A.01.30_Updated_PWS_17_Jan_19.pdf

PERFORMANCE WORK STATEMENT (PWS)

SCADA Consulting Services

Little Rock District Army Corps of Engineers

Part 1

General Information

1. GENERAL: This is a non-personal services contract to provide security system upgrades and technical support/consultation services for an existing CCURE 9000 security system. The Contractor shall furnish and install hardware, equipment, software and perform integration/programming/commissioning to accomplish items as identified in the detailed statement of work, and three years (base year plus two option years) of telephone technical support and an 8 hour training session. The Contractor shall provide one three day of on-site support visit to the master station or remote plants for a total 24 hours on site plus travel time. The on-site support site visit shall be included in the telephone technical support contract. One visit will be required for the base year, and one visit for each of the option years. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all labor, personnel, equipment, supplies, travel, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the work required. The contractor shall perform to the standards in this contract.

1.2 Background: The security systems were upgraded to an ENDURA/CCURE 9000 platform in 2012 and 2013. These systems are installed at seven facilities in Little Rock District’s boundaries. The master plant, Table Rock (TR) Power Plant, is located at Branson, MO and the six remote plants are located as follows: Beaver (BV) Power Plant is located near Eureka Springs, AR. Norfolk (NF) Power Plant is located near Mountain Home, AR. Bulls Shoals (BS) Power Plant is located near Mountain Home, AR. Greers Ferry (GF) Power Plant is located near Heber Springs, AR. Dardanelle (DR) Power Plant is located at Dardanelle, AR. Ozark (OZ) Power Plant is located at Ozark, AR

1.3 Period of Performance: The work shall be accomplished as follows:

The plant upgrade tasks shall be completed not later than 120 days after the contractor receives notice to proceed for this contract award. The consultation/Technical Support shall be provided for one year from receipt of notice to proceed, with two additional option years.

1.4 Schedule

The Contractor shall develop and submit a schedule in accordance with period of performance requirements for approval. Submit schedule for approval within 15 days after notice to proceed. The schedule shall include as a minimum: Start date at each project, Commissioning dates for each project, completion date for each project, Training date, and contract closeout date. Only one plant can be upgraded at a time.

The existing security system shall remain operational until it has been upgraded.

1.5 Place of Performance: The on-site work shall be conducted at six hydroelectric power plants in Arkansas and one plant in Missouri. The site locations are:

US Army Corps of Engineers Beaver Power Plant 774 Dam Site Road Eureka Spring, Arkansas 72631

US Army Corps of Engineers Bull Shoals Powerhouse:

2737 Powerhouse Road Lakeview, Arkansas 72642

US Army Corps of Engineers Dardanelle Power Plant 1022 Dam Road Dardanelle, Arkansas 72834

US Army Corps of Engineers Greers Ferry Plant 700 Heber Springs Road North Heber Spring, Arkansas 72543

US Army Corps of Engineers Norfork Powerhouse:

1487 Hwy 177 South Salesville, Arkansas 72653

US Army Corps of Engineers Ozark Power Plant 1204 Aux Arc Park Rd Ozark, Arkansas 72949

US Army Corps of Engineers Table Rock Power Plant 760 Hatchery Road Branson, Missouri, 65616

1.6 General Information

1.6.1 Quality Control The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract.

The Contractor shall submit his quality control program to the Government for approval.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays:

New Year’s Day Labor Day

Martin Luther King Jr. Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

1.6.4 Hours of Work: On site work shall be accomplished during normal works for the District’s Power plant. Normal work hours are 0630 to 1700 Monday through Thursday each week. On site work shall not be conducted on Federal Holidays.

1.6.5 Type of Contract: The government will award a firm fixed price contract.

1.6.6 Security Requirements: Contractor personnel shall be prepared to show picture identification for access to Corps facilities.

1.6.7.1 PHYSICAL AND CYBER Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use and copies of programming performed by Contractor. At the close of each work period, government facilities, equipment, and materials shall be secured.

The Contractor shall sign a non-disclosure agreement to protect information about the existing and new security system. All site specific information shall be secured when not attended by persons with level II certification. In no circumstances are contractor personnel without level II certification be allowed to have access to Little Rock District’s security system and site specific documentation.

1.6.7.2 National Threat Levels: The National Threat Level could be moved to a higher level during the course of this contract resulting in work delays. If there is a delay of more than one week the Contractor may be eligible for a time extension.

1.6.7.3 Cyber Security Training: The Contractor shall complete Government provided Cyber Security training and sign an acceptable use policy.

1.6.7.4 Security Background Certifications/Clearances: The Contractors personnel will be subject to background checks in accordance with Army and DOD regulations.

