STIOS PWS Draft 8 20 26 - Unclass.pdf

DRAFT

SBU - CONTRACTING AND ACQUISITIONS

TABLE OF CONTENTS

C-001 PURPOSE AND SCOPE

C-002 BACKGROUND

C-002.1 Bureau of Diplomatic Security and Countermeasures Directorate

C-002.2 Organizational Structure

C-002.3 PSIM and HDSVS Background

C-002.4 SMSe Background

C-003 OBJECTIVES

C-004 COMMUNICATION

C-005 SCOPE

C-006 PROGRAM MANAGEMENT

C-006.1 General

C-006.2 Program Management Plan

C-006.3 Risk Management Plan

C-006.4 Customer Satisfaction Survey

C-006.5 Standard Operating Procedures (SOPs) and Quality Control Plan (QCP)

C-006.6 Monthly Status Meetings

C-006.7 Monthly Performance and Progress Reports

C-006.8 Quality Assurance Surveillance Plan (QASP) and Performance Requirements Summary

C-006.9 Information Technology and Information Assurance

C-006.10 Hardware Management

C-006.11 Associate Contractor Agreement (ACA)

C-006.12 Labor Tracking, Project Cost Allocation, and Itemized Invoicing

C-007 STOC/IOC OPERATIONS

C-007.1 Co-Located STOC/IOC Operating Model

C-007.2 Tiered Support Structure

C-008 PERFORMANCE REQUIREMENTS

C-008.1 PSIM Operations and Maintenance

C-008.2 HDSVS Operations and Maintenance

C-008.3 Video Analytics

C-008.4 Subsystem Integrations

C-009 FACILITY MODELING AND GEOSPATIAL SUPPORT (3-D)

C-010 SMSe NETWORK OPERATIONS (NSM-OWNED FUNCTIONS)

C-010.1 General

C-010.2 SMSe Systems and Infrastructure

C-011 CMMS OPERATIONS: MAXIMO / ASSET MANAGEMENT SYSTEMS

FUNCTIONALITY SUPPORT

C-011.1 General

C-011.2 CMMS Requirements

C-011.3 CMMS User Profiles

C-012 APPLICATION DEVELOPMENT AND SUPPORT (SharePoint Platform)

Management Analyst

C-013 DOMESTIC NETWORK SUPPORT — ALARMNET AND SECURITY

SYSTEM CONFIGURATION

C-013.1 AlarmNet Enterprise Architecture (AEA)

C-013.2 Security System Configuration (SSC)

C-013.3 Domestic Facility Coverage

C-014 RISK MITIGATION ENGINEERING (RME)

C-015.1 General

C-015.2 Training Levels

C-015.3 Additional Training Requirements

C-016 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

Table C-016-1: Severity Framework

C-017 DELIVERABLES

C-018 PHASE-IN AND PHASE-OUT

C-018.1 Phase-In (60 Calendar Days from Contract Award)

C-018.2 Phase-Out

C-019 POSITIONS AND LABOR CATEGORIES

C-019.1 Estimated Full-Time Equivalents (FTE)

C-019.2 Key Personnel

C-020 GENERAL REQUIREMENTS

C-020.1 Period of Performance

C-020.2 Place of Performance

C-020.3 Hours of Work

C.020.4 Surge/On-Call Support Labor

C-020.5 Unauthorized Work

C-020.6 Access to Government Property or Facilities

C-020.7 Post Hardship Differential Pay and Danger Pay

C-020.8 Use of Personal Electronic Devices

C-020.9 Government Furnished Information (GFI) and Property/Equipment

(GFE)

C-020.10 Government Furnished Vehicles

C-020.11 Insurance Requirements

C-020.12 Applicable Standards

C-020.13 Data Rights

C-020.14 Section 508 of the Rehabilitation Act

C-020.15 Travel

C-020.16 Training of Contractor Personnel

C-020.17 Security Requirements

C-020.18 Safeguarding of Information

C-020.19 Protection of Information

C-020.20 Contractor Identification

C-020.21 Other Direct Costs (ODCs)

C-020.22 Incident Reporting

PERFORMANCE WORK STATEMENT

Security Technology Integration and Operations Support (STIOS)

Department of State | Bureau of Diplomatic Security | Office of Security Technology Contract Number: [TBD]

C-001 PURPOSE AND SCOPE

The Department of State (DOS), Bureau of Diplomatic Security (DS), Office of Security Technology (ST) requires a contractor to operate, maintain, and enhance the DS Physical Security Information Management (PSIM) system and High- Definition Security Video System (HDSVS) enterprise, while also providing comprehensive information technology and security technology support services to DS and its programs, facilities, and customer organizations.

The contractor shall deliver:

• Steady-state operations and maintenance of the Department's Physical Security Information Management (PSIM) and High-Definition Security Video System (HDSVS) enterprise

• Continued HDSVS expansion through Technical Security Upgrade (TSU)-driven site conversions

• Video analytics deployment and performance management

• 3-D facility modeling services

• Security Management System enterprise (SMSe) network and systems operations, maintenance, and design, including untrusted edge network operations

• Computerized Maintenance Management System (CMMS) operations and support

• Application development and support (SharePoint platform)

• AlarmNet (DME) network and systems operations, and security application server administration

• Risk Mitigation Engineering (RME) cybersecurity support

• Training, program management, and customer support

• Co-located 24/7/365 STOC/IOC operations providing contractor-owned Tier 1 through Tier 3 support across all functional areas for all operations outlined above

This is a performance-based contract. This PWS specifies what outcomes the contractor must achieve; it does not prescribe how those outcomes are to be met.

