SOW_HML_Access_Control_SOW_9-5-2024.pdf

Statement of Work

NOAA Hollings Marine Laboratory Physical Access Control System Replacement

(ePACS) Charleston, SC

Purpose:

The purpose of this Delivery Order is to obtain the supplies and services of a contracting vendor to provide the following:

Replacement and installation of the Hollings Marine Laboratory physical access control system (ePACS) located at the National Oceanic and Atmospheric Administration, National Ocean Service (NOAA), National Centers for Coastal Ocean Science (NCCOS) - NOAA Hollings Marine Laboratory, 331 Fort Johnson Rd, Charleston, SC, 29422 .

The objective is to provide and install PACS components. The PACS will be integrated with the NOAA Enterprise Physical Access Control System (ePACS) which is a SoftwareHouse CCure 9000 system. The contractor will be responsible for obtaining and installing all component parts and providing on-site technical support to do initial power-up, programming, and integration with the NOAA ePACS system.

US Government Compliant:

- HSPD -12 & FIPS compliant and approved

For FIPS 201 Approved Product list please refer the following link -https://www.idmanagement.gov/approved-products-list-pacs-products

- FICAM Approved APL#s 10083, 10097

- PIV, PIV-II, TWIC, CAC cards

As part of NOAA’s initiative to increase the protection of visitors, and employees, this initiative shall be to provide improved electronic access control to its buildings.

National Mandates:

Homeland Security Presidential Directive 12 (HSPD-12) requires federal agencies to issue secure and reliable identification to all employees and contractors. FIPS Publication 201-3

- Personal Identity Verification (PIV) of Federal Employees and Contractors , issued by NIST, establishes the technical specifications for the smart cards that respond to this requirement.

HSPD-12 requires Federal agencies to provide a common ID credential system for all federal employees and contractors. PIV badges are electronically verifiable and protected by digital certificates, biometric data, and a PIN code. These credentials are issued, tracked, and revoked from a central management system and require applicant background checks.

https://www.idmanagement.gov/approved-products-list-pacs-products/

Objective The objective of this Statement of Work is to provide the necessary equipment and integration to allow HML security to have the means to quickly lock down buildings and access points, identified in Appendix B, by either all buildings at once, individual buildings, or groups of buildings identified in zones. Period Of performance shall be 180 days from contract award.

Scope of Work :

The contractor shall provide all labor, material, equipment, supervision and transportation necessary in accordance with these instructions, specifications and accepted trade and industry standards. Doors shall be migrated on a door-by-door basis to limit the impact to daily operations. A complete project schedule shall be submitted by the contractor and approved prior to installation.

The contractor shall perform a site survey prior to project implementation to ensure any electronic door devices are functioning properly and to identify any possible project deviations prior to installation.

Issues identified during the survey, including additional wiring, network devices (extenders, switches, converters, etc.), security - integrated door hardware devices (strikes, REX, contacts), repairs, or deviations from the current PWS shall be submitted to the NOAA POC for review and approval. The expectation is when acceptable reuse current existing cabling and devices that meet SOW requirements and are in good serviceable condition.

The contractor shall provide and install an access control/card reader on specified doors in the facility as listed in Appendix B.

* Site visit prior to submission of quote is highly recommended and available upon request.

The Contractor shall install the new system as follows:

Access Control System

○ Install new PACS control panel(s) and associated panel components from the approved hardware list appropriate for the installation.

○ The preferred location of the security panels is inside an IDF or telecommunications room type space.

○ New PACS panel(s) must be powered from an existing building emergency power circuit.

○ The Contractor must ensure all electrical work is completed in accordance with the GSA PBS building codes.

○ All communication cabling shall be plenum rated.

The contractor shall communicate and work with NOAA’s ePACS Engineers to configure the panels and ensure they are online on the network and accessible. The Contractor will commission the panels and assign IP address information to the devices. The port-mapping for panels will also be provided to the NOAA ePACS team for documentation. The Government Point of Contact (GPOC) will ensure contact information is provided for the NOAA ePACS team. Network connectivity and all network switching infrastructure will be provided on-site for the panels.

Fill, patch, and color match paint all holes from the removal of the existing equipment and hardware that will not be used.

The contractor will interconnect the system to the building’s fire alarm system to ensure proper code compliance and door release during a fire emergency.

The contractor shall provide a 1-year full warranty on all workmanship and component parts.

