H399--Annual Workplace Evaluation and Physical Security Assessment

THIS IS MARKET RESEARCH ONLY AND NOT A SOLICITATION We are looking for interested and qualified companies that can meet the Draft Statement of Work Requirements STATEMENT OF WORK 9-14-2023 Annual Workplace Evaluation and Physical Security Assessment Introduction/Background As one of the administrations within the Department of Veterans Affairs (VA), the Veterans Benefits Administration (VBA) provides a variety of benefits and services to service members, veterans, and their families. These benefits and services include but not limited to education benefits, home loans, life insurance, and disability compensation or pension benefits. Award of these benefits often requires information gathering from a multitude of third parties, government agencies, and digital repositories as well as the application of complex rules. VBA owns and operates a substantial infrastructure portfolio within the National Capital Region (NCR) and Regional Offices throughout the nation. VBA is committed to protecting its workers by conducting annual inspections and assessments consistent with direction from the VBA Office of Mission Support (OMS) Occupational Safety and Health (OSH) Division. The inspections and assessments focus on two major task categories: Annual Workplace Evaluation (AWE) which inspects workplace hazards by evaluating the Occupational Safety and Health programs/elements/requirements. Physical Security Assessments for best practices to mitigate vulnerabilities and threats and countermeasures for specific aspects in the following areas: Facility Overview Facility Security Background Security Force Profile Physical Security Profile Comprehensive Security Systems. VBA accomplishes these inspections through the services of a contractor with the necessary safety expertise and physical security expertise. This approach ensures that VBA receives expert and third-party feedback on safety and physical security. The purpose of this procurement is to engage a highly skilled contractor with expert knowledge and extensive experience as well as credibility in these critical areas of safety and physical security. This document outlines the scope and steps to be taken to create a methodology that promotes consistency, ensures thoroughness, and enhances the quality of the assessment process. Scope The VBA Office of Mission Support (OMS) Occupational Safety and Health (OSH) Division seeks the support of a highly experienced Contractor with broad and extensive technical expertise in two Task Areas 1) Annual Workplace Evaluation and 2) Physical Security Assessments to provide an array of support for numerous VBA District/Regional Offices and select out-based sites. Personnel assigned to the Task Areas shall be specialized and certified in their respective skill areas. Required service areas include: Task Area 1: Annual Workplace Evaluations Annual Workplace Evaluations (AWE) encompass inspections and the completion of checklists and reports for the Occupational Safety and Health (OSH) Programs, which include but are not limited to the following safety programs/elements/requirements: Life Safety Electrical Safety Lock Out/Tag Out, Construction Safety, General Work Environment Housekeeping Medical Services and First Aid Personal Protective Equipment (PPE), Hazard Communication (Global Harmonization System), Federal Agency Requirements, and OSH Training Task Area 2: Physical Security Assessments Physical Security Assessments (PSA) encompass two-year assessment cycles for Regional Offices and three-year assessment cycles for Out-Based Offices and the completion of checklists and reports for: Facility Overview Security Force Profile Entry Controls Employees/Visitors (Badging) Parking Delivery Standoff Barriers, Locks, and Keys Building Envelope Intrusion Detection and Assessment Communications Testing and Maintenance Support Systems, and Systems Management Applicable Criteria Documents The Contractor shall comply with the criteria documents listed below in three categories: 3.1) General Applicable Criteria Documents; 3.2) Annual Workplace Evaluation Criteria Documents; and 3.3) Physical Security Assessment Criteria Documents. General Applicable Criteria Documents:  44 U.S.C. § 3541-3549, Federal Information Security Management Act (FISMA) of 2002  44 U.S.C. § 3551-3558, Federal Information Security Modernization Act (FISMA) of 2014.  Health Insurance Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule dated February 20, 2003 36 C.F.R. Part 1194 Information and Communication Technology Standards and Guidelines, January 18, 2017 Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110 140), December 19, 2007. Section 104 of the Energy Policy Act of 2005, (Public Law 109 58), August 8, 2005. 5 U.S.C. § 552a, as amended, The Privacy Act of 1974.   Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters.  Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998. 36 C.F.R. Part 1194 Electronic and Information Technology Accessibility Standards.   Section 701 of the Promise to Address Comprehensive Toxics (PACT) Act of 2022 (Public Law 117-168), August 2, 2022 Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103 Social Security Number (SSN) Fraud Prevention Act of 2017 Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018 Federal Travel Regulation (FTR) (www.gsa.gov/federaltravelregulation) Executive Order 13693, Planning for Federal Sustainability in the Next Decade, dated March 19, 2015. Executive Order 13221, Energy-Efficient Standby Power Devices, August 2, 2001. Executive Order 13834, Efficient Federal Operations, dated May 17, 2018 Executive Order 13960, Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government, dated December 3, 2020. Executive Order 14026, Increasing the Minimum Wage for Federal Contractors, dated April 27, 2021. Executive Order 14028, Improving the Nation's Cybersecurity, dated May 12, 2021. Executive Order 14034, Protecting Americans' Sensitive Data from Foreign Adversaries, dated June 9, 2021. Executive Order 14058, Transforming Federal Customer Experience and Service Delivery to Rebuild Trust in Government, dated December 13, 2021.  Homeland Security Presidential Directive (12) (HSPD-12) , August 27, 2004. Office of Management and Budget (OMB) Circular A-130, Managing Federal Information as a Strategic Resource, July 28, 2016. OMB Memorandum Security Authorization of Information Systems in Cloud Computing Environments, December 8, 2011 (FedRAMP Policy Memorandum) OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005 OMB Memorandum M-08-05, Implementation of Trusted Internet Connections (TIC), November 20, 2007. OMB Memorandum M-08-23, Securing the Federal Government s Domain Name System Infrastructure, August 22, 2008. OMB Memorandum M-04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003. OMB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005. OMB Memorandum M-11-11, Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011. OMB Memorandum M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 21, 2019. OMB Memorandum M-19-26, Update to the Trusted Internet Connections (TIC) Initiative, September 12, 2019 OMB Memo M-21-06, Guidance for Regulation of Artificial Intelligence Applications, dated November 17, 2020. OMB Memorandum M-21-07, Completing the Transition to Internet Protocol version 6 (IPv6), November 19, 2020. OMB Memo M-21-30, Protecting Critical Software Through Enhanced Security Measures, dated August 10, 2021. OMB Memo M-22-01, Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response, dated October 8, 2021. OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022. OMB Memorandum for Chief Information Officers, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017.  Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, V2.0, December 2, 2011. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 798, Mobile, PIV, and Authentication, March 2014. Federal Information Processing Standards (FIPS) Publication 140-2, Security Requirements for Cryptographic Modules, May 25, 2001. FIPS 186-5, Digital Signature Standard (DSS), dated February 3, 2023. FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004. FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006. FIPS Publication 201-3, Personal Identity Verification of Federal Employees and Contractors, January 2022. FIPS Special Publication 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIS Special Publication 800-171, February 2021. NIST SP 500-267B Revision 1, USGv6 Profile, November 2020 NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, Rev. 2, December 20, 2018. NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, dated May 26, 2022.  NIST SP 800-57, Recommendation for Key Management, dated May 4, 2020. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, December 1, 2017. NIST Special Publication (SP) 800-66 Rev 2 (Draft): An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, July 2022. NIST SP 800-116 Rev. 1, Guidelines for the Use of PIV Credentials in Facility Access, June 29, 2018. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 19, 2014. VA Directive 0058, VA Green Purchasing Program, July 19, 2013 (https://www.va.gov/vapubs/index.cfm) VA Handbook 0058, VA Green Purchasing Program, July 19, 2013 (https://www.va.gov/vapubs/index.cfm) VA Handbook 0710, Personnel Suitability and Security Program dated May 2, 2016   VA Directive 0710, Personnel Security and Suitability Program, June 4, 2010, (https://www.va.gov/vapubs/index.cfm) VHA Directive 1605.05, Business Associate Agreements, November 17, 2020, (https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=9178) VA Directive and Handbook 6102, Internet/Intranet Services, August 5, 2019 (https://www.va.gov/vapubs/index.cfm)  VA Directive 6102 (Internet/Intranet Services), August 5, 2019 (https://www.va.gov/vapubs/index.cfm) VA Handbook 6102 (Internet/Intranet Services), August 5, 2019 (https://www.va.gov/vapubs/index.cfm VA Directive 6300, Records and Information Management, September 21, 2018 (https://www.va.gov/vapubs/index.cfm) VA Handbook, 6300.1, Records Management Procedures, March 24, 2010 (https://www.va.gov/vapubs/index.cfm) VA Directive 6500, VA Cybersecurity Program, February 24, 2021 (https://www.va.gov/vapubs/index.cfm) VA Handbook 6500, Risk Management Framework for VA Information Systems Tier 3: VA Information Security Program, February 24, 2021 (https://www.va.gov/vapubs/index.cfm) VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information (SPI), March 12, 2019 (https://www.va.gov/vapubs/index.cfm) VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle, March 22, 2010 (https://www.va.gov/vapubs/index.cfm) VA Handbook 6500.6, Contract Security, March 12, 2010 (https://www.va.gov/vapubs/index.cfm) VA Handbook 6500.8, Information System Contingency Planning, April 6, 2011 (https://www.va.gov/vapubs/index.cfm) VA Handbook 6500.10, Mobile Device Security Policy, February 15, 2018. VA Handbook 6500.11, VA Firewall Configuration, August 22, 2017. VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment, October 15, 2014. VA Handbook 6508.1, Procedures for Privacy Threshold Analysis and Privacy Impact Assessment, July 30, 2015. VA Directive and Handbook 6510, VA Identity and Access Management, January 15, 2016. A Directive and Handbook 6513, Secure External Connections, October 12, 2017 VA Directive and Handbook 6517, Risk Management Framework for Cloud Computing, November 15, 2016. VA Directive 6609, Mailing of Sensitive Personal Information, May 20, 2011 (https://www.va.gov/vapubs/index.cfm) VA Handbook 0730, Security and Law Enforcement, dated August 11, 2000. (https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=93&FType=2) VA Handbook 0730/1, Security and Law Enforcement, dated August 20, 2004. (https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=96&FType=2) VA Handbook 0730/4, Security and Law Enforcement, dated March 29, 2013. (https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=700&FType=2) VA Directive 6066, Protected Health Information (PHI) and Business Associate Agreements Management, dated September 2, 2014. VA Regulation 2022-13312, Individuals Using the Department of Veterans Affairs Information Technology Systems to Access Records Relevant to a Benefit Claim, dated June 24, 2022. Authorization Requirements Standard Operating Procedures, v1.35, dated April 13, 2022.  BTS Emergency Notification SOP, v2.0, dated July 22, 2021 Veteran Focused Integration Process (VIP) Guide 4.0, January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 One-VA Technical Reference Model (TRM) - (reference at https://www.va.gov/trm/TRMHomePage.aspx) VA Enterprise Cloud Technical Reference Guide, v2.0, dated November 2022. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014. VA Enterprise Cloud (VAEC) Technical Reference Guide, July 2018 version 1.  IAM Identity Management Business Requirements Guidance Document , May 2013. https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514  VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 VA Memorandum, VAIQ #7712300, Mandate to meet PIV Requirements for New and Existing Systems, June 30, 2015.  VA Memorandum, VAIQ #7660995, Continuous Diagnostics and Monitoring of all VA Information Systems, dated January 29, 2016. VA Memorandum, VAIQ #7497987, Compliance Electronic Product Environmental Assessment Tool (EPEAT) IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section. https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552  Office of Information Security (OIS) VAIQ #7424808 Memorandum, Remote Access, January 15, 2014. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28  VA Memorandum, VAIQ #7614373, Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems, July 9, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28  VA Memorandum, VAIQ #7613595, Mandatory Use of PIV Multifactor Authentication to VA Information System, June 30, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28  VA Memorandum, VAIQ #7613597, Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges, June 30, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28  VA Memorandum Personal Identity Verification (PIV) Logical Access Policy Clarification, July 17, 2019 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896  VA Memorandum, VAIQ #7581492, Use of Personal Email, April 24, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28  VA Memorandum VAIQ #7823189, Updated VA Information Security Rules of Behavior, September 15, 2017. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 Records Control Schedule VB-1, dated January 31, 2014. Annual Workplace Evaluation Criteria Documents. 