Statement_of_Work_MDDEDC.docx

Department of the Interior United States Geological Survey MD-DE-DC Water Science Center 1289 McD Drive Dover, DE 19908

Personnel Access Control System/Alarm System

Work Statement

Table of Contents

BACKGROUND

The Department of the Interior (DOI) U.S. Geological Survey (USGS) requires a new Physical Access Control System (PACS) in order to develop compliance with the standards set forth by the Homeland Security Presidential Directive 12 (HSPD-12) in accordance with the Federal Information Processing Standards-201 (FIPS-201) and the National Institute of Standards & Technology (NIST) guidelines. USGS facilities that are controlled by a PACS will be changed over to key card readers that will utilize the federally standardized Personal Identification Verification (PIV) Credentials to gain access into secure areas.

The FY 2019 National Defense Authorization Act, Section 889(a)(1)(B) prohibits federal departments and agencies, (including bureaus of Interior ) from contracting with any entity that uses covered telecommunications equipment or services from five Chinese companies: Huawei, ZTE Corporation, Hytera Communications, Hangzhou Hikvision, and Dahua Technology company. By law, this prohibition takes effect on August 13, 2020.

GENERAL REQUIREMENTS

Independently and not as an agent of the Government, the contractor shall be required to furnish all the necessary services, qualified personnel, material, supplies, subcontractors, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work in accordance by law and the terms and conditions herein and the specifications set forth below.

The contractor shall ensure that its agents, employees, and subcontractors involved in the installation of a physical access control systems (PACS) be trained for the level of expertise required for the proper performance of the task. The contractor agrees that the contractor’s personnel and equipment are subject to safety and security inspections by Government personnel while on Federal property.

The Government is not responsible, in any way, for damage to contractor’s supplies, materials, or equipment, or to contractor’s employees’ personal belongings due to fire, theft, accident or other disaster, except pursuant to the Federal Tort Claims Act.

DESCRIPTION OF PACS SYSTEM

The USGS requires the installation of a PACS in accordance with the most recent requirements of Homeland Security Presidential Directive 12 (HSPD-12) and Federal Information Processing Standards 201 and 201-2 (FIPS 201, 201-2). The system shall provide for detecting, delaying, and deterring unauthorized individuals from entering the internal offices and suites while providing access to authorized personnel. The scope of the project will include the following:

1. The PACS shall consist of access control panels; (ACPs), FIPS 201 readers, and related sensor and door control devices. The ACPs may be either a traditional multi-door control panel, or a single-door “edge” device.

2. Provide specification sheets, technical drawings, manufacturers’ data, and other submittals as defined within this specification and perform employee training on the system to designated Science Center personnel.

SYSTEM COMPONENTS AND SPECIFICATIONS

Contractor shall provide all equipment and labor as necessary for a full and complete system (turn-key). Card readers, keypads, and locking mechanisms will be added on all exterior doors and the server room door. The alarm system will be tied into the PACS. Motion sensors throughout the building will be added. The PACS must integrate and interact with the PACS system in the Baltimore office. Site visit by contractor will be required.

General PACS Operational Requirements:

Control, monitor, and record all entry attempts using DOI Access cards and other approved card types at card reader terminals. The system shall be capable of and provide two-factor authentication via keypad entry in one location and standard readers at all other locations. The system shall be capable of locking/unlocking doors during specific times.

When a person wishes to enter the building or a secure area, the cardholder places his/her card within close proximity or inserts or places it to the reader terminal at the door. Authentication is based on the credential value read from the card. PACS shall automatically control door access by comparing credential value(s) stored within the access card with similar information previously programmed into the PACS itself. PACS shall be compliant with authentication and authorization procedures required under HSPD 12 and FIPS 201 and 201-2, including, but not limited to, facility code, agency code, and credential value, as contained in the FASC-N (Federal Agency Smart Credential Number) which is part of the CHUID (Cardholder Unique Identification file). The system shall maintain a database of authorized access card I.D. numbers with their authorized points and times of entry, access level, etc. based on the programming.

