SOW St. Louis ERO VMS-Rev 1.pdf

Immigration and Customs Enforcement

Office of Professional Responsibility

Security Division

Physical Security Operations Unit

Electronic Security Systems (ESS)

Scope of Work

Upgrade of Video Surveillance System

(VSS)

Location: ICE-ERO

1222 Spruce Street

Saint Louis, MO 63103

Version: (1)

01/22/2020

WARNING: This document is FOR OFFICIAL USE ONLY

(FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C.

552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public or other personnel who do not have a valid "need-to-know" without prior approval of an authorized DHS official.

Document Control: At a minimum, this document, and any products made from this document, will be marked as “FOR

OFFICIAL USE ONLY,” disseminated only on a need-to-know basis, and stored in a locked container or password-protected file or system offering sufficient protection against theft, compromise, inadvertent access, and unauthorized disclosure.

When no longer needed, destroy physical copies by shredding, pulping, or burning to assure destruction beyond recognition.

TABLE OF CONTENTS

SECTION I - GENERAL REQUIREMENTS

1. Project Overview

2. Project Location and Contacts

3. Project Scope

4. Compliance

5. Qualifications

6. Project Site Visit

7. Timeline and Benchmarks

8. Project Closeout

9. Training

10. General Notes

11. Infrastructure

12. Warranty

13. Review and Approvals

SECTION II - ELECTRONIC SECURITY TYPICAL BLOCK DIAGRAMS

SECTION III - ELECTRONIC SECURITY SYSTEMS (ESS) COMPONENT TASKS

A. Video Surveillance System (VSS)

SECTION IV - SECURITY SYSTEMS DETAILS........................... Error! Bookmark not defined.

A. Interior Video Surveillance System (VSS) Devices ...................... Error! Bookmark not defined.

B. Exterior Video Surveillance System (VSS) Devices

ATTACHMENTS

PACS Paperwork ................................................................................ Error! Bookmark not defined.

ESS Component Checklists

MegaCenter Alarm Requirements (MAR) Form ............................... Error! Bookmark not defined.

SECTION I - GENERAL REQUIREMENTS

1. Project Overview

1.1. The U.S. Immigration and Customs Enforcement (ICE) is the premier Federal Law Enforcement

Agency within the U.S. Department of Homeland Security with primary mission to promote homeland security and public safety through the criminal and civil enforcement of federal laws governing border control, customs, trade and immigration.

1.2 ICE requires the Contractor/vendor to upgrade existing video surveillance system (VSS). The

Contractor proposed solution must reflect consideration for the sensitivity of the ICE mission, the safety and security of all personnel, information, facilities and the requirements set forth in this document.

2. Project Location and Contacts

2.1 The place of work performance is the ICE office located at 1222 Spruce Street, St. Louis, MO

63103.

2.2. The following ICE Office of Professional Responsibility (OPR) Field Security Manager (FSM), or his/her supervisor in their absence, is the final technical security authority for this project:

Katherine Rucinski

Office: 312-341-4435

Mobile: 312-339-8353

2.3. The ICE Office of Assets and Facilities Management (OAFM) Project Manager is:

Tammy DeLima

Office: 214-915-6121

Mobile: 214-250-2456

3. Project Scope

3.1. ICE requires the Security Contractor to design, procure, install, configure, program, test, document, maintain components and installation work through the warranty period and train personnel on a turn-key Electronic Security Systems (ESS). The ESS sub-systems shall include but may not be limited to:

(1) Physical Access Control System (PACS); (2) Intrusion Detection System (IDS); and (3) Video

Surveillance System (VSS).

3.2. All programming, software loads and maintenance will be done on-site. The Contractor will not be authorized remote (client) access to the network or systems to perform maintenance, troubleshoot problems, or apply software changes.

3.3. A description of acceptable fielded security devices and typical ESS block diagrams are included in this document for reference. The Contractor may propose other ESS solutions they believe will be beneficial to ICE.

3.4. A detailed listing of all ESS equipment product data (including quantity, make, model, part numbers) and fielded device locations must be provided by The Contractor and approved by the FSM to ensure compliance with this document.

3.5. The Contractor shall provide drawings for each ESS component sub-system (PACS, IDS, VSS) and a combined ESS drawing with all component sub-systems. Drawings shall list each component individually (i.e. workstation(s), panels, enclosures, power supplies, fielded devices) and their installation locations. The Contractor shall ensure that all mounting details and all devices are cross referenced in the drawings including all data cabling that interconnect components, and all power connections.

3.6. Any conflicts between the requirements of this Security SOW and any other project requirements or specifications, to include the ICE Facilities Design Guide (FDG), will be identified to the ICE OAFM

Project Manager and FSM for resolution. All coordination and resolution shall occur through prescribed

GSA channels.

3.7. This Scope of Work (SOW) will be periodically reviewed to assess the future use of the components described within. ICE reserves the right to change system components listed within this SOW through proper coordination through prescribed GSA channels.

4. Compliance

4.1. In compliance with General Services Administration (GSA) specifications or in the absence of GSA

Schedules the following will apply and are required for all U.S. Immigration and Customs Enforcement

(ICE) security system projects: Homeland Security Presidential Directive 12 (HSPD-12), Office of

Management and Budget (OMB) M-11-11 and M-05-24, Interagency Security Committee (ISC)

Standards, Department of Homeland Security (DHS) Management Directive System, National Institute of Standards and Technology (NIST) 800-116 and 800-53, Federal Information Processing Standards

(FIPS) 201-2, and Underwriters Laboratory (UL).