29 CFR 1904 Recording and Reporting Occupational Injuries and Illnesses , latest version 29 CFR 1910 Occupational Safety and Health Standards, latest version 29 CFR 1926 Safety and Health Regulations for Construction, latest version 29 CFR 1960 Basic Program Elements for Federal Employee Occupational Safety and Health Programs and Related Matters , latest version 41 CFR Subtitle C Federal Property Management Regulations System National Fire Protection Association (NFPA) Standards, latest version General Services Administration (GSA) Lease Criteria American National Standards Institute (ANSI) VA Directive 7700 OSH Program VBA Directive 7700 OSH Program Physical Security Assessment Criteria Documents VA Handbooks 0730 Physical Security Design Manual (PDRSM) Interagency Security Committee (ISC) Risk Management Process for Federal Facilities Performance Details Performance Period The Base Period is 12 months from the contract award date. Option Period 1 is a 12-month period from the date of the exercise of the option period. Option Period 2 is a 12-month period from the date of the exercise of the option period. Option Period 3 is a 12-month period from the date of the exercise of the option period. Option Period 4 is a 12-month period from the date of the exercise of the option period. Hours of Work Work at a Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). Hours of work will be established at the contract level. The Contractor may also be required to support 24/7 operations 365 days per year as identified in the contract.  There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows: Under current definitions, five are set by date: New Year's Day January 1 Juneteenth Day June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25 If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday. The other six (6) are set by a day of the week and month: Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November  Place of Performance Locations of the work shall be at Government and Contractor sites within the Continental United States (CONUS), the Philippines, Puerto Rico, St. Thomas, and St. Croix. No work at Contractor site(s) shall be performed outside of the Continental United States (OCONUS). The primary work performed at the Government locations is identified in Appendix xxx Travel Most of the work shall require travel by the Contractor, anticipated requirements for travel include Contractor or combined Contractor/VBA staff teams performing facility assessment, visits, inspections, or training. All travel shall be in accordance with the GSA Federal Travel Regulations, Federal Acquisition Regulation (FAR) 31.205-46. Travel shall be inclusive with the price quote. In addition, all travel must be pre-approved by the Contracting Officer s Representative (COR). For AWE travel, the Contractor shall visit all the Regional Offices (ROs) and Out-Based Offices (OBOs) facilities during each period of performance. Preparation for each on-site visit shall include a Pre-Visit Conference Call, Opening Conference, and Closing Conference with the VBA identified point of contacts. These may include the facility Director, Assistant Director, Collateral Duty Safety Officer (CDSO), Security Officer, union representatives, and other personnel identified by VBA. For PSA travel, the Contractor shall visit xxx VBA facilities during the period of performance. Preparation for and each visit shall include a Pre-Visit Conference Call, Opening Conference, and Closing Conference with the VBA identified point of contacts. These may include the facility Director, Assistant Director, Collateral Duty Safety Officer (CDSO), Security Officer, union representatives, and other personnel identified by VBA. Most VBA facilities shall require a one-day visit plus travel to and from the facility. Some of the larger facilities may require 1.5 to 2 days depending on size and complexity. The Contractor shall coordinate with the facilities point-of-contact (POC) will provide the Contractor with a schedule. Contractor shall make every effort to minimize travel and combine individual visits within a normal work week. Non-Government Facilities Personnel performing at Contractor facilities shall comply with VA and/or Federal Assessment and Authorization (A&A) requirements. The Contractor shall disclose specific facility information during the solicitation process as part of the Contractor proposal. All facilities shall be approved by VA and in compliance with VA Security and Privacy. All facilities containing VA source materials shall be compliant with 36 CFR Part 1234, Subpart B, with no exceptions made for the waivers discussed within 36 CFR Part 1234, Subpart B. Contractor Acquired Equipment The Contractor shall acquire and/or provide any hardware and/or software required to accomplish the contract that is not provided as Government Furnished Property (GFP). All hardware/software must adhere to VA information technology (IT) requirements, including the requirement for an Authority to Operate (ATO). Software integrity shall be maintained by the Contractor within the licensing agreement of the producer. Task Description The sections below provide details. Project Management, Task Management, and Work Plan The purpose of this task is to manage and coordinate support for overall project management, ensure ongoing communications, integration and collaboration, quality, status reporting, and staff allocations; and identify and address risks and issues. This task includes overall management of the project. The Contractor shall perform the following activities: Conduct a kick-off meeting to define a common understanding of project plan, major actions, key milestones, and schedules as well as deliverables. Introduce Contractor personnel and describe the roles of individuals. Provide the staff experience profile that accomplishes the tasks in this contract. Identify the periodic meetings to discuss progress, plans, risks, and issues. Work Plan for AWE Develop a Work Plan for AWE inspections that serves as a living document throughout the period of performance and will cover the following general areas: Develop AWE best practices for inspections. Execute AWE Inspection Deployment Schedule. Document risks, issues, and FboNotice causes of deficiencies. Make recommendations for corrective actions and preventive measures. Continual improvement of AWE inspection process using information gathered from past and ongoing inspections. Work Plan for Physical Security Assessments Develop a Work Plan for Physical Security Assessments that serves as a living document throughout the period of performance and will cover the following general areas: Document risks, issues, and make recommendations for execution of the Physical Security Assessments inspections. Develop Physical Security Assessment best practices for inspections, and Develop Physical Security Assessment Deployment Schedule Two-year cycle for Regional Offices (RO) Three-year cycle for Out-Based Offices (OBO) Update the Physical Security Assessment information as may be required. The deployment schedule, whether AWE or Physical Security Assessment, shall be coordinated with and approved by a VBA identified point of contact. The deployment schedule will consider accessibility, proximity, and complexity to streamline logistics requirements. The VBA COR will work with the Contractor