PWS V3-3.26.26.pdf

Performance Work Statement (PWS)

Title: Security Cameras and Lenel HSPD-12 / FIPS 201-3 Compliant Door Access Control Systems – Installation, Service, and Maintenance

Introduction The mission of the Indian Health Service (IHS) is to raise the physical, mental, social, and spiritual health of American Indians and Alaska Natives to the highest level. As part of this mission, the IHS is committed to ensuring the safety and security of its patients, staff, and facilities while providing high-quality healthcare services across its regions.

To support this mission, the purpose of this contract is to design, furnish, install, and maintain Homeland Security Presidential Directive 12 (HSPD-12) compliant Physical Access Control Systems (PACS) and video surveillance systems and alarms in Indian Health Service facilities located throughout the Great Plains and Billings Area, including North Dakota and South Dakota. These systems will enhance the protection of federal facilities, patients, staff, and property through compliance with HSPD-12, Federal Information Processing Standard (FIPS) 201-3, and all applicable federal security and privacy regulations.

The implementation of these systems will ensure standardized, secure, and efficient access control for all IHS facilities, promote accountability, and safeguard critical federal healthcare infrastructure. By integrating advanced physical security technologies, the IHS will continue to uphold its mission of providing safe and secure environments where quality healthcare can be delivered to the Native communities it serves.

1.0 Objectives

• Ensure compliance with HSPD-12 and FIPS 201-3 requirements.

• Physical Access Control (PACS) must come from the GSA Approved Products List under the 13.01 Topology

• Maintain fully functional, continuously operating door access and video surveillance systems.

• Provide secure, auditable, and centrally managed access to protected facilities.

• Integrate panic devices and intrusion detection systems https://www.idmanagement.gov/fips201/%23approved-1301-topology-pacs-products

• Minimize system downtime and security vulnerabilities through proactive service and maintenance.

2.0 Scope

This Performance Work Statement (PWS) defines the requirements for the installation, configuration, integration, service, and ongoing maintenance of security camera systems, intrusion alarms and Lenel door access control systems in accordance with Homeland Security Presidential Directive 12 (HSPD-12) and Federal Information Processing Standard (FIPS 201-3). The contractor shall provide all personnel, equipment, tools, materials, supervision, and services necessary to ensure continuous operation and compliance of physical security systems. The contractor that is awarded this contract must be certified or have a certified sub-contractor in the LenelS2 OnGuard™ software applications and hardware installation/maintenance. The Government must retain rights to all associated data, hardware and software and have full access to all elements of the video surveillance and physical access systems. At no point can the Government be locked out of the system. The contractor will be required to provide a full plan for annual licensing, repairs and annual service/maintenance.

The existing security infrastructure before this IDIQ award includes Recording Servers, Access Panels, Lock Power Supply, Cameras, Card Readers, Electrical Strikes, Exit Door Push Buttons, Panic Buttons, integration with alarm systems, and Door Monitor Switches at the Service Unit Pharmacy Locations.

The current software utilized for Surveillance management is Milestone Systems XProtect Corporate. The current software utilized for Access Control is OnGuard and Lenel.

Existing Hardware Estimates (these are minimums):

Door Readers 535

Door Reader Modules 225

Lenel Controllers 56

HSPD12 PAM Modules 80

Interior IP Cameras appx 800

Exterior IP Cameras appx 120

Virtual Servers 30

Panic Buttons 80

Intercom master door stations 15 with 36 Doors

The Recording Servers currently in place are virtual servers with Windows 2022. During the base +4 option years of this contract, there will be a Windows OS Server upgrade that the vendor will be expected to perform. In addition, the vendor will be responsible for ensuring that the servers remain up and fully patched/maintained throughout the life of this contract. This includes (but is not limited to) adequate partitions configured for system growth, system updates and maintenance.

This performance-based methodology requires the contractor, as part of its proposal, to furnish the government with a Statement of Work (SOW) that defines how the contractor proposes to accomplish the work. The contractor shall also furnish standards that demonstrate the accomplishment of the work as proposed.

3.0 Background

To meet federal security standards and enhance facility access control and video surveillance capabilities, the organization requires installation and lifecycle support of Lenel OnGuard-based access control systems and an enterprise-grade IP-based CCTV system. These systems must comply with federal mandates for identity verification, credentialing, and facility protection.

4.0 Contractor Responsibilities

4.1 Installation and Configuration

The contractor shall:

• Provide all employee transportation for work performed, maintain satisfactory standards of competence, conduct, appearance and integrity, and adhere to sign in/out procedures while performing work at IHS facilities and locations

• Notify Contracting Officer’s Representative (COR) of any delays, illnesses or inability to perform duties as soon as the vendor becomes aware of the delay.

