Statement_of_Work_318_Recorder_Replacement.pdf

STATEMENT OF WORK/REQUIREMENTS DOCUMENT

Title: National Institute of Standards and Technology (NIST) Building 318 Phone and Radio Communications Recorder Replacement

Requesting Office: Emergency Services Office/ Security Systems and Access Controls Group

I. BACKGROUND INFORMATION

The Emergency Services Office (herein referred to as ESO) is responsible for the oversight and maintenance activities associated with National Institute of Standards and Technology (NIST) Gaithersburg Campus access control, video management, badge office, USAccess activities, Police and Fire Department records and management systems.

A walkthrough will be scheduled soon to review the equipment, connections, and to cover any unknowns. Questions about anything related to this document shall be submitted to the Contracting Officer (CO). ESO will not answer direct questions pertaining to this procurement.

Purpose/Objective: The objective of this procurement is to acquire a replacement for the failing recorder currently located in Building 318. The recorder is responsible for voice recording phone extensions (x2222 and X2805) as well as police radio communications. More detail on the current configuration and other devices will be provided below.

II. SCOPE

The Contractor shall provide a turnkey solution to include recorders, devices, wiring, and any other connections to meet or exceed the requirements detailed below. The contractor’s proposal must be inclusive of FOB Destination delivery, installation, warranty, training, and option line items noted below.

III. MINIMUM REQUIREMENTS

The Contractor shall provide a system that meets all technical specifications identified below. All items must be new. Used or remanufactured equipment will not be considered for award.

Experimental, prototype, or custom items will not be considered. The use of “gray market” components are not authorized for sale in the U.S. by the Contractor is not acceptable. All line items shall be shipped to the contractor’s place of business prior to delivery to NIST or the equipment can be shipped directly to NIST, with the understanding that a shipment notification (email or phone call) must be made prior to delivery with an ETA so we can alert our shipping and receiving department. Equipment must be in the original manufacturer’s packaging and include all original documentation and software, when applicable.

The shall provide an Eventide NexLog DX series recorder or equivalent along with any other peripherals and shall be capable of recording no less than 8 digital phone line extensions supplied from a Hicom 300 or Hipath 4000 PBX. The recorders or other devices shall be capable of accepting PBX (Private Branch Exchange), TDM (Time Division Multiplexing), or VOIP (Voice Over IP) connections so that future PBX technology changes do not prompt the replacement of the recorder. The recorder must be capable of also recording 3 police two-way radio output channels + 1 announce channel. Please retain the use of the announce channel, the contractor shall connect and test the announce channel to ceiling mounted speaker and install an on/ off switch or a volume control. The existing radios in use are Uniden Bearcat BCD996P2 Trunk Tracker V models. All audio recordings must be as clear as possible. The use of pre-amplifiers or noise filters may be necessary to ensure there is no popping, static, or wavering audio volume, etc.

A solution is required that will record up to 8 (TDM or VOIP) PBX phone extensions in Building 101 and Building 318 regardless of which phone location answers the extension. These extensions are duplicated using the PBX. The current PBX resides in Building 101. A google maps screen shot is shown below to convey the geographical distance between these two buildings.

The new recorder(s) shall be capable of meeting or exceeding requirements listed in sections A through C below.

Recorder(s) Specifications

A. Technical Specifications

a. Hardware

i. 3U-4U Chassis is acceptable

ii. Core i5 CPU or better

iii. 16GB DDR4 RAM or better

iv. Operating System shall be Embedded Linux (Redhat, Debian, Ubuntu, Mint, etc.)

v. System drives must operate in a minimum of a RAID 10 configuration utilizing no less than 3 drives such that it acts as a redundant failover if the primary drive should fail.

1. In the event of an operating system HDD failure the unit shall produce an audio/ visual alarm, other notification methods such as email are great but not required.

vi. The unit must provide both internal speaker and be capable of external audio amplified speaker output.

vii. Must provide dual hot-swap power supplies (120-240VAC) capable of handling the unit’s workload.

1. Power supplies or unit shall produce an audio/ visual alarm in the event of a system failure, other notification methods such as email are great but not required.

viii. The unit must be capable of mounting on a standard 2 post network rack.

ix. Unit shall be capable of recording no less than 8 digital and 8 analog audio channels.

x. Unit shall contain enough storage space to record and retain lossless audio files for no less than 35 days.

xi. The storage drives should also be hot-swappable in a RAID 10 configuration utilizing no less than 3 drives and provide an audio/ visual alert when a drive failure is detected.

xii. Mainboard must have TPM 2.0 or better to support encryption requirements.

