DRAFT

National Oceanic and Atmospheric Administration U.S. Department of Commerce

Performance Work Statement (PWS)

NOAA Critical Infrastructure Management Systems (CIMS)

Enterprise Physical Access Control System (ePACS) and Enterprise Video Surveillance Systems (eVSS)

Enterprise Support and Integrator Services

Solicitation Number Fiscal Year Version

TBD 2027 3.0

TABLE OF CONTENTS

PART 1. INFORMATION 4

1.1. Purpose 4

1.2. Background 4

1.3. Objectives 4

1.4. High Level Scope Description 5

PART 2. SCOPE 6

CLIN 0001: ePACS/eVSS Integrator System Architect Services (FFP) 6 CLIN 0002: Software Licensing, Subscriptions, and Support (T&M) 9 CLIN 0003: Replacement Parts, Supplies, and Materials (T&M) 11 CLIN 0004: Travel (T&M) 14

CLIN 0005: LABOR (FFP) 15

CLIN 0006: Emergency Support (T&M) 17 CLIN 0007: Phase-In / Transition Support (FFP) 19

PART 3. DELIVERABLES 21

3.1. CLIN 0001: ePACS and eVSS Integrator Services and System Architect (FFP) 21

3.2. CLIN 0002: Software Licensing, Enterprise Subscriptions, and Integration Support (T&M) 22

3.3. CLIN 0003: Replacement Parts, Supplies, and Materials (T&M) 23

3.4. CLIN 0004: Travel and Relocation Support (T&M) 24

3.5. CLIN 0005: Technical Labor & Staff Augmentation (FFP) 25

3.6. CLIN 0006: Emergency After-Hours Support (T&M) 26

3.7. CLIN 0007: Phase-In / Transition Support (FFP) 27

PART 4. PERFORMANCE METRICS 28

PART 5. CONTRACT REQUIREMENTS 1

5.1. Certification Requirements 1

5.2. Key Personnel Qualifications (Sr. ESS Administrator / System Architect) 1

5.2.1. Daily On-Site Presence, Attendance Check-In, and Coverage 1

5.3. Key Personnel Replacement & Substitution Restrictions 1

5.4. Period of Performance 1

5.5. Type of Order 1

5.6. Hours of Operation / Place of Performance 1

5.6.1. Remote Work and Telework Authorization 1

5.7. Travel 1

5.8. Recognized Holidays 1

5.9. Security Requirements 1

5.9.a. Suitability/Risk Level 1 5.9.b. Physical Security 1 5.9.c. Lock Combinations 1 5.9.d. Key Control 1

5.10. Contracting Officer’s Representative (COR) 1

5.11. Task Manager 1

5.12. Conservation of Utilities 1

5.13. Post Award Conference/Periodic Progress Meetings 1

5.14. Contract Manager 1

5.14.a. Corporate Responsiveness & Inquiry Timelines 1

5.14.b. Subcontractor Responsibility & Flow-Down Compliance 1

5.15. Processing and Identification of Contractor Employees 1

5.16. Quality Assurance 1

Quality Assurance Surveillance 1 Government Remedies 1

5.17. Government Remedies for Defective Performance 1

5.18. Continuity of Services & System Handover 1

PART 6. GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES 1

6.1. General 1

a. Facilities 1

b. Equipment 1

c. Utilities 1

PART 7. CONTRACTOR FURNISHED PROPERTY, EQUIPMENT, AND SERVICES 1

7.1. General 1

7.2. Secret Facility Clearance 1

PART 8. APPLICABLE PUBLICATIONS 1

TECHNICAL EXHIBIT 1 - CONTROLLED UNCLASSIFIED INFORMATION (CUI) 1

TECHNICAL EXHIBIT 2 - Incident Response & Resolution Service Level Agreement 1 TECHNICAL EXHIBIT 3 - Solicitation Evaluation Factors 1

PART 1. INFORMATION

This performance work statement defines the Government's requirements in terms of the objective and measurable outputs.

1.1. Purpose

This Performance Work Statement (PWS) outlines the requirements for enterprise system architecture, centralized system administration, database engineering, software licensing, cloud/network convergence, and technical integration services for the NOAA/OCIO/Service Delivery Division’s (SDD) Critical Infrastructure Management Services (CIMS) program.

The primary purpose of this contract is to maintain high availability, cybersecurity compliance, software stability, and logical configuration management across NOAA’s centralized Enterprise Physical Access Control System (ePACS) infrastructure and Enterprise Video Surveillance System (eVSS) platforms nationwide. Physical site-level hardware installation, routine preventive maintenance of local field hardware, and physical field repairs are explicitly out of scope for this contract and are supported via separate site-level procurement actions.

1.2. Background

The NOAA Office of the Chief Information Officer (OCIO), through its Service Delivery Division (SDD) and Critical Infrastructure Management Services (CIMS) program, is responsible for the secure operation and maintenance of NOAA’s Enterprise Physical Access Control System (ePACS) and Enterprise Video Surveillance System (eVSS). These systems are deployed across multiple NOAA facilities nationwide and support mission-critical physical security functions.

To maintain operational integrity, ensure 24/7/365 system availability, and meet strict federal physical security and IT compliance mandates (such as HSPD-12, FIPS 201-3, and FICAM), NOAA requires dedicated vendor support for enterprise-level system architecture, daily administration, software/license management, hardware acquisition, and system expansion services.

1.3. Objectives

The objectives of this Performance Work Statement (PWS) are to:

● Maintain High Availability: Ensure continuous (24/7/365) operational readiness, maximum uptime, and peak reliability across all NOAA ePACS and eVSS infrastructure.

● Deliver Expert Architectural & Engineering Support: Provide robust system administration, database engineering (SQL/Oracle/Active Directory), and cross-system integration (PACS, VSS, IDS, Visitor Management).