If the information on the card is authenticated against the data stored in the PACS, a signal is sent by the PACS to the card reader terminal location to operate the release device, allowing the person to open the door and enter. If the information on the card is not authenticated within the PACS, the PACS does not release the activating device but sounds a brief audible or visual alarm at the reader and logs the access card number, access point, time of day and why access was denied. Each designated door shall be monitored and logged for real time status (open/close). A programmable alarm shunt timer (2 seconds to 14 hours) allows door to be opened for authorized card access entry, allowing adequate time to enter without alarming the system. An alarm shall occur if the door remains open beyond the alarm period. The system shall not alarm when an exit device (pushbutton or request to exit sensor) is used to leave. A programmable alarm shunt timer (2 to 120 seconds) will permit a door to remain opened, allowing adequate time to exit. An alarm shall occur if the door remains open beyond the alarm period.

Access to the system database shall be restricted through at least two security access levels. The system shall require two-factor authentication using the PIV card for system login and administration and for authorization to change programming parameters. The PACS shall maintain a calendar clock for controlling and indicating all time related functions, such as schedule door lock open and close command. The USGS System Administrator, using appropriate keyboard commands, may program the ACP to automatically suppress alarms and unlock doors to enable door access for extended time intervals. This event information must be recorded.

The USGS System Administrator, using appropriate keyboard commands may display on the monitor, interact, interface, and print summary reports, including alarms, access activity at specified card reader, denied access attempts, doors in override mode (card access), door with alarms suppressed (monitored), all transactions stored in disks (printout to be sorted by date, time, transaction type, card, I.D. number, card reader or alarm monitor transactions), and all user programmable data.

PACS System Architecture Requirements:

The PACS system will be a Lenel OnGuard system to interact with the system in Baltimore.

Networking and Data Security Requirements:

The PACS Controller and ACPs shall be connected to a common LAN or WAN inside the USGS firewall and use TCP/IP communications (Computer will be provided and installed by USGS). The system shall support the following networking and encryption standards and shall operate on the existing building network infrastructure:

· Web: HTTP, HTTPS, XML

· IPv6 Compliant

· Email: SMTP

· Messaging: SMS

· Encryption: NIST FIPS 140-2 validated encryption

Communications between the PACS controller and the ACP shall be encrypted using SSL or equivalent NIST FIPS 140-2 validated encryption. Communication between the network controller and network remote ACP or edge devices shall be authenticated using the SSL or equivalent NIST FIPS 140-2 validated encryption. Administrative access to the security management application and the personnel security data shall be password protected.

Access Control Functional Requirements:

The PACS (Controller and ACP) shall support the following features:

· Multiple group privileges per person

· Detailed time specifications

· Activation/expiration date/time by person with one (1) minute resolution.

· Access level disable for immediate lockdown

· Multiple holiday schedules

· Timed unlock schedules

· Scheduled actions for arming inputs, activating outputs, locking and unlocking portals

· Card enrollment reader support

· Timed anti-pass back

· Muster / Roll Call Reporting

· Dual reader portal support

· Wiegand keypad PIN support

· An administrative interface that integrates system activity logs, floor plans, ID photos, and alarm notifications.

· Event and alarm notifications delivered via email, SMS, and browser interfaces.

· Graphic floor plans with active icons of security system resources.

· System user permissions to grant whole or partial access to system resources, commands, and personal data.

· Ability to arm/disarm groups of inputs based on other system inputs or alarm events.

· Tiered administrative access to system functions and data such that some administrators’ access may be restricted.

Reporting Requirements:

The hardware, firmware, software system shall produce predefined reports regarding software and security hardware configuration, event history, and the administration of people within the system. It shall be possible for the Center System Administrator to create ad hoc reports through a graphical user interface. When creating custom reports, the end user shall be able to select the database fields, including user defined fields; for inclusion in reports. The custom report writer shall allow entry of relative time and dates; such as “last week, previous day, last 30 days” for filtering time and date to prevent the need for re-enter time and date entries each time a report is run. It shall be possible to produce reports based on event data, personnel data, and system configuration data. The custom report writer shall allow for selection of devices to be reported on; which specific events will be included in the report, and have filters for selection of personnel. It shall be possible to save custom reports for later reuse. Report results shall be printable, output to a PDF file, or exported to Excel.

Alarm System Requirements

The alarm system must be wired into the PACS keypads. There should be one keypad for each entry door. The system alarm shall be monitored, and alarm activation and deactivation must be programmable and changeable as situations change.