The system shall consist of Proximity Readers at predetermined locations on the exterior and interior as listed in Appendix B. The contractor shall provide all labor, equipment and material required to mount, provide power to, and install proximity readers, associated hardware and associated replacement door hardware as needed. Vendor is responsible for providing electrical power as needed per National Electric Code. Contractor shall utilize the nearest appropriate power branch circuit having adequate capacity to provide required service. Under no circumstances is the contractor to utilize any lighting branch circuit or switch-leg for power.

The contractor shall replace the physical access control system equipment at the Hollings Marine Lab in order to bring them into compliance with NOAA enterprise physical access control system requirements as well as IT security requirements; to identify the equipment, software, and data deliverables that are required from the contractor; and to identify applicable requirements and/or restrictions.

Contractor needs to provide a detailed list of equipment in order for facilities operations to maintain spare parts inventory and to promote equipment standardization across NCCOS facilities.

No HML sensitive information shall be stored, generated, transmitted or exchanged from the ePACS system used for access control.

General Requirements:

The contractor’s employees shall not enter the work site without an appropriate badge. They may also be subject to inspection of their personal effects when entering or leaving the project site. Badges shall be provided to the contractor for distribution to on-site employees of the contractor and all Subcontractors.

The Contractor shall perform their work during normal business hours, unless otherwise directed by the NOAA POC.

For working outside the “regular hours” as defined in the statement of work, the vendor shall give 1 day email notice to the designated point of contact, Randy.p.grady@noaa.gov , so that arrangements can be provided for the employees. This notice is separate from any notices required for utility shutdown described later in this section.

The contractor shall execute work so as to interfere as little as possible with normal functioning of HML as a whole, including operations of utility services, fire protection systems and any existing equipment, and with work being done by others.

All Buildings shall be occupied during performance of work. The contractor shall take all measures and provide all material necessary for protecting existing equipment and property in mailto:Randy.p.grady@noaa.gov affected areas against dust and debris, so that equipment and affected areas to be used in the HML operations shall not be hindered.

Electrical work shall be accomplished with all affected circuits or equipment de-energized. When an electrical outage cannot be accomplished, work on any energized circuits or equipment shall not commence without the POCs prior knowledge and approval. The vendor shall submit a request to interrupt any such services to POC, in writing, 48 hours in advance of proposed interruption. Request shall state reason, date, exact time of, and approximate duration of such interruption.

In general, the following preventive measures shall be adopted during installation of new equipment to keep down dust and prevent mold. Dampen debris to keep down dust and provide temporary construction partitions in existing structures where directed by designated point of contact. Blank off ducts and diffusers to prevent circulation of dust into occupied areas during construction.

Maintain the surrounding area frequently. Remove debris as they are created. Transport these outside the construction area.

NOTE : If the vendor can show that the installation of new security equipment and related work shall not result in creation of significant dust or other contaminants then some or all of the requirements for dust protection can be deleted or modified as approved by the SO.

Normal working hours shall be used to complete this contract unless otherwise indicated.

Normal working hours shall be 7:30 AM to 5:00 PM, Monday through Friday – Federal Holidays or any other Holiday designated by the President of the United States excluded. Deviations from normal working hours must be approved in writing from the designated point of contact no less than 72 hours in advance.

Materials and equipment furnished shall be of current production by manufacturers regularly engaged in the manufacture of such items, for which replacement parts shall be available.

Control server installation and configuration shall have dual homed capability.

All electrical work must comply with the requirements of NFPA 70 (NEC), NFPA 70B, NFPA 70E, OSHA Part 1910 subpart J, OSHA Part 1910 subpart S and OSHA Part 1910 subpart K in addition to other references required by contract.

New work shall be installed and connected to existing work neatly, safely and professionally.

Disturbed or damaged work shall be replaced or repaired to its prior conditions.

The Government's approval shall be obtained for all equipment and materials used for the installation of the security system before delivery to the job site. The submittals shall include adequate descriptive literature, catalog cuts, shop drawings and other data necessary for the Government to ascertain that the proposed equipment and materials comply with specification requirements and codes.

For all new penetrations required through walls and floors the vendor shall install fire block caulking during installation of the security project. For new floor penetrations that require sleeves they must extend the sleeve one inch above finished floor and provide sealant for watertight joints. Penetrations are not allowed through beams or ribs, but may be installed in concrete beam flanges. Vendors shall ensure all wall penetrations are filled with appropriate fire-stop material. Contractor must coordinate inspections of penetrations with NOAA personnel.

Equipment and materials shall be carefully handled, properly stored, and adequately protected to prevent damage before and during installation, in accordance with the manufacturer's recommendations and as approved by the designated point of contact.