● Ensure Regulatory & Federal Compliance: Maintain strict alignment with GSA Approved Products List (APL) standards, Trade Agreements Act (TAA) guidelines, HSPD-12, FIPS 201-3, and NOAA/DOC cybersecurity baselines.

● Support Enterprise Expansion: Provide turn-key engineering design submittals, pre-staging/configuration of edge controllers, and professional installation/cabling for HQ head-end servers, test lab environments, and national capitol area components during facility modifications and expansions.

1.4. High Level Scope Description

The Contractor shall furnish all necessary qualified enterprise IT personnel, certified software engineers, technical expertise, tools, and management required to execute centralized life-cycle system support, head-end architecture, software administration, and Tier 3 logical support for NOAA’s ePACS and eVSS environments.

Work under this contract is structured across seven primary Contract Line Item Numbers (CLINs):

CLIN 0001 - ePACS and eVSS Integrator Services and System Architect (FFP): Day-to-day head-end system administration, enterprise database optimization, remote health monitoring, engineering design submittals, cross-system software convergence, logical access provisioning, and regulatory compliance alignment.

CLIN 0002 - Software Licensing, Enterprise Subscriptions, and Integration Support (T&M):

Management, procurement, renewal, and feature activation of enterprise software licenses, Software Maintenance Agreements (SMAs), VMS licensing, and specialized OEM integration support (requiring Software House Vendor of Record status).

CLIN 0003 - Replacement Parts, Head-End Equipment, and Materials (T&M): Procurement and supply of enterprise head-end hardware, replacement central servers, head-end storage arrays, GSA APL / TAA compliant edge controllers, and specialized system expansion hardware to be deployed/passed through to field teams.

CLIN 0004 - Travel Support (Cost-Reimbursement / ODC): Authorized reimbursable travel in support of enterprise system architecture reviews, major head-end site integrations, complex site surveys, and direct technical support across CONUS/OCONUS NOAA facility hubs in accordance with Federal Travel Regulations (FTR).

CLIN 0005 - Technical Labor & Staff Augmentation (FFP): On-demand access to certified IT engineers, system architects, and technical specialists for ad-hoc enterprise projects, complex software integrations, and agency expansion initiatives.

CLIN 0006 - Emergency Head-End & System Support (T&M): Rapid-mobilization after-hours support (remote triage and designated head-end intervention) to address critical enterprise outages, central database crashes, or primary head-end system failures.

CLIN 0007 - Phase-In / Transition Support (FFP): Structured technical onboarding, joint inventory audits, master administrative credential verification, database shadow operations, and system cutover activities during the initial transition period.

PART 2. SCOPE

CLIN 0001: ePACS/eVSS Integrator System Architect Services (FFP)

SCOPE & OBJECTIVE

The Contractor (Integrator) shall serve as the primary administrator for NOAA's central C•CURE 9000, Milestone VMS, and related environments. The Contractor is responsible for head-end server/software administration, remote database configuration, firmware push updates, and logical integration. Physical mounting, cabling, and site-level commissioning of door sub-assemblies and edge devices at field sites are handled by separate local site contractors.

This requirement encompasses day-to-day administration, proactive maintenance, system expansion, architectural design, hardware/software procurement, OEM license administration, asset inventory tracking, and strict federal cybersecurity/physical security compliance across all integrated components (hardware, software, firmware, and infrastructure).

Task Area 1 - Enterprise System Operations & Health Monitoring

A. Continuous System Availability: Manage and sustain day-to-day operations of NOAA’s enterprise PACS and VSS platforms, ensuring high availability (24/7/365 operational readiness) for all critical physical security assets (door controllers, card readers, biometric sensors, VMS servers, NVRs/SAN storage, and IP cameras).

B. Software Platform Administration: Install, configure, maintain, operate, provision, upgrade, and troubleshoot core software platforms including Software House C•CURE 9000, Milestone Video Software, and ExacqVision Video Software in accordance with agency requirements.

C. Proactive Health Checks & Maintenance: Execute routine preventative maintenance, log reviews, database optimization, and system health monitoring to detect and resolve network degradation, storage capacity bottlenecks, or hardware failures prior to operational impact.

D. Badging & Access Provisioning: Manage user access records, create/change/delete user accounts, provision access badges, handle visitor access/badging software, and ensure individuals are removed from facility access lists within required timeframes when access is no longer required.

E. Incident & Outage Response: Troubleshoot and resolve system outages, hardware malfunctions, firmware corruption, and software bugs in accordance with established agency Service Level Agreements (SLAs).

Reference: Technical Exhibit 2 - Incident Response & Resolution Service Level Agreements

Task Area 2 - Engineering, Architecture & Technical Convergence

A. Technical Integration Lead: Serve as the technical bridge between Original Equipment Manufacturers (OEMs) and NOAA’s operational and IT environment. Apply comprehensive engineering expertise across server hardware/software, Windows Active Directory, Microsoft SQL Server, and Microsoft Azure cloud environments.

B. Cross-System Convergence: Design and implement interoperable workflows integrating PACS, VSS, Intrusion Detection Systems (IDS), visitor management, and enterprise identity systems.

Program event-driven video triggers (e.g., camera pop-ups or PTZ presets on PACS alarms).

C. System Documentation: Create and maintain detailed network server documentation, including physical diagrams, logical topology diagrams, IP address schemes, asset management tracking, and database designs related to the PACS/VSS environment.

D. As-Built Documentation & CMMS Update Mandate Final acceptance and invoice payment for any system modification, installation, or hardware replacement (under CLIN 0001 or CLIN 0003) is strictly contingent upon receipt and Government approval of updated As-Built CAD/Visio drawings, IP address assignments, and CMMS record updates. Updated documentation must be delivered within ten (10) business days of physical work completion. Invoices submitted without attached As-Built confirmation shall be held in accordance with Section 5.17.

