SOW - Intrusion Detection System.pdf

Statement of Work

Vindicator Intrusion Detection System (IDS) Installation Building 90131 AFSOC Operations Center Ground Control Station Expansion

Hurlburt Field, FL 1 May 2021

1 Description of Services

1.1 Certified Contractor

A Honeywell Vindicator certified contractor shall provide all necessary supervision, labor, travel, materials, tools, equipment, accessories, and other items necessary to complete the installation of all components safely. The installation will comply with the Air Force certification standards outlined in the following standards and safety publications.

Air Force Instruction (AFI) 31-101

Security Procedures for Head Quarters 16th Air Force

Telecommunications Industry Association (TIA)/ Electronic Industries Alliance (EIA)-

Residential Telecommunications Cabling Standards

TIA/EIA-607

Commercial Building Grounding and Bonding Requirements for Telecommunications

National Fire Protection Association (NFPA) 70 National Electric Code (NEC)

NFPA 101, Life Safety Code

NFPA 780, Standard for the Installation of Lightning Protection Systems

Security Forces Non-Nuclear Intrusion Detection Equipment Approval Letter, date 26 August 2020

The Contractor shall provide all of the necessary tools and equipment to complete the upgrade.

This requirement includes any ladders, lifts, hoists, power tools, safety gear, or other equipment, tools, supplies necessary to complete installation and provide necessary testing of all installed components.

This Statement of Work (SOW) is not to be discussed with or disseminated to anyone other than those required for planning, procurement, and installing the security system.

1.2 System Requirements

The Contractor shall install the Vindicator Intrusion Detection System (IDS) primary control unit and computer management system within room A43 of building 90131 and link the new IDS to the existing Vindicator IDS system for alarm status reporting to the base. This second Vindicator IDS system shall be installed for intrusion detection of five (5) Mobile Ground Control Systems (MGCS) that will be Secure Working Areas (SWA) within a fenced-in Restricted Area adjacent to building 90131. Requirements include the ability to place each area in secure and access mode simultaneously and the capability to provide continuous intrusion detection for a human-sized intruder.

The Contractor shall provide any support equipment required to integrate new Intrusion Detection Equipment (IDE).

The Contractor shall install Vindicator Version (V)6.2 platform. The Vindicator V6.2 platform shall meet United States Air Force (USAF) Authority to Operate (ATO).

The Contractor shall install the IDE from the current Air Force Non-Nuclear IDS Equipment.

The Contractor shall install Vindicator graphical keypads that are compatible with the Vindicator V6.2 platform. The system shall be compatible with Windows V6.2. It must provide the capability to assess alarms and initiate responses in a manner that shall aid in preventing damage, destruction, or unauthorized access to the controlled resources. The Protection Level (PL) of this area will be PL3. The responsible monitoring station will have an audible and visible annunciation for each IDS. The IDS shall be separate from, and independent of, fire, smoke, radon, water, and other systems. The Access Control System (ACS) personnel turnstiles will be subordinate in priority to IDS alarms. The system shall be compatible with Windows version 7.0.

1.2.1 Alarm Activation Pads

Each of the five (5) SWAs requires one (1) individual alarm activation/deactivation pad that operates independently of one another. These will be installed inside each Ground Control Station (GCS) primary entrance near the door that employs a 30-second alarm activation delay to change the system mode of access during activation/deactivation. This IDE must have the ability to place the area in "secure" or "access."

1.2.2 Motion Detector Sensors

Each of the five (5) SWA requires 1 360-degree motion detection sensor for each GCS centrally located on the GCS ceiling to ensure motion detection within the GCS and at both GCS doors.

1.2.3 Balanced Magnetic Switches on Personnel Doors

Each of the five (5) SWA requires two (2) Balanced Magnetic Switches (BMS) installed on each personnel door.

1.2.4 Vindicator Access Control System

Install 2 Vindicator Access Control Systems (ACS), one at each of the two access turn styles.

Proximity badge swipe capability at each of the 2 personnel turnstiles for entry inward and free movement for the exit. The turnstiles are being installed under a construction contract and are Boon Edam Model Turnlock-100EC2. The pin-pad will be located within a weather-protected cover or box. ACS equipment must be in protective cover from the weather.