Equipment and Materials Requirements:

Mechanical, electrical and associated systems shall be safe, reliable, efficient, durable, easily and safely operable and maintainable, easily and safely accessible, and in compliance with applicable codes as specified. The systems shall be comprised of high quality institutional-class and industrial-class products of manufacturers that are experienced specialists in the required product lines.

All items furnished shall be free from defects that would adversely affect the performance, maintainability and appearance of individual components and overall assembly.

The NOAA Enterprise Physical system is a CCure 9000 system using the standardized components listed below. Options for each component may be customized to address the needs outlined within this SOW. The contractor must use a combination of the following hardware and other components as needed in order to enable the NOAA ePACS system to be extended to this location and managed as part of the Enterprise.

PACS SYSTEM COMPONENT REQUIREMENTS:

The following security panels are the approved Enterprise Supported readers for NOAA’s ePACS.

● iStar Ultra G2 Controller Panel - Wall Mount

● iStar Ultra G2 Controller Panel - Rack Mount

● iStar Edge G2 Controller Panel - Wall Mount

BADGE READER COMPONENT REQUIREMENTS:

The following readers are the approved Enterprise Supported readers for NOAA’s ePACS. These can be terminal connected or pig-tail connected based on the need.

SINGLE FACTOR STANDARD READER:

■ Identive Mullion Reader

IDV-9010AB

■ Identive Wall Mount Reader IDV-9110AB

TWO FACTOR HIGH ASSURANCE READER:

■ Innometriks Cheetah SE Reader

INN-SECHTA-CTA

Card readers should be mounted 48” above the finished floor (AFF).

PACS WIRING REQUIREMENTS:

The following wiring requirements must be adhered to.

● The Contractor shall ensure readers are wired from the reader to the panel using 2 WIRE RS485-OSDP.

● OSDP cable meeting or exceeding the specifications of WCW Part Number 4461030-OSDP shall be used to ensure proper communication from the reader to the panel using OSDP secure channel communications.

Electrical:

Any electrical work required for the installation of the new security system must meet the International Building Code (IBC), National Electrical Code (NEC), Underwriters Laboratories, Inc. (UL) and National Fire Protection Association (NFPA) as minimum installation requirement standards.

Personnel:

The contractor shall provide, schedule, supervise, and manage all personnel required to perform the tasks required by this statement of work. The contractor shall ensure that all personnel are properly trained for the work that they are assigned. The contractor shall coordinate all requirements for escorts with the designated point-of-contact at least one week in advance of required access. All contractor personnel shall comply with facility requirements for sign-in and badge display. The contractor shall promptly remove and replace any of its personnel who do not comply with NOAA requirements. The contractor shall be responsible for any delays or other impact due to misconduct on the part of its employees or subcontractors. All contractor personnel shall be able to understand, read, write and comprehend English in order to perform the duties assigned. The contractor shall provide proof that all on-site employees are U.S.

citizens or legal aliens. The contractor shall not employ personnel with felony convictions, or with a record of narcotics use, for work at any NOAA locations. All personnel employed by the contractor shall be experienced in the type of work involved and familiar with the specification of this delivery order.

Safety:

Site and Building Access: The contractor shall maintain free and unobstructed access to facility emergency services and for fire, police and other emergency response forces in accordance with

NFPA 241.

Means of Egress: The contractor shall not block exiting for occupied buildings, including paths from exits to roads. Minimize disruptions and coordinate with the System owner.

The contractor shall work so as to interfere as little as possible with normal functioning of HML as a whole, including operations of utility services, fire protection systems and any existing equipment, and with work being done by others.

Environmental Program:

All contract work shall be conducted in a safe manner and comply with applicable OSHA requirements. If the contractor fails or refuses to comply promptly with safety requirements, the contracting officer may issue an order stopping all or part of the work until the subject of a claim for an extension of time, excess costs or damages to the contractor.

Security Requirements:

Contractor employees shall comply with all DOC security requirements. Copies of pertinent policies, regulations and procedures shall be provided to the contractor upon request. This employee list shall be constantly kept up to date. All vehicles entering the laboratory campus are subject to search as authorized by local Law enforcement who have joint approved jurisdiction over the complexes.