The contractor is encouraged to propose innovative, cost-effective solutions.

Consolidation Principle. The establishment of a single contract vehicle is an acquisition efficiency and does not constitute an organizational realignment.

Government branch-level operational oversight is preserved as described in this PWS. The contractor owns resolution across all service towers and support tiers;

internal tower boundaries shall not delay mission-impacting work.

C-002 BACKGROUND

C-002.1 Bureau of Diplomatic Security and Countermeasures Directorate

The U.S. Department of State (DOS), Bureau of Diplomatic Security (DS), is the security and law enforcement arm of the DOS and is a leader in international investigations, threat analysis, cyber security, counterterrorism, security technology, and protection of people, property, and information. Its primary mission is to provide a safe and secure environment for the conduct of U.S. foreign policy.

The Countermeasures Directorate (DS/C) manages the development and implementation of all physical and technical countermeasures security standards and policies that apply to DOS facilities domestically and overseas; securely transports diplomatic materials across international borders; and provides defensive equipment to protect the lives of U.S. government personnel, classified information, and property.

The Countermeasures Directorate comprises the following offices:

• Office of Security Technology (ST). The mission of ST is to assist in providing a safe and secure environment for the conduct of diplomacy through the application and use of appropriate technical security countermeasures.

• Office of Physical Security Programs. Directs the development of Overseas Security Policy Board (OSPB) security standards and DOS policies and procedures associated with physical security, construction security, transit security, secure procurement, defensive equipment, and armored vehicle programs at U.S. missions. Provides oversight into the implementation of these programs abroad.

• Office of Diplomatic Courier Service. Provides secure and expeditious delivery of classified, sensitive, and other approved material between U.S.

diplomatic missions and the DOS.

C-002.2 Organizational Structure

Component Responsibilities Summary

Security Technology Director's Front Office

(ST)

Directs and manages operations through Program and Project Management (PPM) centralized portfolio management. Conducts budget planning and resource management through Security Technology Resource Management (STRM).

Reviews technical security standards through the Security Technology Resource Center (STRC).

Facility Security Engineering Division

(FSE)

Develops, supplies, installs, and maintains technical security systems.

Security Technology Operations Division

(STO)

Enhances security for all Department facilities worldwide to reduce risk.

Countermeasures Program Division

(CMP)

Department point of contact for domestic and overseas technical countermeasures operations;

Component Responsibilities Summary research and mitigation of technical security threats.

Security Systems Integration Division

(SSI)

Provides global security connectivity, integration, and monitoring. The System Integration and Monitoring (DS/SSI/SIM) Branch manages worldwide integration of Technical Security Systems (TSS) and delivers situational awareness through the PSIM and HDSVS programs. The Network Systems Management (DS/SSI/NSM) Branch develops and manages secure networking and application solutions for technical security systems worldwide; NSM manages the Security Management System enterprise (SMSe), the Identity Management (IDM) section, and ST's CMMS implementation.

PSP Director's Front Office

Directs Physical Security, Project Coordination, Defensive Equipment and Armored Vehicle, Facilities Security, and WMD Divisions.

Physical Security Division (PSD)

OBO oversight for new office building construction to ensure SECCA/OSPB compliance.

Project Coordination Division (PCD)

Global physical security risk management for U.S. diplomatic facilities.

Component Responsibilities Summary

Defensive Equipment and Armored Vehicle Division (DEAV)

Tests, evaluates, procures, and distributes special protective equipment; manages the Armored Vehicle Program.

Facilities Security Division (FSD)

Project management oversight for physical security upgrades to DOS domestic facilities.

Weapons of Mass Destruction Countermeasures Division (WMD)

Knowledge, equipment, and training for CBR attack response.

Diplomatic Courier Service

Secure movement of classified diplomatic material.

Domestic Management and Engineering

(DME)

Provides Government oversight and management of domestic security technology network operations, including the AlarmNet activity and associated domestic security application administration. DME provides Government oversight to contractor personnel supporting Domestic Network Support functions (see C- 013).

C-002.3 PSIM and HDSVS Background

The System Integration and Monitoring (DS/SSI/SIM) Branch manages worldwide integration of Technical Security Systems (TSS) and delivers security situational awareness through the PSIM and HDSVS programs. Senior mission personnel, Department officials, and national command authority use PSIM data to make decisions affecting the safety of personnel, property, and information.

The PSIM operates on a DS-owned secure wide area network (WAN) known as SMSe, comprised of distributed clients and servers. The HDSVS is deployed at approximately 150+ sites, with an approximately equal number of sites remaining for TSU conversion. PSIM is an SMSe (OCONUS-focused) capability; there is no PSIM integration within the domestic AlarmNet environment (see C-013).

C-002.4 SMSe Background

SMSe is a DS program providing WAN connectivity for TSS and control systems networked through the DOS's worldwide intranet (OpenNet). SMSe leverages existing technical security systems at overseas posts and allows security data, including video, to be monitored remotely at the DS Command Center (DSCC) and other remote locations.