• Install new and maintain existing IP-based security cameras, network video recorders (NVRs), and required infrastructure.

• Install intrusion detection systems and panic buttons

• Install new and maintain existing Lenel OnGuard hardware and software components, including readers, panels, and controllers.

• Integrate access control systems with Personal Identity Verification (PIV) credentials per FIPS 201-3.

• Configure and test badge readers for multi-factor authentication.

• Provide network integration and coordinate with IT for IP address assignment, VLAN configuration, and cybersecurity requirements.

4.2 System Integration

• Ensure seamless integration with existing physical security systems. Products and services used to update and maintenance existing systems will not require full change out of infrastructure. They will integrate and work with Lenel access control systems.

• Synchronize systems with Active Directory, PIV card database, and other federal identity management systems.

• Configure monitoring workstations and management dashboards.

• Provide multi-site/area office monitoring capabilities

4.3 Preventive and Corrective Maintenance

• Perform routine inspections and diagnostics of all camera and access control hardware and software.

o If defects are noted, provide a repair schedule and/or corrective maintenance plan to include response time(s) to

• Replace or repair failed or degraded components.

• Provide 24/7 remote support within 1 hour of contact and emergency onsite response within 12 business hours.

• Maintain current firmware/software versions and security patches in accordance with agency cybersecurity policy.

4.4 Documentation and Reporting

• Provide as-built drawings, configuration details, and system architecture diagrams.

• Maintain a maintenance log with system status, service actions, and incidents.

• Submit quarterly system health reports and compliance audits.

4.5 Training and Support

• Provide training for security and IT personnel on system operation, troubleshooting, and administration when new systems are installed, prior to site project completion.

• Provide annual training to Great Plains and Billings Area users end user skills and administration skills and resources.

• Supply user manuals, SOPs, and training guides.

5.0 Deliverables

Deliverable Frequency Format

Installation and Configuration Report Upon completion PDF / Digital

Maintenance/Support Logs Monthly Excel / PDF

System Health Reports Quarterly PDF

As-Built Documentation per site Post-installation PDF

User Training & Manuals Post-installation PDF

6.0 Security Requirements

Contractor personnel shall undergo background checks and adhere to all facility access protocols. Systems shall be installed in compliance with federal cybersecurity and physical security regulations. For reference these requirements include: SPD‑12, FIPS 201‑3, NIST

SP 800‑116r1 (PIV in PACS), NIST SP 800‑73‑5/78‑5 (PIV interfaces/crypto), ISC Risk Management Process (2024) for facility security levels and countermeasure tailoring, FAR 52.204‑9 (PIV of contractor personnel), FAR 52.204‑25 (NDAA §889), IHS IHM Part 5, Chapter 30 (HSPD‑12/PIV policy), ONVIF S/T/G/M for devices, SIA OSDP (IEC 60839‑11‑5) for reader comms, HIPAA Security Rule safeguards where applicable, and DISA STIG/CIS hardening for Windows servers.

7.0 Period of Performance

The base period of performance is 12 months from the date of award, with four (4) 12-month option periods for continued service and maintenance.

8.0 Place of Performance

All work shall be performed at the designated federal facilities, as listed in contract. A table of currently supported facilities is included in this PWS, this list is subject to change upon mutual agreement of the Government and the Vendor. Some remote diagnostics and updates may be conducted offsite.

9.0 Government-Furnished Equipment (GFE)

The Government may provide badges, network access, and secure storage space for tools and equipment. All other equipment shall be furnished by the contractor unless otherwise specified.

10.0 Applicable Regulations and Standards

• HSPD-12

• FIPS 201-3

• NIST SP 800-116

• DHS 4300A

• Federal Acquisition Regulation

(FAR)

11.0 Vendor Required Credentials

• Aruba Gold Partner

• Cisco Gold Partner

• Cisco CCNP Routing and Switching

• CCNP Data Center

• Certified Project Management Professional (PMP) on Staff

• Certified IT Infrastructure Library (ITIL) on Staff

• manufacturers and CISSIP certified personnel on staff

• Leviton Certified Technician on Staff

• LenelS2Certified Partner

PLACE OF PERFORMANCE

This contract refers to the Indian Health Service facilities throughout the Great Plains and Billings Area. They are located in the following cities: The contractor will need to confirm actual square footage of each location.

