VIRGINIA COMMERCIAL SPACE FLIGHT AUTHORITY

REQUEST FOR PROPOSALS (RFP)

Issue Date: 5/21/2026

Subject: RFP 26.130300-003-028

Title: SCADA Integrator

Issuing Organization: Virginia Commercial Space Flight Authority 101 W. Main Street, Suite 602 Norfolk, VA 23510

Location of Work: Multiple locations in the vicinity of:

Virginia Commercial Space Flight Authority Mid-Atlantic Regional Spaceport Facilities Wallops Island, VA 23337

Proposals will be received until 6/17/2026 4:00 p.m. Eastern time for furnishing the scope described herein.

Proposals shall remain valid for 60 days from the date submittals are due.

VCSFA is not obligated to pay any costs incurred by the Offeror in preparing or submitting an offer to this RFP.

Certification:

In compliance with this RFP and all conditions imposed in this RFP, the undersigned firm hereby offers and agrees to furnish all services in accordance with the attached signed proposal or as mutually agreed upon by subsequent negotiation, and hereby certifies that all information provided below and in response to this request for proposal and any schedule attached hereto is true, correct, and complete.

Name and Address of Firm:

By: ______________________________________ _______________________________________ Authorized Signature/Title Date Printed Name

Email Phone Number

Virginia Commercial Space Flight Authority

VCSFA RFP 26.130300-003-028

SCADA Integrator

TABLE OF CONTENTS

PAGE

I. PURPOSE 2

II. STATEMENT OF NEEDS 2

III. REQUEST FOR PROPOSAL AND PROJECT SCHEDULE 2

IV. PROPOSAL PREPARATION AND SUBMISSION INSTRUCTIONS 2

V. EVALUATION AND AWARD CRITERIA 4

VI. GENERAL TERMS AND CONDITIONS 5

VII. OTHER TERMS AND CONDITIONS 5

VIII. ATTACHMENTS 6

I. PURPOSE

The Virginia Commercial Space Flight Authority (“VCSFA” or “Virginia Spaceport Authority” or “VSA”) requests proposals for professional services to support Supervisory Control and Data Acquisition (SCADA) implementation at the Mid-Atlantic Regional Spaceport (MARS). The Contractor (“Integrator”) shall provide engineering deliverables and hands-on configuration and commissioning support for a multi-site SCADA solution using Inductive Automation Ignition as the required platform.

VCSFA is a political subdivision of the Commonwealth of Virginia and is exempt from the Virginia

Public Procurement Act.

II. STATEMENT OF NEEDS

See Attachment C for the complete Scope of Work document.

III. REQUEST FOR PROPOSAL AND PROJECT SCHEDULE

1. Request for Proposal

a. Release of Solicitation: 5/21/2026

b. Offeror Questions must be submitted no later than 6/02/2026, 4:00 p.m. Eastern time

Responses to Offeror questions will be included in an Amendment to the RFP, which will be posted on the Commonwealth of Virginia procurement portal (eVA) solicitation page for this RFP. Offerors must include signed Amendments with their proposal submissions.

c. Proposals are due 6/17/2026 at 4:00 p.m. Eastern time, emailed to solicitations@vaspace.org

2. Project Completion Dates

a. VSCFA is requiring work to be completed and accepted by 12/01/2026. Completion sooner than this date will be viewed more favorably in evaluations.

IV. PROPOSAL PREPARATION AND SUBMISSION INSTRUCTIONS

A. GENERAL REQUIREMENTS:

1. Response

a. In order to be considered for selection, Offerors must submit an electronic proposal by the date and time noted above and on the cover of this solicitation.

b. Receipt of an electronic proposal shall be used to determine timeliness.

c. Proposals must be submitted to solicitations@vaspace.org.

2. Proposal Preparation

a. Proposals must be signed by an authorized representative of the Offeror.

mailto:solicitations@vaspace.org mailto:solicitations@vaspace.org

b. All information requested must be submitted. Proposals shall be organized as outlined.

c. All pages of the proposal should be numbered, and each paragraph in the proposal should reference the page number and paragraph number (as appropriate) of the corresponding section of the RFP. Information that the Offeror desires to present that does not fall within any of the requirements of the RFP should be inserted at an appropriate place or be attached at the end of the proposal and designated as additional material. Proposals which are not organized in this manner risk elimination from consideration if VCSFA is unable to find where the RFP requirements are specifically addressed.

d. Proposals should be prepared simply and economically, providing a straightforward, concise description of capabilities to satisfy the requirements of the RFP. Emphasis shall be placed on completeness and clarity of content.

e. Proposal Preparation Costs: The Offeror is responsible for all costs of proposal preparation. VCSFA is not liable for any cost incurred by an Offeror in response to this

RFP.

f. Proposal shall remain valid for sixty (60) days from date of submission.

3. All Proposals Shall Include:

a. Cover sheet of this RFP - filled out as required and signed by an authorized representative of the Offeror.

b. Signed Amendments to the RFP

c. VCSFA Business Certificate and W-9 - Attachments A and B respectively.

d. Exceptions to RFP or Terms and Conditions – Attachment H.

d. Executive Summary – A concise overview of the proposed approach, highlighting how it meets or exceeds the scope requirements, and addresses any project risks.

e. Technical Approach - Detailed methodology of how the contractor will execute the requirements outlined in the Statement of Needs. Description shall include but not be limited to:

• A compliance matrix mapping tasks and deliverables in this SOW to proposed labor and outputs.

• A clear statement of what VSA furnishes vs what the Integrator furnishes.