4.2. All work performed shall comply with national and local codes, ordinances, regulations, and other legal requirements of the authority having jurisdiction (AHJ), which bear on the performance of work.

The Contractor is to acquire all necessary permits for the completion of this work. All ESS components provided by the Contractor are required to meet applicable regulations, directives and guidelines for that respective activity.

4.3. The Contractor shall comply with the most recent applicable codes and standards published by the

National Fire Protection Association (NFPA). This includes, but is not limited to, NFPA 1 Fire Code, NFPA 70 National Electric Code (NEC) and NFPA 101 Life Safety Code.

5. Qualifications

5.1. The Contractor or Sub-Contractor shall strictly adhere to engineering, installation and testing procedures in accordance with the requirements of GSA and equipment manufacturer(s) and maintain a service center near the project site or the ability to expedite parts to the project site within 24 hours.

5.1.1. Contractor or sub-Contractor for PACS - Due to DHS PACS Modernization requirements, Software House C•CURE 9000 is the only Physical Access Control System (PACS) that may be used; no other PACS systems may be substituted for this project. The Contractor or Sub-Contractor for PACS must:

5.1.1.1. Be an approved vendor of FIPS 201 compliant PACS components and services on

Federal Acquisition Service (FAS) Schedule 84, or of HSPD-12 product and service components on FAS Schedule 70.

5.1.1.2. Be listed in the Software House Dealer Certification Program

(http://www.swhouse.com/support/Dealer_Certification.aspx), or provide proof of certification.

5.1.1.3. Be qualified to perform the software application functions for Software House

C•CURE 9000 Enterprise installation and connectivity back to ICE HQ’s infrastructure

5.2. 5.2. Technician -All ESS components shall be installed by an Electronics or Security System

Installation Technician. The technician must have sufficient experience, knowledge, skills, and abilities to perform the required tasks for the installation of the ESS as outlined in this scope. The following skills are preferred:

• Possess a 2-year degree or certification in the electronics discipline from an accredited educational institution or trade school

• Be proficient at maintaining, repairing, and installing access control, intrusion detection/alarm and IP video systems

• Possess the ability to isolate network deficiencies, equipment failures and operational anomalies through use of technical manual reference, diagnostic equipment/software and established troubleshooting techniques

• Have a working knowledge of network architecture with an understanding of IP configuration and transport principals

• Experience in how to run and install conduit and cabling per NEC code

5.3. Specialized Technician - A Specialized Technician for PACS must possess all Technician qualifications as identified above and one of the following current Tyco Software House certifications:

• C•CURE 9000 System Installer/Maintainer (AC9001)

• C•CURE 9000 Advanced Integrator (AC9005)

5.3.1. The certification shall be provided to the FSM upon award of the contract.

5.3.2. During the installation and testing phase, the Contractor shall make no substitutions of specialized technicians unless the substitution is necessitated by illness, death, termination of employment or other non-discretional reason. The Contractor shall notify ICE personnel within five

(5) business days after the occurrence of any of these events and provide a detailed explanation of the circumstances necessitating the proposed substitution, complete credentials for the proposed substitute, and any additional information requested by ICE personnel. All proposed substitutes shall possess the same minimum qualifications to those of the persons being replaced. The ICE personnel will notify the Contractor within fifteen (15) calendar days after receipt of all required information of the decision on the substitution.

http://www.swhouse.com/support/Dealer_Certification.aspx

5.4. Project Manager - The Contractor shall also ensure that a Project Manager is dedicated to the project from contract award until project acceptance is achieved. The Project Manager shall have:

5.4.1. A minimum of four (4) years of progressive experience in the security systems field, including at least three (3) years in a management capacity directing security systems implementations, preferably on behalf of a Federal client.

5.4.2. The Project Manager should also demonstrate experience managing projects of similar size and scope to this ICE project.

5.4.3. The Contractor shall ensure that the Project Manager is on-site for all critical phases of the project. Critical phases include project kickoff, all testing phases for project closeout, final ICE acceptance, and any security coordination meetings to resolve critical issues.

5.5. Systems Engineer - A Systems Engineer with demonstrated experience in the implementation of

PKI and federal ICAM architectures for E-PACS of similar size and scope to this ICE project should be used. The Systems Engineer shall have attained:

5.5.1. Software House C•CURE 9000 Advanced Integrator (AC9005) or C•CURE 9000 Enterprise

Architecture (AC9444) certification, and

5.5.2. Be a current Certified System Engineer ICAM PACS (CSEIP) listed on the Secure

Technology Alliance Registry (https://www.securetechalliance.org/activities-cseip-registry/).

6. Project Site Visit

6.1. Prior to commencing work, the Contractor is required to perform a site walkthrough with the GSA, ICE Field Security Manager or designated alternate and the local ICE program office management to discuss aspects of the facility and job specific requirements, specific work methods and proposed schedules. If the FSM is not available to meet at the project site, the Contractor may request a conference call through GSA.