Security background checks will require level II certifications/clearances for all personnel with access to the Government security system and associated documentation.

1.6.7.5 Vehicles. Private vehicles of the Contractor shall enter and leave the project through approved means. Parking of private vehicles shall be restricted to areas designated by the Contracting Officer.

1.6.8 Special Qualifications: The Contractor’s integrators and consultants shall meet the following minimum contractor experience/certifications in order to be considered qualified to perform this work. These are required for all personnel performing installation or programming work on the Government security system. The Contractor shall submit data to confirm compliance with the minimal qualifications with their proposal.

1. The Contractor must provide a Software house “Dealers Certification” and “Enterprise Partner” certifications for the equipment supplier and integrators.

2. The integrator(s) shall have software house “Advanced Integrator” certification.

3. A minimum of five (5) years programming experience with CCURE 9000 Enterprise Systems.

4. Shall have programmed at least five project upgrades of CCURE 9000 Enterprise systems.

5. Level 2 Security Background clearance for all personnel with access to the Government security system or associated documentation.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5.

The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract:

issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11. CONTRACTOR MANAGEMENT REPORTING (CMR) The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor shall report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract. The Contractor shall completely fill in all the information in the format using the following web address https://Contractormanpower.army.pentagon.mil. The required information includes: (1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative (COTR) or also known as the Contracting Officer’s Representative (COR); (2) Contract number, including task and delivery order number;

(3) Beginning and ending dates covered by reporting period; (4) Contractor's name, address, phone number, e-mail address, identity of Contractor employee entering data;

(5) Estimated direct labor hours (including sub-Contractors); (6) Estimated direct labor dollars paid this reporting period (including sub-Contractors); (7) Total payments (including sub-Contractors); (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub-

Contractor if different); (9) Estimated data collection cost; (10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information); (11) Locations where Contractor and sub- Contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website); (12) Presence of deployment or contingency contract language; and (13) Number of Contractor and sub-Contractor employees deployed in theater this reporting period (by country). As part of its submission, the Contractor shall provide the estimated total cost (if any) incurred to comply with this reporting requirement.

Reporting period shall be the period of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a Contractor’s system to the secure website without the need for separate data entries for each required data element at the website. The specific formats for the XML direct transfer may be downloaded from the website.

1.6.12 Work by the Government Concurrent with Contractor work. It is possible that Government will have other work by Contractor or Government employees at or near the site of this work. The Contractor shall fully cooperate with other contractors or Government employees, heeding any direction by the Contracting Officer.

1.6.13 Safe Clearance Procedure. A Safe Clearance System as required by EM 385- 1-1 is in use by project personnel to safeguard personnel and equipment and provide continuity of service. Any work by the Contractor requiring equipment to be out of service will be coordinated with the Government to obtain a clearance. Contractor personnel may not violate Safe Clearance procedures. A copy of the procedure will be supplied upon request. The awarded contractor shall meet minimum identified requirements and comply with applicable USACE Engineering Manual (EM)-385-1-1, NFPA-241 and applicable federal OSHA regulations. The most stringent standard shall apply. The contractor shall submit an Activity Hazard Analysis Plan. The format of this plan shall be in accordance with USACE EM-385-1-1. Any work involving hazardous chemicals or materials must be done in a manner that it will not expose government or contractor employees to any unsafe or unhealthy conditions.

1.6.14 Payment. The contractor will be eligible for partial payment upon submission of a proper invoice at the successful completion of each power plants upgrade including completion of commissioning and completion of deficiencies at the plant and the master plant interface for the remote plant. Invoices for off-site consulting/technical support shall be made monthly or quarterly at the Contractors option. Submit invoices to the Contracting Officer and other financial points of contact.

1.6.15 Deliveries. The awarded contractor shall deliver all components required for this contract FOB to individual receiving facility. Forklift/crane assistance may be provided when notification of assistance is scheduled with proper advance notice with plant personnel. Deliveries shall be received by a Contractor employee. The Government will not be responsible for acceptance of Contractor items delivered to the Government sites. Acceptable delivery times (excluding federal holidays) to the power plant are: Monday through Thursday, 6:30AM-4:30PM.

1.7 Pre Award Site Visit: Prospective bidders are encouraged to visit the power plants in order to document the existing security system prior to submitting a proposal. On-site visits shall be scheduled in advance and occur during normal duty hours of plant personnel, Mon-Thu, 6:30am-5pm excluding federal holidays. Only one site visit will provided at a time and date approved by the Government. Please contact the Contracting Officer to request a site visit. All Contractor personnel participating in the on-site visits shall present documentation of having a level II security background certification completed and sign a non-disclosure statement prior to the visit. Refer to other requirements in this solicitation regarding site visits.