B. Software/ Licensing Requirements

a. Software shall not be subscription based or require internet connectivity.

i. Annual or One time licensing fees are acceptable.

b. Software shall offer an HTML5 or better browser-based interface.

c. Web browser access must be compatible with standard computers and web browser applications.

i. Examples (Microsoft Windows, Linux, Apple operating systems. Android and iOS tablets and phones). Standard browser applications such as Google Chrome, Microsoft Edge, Mozilla Firefox, etc. mandatory use of non-standard browsers will not be acceptable.

d. Depending on licensing structure expect no less than 10 system administrators, and as many as 50 standard users.

e. Database shall be SQL 2019 or newer.

i. SQL or system shall have no less than AES-256-bit encryption at rest for the recorded data as well as the operating system drives.

ii. SQL shall be configured to make a full backup nightly and keep no less than

35 days’ worth of backups.

f. If more recording storage is needed or the need to retain a recording beyond the 35-day normal offloading of recordings to a NAS or other storage device shall be possible.

g. The software shall be capable of:

i. Quality Assurance.

ii. Screen Capture.

iii. Reporting.

iv. Detailed audit trails.

v. Incident reconstruction.

vi. Secure access via Active Directory or Single Sign On.

vii. Replay and management of audio screen, multimedia, text and TDD recordings.

viii. Browse, Search, Replay, Instant Recall, Live Monitor, Reconstruct Incidents, Protect, and Export when allowed based on user’s role and permissions.

ix. API or other integrations with other law enforcement reporting software is a plus but is not required at this time.

C. NIST IT Requirements.

a. Network Communication

i. The Contractor (and/or any subcontractor) shall provide a mechanism to use

b. User Authentication

a. The Contractor (and/or any subcontractor) shall provide a mechanism to use multi-factor authentication or integrate with the Government supported enterprise identification and authentication solution (e.g., PIV credentials/SAML SSO) as required to comply with Executive Order 14028.

c. Data Encryption

b. The Contractor (and/or subcontractor) shall encrypt all Government data and information in motion and at rest with FIPS 140-2 validated encryption solution as required to comply with Executive Order 14028.

d. NIST 800-171

c. Must be a NIST 800-171 complaint manufacturer

e. NIST 800-53

d. Shall be able to meet the majority of NIST 800-53 controls.

f. Transport Layer Security (TLS)

e. The proposed solution must be configured with HTTPS using the recent version of TLS protocol (e.g., TLS v1.2 or higher).

g. Event Logging

f. The Contractor (and/or any subcontractor) shall ensure the appropriate level of auditing and logging is enabled within the information system, as required to comply with OMB Memorandum M-21-31 or successor.

h. Internet Protocol Version 6 (IPv6)

g. The Contractor (and/or any subcontractor) shall ensure the proposed solution is IPv6 compliant as mandated in the OMB Memorandum M-21-07.

i. Section 508 Compliance

h. The Contractor shall provide accessibility based on Section 508 of the Rehabilitation Act of 1973. All information and communication technology delivered must meet the applicable revised accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists.

j. Nondisclosure of Information

i. Any information made available to the Contractor (and/or any subcontractor) by the Government or collected by the contractor on behalf of the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract.

D. Warranty/ Technical Support

a. The contractor shall include one year of coverage for a Software update Service or similar to cover important software versions and updates, which can incorporate Linux security updates, application-level security updates, and improvements to existing functionality.

b. The contractor shall include one year of telephone support should usage questions or issues arise.

E. Option years for software support coverage.

a. The contractor shall provide optional coverage for up to 5 years additional software support coverage.

b. Each option should be a separate line item.

F. Testing/ Prior to Authority to Operate (herein referred to as ATO)

a. Prior to connecting any phone lines, radios, or network connectivity the contractor shall have the unit installed, setup, and functional for network scanning at the beginning of the ATO process. The ATO process is NIST’s way to ensure systems meet certain criteria prior to releasing them for general use. The ATO process consists of confirmation and testing along with vulnerability scanning to confirm the new system and security settings are as robust as they can be prior to putting it on the NIST or ESO networks. If any edge devices are to be used that require network or other connectivity those requirements need to be brought to the attention of ESO prior to system installation.

a. Any findings located using the scanner will be categorized and defined as Low, Medium, High, and Critical risks. At a minimum the vendor must assist in resolving any findings that are critical and high. Any critical or high findings that cannot be resolved need to be communicated to the system manufacturer for resolution.

b. Once ATO is granted the system can then be connected to the network that will be supporting connectivity to these devices.

b. The contractor shall anticipate no less than 2 visits to address ATO findings, additional questions, concerns, troubleshooting, ATO approval, and final testing.

c. The vendor shall provide a testing document showing the system and its external audio devices and connections. This document should also name some recordings that have been made and locked so they are not overwritten for NIST to verify recording, originating phone, and clarity. Once our final confirmations are done the testing document and any other system documentation or excess parts, screws, etc.

shall be released to the COR or TPOC.

a. This testing document can be in Excel, Word, or Adobe PDF format.

b. The vendor shall illustrate what connections from the recorder or edge device connect to what other line or device and what the other connection and device is.

