PACS_RFI.pdf

United States Coast Guard

Request for Information (RFI) Enterprise Physical Access Control System (PACS) RFI Number: 70Z02326IPACS00001

1. Purpose

The United States Coast Guard (USCG) is issuing this Request for Information (RFI) as a market research tool to identify potential sources capable of providing an enterprise-level Physical Access Control System (PACS). This RFI is intended to gather information to validate assumptions and identify potential solutions for future acquisition planning. This notice is not a solicitation or a promise to contract. The USCG is not obligated to respond to all submissions and reserves the right to use information received for any government purpose.

2. Background

The USCG requires a robust, integrated, and scalable PACS implemented at the perimeter of its installations to enhance physical security. PACS will be implemented across a diverse range of installations – including shore-based facilities, ports, air stations, and cutter homeports. Current access control methods are fragmented, relying on a mix of legacy systems, manual processes, and disparate technologies, hindering comprehensive security management and compliance with evolving federal mandates. The USCG seeks a system that provides centralized management, advanced authentication methods, real-time monitoring capabilities, and robust reporting features.

The desired outcome is a fully operational PACS that enhances security, mitigates risks, and meets all federal standards, ensuring only authorized individuals can access installations. This system must support the mission needs and operational requirements outlined in the attached supporting documents: USCG PACS Mission Needs Statement (MNS), Operational Requirements Document (ORD), and PACS RFI Phased Deployment Plan. The system must include comprehensive identity verification and fitness determination, multi-factor authentication (MFA), a federated debarment database, and 24/7 availability across USCG installations. The system must integrate with both Department of War (DoW) and Department of Homeland Security (DHS) systems and services and be capable of operating on USCG unclassified networks. Furthermore, the system must also be adaptable to future security threats and technological advancements, capable of supporting evolving credential technologies and integration with emerging security protocols. The USCG anticipates this system will be a cornerstone of its overall security posture, protecting critical infrastructure, assets, and personnel.

3. Information Requested

The USCG requests information from qualified vendors regarding their capabilities to provide a comprehensive PACS solution. Please provide detailed responses to the information requested below. Responses should demonstrate a clear understanding of the USCG’s requirements and provide specific examples of how your solution addresses these needs.

1. Organizational Experience: Describe your organization’s experience in designing, implementing, and maintaining enterprise-level PACS (or similar systems) for federal government agencies, particularly those with similar operational profiles to the USCG (e.g., maritime, defense, critical infrastructure). Provide specific examples of successful deployments, including system size, complexity, and key features implemented.

2. Architectural Approach: Detail your proposed architectural approach for a PACS solution that integrates seamlessly with existing USCG IT infrastructure and security policies. The approach should align with the USCG PACS Operational View 1 (OV-1) diagram and include a description of the system’s components (hardware and software), communication protocols, and data flow. Address scalability to support future growth, redundancy for high availability, and disaster recovery considerations. Specifically address support for geographically dispersed locations with varying connectivity types and bandwidth capabilities.

3. Integration Capabilities: Explain your proposed solution’s ability to integrate with existing databases and systems, including but not limited to identity management services (e.g., Active Directory, LDAP), security information and event management (SIEM) platforms, personnel databases (e.g. Defense Enrollment Eligibility Reporting System [DEERS]), and authoritative criminal justice information sources (e.g.

Identity Matching Engine for Security Analysis [IMESA], other criminal justice information systems). Detail any experience with integrating with the DoW Defense Manpower Data Center (DMDC) and DHS systems and services (e.g. PACS Connector). Describe the methods and protocols used for integration, ensuring secure and reliable data exchange.

4. Compliance & Standards: Describe how your proposed solution complies with relevant federal standards, including but not limited to FIPS 201-3 (Personal Identity Verification), FIPS 140-2 (Cryptographic Modules), HSPD-12 (Common Identification Standards for Federal Employees and Contractors), and FISMA (Federal Information Security Modernization Act). Provide documentation or certifications demonstrating compliance. Detail your process for maintaining compliance with evolving standards.

5. Cybersecurity Features: Outline the cybersecurity features incorporated into your proposed PACS solution, including vulnerability management practices, intrusion detection/prevention capabilities, data encryption methods (both in transit and at rest), and protection against common attack vectors (e.g., credential theft, man-in-the-middle attacks). Describe your security development lifecycle (SDLC) and your approach to addressing emerging cyber threats.