Task Area 3 - Lifecycle Management, Expansion & Change Management

A. System Modernization Planning: Formulate and maintain long-term roadmaps for hardware refresh cycles, software upgrades, and infrastructure expansions across NOAA facilities.

B. Deployment, Upgrades & Change Notifications: Plan, configure, pre-stage, test, and commission head-end servers, storage arrays, virtual platforms, and pre-staged field controllers, related PACS/VSS hardware, door sub-assemblies, edge devices, and server/storage infrastructure supporting the Enterprise infrastructure. Provide NOAA with a written description of all scheduled system updates or changes at least 30 days prior to execution.

C. Firmware & Patch Management: Test and deploy OEM software patches, version updates, and security firmware enhancements in staging environments before rolling them out to production systems, ensuring minimal downtime.

D. Inventory Baseline & Tracking: Complete a comprehensive initial inventory within 60 days of contract award, generating a master list of all PACS/VSS equipment (make, model, location, quantity, and operational state). Maintain and update this inventory list continuously as changes occur, and recommend a strategic spare parts inventory.

E. Equipment Removal & Disposal: Safely remove and dispose of antiquated, defective, or end-of-life security hardware in accordance with federal property disposal guidelines when replacement services occur.

Task Area 4 - Regulatory Compliance & Standards Alignment

A. GSA APL Compliance: Verify and ensure that all installed PACS door hardware, field panels, credentials, and readers strictly comply with the General Services Administration (GSA) Approved Products List (APL).

B. Federal Security Mandates: Maintain system alignment with Federal Information Processing

Standards (FIPS 201-2), Homeland Security Presidential Directive 12 (HSPD-12), FICAM architectures, Interagency Security Committee (ISC) standards, NIST SP 800-53 / 800-37, DOC IT Security Baseline Policy, and the NOAA IT Security Manual (ITSM).

C. Cyber Hardening: Apply cyber-hardening best practices to all network-connected security devices (IoT cameras, controllers, VMS servers), including disabling unused ports/protocols, managing encryption certificates, utilizing CAC/PIV credentials, and remediating vulnerabilities.

Task Area 5 - OEM Partner Management, Licensing & Procurement

A. OEM Partner Status: Maintain direct enterprise-level channel partner certifications and relationships with key OEMs, specifically including Software House, Milestone, and ExacqVision.

B. Enterprise Licensing & Procurement: Manage end-to-end software licensing, Software

Maintenance Agreements (SMAs), bug fixes, software updates, and turn-key hardware procurements. Leverage direct manufacturer relationships to negotiate volume pricing, eliminate piecemeal equipment sourcing, and deliver fully integrated, turn-key hardware/software solutions to NOAA.

INVOICING

Paid monthly in equal installments. Covers day-to-day enterprise system administration, proactive health monitoring, inventory tracking, badging provisioning, and cybersecurity compliance.

CLIN 0002: Software Licensing, Subscriptions, and Support (T&M)

SCOPE & OBJECTIVE

The Contractor shall furnish, manage, administer, and renew all necessary original equipment manufacturer (OEM) software licenses, software maintenance agreements (SMAs), feature activations, and enterprise subscriptions required to operate, maintain, and expand NOAA’s enterprise Physical Access Control System (PACS) and Video Surveillance System (VSS).

This requirement encompasses specialized credential enrollment software, database connectors, video channel licenses, and direct vendor integration support to ensure full operational readiness and interoperability across all security platforms.

Task Area 1 - Feature Licensing

A. Licensing: Procurement and renewal of all required software licenses, application modules, and software plugins necessary to operate the system or as requested by the COR.

B. 60-Day Renewal Lead Time: The Contractor shall submit complete, verified SMA and software subscription renewal packages to the COR at least sixty (60) calendar days prior to any license expiration date. If the Contractor fails to submit a compliant renewal package within this window, the Contractor shall be financially liable for any OEM lapse fees, reinstatement penalties, or administrative surcharges incurred to restore active software support.

C. Government Ownership of License Keys: All software licenses, software keys, system serial numbers, API tokens, and subscription entitlements procured under CLIN 0002 are the sole property of the U.S. Government. The Contractor shall register all OEM license assets directly in NOAA's name and deliver master digital keys/entitlement certificates to the COR within five (5) business days of activation.

D. Feature & Integration Licenses: Provisioning of specialized feature licenses, including

FICAM/GSA APL validation modules, biometric enrollment connectors, visitor management integrations, and advanced video management software (VMS) channel licenses (e.g.,Milestone).

Task Area 2 - OEM Vendor Status & Integration Support

A. Software House Vendor of Record: The Contractor must maintain active, verifiable status as an authorized Software House (Johnson Controls / Tyco) Vendor of Record throughout the contract performance period to ensure direct access to tier-3 technical engineering support, proprietary software patches, and tier-1 volume licensing structures.

B. System Testing & Validation: Perform comprehensive integration, configuration, and end-to-end testing of all newly activated or renewed software licenses within the production and backup C•CURE 9000 systems to verify zero loss of operational functionality.

C. On-Demand Licensing Support: Provide ongoing software license administration, license allocation tracking, key management, and technical troubleshooting for all installed PACS/VSS software features and API connections.

Itemized Billing Invoiced at published prices (or contracted GSA discount schedules). Requires mandatory 60-day renewal lead time and attached direct OEM list price verification.

