INTENT TO SOLE SOURCE The Department of Veterans Affairs, Network Contracting Office 4 (NCO4) intends to sole source a contract for a need for the current CCURE and DSC integration and intrusion alarm systems to be upgraded at the James E. Van Zandt VA Medical Center 2907 Pleasant Valley Blvd in Altoona, PA 16602 All work is to be completed in accordance with statement of work and schedule. This sole source contract will be solicited and negotiated with Johnson Controls Fire Protection LP 3120 Unionville Rd, Suite 400 Cranberry Township , PA 16066 under the authority of FAR 8.405.6 Only One Source. The North American Industry Classification System (NAICS) code for this procurement is 561621. The Small Business Administration (SBA) size standard is $22M Interested vendors that can meet this requirement, should identify their interest and capability, and respond to this notice by 05/25/2021 by 4:00 PM EST. Interested vendors must send a capability statement, no more than one page in length; to include Company Name, Duns Number, Socioeconomic Category, brief description of your business entities capability to handle this particular project at the Altoona VA Medical Center, website and GSA Contract number & or other VA Medical Center contract information. No solicitation will be made available. This is not a request for quotations. All information shall be provided at no cost or obligation to the Government. Responses must be sent via email to the Contracting Officer at
[email protected] If no responses are received, Contracting will proceed with the sole source negotiation Johnson Controls Fire Protection LP Draft Statement of Work CCURE Upgrades and Reprogramming James E. Van Zandt VAMC Altoona, PA 16602 Background: The Altoona VA Medical Center has a need for the current CCURE and DSC integration and intrusion alarm systems to be upgraded. All mapping and software issues for these systems are in need of debugging and updated to work with the existing alarm panels. All systems shall be fully functional and operational at the completion of the contract. Scope: The Altoona VAMC is seeking a certified, knowledgeable and with a background in CCURE and intrusion programming, to come to the Altoona VAMC and resolve the CCURE 9000 v.2.80 issues that currently exist. The technician shall be responsible for fixing the DSC integration between the CCURE and programming other intrusion panels throughout the facility. The technician shall be required to update all the maps within the facility to the current room numbers and locations to include PACs doors and readers at those locations. The facility will provide all the information needed to imbed into the CCure program. Clusters and partitions need updated to reflect proper locations as well as correct doors and hardware attached to the doors (i.e. readers, request to exits). The technician will be working in the police station on a VA furnished computer with access to the required software. While onsite the technician shall be responsible for performing all necessary software updates and upgrades to the system, while maintaining compatibility with our current system. The technician will be responsible for cleaning up and making our CCURE screen more user friendly and easier to read (correctly laid out in respect to doors and locations). Training of the CCURE system and function ability will need provided to all police and designated staff. GENERAL REQUIREMENTS: Software Integration and mapping- Labor: Contractor shall install all software patches and updates to the CCURE program along with inputting all maps and data for the program itself. Hardware and Equipment Requirements: N/A Software Requirements: Software and any updates shall be compliant with the current version of CCURE v. 2.80. Service Agreement request for the software: Contractor shall provide the VA with 24/7 technical support and a one-year service agreement. Training Requirements: Contractor shall be responsible for training all of the VA Police Department and any other designated staff. Training should include but not limited to identifying doors, modifying schedules, search criteria, programming badges, and troubleshooting any issues. Training is required to be done face to face with the VA Police staff for at least three (3) days to explain how the entire system works. Training shall be designed in three stages from beginner (no concept of how the product works-many questions) to intermediate (starting to understand the product) to advanced (running the software and feeling confident for running it on their own). PROCESS All work will take place at the Altoona VAMC during business hours of 0730-1600. Contractor shall be responsible for troubleshooting all existing errors and correcting any issues. Contractor shall be responsible for training the VA Police staff and any other designated staff at the Altoona VAMC. The VA is requesting all software rights and licenses be made available at the completion of installation. The VA will maintain full control of the CCURE system and be able to perform all functions within the system. Contractor shall provide technical support 24/7 in case of any issues that may come up with the equipment or software that cannot be troubleshot by VA Police Department. All contracted personnel providing installation and training on site at the Altoona VA will be required to obtain a visitor badge that will be required to be worn on their person while on VA property. The VA Police Department (VAPD) will assist with this process. At the completion of the project, contractor and contracting staff are required to return the government issued visitor badge to the VA police department. PROTECTION OF GOVERNMENT PROPERTY During work execution, the Contractor shall take special care to protect Government property to include, but not limited to, installation of software at the Altoona VA. Contractor is responsible and required to protect the integrity and confidentiality of all systems utilized by the police and policies pertaining to the VA. SUB CONTRACTING The Contractor will be responsible for providing the services outlined within the contract. If the contractor wishes to utilize a subcontractor to complete parts of the requirements of the contract, they may do so with the understanding that the subcontractors are to follow all requirements stated within this statement of work. The Government has a business relationship with the Prime Contractor only. Only the Prime Contractor may bill the Government for services. INVOICE / PAYMENT Payment will be made through the Tungstun System with the falling information Invoice number and date Contractor s name and address Accurate Purchase Order Number Detailed pricing for all equipment supplied Detailed pricing for all software supplied Detailed pricing for all training provided Dates all services were performed Location where services performed Total billing amount Invoices will be electronically submitted to the Tungsten website at http://www.tungstennetwork.com/uk/en/ Tungsten direct vendor support number is 877-489-6135 for VA contracts. The VA-FSC pays all associated transaction fees for VA orders. During Implementation (technical set-up) Tungsten will confirm your Taxpayer ID Number with the VA-FSC. This process can take up to 5 business days to complete to ensure your invoice is automatically routed to your Certifying Official for approval and payment. In order to successfully submit an invoice to VA-FSC please review How to Create an Invoice within the how to guides. All invoices submitted through Tungsten to the VA-FSC should mirror your current submission of Invoice, with the following items required. Clarification of additional requirements should be confirmed with your Certifying Official (your CO or buyer). The VA-FSC requires specific information in compliance with the Prompt Pay Act and Business Requirements. For additional information, please contact: Tungsten Support Phone: 1-877-489-6135 Website: http://www.tungsten-network.com/uk/en/ Department of Veterans Affairs Financial Service Center Phone: 1-877-353-9791 Email:
[email protected] HIPAA Compliance Contractor must adhere to the provisions of Public Law 104-91, Health Insurance Portability and Accountability Act (HIPAA) of 1966 and the National Standards to Protect the Privacy and Security of Protected Health Information (PHI). Contractor Personnel Security Training Requirements All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: Sign and acknowledge understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training; Successfully complete the appropriate VA privacy training and annually complete required privacy training; and The contractor shall provide to the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee prior to initiation of the contract and annually thereafter, as required. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete. Contractor Personnel Security Requirements Position Sensitivity - The position sensitivity for each Contractor position is determined by the VA utilizing Position Designation Automated Tool (PDAT). Each position will be designated at the high, moderate, or low risk level, depending on the position s potential for adverse impact to the integrity and efficiency of the services (CFR 731.106). All Contractor employees and subcontractors are required to complete VA s Privacy training. Documented proof must be provided to the COR. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. All VA badges MUST be returned upon Employee termination. VA INFORMATION CUSTODIAL LANGUAGE: Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. If a VHA contract is terminated for cause, the associated BAA must also be terminated, and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.