GENERAL INSTALLATION

All materials and workmanship provided by the Contractor shall be in accordance with best practices of the personnel and physical security systems installation trade and shall meet Underwriters Laboratories (UL) Standards for Safety, National Electric Code (NEC), and applicable Federal, state, and local codes. The installations for all equipment and systems shall be suitable in every respect for a satisfactory commercial business operation. Contractor is responsible for all applicable permits and licenses and personnel shall be licensed electricians. Coordination for installation of cameras must be made with the building owner prior to installation. The contractor will be responsible for loading and configuring an enrollment station to include all software and shall provide all appropriate hardware (not to include the actual computer) such as fingerprint reader, PIV card scanner, and actual card reader at the enrollment station.

GENERAL WORK REQUIREMENTS

The contractor shall have the opportunity to visit the site to make necessary inspections, measurements, and become familiar with the requirements prior to submitting a bid proposal.

The contractor will provide all labor, tools, materials, insurance, and supervision required to complete the project. The contractor will comply with all Federal, state, local and tribal laws and regulations as applicable to this project.

COORDINATION OF WORK

All work will be coordinated with the USGS POC as to time and conditions.

PAINTING, PATCHING, AND REPLACEMENT

Repair must be made to any damaged finishes as a result of this work so that they will match existing adjacent surfaces and paint any damaged components to match adjacent surfaces, except those with factory-finished surfaces. Touch up factory-finished surfaces that are scratched or marred so that they will match the original condition. Remove trash, wire, and debris caused at the work site and vacuum where ceiling tiles or panels have been removed.

MANUFACTURER'S LITERATURE

The contractor shall provide two (2) specification sheets and manufacturer’s literature showing model numbers, relevant data, and basic and optional features of the equipment, network wiring diagrams of all devices including the location and identification of distribution cabinets and internal equipment, wire and cable runs, tamper circuit configuration, etc. These submissions must be provided to the USGS Technical Liaison Realty Officer at the final inspection.

USER INSTRUCTION

The contractor shall conduct training on the system after completion of the installation and before the final inspection. At the time of the final inspection, personnel trained (up to 5 individuals) must demonstrate the capability to operate the system and perform basic system functions.

TESTING AND CUTOVER

The contractor is responsible for quality control. The contractor shall test the system to the manufacturer’s quality standards.

All documentation and required submissions must be complete and provided to the USGS POC during the final acceptance test. Final inspection will include a full test of functions, and an inspection of the general workmanship. Successful completion of the acceptance testing marks the beginning of the warranty period. All materials and workmanship for the installation shall be warranted for a minimum of one year from the date of successful completion of final acceptance.

The cut-over and testing will be scheduled during a normal workday, Monday – Friday between the hours of 8:00 am and 3:00 pm, excluding Federal holidays. The cut-over should be planned to maintain building security at all times.

STARTUP SERVICE

The contractor shall enroll all USGS building occupants, “start-up” and “de-bug” to assure the system operates successfully. The contractor shall provide the necessary technical personnel onsite to assure the successful activation of all integrated systems. This includes a factory-authorized service representative to train USGS personnel to adjust, operate, and maintain the PACS.

WARRANTY WORK AND SERVICE

The contractor shall guarantee that all installed parts, components, systems, and workmanship meet the specifications set forth in the SOW. Additionally, the contractor shall warranty all contractor supplied components, workmanship, and/or systems for a (minimum) period of 12 months from the date of Government acceptance. Should any contractor supplied part, component, workmanship, or system fail within the warranty period, the contractor shall immediately replace or repair that part, component, or system within 48 hours at no further cost to the Government. If the contractor is unable to start and/or finish the repair or replacement, the contractor shall be liable for all costs incurred by the Government to correct the issue(s). The contractor shall not be responsible for the repair or replacement of any part, component, or system that fails due to fire, flood, riots, and vandalism or because of the misuse of equipment by Government employees.

After the 12 month warranty period, the contractor and the Government will enter into a 3-year service agreement with option to renew yearly.

The alarm system will be monitored for 3 years with the option to renew yearly.

QUALITY ASSURANCE SURVEILLANCE PLAN

The contractor shall be responsible for quality control.

The Government will be responsible for quality assurance.

The USGS Technical Liaison (TL) will review 100% of the deliverable documentation. The USGS TL will test 100 % of the readers.

The system shall pass 100% of the testing and reviews before acceptance. The contractor shall redo any substandard performance to 100% of the above standards at no additional cost to the government within 2 calendar days of the TL’s notice to the contractor of substandard goods, substandard installation services, or substandard training services.

image1.png