SOW_FICAM_COMPLIANCE_UPGRADE_SPECIFICATION_27June2022.pdf

NIFC CAMPUS PACS

MODERNIZATION SERVICES SPECIFICATION

NIFC CAMPUS PACS MODERNIZATION

SERVICES SPECIFICATION

1.0 PART 1

1.1 GENERAL

A. The Bureau of Land Management (BLM) National Interagency Fire Center (NIFC), in Boise, Idaho has a requirement to upgrade the existing campus-wide access control system to full compliance with Federal Identity, and Credential Access Management (FICAM) standards.

B. The existing access control system is based on AMAG Technology Inc. hardware and software, upgrades shall modify the existing AMAG access control system to a seamless transition to a full FICAM compliance.

C. Vendor shall determine, provide, and install all associated hardware, software, and firmware required to bring the existing base-wide access control system into full FICAM compliance with all readers at Assurance Level 2.

D. The campus includes a mix of AMAG access control hardware located in 16 occupied buildings including several perimeter personnel and vehicle gates. The current system includes 27 door controller nodes operating 127 card readers. Vendor should take note that the node and 1 card reader located in the basement of building 100 ADM will not be upgraded and will be abandoned in place. Location and description of the existing security system hardware are shown on the following drawings (Attachment 1) described in Table 1.

1) The campus buildings requiring work were constructed in three distinct periods, the

1960’s, 1980’s and 2010’s.

2) The buildings include a mix of uses including office space and warehousing.

3) Ceilings in the buildings requiring work include a mixture of suspended tile, gypsum/wood hard decking and open steel framing. No removal of hard deck ceiling is anticipated in this work effort, conduit and data cable trays are accessible through access panels.

4) Interior and exterior pathways are available to all devices requiring service, with no drilling or coring expected to be required.

Table 1 - Existing Hardware Drawings

Drawing Number Building Name

ES-010 100 ADM

ES-020 102 SHP

ES-030 106 OWY

ES-040 110 TRN

ES-050 115 NWS

ES-060 140 MGB

ES-070 200 BAD

ES-080 205 PAR

ES-090 210 RMP

ES-100 215 GBK

ES-110 300 JWH

ES-120 410A ITS

ES-130 410B RSC

ES-140 410C RWS

ES-150 415 MNT

ES-160 700 NCN

E. Existing Software: The existing software includes AMAG Symmetry Professional Homeland

Security Edition version 9.3.25, database version 9.3.25 48003, installed on a Windows Server

2016 operating system running as a virtual machine on VMWare vSphere 7.X with 3 clients.

1) Additional existing active system licenses:

I. Threat Level Manager Module

II. 128 Card Reader License (Professional)

III. Data Connect Module

IV. 1 Client Software License (Professional)

V. Symmetry

VI. 64 Card Reader License (Professional)

VII. 1 Client Software License (Professional)

VIII. 1 Client Software License (Professional)

F. Existing Hardware: The existing security system is composed of a mixture of FICAM-Ready and legacy non-FICAM hardware as indicated on the attached drawings and summarized in Table 2 below.

Table 2 – Summary of existing hardware

Drawing Number

Building Name

Non-FICAM Ready (Replacement required)

FICAM-Ready (PAMs required)

S853 Card Readers

Monitoring Points

M2150-xDBC Node

CAB3A

Cabinet

RKCL40

Card Reader

EN-DBU-

Node with

M2150 4DC-

F-HSE

Controller(s)

Life Safety Power Cabinet

ES-010 100 ADM 1 1 1 4 1 1

ES-020 102 SHP 3 1 1

ES-030 106 OWY 12 2 2 2

ES-040 110 TRN 8 1 1 1

ES-050 115 NWS 2 1 1

ES-060 140 MGB 9 1 2 2

ES-070 200 BAD 7 1 1

ES-080 205 PAR 10 2 2 2

ES-090 210 RMP 5 1 1 1

ES-100 215 GBK 12 8 3 3

ES-110 300 JWH 18 3 5 5 9 1 2

ES-120 410A ITS 7 1 1

ES-130 410B RSC 7 1 1

ES-140 410C

RWS

6 1 2

ES-150 415 MNT 4 1 1

ES-160 700 NCN 3 3 1 1

Total: 101 23 23 23 26 4 6

G. Work shall be performed during regular working hours, Monday through Friday, 8:00 AM MDT to 4:30 PM MDT.

H. Work will be performed on a maximum of two buildings at a time, in an ordered selected by the company and coordinated with COR. Work on the next building will be allowed only after

FICAM-Ready startup as described in Section 3.1.I EXECUTION is complete.

I. Company shall have limited use of premises for work effort as defined by the Contracting

Officer Representative (COR) and shall be escorted by the Government where required.