6.1.1. The Contractor shall become familiar with local conditions under which work is to be performed and correlate observations with requirements of contract documents.

6.1.2. The Contractor shall identify areas of concern, review important procedural and safety precautions, and agree upon desired installation timetables through a project plan developed by the

Contractor.

6.1.3. Before ordering any materials or performing work, the Contractor shall verify space requirements and be responsible for their correctness.

6.1.4. For observation(s) that should be made during the site visit no allowance for claims of concealed conditions by the Contractor shall be made. If in-wall inspections are requested but not allowed, the Contractor shall note this on their quote.

6.1.5. Based on NFPA fire code requirements all doors shall be identified as either fail safe or fail secure during the walkthrough. Doors that require delayed egress will also be identified. ICE https://www.securetechalliance.org/activities-cseip-registry/ perimeter doors and high security doors will typically be fail secure (normally locked) while yet allowing appropriate egress.

7. Timeline and Benchmarks

7.1. The requirement to provide a turnkey solution will necessitate the Contractor to coordinate several actions and deliverables with the Architectural Engineer, General Contractor, other sub-contractors and various ICE program offices. All coordination shall occur through prescribed GSA channels.

7.2. Typically, within 30 days of award, the Contractor shall provide, or incorporate in the overall project schedule, a plan which will address date of completion for the following administrative benchmarks. This information should be displayed in a Gantt Chart or other timeline product with key dates annotated. Please note that expedited coordination may be required for small projects or urgent circumstances.

Activity / Deliverable Benchmark

Provide final security design/drawings, device lists and updated project schedule

Within 30 days of contract award

Provide product certification, etc.

data submittal, proof of

*Provide all PACS PAPERWORK (Port Charts, Input/Output Worksheets, etc.), and

MEGACENTER ALARM REQUIREMENTS

FORM to FSM for review and approval

Local ICE office(s) to provide PACS Personnel

Worksheets

Coordinate installation of POTS or IP connection with project team

Coordinate with FSM to provide necessary information for Site Security Addendum

Provide final copy of ICE-approved

MEGACENTER ALARM REQUIREMENTS

FORM to FPS MegaCenter for programming via

FSM (minimum 3-day turn around)

No later than 30 days prior to projected test and acceptance date

Provide confirmation of test and acceptance date

Provide Letter of Completion and completed ESS

COMPONENT CHECKLISTS to FSM; place approved Port Charts in each PACS panel enclosure

No later than 14 days prior to projected test and acceptance date

Provide training, materials and handouts On projected training date

Completion of punch list corrections Within 14 days of discovery

Provide closeout docs

Within 30 days completion, unless otherwise by GSA of project specified

8. Project Closeout

8.1. When the Contractor has completed all ESS work, the Contractor is to test and certify the work performed has been completed, and the systems/hardware provided are in good working order. A Letter of Completion must be signed by a senior company official on letterhead identifying each task and ESS component applicable to the certification. The Contractor must complete the ESS COMPONENT

CHECKLISTS referenced at the end of this document. The Contractor must follow the prescribed GSA channels when submitting certifications.

8.2. Approximately two weeks after receipt of the Letter of Completion, the ICE Field Security

Manager, or designated alternate, and the Contractor will perform a final walk-through inspection and acceptance test of the ESS to ensure the system is complete and acceptable. Inspections and tests will be conducted during the final walk-through, including but not limited to the following:

8.2.1. During the inspection, the Contractor shall demonstrate all equipment and system features, to include emergency power solution demonstration, to ICE Field Security Manager.

8.2.2. Any portions of work found to be deficient or not in compliance with these requirements must be responded to and/or corrected within 14 days. A reasonable time extension may be granted as determined by ICE Field Security Manager. Upon correction of deficiencies, the Contractor shall submit a request in writing for another acceptance test with the ICE Field Security Manager.

8.2.3. After all deficiencies have been corrected and prior to the final acceptance test walk-through there will be a one-week monitoring period of all installed equipment to ensure proper operation.

8.2.4. If all work is found to be acceptable and in compliance with the requirements, the

Government will issue a letter of acceptance.

8.2.5. Additional testing may be done or required by the ICE Field Security Manager.

8.3. The start date of the beneficial use and warranty will not commence prior to a successful final walk-through test. Failure of any contractor-provided hardware or software system to perform as specified will be construed as a failure to comply with requirements of the contract.

8.4. The Contractor will provide an as-built package including one electronic PDF format file and three

(3) hard copies of the Electronic Security Systems (ESS) diagrams identifying the locations of all ESS components, unless directed otherwise by the FSM. This will include but is not limited to floor plans, riser diagrams, port charts, door details and device wiring details. Additionally, the as-built package shall contain any other deliverable items to include documents generated as a result of the final walk through checklist and acceptance testing.

8.5 The Contractor shall provide a training sign-in roster with the closeout documents. The roster shall include a description of the topics covered, date of training, name and signatures of attendees, and name and signature of instructor.

9. Training

9.1. The Contractor shall provide training upon completion and acceptance of the ESS. Training services must provide attendees with the necessary skills to configure, install, operate, and troubleshoot installed security systems and devices. Training is to be a combination of face-to-face lecture and lab instruction with emphasis on hands-on activities. Operational system hardware shall be utilized during training to provide attendees with installed security systems environment familiarization.

