SOW_FINAL.pdf

STATEMENT OF WORK

MILITARY SEALIFT COMMAND HQ SCIF SECURITY INTRUSTION DETECTION SYSTEM MAINTENANCE

CONTRACT WITH OPTION YEARS

1.0 TABLE OF CONTENTS

2.0 GLOSSARY OF TERMS

3.0 SERVICES

4.0 ACRONYMS

5.0 DELIVERY AND PERFORMANCE

6.0 MAINTENANCE

7.0 MAINTENANCE REQUIREMENTS

8.0 TRAINING REQUIREMENTS

9.0 GOVERNMENT FURNISHED SERVICES/PROPERTY

10.0 SECURITY REQUIREMENTS

11.0 CONTRACT DELIVERABLES

12.0 GENERAL CONTRACT ADMINISTRATION

13.0 PERFORMANCE REQUIREMENT SUMMARY

The explanation or definitions of terms and abbreviations commonly used in the security community can be found in Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities ICS 705-02 Series, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities, 22 December 2016, Sensitive Compartmented Information (SCI) Administrative Security Manual:

Administration of Physical Security, Visitor Control, and Technical Security, DoDM 5105.21 – Vol. 2, DoD Information Security Program: Protection of Classified Information, DoDM 5200.01, Vol. 3 and all Intrusion Detection System and Access Control Defense Information Systems Agency Security Technical Implementation Guide (STIG) requirements. No effort to duplicate these terms is intended. Where terms are used in this Statement of Work with a different connotation, or where definitions are lacking in the above-mentioned publications, the explanations of such terms are included.

Accreditation – Accreditation is the beginning of a life cycle process of continuous monitoring and evaluation, periodic re-evaluation, and documentation reviews to ensure SCIF is maintained in an accredited state.

Accreditation Process – The accreditation process shall include a review of documents relation to SCIF design, construction, and operations. Documents shall include, but not limited to: Fixed Facility Checklists, Standard Operation Procedures, Emergency Plans, Construction Security Plan, and waiver request packages and supporting documentation, if applicable.

AECS Head-End Equipment Protection – Check to ensure the physical location of the primary IDS head-end equipment (server and/or work station/monitoring equipment) is in a continuously occupied location (e.g. guard monitoring station for alarms and CCTV.) MSC HQ continuously manned station is the Battle Watch Center (BWC). (See Glossary – Battle Watch Center)

2.0 GLOSSARY OF TERMS

1.0 TABLE OF CONTENTS

Alarm Response Times - Response time is based upon accreditation and security-in depth. If the response force cannot meet the required response time, additional security requirements (i.e., additional barriers, adding cameras, going to closed storage) must be added.

Automated Access Control Systems (AECS) – Also known as Two Factor Authentication – Automated Access Control Systems for the purposes of this SCIF is a mandatory requirement in this contract. Automated Access control system installed must use at least two technologies (badge. PIN, biometrics.), etc.

Badge In = Badge Out/Lock Out – IDS System must provide capability for AECS System to deny access to individuals who badge and PIN in to the SCIF, but fail to badge out prior to departure. This provides user capability to ensure SCIF is properly vacated prior to securing SCIF by locking FF-L-2740 device and arming the IDS at completion of workday.

Balanced Magnetic Switch (BMS) – Balanced Magnetic Switches for this IDS installation installed on perimeter doors must meet UL 634 Standards.

DD Form 254 - The MSC HQ SSO, with assistance from MSC HQ Contracting, will provide the concept approval and, if applicable, the DD Form 254, “Contract Security Classification Specification,” for contractor facilities to DIA Office of Counterintelligence and Security (DAC) with an information copy to the supporting SSO.

Government – Any person or organization within the U.S Government with a vested interest in the proper and technically sound installation of this intrusion detection system or associated installations safe outcome of the missions assigned to the contractor for which this contract supports.