SMSe is a global network supporting 250+ overseas posts and using virtualized, containerized, and physical servers operating Windows Server OS and Linux connecting thousands of IoT devices.

C-003 OBJECTIVES

DS is challenged by evolving domestic and international threat environments. The following objectives guide this acquisition:

• Implement quality assurance methodologies to maximize program efficiency and effectiveness in a climate of fiscal restraint.

• Define and manage service levels that minimize solution delivery time, cost, and defects and consistently deliver quality products meeting business requirements.

• Protect sensitive and classified information at DOS and DS-supported facilities.

• Improve the technical and physical security capability of DOS and other DS-supported facilities to reduce vulnerabilities and ensure a safe working environment.

• Automate regularly executed manual processes through workflows and other features that eliminate recurring support costs and implement consistent, repeatable processes.

C-004 COMMUNICATION

The Government considers effective and productive communication essential to a collaborative relationship and to the success of this program. Expectations on technical issues, cost, schedule, performance, and progress toward (or variances from) established expectations must be communicated clearly and without ambiguity or delay.

The Contractor shall establish and maintain effective communication with the Government, structuring its support so that its goals and objectives are aligned with those of the Government through an open, customer-oriented effort. The Contractor shall employ both formal and informal methods of communication to promote timeliness and efficiency of actions.

The Contractor shall communicate with the Government during all phases of the contract and, at a minimum, take steps to understand the Government's business and technical issues, provide insight into issues and problems, recommend solutions, and recommend actions to maintain cost, schedule, quality, and technical baselines. The Contractor shall have effective communications processes and plans to identify, prepare, review, incorporate comments, disseminate, and track communication items (deliverables, work products, drawings, correspondence, etc.). The format of the communication plan shall be reviewed and approved by the Contracting Officer's Representative (COR).

C-005 SCOPE

The Contractor shall provide the technical support services necessary to support DS and its programs, facilities, and customer organizations, including:

• Program Management

• PSIM Operations and Maintenance

• HDSVS Operations and Maintenance

• Video Analytics Deployment and Operations

• Subsystem Integrations

• Facility Models (3-D)

• SMSe Network and System Design, Operations, and Maintenance

• SMSe Enterprise Infrastructure Design, Operations, and Maintenance

• IOC/STOC Operations

• CMMS Development and Operations: Maximo/Asset Management Systems Functionality Support and Development

• Application support and development (SharePoint Platform)

• AlarmNet network and systems operations, and domestic security application server administration

• Risk Mitigation Engineering

• Training

The technical services tasks span multiple DS Directorates, offices, divisions, branches, and programs. The Contractor shall provide all required personnel, management oversight, project management, quality control processes, and other necessary resources to support this contract and the achievement of DS objectives.

At a minimum, the Contractor shall satisfy the requirements and produce the deliverables detailed in this PWS.

The Contractor shall perform all tasks in a manner meeting the highest professional and technical standards and industry-leading practices. All Contractor personnel shall be fully proficient in the areas in which they work and are to:

• Act in a consultative manner, proactively searching for creative solutions that ensure reliability, improve performance, provide increased value, and/or reduce cost.

• Provide deliverables that are clear, concise, technically accurate, well organized, properly referenced, accountable, and complete.

• Produce, update, and maintain documentation on all standard operating procedures (SOPs), desktop procedures, security equipment deployment guides, software deployment guides, and service level agreements (SLAs) throughout the life of the contract.

• Freely provide the Government with knowledge transfer of work products and expertise associated with contracted tasks.

ST maintains over 150 overseas offices supporting all overseas missions and facilities in numerous locations around the United States. These systems require the contractor to install, maintain, support, upgrade, monitor, and train system users.

Temporary Duty (TDY) missions (domestic and abroad) are required on an as-needed basis to provide installation, support and maintenance, and training. All deliverables and services defined within this PWS may be required on a TDY basis, depending on specific DS mission needs.

C-006 PROGRAM MANAGEMENT

C-006.1 General

The Contractor shall provide program management for all tasks carried out under this contract. The Contractor's Program Manager shall ensure the effective and efficient accomplishment of all assigned projects.

DS/C requires comprehensive Program Management (PM) support to provide the framework, process optimization, coordination, and governance necessary for success. The Contractor shall establish the program plans, structures, processes, schedules, reporting requirements, communication channels, and quality control functions necessary to achieve DS/C objectives. Specific goals include:

• Ensure alignment of activities with program goals, promoting operational efficiencies, avoiding schedule and resource collisions, and providing DS/C management visibility into efforts and resource usage.

• Provide a central point of communication and issue management for critical production issues, planned and unplanned outages, and transition issues.

• Develop project charters, plans, timelines, and schedules.

The Program Manager shall be physically located on-site at a DOS facility to be determined by the Government. At a minimum, the Program Manager must have authority to bind the firm and be capable of effectively coordinating logistics, planning, and attending meetings (ad hoc and scheduled), and addressing all escalated issues. The Program Manager or designated representative shall be responsible for all contractor personnel and shall ensure program requirements are met, including:

• Implement and coordinate project management policies, practices, and procedures

• Track and report designated metrics for the office and subordinate divisions

• Monitor, review, and assist with project plan development

• Develop performance reports for the office

Three guiding principles govern contract execution:

1. No risk to continuity of service

2. Essentiality of communication

3. Flexibility and adaptability

C-006.2 Program Management Plan

The Contractor shall provide a Program Management Plan (PMP) to manage, track, and evaluate performance. The PMP shall consist of risk mitigation and control policies and procedures in accordance with standard industry practices for project administration, execution, and tracking. The original PMP shall be presented as part of the initial proposal. Modifications shall be made after the initial kickoff meeting; the revised PMP is due 30 calendar days after the contract kickoff meeting. Throughout the period of performance, the Contractor shall maintain and update the PMP, track changes and schedule variances, and provide ongoing updates and reports.