9.2. The Contractor will provide a minimum 4-hour basic training session to system operators. The dates and times of each session shall be jointly determined by the ICE supervisor, the Field Security

Manager and the Contractor.

9.3. Training material used, a complete set of product manuals, quick reference guides, and a certificate of training completion are to be given to each participant.

9.3. Training will cover all ESS components:

9.3.1. Video Surveillance System (VSS) training topics will include:

• Location and identification of VSS components and any enclosure keys

• Accessing and viewing cameras

• Moving and focusing cameras

• Changing monitor view mode from single to multicamera mode

• Enabling and administering privacy masking

• Searching, retrieving and reviewing camera video

• Downloading and exporting video in open file format and proprietary format

• Adding personnel to the system as both operator and administrator roles with passwords

• Overview and maintenance of emergency power

• How to obtain and install future software and firmware updates

10. General Notes

10.1. The Contractor is responsible for damage to any equipment, materials, surfaces or other work disrupted as result of the work. The Contractor will patch and paint any holes and make any repairs to any surface (i.e. walls, doors, ceiling, etc.) that is the result of the Contractor's work. Repair work must match existing construction in grade and likeness. Repair or remuneration will be the sole responsibility of the Contractor. If such work cannot be repaired within a reasonable time, the Government reserves the right to repair damaged equipment, materials or surfaces and offset the costs for such repairs from the awarded contract price. The Contractor will coordinate any anticipated ESS downtime with the ICE

FSM and local ICE Program Offices.

10.2. Conflicts between manufacturer’s recommendations, specifications, and/or contract documents must be reported in writing to the GSA or Contracting Officer Representative for resolution.

10.3. All passwords for ESS component systems will be changed from the default and be provided to local management in the training session and recorded in the closeout documentation.

11. Infrastructure

11.1. The Contractor is to install all wiring including, but not limited to, communication and power support necessary for the operation of the ESS. All wiring shall consist of a single, unbroken run that is free of splices and T-Taps. Wiring for all ESS devices shall be tamper resistant. Wiring for all ESS field devices shall not be exposed (i.e. must be internal to a secure space wall, ceilings, doorframes, etc.)

upon installation. Wiring for all ESS components shall remain within ICE space to the fullest extent possible. When it is not feasible for wiring to remain internal to ICE space the Contactor shall provide a tamper resistant or conduit solution. Written approval by the ICE Field Security Manager is required for any wiring to be placed external of ICE controlled space.

11.1.1. In compliance with NFPA 70 NEC and as prescribed by the manufacturer, for PACS card readers, all cabling shall be plenum-grade, listed as having adequate fire-resistant and low smoke-producing characteristics.

11.1.2. Additionally, for PACS, the Contractor shall ensure that all cabling within the enclosure does not exceed one spare pair per cable and is properly terminated with a sleeve to prevent unraveling/unwinding.

11.2. For PACS renovation projects, The Contractor is required to remove the existing access control infrastructure including controllers, card readers and reader modules, power supplies, door position switches, request-to exit devices, and cabling. The Contractor may reuse the existing electrified lock sets. If the Contractor chooses to reuse the existing electrified lock sets, the Contractor shall maintain and at no cost to the government these locks sets during the warranty period. If the Contractor cannot remove existing cable, they shall terminate all cable ends and tag the cable as “Abandoned Security

Wire” and shall not re-use any portion of the legacy PACS wire in the new PACS.

11.3. The Contractor shall securely fasten all ESS wiring above drop ceilings to provide adequate support in an approved method and per the latest version of the GSA PBS-P100 Facilities Standards for the Public Building Service and the National Electric Code (NEC). No wiring may be directly in contact with acoustical ceiling tiles. When replacing existing security system wiring the Contractor must remove abandoned ESS wiring in the ceiling. Line security to end devices shall be implemented through End-of-

Line resistors installed at the device.

11.4. High security screws must be used for all ESS components that are exposed (i.e. can be viewed externally or are not secured behind a face plate).

11.5. All wiring shall be labeled at both ends using a numerical system to allow for identification. The wire labeling configuration shall be called out on the as-built ESS drawings to be provided and verified during final walk through and acceptance.

11.6. All grounding is to be performed in accordance with ANSI-J-STD-607-A, NFPA 70 NEC and local codes and practices. Grounding for all electrical work performed by The Contractor shall include, but is not limited to, the highlights below:

11.6.1. Provide grounding at security device location and ensure proper bonding to existing facilities.

11.6.2. Ensure equipment racks are properly grounded to facility grounding buss bar.

11.6.3. Ensure grounding continuity by properly bonding appropriate cabling, closures, cabinets, conduits, service boxes, and head end equipment.

11.6.4. Power shall only be applied to the system after re-checking for proper grounding of the system and measuring all loops for lack of shorts and open circuits.

11.7. The Contractor will provide lockable electronics equipment rack(s), mounts, slides, shelves and other necessary items to install and mount hardware.

11.8. The Contractor’s proposal must identify by square footage all wall and floor space requirements for rack and wall mounted equipment. The Contractor’s proposal must identify by amperage all ESS power requirements to ensure appropriate rated circuit breakers are installed in power panels supporting the equipment.

