P09_Performacne Work Statement Security Upgrade.docx

Performance Work Statement Department of Veterans Affairs (VA) Upgrade Video Management System Overview General Intent The Contractor shall provide professional services to include all labor, transportation, materials, apparatus, tools, equipment and permits necessary to prove the upgrade to the video management system in accordance with the performance work statement. All work shall be completed within 6 Months of contract award unless other time frames are acceptable prior to award.

Location(s):

Springfield Community Based Outpatient Clinic (SPCO) 25 Bond St Springfield, MA 01104

Belmont Street Community Based Outpatient Clinic (WOPC) 403 Belmont Street, 1st and 2nd Floor Worcester, MA 01604-1020

VA Central Western Massachusetts (Edward P. Boland Veterans Affairs Medical Center 421 North Main Street Leeds, MA 01053-9764 Project Specific Scope of Work This project will consist of installing PACS (Physical Access Control Systems), control devices and coordinating intrusion detection systems (IDS) into the camera/access control system for only buildings 1, 2, 16, 25 at the Leeds campus and the Springfield and Worcester outpatient clinics. The Springfield and Worcester clinics will need camera licenses to tie into the Salient CompleteView system.

It is the intent of VA CWM to replace the existing Physical Access Control Systems (PACS), consisting of all equipment and information required to verify, identity, and grant or deny access to individuals. The current system is antiquated and no longer functional.

This is a replacement for an existing system, so there is existing communication wiring and power for the devices listed below for the PACS system. For the IDS, wiring may need to be provided to local control panels and microswitches, etc. A list of all the zones and locations is included below. If there is an issue with the wiring, VA electricians can help troubleshoot and replace, provided staffing is available and advance notice is provided to the COR assistance is not guaranteed).

The new PACS shall be compatible with Salient and the existing HID readers. Currently Premisys is the basis of design and offers interoperability with Salient CompleteView system and alternate substitutions shall require demonstration to the COR that the substitution provides the same functionality and can offer interoperability with the camera system.

Premisys license will need to be procured and installed on a VA provided server on the VA system coordinating with VA OIT.

All PACS shall comply with HSPD-12, PPD-21, NIST SP 800-116, and VA 6500 Directive page 40 Section (4) Physical Security Controls requirements.

Data Gathering Panels shall be centrally located within a secure location that prevents panels from being damaged, tampered with, or accessed by unauthorized personnel. Field modules, such as reader modules, may be located on the secured side of a door in an enclosure that is locked or protected with a tamper switch.

All entry control devices shall be card readers, FIPS 201 compliant and hardwired to the PACS data gathering panel.

Electrified Locks, such as, magnetic locks, strikes, and mortise locks, shall be selected based upon life-safety requirements, locking arrangements, and level of security.

Request-to-exit devices shall be integrated in the electrified locksets in accordance with NFPA, IBC, and other applicable construction codes. Fail-safe-failsecure, field selectable locks must be used.

PACS Credentials and Enrollment Interface: With the development of the HSPD-12 based architecture, credentialing and badge issuance are separate from the PACS. Facility level enrollment station is required; however, credentialing and badge issuance will be accommodated by a separate non-PACS system. The facility level enrollment station will allow the PIV badge holder to be programmed for facility level access permissions. Credential validations shall comply with OMD 11.11, FICAM, and NIST SP 800-116, and shall use PKI authentication method.

Contractor shall provide all labor for installation and operational checks of all devices listed in section 2.1(equivalent substitutions subject to compatibility with existing systems). Floorplans shall be made available during the walkthrough. Substitutions requested by the contractor will need to be shown to be fully functional and interoperable prior to approval. Old access control panels and other equipment shall be disposed of by the contractor and coordinated with the COR prior to disposal.

The contractor shall program PACs readers and Intrusion detection system devices by coordinating with the physical security specialist.

Premisys software including license shall be installed on a server and programming for the 500 employees into the PACS system.

A videotaped 4-hour training session shall be provided showing the functionality of the PACS and intrusion detection systems and all the system capabilities that may need to be accessed by police services.

4 hours of phone support over the year following the installation shall also be provided as part of this contract.