Standard operating procedures (SOPs) and service level agreements (SLAs) shall be provided by the Contractor, thoroughly capturing the duties of each position, and shall be upgraded periodically. SOPs and SLAs shall be provided to the Government within 90 days of contract award.

The Contractor shall adhere to Government-approved plans, schedules, and milestones. Project risks shall be identified and escalated according to Government-approved communications channels.

The Contractor shall prepare Program Status Reports depicting the Contractor's performance assessment, comprising:

• Part 1 – Status: activities performed and scheduled for the next period;

major risks/issues and resolutions; personnel and contractual updates;

recommendations for improvement.

• Part 2 – Performance compliance report indicating actual measured/calculated performance against Acceptable Quality Level (AQL) standards for each area.

C-006.3 Risk Management Plan

Risk Management identifies, mitigates, and monitors risks associated with the DS/C programs. The Contractor shall report all identified risks, whether under Contractor or Government control, and shall track and mitigate risks under the Contractor's control and risks the Government directs the Contractor to monitor.

The Contractor shall define and document a risk management approach no later than the end of the transition phase. The Risk Management Plan shall be included in the PMP.

C-006.4 Customer Satisfaction Survey

The Contractor shall develop customer satisfaction surveys to evaluate overall contractual procedures and specific services provided, administered via an automated survey system. The specific format, content, and recipients shall be approved by the COR prior to release. Statistical results shall be provided to the COR annually and shall be utilized in the administration of the Quality Assurance Surveillance Plan.

C-006.5 Standard Operating Procedures (SOPs) and Quality Control Plan

(QCP)

The Contractor shall create, update, and maintain SOP documentation reflecting the terms and conditions of this contract. The Contractor shall provide effective and enforceable SLA recommendations, presenting a first draft to the Government for approval within 90 days of contract award, and shall incorporate the SLAs into the SOP documentation.

The Contractor shall develop, maintain, and follow SOPs for all required operational functions. Each SOP shall undergo two draft reviews before Government approval. A joint annual SOP review shall occur 30 calendar days prior to each contract option year exercise.

Required SOPs:

• 3-D Model Maintenance, Creation, and Integration

• Configuration Management

• Change Management

• Release Management

• Patch Management

• User Support

• TSS Integration Support

• HDSVS Site Activation and Integration

• Analytics Deployment and Management

• Legacy System Support and Sunset

• Deployment of New Capabilities

• Operations Support

• Training Support

• CMMS Operations Reporting

• Software Development Plan

• Quality Control Plan (QCP)

• Network and Server Operations and Management

• Enterprise Infrastructure Architecture, Operations, Automation, and Management

• TSU Coordination and Integration

Quality Control Plan (QCP). The Contractor shall develop and maintain a QCP that includes an inspection system covering all contract services, performance monitoring methods, and quality review documentation. The QCP is the Contractor owned quality-control instrument (distinct from the Government-owned Quality Assurance Surveillance Plan; see C-006.8). The QCP shall be updated annually with lessons learned and submitted with the annual SOP revision.

C-006.6 Monthly Status Meetings

The Contractor shall meet with the COR monthly to discuss, at a minimum:

• Monthly Performance and Progress Report

• Financial status review

• Risks, issues, or obstacles impeding progress and recommended solution(s)

• Workforce and staffing forecasts

C-006.7 Monthly Performance and Progress Reports

The Contractor shall submit a Monthly Performance and Progress Report on the 5th business day of the following month, identifying key activities and accomplishments, risks, issues, and mitigation actions, and financial and workforce status. The Contractor shall propose and coordinate the format with the COR upon award. At a minimum, the report shall summarize data monthly and cumulatively and include:

• Program status (objectives met, work completed, work outstanding)

• Performance in meeting standards/SLAs

• Notable achievements

• Risks, issues, or obstacles and recommended solutions

• Status of deliverables/milestones

• Labor expenditures for the period; total task expenditures year to date;

remaining funds, monthly burn rate, and projected burn rate until task completion

• Obligated funds per contract line-item number (CLIN)

This report shall reconcile with the labor tracking, project cost allocation, and itemized invoicing requirements in C-006.12.

C-006.8 Quality Assurance Surveillance Plan (QASP) and Performance Requirements Summary

The Government owns and maintains the Quality Assurance Surveillance Plan (QASP). The QASP describes the systematic methods the Government uses to monitor Contractor performance against the performance standards in this PWS, defines how performance standards are applied, the frequency of surveillance, and the minimum acceptable levels of performance. The Contractor shall support the Government's administration of the QASP by providing performance data, reports, and access necessary for surveillance.

The Contractor shall develop and maintain the Quality Control Plan (QCP) (see C- 006.5) as its owned instrument for ensuring performance meets the standards in the Performance Requirements Summary (see C-016).