1.8 Submittal Format. The Contractor shall submit all information to the Government in Microsoft compatible media format. Submittals may be required to be submitted on CD’s or by other means depending on the size of the submittals. Technical submittals shall be sent to the following individuals:

US Army Corps of Engineers Little Rock District 700 West Capitol Little Rock, AR 72203-0867 Attn: Robert Johnson Email: robert.a.johnson@usace.army.mil

Phone: 501-340-1345

US Army Corps of Engineers Bull Shoals Power Plant 700 West Capitol Little Rock, AR 72203-0867 Attn: Dion Cruz Email: dion.a.cruz@usace.army.mil

Phone: 870-431-5391 X4015

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor having a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations.

This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. DELIVERABLE. Anything that can be physically delivered but may include non-physical things such as meeting minutes.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11. SUBCONTRACTOR. One that enters into a contract with a prime contractor.

The Government does not have privity of contract with the subcontractor.

2.1.12. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. WORK WEEK. Is defined as Monday through Thursday, unless specified otherwise.

2.1.13 SCHEDULE. Detailed schedule showing start and stop dates for training sessions. The Contractor shall submit this schedule for review and approval by the Contracting Officer. The Contracting Officer shall review and provide any comments back to the Contractor within 30 calendar days.

2.1.15 CONTRACTORS EXPERIENCE AND CERTIFICATION: The Contractor shall submit copies of previous experience documenting requirements of paragraph 1.6.8 with their proposal. Include dates of experience, location of work, name of hydroelectric facilities, and name and phone number, Failure to document experience shall result in rejection of the contractors proposal.

2.2. ACRONYMS:

AFARS Army Federal Acquisition Regulation Supplement

AR Army Regulation

CCE Contracting Center of Excellence

CFR Code of Federal Regulations

CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative

COTS Commercial Off-the-Shelf

DA Department of the Army

DD250 Department of Defense Form 250 (Receiving Report)

DD254 Department of Defense Contract Security Requirement List

DFARS Defense Federal Acquisition Regulation Supplement

DMDC Defense Manpower Data Center

DOD Department of Defense

FAR Federal Acquisition Regulation

HIPAA Health Insurance Portability and Accountability Act of 1996

KO Contracting Officer

OCI Organizational Conflict of Interest

OCONUS Outside Continental United States (includes Alaska and Hawaii)

ODC Other Direct Costs

PIPO Phase In/Phase Out

POC Point of Contact

PRS Performance Requirements Summary

PWS Performance Work Statement

QA Quality Assurance

QAP Quality Assurance Program

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Program

QDR Quality Deficiency Report

TE Technical Exhibit

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1 Facilities: The Government will provide a workplace at the power plant during on-site visits. Restroom facilities are available for use by Contractor personnel. The Contractor shall maintain ordinary care of Government furnish facilities. Power is limited to 120VAC.

3.2 Utilities: Electric power outlets are available at various work areas in the Power Plants. The Contractor shall furnish their on telephone service.

3.3 Equipment: The Government will provide access to Security equipment at the Master Power Plant and at each remote plant.

3.4 Equipment Drawings: Existing Security System drawings and associated data will be available for the contractors inspection during the site visits.

3.5 Protection of Government Property: The Contractor shall not damage or misuse Government furnished property and equipment. Any government property or equipment damaged by the Contractor shall be promptly repaired or replaced back to the original condition of the equipment at the Contractors expense. Failure to properly use and maintain Government facilities or equipment will result in prohibited use.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General; The Contractor shall furnish all labor, travel, materials, supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.0 Summary of Work:

US Army Corps of Engineers is in the process of upgrading existing components which form a district wide comprehensive security and video monitoring/storage system. This comprehensive system is an “ Enterprise Level” system comprised of seven individual security systems located at powerhouses and dams within the Little Rock District.

Locations are identified in paragraph 1.5. The existing security system is a Windows OS based Softwarehouse C-Cure 9000 Security Management and Access Control application. Each system also includes a third-party Endura Video Management System (VMS) for both live video, storage and retrieval system which utilizes analog, digital and IEEE 802.3 standards. Site systems incorporate a variation of Client PC, VMS PC, Channel Encoder(s), network switch, hardware interface (iSTAR Controller), Master Application Server (MAS) and/or, Satellite Application Server(SAS). Each PC shall be provided with peripheral user interface items such as video montoring system hardware/software, keyboards, PTZ controllers, and mice. New monitors are not required for the contract. The Contractor shall connect to existing monitors. Provide necessary interface hardware.