to develop the schedule in consideration of priorities and travel efficiency. The schedule shall reflect how the Contractor s plan will implement an efficient methodology for conducting all the required site visits (e.g., group two to three VBA facilities in a single trip so that grouped AWE Inspections or Physical Security Assessments shall be completed in a single week based on geography, proximity, and other travel considerations). Overall Managerial Activities for the Conduct of AWE Inspections and Physical Security Assessments Planning/Preparation The Contractor team shall review applicable regulations for the facility based on the answers to any pre-visit Questionnaire (developed as part of the protocol), review and prepare required forms for the visit, prepare a Contractor Team Plan for each facility visit to minimize time impacts to VBA facilities operations, and review the protocol so that all the steps will be followed to complete the evaluation or assessment. The Contractor will create the Opening Conference Guide and Facility Schedule. The VBA identified point of contacts will coordinate with the Contractor for any visits attended by additional observers beyond the expected personnel. AWE Planning and Preparation During the planning and preparation activities, AWE inspectors shall review the checklist provide by VBA requiring on-site completion (listed below and in Appendix B): OMS Checklist for Annual Workplace Safety and Health Inspections Other site-specific AWE documents At a minimum, the assessor(s) shall review the site mission and related documents to include but not limited to organization charts, OSH operational criteria for the site, site plans and procedures, past site office AWE checklist/surveys, facility plans and lists, housekeeping and custodial operations/procedures, personal protective equipment policy/procedures, alarm procedures, site maps, and architectural/engineering drawings. Architectural/engineering drawings shall include but not be limited to: Floor plans for all floors including emergency egress. Interior plans to include special room layouts and workstations. HVAC plans Electrical and lighting floor plans Plumbing plans Fire Safety floor plans Site plans including sidewalks, parking, loading dock, etc. Other site-specific plans as may be defined by contractor. Physical Security Planning and Preparation During the planning and preparation activities, physical security assessors shall review the checklist documents requiring on-site completion (listed below and in Appendices C, D and E): Facility Security Assessment: Building Engineer Questionnaire Facility Security Assessment: Cybersecurity Questionnaire Facility Security Assessment: Tenant Agency Questionnaire PACS Assessment Toolkit (Physical Access Control Systems) Other site-specific documents as may be defined by contractor. At a minimum, the assessor(s) shall review the site mission and related documents to include but not limited to organization charts, site security plans and procedures, past site office assessment checklist/surveys, site/facility asset lists, alarm procedures, and site maps/drawings. Site maps/drawings may include but not be limited to: Security areas (property protection areas, security areas, vaults, vault type rooms, etc.) Critical facilities Controlled areas Building definitions Location of security posts Classified matter areas Vital equipment areas Lighting diagrams Sensors (types, locations, controls, etc.) Alarms (types, locations, controls, etc.) Data transmission systems Console equipment, and Miscellaneous security items. The assessor shall plan and prepare for interviews of personnel to gain insight into facility operations. The assessor shall determine the organizational levels of personnel to interview to include but not be limited to security managers (government and contractor), facility managers and staff, vault/vault-type room custodians, security police officers (SPOs), security technicians/specialists, systems engineers and programmers, central alarm station (CAS), secondary alarm station (SAS) operators and other personnel as determined by the contractor and coordinated with the government representative. Interviews may be formal or informal and may take the form of discussions during facility tours or performance testing. Facility Visit The Contractor will conduct the visit. In conducting the facility visit, the Contractor will gather information that will be used to confirm compliance with applicable internal and external standards as well as the specific Checklist prepared for the facility. The facility visit will begin with an Opening Conference, review of any pre-visit Questionnaire and required checklist(s), and verification of the Facility Visit Schedule. The team will conduct interviews of staff, observe operations, and review records to gather required data and develop findings. Preliminary findings will be discussed with facility management to ensure that the information gathered is correct and the Contractor will conduct a Closing Conference to review all findings at the conclusion of the visit. AWE Conduct During On-Site Visit During the on-site visit, the AWE Inspector(s) shall conduct themselves in a professional manner as the agenda and materials prepared during the planning and preparation phase is used to guide interviews and tours in concert and coordination with on-site representatives. The Inspectors may collect information as necessary and complete the required OMS Checklist, as well as collect additional information as deemed necessary for the specific site. The Inspectors shall discuss observed deficiencies, potential concerns and previous findings that may have required attention/resolution. The Inspectors shall work with on-site representative on a action plan and timeline, if necessary, for resolving deficiencies and consider establishing a prioritized list for actions. Set-up/schedule follow-up meetings as appropriate for communication and resolution of open items. Physical Security Assessment Conduct During On-Site Visit During the on-site visit, the Physical Security Assessors shall use detailed information prepared during the planning and preparation phase to guide interviews and tours of the physical security aspects of the facility, collecting and documenting information as necessary and as appropriate. The Assessor(s) shall review common deficiencies, potential concerns, and previous findings after completing each data collection activity to determine whether any of the identified deficiencies are apparent at the facility. If so, assessors shall then determine whether subsequent activities should be reprioritized. Set-up/schedule follow-up meetings as appropriate for communication and resolution of open items. Identify and verify actions and/or documents planned to be addressed as part of the follow-up meetings. Data Synthesis / Forms/ Reports In addition to required forms and checklist, the Contractor shall create and provide a site visit report, preliminary before departure from the site and final report no later than 10-days after the site visit. The Contractor shall work with the government to propose a format for approval by the VBA Program Officer to report findings of the visit conducted, listing of the findings, any standard not being met, the location of the finding, the