11.9. The Contractor shall coordinate with GSA and OAFM to request that all security equipment be on its own dedicated electrical circuit. The security technician is not responsible for this; a licensed electrician will need to make sure this is accomplished.

11.10. The Contractor is to provide and install all equipment associated power for ESS operation. All

ESS management and backend equipment (i.e. reader controllers, IDS panels, etc.) is to be installed in the suite’s IT LAN room, security equipment room or other secured area, with approval by the FSM.

The Contractor will ensure each equipment room contains sufficient HVAC air circulation and conditioning to support electronic equipment requirements. In each designated equipment room, high quality fire rated plywood, or better, must be installed by the Contractor to support wall mounted backend equipment (i.e. panels, power supplies, etc.).

11.11. The Contractor shall provide and install a minimum of an 8-hour emergency power solution for all ESS hardware. The power solution can be provided through the use of batteries, emergency generators, UPS, or a combination thereof to meet the requirements.

11.11.1. If emergency power is available, via generator, a battery backup must be provided to cover transfer time.

11.11.2. Unless specified differently by the manufacturer, PACS power supplies have 12

Vdc/18ah batteries. Any batteries for IDS panels shall have no less than a 12 Vdc/7ah battery each, unless specified differently by the manufacturer.

11.11.3. For uninterruptable power supply (UPS) installations the UPS must have surge protection and line conditioning features.

11.12. Power supplies to ESS equipment shall be wired to minimize likelihood of accidental disconnect.

Unsecured plug-ins to power supplies not located in a rack or enclosure are not acceptable.

11.13. The Contractor shall ensure that all power supplies are rated to power the maximum load plus a minimum of 10 percent spare capacity. ICE defines maximum load as the simultaneous use of all devices at their maximum current requirements.

11.14. The Contractor shall supply voltage load calculations for each Electrical/LAN closet that supports the PACS. The Contractor shall calculate power supplies and back-up capacity by maximum load.

Separately, The Contractor shall calculate nominal power and typical duty-cycle to determine the duration of the back-up system.

11.15. The Contractor shall ensure that all power supplies to PACS panel(s) are co-located. The

Contractor shall ensure that new power supplies are optioned to transmit a trouble condition to the

PACS when the following conditions exist: (a) low battery, (b) AC fail.

11.16. The Contractor shall ensure outputs are individually fused and sufficient for the connected load.

The Contractor shall ensure that all battery calculations are based upon peak usage (i.e. simultaneous use of all devices.). The Contractor shall provide batteries sufficiently sized to support the stand-by requirements.

11.17. In compliance with NFPA 101 Life Safety Code means of egress standards and as determined from the pre-construction site walkthrough the Contractor shall ensure that all doors are properly wired for either fail safe or fail secure mode of operation. All egress path doors, unless otherwise designated by the FSM, scheduled with electronic hardware shall unlock from inside the facility upon actuation of a life safety device or fire alarm.

12. Warranty

12.1. A warranty period of one year will commence on official date of use after testing and acceptance by ICE Field Security Manager or designated alternate. ICE shall incur no equipment or labor costs during this warranty period.

12.2. The Contractor will identify a technical support or service contact for consultation during normal business hours, which is reachable by telephone or email.

12.3. Any critical security component that becomes inoperable must be replaced or repaired within 72 hours. Critical components are those required to provide security (PACS, IDS, VSS) for a perimeter access point or high security/critical area.

12.4. For any non-critical component that becomes inoperable, the Contractor shall schedule a service call as soon as practical but not to exceed 14 days.

12.5. The Contractor must notify the customer of all projected downtime and estimated time for repair and provide a written report of all services rendered at time of repair.

12.6. Replacement security devices must be approved by FSM prior to installation.

12.7. ICE shall receive the full benefit of all manufacturers’ warranties on all components beyond the initial warranty period.

12.8. The Contractor shall propose an extended warranty plan that includes ESS equipment replacement costs and hourly labor costs for service requirements. The proposed extended warranty should include the regularly scheduled and routine upkeep of equipment. The repair or replacement of any critical security component, as defined above, must occur within the same timeframe established in this document. For any non-critical security component that becomes inoperable, the Contractor shall schedule a service call as soon as practical.

STEVEN T INGWERSEN Digitally signed by STEVEN T INGWERSEN Date: 2020.01.28 10:27:14 -05'00'

13. Review and Approvals

Completed by:

Name, Signature & Date:

Approved by (RSM or SC): Steven Ingwersen

Name, Signature & Date:

Transmitted to (OAFM Title & Name):

Signature: Date:

SECTION II - ELECTRONIC SECURITY TYPICAL BLOCK DIAGRAMS

SECTION III - ELECTRONIC SECURITY SYSTEMS (ESS) COMPONENT TASKS

A. Video Surveillance System (VSS)

A.1. The Contractor shall provide a complete VSS solution designed such that it meets the physical security needs of the facility. The solution shall include cameras, network video recorders (NVR) and associated peripheral hardware for management and network transport purposes. The VSS solution must be built on an Internet Protocol (IP) based architecture on an isolated LAN platform; this network will not connect to the Internet nor any other network. The Contractor shall provide all network related hardware for this platform. Procurement of VSS hardware must follow GSA guidelines and the purchasing or use of hardware manufactured or assembled in China is prohibited. All network switches will be rated to support IP camera Power-Over-Ethernet (POE) requirements as per manufacturer specifications. The VSS solution will contain local management capabilities utilizing a standalone configuration. System management software shall be compatible with all functional requirements of the

VSS system. Exceptions must be approved by the FSM.