Every invoice submitted against CLIN 0002 shall include an itemized breakdown specifying:

● OEM Part Numbers and License Descriptions

● Serial / System Identification Numbers

● Unit Quantities, Duration/Term of License (e.g., 1-Year SMA)

● Published List Price vs. Actual Unit Cost Billed

● Associated Facility / System Instance

CLIN 0003: Replacement Parts, Supplies, and Materials (T&M)

SCOPE & OBJECTIVE

The Contractor shall furnish enterprise head-end hardware, replacement servers, storage components, edge controllers, expansion boards, critical spare parts stock, and ancillary supplies required to operate, maintain, expand, or test NOAA's enterprise Physical Access Control System (PACS) and Video Surveillance System (VSS) environments.

Physical installation, wiring, mounting, and workmanship responsibilities under this CLIN are strictly limited to head-end equipment, central server racks, and the PACS/eVSS Test and Staging Laboratory located at NOAA Headquarters (Silver Spring, MD) and nearby national capitol area sites. Physical hardware installations, low-voltage wiring, and door component mounting across nationwide field sites are explicitly out of scope and will be executed by separate local site contractors.

Task Area 1 - Original Equipment Manufacturer (OEM) Parts & Substitutions

A. OEM Direct Equipment & Stock Management: Core access control, video management, or storage hardware (e.g., C CURE system controllers, expansion modules, head-end servers, SAN/NVR storage arrays, card readers, power supplies, and encoder chassis) shall be sourced directly from the OEM or authorized channel partners. The Contractor shall procure and maintain an authorized central stock of critical spare parts and long-lead replacement components to ensure rapid deployment during system failures.

B. Prohibition of Unapproved Substitutions: The Contractor shall not substitute core OEM parts with third-party or alternate vendor components without prior written approval from the Contracting Officer’s Representative (COR).

C. Part Quality & Warranties: All replacement parts used during maintenance or repair services shall be factory-new standard parts, or components that equal or exceed OEM performance specifications, warranted as new by the manufacturer.

D. Spare Parts Stock Custody & Inventory Control: The Contractor shall maintain strict audit control and continuous inventory tracking over all Government-owned spare parts and stock equipment stored at Government facilities or contractor-managed warehouses. Whenever stock equipment or emergency spare parts are authorized for deployment to a field site or test environment, the Contractor shall generate a replenishment procurement estimate under CLIN 0003 within forty-eight (48) hours to maintain established baseline stock levels.

E. Pre-Configuration & Staging for Field Deployment: For spare stock or expansion hardware intended for nationwide field site deployment, the Contractor shall perform head-end enrollment, IP address mapping, firmware flashing, and GSA APL/TAA verification prior to staging and shipping the equipment to local site contractors.

Task Area 2 - Ancillary Supplies, HQ Test Lab & Head-End Physical Installation & Workmanship

A. Supplies Definition: Non-OEM hardware, cabling, and installation items are classified as "supplies".

Supplies include, but are not limited to: high-grade network cabling, fiber optics, wiring harnesses, wire ties, connectors, terminal blocks, relays, power supplies, patch panels, server rack hardware, access control hardware, video surveillance hardware, and door hardware.

B. Quality Standards: All ancillary supplies shall meet commercial security-grade standards and conform with applicable National Electrical Code (NEC/NFPA 70) and agency cabling standards.

C. Installation Standards, Workmanship Quality, and Workmanship Warranty: All physical replacement, rack mounting, panel re-termination, network patching, and cabling services performed under CLIN 0003 shall be strictly limited to head-end equipment, central server racks, and the PACS/eVSS Test & Staging Laboratory at NOAA Headquarters (Silver Spring, MD), and national capitol area sites. Work shall be executed in a neat, professional, and workmanlike manner in strict accordance with industry best practices, OEM installation guidelines, NEC standards, and TIA cabling protocols. Sloppy wiring, unorganized panel routing, unmonitored power drops, or loose enclosures shall be rejected at the Contractor's sole expense.

D. Qualified & Certified Installers: All physical installation, rack integration, and component replacement work must be performed by qualified technicians holding active factory certifications (including Software House C•CURE Installer certification) where brand expertise is required.

E. Workmanship Warranty: The Contractor shall provide a minimum one (1) year warranty on all workmanship and installation labor performed under CLIN 0003 at HQ facilities, running concurrently with manufacturer hardware warranties. Any installation defects, wiring failures, poor terminations, or loose hardware mounts discovered within twelve (12) months of project acceptance shall be corrected, repaired, or re-installed by the Contractor at zero additional cost to the Government.

F. Post-Installation Testing & Government Acceptance: Upon replacing or installing any component at the HQ head-end or test lab under CLIN 0003, the Contractor shall perform full operational continuity, signal integrity, network throughput, and functional integration testing. The Government retains the right to inspect, validate, and verify all completed installations prior to approving invoices submitted against CLIN 0003. Non-conforming or unapproved installations shall be remediated before payment authorization.

Task Area 3 - Federal Compliance & Standards Alignment

A. GSA APL Mandatory Listing: The Contractor is solely responsible for verifying that any installed, replaced, or upgraded PACS component-including hardware revisions, firmware versions, and card readers-is currently listed on the General Services Administration (GSA) Approved Products List (APL).

B. Trade Agreements Act (TAA) Compliance: All procurement items furnished under this CLIN shall strictly comply with the Trade Agreements Act (TAA) (19 U.S.C. § 2501 et seq.) and Federal Acquisition Regulation (FAR) Part 25.

C. Warranty Pass-Through & Compliance Certification: The Contractor shall provide a minimum one (1) year pass-through manufacturer warranty (or standard OEM commercial warranty, whichever is greater) for all hardware, parts, panels, and supplies procured under CLIN 0003. Additionally, every hardware invoice submitted under CLIN 0003 must include a signed GSA APL / TAA Compliance Certification Form confirming the specific hardware revision and firmware build are currently active on the GSA APL list.

Invoices lacking this certification will be rejected.

