P09 - SOW (Knightscope).pdf

Statement of Work Security Robot

1.0 SCOPE OF SERVICES

1.1 Project Overview. The South Texas Health Care System (STVHCS), Audie L. Murphy (ALM)

Memorial VA Hospital project (K5) is the deployment of an Autonomous Data Machine (“ADM”) to patrol mutually agreed, specified areas within ALM (parking lots, VA ground, pedestrian gates, exterior building, lobby, etc.) providing video, audio, thermal and signal monitoring, as well as alerts to defined incidents and events.

The purpose of the patrols is to supplement existing Police Operations with automated data gathering, providing additional coverage for medium to high traffic areas, while VA Police staff handle additional workload and developing situations.

VA Police intend to evaluate the application of this technology in a controlled environment and potentially deploy robots at additional locations.

1.2 Project Purpose. The purpose of this project is to enhance the security team’s ability to monitor activity within the patrolled areas, enforce campus parking requirements, identify and respond to anomalies and events in a timely manner, increase the visibility of security in defined areas to deter criminal, noncompliant and other undesirable behavior, and to demonstrate the functionality of the ADM for consideration in other applications for STVHCS business interests.

This project will act as the test case, with the intention of having this product available to other facilities interested in taking advantage of the technology and enhancements to the existing Security Profile.

1.3 Services Scope. Contractor is responsible for the following Services and scope, as further described and detailed in Section 5.0 below, in the context of the overall Project:

1.3.1 Deployment and set-up

1.3.2 User Interface

1.3.3 Incident/Event Notification Programming

1.3.4 Training & Support

1.3.5 Maintenance & Repairs

2.0 PROJECT OVERSIGHT, STAFFING AND ROLES AND RESPONSIBILITIES

2.1 Project Oversight.

2.1.1 Contractor Point of Contact. Contractor will designate a point of contact for management and oversight of the performance of Services detailed herein and for any and all issues relating to this SOW including but not limited to quality, completion of deliverables, issue management, accuracy and timeliness of time reporting and invoicing.

3.0 PERIOD OF PEFORMANCE (PoP)

3.1 The Government intends to award a single VA Police Facility award with a PoP that shall be 12-months from date of award. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

4.0 PLACE OF PREFORMANCE

Shall be period of delivery and acceptance. Contractor will perform install during normal hours of operation 8am until 5pm, Monday thru Friday. Or as listed in the maintenance and repairs part of the contract.

5.0 SERVICES TO BE PERFORMED

5.1 Contractor shall perform the following:

5.1.1.1 Shipment of the outdoor patrolling ADM, two (2) charging station, two

(2) monitoring signs and any other miscellaneous supporting materials to Client site.

5.1.1.1.1 The ADM will be outfitted with Client branding decals approved by both Client and Contractor. Decals will be designed, produced and applied to the ADM by Contractor personnel.

5.1.1.1.2 The Delivery of Five (5) Knightscope Security Operations

Center (KSOC) Licenses with Each ASR

5.1.1.2 Contractor representative shall inspect the equipment upon delivery to determine whether it is in good and serviceable condition. If the equipment is not in good and serviceable condition, Contractor will make arrangements at its sole expense to return and redeliver the equipment, in which case the start of the Term shall automatically be postponed until Contractor delivers equipment that is in good and serviceable condition at Contractor’s sole expense. Once delivered, Client shall keep the equipment reasonably secure and in good condition and working order (ordinary wear and tear excepted), except for the maintenance and repair that is Contractor’s responsibility as set forth herein.

5.1.1.3 Map the patrol area as described below

5.1.1.3.1 The ADM will patrol desired areas with sufficient

cellular coverage as mutually agreed upon by Client and Contractor.

5.1.1.4 Equip the ADM to perform the following functions:

5.1.1.4.1 Detect humans and alert to human presence during

times prescribed by Client.

5.1.1.4.2 Detect/capture license plates throughout the

environment, and support parking enforcement of various zones.

5.1.1.4.3 Capture thermal readings (surface temperatures) and alert to detections above/below thresholds requested by Client.

5.1.1.4.4 All of the above data will continue to be available to Client via the contractor’s User Interface (User Interface, see 3.1.2)

5.1.1.5 ADM may only patrol in areas with sufficient network (4G LTE) coverage. ADM may only be assigned patrol in areas deemed safe and operationally feasible in terms of obstacles and pathway width (minimum of 60” unobstructed). Contractor engineers have final authority on all patrol areas.

5.1.1.6 Work with Client personnel to mount the charging stations in mutually acceptable locations within the patrol area. This will require dedicated 110v power to each charging station, physical mounting of the charging box to a wall, post or stand, and adhering the charging pad to the floor.

5.1.1.7 Assignable patrol zones/locations will be mapped within the overall patrol area for the ADM. Client may request additional assignable patrol zones/locations within the patrol area at any time.