• Explicit assumptions for on-site visits, travel, and access windows.

• Identification of recurring cost drivers created or depended on by the proposed solution.

• A list of requested controlled-disclosure items needed to firm the design (with justification).

• Description of the bidder’s software quality, testing, configuration management, and cybersecurity approach, including test planning, test case development method, defect tracking, peer review workflow, and how work products will be managed in the VSA GitLab repository. If proposing a test-first method for scripts or interface logic, describe the approach and tools. Provide estimated performance criteria for all stated Requirements and Deliverables in the Scope of Work.

• Sample deliverables from past projects or models that illustrate what VCSFA’s deliverables might resemble (sanitized/anonymized)

f. Capability and Experience of the Offeror

• Provide an overview of the Offeror’s qualifications to perform the work, including relevant experience, technical competencies, and management capabilities. The response should demonstrate the Offeror’s ability to successfully execute projects of similar scope and complexity. Include descriptions of three (3) relevant projects that highlight the firm’s capability to successfully manage and complete projects with Ignition-based, multi-site

SCADA integration and similar protocol environments. VCSFA contact previous project points of contact as a reference regarding past performance. Preference will be given to Offerors that are registered in the Inductive Automation Integrator Program with the highest level of certification.

g. Staffing Plan and Key Personnel

• Provide a staffing plan to include all key personnel with resumes/bios for each, outlining their relevant experience, qualifications and certifications. Preference will be given to key personnel with Inductive Automation Integrator Certification

• As part of the staffing plan, include an organizational chart showing the roles and relationships of key personnel.

• Provide a statement that the key personnel identified will remain committed to this project for the full duration and scope.

f. Project Price – Complete and include here the Pricing Form in Attachment D, showing pricing with elemental breakout. Pricing shall be all inclusive of all necessary labor, transportation, supervision, materials, equipment, and incidentals necessary to fulfill the requirements outlined in the RFP.

a. If the Offeror has an alternative, standard pricing structure for services of this nature (e.g. price per tag), this can be included separately, in addition to the Pricing Form in Attachment D, as a reference for VCSFA’s consideration.

g. Project Schedule

• Complete and include here the Schedule Overview Form in Attachment E.

• In addition to Attachment E, provide a proposed integrated schedule aligned to Phase

1 milestones and identify long-lead dependencies. Proposals shall clearly state assumptions for:

1. Site access and escort requirements.

2. Hardware lead times and dependencies.

3. Disclosure constraints that could affect schedule.

• A final schedule will be negotiated between the selected Integrator and VCSFA.

h. Risks: Offerors shall identify known or perceived risks, uncertainties, or information gaps that could affect cost, schedule or performance. For each risk identified, describe the nature of the risk, whether the risk is Contractor-controlled, Owner-controlled or shared, and the potential cost or schedule impact.

i. Alternative Approaches

a. If the Offeror has innovative ideas or alternative approaches to accomplishing the Scope of Work that differ from the approach outlined in VSA’s Statement of Needs, they may be outlined here with an explanation why such an approach may be beneficial to VCSFA and any cost and/or schedule differential implicated by the approach.

i. Proposals/quotes of lower-tier subcontractors, if any.

V. EVALUATION AND AWARD CRITERIA

Proposals will be evaluated based on best overall value with the following criteria, in order of priority:

• Relevant experience with Ignition-based, multi-site SCADA integration and similar protocol environments

• Technical approach and compliance with the SOW

• Schedule and execution plan

• Price / total evaluated cost, including base scope and OD1 option

• Key personnel qualifications and staffing plan

Proposals that are not in compliance with specifications will not be considered. Proposals shall be evaluated by VCSFA based on the above specific criteria and completeness, relevance, and quality of the Offeror’s responses to the RFP and the specific proposal requirements.

VCSFA reserves the right to reject any and all proposals; to waive minor informalities in proposals or request additional information from Offerors; or to select the proposal that in VCSFA’s judgment best accomplishes the purpose of the request.

Discussions or Oral Presentation. VCSFA may choose to engage highly ranked Offerors after the proposal evaluation stage to participate in discussions and/or oral presentations, during which Offeror may be asked to clarify or elaborate on aspects of their proposals. Offeror evaluations and rankings may be further modified based discussions/oral presentations.

Negotiations. VCSFA will select one or more Offerors that it deems to be fully qualified and best suited based on the evaluation of proposals and any additional discussions/oral presentations, in accordance with the criteria included in this RFP. VCSFA may then conduct negotiations with the Offerors so selected. VCSFA shall consider price, but it will not be the sole determining factor in the selection. Negotiations may result in mutually agreed upon modifications of the RFP and/or the Offeror’s proposal. VCSFA may cancel this RFP or reject Proposals at any time before the award and is not required to furnish a statement of the reason VCSFA did not deem a particular Offeror the most advantageous. Should VCSFA determine in writing and in its sole discretion that only one Offeror is fully qualified, or that one Offeror is clearly more highly qualified than the others under consideration, VCSFA may negotiate a contract or award a contract without further negotiation to that Offeror.

Award. VCSFA shall select and award a contract to the Offeror that, in its opinion, presents the best overall value to VCSFA, in accordance with the evaluation criteria.