Facility Estimated Square Footage Aberdeen, SD Physical Access Control Belcourt, ND 105279.5 Fort Yates, ND 1723.8

• Cannon Ball, ND 2475 Sisseton, SD 85574.2 Wagner, SD 36128.8 Winnebago, NE, Drug Dependency Unit 15000 McLaughlin, SD 7207

• Wakpala, SD 1920

• Bullhead, SD 960

Rosebud, SD 93977.8 Pine Ridge, SD 122857.8 Kyle, SD 18770 Wanblee, SD 14434.5 Rapid City, SD 46895 Eagle Butte, SD 138491.9 Fort Thompson, SD 20818.8 Lower Brule, SD 12022 Mobridge, SD 31483.7

Minot, ND 2000 Martin, SD 2225 LaCreek, SD 464.5 Manderson, SD 960 Mobridge, SD (YRTC) 31484 Sioux Falls, SD South Dakota Urban 20000 Pierre, SD South Dakota Urban 15000 Lame Deer Health Center 63500 Chief Redstone Clinic 18000 Verne E Gibb Health Center 14000 White Buffalo Clinic 11000 Fort Belknap Hospital 52000 Eagle Child Health Station 14000 Crow/Northern Cheyenne Hospital 95000 Lodge Grass Health Clinic 8000 Pryor Health Station 8700 Blackfeet Community Hospital 137000 Heart Butte Health Station 7000 Billings Area Office 7000

CONSTRAINTS

All tasks under this contract will be conducted in accordance with Homeland Security Presidential Directive 12 https://www.dhs.gov/homeland-security-presidential-directive- 12, and FPS-201 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-3.pdf . All work must follow HSPD-12/FIPS 201-3; procure APL-validated PACS solutions; comply with §889 prohibitions; never lock the Government out of any system, data, or keys; and observe all confidentiality/privacy requirements.

Access to Government Property (on-site contractors) The COR and/or Project Manager will make all necessary arrangements for access by contractor personnel to the work site(s).

While on government property, the contractor personnel shall comply with all rules and regulations pertaining to health and safety, not only as they apply to themselves, but also to other personnel and property at the site. Contractor personnel shall comply with all regulations restricting the disclosure of information which may become known during the performance of this contract

In the performance of work hereunder and with the price herein, the contractor shall obtain and maintain in effect all necessary permits and licenses required by Federal, State, Tribal, or local government, or subdivisions thereof, or of any other duly constituted public authority. Further the contractor shall obey and abide by all applicable laws and ordinance.

https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-3.pdf

AUTHORITY

1. No person other than the Contracting Officer has authority to bind the Government with respect to this contract.

2. No action or omission of any government employee or representative other than the Contracting Officer shall increase or decrease the scope of this contract or shall otherwise modify the terms and conditions of this contract.

3. In no event shall any of the following be effective or binding on the Government or imputed to the Contracting Officer with respect to this contract:

a. An understanding or agreement between the Contractor and anyone other than the Contracting Officer;

b. A purported modification or change order issued by anyone other than the Contracting Officer;

c. A promise by anyone other than the Contracting Officer to provide additional funding or make payments; or

d. An order, direction, consent, or permission from anyone other than the Contracting Officer to:

i. Incur costs in excess of a specified estimated cost, allotment of funds, or other ceiling; or

ii. Expend hours in excess of a specified level of effort.

Attachment A — Service Levels & QASP (Government Surveillance)

Definitions

• Availability: service reachable and performing intended function; excludes Government-approved maintenance windows.

• S1 Critical: Area-wide PACS/VMS outage; loss of recording at hospital; life/safety issue.

• S2 High: Multi-door failure; door won’t re-secure; pharm vault camera failure;

certificate validation down at site.

• S3 Medium: Single door/camera persistent fault.

• S4 Low: Cosmetic, documentation, minor tuning.

Service Levels

Metric Target AQL / Remedy

PACS core uptime (site)

≥ 99.5% monthly Credit 5% MRC/site per 0.1% below to 98.5%

VMS recording uptime (site)

≥ 99.5% monthly Same as above

Patch currency (Critical/High)

≤14 / ≤30 days respectively

Finding on quarterly audit = corrective action plan in 10 days

Backup success (servers/config)

≥98% monthly Restore test failure = plan & retest in 5 days

APL attestation Quarterly, no gaps Gap = stop-work on non-APL work until resolved

Government QA will review monthly logs, sample doors/cameras, and change records against this QASP.