Task Area 4 - T&M Work Proposals and Cost Estimates

A. All Contractor proposals for T&M task orders, system expansions, repairs, or retrofits must be fully developed, accurate, and submitted within five (5) business days of a Government request. Incomplete, vague, or sloppy proposals will be formally rejected.

B. Every proposal submittal MUST include:

a. Detailed Scope of Work (SOW): Specific description of tasks, technical approach, affected facilities, door/camera IDs, and timeline.

b. Itemized Bill of Materials (BOM): Exact OEM part numbers, quantities, descriptions, published list price (MSRP), discounted unit price, and explicit confirmation of GSA APL listing and TAA compliance.

c. Labor Breakdown: Fully burdened labor categories, estimated hours per labor category, and clear task assignments matching contracted rates.

d. CAD/Draft Site Layouts: Preliminary floor plan drawings or port maps when structural installation or cabling is required.

The Contractor shall NOT bill the Government for labor hours spent drafting, revising, or correcting defective proposals. If a proposal is rejected twice due to omissions, errors, or unapproved price markups, the COR may issue a Contract Discrepancy Report (CDR).

Invoicing

A. Itemized Billing: Every invoice submitted against CLIN 0003 shall include an itemized breakdown detailing part numbers, equipment descriptions, quantities, manufacturer list prices, actual unit costs, shipping, and associated job/facility ticket numbers.

B. Partial Billing for Materials Delivered: The Contractor may submit progress invoices for equipment, major hardware components, and installation supplies upon physical delivery and verification at the designated NOAA facility. Material progress billing MUST include:

● Proof of physical delivery (signed packing slip or site representative receiving report).

● Itemized vendor invoice showing actual cost and verified OEM list price (MSRP).

● Signed GSA APL / TAA Compliance Certification Form for the delivered hardware.

C. Prohibition on Workmanship Progress Billing: The Contractor is strictly prohibited from billing labor, installation, mounting, cabling, or workmanship charges on a percentage-of-completion basis prior to full project completion.

D. Workmanship Payment Trigger: Labor and installation charges associated with replacement, expansion, or retrofit tasks shall NOT be invoiced or paid until:

● All physical installation, wiring, labeling, and mounting work is 100% complete.

● Post-installation testing and functional verification have been successfully executed.

● The Government (COR or Task Manager) issues a formal written Certificate of Acceptance for completed workmanship and system performance.

CLIN 0004: Travel (T&M)

SCOPE & OVERVIEW

The Contractor shall provide travel support to accomplish operational, engineering, installation, and project management objectives at NOAA facilities across the conterminous United States (CONUS) and non-conterminous/foreign locations (OCONUS) as required under the CIMS program.

Travel will be utilized on an as-needed basis for on-site technical support, emergency repairs, physical security system installations, site surveys, stakeholder meetings, project reviews, and program-related training/conferences. The exact frequency and locations are indeterminate at contract award; therefore, travel shall be managed as an authorized, reimbursable Other Direct Cost (ODC).

Task Area 1 - Prior Written Authorization All travel must be determined necessary and explicitly authorized in writing by the Contracting Officer’s Representative (COR) prior to incurring any travel-related expenses or booking arrangements.

The Contractor shall submit a formal Travel Request Form to the COR at least 10 business days prior to anticipated travel (except for emergency/unplanned outage dispatch). The request must include the justification, travel dates, itinerary, estimated costs (airfare, per diem, lodging, rental car), and projected operational outcomes.

Task Area 2 - Compliance with Federal Regulations Reimbursable travel expenses shall strictly conform to the Federal Travel Regulations (FTR) guidelines prescribed by the General Services Administration (GSA) for CONUS travel.

Travel outside CONUS shall conform to the Standardized Regulations (Government Civilians, Foreign Areas), Section 925, prescribed by the U.S. Department of State.

Airfare, lodging, and Meals and Incidental Expenses (M&IE) will not be reimbursed above the maximum per diem rates established by GSA/State Department unless prior written approval for actual expense allowance is granted by the Contracting Officer under exceptional circumstances.

Task Area 3 - Rapid Mobilization & On-Demand Travel The Contractor shall maintain the capability to deploy qualified engineering and technical personnel on short notice (within 24–48 hours) to address critical security system outages or emergency maintenance requirements across NOAA sites.

Task Area 4 - Post-Travel Reporting & Deliverables The Contractor shall submit a detailed Travel Trip Report to the COR within 5 business days following the completion of any authorized travel. The report shall outline:

● Dates, locations visited, and personnel deployed

● Specific technical or operational objectives achieved

● Key findings, site condition assessments, or equipment status

● Outstanding action items or follow-up recommendations

Task Area 5 - Invoicing Travel costs shall be billed monthly in arrears. Every travel invoice must include detailed supporting documentation, including trip tickets, lodging folios, airfare receipts, rental car agreements, and proof of prior COR written approval.

CLIN 0005: LABOR (FFP)

The Contractor shall provide specialized technical labor and staff augmentation support on a Firm-Fixed-Price (FFP) basis to support program growth, ad-hoc engineering initiatives, facility expansions, emergency system modifications, and specialized technical projects across NOAA's ePACS and eVSS enterprise.

CLIN 0005 provides access to certified IT engineers, system architects, help desk specialists, quality assurance professionals, and related support to supplement NOAA capability upon Government need, during periods of increased operational volume or specialized technical deployments. Work performed under CLIN 0005 shall be authorized on a task-by-task basis via written FFP Task Orders or formal COR Technical Directions.

Task Area 1 - Task Order & Technical Direction Authorization For each staff augmentation request or ad-hoc technical project, the Contractor shall submit a fully developed FFP Labor Estimate Package to the COR/CO within five (5) business days. The package MUST include:

● Detailed Statement of Work (SOW): Technical approach, objectives, key deliverables, firm milestone schedule, and completion criteria.