VI. GENERAL TERMS AND CONDITIONS

The following terms and conditions are incorporated into this solicitation:

• Attachment F – VCSFA Contract for Services

• Attachment G – FAR Federal Clause Flowdowns

By submitting a proposal, the offeror confirms acceptance of these terms as well as any other terms and conditions contained in this RFP. Any exceptions to these terms should be identified in accordance with Attachment H

VII. OTHER TERMS AND CONDITIONS

1. In accordance with the Virginia Fair Employment Contracting Act, Va. Code Sec. 2.2- 4200 et seq., the Contractor agrees as follows:

a. The Contractor will not discriminate against any employee or applicant for employment because of race, religion, color, sex, national origin, age, disability, or other basis prohibited by state law relating to discrimination in employment, except where there is a bona fide occupational qualification reasonably necessary to the normal operation of the Contractor. The Contractor agrees to post in conspicuous places, available to employees and applicants for employment, notices setting forth the provisions of this nondiscrimination clause, including the names of all contracting agencies with which the Contractor has contracts of over $10,000.

b. The Contractor, in all solicitations or advertisements for employees placed by or on behalf of the Contractor, will state that such Contractor is an equal opportunity employer. However, notices, advertisements and solicitations placed in accordance with federal law, rule or regulation shall be deemed sufficient for the purpose of meeting the requirements of this section.

c. If the Contractor employs more than five employees, the Contractor shall

(i) provide annual training on the Contractor’s sexual harassment policy to all supervisors and employees providing services in the Commonwealth, except such supervisors or employees that are required to complete sexual harassment training provided by the Department of Human Resource Management, and (ii) post the Contractor’s sexual harassment policy in (a) a conspicuous public place in each building located in the Commonwealth that the Contractor owns or leases for business purposes and (b) the Contractor’s employee handbook.

d. The Contractor shall include the provisions of subdivisions a, b, and c above in every subcontract or purchase order of over $10,000, so that those provisions will be binding upon each subcontractor or vendor.

2. The Contractor agrees to comply with all applicable federal and state laws and regulations pertaining to information security and data privacy.

3. Request to Protect Records from Public Disclosure

Information which you desire to make available to VCSFA but which you believe should be exempted from disclosure, such as a trade secret, proprietary information, or other confidential information, should clearly by identified and designated as such, stating in writing why protection of that information is needed. The Respondent should make a written request to solicitations@vaspace.org. The written request shall:

a. Specify the applicable Code of Virginia exemption (such as Va. Code Sec. 2.2-3705.6(24)), upon the submission of the materials for which protection is sought.

b. Identify specifically and conspicuously the data or other materials for which the protection is sought (requesting protection for the entire response does not comply with this requirement and such request will be rejected); and,

c. State the reasons why protection is necessary.

Failure to take such precautions prior to submission of information may subject confidential information to disclosure under the Virginia Freedom of Information Act.

VIII. ATTACHMENTS

Attachment A – VCSFA Business Certification Attachment B – W-9 Form Attachment C – Scope of Work Attachment D -- Pricing Form Attachment E – Schedule Form Attachment F – VCSFA Contract for Services Attachment G -- FAR Federal Clause Flow-downs https://marsspaceport.sharepoint.us/sites/CTR-Staff/Solicitations/24.891138-000-012%20Pad%200A%20ISI%20Examinations/RFP%20Docs/solicitations@vaspace.org

Attachment H - Exceptions to VCSFA RFP and Terms and Conditions

Dear Valued Supplier, We request that you complete the following information in order to be added the approved suppliers list with Virginia Commercial Space Flight Authority (VCSFA). Please return this form as soon as possible.

Company Name Company Name Street Address Street Address City City State Zip State Zip

Cage Code

President: CFO:

No. of Employees:

If Subsidiary, name of Parent:

Signature:__________________________________ Title:

Date:

Vendor ID: Classification: __ __ __ __ __ __ __ __

Export/Import Certification

(NAICS)

A. OFFEROR (____) is, (____) is not a “U.S. Person” as defined in the ITAR 22 CFR Part 120.15 and EAR 15 CFR 772.

B. OFFEROR (____) is registered, (____) is exempt from registration, (_____) is not registered with the U.S. Department of State, Directorate of Defense Trade Controls per ITAR 22 CFR Part 122.1 (a) and (b). Expiration Date of Registration (________________) C. OFFEROR (____) will obtain the necessary export authorization prior to the release of controlled technical data or other defense articles provided by VCSFA for the purpose of procurement to any Foreign Person in or outside of the United States.

In the event this effort contains controlled technical data within the definition of the International Traffic In Arms Regulations (ITAR), it is subject to the control laws of the U.S. Government. Transfer of this data by any means to a Foreign Person, whether in the United States or abroad, without an export license or other approval from the U.S. Department of State, is prohibited. Suppliers shall ensure any lower tier participants are made aware of this requirement.

Additionally, for service type orders, the supplier is advised that due to the nature of work performed by Virginia Commercial Space Flight Authority, it is anticipated that any services performed under this contract may include exposure to defense articles. As such, only U.S. Persons may work on any resultant order. The supplier is responsible for ensuring compliance with this requirement, and for flowing down the requirement to lower tier participants.

ORDERS MAY NOT BE PROCESSED UNTIL WE HAVE RECEIVED THE ABOVE INFORMATION

Company Addresses Order to: Remit to:

ITAR 22 CFR 120.15 and EAR 15 CFR Part 772 define a U.S. person as a person who is a lawful permanent resident as defined by 8 U.S.C.1101(a)(20) or who is a protected individual as defined by 8 U.S.C. 1324b(a)(3). It also means any corporation, business association, partnership, society, trust, or any other entity, organization or group that is incorporated to do business in the United States. It also includes any governmental (federal, state or local) entity.