IDS/ACS Primary and Emergency Power Supply – Primary Power for Intrusion Detection System/Access Control System must be commercial AC or DC power. In the event of commercial power failure at either the SCIF area or the monitoring station, the equipment must change power sources without causing an intrusion alarm indication. An Uninterrupted Power Supply (UPS) will be required for this to occur.

IDS/ACS Component Tamper Protection – Intrusion Detection System installed must provide component tamper protection. Failure to provide tamper protection to installed Intrusion Detection System/Access Control System could result in an undetected modification or disabling of IDS/ACS system components.

IDS Alarm Monitoring Indicators – System must provide audible and visual indication of any alarm activation at the primary monitoring station.

IDS Performance Verification – Installed IDS must provide a system of checks of all alarm sensors (BMS, motion, glass break, etc.) IDS performance verification test must be conducted every 90 days, so system must provide a system and procedure for conducting this test and recording / documenting results. System must provide a way to log and retain these test results to be retained for at least 180 days. Test logs are an inspection criteria.

Interior Motion Detection – Where classified equipment and/or associated media is stored in the open, it must be covered with interior motion detection sensors.

Letter of Accreditation – A letter of accreditation is a formal statement on behalf of the IC element head that a facility has been designed, constructed, inspected, and certified for the protection of all Sensitive Compartmented Information (SCI) compartments, programs or special activities in accordance with the provisions of ICD 705.

Line Supervision - Line supervision for all intrusion detection equipment (IDE) components of an IDS (USG and contractor facilities) will employ 128-bit (or greater) encryption whenever the signal line leaves the SCIF. This includes signal lines between any IDE, premise control unit (PCU), and monitoring stations. All lines employing line supervision require certification of the algorithm by the National Institute of Standards and Technology (NIST) (i.e., a NIST certificate). An alternate form of line supervision may be approved on a case-by-case basis.

Monitoring Stations - Monitoring stations must be continuously supervised and staffed by U.S. personnel. These personnel do not need to be SCI-indoctrinated unless the system was configured to allow them to reset or shunt an alarm condition.

Scheduled Maintenance – Periodic prescribed inspections or servicing of Intrusion Detection System (IDS) or equipment, accomplished on a calendar, basis to ensure the IDS is not just functional, but fully operational to execute mission.

SCIF Type – Within the Letter of Accreditation, the SCIF Type will be identified. This letter will provide SCIF identity (unique identifier and/or location), and SCIF Type: Closed Storage for all SCI material. The letter will provide Acoustic requirements (e.g., discussions or non-discussion, amplified or non-amplified; Effective date of accreditation, and a statement that SCIF meets all physical, TEMPEST, and technical security standards in place;

and approved waivers, to include details of the standard9s) not met and when they are scheduled to be met, or standard(s) exceeded.

Masking of IDS Sensors – Shunting or Masking of IDS internal zone or sensor must be appropriately logged, therefore, contract must provide a system of logging and archiving masked or shunted sensors

TEMPEST inspection – A Certified TEMPEST Technical Authority (CTTA) Inspection is a necessary part of the accreditation process. The Regional SSO will schedule and/or facilitate this inspection.

Transmission Line Security – Check that Class-I or Class II line supervision is being used in accordance with DoD Manual 5200.01, with the exception of portions of the transmission line running entirely through spaces or areas where unescorted access is controlled to at least the Secret level.

Automated Access Control Systems (AECS) – Also known as Two Factor Authentication – Automated Access Control Systems for the purposes of this SCIF is a mandatory requirement in this contract. Automated Access control system installed must use at least two technologies (badge. PIN, biometrics.), etc.

Battle Watch Center (BWC) – A continuously manned watch station in MSC HQ SP-67 adjacent to this SCIF.

Closed Circuit Television (CCTV) – There will be one Closed Circuit Television (CCTV) system with camera as part of this contract. The one (1) SCIF primary entry / exit door must have CCTV camera. Primary (only) entrance to SCIF must be continuously monitored by cleared employees (inside or outside the room or area) whenever the FF-L-2740 combination lock is disengaged for daytime or other routine access.