● Firm-Fixed-Price Labor Breakdown: Proposed labor categories, fully burdened contracted fixed rates, estimated hours per category, and firm fixed price total for the task order.

Task Area 2 - Labor Category Descriptions & Qualification Baselines All personnel assigned to perform work under CLIN 0005 must satisfy the following minimum education, experience, and certification baselines prior to performance. This is not an exhaustive list of labor categories but this list does include those that the Government expects might be needed.

IT Engineer Role & Responsibilities: Performs field component integration, head-end controller programming, network IP camera configuration, panel wiring validation, and hardware/software troubleshooting.

Qualifications:

Level III: 5+ years technical experience in electronic security systems. OEM factory training required.

Level IV: 8+ years technical experience. Active C•CURE 9000 factory certification required.

Level V: 10+ years expert-level field engineering experience. C•CURE and Milestone Advanced/Expert certifications required.

Quality Assurance Specialist Role & Responsibilities: Conducts independent quality control inspections on physical installations, wiring terminations, CAD as-built accuracy, CMMS data entry, and SLA/QASP compliance.

Qualifications:

Level III: 4+ years technical QA/QC inspection experience in low-voltage security or IT systems.

Level IV: 7+ years QA/QC management experience enforcing NEC, TIA, and federal compliance standards.

Level V: 10+ years senior quality assurance management experience leading quality management programs (ISO/QASP) for federal enterprise contracts.

IT System Engineer Role & Responsibilities: Executes high-level server hardware/software configuration, SQL/Oracle database engineering, Active Directory access provisioning, VMS storage architecture, network topology design, and cyber hardening.

Qualifications:

Level III: Bachelor’s degree + 5 years (or Associate’s + 7 years) specialized PACS/VSS engineering experience. Active C•CURE Installer certification required.

Level IV: Bachelor’s degree + 8 years (or Associate’s + 10 years) specialized experience. Active CSEIP and C•CURE Installer certifications required.

Level V: Master’s/Bachelor’s degree + 10+ years senior engineering experience leading complex multi-site PACS integrations. CSEIP and C•CURE certifications required.

Help Desk Specialist Role & Responsibilities: Manages tier-1 through tier-3 user access requests, card badge creation, visitor management processing, C•CURE access list administration, and routine incident ticketing.

Qualifications:

Level III: 3+ years IT help desk or security badging experience. Proficient in C•CURE 9000 operator functions.

Level IV: 5+ years specialized security help desk experience. C•CURE operator/administrator certification required.

Level V: 8+ years senior help desk lead experience managing enterprise badge provisioning workflows and tier-3 incident escalation.

Enterprise IT System Architect, Chief Role & Responsibilities: Serves as the primary technical authority for enterprise physical security system architecture, high-level C•CURE/Milestone software convergence, cloud hosting strategies (Azure), and complex identity management integrations (FICAM/FIPS 201-3).

Minimum Qualifications: Master’s degree in Computer Science, Systems Engineering, or related field with 12 years of enterprise security engineering experience; OR Bachelor’s degree with 15 years of experience. Must hold an active CSEIP certification and formal Software House C•CURE 9000 System Architect certification.

CLIN 0006: Emergency Support (T&M)

The Contractor shall provide emergency after-hours technical support, rapid remote engineering response, and on-site head-end triage services on a Time & Materials (T&M) basis to address critical enterprise system failures, software/database corruption, or severe operational degradation occurring outside standard business hours (1700 to 0700 local time, weekends, and Federal holidays).

Emergency support under CLIN 0006 applies when a Severity 1 (Emergency Outage) or Severity 2 (Urgent Issue) condition occurs on central enterprise systems; such as complete loss of primary/backup head-end servers, primary badging database corruption, central VMS storage array/NVR crashes, or other enterprise integration failures that impact nationwide system functionality or life safety operations.

Physical site-level emergency dispatches for local field hardware (e.g., individual door lock failures or localized reader outages at field sites) are explicitly out of scope for this contract and are supported via separate local site agreements.

Task Area 1 – Emergency Notification, Remote Triage & Mobilization Protocols The Contractor shall maintain a continuously monitored, 24/7/365 emergency dispatch mechanism (toll-free telephone number or dedicated incident response portal) to receive emergency service requests from the COR, Task Manager, designated NOAA Security Office official, or others determined by the Government to have a need.

Upon verbal, written, or portal notification of an emergency enterprise condition by NOAA, the Contractor shall strictly adhere to the following SLAs:

● Initial Technical Acknowledgment: Within one (1) hour of notification.

● Remote Technical Engagement & Triage: Initiate a remote engineering troubleshooting session (or dispatch certified technicians to the HQ/Data Center head-end server facility if a physical head-end hardware failure occurs) within two (2) hours of notification.

● Workaround or Full System Restoration: Achieve operational workaround or complete head-end restoration within eight (8) hours of initial notification.

Emergency dispatches initiated outside standard business hours may be verbally authorized by the COR or Task Manager. The Contractor shall submit a formal written Emergency Work Authorization Form to the COR within twenty-four (24) hours following initial engagement.

Task Area 2 – Emergency Labor Qualifications & Access Engineering personnel assigned to perform emergency response work under CLIN 0006 must hold active factory certifications (including Software House C CURE 9000 System Architect / Installer certification and/or Milestone Advanced certification) and maintain active administrative access credentials to ensure immediate, unassisted system access.

Task Area 3 – Emergency Invoicing & Billing Rules The Contractor shall be guaranteed a minimum of two (2) hours of labor at the contracted CLIN 0006 emergency hourly rate for authorized emergency dispatches or remote intervention sessions.