Business Status

Pertinent Data

It is the policy of VCSFA that small businesses and companies owned by socially and economically disadvantaged individuals have the maximum opportunity to participate in the performance of contracts awarded by the Commonwealth of Virginia and U.S. Government Federal agencies. Eligibility as a small business is based upon the regulations issued by the Small Business Administration, per Rev. 13, part 121 of the SBA Rules and Regulations.

Fax Number

If so, what year?

Dun & Bradstreet Number:Federal Tax I.D. Number:

Principal product or service:

(Assigned by VCSFA POC)

Printed Name:_______________________________

Internal Use Only

Telephone Number Fax Number

Telephone Number

Has your company ever filed for Bankruptcy?

Years in Business:

Native American-Owned Small Business

Small Business Large Business Non-Profit Business Foreign Business Historically Black College & University or Minority Institution

Small Disadvantaged Business Women-Owned Small Business HUBZone Small Business Veteran Owned Small Business Service Disabled Veteran Owned Small Business Nonprofit Agency for Blind/Handicap

08/01/2018

OFFEROR (____) is, (____) is not presently debarred, suspended, proposed for debarment, or declared ineligible for the award of contracts by any State or Federal agency.

NAICS:

Does your organization hold any State or GSA Contracts? Yes No If yes, what is the Contract Number? ________________________________

Attachment A - VCSFA Business Certification

Form W-9 Request for Taxpayer Give Form to the

(Rev. October 2018) Identification Number and Certification requester. Do not

Department of the Treasury send to the IRS.

Internal Revenue Service ► Go to www.irs.gov/FormW9 for instructions and the latest information.

1 Name (as shown on your income tax return). Name is required on this line; do not leave this line blank.

2 Business name/disregarded entity name, if different from above cvi Ql 3 Check appropriate box for federal tax classification of the person whose name is entered on line 1. Check only one of the 4 Exemptions (codes apply only to Cl following seven boxes. certain entities, not individuals; see instructions on page 3):

C □ Individual/sole proprietor or D C Corporation D S Corporation 0 Partnership D Trust/estate 0

• Ill single-member LLC Exempt payee code (if any) Q) C

a. 0

□�-n Limited liability company. Enter the tax classification (C=C corporation, S=S corporation, P=Partnership) ► ... :I Note: Check the appropriate box in the line above for the tax classification of the single-member owner. Do not check Exemption from FATCA reporting 0 ...

C 1n LLC if the LLC is classified as a single-member LLC that is disregarded from the owner unless the owner of the LLC is code (if any) ·- C another LLC that is not disregarded from the owner for U.S. federal tax purposes. Otherwise, a single-member LLC that... -

11. u is disregarded from the owner should check the appropriate box for the tax classification of its owner.

·u □ Other (see lnstruotJons) ► (App/fes to eccaunls maintained outside lhe U.S.)

a.

5 Address (number, street, and apt. or suite no.) See instructions. Requester's name and address (optional) Ill

Ql Ql

6 City, state, and ZIP code

7 List account number(s) here (optional)

■ •.r.1 ... Taxpayer ldehtification Number (TIN) I Social security number I Enter you� TIN in_ the app_ro�ri�te box. The TIN provided must _ match t�e name given on line 1 to avoid backup withholding. For 1nd1v1duals, this 1s generally your social security number (SSN). However, for a resident alien, sole proprietor, or disregarded entity, see the instructions for Part I, later. For other entities, it is your employer identification number (EIN). If you do not have a number, see How to get a TIN, later.

ITIJ -[D -I I I I I

or

Note: If the account is in more than one name, see the instructions for line 1. Also see What Name and Number To Give the Requester for guidelines on whose number to enter.

[ Employer Identification number

Certification Under penalties of perjury, I certify that:

1. The number shown on this form is my correct taxpayer identification number (or I am waiting for a number to be issued to me); and

2. I am not subject to backup withholding because: (a) I am exempt from backup withholding, or (b) I have not been notified by the Internal Revenue

Service (IRS) that I am subject to backup withholding as a result of a failure to report all interest or dividends, or (c) the IRS has notified me that I am no longer subject to backup withholding; and

3. I am a U.S. citizen or other U.S. person (defined below); and

4. The FATCA code(s) entered on this form (if any) indicating that I am exempt from FATCA reporting is correct.

Certification instructions. You must cross out item 2 above if you have been notified by the IRS that you are currently subject to backup withholding because you have failed to report all interest and dividends on your tax return. For real estate transactions, item 2 does not apply. For mortgage interest paid, acquisition or abandonment of secured property, cancellation of debt, contributions to an individual retirement arrangement (IRA), and generally, payments other than interest and dividends, you are not required to sign the certification, but you must provide your correct TIN. See the instructions for Part 11, later.

Sign Here

I Signature of U.S. person ►

General Instructions

Section references are to the Internal Revenue Code unless otherwise noted.

Future developments. For the latest information about developments related to Form W-9 and its instructions, such as legislation enacted after they were published, go to www.irs.gov/FormW9.

Purpose of Form An individual or entity (Form W-9 requester) who is required to file an information return with the IRS must obtain your correct taxpayer identification number {TIN) which may be your social security number (SSN), individual taxpayer identification number (ITIN), adoption taxpayer identification number (ATIN), or employer identification number (EIN), to report on an information return the amount paid to you, or other amount reportable on an information return. Examples of information returns include, but are not limited to, the following.