J. The company shall supply all tools and material required to complete the installation. The Government shall not be responsible for the security of company tools or materials.

1.2 DEFINITIONS

A. FICAM-Ready – NIFC existing door access hardware solution includes the following: HID

RKCL40-K-PAM card readers, M2150-4DC-F-HSE door controllers, EN-DBU-xxK-MK2-HSE node/controllers. Addition of the HID pivCLASS PAM unit is required to allow the solution to be FICAM compliant.

B. Non-FICAM-Ready – NIFC existing legacy door access hardware solution includes: AMAG S-853

Contact/Contactless Card Readers, M2150-4DBC-HSE and M2150-8DBC-HSE controllers.

Replacement of the card readers and controllers is required to allow FICAM compliant solution.

1.3 QUALITY ASSURANCE

A. The company performing installation and programming shall be AMAG factory authorized dealer and reseller. All technicians performing the installation shall be AMAG certified installers with current certifications in Symmetry V9 and have successfully completed AMAG’s

FICAM training course. System design/install engineer(s) shall be Certified System Engineer

ICAM PACS (CSEIP) certified for providing FICAM compliant access control systems. Company shall provide current certification and training certificates for verification of all certifications.

B. All work shall be in accordance with the latest standard of the National Electrical Code (NEC) and meet OSHA safety regulations.

1.3 WARRANTY

A. The installation shall be covered by a one-year parts warranty and a one-year labor warranty.

B. The Company shall file any applicable manufacturer’s warranty with the manufacturer for equipment provided to NIFC.

1.4 SUBMITTALS

A. Format: Each submittal shall include two (2) hard copies and one electronic submittal in PDF file format.

B. Product Submittal Data:

1) Each proposed product shall include manufacturer catalog cuts and specifications.

2) Equipment electrical and power wiring diagrams, installation layout and backup battery sizing shall be submitted.

3) Proposed software submittal.

C. Informational Submittal:

1) Technician AMAG Certifications and training certificates.

2) Engineer CSEIP certificate(s).

3) Project Schedule, describing at a minimum; start date, total project length, submittal schedule, work schedule for each building, periods for each building when the existing security system will be inoperable if applicable.

4) Schedule of Values, See Attached Schedule of Values Form (Attachment 2).

I. Describe at a minimum; the total and detailed breakdown of Contract Price showing material quantities and required licensing allocated to each of the various areas of work.

a) Areas of work shall include:

i. Centralized software and installation costs necessary to control and run the nodes installed thorough campus.

ii. For each of the buildings identified in Table 1, provide costs for all hardware, cabinetry, wiring and appurtenances.

D. Government Review:

1) Company shall include 7 days for Government submittal review.

E. Closeout Submittals:

1) Company to provide the following:

I. Record of Government testing and walk-through to ensure proper operability of system and programming, PDF Format.

II. As-built record drawings, PDF Format, at a minimum include the following for each building.

a) Wire routing

b) Node type, location and name (per naming convention).

c) Hardware type, location and name (per naming convention).

d) Power type, model and location.

III. Programming schedule, Excel and PDF format.

IV. Software licensing, PDF Format.

V. Operation and Maintenance Document, PDF Format.

2.0 PART 2

2.1 PRODUCTS

A. General description of work products: software, readers, nodes/door controllers, communication wiring, power supplies, and appurtenances shall result in a FICAM compliant system in accordance with the attached AMAG Technology FICAM compliant architecture

(Attachment 3).

1) Software and Licensing, version specified or most-recent release, or manufacturer recommended equivalent.

I. Management Software License, HID Federal Identity pivCLASS Certificate Manager

Software, PVC-CM

II. Enrollment Software License, HID Federal Identity pivCLASS Registration Engine, PVCP-D/S

2) Enrollment Hardware, version specified, or manufacturer recommended equivalent.

I. Targus Numeric Keyboard, TAR KPD

II. USB Scanner and Built-In Smart Card Reader, MSO 1350 E-3

III. OMNIKEY 3121 TAA, R31210349-1

3) Hardware, version specified, or manufacturer recommended equivalent.

I. Database Base Controller with on-board NIC, M4000-DBB

II. Door Entry Controller, M4000-DEC4

III. Power Supply, M4000-IPS

a) Installer to provide adequate battery backup to run all hardware connected to each controller for 4 hours, with minimum 2 x 8Ah 12V

AGM batteries. Calculations to determine proper battery capacity are the responsibility of installer.

4) Field Validation Hardware, version specified, or manufacturer recommended equivalent.

I. pivCLASS Authentication Module, PVC-PAM-BOARD

II. Contactless and Contact Smart Card Reader, Veridt Stealth Dual (single-gang box mounting) or HID IC-RKCL40 (double-gang box mounting).