A.2. The Contractor will design a VSS solution that contains, at a minimum, the following:

A.2.1. An NVR model/type that shall produce an open file format, such as .avi or .mov, and a proprietary water-marked format for download or export

A.2.2. A system that includes the ability to visually present a variety of groupings of real-time video as selected by the administrator or local operator

Video Surveillance System (VSS) – local facility

POE

capable switch

Workstations/ Decoders monitor(s)

IP Network Cameras

Emergency Power

NVR

NVR – Network Video Recorder

A.2.3. Basic camera management functions

A.2.4. An NVR model/type where an administrator can pre-program pan-tilt-zoom (PTZ) cameras to view a pattern or tour during predetermined timeframes but, manually controlled when needed

A.2.5. A system that is capable of detecting a duress activated alarm and displaying the closest camera to the location of the alarm in full screen on a preselected monitor until reset to normal video display operation, as specified by FSM

A.2.6. All required software and hardware licenses for at least 1 year from date of ICE acceptance

A.2.7. All required firmware and software updates to all VSS equipment prior to deployment

A.3. Network Video Recorder (NVR) equipment is required for the storage and review of historical security camera video. NVR systems shall be capable of changing the recording frame rate and frames-per-second (fps) based upon a set schedule and analytical inputs such as motion. The typical minimum recording solutions for each camera location are listed below.

A.3.1. Exterior Perimeter: 24/7 minimum 15 fps continuous

A.3.2. Public entrance/exit (interior side), transaction windows, lobbies:

A.3.2.1. Business hours (One hour before facility opens to one hour after facility closes):

minimum 15 fps continuous

A.3.2.2. Non-business hours (One hour after closing to one hour before opening): Motion and alarm activated, a minimum of 15 fps from 10 seconds before to 30 seconds after.

(motion period shall include 2 hours of 15 fps recording for storage calculations)

A.3.3. Detainee areas (Sally Port, holding, processing, etc.), evidence rooms, armory:

A.3.3.1. Business hours (One hour before facility opens to one hour after facility closes):

minimum 15 fps continuous

A.3.3.2. Non-business hours (One hour after closing to one hour before opening) minimum

7.5 fps continuous. With motion and alarm activation recording increases to a minimum of

15 fps to include 10 seconds before and 30 seconds after. (non-business motion period shall include 2 hours of 15 fps recording for storage calculations)

A.3.4. Non-public entrance/exit, stairwells, hallways, non-detention elevators: 24/7 Motion and alarm activated, a minimum of 15 fps from 10 seconds before to 30 seconds after. (motion period shall include 6 hours of 15 fps recording for storage calculations)

A.4. NVR hard disk drives used for video storage, such as the Western Digital ITB-10TB (a.k.a. Purple

Surveillance Storage), must be built to withstand continuous read/write activity. The Contractor will determine the storage capacity of the NVR(s) based on the following criteria:

A.4.1. Quantity of cameras

A.4.2. Period of motion activated recording per camera

A.4.3. Frames-per-Second (fps) for each camera

A.4.4. A minimum of 30 days of storage for each camera

A.4.5. H.264 or better compression

A.4.6. Camera resolution

A..4.7. Good video quality with a minimum resolution of 40 pixels-per-foot (PPF) at the target distance

A.5. The video system will be calculated to accommodate an additional 20% for storage capacity and future expansion of additional camera channels. Documentation illustrating this calculation shall be submitted to the FSM for review, including a list of cameras and their respective recording rate and duration. This requirement is capped at 10 additional video channels and storage space. The requirement may be lowered by the FSM with written authorization.

A.6. Cameras must provide 100% coverage of perimeter, detention and high-security areas. In detention holding cells, cameras will be mounted such that video is not seen or recorded in the toilet/privacy area.

All cameras will have 2-megapixel or better resolution. The FSM may designate a select number of cameras covering high security or critical areas as 5-megapixel or better to identify a person (facial recognition) or object (license plate recognition) with enough detail for courtroom quality. All exterior cameras shall have an infrared (IR) cut-filter and/or IR night time illuminator either built in or added as an accessory. All exterior cameras shall be environmentally protected based on the prevailing weather conditions for the geographical area and as prescribed by the camera manufacturer. Fixed, pan-tilt-zoom, 180-degree and 360-degree panoramic or multi-head cameras are acceptable.

A.6.1. Pan-tilt-zoom cameras shall not be programed on an area tour to provide 100% exterior coverage. These cameras shall only be utilized for additional monitoring capability when a guard force is present.

A.6.2. 360-degree panoramic or multi-head cameras should not be utilized as the primary camera to view an area when active monitoring is required.

