by OPM or its designees, for the purpose of completing BIs, is not billable to the Government. The Government considers these costs to be overhead and estimates that between 3 and 10 hours may be required on the part of an individual to complete background clearance processing.

The contractor shall assist with BIs and security clearances as applicable to ensure that all contractor personnel associated with the project have a security clearance commensurate with the data being processed. Appropriate BIs and security clearance-related documentation shall be submitted by the contractor no later than ten calendar days after award or ten calendar days prior to any new employee starting work under the Order.

ACCESS TO NIGC FACILITIES AND INFORMATION SYSTEMS

Contractor Access to NIGC Facilities and Information Systems are contingent based upon the clauses cited below:

(a) HSPD-12 and PIV. Individuals engaged in the performance of this award as employees, consultants, or volunteers of the contractor must comply with all applicable Homeland Security Presidential Directive-12 (HSPD-12) and PIV procedures, as described below, and any subsequent NIGC or Government-wide HSPD-12 and PIV procedures/policies[endnoteRef:3]. [3: https://www.cac.mil/Portals/53/Documents/m-11-11.pdf

(b) A U.S. citizen or resident alien engaged in the performance of this award as an employee, consultant, or volunteer of a U.S. firm may obtain access to NIGC facilities or logical access to NIGC's information systems only when and to the extent necessary to carry out this award and in accordance with this clause. The contractor's employees, consultants, or volunteers who are not U.S. citizens or resident aliens as well as employees, consultants, or volunteers of non-U.S. firms, irrespective of their citizenship, will not be granted logical access to U.S. Government IT systems and must be escorted to use U.S. Government facilities (such as office space).

(c) (1) No later than five business days after award, the Contractor must provide to the COR a complete list of employees that require access to NIGC facilities or information systems.

(2) Before a contractor (or a contractor employee, consultant, or volunteer) or subcontractor at any tier may obtain a NIGC ID (new or replacement) authorizing the individual routine access to NIGC facilities in the United States, or logical access to NIGC's information systems, the individual must provide two forms of identity source documents in original form to the Enrollment Office personnel when undergoing processing. One identity source document must be a valid Federal or State Government-issued picture ID. Contractors may contact the NIGC Security Office to obtain the list of acceptable forms of documentation. Submission of these documents, including documentation of security BIs, is mandatory for the Contractor to receive a PIV/Facilities Access Card (FAC) card and be granted access to any of NIGC's information systems. All such individuals must physically present these two source documents for identity proofing at their enrollment.

(d) The Contractor must send a staffing report to the COR by the end of each quarter. The report must contain the listing of all staff members with access that separated from or were hired under this contract in the past ninety (90) calendar days. This report must be submitted even if no separations or hiring occurred during the reporting period. Failure to submit the ‘Contractor Staffing Change Report’ each month may, at NIGC’s discretion, result in the suspension of all logical access to NIGC information systems and/or facilities access associated with this contract. NIGC will establish the format for this report. This report shall also include all GFE and GFE tracking numbers for each employee.

(e) Contractor employees are strictly prohibited from sharing logical access to NIGC information systems and Sensitive Information. They will be required to sign a non-disclosure agreement[endnoteRef:4]. NIGC will disable accounts and revoke logical access to NIGC IT systems if Contractor employees share accounts. [4: https://www.dcsa.mil/Portals/91/Documents/CTP/CUI/DOD-CUI_Non-Disclosure_Agreement.pdf]

(f) NIGC, at its discretion, may suspend or terminate access to any systems and/or facilities when a potential Information Security Incident or other electronic access violation, use, or misuse incident gives cause for such action. The suspension or termination may last until such time as NIGC determines that the situation has been corrected or no longer exists.

(g) The Contractor shall notify the COR at least ten business days prior to the Contractor employee’s removal from the contract. For unplanned terminations of Contractor employees, the Contractor must immediately notify the COR, and the CO. The Contractor or its Facilities Security Officer must return NIGC PIV/FAC cards to the NIGC within 24 hours of the departure of the employee or within 24 hours of completion or termination of the contract, whichever occurs first. The TPOC will email the COR with confirmation that the PIV card has been returned immediately upon receiving it.

(h) The contractor is required to insert this clause including this paragraph (h) in any subcontracts that require the subcontractor, subcontractor employee, or consultant to have routine physical access to NIGC space or logical access to NIGC's information systems.

UNAUTHORIZED WORK

No payments will be made for any unauthorized supplies and/or services or for any unauthorized changes to the work specified herein. This includes any services performed by the Contractor of their own volition or at the request of an individual other than a duly appointed Contracting Officer (CO). Only a duly appointed CO is authorized to change the specifications, terms, and conditions under this effort.

NIGC Performance Work Statement | Physical Access Services Page | 2