Lenel & Milestone Maintenance Support Services for Security Cameras

Solicitation / RFP / RFQ

This document provides instructions for offerors and outlines evaluation criteria for a Firm Fixed Price contract. The requirement is in support of the Walter Reed National Military Center, Bethesda, Maryland, and will be awarded by the Defense Health Agency Contracting Activity (DHACA) Healthcare Contracting Division Northeast (HCD-NE).

• Offerors must provide two (2) to three (3) references for same or similar services completed within the past three (3) years.

• References should demonstrate projects comparable in scope and complexity, including project dates and a description of the work performed.

• Contract Type: Firm Fixed Price.

• The Government reserves the right to award without discussions.

• Questions Deadline: June 26, 2026, at 10:00 AM EST. All questions must be submitted in writing to deartra.j.king.ctr@health.mil.

• Offer Price Firmness: Offerors agree to hold prices firm for 60 calendar days from the quote submission date.

• Proposal Submission Deadline: July 13, 2026, 10:00 AM EST. Proposals must be submitted electronically via email to deartra.j.king.ctr@health.mil.

• Format: Quotes must be submitted in a format readable by Microsoft Office 2007 programs or later.

• Page Limitations: Specific page limitations for each evaluation factor are detailed within the document (Experience and Price).

• Evaluation: The award will be made to the responsible offeror whose offer is most advantageous to the Government, considering price and other factors.

• Not specified in this document.

• This document includes addenda to FAR Clauses 52.212-1 and 52-212-2.

Form / Attachment / Pricing Sheet

This document is the "DHA Component Acquisition Executive (CAE) (J-4) New Employee Onboarding Handbook." It serves as a guide for new employees joining the CAE (J-4) organization, providing essential information for a smooth onboarding process.

• Purpose of the Handbook: To help new employees understand DHA, its mission, vision, and values, and how the CAE (J-4) fits into the agency.
• Onboarding Requirements: Details key steps such as Entry on Duty (EOD), security clearance, Common Access Card (CAC) acquisition, network access, computer and equipment issuance, system access, facilities access, parking, and training.
• Resources and Information: Includes sections on employee resources, useful information, policies, and frequently called numbers.
• Appendices: Contains onboarding checklists, system requirements, forms, time card codes, acronyms, and leadership/points of contact.

While primarily an internal employee onboarding document, this handbook provides insight into the organizational structure, key personnel, and operational processes of the DHA CAE (J-4). Understanding these aspects can help potential bidders identify relevant points of contact, grasp the agency's operational framework, and understand the systems and procedures that may impact contract execution or collaboration.

Form / Attachment / Pricing Sheet

This document, titled "Annual Training List Fiscal Year 2022," serves as a comprehensive catalog of mandatory and recommended training for personnel within the Defense Health Agency (DHA) for the fiscal year 2022. It outlines various training topics, their delivery methods, frequency, target audience, and the Office of Primary Responsibility/Office of Collateral Responsibility (OPR/OCR).

• Training Topics: Covers a wide range of subjects including leadership, security, compliance, awareness, and professional development.
• Delivery Methods: Includes online platforms (JKO, Adobe Connect), classroom instruction, and varied methods.
• Frequency: Specifies whether training is annual, every 2 or 3 years, or one-time.
• Target Audience: Differentiates training for civilians, military personnel, senior leadership, managers, supervisors, and specific roles.
• OPR/OCR: Identifies the responsible office for each training.

While this document is primarily an internal DHA training list, it may be relevant to potential bidders if the opportunity requires specific training certifications or if the contract involves personnel who must complete these DHA-mandated trainings. Understanding the training landscape can provide insight into DHA's operational priorities and compliance requirements. It does not directly outline procurement requirements but provides context on workforce development within the agency.

Form / Attachment / Pricing Sheet

This document, "Attachment 2," outlines the Deliverable Schedule Table for the contract. It details specific deliverables, their frequency, format, submission recipient, and the section of the contract they apply to.

• Basic Assessment: Due 30 days prior to contract award and annually thereafter. Submitted electronically to the COR via SPRS. Applicable to section 6.5.2.1.1.
• CMMC: Due at time of award and every 3 years thereafter. Submitted electronically to the COR via SPRS. Applicable to section 6.5.4.

This attachment is crucial for bidders to understand the timing and submission requirements for key contractual deliverables, specifically the Basic Assessment and CMMC compliance. Bidders must ensure their proposals account for these scheduled submissions and compliance points.