• Form 1099-INT (interest earned or paid)

Cat. No. 10231X

Date►

• Form 1099-DIV (dividends, including those from stocks or mutual funds)

• Form 1099-MISC (various types of income, prizes, awards, or gross proceeds)

• Form 1 099-B (stock or mutual fund sates and certain other transactions by brokers)

• Form 1 099-S (proceeds from real estate transactions)

• Form 1099-K (merchant card and third party network transactions)

• Form 1098 (home mortgage interest), 1098-E (student loan interest), 1098-T (tuition)

• Form 1 099-C (canceled debt)

• Form 1099-A (acquisition or abandonment of secured property)

Use Form W-9 only if you are a U.S. person (including a resident alien), to provide your correct TIN.

If you do not return Form W-9 to the requester with a TIN, you might be subject to backup withholding. See What is backup withholding, later.

Form W-9 (Rev. 10-2018)

Attachment B

Attachment C – Scope of Work

RFP 26.130300-003-028

1.0 Background

Virginia Commercial Space Flight Authority (“VCSFA” or “Virginia Spaceport Authority” or “VSA”) requests proposals for professional services to support Supervisory Control and Data Acquisition (SCADA) implementation at the Mid-Atlantic Regional Spaceport (MARS).

The contractor (Integrator) shall provide engineering deliverables and hands-on configuration and commissioning support for a multi-site SCADA solution using Inductive Automation Ignition as the required platform. The Scope of this contract is limited to what is referred to herein as “Phase 1,” which will focus on data ingestion, visualization and recording for select sites within the Mid-Atlantic Regional Spaceport (MARS) Complex, referred to herein as “Site 1,” “Site 2,” “Site 3,” and “Site 4.” Phase 1 is strictly read-only monitoring and data logging. No command/control, writebacks, or setpoint changes are permitted in Phase 1. Phase 2, which is outside of the scope of this contract, will expand capabilities to read and write for Phase 1 Sites as well as additional sites within the MARS Complex.

2.0 Scope

2.1 In-Scope Sites

MARS is a multi-site location requiring inter-site communications ability that will be completed in multiple phases. This initial scope shall be considered as Phase 1 and only utilized for read-only monitoring and data logging. No command/control, writebacks, or setpoint changes are permitted in Phase 1. Phase 1 scope includes the following Sites, which are facilities located within the MARS Complex. Physical separation between sites is nominally between 0.25 to 3 miles, connected primarily through a fiber optic network.

1. Site 1 (hub)

2. Site 2 (spoke)

3. Site 3 (spoke)

4. Site 4 (spoke)

Implementation sequence: VCSFA intends to implement and validate Phase 1 in the following order: (1) Site 1 hub and Site 2 integration, (2) Site 3 integration, (3) Site 4 integration.

For the purposes of proposal preparation, Offerors should estimate roughly 2000 tags and 15 screens per Site. Actual tag or screen numbers may differ and will be provided to the Awardee.

2.2 In-Scope Outcomes

The Phase 1 solution shall achieve, at minimum:

1. Telemetry for the approved Phase 1 tag sets is visible at Site 1 (hub) in real time and matches source values within defined tolerances. A list of Phase 1 tag sets will be provided to the awarded offeror.

2. Historian logging is enabled for the Phase 1 tag sets and meets minimum retention requirements.

3. Stale or missing telemetry detection is implemented, visible to operators, and verified in testing.

4. Read-only enforcement is implemented and verified.

5. Backup and restore processes are documented and demonstrated.

6. Operator dashboards, trends, and basic alarming are implemented for Phase 1 use cases.

7. Project deliverables and handover artifacts are complete and sufficient for VCSFA to operate and maintain the system without vendor lock-in.

8. SCADA related databases required for tracking tags, historians, bills of materials, that reside on the hypervisor

2.3 Out-of-Scope

Unless explicitly included as a priced option or written contract line item, out-of-scope includes:

1. Command/control, writebacks, remote control, or setpoint changes.

2. Expansion to sites beyond the Phase 1 sites.

3. Data warehouse integration.

4. Electrical construction, field wiring, conduit work, and rack installation work performed by contractor trades.

5. Classified-to-unclassified transfer solutions except as the separately priced option defined in Section 10.0.

6. Data warehouse, which will synchronize with SCADA related databases

3.0 Contracting and Execution Model

3.1 Contract Type

VCSFA’s intended structure is:

1. The Contract will be fixed price for all Deliverables (as defined in Section 7.0) through completion and acceptance of Phase 1 Services. VCSFA may authorize additional services on a Time and Materials (T&M) basis using fully burdened hourly rates established in the Contract. Contractor shall be available to provide on-call support on a T&M basis for a period of up to three (3) months following completion of Phase 1 Services.

3.2 Responsibility Split

1. VCSFA is responsible for procurement and ownership of core platform items, including Ignition licensing and server or virtual machine infrastructure.

2. VCSFA is responsible for site access coordination, safety compliance, and internal information technology (IT) approvals.

3. The Integrator is responsible for the contracted deliverables and for providing configuration and commissioning support sufficient to meet the acceptance criteria.

4. VCSFA will designate a Software Quality Auditor responsible for independent review of Integrator-delivered software and configuration artifacts and test evidence for acceptance.

5. The Integrator shall support the Software Quality Auditor by providing timely access to required artifacts (including VCSFA GitLab repository history, Ignition exports and backups, scripts, interface mappings, test cases, executed evidence, and defect or issue logs) and by participating in quality reviews as requested.

3.3 Installation and Commissioning Boundary

1. VCSFA will perform or directly manage physical installation activities such as rack/stack, cabling, and field integration unless explicitly included as a priced contract line item.