Attachment B — Acceptance & Commissioning (per Site)

1. Design package accepted (drawings, IP plan, reader schedule, cert validation design).

2. Function tests (100% of new, ≥10% of existing)

a. Door: normal access (PIV), schedule unlock, antipassback (if used), forced/held alarms, REX, fail-safe/secure behavior, intercom call-up.

b. PIV: PKI validation (including CRL/OCSP), authentication mode per risk tier, card revocation test.

c. Video: live/recorded streams, event-triggered call-ups, time sync, retention ≥ policy, export with hash/chain-of-custody.

3. Security: admin RBAC, audit log forwarding, two Government break-glass admin accounts verified; NDAA-compliant hardware list.

4. Performance: failover/restore tests, alarm latency, VMS throughput within OEM spec.

5. Documentation & Training delivered and accepted.

6. 30-day burn-in defect period; punch-list closure prior to final acceptance.

Attachment C — Compliance Crosswalk (excerpt)

Requirement Source(s) How satisfied

Use PIV for facility access; agency HSPD-12 policy

HSPD-12,

IHS IHM

Part 5 Ch. 30

OnGuard + APL validation + PIV auth at portals; IHS badging. Department of Homeland Security+1

FIPS 201-3 credential & auth mechanisms;

deprecations

FIPS 201-3

Disallow CHUID; implement PKI-based mechanisms;

support SM-AUTH where applicable. NIST Computer Security Resource Center

Risk-based PIV modes at portals

NIST

SP 800-116r

Controlled/limited/restricted zones mapped to CAK/OCC-AUTH/BIO-A as required. NIST CSRC

PACS solution/listing

GSA

FIPS 201

APL

Procure from APL (e.g., “LenelS2 OnGuard with HID Embedded Auth”). Id Management

Reader comm security

SIA OSDP /

IEC 60839-1

1-5

Use OSDP Secure Channel on new/modernized doors; no new Wiegand. IEC Webstore

Supply-chain ban (covered video/telecom)

FAR 52.204-

Procurement screens; letters of conformity; periodic scans. Legal Information Institute

Contractor PIV of personnel

FAR 52.204-

Clause in prime/subs; badging, returns, tracking.

Legal Information Institute

Cloud (if used) FedRAMP Only FedRAMP-authorized SaaS/hosted services.

FedRAMP

HIPAA safeguards (in care settings)

HIPAA

Security Rule

Placement review; access controls; logging; retention policy. HHS.gov

The contractor will comply with the following listed regulations:

https://www.dhs.gov/homeland-security-presidential-directive-12?utm_source=chatgpt.com https://csrc.nist.gov/pubs/fips/201-3/final?utm_source=chatgpt.com https://csrc.nist.gov/pubs/fips/201-3/final?utm_source=chatgpt.com https://csrc.nist.rip/publications/detail/sp/800-116/rev-1/final?utm_source=chatgpt.com https://www.idmanagement.gov/fips201/ https://webstore.iec.ch/en/publication/33414?utm_source=chatgpt.com https://www.law.cornell.edu/cfr/text/48/52.204-25 https://www.law.cornell.edu/cfr/text/48/52.204-9 https://www.fedramp.gov/about-marketplace/?utm_source=chatgpt.com https://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/index.html?utm_source=chatgpt.com

- Privacy Act, 5 U.S.C. 552a - Office of Privacy and Civil Liberties | Privacy Act of 1974

- Health Insurance Portability and Accountability Act (HIPAA) - eCFR :: 45 CFR Part 164 -- Security and Privacy

- CFR 42 Part 2 - eCFR :: 42 CFR Part 2 -- Confidentiality of Substance Use Disorder Patient Records

Indemnification and Governing Law

Indemnification, Liability, Statute of Limitations: Any provisions in the Terms of Service (TOS) related to indemnification and filing deadlines are hereby waived, and shall not apply except to the extent expressly authorized by law. Liability for any breach of the TOS as modified by this amendment, or any claim arising from the TOS as modified by this amendment, shall be determined under the Federal Tort Claims Act, or other governing federal authority. Federal statute of limitations provisions shall apply to any breach or claim.

Governing law: Any arbitration, mediation or similar dispute resolution provision in the TOS is hereby deleted. The TOS and this amendment shall be governed by and interpreted and enforced in accordance with the laws of the United States of America without reference to conflict of laws. To the extent permitted by federal law, the laws of the State of locations covered in this PWS will apply in the absence of applicable federal law.

https://www.justice.gov/opcl/privacy-act-1974 https://www.justice.gov/opcl/privacy-act-1974 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2 https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2

Introduction