5.1 General Tasks (Sequence of work not defined herein):

Furnish Submittals

Review/document existing configuration

Remove existing Endura VMS System and turn over to Government

Furnish and Install new CCURE 9000 and Exacqvision VMS computer station

Remove existing MAS and turn over to the Government

Furnish and Install MAS Replacement

Remove existing SAS and turn over to the Government

Furnish and Install SAS Replacement

Remove existing Pan/Tilt/Zoom keyboard/controller

Furnish and Install Pan/Tilt/Zoom keyboard/controller

Remove and install existing Video Encoders.

Furnish and install new Network Video Recorders

Remove and install existing Network Video Recorders.

Furnish and install new Video Encoders

Remove classic ISTAR Modules (existing ISTAR PRO Modules to Remain)

Furnish and Install new Ultra-ISTAR Modules and reconnect to existing circuits/wiring.

Furnish and install new CCURE software, Exacqvision Enterprise Software, Operating System.

Integrate/program new hardware and software. Configure/connect/program all field devices. Provide presets for all cameras associated with a door alarm.

Provide commissioning to verify system operations, Army Gold Disk Master Standards, etc.

Provide telephone technical support.

Provide on-site technical support.

Other items as identified in this solicitation.

Miscellaneous items as required to provide a complete and functional upgrade to the security system.

5.2 Off-Site and On-Site Consulting

5.2.1 Off-Site Consulting:

The Contractor shall provide offsite consulting and technical support services to assist the Government with technical issues related to the security system. This task shall be completed within the period of performance in Section 1.5 of this contract.

Technical support will be available at all times when technical support is open for support. The Contractor shall maintain a log of telephone support hours in 15 minute increments.

5.2.2 On-Site Consulting/Support:

The Contractor shall provide three (one in base bid and one for each option year) of on-site trips. Each on site trip shall be for 24 hours (24) of actual on-site support plus travel time. Support shall be completed within the period of performance in Section 1.5 of this contract. The date and time of site trips will be coordinated between the COR and the Contractor. Travel and Per Diem Rates for on-site support will be reimbursed at the current government rates. The Contractor will be paid for travel time in accordance with Army Travel Regulations.

5.3 Documentation:

The Contractor shall furnish documentation in electronic format and hard copy on the hardware and software provided in this contract. Any customized setup/programming developed for this project shall be included in the documentation. Provide both operations and programming documentation for the hardware and software. Include all passwords needed to access the system to make changes to the system. The documentation shall be sufficient for Government personnel to perform all operational and maintenance activities including but not limited to: Adjusting cameras, adjusting monitors, PTZ operations, calling up recordings, viewing alarms, adjusting presets, clearing alarms, and all other operational capabilities. An Administrative access shall be set up so system administrator can perform changes to the security system setup, modify, perform diagnostics, add new cameras, add new doors, change security settings and all other programming capabilities of the systems. The Contractor shall submit a copy of the documentation for Government review and approval 30 days prior to scheduling training. Any special macro's or other programs shall be furnished by the Contractor.

5.5 Programming Standards: The contractor shall follow Software House recommended programming recommendations for the Enterprise Upgrade. To include: Planning offsite Domain/Virtual Machine Creation: Permitted offsite test upgrade of Servers only; Onsite upgrade, installation and deployment of Upgraded Database(s). Compliance of the above shall include cyber security requirement shown in paragraph 5.17. All card readers shall be in set up with CAC card reading capability in accordance with FIPS 201 standards.

5.6 The supplier/contractor shall furnish a minimum three (3) year warranty on all work and materials which shall take affect after the Powerhouse/Dam security System Upgrade work has been completed and accepted by USACE. Proper documentation shall be maintained throughout the integration process which records system component functionality, comprehensive network communications viability, and component security hardening and testing. This record of documentation shall be presented to USACE COR prior to final project acceptance. All latent defects shall be corrected/repaired by the contractor at no expense to the government.

5.7 The following specific changes to each site security system are to be made and must incorporate Software House Professional Services for Enterprise Upgrade

5.8 Security System Client Computer/Component Requirements. Refer to paragraph

5.16 for list of contractor furnished hardware, software, and other components for this project. Refer to paragraph 5.15 for list of existing cameras, door readers and door alarms.