2. The Integrator shall include commissioning support required to validate connectivity, data ingestion, tag accuracy, historian logging, stale detection, access controls, and backup and restore demonstrations. The assumption is that the Integrator will perform this support remotely through VPN.

4.0 Procurement Communications and Parity Controls

1. During the solicitation, the Integrator shall not engage directly with VCSFA Engineering personnel except through the official Contracts-managed question and answer (Q&A) process.

2. Security-sensitive details may be provided in a controlled appendix and/or under non-disclosure agreement (NDA) as directed by VCSFA Contracts and Security, with parity maintained across bidders.

5.0 Technical Requirements

5.1 Required Platform

The Phase 1 SCADA platform shall be Inductive Automation Ignition.

5.2 Architecture

Phase 1 shall implement a hub-and-spoke model with Site 1 as the hub and site gateways at Sites 2, 3 and 4 as spokes.

5.3 High-Level Functional Requirements

The Phase 1 solution shall provide:

1. Real-time monitoring of telemetry values.

2. Data logging (historian) and time-series trending.

3. Alarm or event detection pathways (even if limited in Phase 1).

4. User access controls and auditability appropriate for VCSFA operations.

5. Network connectivity across Phase 1 sites under IT and Engineering constraints.

6. Data visualization through operator dashboards and trends.

5.4 Site Interface Requirements

Phase 1 shall integrate data from sites 1-4, which use various communication protocols.

The Integrator shall support the development and validation of:

1. A Phase 1 Tag Database (tag names, descriptions, units, scaling, engineering ranges, scan classes, historian classes, and alarm thresholds where applicable).

2. Site Interface Control Documents (ICDs, interface control documents) sufficient to reproduce integrations and support troubleshooting, commissioning, and Phase 2 expansion.

5.5 Network Segmentation and Security

Phase 1 shall implement segmented networks, including Virtual Local Area Network (VLAN) segmentation and Demilitarized Zone (DMZ) boundaries where required. The Integrator shall support VCSFA IT in defining and verifying network, encryption at-rest, encryption in-transit, and boundary requirements as needed for Phase 1.

5.6 Data Integrity and Time Synchronization

The Integrator shall support definition and verification of time source and synchronization approach. All ingested data shall be timestamped consistently and traceably.

5.7 Historian and Data Retention

1. Phase 1 shall configure a historian suitable for long-term trending and analysis.

2. Minimum retention requirement is 2 years for Phase 1 data.

3. Historian backend baseline: Microsoft SQL Server (SQL, structured query language) hosted and administered by VCSFA IT. The Integrator shall provide database configuration guidance, sizing assumptions, and validation steps. VCSFA shall provide licensing and database administration.

5.8 Stale or Missing Telemetry Detection

The Integrator shall implement stale detection behavior for representative tags and ensure operators can see stale state and likely cause (source or communications loss).

5.9 Read-Only Enforcement

Phase 1 shall enforce read-only operation. Writebacks and control functions shall be disabled or access-restricted such that operators cannot control field devices.

5.10 Version Control and Work Product Management (VCSFA GitLab) The Integrator shall use VCSFA’s GitLab repository for all Phase 1 work products and shall comply with VCSFA IT policies for repository access and authentication.

1. VCSFA will provide and control access to the GitLab repository used for Phase 1.

The Integrator shall request user accounts and access through VCSFA.

2. All work products shall be committed to the GitLab repository, including Ignition exports and backups, scripts, tag exports, database scripts, interface mappings, test procedures and results, issue logs, and release notes.

3. The Integrator shall use merge requests for changes to scripts or material configuration logic, with documented review and approval prior to merge.

4. The Integrator shall tag each release intended for deployment to a production environment with a unique release tag and accompanying release notes.

5. The Integrator shall not use public repositories or public issue trackers for VCSFA work products unless explicitly approved in writing by VCSFA.

6. Credentials, private keys, and sensitive security details shall not be stored in the repository. Such items shall be handled per VCSFA IT policy and documented in a controlled manner.

5.11 Remote Access and Secure Connectivity

Remote access by the Integrator is permitted only through VCSFA-approved secure remote access methods and only when enabled and authorized by VCSFA IT.

1. Remote access shall use VCSFA-approved virtual private network (VPN) connectivity or an equivalent secure remote access solution as directed by VCSFA

IT.

2. Multi-factor authentication (MFA, multi-factor authentication) shall be used where supported by VCSFA systems and policy.

3. Integrator access shall be least-privilege and time-bounded, enabled only during approved work windows, and revoked when not in use.

4. Remote sessions shall be logged in accordance with VCSFA IT policy. Where VCSFA tooling supports it, session recording may be required.

5. Access to operational technology (OT) networks and field interfaces shall be mediated through segmented network boundaries and approved jump hosts where directed by VCSFA IT.

5.12 Environment Separation and Release Promotion

Phase 1 shall employ separate environments to support controlled development, validation, and production operations.

1. At minimum, a development environment (DEV) and a production environment (PROD) shall be maintained. Where feasible, a staging or test environment (TEST) shall be maintained to validate releases prior to production deployment.

2. Development activities and iterative changes shall be performed in DEV (or TEST as directed) and promoted to PROD only after completion of required testing and approval under change control.

3. The production environment shall be treated as a controlled baseline.

Configuration changes to PROD shall be performed only through approved releases and documented in release notes.

4. Virtual machine snapshots may be used to support rollback planning, but shall not replace Ignition gateway backups, documented restore procedures, and tested recovery steps.