5) Software Service

I. Company shall provide 1 year AMAG service for Certificate Manager, Registration Engine, PAM licensing.

6) Communication and power wiring, version specified, or manufacturer recommended equivalent, whichever is more stringent.

I. New manufacturer approved wiring shall be installed between all new hardware locations

a) Wiring shall meet requirements of RS-485 or Wiegand as specified by manufacturer.

b) Interior cable shall be plenum rated unless installed in a raceway.

c) Exterior cable (in conduit or not) shall be rated for direct burial.

II. Required LAN connections shall be provided using CAT6 wiring to NIFC network LAN switch. LAN switches are located a maximum of 15ft from node cabinet.

B. Cabinetry.

1) Existing cabinetry shall be used to house new AMAG Door controllers, PAM hardware and power supplies.

I. Power supplies that do not fit into existing cabinetry shall be installed in new enclosures.

a) New Power Supply Cabinetry, shall be a lockable, NEMA 1- rated enclosure sized to fit required equipment.

b) EMT electrical conduit installed where required by code.

2) New controller cabinetry shall be provided in locations where existing cabinets do not exist (building 300-JWH) to house new nodes, controllers, PAM hardware and power supplies.

i. New controller cabinetry, version specified, or manufacturer recommended equivalent.

i. LifeSafetyPower E6A1

3.0 PART 3

3.1 EXECUTION

A. Installer shall identify and remove existing non-FICAM compliant hardware. Work will be performed on a maximum of two buildings at a time, in an order selected by the company and coordinated with COR.

B. Remove existing communication wiring and re-install specified communication wiring.

Coordinate routing with government.

1) All exterior wiring in conduits is required to be replaced with specified exterior direct bury rated cable.

C. Remove existing non-FICAM compliant hardware and mount new specified AMAG FICAM hardware and PAM inside existing door controller cabinets. In installation where power supplies do not fit into existing cabinets, new cabinetry shall be installed.

1) Provide identification label on each node cabinet showing the naming nomenclature as reflected in Symmetry.

D. Install the specified FICAM compliant card readers.

1) Provide identification label on card readers name as reflected in Symmetry.

E. Building 300 requires all card readers to be served by nodes located in basement room

B15. Existing nodes and cabinets, not in B15 will be abandoned in-place.

1) Battery backup are not required for any nodes serving Building 300. Backup power is provided by building backup system.

2) New Door Controller Cabinets are required in building 300.

3) New wiring is required from card readers to new node locations.

F. Provide all required appurtenances to ensure a fully functional system.

G. Program door naming using the following convention:

BUILDING NAME_ROOM NUMBER – CARDINAL DIR. _ DESCRIPTION_NODE.BOARD.PORT

H. Program system to replicate current functionality that includes but is not limited to the following general programming:

1) Upon loss of power or access control system failure doors shall fail to secure mode where possible.

2) Do not program any door to unlock automatically on a schedule.

3) Program system and readers to accept card commands.

4) Program system for a daily lock sweep of any unlocked doors specific to each building.

5) Program for forced door alarms to be generated.

6) Program for held door alarm to be generated after 1 minute.

7) Program for emergency lock down via lock down button and card command.

8) Program for card command lock down recovery.

9) Program for monitor points to send alarm outside of working hours.

10) Remove unused hardware entries from programming and database.

I. Prior to moving to next building, company to provide complete startup, testing and commissioning of FICAM-ready system to serve the building.

1) FCAM-ready operation to allow building to operate in current, non-FICAM compliant status until entire campus is complete.

2) For each building provide Excel spreadsheet describing all new equipment installed, with door naming conventions show on existing hardware drawings.

3) Company shall verify operation of all new and existing units with COR.

J. At completion of final building company shall coordinate with COR to enable PAM initialization, utilization of registration engine and certificate manager to begin FICAM compliant PACs operations for entire campus.

1) Software will be installed on government provided VM and MS SQL database servers.

Company to coordinate with the COR for VM and database access.

2) Install and configure Federal Identity pivCLASS registration engine software and all associated licensing. Install and configure Federal Identity pivCLASS Certificate

Manager software and provide all associated licensing. Configure the existing

Symmetry AMAG system software to function seamlessly as a FICAM compliant system to include cardholder PIV registration and cardholder PIV certificate management.

Company programming shall include door and node naming convention shown on the existing drawings.

3) Company shall ensure card enrollment functionality through registration engine is operating correctly and will then train the government’s key PACs operators in the card enrollment process. Once trained and proficient the government’s key PACs operators will assume responsibility for enrollment of campus personnel.

3.1 CLOSEOUT

A. Clean and remove installation related trash and debris.

B. Provide Closeout Submittals.

------------ END OF SECTION ---------