5.8.1 Security System Client Monitor Computer: Provide new Security System Client Monitor at all seven locations. Remove existing Endura WS5000 Client PC and replace/integrate with a Consolidate C-Cure Client Features with single C-Cure\Video Client Computer in accordance with software house and Exacqvision recommendations/best practices. Remove existing VMS Computer. Provide Video\C- Cure Client Workstation. Consolidate Video Features with C-Cure\Video Client Computer. These requirements apply to all seven locations. The computer shall meet the following specifications and be configured per software house recommendations and in accordance with cyber security requirement listed in section 6:

Processor: Two Intel Xeon Processor E5 Series Operating System Windows 10 Pro 64 bit Operating System Drive 275GB SSD

Storage 1TB Memory 16GB

Optical Drive DVD-Writer-SATA Networking 1GBE

Interfaces (8) USB 3.0 (4 front, 4 rear) (2) USB 2.0 Video Graphics Card (2) NVidia

GTX 1060

Video Outputs Support for up to 8 monitors DVI, HDMI, and Display port Form Factor Tower

5.8.2 Controller- iSTAR: Replace existing classic iSTAR controller with new ISTAR-Ultra SE controllers. Locations and number of devices are identified in the equipment list.

Configure new USTAR modules as required to interface with field devices and control room equipment. Provide necessary wiring, encloser and other installation components for a complete and functional installation.

5.8.3 Application Server- (MAS): Replace the existing master application server at Table Rock power plant. Provide all integration and ancillary components for a complete and functional system. Provide Windows Server 2016 operating system compatible with cyber security system requirements in section 5.17. The Operating Systems shall be set up in accordance with Army Gold Master standards.

Upgrade PC OS with: Processor: Intel Xeon E5-2630 v4 (2.2 GHz or greater)

Hard Disk Drives Dual drives: primary drive = 1TB or greater (9000 Runtime);

secondary drive = 1TB or greater (data backups). SSD is recommended.

Drive Speed 15,000 RPM or greater Memory

32GB

Minimum Network Adapter Card Intel Gigabit ET Quad Port Adapter, Gigabit Ethernet NIC, PCle x4

Optical CD/DVD Drive R/RW

Video Card(s): (2) Titanium GeForce-GTX-1070-8G Integrated Video Subsystem Database Support: (English Only) SQL Server 2016 Standard/Enterprise (64-bit) Operating System Support: Windows Server 2016 Standard & Enterprise (64-bit)

5.8.4 Application Server- (SAS): Replace Security Application Server Computer Operating Station at each of the seven plants. The computer specifications shall meeting the following as a minimum: Processor: Intel Xeon E3-1240 v5 (3.5 GHz or greater) Hard Disk Drives Dual drives: primary drive = 1TB or greater (9000 Runtime);

secondary drive = 1TB SSD or greater (data backups). Provide all integration and ancillary components for a complete a functional system.

Drive Speed 15,000 RPM or greater Memory 32GB or greater

Network Adapter Card Intel Gigabit ET Quad Port Adapter, Gigabit Ethernet NIC, PCle x4

Optical CD/DVD Drive R/RW

Video Graphics Card (2) NVidia GTX 1060 Card Integrated video subsystem (dedicated video accelerator recommended when used as a client workstation)

Database Support (English Only) SQL Server 2016 Standard & Enterprise (64-bit) Operating System Support Windows Server 2016 Standard & Enterprise (64-bit)

5.8.5 Video Encoders: Replace existing Pelco Encoders with Exacqvision encoder which is compatible with existing and new components. This is required at all seven plants. Provide all integration and ancillary components for a complete and functional system.

5.8.6 Video Recorders: Replace existing PELCO Video Servers/Recorders with Exacqvision Network Video Recorders. This is required at all seven plants. Provide all integration and ancillary components for a complete and functional system.

5.8.7 Pan/Tile/Zoom (PTZ) Controller Keyboards: Replace existing PTZ controller with integrated keyboards. Provide Exacqvision integrated keyboard model number 5000- 50100. PTZ Controller shall have programmable both fixed and programmable keypad and joystick. Provide all integration and ancillary components for a complete and functional system.

15.9 Ancillary Components: The Contractor shall furnish and install all ancillary/necessary components for complete and functional systems in accordance with the manufacturer’s recommendations even though not specifically identified to be provided. This will include keyboards, mice, speakers, power supplies, wiring, cables, connectors, documentation, licenses, etc. New monitors are not required. The contractor shall provide all necessary tools and equipment for the installation/replacement of components.

15.10 Software: The Contractor shall furnish all necessary software for the new hardware and configure software to provide a complete and functional system. Provide all software required even if not specifically identified to be provided.

15.11 Security System Requirements: The contractor shall provide all necessary labor, materials, software, equipment and services to comply with the security system requirements attached to this performance work statement.

15.12 Commissioning: The Contractor shall conduct commissioning tests of the new system which will test all points to the system and all system functions including start up and shutdown of the system. This will include testing all functions for operation of the system, but also shall include review system administration settings. The Contractor shall develop a detailed commissioning plan and submit for approval by the Government. The commissioning will be witnessed by the Government personnel.