5.13 Ignition Artifacts and Release Package Requirements

Each production deployment shall be accompanied by a release package stored in the VCSFA GitLab repository and associated with the release tag.

1. Ignition gateway backup file(s) for the hub and affected site gateway(s) (e.g., .gwbk) with documented restore steps.

2. Ignition project export file(s) for affected projects (export format as supported by Ignition).

3. Tag export(s) for the Phase 1 tag database, including tag hierarchy, scaling, alarm thresholds (if used), scan classes, and historian settings as applicable.

4. A module and version inventory for each Ignition gateway environment.

5. Database schema or configuration scripts (SQL, structured query language) if changes are required to support historian or reporting functions.

6. Release notes describing what changed, why it changed, and how it was verified.

7. Test evidence summary for the release, including executed test records and any open issues with disposition or mitigation.

8. Rollback plan identifying the steps to return to the previously accepted baseline.

5.14 Software Quality, Auditing, and Test-First Verification

Phase 1 relies on a combination of software and configuration (Ignition projects, tag models, historian configuration, and scripts). The Integrator shall provide verification artifacts suitable for independent audit and long-term sustainment.

1. The Integrator shall implement a software and configuration quality approach that enables auditable, repeatable verification of Phase 1 outcomes (read-only monitoring and data logging), including requirements-to-test traceability and defect handling.

2. The Integrator shall develop a Test Plan derived from the Phase 1 requirements baseline and the agreed Phase 1 tag set. Test cases shall define inputs or preconditions, steps, expected results, and required evidence.

3. The Test Plan shall be delivered for VCSFA review and approval prior to final build activities and prior to any production deployment. Changes to test cases that affect acceptance shall be approved before execution.

4. For custom scripts or complex configuration logic, the Integrator shall implement repeatable unit-level tests or automated checks where feasible. Where automation is not feasible, the Integrator shall provide manual test procedures that are repeatable and produce objective evidence.

5. For custom scripts, interface transforms, and any non-trivial logic, the Integrator is encouraged to apply a test-first approach (write tests or checks first, then implement changes to satisfy the tests). If a test-first approach is not used for a given component, the Integrator shall document the rationale and the alternative verification method.

6. The Integrator shall maintain an issue and defect log in VCSFA GitLab, link issues to relevant test cases and release tags, and provide disposition for all open items at time of acceptance.

7. The Integrator shall provide an Acceptance Evidence Package for each production release and for final Phase 1 acceptance, including executed test records, objective evidence, and an issue or defect log with disposition.

5.15 International Traffic in Arms Regulations (ITAR)

Please see Attachment F, Section 9. “Export Control and Compliance” for terms and conditions regarding ITAR.

6.0 Integrator Tasks

Task 1: Kickoff and Integrated Execution Plan Support

1. Participate in kickoff meetings.

2. Support refinement of responsibility assignment and schedule baseline.

3. Provide a weekly status package including schedule, risks, issues, and decision needs.

4. Establish and use the VCSFA GitLab repository for Phase 1 work products, including a change workflow using merge requests and release tags.

5. Provide a remote access approach for Integrator support activities, consistent with VCSFA IT policy (e.g., VPN access method, authentication, logging, and work windows).

Task 2: Architecture and Best Practice Review

1. Review hub-and-spoke architecture for scalability, redundancy, backups, and performance.

2. Provide written findings and recommendations.

Task 3: Hardware Bill of Materials Compatibility Review

Prior to VCSFA purchase finalization, review proposed hardware and approach including:

1. Servers or virtual machines, storage sizing, network interfaces.

2. Uninterruptible power supply (UPS) strategy.

3. Protocol gateway approach.

Provide a written compatibility assessment and recommendations to reduce rework and vendor lock-in.

Task 4: Interface Definition and Integration Advisory

1. Support development and validation of Site ICDs for Site 4, Site 2, and Site 3.

2. Provide troubleshooting support for boundary interfaces, including Site 3 tenant interface and Site 4 building automation system (BAS, building automation system) boundary.

Task 5: Ignition Configuration and Build Support

Provide hands-on support to implement and validate:

1. Ignition gateways (hub and site gateways) configuration.

2. Tag database implementation.

3. Historian configuration and trending.

4. Operator dashboards and screens.

5. Basic alarming pathways as defined by VCSFA.

6. Gateway backup and restore processes and validation.

7. Data translation and tag import from each site to SCADA.

Task 6: Test Planning and Commissioning Support

1. Develop or review test plans for bench validation (FAT-like, factory acceptance test-like) and site validation (SAT-like, site acceptance test-like).

2. Develop a Test Case Suite derived from the Phase 1 requirements baseline and agreed Phase 1 tag set, including defined evidence to capture for each test.

3. Provide a requirements-to-test traceability summary sufficient to demonstrate that each Phase 1 requirement is verified by one or more test cases.

4. Deliver the Test Plan and Test Case Suite to VCSFA for review and approval prior to final build activities and prior to production deployment.

5. Maintain an issue or defect log in VCSFA GitLab during test execution, link defects to test cases, and provide disposition at time of acceptance.

6. Provide an Acceptance Evidence Package for each release and for final acceptance, including executed test records, objective evidence (screenshots, logs, exports), and the issue or defect log.