IT Security Requirements:

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The following is a list of relevant information the Department of Commerce (DOC) Information Technology (IT) Security takes into consideration when assessing the security requirements and risk for procuring IT products and services.

a) The Contractor shall only supply Information Technology (e.g., hardware, software, firmware, etc.) and/or product license and shall not require the use of any contractor owned equipment. The contractor shall not have remote access to any government owned equipment. The Contractor shall ensure the acquiring Information Technology provided disables “phone home” or similar capabilities.

b) Product support and supporting documentation allows for the sanitization of the acquiring Information Technology and/or product license upon the disposal of the product. Product shall allow the use one of the approved methods for secure destruction of data/information including unclassified but sensitive information. Approved methods include NIST Special Publications 800-88 Guidelines for Media Sanitization (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) or the National Security Agency in the Media Destruction Guidance (https://www.nsa.gov/Resources/Media-Destruction-Guidance/).

c) The acquiring information technology is engineered for trustworthy and security that is consistent with the engineering-based trustworthy secure solutions as outlined in NIST Special Publication 800-160 Version 1, Revision 1 Engineering Trustworthy Secure Systems (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1r1.pdf) and NIST Special Publication 800-160, Volume 2, Revision 1 Developing Cyber-Resilient Systems: A Systems Security Engineering Approach ( https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf ).

d) The acquiring information technology complies with Office of Management and Budget Memorandum M-07-18 Ensuring New Acquisitions Include Common Security Configurations and the Federal Acquisitions Regulations (FAR) 39.101(d) regulations require NIST common security configuration checklists including United States Government Configuration Baseline (USGCB) initiative. More information is available at National Checklist Program (NCP), (https://nvd.nist.gov/ncp/repository), the U.S.

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf government repository of publicly available security checklists (or benchmarks) that provide detailed low-level guidance on setting the security configuration of operating systems and applications. The acquiring information technology considers the following requirements:

1. Software procured meets the standard installation, operation, maintenance, updates and/or patching of software shall not alter the configuration settings from the approved USGCB/other secure configuration.

2. Applications designed for normal end users run in the standard user context without elevated system administration privileges.

3. Supporting documentation or reference(s) that describes the security capabilities, the design and development processes and the testing and evaluation procedures used by the product or services being provided for this acquisition.

4. Supporting documentation or reference(s) that describes all product or service updates and enhancements as they are implemented. The product or service supporting documentation could be the user and system administrator guides, which documents the functional properties of the security controls employed to permit the analysis and testing of the security controls.

5. The acquiring information technology complies with the Homeland Security Presidential Directive 12 (HSPD-12) Policy for a Common Identification Standard for Federal Employees and Contractors requirements from FAR 4.1302 stating: (a) In order to comply with Federal Information Processing Standard (FIPS) 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors (https://doi.org/10.6028/NIST.FIPS.201-3), agencies must purchase only approved personal identity verification products and services, (b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

e) The acquiring information technology complies with Internet Protocol Version 6 (IPv6) requirements from FAR part 11.002 requirements that state the agency Chief Information Officer can waive this requirement provided the acquisition requirements documents the appropriate technical capabilities defined in the USGv6 Profile available in the NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-program) and the corresponding declarations of conformance. To meet this requirement each DOC acquisition of IP protocol technology must express requirements for IPv6 capabilities in terms of the USGv6 Profile (i.e., using the USGV6 Capabilities Check List) and vendors must be required to document their product’s support of the requested capabilities through the USGv6 test program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1) using the USGv6 Suppliers Declaration of Conformity.

Federal Holidays Contractor’s work shall not be performed on Federal Holidays. Federal Holidays are as follows:

New Year’s day, MLK day, President’s Day, Memorial day, Fourth of July, Labor Day, Columbus day, Veteran’s day, Thanksgiving, Christmas and any day the President of the United states declares or proclaims that is a day off for Federal workers.

Building Security The contractor shall be responsible for ensuring that any doors used by the contractor for building egress, prior to and after normal working hours are secured (location specific)..

Quality Assurance The contractor shall perform all tests, inspections, and other actions that are required to verify that products, documents, and services meet the requirements of this Statement of Work, project objectives, and best commercial practices. The contractor shall maintain records that document the performance of quality assurance tasks and shall provide these records to NOAA on request.

Documentation of configuration setup and as-built schematics shall be supplied upon completion.

Requirements:

Vendor shall provide all labor, equipment and material required to mount, provide power including communications connectivity, and install proximity readers, associated hardware and associated replacement door hardware as needed. Vendor is responsible for providing electrical power as needed per NEC. Vendor shall utilize the nearest appropriate power branch circuit having adequate capacity to provide required service. Under no circumstances is the vendor to utilize a lighting branch circuit or switch-leg for power.