Commissioning will be conducted after the contractor has performed internal quality verification testing. The Government will assist with the commissioning procedures by bringing in each alarm input from the seven sites. The Contractor shall submit the commissioning plan (testing plan) to the Government for approval 30 days prior to conducting the first system’s commissioning.

15.13 Army Gold Disk Master Verification: The Contractor shall provide personnel to work with Government Cyber Security Personnel to validate that the Contractor furnished software is set up in accordance with Army Gold Disk Master Standards. Any deficiency shall be adjusted by the Contractor prior to acceptance of the system.

15.13 Training: The Contractor shall provide training to operations personnel and Table Rock Power Plant. The Training shall cover all operational and maintenance activities for the system(s). Training shall be a minimum of 8 hours and shall be documented by video by the Contractor. Eight Copies of the recording shall be provided in DVD format. 16 copies of the training material shall also be provided.

Material shall include manufacturer’s literature or setup and operation of the systems which shall include step by step instructions for performing day to day operations and adjusting the program to add, delete, disable existing or new input devices. The training material shall be consolidated in a labeled three ring binder with separation tabs. An index shall be provided at the first tab. All material shall be written in English and shall be legible. Training will be held at Table Rock Power Plant.

15.14 Existing Plant Door/Controller/Camera/Access Reader List:

5. 15.1 Beaver:

1 Controller (iStar Pro) 4 Alarmed Doors 4 Readers 8 PTZ Cameras 7 Fixed Cameras

5.15.2 Bull Shoals:

1 Controller (iStar XL) 10 Alarmed Doors 10 Readers 13 PTZ Cameras 10 Fixed Cameras

5.15.3 Dardanelle:

3 Controllers (2 iStar Pro and 1 Edge) 18 Alarmed Doors 18 Readers 8 PTZ Cameras 0 Fixed Cameras

5.15.4 Greers Ferry:

6 Controllers (iStar Pro) 6 Alarmed Doors 6 Readers 7 PTZ Cameras 0 Fixed Cameras

5.15.5 Norfork:

1 Controller (iStar XL6) 6 Alarmed Doors 6 Readers 12 PTZ Cameras 8 Fixed Cameras

5.15.6 Ozark:

1 Controller (iStar Pro) 7 Alarmed Doors 6 Readers 6 PTZ Cameras 1 Fixed Cameras

5. 15.7 Table Rock Power Plant:

2 controllers (iStar Pro) 27 Alarmed Doors 27 Readers 20 PTZ Cameras 9 Fixed Cameras

5.16.0 Security System Items:

The following is a summary of required items to be supplied this contract. All items from Software House, Exacqvision, and other suppliers shall be the latest version (most recent). Provide all necessary ancillary components and software to interface with existing components and items required to make a complete and fully functional system.

Security System Items

Item Project Item Description Quantity

1 Beaver CCure 9000 SAS Server 1 2 Beaver CCure 9000 SAS Software As Required 3 Beaver Exacqvision Network Video Recorder 2

4 Beaver ISTAR ULTRA SE Door Controller with Power Supply, 8 ready with enclosure. 1

5 Beaver Client CCure and Video Viewing Station 1

6 Beaver

Software for Client CCure 9000 and video viewing station including Exacqvision Enterprise and other required software. As required

7 Beaver Exacqvision Pan Tilt View Keyboard Controller 1

8 Beaver Exacqvision Video Encoder 4

9 Beaver

Miscellaneous Materials and Supplies in order to provide a complete and functional system. 1

10 Bull Shoals CCure 9000 SAS Server 1 11 Bull Shoals CCure 9000 SAS Software As Required 12 Bull Shoals Exacqvision Network Video Recorder 1

13 Bull Shoals ISTAR ULTRA SE Door Controller with Power Supply, 8 ready with enclosure. 1

14 Bull Shoals Client CCure and Video Viewing Station 1

15 Bull Shoals

Software for Client CCure 9000 and video viewing station including Exacqvision Enterprise and other required software. As required

16 Bull Shoals Exacqvision Pan Tilt View Keyboard Controller 1

17 Bull Shoals Exacqvision Video Encoder 6

18 Bull Shoals

Miscellaneous Materials and Supplies in order to provide a complete and functional system. 1

19 Dardanelle CCure 9000 SAS Server 1 20 Dardanelle CCure 9000 SAS Software As Required 21 Dardanelle Exacqvision Network Video Recorder 1

22 Dardanelle ISTAR ULTRA SE Door Controller with Power Supply, 8 ready with enclosure. 1

23 Dardanelle Client CCure and Video Viewing Station 1

24 Dardanelle

Software for Client CCure 9000 and video viewing station including Exacqvision Enterprise and other required software. As required

