P01 STVHCS PACS SOW.docx

South Texas Veterans Health Care System Physical Access Control System

STATEMENT OF WORK

1.0 SCOPE

The South Texas Veterans Health Care System (STVHCS) requires replacement of current C-Cure 9000 PACS with a turn-key PACS that meets all VHA & USG FIPS and PACS requirements at locations outlined in the below SOW.

2.0 DESCRIPTION OF WORK

a. Contractor shall replace the existing Physical Security and Access Control system (PACS) with a system that is listed in order of priority in the event there is a conflict between the standards.

1. FIPS 201 / PACS 13.02 / FIPS 140-2 compliant, and meets requirements of:

2. VA Directive 0735, “Personal Identity Verification (PIV) of Federal Employees and Contractors”.

3. VA Handbook 0730/2, “Security and Law Enforcement”.

4. VA Handbook 6500, “Information Security Program”.

5. NIST Special Publication SP800-53REV3, “Recommended Security Controls for Federal Information Systems and Organizations”.

6. NIST SP800-116

b. The contractor will supply all software, hardware, database conversions, programming, and additional equipment/parts as necessary to deliver a fully functional Physical Access Control System (PACS) as defined in the OEM service manual or other related OEM documentation, covered by this contract, in accordance with the Conformance Standards Section. The Contractor stipulates by submission of a response to this solicitation such proprietary software, upgrades and parts will be sourced from the manufacturer. All proprietary licensed software and parts supplied shall be of current manufacture and have full compatibility with existing equipment. Documentation of intended parts source shall be provided to the Contracting Officer upon request. All parts necessary for the installation and certification of this system shall be furnished as part of this contract. Refurbished or used parts will not be acceptable.

c. All card readers are to function with all PIV class cards and have full 2FA with pin pad, that validates USG PIV certificates.

d. Design and construction are to include one for one replacement of existing field points.

e. In addition to equipment replacement, contractor is to standardize wiring, color coding, and device configurations as equipment is replaced including CAT6 cabling.

f. All detection devices on the system are to be configured and installed as three state devices.

g. All peripheral equipment shall be secured in the security network communication closets, with the exception of end of line field devices.

h. All buildings will have at minimum, first floor perimeter security (exterior doors monitored by the system) and one door per building is to be controlled by a card reader from the system. Additional perimeter door readers will be selected by the design team using the number of staff occupants, type of security required for function, size of building, and distance between entrance doors. 100 employees or more shall require additional reader doors. An employee only controlled areas such as Pharmacy shall require additional reader doors. A distance of 150 feet or more between entrances shall require additional reader doors.

i. This system is to monitor, control, and operate the Audie L. Murphy Memorial VA hospital ALMD, Kerrville VAMC, North Central Federal VA Clinic, Victoria VA Clinic, Villa Serena, and VA Polytrauma Transitional Housing (PTRP), and Northwest Healthcare Center (NWHCC).

j. This system will operate under a single database allowing for global, instantaneous configuration changes.

k. The system will also be used to control the road/gate entrances to the Medical Center by using hydraulic bollards or electrical wedge gates. The expansion shall allow full electrical/electronic control of all first floor building entrances and station entrance gates, to include securing or unlocking and monitoring from the system work stations.

l. Electronic locking of doors to be fail secure for ingress and shall allow free egress, except in the CLC- buildings. In the CLC doors are controlled by time code for card in/card out operation.

m. Design and construction are to use existing pathways where feasible and require new pathways where needed.

n. Design and construction will size pathways to a maximum fill rate of 50%.

o. Existing pathways are to be cleared of any abandoned conductors, prior to using the pathway.

p. No splices or connections will be permitted outside of communications closets, except for end device connections, unless specifically approved by the COTR in writing.

q. All Nodes (controller) to device wiring to be new and unbroken.

r. Warranty coverage for the installed system shall be a minimum of 1 full year from date of project acceptance

1. Covered hardware failure

2. Programming

3. Software licensing

4. Technical consulting / support, to include on-site support as needed.

s. Full maintenance/system management and administration training on the installed system for at least Five STVHCS staff members

1. Provided onsite STVHCS, or at the ACS’ manufacturer’s training location.

2. Including tuition and travel costs, if applicable.

t. Full as built drawings must be provided to STVHCS upon completion of project.

u. Complete assessment of current C-Cure 9000 system must be completed before installation to verify current operating status, data corruption and correct client / staff count.

v. Vendor must complete enrollment of all STVHCS employees and contractors into new PACS, with training to any STVHCS staff as needed on the enrollment process. Vendor will also need to create user groups, door schedules etc. with assistance from VHA staff for details.

w. Any network hardware i.e., laptops needed for any portion of the installation must be provided by the vendor.

x. Fisher House Requirements:

1. Requires an enterprise hotel solution that enables on site staff to monitor, run reports on access, issue visitor and staff access cards, must be able to integrate to main PACS system if and when necessary for monitoring purposes only.

2. No PIV Class requirement for this location, all materials must be able to replace or integrate with current SALTO system.

y. PACS must be able to control, modify and monitor all locations from Audie L. Murphy.

z. Provide the ability to troubleshoot, repair and install components of the PACS such as mag locks, door operators, contact point etc. on an as needed basis during the installation.