Prior to installation a walk-thru with the SOR and the Contractor shall be conducted to identify locations to install proximity readers, replacement door hardware, and corresponding security system. Proximity readers shall be located on doors as indicated in Appendix B. Contractor shall survey existing systems to ensure they are on the approved list and compatible with the new systems. If not, the contractor shall replace the existing system with equipment/software that is compatible and on the approved list, see Appendix A.

Deliverables:

The physical access control systems products, identified in Appendix A, are the only known physical access control systems that meets the requirement for use with the PIV-ID card.

Consequently, the physical access control systems products listed in Appendix A are the only systems that shall be considered for installation. Readers shall be listed on the GSA FIPS 201 Approved Product and supported by the manufacturer of the PACS on which they are installed.

Submittal Requirements:

The contractor shall provide electronic copy of each required submittal in accordance with the below schedule:

Deliverable Objective Due

Work Schedule, with start and completion dates

Coordinate scheduling with Technical POC and overall project construction schedule

Within 30 days of awarded contract / NTP for construction

Designation of on-site, job-site supervisor and contact information

Provide a Primary POC Within 30 days of Contract Award / NTP for construction

Final Design Submission for Approval

Wiring design, device placement, install locations for component parts, and complete Bill of device Materials and specs of materials.

Within 90 days of award.

1-year Warranty Documentation Warranty parts and labor Upon acceptance of work.

Commissioning Drawings / as-builts.

Final as-built drawings for the entire system. System as-builts to be incorporated into CD as-builts and provided to the government in PDF and DWG format per the Lease.

Within 10 days after acceptance of work.

APPLICABLE DOCUMENTS

The following documents form a part of the requirements of this Statement of Work to the extent specified:

- IBC, NEC, UL, NFPA and OSHA standards and requirements

- FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors

Address of Facility :

Hollings Marine Laboratory 331 Fort Johnson Rd.

Charleston, SC 29422

APPENDIX A: APPROVED PRODUCTS LIST

Contactless PIV Readers Readers shall be listed on the GSA FIPS 201 Approved Products and supported by the manufacturer of the ePACS on which they are to be installed:

APPENDIX B: Doors requiring access control

Panels Terminals Rooms HML 4 49 HML Main Lobby Entry Location Rm A114 50 HML A-223 Hall Entry

51 HML A-129 Hall Entry 52 HML Main Visitor Entry 53 HML Front Stairs Entry 54 HML Spare 55 HML C-103 Clean Room 56 HML C-104 NIST Office 57 HML D-119 Rear Stairs 58 HML D-114 Hall Entry 59 HML D-215 Hall Entry 60 HML D-104 Clean Room

HML 2 65 HML E-110 Storage to Lobby Location: Rm. E106 66 HML E-108 Exit to Lobby

67 HML E-114 Exit to Hall 68 HML E110 Exit to Storage

Location: Rm. E112 69 BSL E-116 Hall Entry 70 BSL E-116 Lab Entry

Above door in their Office 71 BSL E-118 Lab Entry 72 BSL E-121 Hall Entry 73 BSL E-121 Lab Entry 74 BSL E-123 Lab Entry 75 HML D-214 Lypholizer Room

HML 3 81 HML F-101 Lab Entry Location: Hallway to Facilities Upstairs 82 HML F-115 Lab Side Entry

83 HML F-118 Tank Room 84 HML F-119 Tank Room 85 HML F-120 Tank Room 86 HML F-133 Aquatic Entry

Corridor F-143 Equipment Storage F-140 Wet Lab F-141

HML 8 101 HML N-113 MRI Lab Location: Rm N204 102 HML N-116 MRI Entry

103 HML N-113 Lab 104 HML N-120 Control Room 105 HML N-119 Sample Prep 106 HML N-112 Electric Room 107 HML N109 North Passage 108 HML N100 Stair 2 109 HML N104 Control Room 110 HML N105 Pump Room 111 HML N-102 Magnet Room

HML 5 Corridor Entry First Floor Location: H1 AHU Mech Room Corridor Entry Second Floor

Electrical/Mech Room First Floor H220 IT Office Second Floor IT Room First Floor Lab 1 First Floor Lab 2 First Floor Main Entry Stairs First Floor Server Room Left Second Floor Server Room Right Second Floor Stairs Entry First Floor Stairs Entry Second Floor

Government Point of Contact Information :

Randy Grady NCCOS Facilities Branch Chief (252)725-3541 cell randy.p.grady@noaa.gov

Invoice Processing Platform (IPP) POC:

NAME: Melinda Mills mailto:randy.p.grady@noaa.gov