actual observation, and recommended corrective action to be taken. The reports shall also highlight good practices discovered during the site visits and identify those practices recommended for implementation. The reports shall also consist of year end reports as noted. AWE Reports The Contractor shall provide a summary report including the completed checklist for each site within the time frame as noted above. For standards not being met, the Contractor shall identify the specific OSH rule that has not been met and time frame recommended for when the corrective action should be completed, as well as ensure that any critical items are specifically flagged for special attention and urgent recommendation for correction. The Contractor shall also provide and an end of year report that summarizes VBA, highlighting positives from the inspections in each of the report including identification of consistent good practices that should be recognized and considered for implementation across VBA. Physical Security Assessment Reports The Contractor shall provide a summary report ensuring that the specific checklist being addressed for each site is provided within the time frame as noted above. For standards not being met, the Contractor shall identify the specific security criteria that has not been met, any security practices that should be adapted (if needed) as a stop gap, and a time frame recommended for when the corrective action should be completed to ensure consistent security practices. The Contractor shall identify any critical items specifically flagged for special attention and urgent recommendation for correction. The Contractor shall also provide and an end of year report that summarizes VBA, highlighting positive security practices from the assessments in each of the reports including identification of consistent good practices that should be recognized and considered for implementation across VBA. AWE Specialization Areas Occupational Safety and Health Administration Programs The Contractor shall be knowledgeable and experienced with the federal, agency, directives, and consensus standards/criteria on Occupational Safety and Health to ensure that VBA Regional Offices (ROs) maintain and operate with the appropriate safety and health protocols. The Annual Workplace Evaluation criteria documents listed in Section 3.2 include specific regulations that apply to the following assessments within this Section. Occupational Safety and Health Administration (OSHA) Standard 29 CFR 1926 and 1910 discuss life safety, electrical safety, general work environment, personal protective equipment, lockout/tagout, medical services and first aid, and hazard communication program as discussed in the following sections. Standard 1926 covers safety and health regulations for construction while 1910 covers OSHA standards that are promoted from national consensus standards or any established Federal standard. Standards 29 CFR 1904 and 1960 provide guidance for OSHA programs in general. Standard 1904 requires the employer to track and report any work-related deaths, injuries, or illnesses while Standard 1960 discusses standards related to OSHA programs for Federal employees. The Contractor shall coordinate with the respective Collateral Duty Safety Officers on the plan for completing the Annual Workplace Evaluation. Life Safety (Fire and Egress): During the life safety assessment, the Contractor will conduct a thorough on-site review of the facility, assess compliance with the Life Safety Code and VBA criteria. Standard 1910 Subpart E Exit Routes and Emergency Planning cover the requirements for exit routes in the workplace and Subpart L contains overall fire protection requirements. Standard 1926 Subpart F contains requirements for fire prevention and protection through all phases of construction. This includes but not limited to examining egress paths, doors, stairways, and above-the-ceiling areas; noting the presence of smoke and fire dampers, smoke detectors, fire extinguishers, exit signs, and egress illumination devices; and reviewing fire resistance ratings of doors and partitions. As part of the process, the Contractor working with the CDSO, the Contractor shall gather building information from previously prepared Life Safety plans, VBA s record drawings, field assessments, and consult with applicable building codes as determined by the facility s year of construction. ELECTRICAL SAFETY During the electrical safety inspection/assessment, the Contractor shall employ qualified electrical inspectors and provide all technical supervision, equipment, labor, and materials to conduct a thorough on-site review of the facility s periodic electrical inspection and assess compliance with the electrical code and VBA/OSH criteria. 1910 Subpart S include protection requirements for electrical but for construction, requirements related to electrical safety are found in 1926 Subpart K. This includes but not limited to examining electrical panel clearance, code compliance for use of electrical power, proper use of appliances and equipment, ensuring no damage to cords, switches, and junction boxes and ensuring proper use of any connections to electrical. The Contractor shall complete all required forms and checklist and provide an overall report consistent with best practices on the overall state of the facility s electrical system and any recommendations for improvement. GENERAL WORK ENVIRONMENT The Contractor shall assess the general work environment in accordance with standards 1910 or 1926 (for construction) to ensure clear egress/access paths, aisles, passageways, and emergency egress aspects to include proper egress and exit through doors and (if applicable) emergency windows. The Contractor shall ensure the stability and safety of office equipment including bookcase, cabinets, and other heavy items. The Contractor shall also assess the proper levels of illumination of work areas and proper ventilation levels and operation for the work being performed. The Contractor shall also assess the cleanliness of the work environment to ensure proper housekeeping and best practices for operating in a clean and safe work environment. PERSONAL PROTECTIVE EQUIPMENT The Contractor shall provide workplace hazard assessments for the proper quantity and placement of required personal protective equipment (PPE) for the type of work being performed to include the need for protective gloves, aprons, shields, or other means to prevent cuts and injuries. In addition, provide emergency materials for corrosive liquids or chemical splash injuries as well as training practices for the proper use, care, and limitations for personnel use. Standard 1910 Subpart I describe the general requirements for personal protective equipment. Requirements for construction are detailed within Standard 1926 Subpart C, General Safety and Health Provisions. LOCK OUT / TAG OUT The Contractor shall assess existing practices for lockout/tagout procedures in facilities needing such and ensure that affected employees have been notified of procedures required for the respective facility. 1910 Subpart J has requirements on controlling hazardous energy with lockout/tagout as well as an example of typical lockout procedures. 