7. Support test execution and evidence collection.

8. Support commissioning activities needed to demonstrate acceptance criteria.

Baseline on-site support plan:

1. Trip 1: kickoff plus interface and architecture workshops at Site 1 (2 to 3 days).

2. Trip 2: bench or pre-deployment validation at Site 1 (2 to 3 days).

3. Trip 3: site validation window sequenced as Site 2 first (with Site 1 connectivity verification), then Site 3, then Site 4 (5 to 7 days total).

Additional site visits beyond the baseline shall be provided per request by VCSFA and priced under the T&M and travel rates established in the contract, within a NTE ceiling.

Task 7: Training and Knowledge Transfer

Provide:

1. Operator training (dashboards, trends, stale response).

2. Administrator training (gateway management, backups, user management).

3. Runbooks for routine sustainment tasks.

Task 8: Cybersecurity Evidence Support

Baseline requirement:

1. Required: configuration and security checklist evidence for segmentation, encryption, access controls, patch baseline documentation, and audit logging verification as part of acceptance package.

2. Optional: deeper Software Quality Evaluation (SQE, software quality evaluation) support as a separately priced option or as directed within a T&M NTE scope.

7.0 Deliverables

All deliverables shall be provided in a form that allows VCSFA to operate, maintain, and recreate the deployed system without vendor lock-in.

7.1 Data Rights and Deliverable Ownership

1. VCSFA shall receive all configuration artifacts created or modified for Phase 1, including Ignition project exports, gateway backups, tag database exports, scripts, interface mappings, alarm definitions, and test procedures and results.

2. Any license-back construct must not restrict VCSFA use of Phase 1 deliverables.

3. Reference Attachment F, Section 7. “Records, Work and Intellectual Property” for terms and conditions of data rights and intellectual property.

7.2 Deliverable Packaging and Handover Format

Deliverables shall be handed over as a complete package suitable for independent operation and redeployment by VCSFA, including:

1. Ignition gateway backup files and project exports for hub and each site gateway, with documented restore steps.

2. A version-controlled export of the Phase 1 Tag Database and the final tag list used for acceptance.

3. As-built architecture package including network logical diagram as allowed, VLAN and DMZ description as allowed, server inventory, patch levels, backup schedules, and restore steps.

4. Test package: test plans, executed test records, objective evidence, and an issue log with disposition.

5. Operations package: administrator runbook, operator quick-start guide, and training materials.

6. Lifecycle cost summary and ownership recommendations.

7. GitLab repository access confirmation for VCSFA and the Integrator, including repository structure, branch and merge request workflow, and release tags corresponding to deployments.

8. Release package(s) for each production deployment, including the Ignition artifacts and test evidence defined in Section 5.13.

7.3 Minimum Deliverable List (Base Scope)

D1: Phase 1 Requirements Baseline (Integrator supports review and provides inputs;

VCSFA approves baseline)

D2: Phase 1 Tag Database

D3: Site ICDs – Sites 2, 3 and 4

D4: Review and validate VCFSA’s current Network and Segmentation Plan (as allowed for disclosure).

D5: Review and validate VCSFA’s current Hardware Bill of Materials and Compatibility Assessment.

D6: Review and validate VCFSA’s current Ignition Architecture and Configuration Plan.

D7: Ignition Project and Gateway Configuration Artifacts (exports and backups).

D8: Dashboards, Screens, Trends (Phase 1 operator views).

D9: Test Package (plans, executed records, objective evidence, issue log).

D10: Complete As-Built Architecture Package (currently at 30% design)

D11: Training and Runbooks.

D12: Lifecycle and Recurring Cost Summary plus Ownership Recommendations.

D13: Configuration Management Release Package (final baselines packaged for VCSFA control).

D14: Software Quality and Audit Evidence Package (subset of D9 and D13 packaged as an auditable submission, including test case suite, executed evidence, defect disposition, and release verification summary).

Note on Tasks and Deliverables There is a logical correspondence between the numbered tasks and the numbered deliverables, but the SOW is not written so that “Task 1 = D1, Task 2 = D2, Task 3 = D3,” and so on. Instead, the tasks are the work activities, and the deliverables are the outputs that come out of multiple tasks.

The approximate correspondence is presented below.

• Task 1 (kickoff / execution planning / GitLab / remote access) supports D1 and parts of D13.

• Task 2 (architecture review) supports D6 and feeds D10.

• Task 3 (hardware BOM review) maps to D5.

• Task 4 (site ICDs / interface troubleshooting) maps to D3 and feeds D4.

• Task 5 (Ignition build/configuration) feeds D2, D6, D7, and D8.

• Task 6 (test planning / commissioning / evidence) feeds D9 and D14 and supports acceptance.

• Task 7 (training / knowledge transfer) maps directly to D11.

• Task 8 (cybersecurity evidence support) does not have a clean standalone deliverable number; it is mostly absorbed into D14 and the release/evidence package structure.

The correspondence is many-to-many, not 1-to-1.

• Tasks describe how the work gets done

• Deliverables describe what must exist at acceptance

8.0 Verification, Acceptance, and Handover

8.1 Acceptance Criteria

Phase 1 is accepted when:

1. Telemetry from each site’s agreed tag set is visible at Site 1 in real time and matches source values within defined tolerances.

2. Historian is recording per defined collection classes.

3. Stale telemetry detection works for representative tags and correctly indicates source or communications loss conditions.

4. User access restrictions are implemented and validated (administrator vs operator).

5. Redundancy behavior meets defined failover expectations, or gaps are documented and approved.

6. Deliverables in Section 7.0 are complete and approved by VCSFA engineering governance.

7. Software Quality Auditor review of the acceptance package is complete, with no unresolved critical defects preventing safe Phase 1…