The performance standards, AQLs, surveillance methods, primary and supporting service towers, Government oversight branches, and incentives/disincentives are consolidated in the Performance Requirements Summary (PRS) at C-016.

Consequences for nonperformance are tiered: mission-critical elements carry stronger severity signals referencing Government/CO-owned remedies;

administrative elements are addressed through past-performance/CPARS mechanisms. All specific remedy and monetary mechanisms are subject to the final contract type and CLIN structure and are established by the Contracting Officer.

C-006.9 Information Technology and Information Assurance

The Contractor shall:

• Provide input to the SMSe IT Contingency Plan covering hardware, OS, PSIM, HDSVS, and database configurations

• Submit Notifications of Change (NOC) for all system modifications affecting the SMSe Authority to Operate (ATO)

• Prepare and maintain all documentation required for the DOS Assessment and Authorization (A&A) process and FISMA compliance for SMSe, AlarmNet, CMMS-U, and CMMS-C

• Coordinate with DS/ST/RME as cybersecurity liaison and provide A/ISSO support of ISSO duties

• Document all planned hardware, software, database, and OS configurations a minimum of 30 days prior to installation

Information assurance validation, verification, and assessment activities are performed under the Risk Mitigation Engineering function (see C-014).

Authorization and risk-acceptance decisions (including ATO) are inherently governmental and are retained by the Government.

C-006.10 Hardware Management

All PSIM/HDSVS hardware is GFE. The Contractor shall:

• Maintain a complete, accurate hardware inventory in CMMS

• Establish, advise, and maintain the full Asset Management lifecycle of hardware and software. This includes tracking depreciation schedules, managing vendor warranty agreements, mapping assets to software licenses, and providing data-driven recommendations for hardware refresh or disposal cycles based on total cost of ownership (TCO).

• Develop and support Purchase Requests (PRs) through the supply chain contract via the ACA framework

• Diagnose, document, and report hardware failures immediately to the Government with recommended courses of action

• Obtain prior written COR approval before independently procuring hardware outside the supply chain (treated as ODC)

C-006.11 Associate Contractor Agreement (ACA)

ST maintains a multilateral ACA among related contractors. The Contractor shall sign the ACA upon contract award, participate in a Government-led ACA review during phase-in, and actively collaborate with associate contractors throughout the period of performance. The ACA shall not be used to share proprietary or competitively sensitive information beyond mission necessity.

All Contractors must work together to form and execute a mutually agreeable ACA and Operational Procedures. Each associate Contractor is responsible for identifying which portion(s) of their support services overlap with another associate Contractor(s) and shall develop mutually agreeable Operational Procedures to ensure communication and collaboration. The Operational Procedures take effect once approved by the CO.

The ACA shall include the basis for sharing information, data, technical knowledge, and expertise, and at a minimum:

• The associate Contractors and their relationships

• The programs involved and the relevant Government contracts

• The associate contractor interfaces by general subject matter

• The specific category of information to be exchanged or support provided

• The expiration date (or event) of the ACA

• Identification of potential conflicts, agreements on protection of proprietary data, and restrictions on employees

• Security procedures for joint-contractor occupation of a contractor's facility

Contract/Services Provided Current Contractor Name (to be updated, as appropriate)

Role

Supply Chain Management

Domestic Security Installation Services

Overseas Security Installation Services

Contract/Services Provided Current Contractor Name (to be updated, as appropriate)

Role

Administrative Support Services

Identity Management Support

Quality Assurance and Liaison Support

The Supply Chain Management Contractor is responsible for overall coordination and facilitation of communication, planning, and scheduling among the associate contractors.

C-006.12 Labor Tracking, Project Cost Allocation, and Itemized Invoicing

The Contractor shall implement labor tracking, project cost allocation, and itemized invoicing to provide the Government full visibility into the application of labor and other costs across the service towers and tasks of this contract, as follows:

(a) The Contractor shall track labor on a per-employee basis by task and project.

(b) The Contractor shall charge labor to project billing codes.

(c) The Contractor shall establish and maintain a project billing code structure that maps to the service towers, tasks, and CLINs of this contract. The project billing code structure shall be submitted to and approved by the Government prior to submission of the first invoice.

(d) The Contractor shall provide itemized invoicing by project and CLIN in the format prescribed by the Contracting Officer.

(e) The Contractor shall provide supporting detail for labor, project, and cost allocations upon Government request.

(f) This subsection provides cost visibility and allocation transparency. It does not alter the basis of payment. Firm-fixed-price work remains payable on the basis of achievement of defined outcomes/deliverables and is not converted to a level-of-effort basis by this subsection.

This subsection reconciles with the Monthly Performance and Progress Report (C- 006.7).

C-007 STOC/IOC OPERATIONS

C-007.1 Co-Located STOC/IOC Operating Model

The Contractor shall support a co-located STOC/IOC operating model. The Security Technology Operations Center (STOC) shall remain the enterprise SMSe monitoring, intake, and technical support function. The Integrated Operations Center (IOC) shall remain the SIM mission-support function for PSIM, HDSVS/VMS, advanced video analytics, alarm/event processing, and integrated technical security systems.

The Contractor shall provide staffing, management, coordination, documentation, and escalation support for both functions. The establishment of a single contract vehicle shall not alter Government branch-level operational oversight. NSM shall retain Government oversight of SMSe network, systems, and infrastructure functions. SIM shall retain Government oversight of IOC operations, PSIM mission applications, integrated technical security system support, and operational monitoring requirements.