1926 Subpart G details the requirements for using tags to prevent accidents and Subpart K specifically details locking and tagging out electrical circuits. MEDICAL SERVICES AND FIRST AID The Contractor shall assess the adequacy of medical services and first aid requirements sufficiently stocked and readily available at locations appropriate for the site and facility that allows for ready access by personnel. Requirements for medical and first aid are in 1910 Subpart K or 1926 Subpart D. HAZARD COMMUNICATION PROGRAM The Contractor shall assess existing and needed hazard communication programs (HAZCOM) and whether workers have been trained in the proper practices for hazard controls, safe use, handling, and emergency procedures for work environments using hazardous materials as a normal part of the work environment. Hazard communication requirements can be found in 1910 Subpart Z or 1926 Subpart D. AWE Training The Contractor shall develop, implement, and execute processes for initial training of personnel on maintaining compliance with AWE requirements. The Contractor shall develop and submit to the Government for review training plans, manuals, and other training documentation or training aids. Electronic training tools such as video teleconferencing and computer-based training shall be employed to enhance the effectiveness of training materials and courses. Training delivery may be recorded during live delivery to VA; pre-recorded initial training is not acceptable. The Contractor shall submit a detailed training plan with timelines and schedules, sufficiently detailed to identify user training plans for respective facility or facilities as coordinated with the Government. The Contractor shall develop accompanying electronic user manuals that VA will subsequently make available to new users. The electronic user manuals shall be delivered along with the training manuals. During the period of performance, the Contractor shall revise all user manuals as substantial changes are made to the service. Physical Security Assessments The Contractor shall be knowledgeable and experienced in the assessment of Physical Security Systems and Operations and best practices to mitigate vulnerabilities and threats. The knowledge areas required include assessments consistent with VA Handbook 0730, the Physical Security Resilience Design Manual (PDRSM), and the Interagency Security Committee (ISC) Risk Management Process for Federal Facilities. The Contractor shall conduct security assessments at identified Regional Offices (RO)s and Out-Based Offices throughout the nation in coordination with the Program Manager and respective Security Officer for the facility identified. The areas of assessment shall include but not be limited to: Facility Overview Facility Operations and Building Management Systems: the Contractor shall characterize and document the overall dimensional size of the facility, acreage, parking, tenants, floor plans, building information, and update/document the overall dimensions of the facility, neighboring tenants, site property, floors, elevators, loading docks, mailrooms, and other factors determined by the Contractor to capture the character of the facility, as well as any changes that may have occurred since the previous assessment. The Contractor shall assess and provide an overview of operational hours, personnel (government or contractor), work shifts, quantity counts of personnel and visitors, as well as related characteristics that may influence physical security criteria. Elevators and Escalators: The Contractor shall assess elevator and escalator operations along with respective controls and monitoring and whether a system owner is identified and if a system security plan is in-place along with associated management documentation, updates, owners, points of contacts. The Contractor shall determine if the system security plan is consistent with current industry practices and, if applicable, provide recommendations for improvement. The Contractor shall identify and/or validate the quantity of elevators/escalators and their respective operational condition and whether they serve the public, building services, or other specific/dedicated function. The Contractor shall assess whether elevator/escalator operations are connected to computer or an enterprise network and whether access controls (username, password, etc.) are in-place and whether controls and monitoring are internal or external to the facility. Heating, Ventilating, Air Conditioning (HVAC) System The Contractor shall assess the HVAC system(s) along with controls and monitoring and whether a system owner is identified and if a system security plan is in-place along with associated management documentation, updates, owners, points of contracts. The Contractor shall assess if the HVAC system is connected to a computer with access controls and whether system status can be viewed onsite and can system controller or systems be controlled or altered. The Contractor shall assess if the system can be remotely accessed and controlled using a username and password, the extent of remote control to include shutdown and manipulation, description of any enterprise network (GSA ENT, ICE IRMENT, agency network, etc). The Contractor shall assess whether the HVAC system has software and firmware updates on a recurring basis and document the most recent update occurrence and which aspects of the system/components were affected. Also assess if the HVAC system is integral to a building automation system (BAS) and does the BAS software monitor or control any other systems. Loading Dock: The Contractor shall assess any loading dock for its location, whether controlled or publicly accessible, management and overall use, shipment screening approach, utilities and services, grade level, as well as related criteria for secure operations of a loading dock. Mailroom: The Contractor shall assess any mailroom for its location, whether controlled or publicly accessible, management and overall use, mail screening approach, utilities and services, as well as related criteria for security applicable for the facility. Site Lighting: The Contractor shall assess the site lighting and illumination for operations and maintenance practices for required illumination, assess power sources including emergency sources, repairs response, and general checking to ensure defined requirements for the site. Security Force Profile (staffing, equipment, training) The Contractor shall assess the security force type and management, whether on-site or off-site or mix, staffing levels and work shifts, security posts and quantities, static and/or roving posts procedures, uniform and communications equipment usage procedures, lethal weapon or less than lethal weapon profile, and training programs and procedures for all aspects of the security force and any related policies and procedures that affect the security force profile. Entry Controls for Employees/Visitors The Contractor shall assess entry controls for employees and visitors to prevent unauthorized access to security areas, theft of sensitive information, sabotage of vital equipment, and introduction of contraband. Assess controls for access identification systems, search procedures, detectors, and barriers. The badge system shall be assessed to ensure that only authorized personnel enter, occupy, or leave a security area and to indicate limitations placed on access. Parking Lot and/or Garage The