Solicitation / RFP / RFQ

This document outlines the evaluation criteria for an upcoming solicitation. The Government will award a contract to the responsible vendor whose quotation is most advantageous, considering both price and other factors.

• Factor 1 – Experience:

  • The Government will evaluate recent and relevant past performance.
  • Relevancy is determined by the scope, type of work, and price of prior contracts compared to this solicitation.
  • Performance will be assessed based on quality, timeliness, business relations, and other considerations.
  • Vendors without available past performance information may not be evaluated favorably or unfavorably.

• Factor 2 – Price:

  • The vendor's total price will be evaluated for fairness and reasonableness, potentially using techniques outlined in FAR 15.404-1(b).
  • Price is not adjectively rated but must be deemed fair and reasonable for award eligibility.
  • A comparison of total proposed prices will determine price competition.

• Quotations will be evaluated by including the total price for all option periods.

• The Government may deem a proposal unacceptable if option prices are significantly unbalanced.

• Evaluation of option periods does not obligate the Government to exercise them.

Performance Work Statement (PWS)

This PWS outlines the requirements for providing non-personal services for Lenel & Milestone On-Site Maintenance Support Services for the Operations Department at Walter Reed National Military Medical Center (WRNMMC), Bethesda, MD.

• Provide on-site maintenance support for the Lenel OnGuard Access Control System (ACS) and Milestone Video Management System (VMS).

• Requires two (2) Full-Time Equivalent (FTE) Lenel OnGuard certified maintenance technicians and one (1) FTE Milestone certified system administrator/technician.

• Services include installation, configuration, maintenance, troubleshooting, and lifecycle management of ACS and VMS hardware and software.

• Technicians must hold specific Lenel S2 OnGuard 8.2 Core Certification and Milestone Knowledge Program certifications (Technical Configuration 1 & 2).

• Contractor must be a Naval District Washington (NDW) N6 preferred contractor with pre-approved access to the Lenel & Milestone Enterprise 3SP Network.

• Comprehensive monthly audits of field hardware.

• Response to escalated faulty hardware calls within specified timeframes.

• Maintenance of daily, up-to-date work order databases and tracking records.

• Submission of a Quality Control Plan (QCP) within 30 days of contract award.

• Place of Performance: Walter Reed National Military Medical Center, Bethesda, Maryland.

• Base Period: July 1, 2026 - June 30, 2027.

• Four (4) one-year option periods through June 30, 2031.

• Hours of Operation: Monday - Friday, 0800 - 1600, excluding Federal holidays.

• Contractor personnel require Common Access Cards (CACs).

• Compliance with DoD and DHA onboarding, training, and security requirements (including background investigations and Non-Disclosure Agreements).

• Adherence to physical security, key control, and lock combination procedures.

• Contractor personnel must clearly identify themselves as contractor support staff in all communications.

• All work is unclassified; Tier II position sensitivity designation.

• Compliance with DFARS 252.239-7018 for unified capability equipment.

Form / Attachment / Pricing Sheet

This document outlines the process for requesting Common Access Cards (CACs) for contractors and other eligible personnel through the Defense Health Agency (DHA). It details the use of the High-Volume Data Feed (HVDF) Batch Processing Tool, a Microsoft Excel spreadsheet, for submitting applications to the Trusted Associate Sponsorship System (TASS).

• HVDF Batch Processing Tool: A spreadsheet designed to process high-volume TASS applications, reducing turnaround time.
• Eligible Populations: Includes Affiliated Volunteers, DoD and Uniformed Service Contractors, Foreign Affiliates, Non-DoD Civil Service Employees, Non-DoD Presidential Appointees, Non-Federal Agency Civilian Associates, Non-US Non-Appropriated Fun (NAF) Employees, OCONUS Hires, and Other Federal Agency Contractors.
• Process: Facility Security Officers (FSOs) are responsible for accurately completing the HVDF spreadsheet with applicant data and submitting it via the Safe Access File Exchange (SAFE) application to the DHA TASS Mailbox.
• Data Fields: The document provides detailed column-by-column instructions for completing the spreadsheet, including applicant identification, personal details, contact information, and contract-related data.
• Validation Rules: Specifies the required format and content for each data field to ensure successful upload into TASS.
• CAC Renewals: The HVDF tool can also be used to initiate CAC renewals.

This document is crucial for any bidder or contractor personnel requiring a DHA-issued CAC. It provides the procedural steps and data requirements necessary for obtaining or renewing these credentials. Understanding this process is essential for ensuring personnel can access DHA facilities and systems as required by contract performance.