The Contractor shall maintain documented workflows to ensure timely escalation between STOC, IOC, NSM network support, SIM mission support, and Tier 3 engineering resources. The Contractor shall not allow internal organizational boundaries, service tower boundaries, or ticket routing disputes to delay response to mission-impacting requirements. A determination that root cause resides in another service tower shall not be used to deprioritize, stall, or delay mission-impacting work; such work shall be actively worked and escalated regardless of which tower owns the root cause.

The Contractor shall establish and maintain a dedicated NSM mission-support queue within the Government-approved work order system for requests affecting

SMSe infrastructure to include network devices, physical and virtual servers, workstations, cross-domain transfer solutions, internet pathway and circuits, and associated other associated hardware and software.

The Contractor shall establish and maintain a dedicated SIM mission-support queue within the Government-approved work order system for requests affecting PSIM, VMS/HDSVS, advanced video analytics, ACS/IDS integration, IOC operations, contingency support, DS Command Center support, high-threat post support, or other SIM-directed operational requirements.

Requests submitted through either of these queues shall be prioritized according to Government-approved severity levels (see C-016, CC-1) and escalated when required to preserve operational availability, mission response, and continuity of security monitoring.

C-007.2 Tiered Support Structure

The co-located STOC/IOC will be located at a Government facility in the Washington, D.C. area and provide24/7/365 staffing with no unstaffed shifts.

The Contractor owns Tier 1 through Tier 3 support. The Government's role is oversight, triage/priority, authority, and acceptance.

Tier Provider Function Coverage Response Standard

Tier 1 Contractor

(STOC/IOC)

Front-door intake, initial triage, CMMS ticket creation, basic troubleshooting, account/access coordination, initial monitoring and

24/7/365 onsite at a Government facility in the Washington, D.C. area;

minimum one contractor per shift for

Per CMMS

SLA

Tier Provider Function Coverage Response Standard event documentation

IOC and two contractors per shift for STOC, both including weekends and holidays;

zero unstaffed shifts for both areas

Tier 2

STOC

Contractor (NSM-led)

SMSe network, systems, and infrastructure troubleshooting;

general SMSe and CMMS user support

24/7/365 Per C-016

(CC-1)

Tier 2

– IOC

Contractor (SIM-led)

PSIM/SPARTA,

VMS/HDSVS,

alarm/event handling and correlation, analytics, ACS/IDS integration, 24/7/365 Per C-016

(CC-1)

Tier Provider Function Coverage Response Standard operational monitoring

Tier 3 Contractor (on call)

Engineering escalation from the responsible service tower

24/7/365 on call

Acknowledge within 30 minutes;

subject matter expert engaged on the problem within 2 hours

All installation, maintenance, repairs, and asset management shall be documented in the ST Computerized Maintenance Management System (CMMS). The Contractor shall submit weekly CMMS reports to the COR covering the number of work orders opened for the week, total number completed, and total number open;

average completion time; and new assets reported, by summary, team, and individual for STOC. Other CMMS metrics may be required as directed by the Government. The Contractor shall make every effort to institutionalize root cause analysis to assist the Government in identifying and mitigating the leading causes of issues or failures affecting sites.

Work product lineage. Work products, documentation, and configurations handed over from predecessor contractor(s) become Government-furnished information/equipment (GFI/GFE) to the Contractor. The Contractor shall assume, maintain, and build upon such work products (see C-018 and C-02.8).

C-008 PERFORMANCE REQUIREMENTS

C-008.1 PSIM Operations and Maintenance

The Contractor shall maintain the PSIM enterprise across three environments (production, training, and testing) at full operational status throughout the period of performance.

System Availability: Maintain the PSIM production environment at 99.9% uptime (measured monthly).

Core Capabilities — the Contractor shall ensure the PSIM:

• Centrally acquires, parses, analyzes, and displays security data from TSS devices at up to 250+ Department facilities

• Integrates access control, intrusion detection, imminent danger notification, video, key management, and network monitoring data into a single operator interface

• Supports global, regional, and site-level user roles with role-based access control via Active Directory single sign-on

• Provides interactive 2-D and 3-D geospatially accurate facility models with real-time sensor status

• Maintains a 3-D whole-earth viewer with offline capability

• Supports configurable alerts with SOP-driven workflows, including complex multi-step acknowledgment sequences

• Provides customizable reporting in XML, Excel, Word, CSV, MHTML, and PDF formats

• Operates on all current and future DOS-approved operating systems

• Maintains high availability with application redundancy and automatic failover

• Tolerates high-latency

Software Management: The Government holds a perpetual enterprise license for PSIM software administered through a separate Software Support Agreement (SSA). The Contractor shall evaluate, test, and implement software updates per Government direction.

C-008.2 HDSVS Operations and Maintenance

The Contractor shall maintain and expand the HDSVS enterprise.

System Availability: Maintain HDSVS at 99.9% uptime at all deployed sites (measured monthly).