6. Cost Estimate: Provide a Rough Order of Magnitude (ROM) cost estimate for initial implementation of Phase 1 sites (refer to USCG PACS RFI Phased Deployment Plan), ongoing maintenance (including software updates and support), and potential upgrades. Please break down costs into categories such as hardware (readers, controllers, servers), software development including debarment database, integration with internal/external systems, software licenses, installation services, training, and potential recurring fees. Please note that this is for planning purposes only and does not constitute a commitment to purchase.

7. Reporting & Auditing: Describe the reporting and auditing capabilities of your proposed solution, including real-time monitoring, incident response features, the ability to generate comprehensive audit trails for security investigations, system performance metrics (e.g. False Acceptance/Rejection Rate [FAR/FRR]), and customizable reporting dashboards. Detail the system’s ability to track access events, identify anomalies, and generate alerts based on predefined rules.

8. Multi-Factor Authentication (MFA): Detail any MFA including biometric options supported by your proposed solution, including fingerprint scanning, facial recognition, iris scanning, and other emerging biometric technologies. Specify the associated security levels, accuracy rates (e.g. FAR, FRR), and compliance with relevant standards. Address considerations for the use cases outlined in the USCG PACS Operational Requirements Document (ORD), including MFA access points, localized debarments and interagency operations.

9. Remote Management & Monitoring: Describe the remote management and monitoring capabilities of your proposed solution, including the ability to remotely administer the system, monitor system health, perform software updates, and respond to security incidents. Detail the system’s ability to provide remote access to authorized personnel while maintaining a high level of security.

10. Challenges & Risks: Identify potential challenges and risks associated with implementing a PACS solution of this scale and complexity within the USCG environment, including integration with current DoW/DHS/USCG systems, user adoption, and potential disruptions to operations considering the need for high availability. Propose mitigation strategies to address these challenges.

11. Credential Management: Describe your proposed solution’s capabilities for managing various credential types, including DoD and DHS smart cards (CAC/PIV), Real ID-compliant state/federal-issued identification, and temporary/visitor credentials as well as credentials for administering the system. Explain how the system supports credential lifecycle management, including issuance, revocation, and renewal.

12. Access Control Policies: Detail your proposed solution’s ability to enforce granular access control policies based on user roles, time of day, location, and other relevant factors. Describe the system’s support for MFA (both as an identity verification mechanism as well as system administration) and the ability to define complex access rules.

13. System Scalability: Describe how the proposed solution will scale to accommodate the future growth plans outlined in the USCG PACS ORD in the number of users, facilities, and access points. Provide details on the system’s maximum capacity and the process for adding new components.

14. Lifecycle Planning and Sustainment: Describe the lifecycle planning and sustainment consideration for the proposed solution to include:

a. System Lifecycle: Expected service life, technology refresh cycle, and end-of-life (EOL) considerations.

b. Sustainment Approach: Maintenance concept (e.g., on-site, depot-level, or remote), preventive maintenance schedules, and availability of technical documentation.

c. Software and Firmware Support: Frequency of updates, patch management processes, and cybersecurity sustainment practices.

d. Training and Technical Support: Availability of operator and maintainer training, user manuals, and helpdesk or field support services.

e. Spare Parts and Supply Chain: Logistics strategy for spare parts, lead times, and availability throughout the product’s lifecycle.

f. Warranty and Post-Warranty Options: Coverage terms, renewal processes, and recommended sustainment strategies beyond warranty periods.

g. Obsolescence Management: Approach to maintaining interoperability and support as components reach EOL or as standards evolve.

15. Business Size and Existing Government Contract vehicles that could be utilized.

4. Submission Instructions

Interested vendors are requested to submit their responses to this RFI electronically in Microsoft Word document (.doc/.docx) or PDF format. Responses should be concise and focused, not exceeding 20 pages (excluding appendices).

Please submit your responses to:

POC: Wendy Paulo, USCG Contracting Officer, Wendy.L.Paulo@uscg.mil

5. Confidentiality

All information submitted in response to this RFI will be treated as proprietary. The USCG will protect submitted information in accordance with applicable laws and regulations.

However, the USCG assumes no liability for the disclosure of proprietary information.

6. Disclaimer

This RFI is for informational purposes only and does not constitute a commitment to procure goods or services. The USCG is not obligated to respond to all submissions and reserves the right to use information received for any government purpose. The USCG may or may not schedule follow-on activities as a result of this RFI.

7. References

• 5200_dtd_May_2025_USCG_PACS_Mission_Needs_Statement_CRE_signed.pdf

• 5200_dtd_25Sep2025_USCG_PACS_Operational_Requirements_Document_CRE_si gned.pdf

• USCG_PACS RFI Phased Deployment Plan.xlsx mailto:Wendy.L.Paulo@uscg.mil