Device listing and location

Standard Gap, 5W, 175VDC, 0.25 Amp, DPDT, C X 2 & 18" Armore

#FPO150-B100C8D8PE4M

Standard Gap, 5W, 175VDC, 0.25 Amp, DPDT, C X 2 & 18" Armore

#FPO150-B100C8D8PE4M

Standard Gap, 5W, 175VDC, 0.25 Amp, DPDT, C X 2 & 18" Armore

#FPO150-B100C8D8PE4M

Standard Gap, 5W, 175VDC, 0.25 Amp, DPDT, C X 2 & 18" Armore

#FPO150-B100C8D8PE4M

Card Access Upgrade SPOC

IP CCTV Recording System

Power Pro includes: Intel Xeon CPU; 16GB RAM; Windows 10 IOT 64 Bit;Warranty:3 year Basic: Keyboard & mouse included, Shared OS Drive rev:007

camera license

Intrusion Detection System SPOC

Card Access Upgrade WOPC

IP CCTV Recording System WOPC

Power Pro includes: Intel Xeon CPU; 16GB RAM; Windows 10 IOT 64 Bit;Warranty:3 year Basic: Keyboard & mouse included, Shared OS Drive rev:0076752.18

camera license

Intrusion Detection System

List of Intrusion Detection Zones and sensors:

PHARMACY BLDG 1

CANTEEN BLDG 1 (B246 & 260)

ARMORY bldg 25

WAREHOUSE bldg 16

AGENT CASHIER bldg 1

IT room 213 and 208 building 2

Schedule All on-site work (including cleanup) shall take place during the following times, unless otherwise approved by the COR:

7:00 AM Est - 4:30 PM Est Monday through Friday (excluding Federal holidays)

When the contractor’s work interferes with hospital functions, such as when work produces excessive noise, odors, dust, utility service interruptions, or other interferences with normal hospital operations that cannot be contained within the area of work, the contractor shall schedule said work at other than normal hours and as directed by the COR at no additional cost to the Government. In the event of an emergency, contractor services may be stopped and rescheduled at no additional cost to the government.

Debris Removal The Contractor/Installer shall be required to remove waste materials and debris daily (unless otherwise authorized by COR) from the campus. All waste material and debris shall be removed off the site by the contractor and shall be disposed of in accordance with applicable State and Federal regulations.

VHA Supplemental Contract Requirements for Combatting COVID-19

1. Contractor employees who work in or travel to VHA locations must comply with the following:

a. Documentation requirements:

1) If fully vaccinated, contractors shall show proof of vaccination.

i. NOTE: Acceptable proof of vaccination includes a signed record of immunization from a health care provider or pharmacy, a copy of the COVID-19 Vaccination Record Card (CDC Form MLS-319813_r, published on September 3, 2020), or a copy of medical records documenting the vaccination.

2) If unvaccinated, contractors shall show negative COVID-19 test results dated within three calendar days prior to desired entry date. Test must be approved by the Food and Drug Administration (FDA) for emergency use or full approval. This includes tests available by a doctor’s order or an FDA approved over-the-counter test that includes an affiliated telehealth service.

3) Documentation cited in this section shall be digitally or physically maintained on each contractor employee while in a VA facility and is subject to inspection prior to entry to VA facilities and after entry for spot inspections by Contracting Officer Representatives (CORs) or other hospital personnel.

4) Documentation will not be collected by the VA; contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

2. Contractor employees are subject to daily screening for COVID-19 and may be denied entry to VA facilities if they fail to pass screening protocols. As part of the screening process contractors may be asked screening questions found on the COVID-19 Screening Tool. Check regularly for updates.

a. Contractor employees who work away from VA locations, but who will have direct contact with VA patients shall self-screen utilizing the COVID-19 Screening Tool, in advance, each day that they will have direct patient contact and in accordance with their person or persons who coordinate COVID-19 workplace safety efforts at covered contractor workplaces. Contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

3. Contractor must immediately notify their COR or Contracting Officer if contract performance is jeopardized due to contractor employees being denied entry into VA Facilities.

1. For indefinite delivery contracts: Contractor agrees to comply with VHA Supplemental Contract Requirements for any task or delivery orders issued prior to this modification when performance has already commenced.