Steady-State Operations:

• Provide 24/7/365 remote management of all deployed HDSVS sites through the IOC

• Maintain full PSIM/VMS integration at all deployed sites

• Monitor storage arrays, camera health, and VMS software

• Support legacy analog systems (NVRs and analog infrastructure) until TSU conversion

TSU Site Conversions — for each newly converted site, the Contractor shall:

• Deliver full PSIM/VMS integration as a required activation deliverable (Government acceptance gate)

• Provide on-site VMS training to security personnel, coordinated through the TSU schedule via the ACA framework

• Recommend 3-D model updates where site changes warrant a refresh, subject to Government approval; where a new or updated model is required for a converting site, the model shall be delivered and accepted prior to or concurrent with the site conversion acceptance gate (see C-009)

C-008.3 Video Analytics

The Contractor shall deploy, operate, and optimize video analytics capabilities across the HDSVS enterprise based on Government direction.

Analytics capabilities shall include, but are not limited to:

• Perimeter intrusion detection

• Loitering and crowd detection

• Object and abandoned-object detection

• Motion and behavioral analytics

• License plate recognition (LPR)

• Facial recognition (FR)

• Additional capabilities as directed by the Government

Analytics shall be surfaced through the PSIM and HDSVS as primary delivery vehicles. The DS/SIM Branch Chief or designated representative shall provide written approval for analytics deployment at each site.

Analytics Processing: The Contractor shall employ a hybrid model using edge-based and server-based processing as appropriate to each site's security posture.

Server-based analytics hardware is Government-Furnished Equipment (GFE).

Analytics Performance Management (controllability-based construct): Analytics performance shall be managed through a baseline → tune → trend-report → improve methodology rather than fixed absolute pass/fail thresholds. Upon deployment at a site, the Contractor shall establish a performance baseline, actively tune and optimize the analytics, report performance trends, and drive continuous improvement. The following requirements apply:

• Performance shall be measured using PSIM alarm resolution questionnaire data, VMS data, and analytics server logs. Vendor laboratory claims are not acceptable as proof of operational performance.

• The Contractor shall validate data accuracy across all three collection sources (PSIM, VMS, analytics server) prior to relying on that data for reporting and shall resolve and report any discrepancies to the Government.

• Network latency outside the Contractor's control shall not constitute a performance deficiency for alarm delivery, provided the Contractor documents root cause using network diagnostic tools (ping, traceroute, networking monitoring). (See the enterprise Controllability and Exclusions provision at C-016.)

• High-consequence alarms designated by the Government shall be handled through a mandatory human/video verification workflow prior to emergency response.

Analytics Tuning: The Contractor shall actively tune and optimize all deployed analytics, document all adjustments and their performance impact, and submit tuning reports (Deliverable N). The Government may direct configuration adjustments at any site; the Contractor shall implement within a timeframe agreed with the COR.

Analytics Data Collection: For every analytics-generated alarm, the Contractor shall capture the following in the PSIM alarm resolution questionnaire:

• Date/time of alarm and disposition timestamp

• Site location, camera identifier, and analytics capability type

• Alarm disposition (true/false alarm) and cause of false alarm if applicable

• Identity of resolving operator

• Whether a response was initiated and type of response

C-008.4 Subsystem Integrations

The Contractor shall maintain full integration between the PSIM/HDSVS (SMSe overseas environment) and the following systems. All integrations in this subsection are SMSe/PSIM-side (OCONUS/enterprise). There is no PSIM integration on the domestic AlarmNet environment (see C-013).

• Enterprise Access Control

• Enterprise Digital and Analog Video Management

• Enterprise Network Monitoring

• Enterprise Key Management system

Integration requirements for each system include real-time event receipt, status monitoring, alarm generation, and command capability as applicable. The Contractor shall also develop, document, test, and sustain bespoke interfaces/connectors (API/SQL/SNMP/SYSLOG) as required, per approved requirements, delivered per negotiated schedule with a Government acceptance gate and via approved change control.

C-009 FACILITY MODELING AND GEOSPATIAL SUPPORT (3-D)

Facility Modeling and Geospatial Support (FMG) is a distinct service function.

Government oversight of FMG is provided by the SIM Branch.

The Contractor shall maintain, update, and create geospatially accurate 3-D site models integrated into the PSIM, and shall develop and maintain associated geospatial/GIS data. All models and geospatial data are Government property. The Contractor shall use Government-furnished source data (aerial imagery, DTED 1/2, CAD as-built drawings, photographic surveys, site camera locations, and field notes).

Performance Construct: Model creation, updates, and geospatial data work shall be delivered on a negotiated-schedule basis with a Government acceptance gate, validated for accuracy against as-built/survey truth. At TSU conversion sites requiring a new or updated model, the model shall be delivered and accepted prior to or concurrent with the site conversion acceptance gate (see C-008.2, IOC-3).

Model Requirements:

• Photorealistic, geospatially accurate, and architecturally correct

• Default look-down perspective with first-person and fly-through modes available

• Render at 40–60 frames per second within the PSIM

• Fully functional offline (disconnected from WAN or global map server)

• Maintained across a minimum of three modeling workstations (production software is GFE)

At TSU conversion sites, the Contractor shall recommend a 3-D model refresh where site changes are significant, leveraging on-site personnel and fresh photo surveys where available. All recommended refreshes require Government approval prior to implementation.

C-010 SMSe NETWORK OPERATIONS (NSM-OWNED FUNCTIONS)

C-010.1 General

The Contractor shall ensure stable, secure operation of the SMSe network supporting the PSIM and HDSVS enterprise and all connected technical security systems and Internet of Things (IoT) devices, applying Zero Trust principles throughout. NSM retains Government oversight of all SMSe network, systems, and infrastructure functions in this section. The SMSe network is a separate and distinct environment from the domestic AlarmNet network (see C-013).

