RFQ Attachment 1 - SOW.pdf

Statement of Work

National Institute of Allergy and Infectious Diseases (NIAID) – Security and Emergency Preparedness Maintenance

June 5, 2024

1. Purpose To acquire maintenance service for systems utilized by the National Institute of Allergy and Infectious Diseases (NIAID), Surety and Preparedness Coordination Branch (OBRS), including access control systems (ACS), video imaging systems, closed circuit television (CCTV), various security detection and initiating devices, perimeter detection, and others. The NIAID is seeking contract services to maintain these systems and the overall physical security infrastructure. More specifically, this is critical infrastructure for maintenance and installation products and services in support numerous NIAID-wide campus customers. The maintenance and installation of these systems requires onsite coordination and tie-in to the existing NIAID campus security network management systems that require a high level of technical expertise/skill sets.

Period of Performance:

Place of Performance:

Base Period: July 14, 2024 – February 28, 2025 Option Period 1: March 1, 2025 – February 28, 2026 Option Period 2: March 1, 2026 – February 28, 2027

NIAID buildings with the following locations: 5601 Fishers Lane, Rockville, MD; Integrated Research Facility, 8200 Research Plaza in Frederick, MD; 9 West Watkins Gaithersburg, MD; Bethesda Campus, 9000 Rockville Pike, Bethesda, MD (Buildings: 33, 31, 40, 40a, 40b, 29b);

and 12735 Twinbrook Pkwy. Rockville, MD

2. Background The Office of Biodefense Research and Surety (OBRS) has an integrated, enterprise electronic security management system providing commercial off-the-shelf (COTS) card access/entry control, visitor management and integrated video imaging/badging in conjunction with security alarm monitoring and control (intrusion detection), and Closed-Circuit Television (CCTV) with alarm call-up and digital video recording in a single system platform. The system was designed to be FICAM compliant and provide a high measure of safety and security to personnel and property as well as to safeguard information as part of this agency’s statutory responsibilities.

The OBRS architecture is based on standard TCP/IP Ethernet network technology for all communication requirements. OBRS interfaces via its dedicated, proprietary, closed network infrastructure at each site (Utility network). The OBRS COTS applications system software packages reside on the Microsoft Windows Operating System Platform with Microsoft SQL used for database management.

The Federal Protective Service is charged with protecting the safety of NIAID personnel, information and property at all GSA leased locations. The Surety and Preparedness Branch provides for security systems at each NIAID facility listed. The enterprise electronic security system installed at all NIAID National Capitol Region locations uses a COTS application that is FIPS 201-2 compliant into limited access areas using a network of COTS applications and components provided by the vendors listed in paragraph 4.b. Since the current system is not to be replaced, NIAID requires a managed services philosophy with maintenance support of existing systems and components.

The software, hardware and firmware in the systems are all proprietary to the respective COTS providers. Updates, patches and trouble resolution are developed, published and provided by each COTS provider respectively. To maintain the integrity of their products, the COTS providers provide advanced support only to their respective authorized dealers or direct by contract. While other developers/manufacturers may sell/service similar products, only those developers/manufactures are licensed or authorized to produce updates, make system modifications or configuration adjustments to these COTS systems. Additionally, only authorized dealers or system owners under contract receive direct notification from COTS developers/manufacturers of security or system patches as they become available, thereby mitigating the costs associated with future performance issues by maintaining the health of the entire system.

In addition, only an authorized dealer or system owner under contract will receive COTS provider support, guidance and direction on how other network, operating system or other COTS system security patches, upgrades, modifications or configuration changes will impact their product and its performance. Therefore, only an authorized dealer or sub-contracted partner possessing the requisite agreement, certifications and/or licenses relevant to the systems will be able to provide the required support to maintain system integrity with minimal tenant disruption.

3. Scope The scope of this effort includes the services, supplies, resources, and industry knowledge necessary to provide support and maintenance to NIAID's security and emergency preparedness systems.