A.7. The Contractor shall take steps to prevent tampering with the VSS system to include:

A.7.1. Positioning/mounting cameras out of reach

A.7.2. Installing all cameras in a fixed, tamper and vandal-resistant and/or detention grade enclosure

A.8. Monitors shall have the appropriate built-in video and management ports based on the VSS system design requirements and shall not have any wireless connection (Wi-Fi, Bluetooth etc.) capability enabled. Wall mounted monitors shall be installed using a premium type full-motion wall bracket to provide tilt, swivel and arm extension capabilities, unless specified differently by the FSM. For multiple monitor installations video shall be organized for security personnel to easily follow movement through the facility from one camera to the next in a smooth flowing fashion without having to bounce back and forth among monitors. VSS workstations and decoders shall not exceed the manufacture’s recommended number of displayed cameras or connected monitors. All monitors shall be capable of viewing the specified number of camera views listed below at 30 fps (real time):

A.8.1. 42-50” monitors are typical for wall and stand mount, general area observation of multiple cameras. Shall be capable of 16 camera views per monitor

A.8.2. 27-32” monitors may be utilized for guard stations and other areas where size restrictions will not allow 42-50” monitors. Shall be capable of 8 camera views per monitor

A.8.3. 22-26” monitors shall be utilized for VSS workstations, alarm call-up, or specific spot area monitors. Shall be capable of 1-4 camera views per monitor

A.9. All AC voltage powered devices shall be connected to a centrally located uninterruptable power supply (UPS) in the designated IT/LAN equipment and frame/closet rooms. Each equipment room will contain a, building-grounded, grounding buss bar which will be utilized for equipment rack and panel grounding connectivity. As part of the VSS package, the Contractor shall provide a rack mount keyboard-video-mouse (KVM) console with appropriate cabling for connection to each NVR and matrix

(if used), or properly configured network client with remote access (on the dedicated VSS network), for video and software management and maintenance.

A.10. The Contractor shall propose, procure and install VSS surveillance advisory signage at entrances to the site, facility, parking garages or parking lots, etc., where VSS coverage exists.

A.10.1. Signs shall be large enough to be noticed, placed in easily seen locations, and have both words and pictures.

Video Phone Doors Stations

1. Outside perimeter entry door off Public Corridor near Break Room 127

2. Outside perimeter door from Secure Vestibule 111 to Corridor 115

3. Outside perimeter door from Secure Waiting #124 to Reception 125

4. Outside Sally Port Man door- Exterior grade weather proof housing

Video Phone Master Stations

Room #105 (Command Post)

Room #124 (Receptionist)

C. Interior Video Surveillance System (VSS) Devices

**Requires detention grade housing

Camera Coverage Areas

All ingress/egress doors leading to and from the ICE-ERO space on the 1st floor to include Sallyport

Inside and outside of the Sallyport

Room # 124- Receptionist’s transaction window

Room # 125- Secure waiting room

Room # 119- VTC Room

Room #120 Visit room *detention grade housing*

Room #121 Visit room *detention grade housing*

Room #117 Interview room *detention grade housing*

Room # 115 Interview *detention grade housing*

Room #111 Secure Vestibule *detention grade housing*

Room #110- Processing area 100% coverage *detention grade housing*

Room # 101 Detainee Property room

Room # 102, 103, 104 and 105 -Holding Cells must have 100% coverage; cover all blind spot without intruding on the privacy of the toilet units. *Detention grade housing is required. *

Video Monitor Locations

Room #105 (Command Post)

Room #113 (SDDO-Supervisor’s Office)

Room # (ERO Open Office) Large Monitors at least 42’ so the officers can see what is happening inside the processing room/sally port, holding cells

Client Monitoring Station

B. Exterior Video Surveillance System (VSS) Devices

Fixed Detention Cameras Outside the Sally Port

Four (4) Cameras outside the Sally Port will be Fixed, Vandal Resistant, Wall Mounted

Day/Night IR Cameras with 40 ft IR range and weather proof housings mounted at 14 feet off the deck or optimum height above finished floor to be out of reach and get facial recognition inside vehicles.

Northeast corner near building (looking west) -View loading/unloading of buses Northwest corner (looking east)-View loading/unloading of buses

Northwest corner west wall (looking southwest) -View loading/unloading of vans

Southwest corner west wall (looking northwest) View loading/unloading of vans

Pan/Tilt/Zoom Cameras Outside the Sally Port

Two (2) low light, high resolution PTZ Cameras on the northwest and southwest corners of the Sally Port will be mounted on corner or gooseneck mounts (to optimize the 270 degree field of view) in weather proof housings, at 14 feet above the deck or the top of the wall to provide situational awareness to agents transferring high risk detainees and to record license plate numbers at the inbound and outbound gates to the parking lot. These two cameras will be set up to revert to a default tour or view when not manually controlled for one minute.

1. Northwest corner of Sally Port to scan parking lot with default to vehicle gate

2. Southwest corner of Sally Port to scan parking lot on tour or manual control

A system that is capable of detecting a duress activated alarm and displaying the closest camera to the location of the alarm in full screen on a preselected monitor until reset to normal video display operation.