25 Dardanelle Exacqvision Pan Tilt View Keyboard Controller 1

26 Dardanelle Exacqvision Video Encoder 2

27 Dardanelle

Miscellaneous Materials and Supplies in order to provide a complete and functional system. 1

28 Greers Ferry CCure 9000 SAS Server 1 29 Greers Ferry CCure 9000 SAS Software As Required 30 Greers Ferry Exacqvision Network Video Recorder 1

31 Greers Ferry ISTAR ULTRA SE Door Controller with Power Supply, 8 ready with enclosure. 1

32 Greers Ferry Client CCure and Video Viewing Station 1

33 Greers Ferry

Software for Client CCure 9000 and video viewing station including Exacqvision Enterprise and other required software. As required

34 Greers Ferry Exacqvision Pan Tilt View Keyboard Controller 1

35 Greers Ferry Exacqvision Video Encoder 3

36 Greers Ferry

Miscellaneous Materials and Supplies in order to provide a complete and functional system. 1

37 Norfork CCure 9000 SAS Server 1 38 Norfork CCure 9000 SAS Software As Required 39 Norfork Exacqvision Network Video Recorder 1

40 Norfork ISTAR ULTRA SE Door Controller with Power Supply, 8 ready with enclosure. 1

41 Norfork Client CCure and Video Viewing Station 1

42 Norfork

Software for Client CCure 9000 and video viewing station including Exacqvision Enterprise and other required software. As required

43 Norfork Exacqvision Pan Tilt View Keyboard Controller 1

44 Norfork Exacqvision Video Encoder 5

45 Norfork

Miscellaneous Materials and Supplies in order to provide a complete and functional system. 1

46 Ozark CCure 9000 SAS Server 1 47 Ozark CCure 9000 SAS Software As Required 48 Ozark Exacqvision Network Video Recorder 1

49 Ozark ISTAR ULTRA SE Door Controller with Power Supply, 8 ready with enclosure. 1

50 Ozark Client CCure and Video Viewing Station 1

51 Ozark

Software for Client CCure 9000 and video viewing station including Exacqvision Enterprise and other required software. As required

52 Ozark Exacqvision Pan Tilt View Keyboard Controller 1

53 Ozark Exacqvision Video Encoder 2

54 Ozark

Miscellaneous Materials and Supplies in order to provide a complete and functional system. 1

55 Table Rock CCure 9000 SAS Server 2 56 Table Rock CCure 9000 SAS Software As Required

57 Table Rock CCure 9000 MAS Server 2 58 Table Rock CCure 9000 MAS Software As Required 59 Table Rock Exacqvision Network Video Recorder 1

60 Table Rock ISTAR ULTRA SE Door Controller with Power Supply, 8 ready with enclosure. 1

61 Table Rock Client CCure and Video Viewing Station 2

62 Table Rock

Software for Client CCure 9000 and video viewing station including Exacqvision Enterprise and other required software. As required

63 Table Rock Exacqvision Pan Tilt View Keyboard Controller 2

64 Table Rock Exacqvision Video Encoder 8

65 Table Rock

Miscellaneous Materials and Supplies in order to provide a complete and functional system. 1

5.17. Cybersecurity Requirements:

5.17.1 Cybersecurity consists of ensuring the security posture of the components delivered by the Contractor are at an acceptable level. Cybersecurity will be done in accordance with DoD requirements as well as in accordance with all applicable current cybersecurity regulations, policies, and processes. Reference DoDI 8500.01 and DoDI

8510.01 for details. The Contractor shall assist the Information System Owner (ISO) by providing any applicable artifacts necessary for the ISO to obtain a System Authority to Operate (ATO) via the Risk Management Framework (RMF) process in relation to the Information Technology (IT) hardware (HW) and software (SW) the Contractor is providing per this contract. The Contractor shall provide patches for vulnerabilities (vendor specific as well as globally published vulnerabilities), adhere to Information Assurance Vulnerability Alerts (IAVAs), and adhere to Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) alerts and notifications for all IT HW and SW provided by the Contractor within 30 days of notification.

5.17.2 Secure Configurations of Computer Operating Systems (OS) and Network Devices: The OS and network devices shall be configured following the principle of least privilege and application separation as described below. The OS and network devices shall be configured per the latest Security Technical Implementation Guides (STIGs) as released by the Defense Information Security Agency (DISA) and install the most current security relevant software and firmware updates. The Contractor may utilize the USACE-provided Army Gold Master image for Windows based operating systems utilized in the control system.