1.2.5 Stationary Security Cameras

Install two (2) stationary security cameras to fixed locations at elevated points within the fenced structure housing the GCSs. The cameras must be compatible with the current Hurlburt Field Security Forces Squadron alarm monitoring station and capable of Immediate Visual Assessment (IVA) and camera playback.

1.2.6 BMSs on Roll Up Doors

Install BMSs on two roll-up doors going into building 90131. These require exterior BMSs as they shall be installed on the outside of the building.

1.2.7 Protected Distribution System Alarms

Install 1 PDS alarm system capable of 5 individual channels and configure a channel for the conduit to go to each of the 5 SWAs. Details are listed in the Alarmed PDS Details in section 1.2.9.

1.2.8 Tamper Protection Switches

Install tamper protection switches in ten (10) conduit pull boxes. Each SWA has a pull box.

There are three (3) pull boxes in the controlled area and 2 on the side of building 90131, elevated at 17 feet.

1.2.9 Alarmed Protected Distribution System Requirements

The Contractor shall ensure line security (i.e., connecting lines are electronically supervised to detect evidence of tampering or malfunction) consistent with Intelligence Community Directive (ICD)-705 technical specifications, and Protected Distribution System (PDS) as required under Committee on National Security Systems Instruction (CNSSI) 7003, Annex A. Intrusion Detection Equipment (IDE) cabling that extends beyond the Sensitive Compartmented Information Facility (SCIF) perimeter will be installed in a closed and sealed metal conveyance (i.e., pipe, tube, or ferrous Electrical Metallic Tubing (EMT). All joints and connections will be permanently sealed completely around all surfaces (i.e., welding, epoxy, and fusion). Set screws will not be used. The seal shall provide a continuous bond between the components of the conveyance. A separate contract will install the physical ferrous EMT conduit from the SCIF to pull boxes adjacent to each SWA. The Contractor shall install the four (4) inch ferrous EMT from the adjacent pull box to each of 5 SWA communications boxes. The SCIF pull-box will be 24”x24”. Cabling between all sensors and the Power Control Unit (PCU) shall be dedicated to the system. It will comply with national and local electric codes and Committee for National Security Systems (CNSS) standards. The PDS alarm system is to be configured to each of the five (5) SWAs and individually alarmed as outlined in the directive CNSSI 7003 Annex A.

Alarmed carriers may be used when it is not practical to perform daily inspections (i.e., when the PDS must be installed in locations that are not easily accessible). An alarmed carrier must be protected by an alarm system that detects attempted penetration of the carrier. As an alternative, the space surrounding the entire carrier may be covered by an area or volumetric (i.e., infrared, motion detection) alarm system approved by the cognizant, physical-security authorities. The alarm system must be capable of prompt detection of any penetration and annunciate the alarm in an office manned twenty-four (24) hours a day, seven (7) days a week. The office must be capable of notifying security forces that can respond within fifteen (15) minutes. The alarm must protect from tampering and be able to register malfunctions. The alarm system must also transmit a line fault message to the annunciator panel if the system fails. A visual inspection of the PDS in accordance with Table 3 in the CNSSI is not required for an alarmed system.

However, each alarm zone must be tested in accordance with Table 5 in the CNSSI. The Standard Operating Procedure (SOP) for the alarmed carrier must be implemented to accomplish the following.

• Verify its performance at intervals as shown in the PDS inspection schedule

• Ensure the response by security personnel in the area of possible attempted penetration is within 15 minutes of discovery

• Provide for inspection of the PDS to determine the cause of the alarm

• Define the action to be taken regarding the termination of transmission

• Initiate an investigation of an actual intrusion attempt

Continuously viewed carriers are normally used when continuously viewed areas are already in place for physical security reasons. A continuously viewed carrier must be under continuous observation, 24 hours a day, 7 days a week, including when non-operational. Such circuits may be grouped together, but they should be separated from all non-continuously viewed circuits ensuring an open field of view. The SOP must include the requirement to investigate any attempt to disturb the PDS. Appropriate security personnel should investigate the area of attempted penetration within 15 minutes of discovery. Alternative carriers and other variances must be approved by the Authorizing Official (AO) and the cognizant security authority based upon a technical review.

1.3 Equipment Placement

The Contractor shall install and program the alarm panel, keypads, and the components to all panel locations within the alarmed facility listed in Section 8. Section 8 Diagrams and Pictures show the controlled GCS perimeter, the turn styles, alarmed PDS locations, and the mobile SWAs with sensors.