4. The contractor shall provide the following.

a. An onsite technician who shall perform all tier 1, some tier 2 troubleshooting and corrective maintenance, small projects, and as some preventative maintenance. Pre-approval from the COR is required for all preventative maintenance. The contract awardee shall provide subject matter expertise and additional staffing support to fill all gaps in technician’s ability to support the NIAID’s systems, security infrastructure and IT networking components.

b. Maintenance/support to NIAID’s physical security countermeasures and emergency management systems which are comprised of various COTS physical security products including, IDS, access control, CCTV, digital video recording, visitor management, emergency phones, drop arm gates, wedge barriers, and related components for NIAID facilities in the National Capitol Region. The NIAID utilizes specific, proprietary COTS products to secure its facilities and requires factory trained and certified personnel to service, administer, maintain, install, upgrade, patch, and provide necessary modifications and/or repairs as needed. Many of the software system developers and systems manufactures operate under a value-added reseller (VAR) model and will require direct relationships. As a VAR for NIAID’s systems, the contractor shall provide maintenance, engineering, and OEM support on all systems and subsystems of OBRS within the place of performance listed earlier. This includes the following systems and sub systems but not limited to:

Physical Security

• Andover Controls, Continuum Access Control Hardware/Network Systems

• Avigilon Video Management

• Optellios Fiber Optic Base Perimeter Detection System

• Optelecom Fiber Optic Transmission Equipment

• Bosch Intrusion Detection Equipment

• HID Reader Devices 3

• Bioscrypt Biometric Systems

• LG/Color IDIris Biometric Reader Devices

• Delta Scientific Barrier Control Systems

• Armor Gate Control Systems

• APSG Vehicle Barrier Systems

• Pelco Video Systems & Digital storage devices

• Audio Monitoring Devices

• Extreme TV IR Illumination Systems

• FLIR Thermal Imaging

• Turnstiles

• American Fibertek Fiber Optic Equipment and Modules

• Dell Workstation/PC/Server/Display Monitor Equipment Hardware & Software

• Video Transmission Conversion Equipment

• DoorKing Communications/Access/Vehicle/Barrier Control Equipment/Devices

• Talk-A-Phone Intercom/Communications Equipment/Devices

• EasyLobby Visitor Management System

• Boon Edam Turnstiles

• HID PIV Class readers and suite of products to include PAM boards and IDPublisher

Technical Expertise and Certifications required:

• Certified System Engineer ICAM PACS (CSEIP) (2 certified staff)

• Cisco CCNA Certification or higher

• Contractor shall provide engineers and technicians knowledgeable in networking, computer hardware and software, databases, and information security.

• Contractor shall have the ability and relevant certifications to service cameras that require scaling from the building roof to access. Teaming is acceptable.

• Expertise with system server failover, hot and warm redundancy best practices in both virtualized and non-virtualized IT environments.

• Expertise operating in and with test, stage and production IT environments. Including expertise in best practices related to systems lifecycle management.

c. Qualified, certified personnel for timely support and maintenance of the NIAID’s COTS systems and related components including the test environments as well as the dedicated network and devices as it relates to systems performance. The contractor shall provide support services to include technical advice and guidance; hardware and software configuration management;

network engineering assistance and maintenance in direct support of performance; system maintenance to include services relating to any phase of development, design, installation, engineering; and technical support for system solutions and projects. The tasks include troubleshooting; analysis, support, and resolution of hardware, software and firmware updates, vulnerability remediation (Security Assessment and Authorization (SA&A) and related Plan of Action and Milestones (POAMs), integration and migration support services for system management and network solution analysis. This effort requires subject matter expert advice for Microsoft Windows-based and Linux operating systems, SQL, associated hardware, and OEM applications, software, hardware and firmware. The contractor will keep all system and subsystem SSAs and/or licenses up to date during the maintenance period aggregating them into a coterminous package. The Contractor shall be responsible to assist the NIAID IT staff with computer and LAN technical support as it relates to system performance, as well as operations services for the security 4 systems infrastructure as outlined in this document. This contract shall encompass all of NIAID’s security systems located in the place of performance section of this SOW.

d. Core hours/Emergency Response Times/On-Call, Standby. The Contractor shall provide resources required to support the NIAID hours of 6:30 a.m. to 3:00 p.m. EST. or other times as agreed upon by the Government and the Contractor. The Contractor shall provide to the Government the escalation path for the Contractor's services for afterhours work and adjustments as needed to this process through the life of the contract. The Contractor shall be expected to respond to afterhours work request no more than 2 hours after dispatch.

e. Preventative Maintenance

i. The contractor’s preventative maintenance program will consist of tasks that are proactive to prevent, predict and minimize system, subsystem, and component failure.