Form / Attachment / Pricing Sheet

This document, "Attachment 5: RMF ASSESSMENT TIMEFRAMES," outlines the required timelines and processes for Risk Management Framework (RMF) assessments for both Design-Bid-Build (DBB) and Facilities Sustainment, Restoration and Modernization (SRM) projects. It details the responsibilities of the Vendor (Vend) and Government (Gov) at various stages of the cybersecurity assessment and authorization process.

• DBB Timeframes: Details steps from initial vendor contact and RFI response, through cybersecurity kickoff meetings, eMASS registration, security plan reviews, self-assessments, implementation, independent verification and validation (IV&V), and finally to commissioning and acceptance testing.
• SRM Timeframes: Outlines similar RMF assessment steps tailored for SRM projects, including initial contact, template provision, FRCS-RA and Nessus report submission, cybersecurity kickoff, eMASS registration, security plan review, and self-assessment matching.
• Key Activities & Deliverables: Includes requirements for FRCS-RA, Nessus scan reports, security assessment plans, boundary diagrams, data flow diagrams, hardware/software inventories, STIG checklists, and continuous monitoring plans.
• Timelines: Specifies deadlines for each step, such as "Within 30 days of construction contract award," "10 business days post receipt," and "Prior to any Commissioning or Acceptance Testing."

This attachment is critical for bidders to understand the cybersecurity compliance timeline and requirements associated with the opportunity. It clarifies the sequence of events, the specific documentation and reports required from the vendor at each stage, and the associated government review periods. Bidders must factor these RMF assessment timelines into their project planning and resource allocation to ensure successful contract performance and timely system authorization.

Form / Attachment / Pricing Sheet

This document, "Attachment 4," is a Responsibility Matrix that outlines the roles and responsibilities of various parties involved in the lifecycle of a facility control system (FRCS) and its associated cybersecurity requirements. It details who is Responsible (R), Approves (A), Consults (C), or is Informed (I) for each task throughout the system's development, construction, post-construction, and operations and maintenance (O&M) phases.

• Roles Defined: Includes USACE-PDT, System Owner, Authorizing Official, Designer of Record, Constructor Contractor, G6/NEC/DOIM, ISSM/ISSO, SCA-V, Customer, and Task Manager.
• Phases Covered: Concept, Planning & Development; MILCON Initiation & Development; Design; Construction RFP; Construction; Post Construction and Warranty; SRM (O&M) RACI; System Design; Cybersecurity Requirements; Implement Security Controls; Assess Security Controls; Authorize System; Monitor Security Controls; Updates and Patching; Decommission.
• Task Breakdown: Specific tasks within each phase are listed, such as "Identify the facility control systems required," "Develop System Security Plan," "Implement controls IAW Final Design," and "Apply Monitoring Strategy to system."
• Responsibility Legend: Clearly defines the meaning of R, A, C, and I.

This matrix is crucial for bidders to understand the collaborative environment and the specific responsibilities assigned to different entities, including the contractor, during the various stages of a project involving facility control systems and cybersecurity. It helps bidders identify their own potential roles, the expectations placed upon them, and the entities they will need to coordinate with or report to throughout the contract performance period. Understanding these responsibilities is key to accurately estimating resources, planning project execution, and ensuring compliance with cybersecurity mandates.

Form / Attachment / Pricing Sheet

This document, "Attachment 3: Cybersecurity Regulations and Guidance," lists the mandatory regulations, laws, and guidance that a vendor must use and comply with for this opportunity. It serves as a reference for cybersecurity and data protection requirements.

• United States Law: HIPAA, FISMA, E-Government Act of 2002.
• Office of Management and Budget (OMB): Circular A-130, Guidance M-05-24 (HSPD-12).
• National Institute of Standards and Technology (NIST): SP 800-37, SP 800-39, SP 800-53, SP 800-60.
• Federal Information Processing Standards (FIPS): FIPS PUB 140-2, FIPS PUB 199, FIPS PUB 200, FIPS PUB 201-2.
• Department of Defense (DoD): Instructions 5200.2, 8500.1, 8520.02, 8510.01, 8551.1, 8580.02, 6025.18, and Directive 5400.11.
• Defense Health Agency (DHA): Publications related to Facility-Related Control Systems (FRCS) cybersecurity, security categorization, overlays, SOPs, and continuous monitoring.

Vendors must review and understand these references to ensure their proposals and subsequent performance meet all specified cybersecurity, privacy, and data handling requirements. Compliance with the most recent published versions of these documents is mandatory.