Emergency labor billing shall commence upon initiation of an authorized remote troubleshooting session or physical arrival at the NOAA HQ/Data Center head-end facility. Travel time to and from facilities shall NOT be billed as labor hours, but reimbursed under CLIN 0004 (Travel) where pre-authorized.

Every invoice submitted against CLIN 0006 shall include an itemized breakdown detailing:

● Government Emergency Incident / CMMS Ticket Number.

● Name of Authorizing NOAA Official (COR/TM) and time of verbal/portal dispatch.

● Technician Name, Certified Labor Category, and actual hours worked.

● Root Cause Analysis (RCA) summary, workaround/fix actions taken, and follow-up recommendations.

CLIN 0007: Phase-In / Transition Support (FFP)

The Contractor shall execute a seamless, structured Phase-In / Transition plan to assume full operational and technical responsibility for NOAA’s ePACS and eVSS enterprise without degradation of system security, operational uptime, or service delivery.

Work under CLIN 0007 encompasses all technical onboarding, system inventory shadow audits, database backups, administrative credential handover, network topology validation, key personnel onboarding, and operational orientation required during the initial 30-to-60 calendar day transition period following contract award.

Task Area 1 – Phase-In Transition Plan & Operational Onboarding

1. Transition Plan Submittal: Within ten (10) calendar days of contract award, the Contractor shall submit a comprehensive Phase-In Transition Plan to the CO and COR for review and approval. The plan MUST outline:

○ Milestone Schedule: Detailed timeline covering key personnel onboarding, security suitability submittals, inventory verification, system shadow operations, and formal handover sign-off.

○ Resource Allocation: Staffing plan identifying certified engineers (C•CURE 9000, CSEIP) assigned to conduct transition activities.

○ Risk Mitigation Strategy: Operational continuity protocols ensuring zero interruption to daily access control provisioning, video surveillance monitoring, or SLA response times during cutover.

2. Key Personnel Onboarding & Clearance Processing: The Contractor shall immediately submit all required security suitability and background investigation packages for assigned Key Personnel and technical staff upon award to ensure full access badges and Tier 4 clearance processing are initiated without delay.

Task Area 2 – Joint Inventory Audit & System Baseline Verification

1. Joint Baseline Physical Inventory: The Contractor shall perform a comprehensive joint physical inventory audit of all system components alongside the outgoing contractor and/or Government representative (COR/TM) across NOAA facilities.

2. Inventory Reconciliation & Baseline Sign-off: The Contractor shall verify and document the make, model, serial number, physical location, firmware build, and operational status of all head-end servers, door controllers, card readers, VMS storage arrays, and IP cameras. The Contractor shall submit an updated Initial Master PACS/VSS Equipment Inventory to the COR within sixty (60) calendar days of award.

Task Area 3 – Technical Asset & Administrative Handover

1. Master System Credentials & Database Backups: The Contractor shall receive, test, and verify all master administrative accounts, root passwords, SQL/C•CURE database backups, Milestone license keys, and IP address schemes.

2. As-Built & CAD Topology Review: The Contractor shall review and audit all existing CAD topology drawings, door panel wiring diagrams, and network maps to establish an accurate technical baseline.

3. Shadow Operations & Cutover Sign-off: The Contractor shall conduct a minimum of fifteen (15) business days of shadow operations alongside NOAA personnel to demonstrate full operational capability across all C•CURE, Milestone, and ExacqVision platforms prior to assuming full primary responsibility.

Task Area 4 – Invoicing & Transition Milestone Payment Controls

1. Firm-Fixed-Price (FFP) Structure: CLIN 0007 operates on a Firm-Fixed-Price (FFP) basis.

2. Prohibition of Partial Progress Billing: The Contractor shall NOT bill or invoice for CLIN 0007 transition labor on a percentage-of-completion basis.

3. Final Transition Payment Trigger: Payment under CLIN 0007 shall be authorized in full ONLY after:

○ The Government formally approves the Phase-In Transition Plan and Master Equipment

Inventory.

○ All Key Personnel maintain active required certifications (CSEIP, C•CURE Installer) and verified security suitabilities.

○ The COR issues a formal written Certificate of Full Operational Transfer & Transition Acceptance.

PART 3. DELIVERABLES

The type of task order will dictate the deliverables required.

3.1. CLIN 0001: ePACS and eVSS Integrator Services and System Architect (FFP)

Deliverable Frequency Medium / Format Submit To

Planned Key Personnel Absence Notice

At least 5 business days prior to planned leave

Written Notice (Email) COR, TM

Initial Master PACS/VSS Equipment Inventory

Once, within 60 calendar days of contract award

Government CMMS COR, TM

Updated Baseline Inventory & Spare Parts Recommendation

Quarterly, and within 5 days of major hardware deployment

Electronic (MS Excel) COR, TM

Advance Change & System Maintenance Notifications

At least 30 calendar days prior to scheduled updates/outages

Electronic (Written Notice / Email)

COR, TM

Monthly System Operations & Health Report (Uptime, ticket status, storage, backups)

Monthly, by the 10th business day of following month

Electronic (MS Word /

PDF)

COR

Engineering Design Packages (EDPs) & Topology Diagrams

As required for site expansions or system modifications

Electronic (Visio, AutoCAD, or PDF)

COR, TM

As-Built CAD Diagrams & CMMS Updates

Within 10 business days of physical work completion

Electronic (AutoCAD / CMMS Data)

COR, TM

Incident & Root Cause Analysis (RCA) Reports

Within 24 hours of major outage resolution

Electronic (MS Word /

PDF)

COR, TM

3.2. CLIN 0002: Software Licensing, Enterprise Subscriptions, and Integration Support (T&M)

Master Software License & SMA Inventory (C•CURE 9000, Milestone, expiration dates, device counts)