Preventive maintenance, also known as scheduled or routine maintenance, includes activities recommended by manufacturers and/or system engineers that are typically performed on a periodic basis—such as system inspections, routine cleaning, and software release installations—to ensure that systems and subsystems are in proper working order. The intention is to keep equipment and software operating efficiently, extend the operational life of equipment, and identify equipment issues before a failure occurs.

ii. The Contractor shall verify that operations are performed correctly and on-time, perform recommended manufacturer diagnostic tests and/or periodic tasks recommended by equipment/system manufacturer. Preventative Maintenance activities will include a combination of visual inspections, operation testing, adjustments, cleaning, lubricating, system backups, file clean up and hard drive defragmentation, verification of software and system electronics, software release installation/patching, and any other periodic task recommended by the equipment/system manufacturer. If the onsite technician is working on a government critical system, the contractor will supplement staffing as needed so as not to critically delay critical preventative maintenance activities. The contractor will immediately notify NIAID of all equipment failures that are discovered as part of Presentative Maintenance efforts and present a resolution plan that includes parts list and costs.

iii. As part of this Maintenance Activity, Contractor shall perform maintenance services including, but not limited to:

1. Perform switch and patch panel inspections for visual indications of faults or loss of link between inter-building trunks.

2. Perform version upgrades, firmware updates and configuration changes as needed (pre-approved by the COR). All available upgrades/updates for any system will be presented to the government prior to initiating the Preventative Maintenance (PM) cycle.

3. Check server event logs (Application, System, and Security) for system errors, misconfiguration, etc. Communicate system errors to COR.

4. Perform system and subsystem application updates, as indicated by manufacturer, to conform to security requirements and NIAID IT.

iv. The Contractor shall provide the following routine preventative maintenance tasks and services monthly and provide a follow up maintenance log documenting all findings:

1. Maintain configuration management documentation and change control logs.

2. Perform switch inspections for visual indications of faults or loss of link between interbuilding trunks.

3. Perform firmware updates and configuration changes as needed to conform to NIAID Information Assurance Vulnerability Alerts requirements to come from the SA&A and penetration testing.

5. Check Patch Panels

6. Working with NIAID IT staff, perform Microsoft updates as needed, to conform to Microsoft security requirements and NIAID Vulnerability Alerts requirements while keeping in mind the applications running on the servers.

7. Perform software patches, updates, and upgrades on all systems and subsystems as listed in this document. This shall include hardware, software, and firmware. All system updates/upgrades will be presented to the government prior to installation for approval.

f. Remedial (corrective) Maintenance.

Remedial maintenance corrects faults and returns system/s to operation if a hardware or software component fails. A failed system or component may be detected during preventive maintenance activities or may be detected by the customer during normal operation of the system. The weekly onsite technician shall provide all tier 1 remedial maintenance, and some tier 2 based on his/her skill level. Anything outside of the technician’s skill level shall be the responsibility of the contractor. Remedial maintenance shall include unlimited support hours.

Trouble calls and service requests shall only be accepted from authorized NIAID representatives.

NIAID shall provide a list of personnel authorized to initiate service requests upon contract award. The Contractor shall provide technical and maintenance support services for installed and operational electronic systems as required. The following services are required:

i. Provide necessary support for Microsoft operating system, application, and LAN/WAN related issues.

ii. Remove and replace defective equipment and ensure new equipment is operating properly.

iii. Replace failed management modules, panels and boards, interface modules, chassis, NVRAM, flash memory, and defective patch cables.

iv. Have full understanding of databases and replication and how it replicates to the various systems. This can be done in a hard server environment, FedRAMP-approved cloud or virtual environment.

g. The Contractor shall have available SME technicians for all systems and subsystems listed in this SOW as well as be certified and trained in Microsoft Windows 10 and higher Active Directory based client server environments and IP-based LAN/WAN environments. The technician(s) shall perform routine checks of all the security equipment to verify that all systems are working properly and document findings. As needed, the technician(s) shall make repairs/adjustments to malfunctioning equipment found during these checks and document this work. The contractor will present these checks as part of the maintenance plan.

h. The Contract shall provide OEM equipment (or approved alternative) required to maintain the existing systems, platforms, subsystems, and items in support of this SOW using Other Direct Costs (ODCs). This includes supplies not provided by the Government otherwise during performance. All ODCs must be pre-approved by the COR prior to purchase. Section 508 compliant ODCs are required when applicable. Energy-efficient ODCs are required when applicable. NIAID has a requirement for security systems installations and life cycle support services providing Electronic Security Systems (ESS) to meet the operational requirements of the agency. This support and services shall apply to all existing, platforms, systems, subsystems and items and provide an end-to-end turnkey solution. Examples of potential ODCs include:

locks, cameras, switches, modules, security panels, power supplies, card readers, and other components/parts of NIAID systems.