DIA Office of Counterintelligence and Security (DAC) – Defense Intelligence Agency (DIA) Office of Counterintelligence and Security (DAC)

Federal Acquisition Regulation (FAR) – Federal Acquisition Regulation or Federal Aviation Regulation. Context shall dictate which applies.

Personal Protective Equipment (PPE) – Gear worn by personnel designed to increase safety, reduce risk, and/or preserve life required by those personnel in accordance with all applicable regulations.

3.0 ACRONYMS

Special Compartmental Information Facility (SCIF) - A secure room or datacenter that foils electronic surveillance and suppresses data leakage. An SCIF includes the use of passive methods such as a room enclosed in a tightly sealed metal shield (Faraday cage) and active methods (jamming).

Special Security Officer (SSO) – MSC HQ USG Civilian responsible for facility Special Security.

Underwriters Laboratories (UL) 2050 Standards for USG SCIFs - All IDS installed in DIA accredited SCIFs will meet UL 2050 standards, unless otherwise approved. UL 2050 certification is not required for USG SCIFs utilizing USG-managed systems until the monitoring or IDS head is replaced. A copy of the UL certificate must be provided to DAC. If the alarm system was installed by a contractor, a copy of the UL 2050 certificate is required.

Military Sealift Command (MSC) has an immediate requirement for the servicing and maintenance of an installed and accredited SCIF Intrusion Detection System, which meets Underwriters Laboratories (UL-2050) standards to support a secure enclave within MSC Headquarters (HQ) Norfolk, VA, with the exception of fiber-optic connectivity to the police dispatch center at Navy Base Norfolk. The purpose of the MSC HQ IDS is to provide an accredited Access Control System IDS. IDSs will comply with basic requirements contained in References (a) and (b) unless otherwise approved by Defense Intelligence Agency (DIA) Counterintelligence and Security Office (DAC).

References (a) and (b) are as follows:

a.

b.

Compartmented Information,” Series.

The contractor will annually inspect the accredited UL-2050 SCIF Intrusion Detection System, its installed battery, and its automated electronic access control system (AECS), ensuring the system meets Underwriter Laboratory- 2050 Standard, and issuing the appropriate waiver letter to Headquarters Military Sealift Command for lack of fiber optic connectivity to base dispatch until the fiber hub is installed at Naval Support Activity Hampton Roads. The purpose of the MSC HQ IDS Single Award Contract (SAC) is to provide an accredited Access Control System IDS.

a. Performance Period. The period of performance will be as defined in the table below.

Period Start Date End Date Base Period (First Year) 01 Oct 2025 30 Sep 2026

Option Period One 01 Oct 2026 30 Sep 2027 Option Period Two 01 Oct 2027 30 Sep 2028 Option Period Three 01 Oct 2028 30 Sep 2029 Option Period Four 01 Oct 2029 30 Sep 2030

b. Scope of Work.

The contractor will provide system maintenance for 5 years: Base period plus 4 one-year option periods. The contract will include a Quality Service Plan which involves all maintenance, repair, and battery replacement actions necessary throughout the fiscal year. MSC will receive priority, 4-hour repair response, annual (yearly) inspections, as scheduled by the MSC SSO, device inspections and repairs as required, and at least one annual training, per year, of 2 hours duration, for one operator. MSC will receive annual software support.

a. The maintenance and system support shall include all required labor, material, and travel necessary to

Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Ver. 1.4, ICD 705 Series.

Intelligence Community Standard 705-2, “Standards for the Accreditation and Reciprocal Use of Sensitive

4.0 SERVICES

5.0 DELIVERY AND PERFORMANCE

6.0 REPAIR OR REPLACEMENT OF IDS EQUIPMENT AND MAINTENANCE

complete the service. The initial service and support will commence on 01 OCT 2025 or contract award and shall be continue until contract termination date.

b. The Contractor shall maintain and comply with its maintenance, repair, and annual inspection plan.

c. Operational Testing and Acceptance of Intrusion Detection System: The following will be successfully demonstrated for technical acceptance by the Government:

6.c.1. MSC (US Navy) accepts condition of in place, currently installed system by signature, prior to contractor assuming maintenance, repair, and annual inspection responsibility for the installed Intrusion Detection System / Automated Electronic Access Control System from 01 OCT 2025, moving forward, until contract is legally terminated by either party. Balanced Magnetic Switch installed upon door #104 is UL-634 standard.