G. Training

a. Training on the system shall consist of one 4-hour block in person by the project lead or experienced technician (although all that time may not be needed).

b. Should expect 5-10 people.

c. Topics to cover

i. Accessing the system local vs web

ii. Logging in/ out

iii. User groups/ Role Assignments

1. How to create and manage them.

iv. Using the application.

v. Recording (If applicable)

1. Search

2. Identification

3. Replay

4. Instant Recall

5. Live monitoring

6. Incident Reconstruction

7. Locking/ unlocking to ensure it’s not overwritten

8. Exporting

a. Supported file types

b. Best practices if exporting for MCPD or evidence use.

vi. Reporting

1. Types of reports

2. Exporting reports

3. Configure/ Creating Reports

vii. Screen Recording (If applicable)

d. Training documentation shall be provided to the COR/ TPOC via usb, email, or

Hyperlink as applicable. If a system login for a manufacturer’s website is needed that would be something to note as well.

IV. DELIVERABLES

V.

Standards of Acceptance: The NIST TPOC or COR shall review (list deliverable) and respond with an acceptance or request for revision email to the Contractor Point of Contact (POC) within 7 days of receipt of deliverable. This section applies to deliverables which must be reviewed and approved for acceptances (draft plans, drawings, etc.)

VI. PLACE OF PERFORMANCE

NIST Gaithersburg

VII. PERIOD OF PERFORMANCE/LEAD TIME

Period of Performance 4/1/2023 – 08/31/2023

VIII. DELIVERY TERMS

Tasking Item to be Delivered Due Date for Deliverable Deliverable Notes Project Kickoff Meeting 14 days after award

Scheduling Project Installation Schedule 30 days after award

Provide project installation team info via email:

Project Role:

First Name, MI, Last Name US Citizen?

Email Address

Equipment Ordering 45 days after award Confirmation of order placement via email to COR.

Installation Begins 60 Days after award Notification of any delays must be sent to the COR via email

Weekly Communication Intervals Email Weekly after installation begins ETA on any manufacturer delays Installation progress Any other delays or issues

System Acceptance and Testing Documents

Detailed in section E Prior to POP end date

Delivery shall be F.O.B Destination and shall occur in accordance with the delivery due dates provided in the above table.

FOB Destination means: The contractor shall pack and mark the shipment in conformance with carrier requirements, deliver the shipment in good order and condition to the point of delivery specified in the purchase order, be responsible for any loss of and/or damage to the goods occurring before receipt and acceptance of the shipment by the consignee at the delivery point specified in the purchase order; and pay all charges to the specified point of delivery. The contractor shall deliver all Line Items to:

National Institute of Standards and Technology Shipping and Receiving 100 Bureau Drive, Building 301 Gaithersburg, MD 20899 C/O: Kevin Conrad MS137.02 Building 101 A16

***Due to ongoing limited site access of the NIST facilities, the Awardee SHALL confirm with the Designated Government Official and the Contracting Officer prior to ANY shipment to NIST***

IX. PAYMENT SCHEDULE

Advance payment is not authorized. The Contractor must invoice in arrears according to the payment schedule. The Contractor shall be paid, in accordance with Net 30-day payment terms, upon receipt and acceptance of a proper invoice, in accordance with the following schedule:

1. 100% after installation and acceptance by the COR/TPOC of fully installed system, AND

2. After the successful completion of the testing requirements set forth in this document under section set forth in this document, AND

3. After successful demonstration by the instrumentation that it performs IAW the technical requirements set forth in this document AND

4. After receiving an invoice submitted properly, IAW the purchase order terms and conditions.

NOTE: Partial shipments and partial invoices will not be accepted, unless otherwise requested and accepted by the Contracting Officer prior to award offer. Proposed payment schedules shall be submitted with vendor’s response to the RFQ for consideration.

X. MISCELLANEOUS INFORMATION

Safety: The Contractor employee must be responsible for knowing and complying with all installation safety prevention regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal.

Security: NIST is a restricted campus. An identification badge is required for access for entry into buildings and is shown to the armed Security Police when entering the campus.

Regular Business Hours. Regular business hours are Monday through Friday, (7:00 am to 4:00 pm) Eastern Time, excluding Federal holidays and weather-related closures.

Identification Badges: Contractor employees must comply with NIST identification and access requirements. Each Contractor employee must wear a visible identification badge provided by the NIST Security Office.

End

***Due to ongoing limited site access of the NIST facilities, the Awardee SHALL confirm with the Designated Government Official and the Contracting Officer prior to ANY shipment to NIST***