Contractor shall assess the applicable parking factors for the facility. Whether a parking lot and/or parking garage, The Contractor shall assess and document for use (federal or public), quantity of spaces, government spaces owned or leased, control of spaces (parking decals, ticketing, etc.), For parking garages: entry control and management, parking levels, grade level, quantity of floors, height and weight restrictions, and any related criteria for security of parking. Barriers, Locks, and Keys The Contractor shall assess physical barrier controls to effectively direct the flow of personnel and vehicles through respective access control designated portals. The Contractor shall assess the effectiveness of security locks and whether performance testing indicates that the system performs adequately. Assess the requirements for security locks in light of the interest being protected, the identified threat, existing barriers, and other protection measures. The Contractor shall assess security keys to include mechanical and electrical technologies, key cards, and other non-standard locking type devices. Examine whether the appropriate key control program is in-place to effectively ensure continuous accountability of security keys. Building Envelope Structural Design: The Contractor shall have reviewed all available structural design information (including progressive collapse criteria, blast criteria, ductility, moment connections, etc.) and develop a comprehensive understanding of the overall structure and design of the facility, including building envelope windows, in preparation for the assessment and completion of the structural section of FSA: Building Engineer Questionnaire and any other requirements identified in this scope. The Contractor shall possess structural knowledge and experience, but not limited to: load bearing elements, types and properties of materials (steel, concrete, wood, etc.), structural connections and anchoring methods, spacing of structural elements, floor-to-floor heights, and all other pertinent criteria to fulfill this contract. Intrusion Detection and Assessment The Contractor shall assess the Intrusion Detection System (IDS) for external and internal applications. Determine the ability for external systems to provide the earliest possible detection of an unauthorized intrusion. The internal system configuration shall be assessed for the required levels of protection. The assessment shall include the characteristics of sensors and their support system, maintenance procedures and schedule, and any related criteria for operating the IDS. Communications The Contractor shall assess the effectiveness of communications equipment allow protection of safeguards and security interests by providing rapid, reliable, and protected information. Assess whether the design of communication systems provide that no single event can disable all modes of communication between the alarm stations and fixed posts. Assess frequency of testing for compliance with operability and alternate communications capabilities in the event of failure of primary systems. Testing and Maintenance The Contractor shall assess the provisions of the testing and maintenance program operations approach by service representatives to perform all tests, maintenance, calibrations, and repairs necessary to keep the detection and assessment systems operational. In addition, the testing and maintenance program should ensure that necessary components remain functional and reliable to minimize equipment failures, forecast impending operational problems, identify functional weaknesses, and guide future upgrades and improvements. Support Systems including Building Management Systems The Contractor shall assess the support systems to include power supplies and tamper protection associated with intrusion detection equipment, alarm monitoring and assessment systems, access control, and entry/exit screening equipment. Assessment shall include auxiliary power (backup power system) to maintain critical operation systems in the event primary power is lost. Assess the adequacy of the auxiliary power supplies to power all alarm systems and critical equipment long enough to permit restoration of normal power, or until other compensatory measures are implemented. Auxiliary power assessment shall include any fuel powered solutions to include fuel type, location of source, fill and refill procedures, use management and access controls, power transitions, load testing and procedures, associated uninterruptible power supplies, and other critical information. Building management systems shall be assessed on web utilization, users having access, access controls and procedures, incidents and associated documentation, and related criteria for building management systems. Systems Management The Contractor shall assess systems management to verify that security management personnel provide sufficient planning, direction, and control processes to ensure continued effective performance of all physical security components. General Qualifications Qualified safety and health inspectors with equipment and competencies to recognize and evaluate hazards of the working environment and to suggest general abatement procedures with various recognized credentials including Certified Hazardous Materials Managers (CHMM), Certified Safety Professionals, and/or Industrial Hygienists. Inspectors with strong knowledge of and extensive experience with the underlying regulations (OSHA, VA, NCA and National Fire Protection Association). Inspectors with strong and directly relevant technical experience and capability. Demonstrated track record of high quality, sustained Program Performance. VBA needs a program support provider familiar and experienced with the inspection life cycle, protocol development, pilot tests, reporting and close-out, and any subsequent recommendations or support that may be required to improve safety and health performance in administrative locations and cemetery operations. Demonstrated success in project and program management within the past five years. Required Staff Qualifications The Contractor selected must provide evidence, through past performance, of experience, capability, and willingness to commit the resources necessary to plan, organize, and execute tasks in an expeditious and efficient manner. The Contractor shall provide staff specialized in the field of safety management. The Contractor must provide safety specialists to conduct the inspection who have at a minimum a BS in the engineering, science, or safety disciplines. The staff provided for inspection purposes shall have experience in conducting inspections in accordance with 29 CFR Part 1960. The project manager and facility survey personnel shall each have at least 5 years of safety management/safety inspection work experience. The contractor shall provide staff with experience and capability in evaluating administrative operations for safety and health requirements and are knowledgeable of safety and health requirements. The Contractor shall have full responsibility for the staff and shall make direct contact with VBA COR, Project Manager, or Project Coordinator to ensure that all arrangements are mutually understood concerning logistical and/or technical requirements. Labor categories for GSA have been used to map the roles