6.c.2. The Intrusion Detection System at Military Sealift Command Navy Transportation Global

Operations Center Intelligence and Planning Sensitive Compartmented Information Facility consists of a burglar alarm complete with one UL-534 Balanced Magnetic Switch installed on SCIF Pri. Entry / Exit door #104, An OnGuard PCC-32ES System ID 153219, SN 10128692 installed within a Dell Optiplex 3080 Intel® COR ™ i3 – 10100 CPU @ 3.60 GHZ RAM is 8.00GB. The Unbreakable Power Supply: Eaton 9PX1000RT 1000 VA UPS, Energy Star, 4-post Rail Kit, Tower Pedestals, RoHS Certified. LENEL Onguard System Software is Installed.

6.c.3. The system provides Automated Electronic Access Control (AECS) utilizing qty. 4 SAC pads, and one DMP operator panel installed, easily accessible within reach of room 104 crash bar.

The operator panel is designed to provide 20 second delayed arming. There are (qty.) 6, 360 degree motion detectors installed, distributed to rooms 104, 105, 106, and 107. The AECS is electromechanically connected to a locking device on the doors 104, 105, 106 and 107, and the contractor would be expected to repair and replace these devices upon failure. The MSC SCIF IDS/AECS controls 3 Zones. The SCIF in its entirety; Room 107 (the network room), and Room105, which receives additional compartmentalization. The Intrusion Detection System installed into MSC SCIF was acceptable by SSO Navy/DIA with waiver due to Naval Base limitations, as Navy Base has/had no fiber optic capabilities available for a UL-2050 extent 3 standards certificate, having presented a letter from installing contractor stating that all equipage installed by KTR up to the point of external connection to Base Police Dispatch meets UL-2050 standards. This fiber connectivity capability will be available within the next 2-3 years, but MSC IS NOT interested in upgrading this system at Building SP-64 for this capability. This contract will not include requests to repair CDX-10 locking devices, GSA safes, sound dampening / white noise generator equipage, door opening hardware, knobs, locks, thresholds, sound dampening material, door sweeps.

6.c.4. Expectations: The contractor would be expected to repair, replace, and maintain equipage installed as part of the IDS/AECS - including BMS, components of the AECS, all cabling and interconnections associated with the Head End Equipage and Unbreakable Power Supply, the motion detectors, the video camera installed in the “man-trap”, room 105, and the cabling and monitor associated with that video camera. The contractor would be expected to conduct an annual inspection to verify operation of AECS, UPS, and IDS continuing to meet UL-2050 standards. The contractor would be responsible for resolving any software or configuration challenges not resolvable at the basic operator level during service calls.

6.c.5. AECS Head-End Equipment Protection – Physical location of the primary IDS head- end equipment (server and/or work station/monitoring equipment) is in a continuously occupied location (e.g. guard monitoring station for alarms and CCTV.) MSC HQ continuously manned station is the police connection after hours, and the Battle Watch Center (BWC) during normal working hours, and after hours (as a back up to the police connection) as defined by MSC Operational description. (See Glossary – Battle Watch Center)

6.c.6. Scheduled Maintenance – Periodic prescribed inspections or servicing of IDS or equipment, accomplished on a quarterly and yearly basis, to ensure the IDS is not just functional, but fully operational to execute mission. Quarterly checks to be conducted by MSC Personnel. Annual System operational test to be conducted and documentation of completion will be provided to MSC HQ SSO.