The Contractor shall coordinate any changes to panel locations through Security Forces and Civil Engineer Representative. The new Vindicator system must be securely tied into the existing security system located in Building 90131.

1.3.1 Power and Network Connectivity Location

The power and the network connectivity are located within twenty (20) feet of the planned alarm panel location.

1.3.2 Special Operations Security Forces/Systems Security Engineering Coordination

The Contractor shall contact a Special Operations Security Forces (SOSFS)/ Systems Security Engineering (SSE) authority for coordination before any install to validate all completed work.

2 Installation

2.1 IDE Component Identification

Al l IDE components such as sensors, junction boxes, communication wiring, battery power, and line supervision shall be individually identifiable to include separate alarm points. No alarm points shall be grouped to show one name and one main area without identifying which individual sensor is activated.

2.2 Alarm Point Wiring

All alarm points shall be wired to the alarm panel clockwise when entering each SWA from the main door and shall be connected to the alarm panel in this order from left to right.

2.3 Tamper Protection Switches

All junction boxes housing IDE shall have tamper protection switches located inside the box.

2.4 Backup Power Sources

The IDE shall have a backup power source, such as a battery, that will provide an uninterrupted 4 hours of power. This backup power source shall be connected to provide a thirty (30) minute battery failure notification prior to battery failing. This notification must be incorporated into t h e panel to provide Security Forces this information.

2.5 Certification Test Requirements.

1 SOSFS/SSE shall conduct functional and operational certification tests for the IDS to ensure the system meets effectiveness standards/compliance requirements.

Note: This test and certification process shall be accomplished before the IDS is deemed operational. The testing and certification shall occur in 3 phases.

2.5.1 Phase I Testing

The Contractor shall perform a Contractor Verification Test (CVT) upon the IDE Installation.

The Contractor, the 65th Special Operations Squadron (SOS) representative, and 1 SOSFS/SSE shall witness test Phase I. The test shall be performed in accordance with the written testing procedures provided in the Installation Design Package (IDP). Any component found to be inoperative during the test or at any time during the installation period shall be brought to the attention of the Security Forces Point of Contact (POC). Acceptance testing shall consist of the following; intrusion tests, tamper tests, annunciation tests, assessment tests, Alternating Current (AC) power loss test, line supervision test, sensor system self-tests, and access control.

2.5.2 Phase II Testing

Phase II testing is a seventy-two (72)-hour continuous test that ensures all equipment is installed properly and works according to specifications. It shall establish initial expectations in regard to false and nuisance alarms. Air Force Technical Order (AFTO) 747, Communications and Information Systems Acceptance Certificate, transferring the system shall be signed after successful completion of Phase II. AFTO 747 signifies the completion of the project and provides acceptance of the installed system. The completion of this form certifies that the system has been tested and accepted as installed. The responsible party shall correct all noted exceptions to the satisfaction of the Government POC/1 SOSFS/SSE.

2.5.3 Phase III Testing

Phase III testing is a 30-day continuous operational test to permanently assess how well the system performs in its normal operating mode. This test is to detect any premature or latent defects in the equipment or components and allow the operators and maintainers to assess the adequacy of logistics support and assess the false and nuisance alarm rates of the system. After successfully completing Phase III, the 505th Combat Training Squadron (CTS) shall request Major Command (MAJCOM) certification.

2.5.4 Phase II and III Completion

The Government shall complete phase II and III testing.

2.6 NAR/FAR Rates

2.6.1 Interior IDS

Interior false and nuisance alarms should be extremely limited.

No more than one false alarm per individual sensor point within the previous 30 days is acceptable.

No more than three nuisance alarms per individual sensor point within the previous 30 days is acceptable.

2.6.2 Exterior IDS

No more than one false alarm per individual sensor point within the previous 24-hour period is acceptable.

No more than three nuisance alarms per individual sensor point within the previous 24-hour period is acceptable.

2.6.3 Individual-Resource IDS

IDS configured to protect an individually exposed resource, such as an aircraft, must not have more than three false alarms or three nuisance alarms per individual sensor point within the previous 24-hour period.

2.7 Corrective Action Response

The maintainer shall respond and correct issues if a negative performance trend is detected from sensors exceeding authorized nuisance and false alarm rate. The maintainer shall replace IDE if the problem continues on IDE, and no cause can be determined.