i. Configuration Management (hardware/software). Hardware or software configuration changes shall be in accordance with NIAID’s Configuration Management policy. The NIAID Chief Information Security Officer (CISO)/ CBIIT must be informed of and involved in all configuration changes to the NIAID IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The NIAID IT will approve any request for change prior to any development activity occurring for that change and will define the security requirements for the requested change.

a. All application or configuration patches in the NIAID IT environment shall be pre-approved by NIAID IT.

b. The Contractor shall ensure all sites impacted by patching are compliant within 14 days of change approval and release.

c. The acquisition of commercial-off-the-shelf (COTS) Information Assurance (IA) and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting “sensitive information”) shall be limited to those products that have been evaluated and validated, as appropriate, and as listed under the Controls portion of this document.

d. All solutions, services, IT hardware/software shall meet HHS, NIH and NIAID policies, standards, and procedures.

j. Security Policy and Architecture

a. All services, hardware and/or software provided under this award must be compliant with HHS, NIH, and CBIIT network security policy.

b. The Contractor solution shall follow all current versions of NIAID, NIH and HHS policies, procedures, guidelines, and standards, which will be provided by the Contracting Officer upon request.

k. Administrative/Compliance

a. Product Inventory & Warranty Control. The contractor shall prepare, maintain, and provide an inventory which shall contain warranty information for each product purchased, the accepted industry nomenclature for the product, serial number and where applicable MAC and IP address of each product, quantity of each product, date of purchase, cost for each product, expiration (if applicable) of each product and, the status of each product (i.e., destroyed, transferred, storage, etc.) An inventory will be conducted by both the contractor PM and the contractor-provided technician (or representative) according to the deliverables in paragraph 6.

b. Security and Facility Access. All technicians and engineers assigned to support NIAID on this contract must obtain unescorted access to these facilities by obtaining an HHS/NIH badge. The badge must be for both physical and logical access and must be kept up to date by taking all required annual trainings as dictated by NIAID, NIH or HHS. All personnel obtaining unescorted access to the facility must meet the eligibility requirements for such a level of access.

c. General Security Responsibilities for Contract Performance. The Contractor shall ensure that its employees follow all policies and procedures governing physical, environmental, and information security described in the various NIAID regulations pertaining thereto, good business practices, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract. Personnel will be responsible for the physical security of their area and government furnished equipment (GFE) issued to them under the provisions of the contract.

i. All personnel that will work on site must be qualified to receive a government PIV card and NIH active directory account. The vendor will be required to fill out the appropriate paperwork and take NIH awareness trainings to qualify. The government will work with the vendor to make sure that they understand the process and strive for delivery within 90 days of contract award.

ii. If needed, all Contractor employees shall receive initial NIAID IT Security Awareness Training within 60 days of assignment to the contract. If needed, refresher training must be completed annually thereafter.

iii. If needed, the education and training will meet standards established by the National Institute of Standards and Technology (NIST) and set forth in HHS and NIAID security policy.

iv. If requested, Evidence of training provided to personnel will be available upon request by the HHS/NIH IT Security Training Office, or during HHS/NIAID onsite validation visits performed on a periodic basis.

5. Inspection and Acceptance Requirements All work under this award will be monitored by the Contractor Officers Representative (COR), who will act as the primary representative of the Government. Final inspection and acceptance of all work performed, reports and other deliverables will be performed by the COR. In the absence of the COR, an alternate POC will be designated, and the Contracting Officer will provide final inspection and acceptance. All work shall be completed in accordance with industry standards.

6. Deliverables Monthly Status Reports. Contractor shall submit a Monthly Status Report to NIAID. Contractor shall cite all action taken during the month. This shall be reported in the form of a log of all the monthly activity and associated Corrective Maintenance Actions. It should include open and closed trouble tickets and relevant status. This report shall be delivered to the NIAID Representatives via email or letter correspondence.

7. Transition of Support

In the event the existing order is not awarded to the incumbent, the Contractor shall make available to a successor contractor all documents, other contract-related materials, as well as any Government Furnished Equipment and Government Furnished Information. These materials shall be organized and catalogued in sufficient detail to support an orderly transition to the successor Contractor. The Contractor shall prepare a transition plan to be implemented within 30-45 days before the end of the order. The Contractor shall work with the COR and Contracting Officer to refine and complete this plan. This plan shall include a list containing detailed descriptions of any process documentation (e.g., hard, and electronic copies of all standard operating procedures, process diagrams, forms, user guides, and checklists) and any informational materials to assist the transition to the successor contractor. The Contractor shall work with the successor contractor to ensure an orderly transition with minimal service disruptions and will assure the dedication of appropriate personnel to manage and provide oversight of the transition.