5.17.3 All applicable STIGs shall be implemented on the system. Any deviations from the STIGs for operational requirements or are incompatible with the production operating environment shall be documented by the Contractor, including the reason why the STIG requirements cannot be met. The Contractor shall utilize the Security Configuration Automation Protocol (SCAP) tool, or similar scanning tool or a manual check, to scan the computers using the latest benchmarks released by DISA appropriate for the system and network devices provided. The scan results shall be imported into the DoD STIG Viewer or equivalent and the completed checklist shall be provided by the contractor to demonstrate the secure configuration of all devices.

5.17.4 Unnecessary Software and Services: The Contractor shall ensure that any unnecessary software not required for the operation and maintenance of the control system is removed from all computers on the system. Software related to games, entertainment, unnecessary diagnostic packages, etc. shall not be installed on the system computers. The Contractor shall remove or disable all services and ports on the supplied computers which are not required for normal, emergency, or troubleshooting operations. Unnecessary services on the automation hardware, such as web servers, shall be disabled in configuration when not required for normal or emergency operations or troubleshooting.

5.17.5 Complete Software Listing: The Contractor shall provide a comprehensive software listing for each computer on the control system. The listing shall include the software name, vendor, and version number at a minimum.

5.17.6 Complete Hardware Listing: The Contractor shall provide to the Government a complete listing of all hardware devices to be utilized on the control system. The listing shall include all PLCs and related components, computers, network devices, interface converters, and similar devices. The listing shall include the Manufacture, Model Number, Firmware Version Number (where applicable), and Installation Location at a minimum.

5.17.7 Ports, Protocols, and Services: The Contractor shall provide a comprehensive listing of the Ports, Protocols, and Services necessary for normal operations, emergency operations, and troubleshooting of the control system.

5.17.8 Default Passwords: The Contractor shall change any default passwords on the equipment provided under this contract, including any PLCs, HMI, and network devices.

A comprehensive listing of the passwords required to properly operate, maintain, and troubleshoot the system shall be provided to the Government. If a default password that cannot be changed is present on any configurable device provided under this contract, it shall be disclosed to the Government in writing.

5.17.9 Principle of Least Privilege: The Contractor shall configure the system using the principle of least privilege, including operating system permissions, file access, user accounts, and application-to-application communications. The control system shall be configured using a role-based scheme so that normal operations occur using an Operator level account with minimum privileges required to operate the system. The Contractor shall document the minimum privileges required for the Operator level account. Administration-level (privileged access) accounts shall be required to perform any configuration changes on the system. All required service accounts should be created as normal users with no administrative permissions. Separate administration-level accounts shall be provided for each administrator on the system. Removable media devices and USB ports (with the exception of keyboard and mouse) shall be disabled for Operator level accounts. The availability of the USB ports and removable media devices shall be configurable using the accounts on the system. Unnecessary/unused accounts shall be removed from the control system. Any “guest-level” accounts that are created on the System by default shall be disabled.

5.17.10 Account Management: The Contractor shall provide a comprehensive Account Listing for each configurable device on the control system. This includes any application accounts, OS accounts, network device accounts, service accounts, or communications accounts. The listing shall provide the unique username and password for each account on each device on the system. The username and account information is sensitive and shall be protected by the Contractor. The listing shall be provided in encrypted form to the COR. Passphrases required to decrypt the data shall be provided to the COR in a separate communication.

5.17.11 Basic Input/output System (BIOS) protection: A protection mechanism shall be provided to prevent unwanted changes to the system BIOS for all devices on the system where feasible. A password meeting DISA STIG requirements shall be utilized.

The passwords used for BIOS protection shall be provided to the Government to allow access by system engineering/administrative personnel after initial commissioning of the system.

5.17.12 Antivirus/Antimalware Software: The computers on the control system shall include most up to date DoD approved antivirus software with up to date signatures.

The Contractor shall verify that the Antivirus/ antimalware software will not negatively affect the operation of the control system. Computers and servers being installed on the system shall be configured with up-to-date antivirus signatures, not older than 10 days, prior to deployment. Evidence of a clean scan shall be provided to the government prior to installing a computer onto the control system.

5.17.13 Logging and Auditing: The control system shall log critical events and operator actions related to the operation of the control system. The Log of operator actions shall not be accessible via any accounts on the system without privileged level access. The operations log shall include a time stamp, the control action taken, and the account via which the action was initiated. OS logging shall be configured per the STIG requirement without exception, including the specified minimum log sizes defined in the STIGs.

5.17.14 Communications: Communications using either the public switched telephone network, leased lines, or any wireless between the different locations and between different facilities on the same location shall be protected via 140-2 compliant encryption methods. Virtual Private Network IPSec tunnels shall be established between the different facilities using approved network devices to include all wireless devices.