2.8 Training

The installer shall provide basic training for any altered IDE, newly installed IDE, or IDS.

T h e training shall include information on how to secure facility, place facility in "access" status, change user pin codes, test all alarm point/sensors and components, and initiate work orders through the respective installer.

The Contractor shall provide the user with a user manual or any other written verbiage stating how to utilize and install the device to activate and deactivate the system.

3 Collateral Support

3.1 Support Products Provided

The Government shall provide the following products in support of this effort;

3.1.1 Permits

Assist in acquiring related permits that may be necessary for work performed.

3.1.2 Installation Access

Arrange access into the installation.

3.1.3 Storage and Operating Space

Provide storage space/staging area for materials and an operating space with telephone capability for the installation team. Building 90131, Warehouse shall act as the main staging area for the Contractor during the installation process. To request additional space, contact 65th SOS. The Government is not responsible for materials left unattended or unsecured.

3.1.4 Host Escort

The 65the SOS shall provide a host escort for the contractors when needed during the installation. The 65SOS shall coordinate with facility/users to ensure rooms and work areas are available when access is required.

4 4.0 System Maintenance

4.1 Warranty

The Contractor shall provide a 1 year warranty maintenance and part replacement on all-new IDE installed by Contractor. The warranty shall start on the day the Government accepts the entire project.

4.2 Software Updates

The Contractor shall provide any software updates required to support new IDE for 1 year from the date the Government accepts the entire project.

5 Special Requirements

5.1 Documentation

The Contractor shall provide documentation for the certified Honeywell-Vindicator installers and the Vindicator Certification Identification (ID) numbers for Vindicator technicians prior to working on this project.

5.2 5.2 Wiring Connections

All wiring connections shall be secured using standard security connectors that meet standard fire codes for security systems. All wiring shall be clearly labeled, and wiring diagram provided to Communication, Civilian Engineers, and 1 SOSFS/SSE.

5.3 Infrastructure and IDE Malfunctions

The contractor and Government representatives shall coordinate to troubleshoot problems during the installation and the one-year warranty/maintenance period.

5.4 Quality Assurance Inspection

A joint quality assurance inspection shall be conducted prior to Government acceptance and system operability testing conducted.

5.5 Certifications

The Contractor shall assign employees who possess adequate certification to handle all required product installation tasks to meet Occupational Safety and Health Administration (OSHA), base safety requirements, and annunciator certification standards. The Contractor shall ensure that the product meets required safety standards when the project is completed and accepted by the Government. The Contractor shall provide the standard commercial product warranty certificate specifying the warranty period for the system on a Portable Document Format (PDF) file.

5.6 Wire and Cable Routing

All exposed IDS wires/cables shall be routed through the conduit. Cabling ran through the ceiling shall be air plenum-rated conduit.

5.7 Tamper Protection

The IDE must be tamper protected.

5.8 Installation Schedule

The Contractor shall develop an installation schedule and coordinate it with the 1 SOSFS/SSE and 65th SOS POC prior to work being accomplished. Installation scheduling coordination may take up to forty-eight (48) hours to coordinate with subordinate units. If the schedule requires changing, the Contractor should make every attempt to adhere to the 48 hours prior to the notification change request.

6 Security Requirements

6.1 Compliance

The Contractor shall comply at all times with base security requirements to include base pass requirements and personnel security clearance.

6.2 Identification and Vehicle Passes

All contractors shall submit a complete list of personnel in accordance with installation policy, including deliverymen, who will be expected to work on the installation. This list will contain Privacy Act information as required as well as the expectation that each individual will be able to present a current and valid state identification, to meet local Air Force security requirements. This information shall be sent to the Contracting Officer at least 10 days in advance prior to the start of installation.

The contractor shall not employ persons for work on this contract if such employee is identified to the contractor by the Contracting Officer as a potential threat to the health, safety, security, general well-being or operational mission of the installation and its population. Contractor personnel shall present a neat appearance and be easily recognized as contractor employees.

