STATEMENT OF WORK.docx

STATEMENT OF WORK PART A – GENERAL INFORMATION

A.1 INTRODUCTION – The Hershel “Woody” Williams VAMC located at 1540 Spring Valley Drive, Huntington WV, 25704 needs to upgrade all existing licenses to the Closed-Circuit Television (CCTV) on the main campus to a version for Police Service security operations.

STATEMENT OF WORK PART B – WORK REQUIREMENTS

B.1 Tasks to be accomplished:

This task covers a phased upgrade of the Avigilon software platform from the current production version to Version 7, with provisions for a future upgrade to Version 8 pending required approvals. The software license included five (5) year so upgrade entitlement, paid upfront, with allows the Government to upgrade the software multiple times during the period at no additional licensing costs, resulting in a cost savings. The approach ensures continued compliance with Veterans Health Administration (VHA) Technical Reference Model (TRM) and Enterprise Reference Architecture (ERA) requirements while minimizing operational and security risk.

Phase I – Upgrade to Avigilon Version 7 (Current Approved State)

The Contractor shall upgrade the Avigilon software to Version 7, which is the current VHA-approved version in the TRM and ERA at the time of implementation. Version 7 represents the stopping point for this phase, as it aligns with all current authorization, compliance, and security requirements. The Information System Security Officer (ISSO) has reviewed and agrees to the upgrade to Avigilon Version 7, and this concurrence is documented as part of the system’s authorization package. All upgrade activities will be performed in accordance with applicable VHA security controls, configuration management, and change management procedures.

Phase II – Conditional Upgrade Path to Avigilon Version 8

This Statement of Work establishes the capability and technical readiness to upgrade Avigilon from Version 7 to Version 8, contingent upon Version 8 being formally approved in the VHA TRM and ERA and receipt of all required Government security and architectural approvals. No implementation of Version 8 shall occur prior to approval. Upon approval, the COR and Computer Engineer shall obtain a new VA Form 6500.6 Risk Assessment reflecting the Version 8 upgrade prior to implementation. The upgrade to Version 8 will not proceed until the updated 6500.6 is approved and the system is authorized to operate with the new version.

This phased approach ensures alignment with VHA cybersecurity governance, compliance with TRM, ERA, and VA 6500 requirements, and a clear separation between approved implementation (Version 7) and future approval-dependent enhancements (Version 8). The Government retains full authority to approve, delay, or deny progression to Phase II based on compliance and risk considerations.

Licensing can be delivered within 2 weeks of order approval

Licenses Only, Customer is providing servers. Onsite Technical services are not included.

This includes upgrading all existing licenses for main CCTV campus to current version (ACC 7) with failovers and conditional upgrade to ACC8.

STATEMENT OF WORK PART C – SUPPORTING INFORMATION

C.1 Place of Performance – Hershel “Woody” Williams VAMC located at 1540 Spring Valley Drive, Huntington, WV 25704. Delivery vehicles shall keep traffic disruptions to a minimum. Use of any other entry points must be approved by Chief, Engineering Service prior to use. Vendor shall deliver required parts or equipment specified above during approved work times.

C.2 Period of Performance – Vendor will provide the start of services within 14 days of contract award and the upgrade entitlement period will be good for 5 years after. Approved work times for this job shall be normal working hours of 8AM – 430PM . The Contractor shall perform all services during normal business hours.

C.3.2 Government Furnished Materials and Services. Government furnished property, if any, will be identified and will only be used for the performance of this contract unless otherwise authorized by the Contracting Officer. The Contractor shall, at all times, take any and all steps necessary for maintenance and preservation of all Government-furnished property. The Contractor shall comply with all reasonable requests of the Contracting Officer to enclose, or specifically protect, Government-furnished property.

C.3.3 Qualifications of Key Personnel – Contractor’s employees should be knowledgeable of standards associated with this type of work.

C.3.4 Supervision/Communications. At all times during the performance, the Contractor’s Superintendent (if applicable) shall be available by cellular phone. Prior to beginning any work, the Contractor shall supply the COR with the telephone number for the Superintendent. The Contractor’s “Competent Person” that meets OSHA training guidelines, is capable of making decisions and acting on behalf of the Contractor shall be physically located on site at all times during performance of the contract. If the Contractor’s Competent Person is absent from the job site for an extended period of time, the COR may send all Contractor/sub-contractor employees off the job.

C.3.5 Parking/Traffic Regulations. The Contractor shall not park on grassy areas unless approved by the COR and the Contractor agrees to restore areas back to VA standards. Drivers should be particularly concerned with pedestrian traffic. Yield to pedestrians in crosswalks. Posted speed limits and all other traffic controls are to be observed by operators at all times. Seat belt use is mandatory on the VA grounds.

C.3.6 Security. The C&A requirements do not apply, and a Security Accreditation Package is not required. This acquisition does not involve storage, generating, transmitting, or exchanging of VA sensitive information. It does not require C&A a MOU-ISA for system interconnection.

Incident Reporting - Contractor shall immediately report any known or suspected security/privacy incidents to the Contracting Officer's Representative (COR), Information Security Officer (ISO), and Privacy Officer. The report must include the nature of the incident, affected systems or data, personnel involved, and any known or suspected misuse. If the incident involves Protected Health Information (PHI), the contractor must follow breach notification procedures as outlined in the Business Associate Agreement (BAA).

Contractor Rules of Behavior - All contractor personnel must sign and adhere to the VA Contractor Rules of Behavior. This includes acknowledging responsibilities for protecting VA sensitive information and complying with all applicable VA security policies.

Training Requirements - Contractor personnel must complete VA Cyber Security Awareness and Privacy Training prior to gaining access to VA systems or data. Annual re-certification is required, and training certificates must be submitted to the COR within one week of contract start and annually thereafter.

Data Encryption - All VA sensitive data must be encrypted using FIPS 140-2 validated encryption methods. This applies to data in transit and at rest.

Media Sanitization - Contractor shall sanitize or destroy electronic media in accordance with VA Handbook 6500.1. Upon contract completion, a self-certification of sanitization must be submitted to the Contracting Officer.

Contractor shall identify which employees will be working under the awarded contract. Contractor personnel shall include employees, sub-contractors, subcontractor employees, suppliers and delivery personnel entering the Medical Center. Those employees shall bring photo ID to obtain a VA Contractor identification badge that shall be worn above the belt at all times while on Medical Center property. Contractor’s employees shall return all I.D. badges to designated personnel at time designated. This does not apply to suppliers and delivery personnel making deliveries to the VA warehouse dock only.

C.3.7 Smoking Policy. The Contractor shall not allow smoking in any building. The VA is a smoke-free facility. This includes the use of electronic cigarettes and vaping devices.