6.c.7. Documentation supporting that installation provides appropriate line supervision was provided to MSC SSO prior to installation. Line supervision for all intrusion detection equipment (IDE) components of an IDS (USG and contractor facilities) employs 128-bit (or greater) encryption whenever the signal line leaves the SCIF. This includes signal lines between any IDE, premise control unit (PCU), and monitoring stations.6.c.8. All lines employing line supervision require certification of the algorithm by the National Institute of Standards and Technology (NIST) (i.e., a NIST certificate). An alternate form of line supervision may be approved on a case-by-case basis by the COMSC HQ SSO.

6.c.9. Method of logging and archiving the Shunting or Masking of IDS internal zone or sensors is a capability of the IDS system installed. Contractor will maintain proof that system provides method of logging and archiving shunted or masked IDS internal zone or sensors.

6.c.10 A copy of the UL 2050 certificate equivalent letter from installation contractor is on hand for review upon request.

6.c.11 Closed Circuit Television (CCTV) – There is one CCTV system with camera installed as part of IDS/AECS. The one (1) SCIF primary entry / exit door must have CCTV camera. Primary (only) entrance to SCIF must be continuously monitored by cleared employees (inside or outside the room or area) whenever the FF-L-2740 combination lock is disengaged for daytime or other routine access.

a. The Contractor shall maintain and comply with its Maintenance Plan.

b. Specific Maintenance Terms

7.b.1 Scheduled Maintenance – Periodic prescribed inspections or servicing of IDS or equipment, accomplished on a quarterly and yearly basis to ensure the IDS is not just functional, but fully operational to execute mission. Quarterly checks to be conducted by MSC Personnel. Annual System operational test to be conducted by a qualified Lenel Technician and documentation of completion will be provided to MSC SSO.

c. Maintenance Schedule.

7.c.1 The vendor shall provide a proposed maintenance schedule as outlined in References (a) and (b).

a. The Contractor shall provide user training, training guide, and manuals.

8.a.1 In coordination with MSC Security, schedule and pay for one (1) Contractor Sponsored User training course. The expense of this training course should be quoted in the contract bid.

8.a.2Provide on-site training for the COMSC HQ SSO and his alternate once during the time span of the entire contract, to include the base contract. Date of training will be at the convenient to the contractor’s schedule and the SSO’s discretion.

8.a.3 Provide user manuals or training guides for basic system operation.

a. The Contractor shall not anticipate use of Government furnished supplies or property in the performance of this Contract, other than those explicitly stated herein.

7.0 MAINTENANCE REQUIREMENTS

8.0 TRAINING REQUIREMENTS

9.0 GOVERNMENT FURNISHED SERVICES/PROPERTY

b. Government Furnished Services.

9.b.1 A requirement for additional escorts beyond N2 personnel for this service contract is not anticipated. Cleared and trained escorts will be required throughout the course of maintenance as the space is designated open storage secret. Attempts at securing escorts through N4 will be attempted based upon schedule. In the event MSC HQ N4 cannot provide escorts, MSC HQ N21/N3/N5 personnel will provide escorts. The government will provide cleared and trained escorts and the ratio required will be one cleared and trained government escort per three IDS maintenance contractors. Contractors engaged in this IDS maintenance/repair shall follow direction from the government escorts while within the confines of MSC spaces, and shall not wander unaccompanied / unattached from government escort at any time. Any maintenance or inspection contractors supporting follow-on, maintenance duties in support of services portion of this award must be cleared at the Secret level. Details will be stipulated within associated DD-254; Department of Defense Contract Security Classification Specification.

a. Facility Security Clearance. The Contractor shall handle, store, and maintain classified material and shall comply with the requirements set forth in the National Industrial Security Program Operating Manual (NISPOM) DoD 5220.22-M, DD Form 254, DoD Contract Security Classification Specification, and maintain appropriate facility clearance levels with approved security containers.

b. Information Security Requirements. The Contractor shall handle, store, and maintain classified material in compliance with requirements set by DoD Industrial Security Manual for Safeguarding classified Information, and the DD Form 254, DoD Contracts Security Classification Specification for classified contracts provided as a solicitation attachment.