The Contractor is responsible for ensuring the stable operation and efficient performance of data networks; monitoring and managing all systems and network hardware and equipment, including routers, switches, and encryptors; analyzing systems and network performance across the organization's LANs and WANs; and identifying and remedying performance bottlenecks. Responsibilities include:

• Monitor and manage all network hardware (routers, switches, encryptors), including both trusted and untrusted (firewalled) edge network components

• Analyze and remediate network performance bottlenecks across LANs and WANs

• Develop and maintain infrastructure technology best government and business practices related to automation and scripted playbooks

• Install, configure, and maintain network hardware and cabling

• Administer hardware/software upgrades and capacity planning

• Maintain network security controls and user account management

• Provide Tier 2 and Tier 3 infrastructure issue resolution

• Design, develop, test, and evaluate infrastructure architecture to support technical security systems

• Ensure interoperability, manage configuration, change, and release processes of all deployed technical security systems

• Provide infrastructure performance statistics and reports

• Develop and maintain infrastructure policies, procedures, and disaster recovery plans

• Inspect, maintain, and where necessary replace network cabling and other network-related equipment

• Perform systems and network and system design and capacity planning

• Perform physical, software, system, and network asset management, including inventory, documentation, and technical specifications

• Administer and maintain user accounts, permissions, and access rights

• Recommend, schedule, and perform infrastructure improvements, upgrades, and repairs

• Interact with vendors, outsourcers, and contractors to secure infrastructure products and services

• Maintain and establish VPN connections to remote facilities

• Maintain and monitor network security and configuration controls and audits

• Test infrastructure changes according to DS policies and practices; develop test plans, scripts, and scenarios, and fully document results

C-010.2 SMSe Systems and Infrastructure

The SMSe team consists of the following functional activities under NSM Government oversight:

• Network engineering and administration

• Systems engineering and administration

• IT Project Management

• Applications engineering

• Level 2 and 3 maintenance and repair support

• Business analytics and voice of customer analysis

• Technical writing support

• Development

• Special projects, domestic and overseas

• SMSe computer configuration production

• Logistics

The Contractor shall:

• Provide systems and network performance statistics and reports

• Install and configure all systems and network hardware and equipment, including routers, switches, encryptors/firewalls, and circuits

• Recommendations and support to designing and improving infrastructure operations to reduce TCO over the life of the contract while improving data accessibility / availability across the entire enterprise

• Implement and maintain infrastructure automation tools, scripts, and orchestration pipelines to perform routine infrastructure monitoring, patch deployment, and incident remediation. The automated system(s) shall operate via deterministic, rule-based logic without altering core system architecture unless explicitly authorized by the Government

• Administer hardware and software upgrades for virtual, containerized, and physical equipment

• Create, modify, and delete user and computer accounts in an Active Directory environment

• Monitor the health and availability of all devices connected to the network

• Initiate and coordinate remediation actions with end users to maintain operability and availability of connected devices

• Support critical sites on a priority basis

• Support service requests on a priority basis

Other SMSe program support requirements include:

• Special Projects — special installations overseas (e.g., integration, digital photo surveys, SMSe installation assistance) and domestic special projects (e.g., installations and support at various State Annexes).

• Computer Configuration Production — configuration of PCs, laptops, and other equipment for use on the SMSe network overseas and domestically.

• Logistics — logistics operation supporting overseas and domestic clients.

DS/SSI/NSM manages the SMSe network. DS/ST/RME provides cybersecurity oversight (see C-014). The Contractor shall coordinate with all relevant DS organizational elements.

C-011 CMMS OPERATIONS: MAXIMO / ASSET MANAGEMENT

SYSTEMS FUNCTIONALITY SUPPORT

C-011.1 General

CMMS is a centralized asset inventory management system customized to meet business needs for warehouse, asset maintenance, supply chain, accounting, business reporting, mobile capabilities, and work orders. .

The Contractor shall maintain and enhance the functionality, integrity, reliability, availability, performance, stability, sustainability, and security of the application and its databases and tools, in alignment with Department Enterprise standards and policies. CMMS is a distinct service tower; Government oversight is provided by the NSM Branch.

CMMS facilitates customer purchase requests, service requests, work order management, and tracking of Government-owned inventory. Additional information:

• ST's enterprise asset management IT application is deployed to all sections of the ST office, overseas and domestically.

• Based on commercial asset management software, customized to support ST work processes and comply with Federal asset accountability laws.

• Hosted by the Department, with over 2,500+ users across 250+ locations.

C-011.2 CMMS Requirements

The Contractor shall support a globally utilized deployment of a commercial enterprise asset management application across multiple environments including development, training, production, and classified, by providing system development and enhancement, user training and outreach, application operations and maintenance, technical support, and contiguous improvement. The Contractor shall provide expert guidance on the enterprise asset management application and collaborate with DS/CIO, Diplomatic Technology, and partner vendors, to research, establish, and implement industry best practices for hosting environment technologies.

The Contractor shall manage, administer, maintain, and provide full end-to-end technical support for commercial enterprise asset management application within the Department’s enterprise infrastructure using Government-approved DevSecOps pipelines and automation scripts to provision,…