and responsibilities for AWE inspections and physical security assessments. Section 7.1 will detail the roles and responsibilities for AWE inspections and Section 7.2 will detail the roles and responsibilities for physical security assessments. The following roles and responsibilities are for GSA: JUNIOR: A Junior labor category has up to 3 years experience and a BA/BS degree. A Junior labor category is responsible for assisting more senior positions and/or performing functional duties under the oversight of more senior positions. JOURNEYMAN: A Journeyman labor category has 3 to 10 years of experience and a BA/BS or MA/MS degree. A Journeyman labor category typically performs all functional duties independently. SENIOR: A Senior labor category has over 10 years of experience and a MA/MS degree. A Senior labor category typically works on high-visibility or mission critical aspects of a given program and performs all functional duties independently. A Senior labor category may oversee the efforts of less senior staff and/or be responsible for the efforts of all staff assigned to a specific job. SUBJECT MATTER EXPERT (SME): A Subject Matter Expert is an individual whose qualifications and/or particular expertise are exceptional and/or highly unique. Subject Matter Experts do not have specific experience/education qualifications, but are typically identified as recognized Industry leaders for a given area of expertise. Subject Matter Experts typically perform the following kinds of functions: Initiates, supervises, and/or develops requirements from a project s inception to conclusion for complex to extremely complex programs; Provides strategic advice, technical guidance and expertise to program and project staff; Provides detailed analysis, evaluation and recommendations for improvements, optimization development, and/or maintenance efforts for client-specific or mission critical challenges/issues; Consults with client to define need or problem supervises studies and leads surveys to collect and analyze data to provide advice and recommend solutions. AWE Personnel AWE inspections are conducted by compliance safety and health officers who ensure employers are in compliance with OSHA requirements to prevent hazards that may cause injuries or death. Responsibilities for compliance safety and health officers include conducting inspections and documenting any violations of OSHA standards, working with employers on corrective actions. Officers can also have the responsibility of providing education or training internally or externally. In relation to the GSA labor categories, all categories are eligible for being compliance safety and health officers conducting inspections as long as the proper training has been completed. Senior positions also include the responsibility of providing training whether it is for internal or external audiences. Physical Security Personnel Physical security specialists are responsible for developing security policies and develop, design evaluate, and install protection systems to ensure that sensitive information, equipment or other material is not compromised. The junior level position is responsible for reviewing designs, inspecting facilities where sensitive material will be located, determine who is allowed to use the material and how to protect it. This position will also evaluate existing practices, confirm whether established security policies are being followed and recommending any corrective action to fix those deficiencies. The journeyman level will be responsible for preparing contract specifications, establishing performance standards and instructions, and administering contracts awarded for guard services. This position must also have knowledge of the state-of-the-art in intrusion detection systems and devices, safes and other storage containers, locks and locking systems, personnel entry control systems, security measures applicable to transporting and shipping requirements, ballistic protection measures, protection levels for special nuclear materials, asset protection, and loss prevention. They must be able to read, understand, and evaluate site/facility engineering drawings for potential security deficiencies and to design and implement installation security systems for new facilities. Senior level specialists conduct surveys and analyses to identify how critical and vulnerable facilities or sites are and threats against them. They must understand the work of variety organizations to consult with operating personnel and other security specialists to devise protection systems. The Senior category level also requires the ability to resolve problems or conflicts between physical security requirements and organizational missions. Preliminary Delivery Schedule ITEM FREQUENCY DELIVERY AWE Checklist and overview site report After each site visit (preliminary and final) Preliminary at departure from site visit Final checklist 15 days after the site visit AWE Annual Report One per POP (draft and final) a. Draft annual report 30 days before end of POP b. Final annual report five days before end of pop Physical Security checklists and overview site report After each site visit (preliminary and final) a. Preliminary at departure from site visit b. Final checklist 15 days after the site visit Physical Security Assessment Annual Report One per POP (draft and final) a. Draft annual report 30 days before end of POP b. Final annual report five days before end of pop Government Furnished Information VBA will provide the Contractor with the following information no later than 5 days after the Contractor award meeting (Documents will be provided electronically whenever possible): AWE Checklists OSH policy, guidance, or instruction governing the AWE process. Previous AWE reports or AWE data from previously conducted AWEs from all applicable locations. (Contractor shall comply with the terms of this contract, previous AWE reports that are not part of this contract shall only serve as a reference) PSA Checklists VA policy, guidance, or instructions governing the physical security process. Previous PSA reports or PSA data from previously conducted PSAs from all applicable locations. (Contractor shall comply with the terms of this contract, previous PSA reports that are not part of this contract shall only serve as a reference) Regional Office Locations List Regional Offices NO. LOCATION ADDRESS 1 Albuquerque, NM 2 Anchorage, AK 3 Atlanta (Decatur), GA 4 Baltimore, MD 5 Boise, ID 6 Boston, MA 7 Buffalo, NY 8 Chicago, IL 9 Cleveland, OH 10 Columbia, SC 11 Denver (Lakewood), CO 12 Des Moines, IA 13 Detroit, MI 14 Fargo, ND 15 FT. Harrison, MT 16 Hartford, CT 17 Honolulu, HI 18 Houston, TX 19 Huntington, WV 20 Indianapolis, IN 21 Jackson, MS 22 Lincoln, NE 23 Little Rock, AR 24 Los Angeles, CA 25 Louisville, KY 26 Manchester, NH 27 Manila, PI 28 Milwaukee, WI 29 Montgomery, AL 30 Muskogee, OK 31 Nashville, TN 32 New Orleans, LA 33 New York, NY 34 Newark, NJ 35 Oakland, CA 36 Philadelphia, PA ITC 37 Philadelphia, PA 38 Phoenix, AZ 39 Pittsburgh, PA 40 Portland, OR 41 Providence, RI 42 Reno, NV 43 Roanoke, VA 44 Salt Lake City, UT 45 San Diego, CA 46 San Juan, PR 47 Seattle, WA 48 Sioux Falls, SD 49 St. Louis, MO 50 St. Paul, MN 51 St. Petersburg, FL 52 Togus, ME 53 Waco, TX 54 Washington, DC 55 Wichita, KS 56 Wilmington, DE 57 Winston-Salem, NC