All commercial trucks must enter through the Commercial Gate on Cody Ave off of Independence Road, Fort Walton Beach, FL for inspection. Prior to going through the Commercial Gate, contractor will have to obtain a visitors pass from the Visitors Center located off of HWY 98. In accordance with the Installation 1st SOSFS Visitor Control Center; base entry procedures must adhere to delivery vehicle process requirements mandated by the 1st SOSFS. Vehicles are subject to inspection. To obtain a base pass from the Visitors Center, the driver will require:

1. A current Vehicle Registration

2. A current Proof of Insurance

3. A valid and current Driver's License for the driver

4. A valid and current Driver's License or other State Identification for any passenger(s) in the vehicle.

5. A Base Pass Letter from the CO with the contract number, and individuals requiring base access. The base pass request must be submitted to the CO at least 10 days prior to scheduled delivery and include the names and driver’s license number of each individual requiring base access. The request shall also include the anticipated installation timeframe for this project.

6. When work under this contract requires unescorted entry to controlled or restricted areas, the Contractor shall comply with AFI 31-101, Volume 1, The Air Force Installation Security Program, AFMAN 16-1405, Air Force Personnel Security Program, and AFI 31- 501 DoDM 5200.02, Procedures for the Department of Defense Personal Security Program, citing the appropriate paragraphs as applicable.

7. Upon completion or termination of the contract or expiration of the identification passes, the prime Contractor shall ensure that all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

8. Failure to comply with these requirements may result in withholding of final payment.

6.3 Retrieving Identification Media

The Contractor shall be responsible for retrieving all identification media, including visitor passes from employees who depart for any reason before the contract expires (i.e., termination for cause or retirement). Visitor passes shall be retrieved and turned into 1 SOSFS Pass and Registration/Visitor Center once the Contractor and its employees leave the base for the last time.

6.4 Traffic Laws

The Contractor and employees shall comply with base traffic regulations.

6.5 Weapons, Firearms, Ammunition

The contractor employees are prohibited from possessing weapons, firearms, or ammunition or within the contractor vehicle or privately owned vehicles while on the Government installation.

6.6 Controlled Storage Areas

Contractor employees performing work in the controlled areas described as Open Secret Storage Area (OSSA) must meet prescribed requirements in accordance with Department of Defense Manual (DoDM) 5200.0 l, Volume 3, Enclosure 3, Para 2.a.( l). IDS Installation and Maintenance Personnel. Alarm installation and maintenance shall be accomplished by United States citizens who have been subjected to a trustworthiness determination according to Reference (l). The Contractor shall provide information of individuals to the Government for clearance verification before commencing work.

6.7 Gate Procedures:

Once at Cody Ave. Gate, be prepared to exit the vehicle and allow for vehicle inspection. At this time you may ask for directions to your final destination.

If the final destination requires the driver to leave Cody Ave. Gate, and re-enter the base through an alternate gate, the pass received will be sufficient documentation for entry into both gates, within a pre-established time directed by the Security Forces representative.

Arrival at the appropriate gate after the designated allotted time will result in non-admittance to the installation.

This procedure will occur each time a commercial truck requests access to the base.

Current Bill of Lading (BOL) to get delivery driver and the vehicle on base. BOL must include the AF installation name, date of anticipated delivery, and specific destination (including building number, street address, and point of contact information).

Personnel should have the following items when entering an installation:

Current Registration for all vehicles

Current Proof of Insurance for all vehicles

Valid driver’s license for each driver

Valid driver’s license or other state identification for each passenger

Depending on the current Force Protection Condition, a government representative may be required to sponsor those people in person at Pass & ID/Visitors Center.

7 Failure Response and Repair Times

7.1 Failure Categories

The Contractor shall respond to and restore failures at fielded locations in accordance with the tables below. System Failures are defined in Table 7-1. The ESS NCO will determine the category of the failure and advise the Contractor.

7.2 Response Time

Response Time is defined as a measurement of the total elapsed time between the issuance of a customer work order and telephonic IDS problem resolution or contractor maintenance personnel arrival at the requesting base. When the Contractor cannot resolve work order issues telephonically or is directed by an Electronic Security System (ESS) Noncommissioned Officer (NCO), the contractor personnel shall meet the response time thresholds listed in Table 7-0 by having service personnel arrive on-site to begin troubleshooting/repair. All actual response times and closeout action details shall be recorded in the Integrated Maintenance Management System

(IMMS).

7.2.1 Response Time Start

Response time shall begin when a technician is called to respond to a work order that cannot be rectified telephonically by base SF personnel.

Figure 2: GCS/SWA Door Design

Figure 3: GCS/SWA Ceiling Area

Figure 4: Site Layout

End of SOW