3.0 VENDOR SPECIFIC REQUIREMENTS

a. Must be currently registered in SAM’s and VHA Vista vendor system.

b. Must be a certified installer / integrator of ALL the following PAC systems currently installed and owned by VA:

c. Must have technicians in the South Texas area to respond to STVHCS service calls in a reasonable amount of time.

d. Must use a manufacturer with products that have been proven to work within the VHA system and meets the FIPS 201, PACS 13.02 and FICAM compliance and is an approved USG PACS Validation Infrastructure product listed on idmanagement.gov.

e. Must have a Certified System Engineer ICAM PACS Technician.

f. Manufacture parts must be a GSA Approved Partner.

4.0 THE PHYSICAL SECURITY SYSTEM AND MANAGEMENT SOFTWARE MUST HAVE:

a. Support a thin client model

b. Microsoft Active Directory Integration

c. Administrative users can be configured to use Microsoft Active Directory for authentication.

d. Capability to create badge templates, badge printing, taking user photographs, and enrolling users into the user database.

e. Areas (comprised of a group of doors) and users can be assigned entry permission based on schedules.

f. Administrative users can be assigned permissions. User profiles can be tailored very specifically.

g. Cardholder credentials can be edited, including system wide card formats.

h. Provide a view of events and alarms in the system. Alarm and event views can be filtered based on several criteria.

i. Events (contact closure inputs or card access denied, for example) can be associated to actions (activate output contact closures, send an e-mail, etc.).

j. Standard and custom reports can be created.

k. Provides a log of all administrative use of the system, arranged by user.

l. Ability to allow system to be synchronized with data from either external SQL databases or Microsoft Active Directory.

m. License files (capacity upgrades or feature additions) can be added.

n. Allow a user to administer the system, by performing tasks such as IP address assignment.

o. Configuration can be backed up to an external server.

p. Previously backed up configuration can be restored from an external server.

q. Warm standby redundancy

r. HTTP/S URLs can be invoked as a result of any event or alarm. Event data can be inserted in the URL to integrate with any external application that accepts URL invocations

s. SQL database servers, application servers and any other network servers need to be virtual machines.

t. All software must have a current VA Enterprise Risk Analyses (ERA) approved on the VA Technical Reference Model (TRM).

5.0 FACILITY POINT OF CONTACT

a. VA Contact Person: Mr. Abdias Villanea, Mr. Lavonne Melton, or Mr. Alrufaiee Omar

b. Contractor Telephone Number(s) of Service Department: 210-617-5300 ext. 15721

6.0 Additional Charges

There shall be no additional charge for time spent at the site (during or after the normal hours of coverage) awaiting the arrival of additional FSE and/or delivery of parts.

7.0 COMPLIANCE WITH SECURITY REQUIREMENTS

8.0 TECHNICAL REQUIREMENTS

The Contractor shall deliver the hardware and equipment with the following requirements:

g. Provide a timeline for work progress that should not exceed 180 days from the time of contract award to deliver a complete working system.

9.0 SECURITY

10.0 DEFINITIONS/ACRONYMS

f. USG – United State Government

11.0 INFORMATION SYSTEMS OFFICE, INFORMATION PROTECTION

The contractor will not have access to VA Desktop computers, nor will they have access to online resources belonging to the government while conducting services. If removal of equipment from the VA is required, any memory storage devices, such as hard drives, solid state drives and non-volatile memory units will remain in VA control and well not be removed from VA custody.

If access is needed the ISSO and COR will be contacted.

12.0 PRIVACY OFFICER

The contractor will not have access to protected Patient Health Information (PHI) nor will they have the capability of accessing patient information during the services provided to the VA and if removal of equipment from the VA is required, any memory storage devices, such as hard drives, solid state drives and non-volatile memory units will remain in VA control and will not be removed from VA custody. All research data available for Contractor analyses is de-identified.

13.0 RECORDS MANAGER

There will be no federal records created, maintained, used or dispositioned with this contract; regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.].

14.0 TYPE OF CONTRACT

STVHCS anticipates award of a FIRM FIXED PRICE contract based on the contents of this solicitation.

15.0 SECURITY REQUIREMENTS

The C&A requirements do not apply, and a Security Accreditation Package is not required.

16 SITE VISIT

A site visit is encouraged for the location of all the STX PACS systems for this requirement, interested Offerors shall contact the below points of contact via email to schedule a site visit available in the below dates. Prospective Offerors are responsible for all expenses related to the site visit. This site visit is not to provide a proposal, but to prepare a capability statement.

Points of Contact to schedule a site visit Omar Alrufaiee omar.alrufaiee@va.gov Lavone Melton lavonne.melton2@va.gov Frank Mendoza francisco.mendoza@va.gov

Available Site Visit Days 01/25/2023 08:00 AM to 1:00 PM 01/26/2023 08:00 AM to 1:00 PM 01/27/2023 08:00 AM to 1:00 PM 01/30/2023 08:00 AM to 1:00 PM 01/31/2023 08:00 AM to 1:00 PM