5.1.1.8 Contractor will program custom audio broadcast messages for Client, as desired, within the functional capabilities of the ADM.

5.1.2 User Interface

5.1.2.1 Contractor will host the Interface and will provide Client with information sufficient to allow Client to access the Interface through a Web browser. Client is responsible for providing, at Client’s own expense, all necessary telephone lines, Internet connections, equipment, software (including a compatible Web browser), and services for Client to effectively access the Interface. Client is responsible for upgrading and configuring Client’s internal systems (e.g. network settings, Internet routing, firewalls, and Web browsers) to be and remain compatible with and optimize the performance of the Interface. Contractor will use commercially reasonable efforts to support the Interface, and maintain its accessibility for Client during the Term. During the Term, Contractor will use commercially reasonable efforts to provide Client with all generally released updates and upgrades to the Interface at no additional charge.

5.1.3 Alert Notification Programming

5.1.3.1 Program event parameters within the functional capabilities of the software, as desired by Client. This may include:

5.1.3.1.1 Signal detection event parameters;

5.1.3.1.2 Thermal detection event parameters;

5.1.3.1.3 Human detection event parameters;

5.1.3.1.4 License Plate detection event parameters;

5.1.4 Training & Support

5.1.4.1 Provide in-person training for personnel authorized by Client to access/use the User Interface;

5.1.4.2 Provide remote training on the User Interface to Client-authorized users as needed.

5.1.5 Maintenance & Repairs

5.1.5.1 Contractor will, at its sole expense, provide ongoing technical support and maintenance for the Equipment during the Term except with respect to loss or damage to the Equipment caused by Client’s negligence or failure to keep the Equipment reasonably secure. Contractor will attempt to provide technical support remotely. In the event that Contractor is unable to rectify an issue remotely, it will dispatch its personnel or agent to Client’s location. Client will provide Contractor with physical access to the Equipment at all times during the Term to perform such support and maintenance 24/7.

Client agrees that Contractor may, in lieu of repairing equipment previously provided and in its sole discretion, replace any such Equipment with replacement Equipment of the same type as is set forth in this SOW and such replacement Equipment shall be treated as the originally delivered Equipment for all other purposes under this agreement.

6.0 INFORMATION SYSTEMS OFFICER, INFORMATION PROTECTION:

The contractor will not have access to VA Desktop computers, nor will they have access to online resources belonging to the government while conducting services.

7.0 PRIVACY OFFICER:

The contractor will not have access to Patient Health Information (PHI) nor will they have the capability of accessing patient information during the services provided to the VA.

8.0 INVOICES AND PAYMENT

A. Payment to be made monthly, in arrears, following satisfactory performance by Contractor’s personnel and upon receipt of a properly prepared invoice.

B. Contractor shall be required to invoice through the Tungsten System at http://www.tungsten-network.com/us/en/veterans-affairs/. Additional information regarding Tungsten shall be provided upon award.

C. The contract shall have current registration in the System for Award Management (SAM) for this solicitation; URL: www.sam.gov.

D. The invoice MUST be itemized to include the following information. Any information listed below, and not provided on an invoice, will render that invoice incomplete and the invoice will be returned for immediate correction.

9.0 GOVERNMENT HOLIDAYS:

A. The Government hereby provides notice and Contractor hereby acknowledges receipt that Government personnel observe the listed days as holidays:

New Year's Day January 1st Martin Luther King's Birthday Third Monday in January Washington’s Birthday Third Monday in February Memorial Day Last Monday in May Juneteenth National Independence Day in June Independence Day July 4th Labor Day First Monday in September Columbus Day Second Monday in October Veterans Day November 11th Thanksgiving Day Fourth Thursday in November Christmas December 25th

B. In addition to the days designated as holidays, the Government observes the following days:

• Any other day designated by Federal Statute

• Any other day designated by Executive Order

• Any other day designated by the President’s Proclamation

C. It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation. In the event the Contractor's personnel work during the holiday, they may be reimbursed by the Contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked.

10. PROGRAM OFFICE POINT OF CONTACT:

Point of COntact (POC):

Business POC: For San Antonio: LT Shannon Dale, Police Service, Phone: 210-617-5224 ext:

13116, Mobile: 210-992-0334 BPA Business POC will be determined when BPA Options are executed.

11. VA Data

Please insert the following language into the requirements section:

ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the Federal

Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 days after contract award. (If Data Security Categorization is High Impact, this will be due 85 days after contract award.)

6. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 days after contract award.)

7. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 140 days after contract award. (If Data Security Categorization is High Impact, this will be due 180 days after contract award.)

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

10. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

11. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation.

B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) https://www.fedramp.gov/agency-authorization/

ASSESSMENT, AUTHORIZATION, and CONTINUOUS MONITORING