Semi-Annually, and 60 days prior to license expiration

Electronic (MS Excel) COR, TM

Proof of OEM Vendor Status Certification (Active Software House Vendor of Record, Milestone partner credentials)

Annually at contract option exercise, or upon renewal

Electronic (PDF Certification)

COR

License Renewal & Procurement Justification Packages (Including OEM list price verification and discount schedules)

At least 60 days prior to annual SMA or subscription renewal

Electronic (PDF / Itemized Quote)

COR, TM

Post-Integration & Test Verification Sign-off

Within 5 business days of activating new software

Electronic (PDF Test Protocol)

3.3. CLIN 0003: Replacement Parts, Supplies, and Materials (T&M)

T&M Task Order & Head-End Expansion Proposals

Within 5 business days of Government request

Electronic (Itemized Quote, SOW, BOM, Labor)

COR, TM

GSA APL & TAA Compliance Verification Form

Submitted with each hardware procurement/invoice

Electronic (PDF / Signed GSA APL Certificate)

COR, TM

Parts Procurement Receipts & List Price Proof

Submitted with monthly invoice package

Electronic (Vendor Invoices / Catalog Proof)

COR, TM

Spare Parts Stock & Inventory Audit Report

Quarterly, and within 48 hours of stock deployment

Electronic (CMMS Data)

COR, TM

Workmanship Certificate of Acceptance

Prior to submitting labor invoices for completion

Signed Acceptance Form

3.4. CLIN 0004: Travel and Relocation Support (T&M)

Advance Travel Authorization Request (Including cost estimates for airfare, lodging per diem, and justification)

At least 10 business days prior to travel (except emergency dispatches)

Electronic (Agency Travel Form / Email)

COR

Post-Travel Trip Report (Objectives achieved, site conditions, equipment status, and follow-up actions)

Within 5 business days following travel completion

Electronic (MS Word /

PDF)

COR, TM

Travel Expense Documentation Package (Itemized receipts, lodging folios, flight itineraries, and rental car vouchers)

Submitted with monthly invoice package

Electronic (Scanned PDF Receipts)

3.5. CLIN 0005: Technical Labor & Staff Augmentation (FFP)

Staff Augmentation / FFP Labor Proposal Package

Within 5 business days of Government request

Electronic (SOW, BOM, FFP Labor Breakdown, Resumes)

COR

Labor Category Resume & Certification Proof

Prior to assigning new labor to any task order

Electronic (PDF Resumes & Certificates)

COR, TM

Task Order Milestone Completion & Invoicing Acceptance

Submitted with monthly invoice package

Electronic (FFP Invoice & Acceptance Sign-off

PDF)

3.6. CLIN 0006: Emergency After-Hours Support (T&M)

24/7/365 Emergency Dispatch Contact Matrix

Annually, and within 24 hours of any contact change

Electronic (PDF / Portal Entry)

COR, TM,

Security Office

Post-Emergency Authorization Form & Root Cause Analysis

(RCA)

Within 24 hours of emergency incident resolution

Electronic (MS Word /

PDF)

COR, TM

Emergency Outage Monthly Ticket Summary & Timesheets

Submitted with monthly invoice package

Electronic (MS Excel Timesheets / Summary)

3.7. CLIN 0007: Phase-In / Transition Support (FFP)

Draft Phase-In Transition Plan & Cutover Schedule

Within 10 calendar days of contract award

Electronic (MS Word / Project PDF)

COR, CO

Joint Inventory Shadow Audit & Baseline Report

Within 60 calendar days of contract award

Electronic (MS Excel / CMMS Submission)

COR, CO

System Administrative Access & Backup Handover Sign-off

Upon completion of transition cutover

Signed Transition Acceptance Form

COR, CO

PART 4. PERFORMANCE METRICS

The Performance Metrics table establishes clear, quantifiable standards for evaluating contractor effectiveness, system reliability, and service quality under this contract. These metrics serve as operational benchmarks to ensure PACS/VSS availability, federal security compliance, and responsive engineering support across NOAA facilities.

ID Performance Metric PWS Mapping

Description & Measurement Criteria

Target / Performance Standard

Acceptable Quality Level (AQL)

1 PACS & VSS

Enterprise System Availability

CLIN 0001

(Task Area 1)

Operational uptime and availability of core head-end servers, C CURE 9000 software, VMS enterprise software, and SAN/NAS storage arrays.

99.9% 24/7/365 operational availability.

≥99.5% uptime per billing period (excluding scheduled maintenance).

2 Incident & Outage Response Time

CLIN 0001

(Task Area 1) /

CLIN 0006 /

Tech Exhibit 2

Response, mobilization, diagnostic triage, and resolution time for reported system outages calculated from ticket creation per Technical Exhibit 2.

Sev 1: <1hr resp / 8hr fix

Sev 2A: <2hr resp / 24hr fix

Sev 2B: <2hr resp / 24hr fix

Sev 3: <8hr resp / 5-day fix

95% on-time response, remote triage, and resolution per billing cycle.

3 Timeliness of Deliverables

All CLINs / Part 3 / Section 5

On-time submission of required deliverables, including Daily Check-Ins, 5-day T&M Proposals, 60-day SMA Renewals, and Monthly Reports.

100% submitted on or before contractual due dates.

95% on-time delivery across all submission cycles.

4 Documentation Accuracy & Quality

All CLINs / Section 4

Accuracy, completeness, and formatting compliance of reports, engineering design packages (EDPs), network topology diagrams, and IP schemes.

Zero critical errors or omissions on first submission; format adheres to NOAA/OCIO protocols.

≤5% error rate on initial review;

corrections completed within 5 business days.

Description & Measurement Criteria

Target / Performance Standard

Acceptable…