Duress Alarm Buttons Locations that will need the Camera coverage with PTZ cameras to create a visual alarm on the video monitors:

Office Area

Location Device

Type

1. Reception #125 Wall Mount

Shielded Blue Push Button

2. Observation #117 Wall Mount

Shielded Blue Push Button

Sally Port

Location Device

Type

1. Outside Doors to Processing Wall Mount

Shielded Blue Push Button

2. Inside wall to right of Bus Door #1 Wall Mount

Shielded Blue Push Button

3. Inside wall to left of Man Door Wall Mount

Shielded Blue Push Button

4. Inside wall to left of Van Door #2 Wall Mount

5. Inside wall to left of Van Door #3 Wall Mount Shielded

Blue Push Button

6. Inside wall on building side Wall Mount

Shielded Blue Push Button

7. Exterior wall to left of Man Door Wall Mount

Shielded Blue Push Button

8. Exterior wall between Door #2 & #3 Wall Mount

ATTACHMENTS

ESS Component Checklists

• (Electronic Copy to be provided by ICE Field Security Manager)

PRIVACY REQUIREMENTS FOR CONTRACTOR AND PERSONNEL

In addition to FAR 52.224-1 Privacy Act Notification (APR 1984), 52.224-2 Privacy Act (APR 1984), FAR 52.224-3 Privacy Training (JAN 2017), and HSAR Clauses, the following instructions must be included in their entirety in all contracts.

Limiting Access to Privacy Act and Other Sensitive Information

In accordance with FAR 52.224-1 Privacy Act Notification (APR 1984), and FAR 52.224-2 Privacy Act

(APR 1984), if this contract requires contractor personnel to have access to information protected by the

Privacy Act of 1974, the contractor is advised that the relevant DHS system of records notices (SORNs) applicable to this Privacy Act information may be found at www.dhs.gov/privacy. Applicable SORNS of other agencies may be accessed through the agencies’ websites or by searching FDsys, the Federal Digital

System, available at http://www.gpo.gov/fdsys/. SORNs may be updated at any time.

Prohibition on Performing Work Outside a Government Facility/Network/Equipment

The Contractor shall perform all tasks on authorized Government networks, using Government-furnished

IT and other equipment and/or Workplace as a Service (WaaS) if WaaS is authorized by the statement of work. Government information shall remain within the confines of authorized Government networks at all times. Except where telework is specifically authorized within this contract, the Contractor shall perform all tasks described in this document at authorized Government facilities; the Contractor is prohibited from performing these tasks at or removing Government-furnished information to any other facility; and

Government information shall remain within the confines of authorized Government facilities at all times.

Contractors may only access classified materials on government furnished equipment in authorized government owned facilities regardless of telework authorizations.

Prior Approval Required to Hire Subcontractors

The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (Subcontractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any

Subcontractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Separation Checklist for Contractor Employees http://www.dhs.gov/privacy http://www.gpo.gov/fdsys/

Contractor shall complete a separation checklist before any employee or Subcontractor employee terminates working on the contract. The separation checklist must verify: (1) return of any Government-furnished equipment; (2) return or proper disposal of sensitive personally identifiable information (PII), in paper or electronic form, in the custody of the employee or Subcontractor employee including the sanitization of data on any computer systems or media as appropriate; and (3) termination of any technological access to the Contractor’s facilities or systems that would permit the terminated employee’s access to sensitive PII.

In the event of adverse job actions resulting in the dismissal of an employee or Subcontractor employee, the Contractor shall notify the Contracting Officer’s Representative (COR) within 24 hours. For normal separations, the Contractor shall submit the checklist on the last day of employment or work on the contract.

As requested, contractors shall assist the ICE Point of Contact (ICE/POC), Contracting Officer, or COR with completing ICE Form 50-005/Contractor Employee Separation Clearance Checklist by returning all

Government-furnished property including but not limited to computer equipment, media, credentials and passports, smart cards, mobile devices, PIV cards, calling cards, and keys and terminating access to all user accounts and systems.

Contractor’s Commercial License Agreement and Government Electronic Information Rights

Except as stated in the Performance Work Statement and, where applicable, the Contractor’s Commercial

License Agreement, the Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation and associated metadata created as part of this contract. All deliverables (including all data and records) under the contract are the property of the U.S. Government and are considered federal records, for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

Privacy Lead Requirements

If the contract involves an IT system build or substantial development or changes to an IT system that may require privacy documentation, the Contractor shall assign or procure a Privacy Lead, to be listed under the

SOW or PWS’s required Contractor Personnel section. The Privacy Lead shall be responsible for providing adequate support to DHS to ensure DHS can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance. The Privacy Lead shall work with personnel from the program office, the ICE Privacy Unit, the Office of the Chief Information Officer, and the

Records and Data Management Unit to ensure that the privacy documentation is kept on schedule, that the answers to questions in the PIA are thorough and complete, and that questions asked by the ICE Privacy

Unit and other offices are answered in a timely fashion.

The Privacy Lead:

• Must have excellent writing skills, the ability to explain technology clearly for a non-technical audience, and the ability to synthesize information from a variety of sources.

• Must have excellent verbal communication and organizational skills.

• Must have experience writing PIAs. Ideally the candidate would have experience writing PIAs for DHS.

• Must be knowledgeable about the Privacy Act of 1974 and the E-Government Act of

2002.

• Must be able to work well with others.

If a Privacy Lead is already in place with the program office and the contract involves IT system builds or substantial changes that may require privacy documentation, the requirement for a separate Private Lead specifically assigned under this contract may be waived provided the Contractor agrees to have the existing

Privacy Lead coordinate with and support the ICE Privacy POC to ensure privacy concerns are proactively reviewed and so ICE can complete any required PTA, PIA, SORN, or other…