c. Personnel Security Requirements. All Detachment Personnel, Program Manager, and Contractor personnel handling classified information necessary to carry out their duties and responsibilities with respect to this contract shall have a Secret security clearance. The individuals shall possess the SECRET security clearance prior to the commencement of the contract and maintain the clearance throughout the duration of contract performance. Loss of a Secret clearance while performing under the contract will result in the Contractor employee being unqualified for the position. At that time, the Contractor will be responsible for replacing that individual with a qualified employee.

a. Each package, report, or other deliverable shall be accompanied by a cover letter (if submitted in hard copy) or the email shall contain the following information:

a. The contract number under which the item is being delivered.

b. The deliverable item and the specific contract reference that requires the delivered item(s).

c. Providing the users course for the COMSC HQ SSO and one back up (Cameron Bembry, (COMSC Special Security Representative. cameron.a.bembry.mil@us.navy.mil))

d. On-site operator training.

e. Operator’s manual/training guide.

a. Meetings and Communications.

12.a.1 Post-Award Conference. Not Applicable.

10.0 SECURITY REQUIREMENTS

11.0 CONTRACT DELIVERABLES

12.0 GENERAL CONTRACT ADMINISTRATION

b. Authorized Changes Only By the Contracting Officer.

12.b.1 No order, statement, or conduct of Government personnel who visit the Contractor’s facility, or in any other manner communicates with Contractor personnel during the performance of this Contract, shall constitute a change under the Changes clause of this Contract.

12.b.2 The Contractor shall not comply with any order, direction or request of Government personnel unless it is issued in writing and signed by the Contracting Officer, or is pursuant to specific authority otherwise included as part of this Contract.

12.b.3 The Contracting Officer is the only person authorized to approve changes in any of the requirements of this Contract and notwithstanding provisions contained elsewhere in this Contract, said authority remains solely the Contracting Officer. In the event the Contractor effects any change at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the order price to cover any increase incurred as a result thereof. The address and telephone number of the Contracting Officer is:

Name: Tommy Hale Address: 471 East C Street, Bldg SP-64 Norfolk, VA 23511-2419 Telephone: (564)-226-8988

Or: any Warranted Contracting Officer at MSC in his/her absence.

c. Contracting Officer’s Representative (COR) – Functions and Limitations.

12.c.1 The COR will represent the Contracting Officer in the administration of technical details within the scope of this Contract and will manage inspection of products and services. The COR is not otherwise authorized to make any representations or commitments of any kind on behalf of the Contracting Officer or the Government. The COR does not have the authority to alter the Contractor's obligations or to change the specifications in the Contract. If, as a result of technical discussions, it is desirable to alter contractual obligations or the statement of work, a modification must be issued in writing and signed by the Contracting Officer.

The following individual is appointed as Contract Officer’s Representative under this Contract:

Name: David Kristofer Milford, COMSC HQ N21/SSO Address: 471 E C St, Bldg SP-64, 1st Deck, C Wing, Room 104, Cubicle 4, Norfolk, VA 23511 Telephone Number: Desk (757) 341-6659, Personal Cell (757) 287-5322

Deliverable or Service

Requirement

Measurement/Metric

Performance Standard

Acceptable Quality Level

(AQL)

Consequence

IDS/AECS

System Component Repair.

Replacement, and Maintenance

Full System Operability Verification Test or Half-split, system component test.

Within 60-days of Start of PoP. Para 6.0.c.

through 6.c.8.

100%

Government not accepting work.

Penalty of 1% per day up to a maximum of 15 days.

Negative

CPARS

Rating.

Annual Service Maintenance

Annual System Checks by qualified Lenel Software operators

Completed within the first 45 days of beginning of the fiscal year once the option is exercised.

100%

After 45 days, a penalty of 1% per day up to 30 days.

Negative

CPARS

Rating

13.0 PERFORMANCE REQUIREMENT SUMMARY