01 NOI Attachment 1 - Draft SOW F.pdf

Information Technology (IT) Support for NOAA Employees and Contractors at the Joint Hydrographic Center

Statement of Work

1.0 Background

The Joint Hydrographic Center (JHC) was established through a cooperative agreement between the National Oceanic and Atmospheric Administration (NOAA) and the University of New Hampshire (UNH). The JHC focuses on the education, research, and technology of hydrographic services, working toward an improvement of national and international capabilities for dealing with and evaluating the use of new and emerging technologies. The services provided by this Statement of Work is pursuant to the Hydrographic Services Improvement Act of 1998 & Coast & Geodetic Survey Act.

1.1. General Description

This statement of work is for IT support for NOAA personnel and/or NOAA contractors assigned at or with substantial interest assigned at or with substantial interest assigned at or with substantial interest the NOAA-UNH Joint Hydrographic Center at the University of New Hampshire, including remote personnel. The packages below reflect three components of support: computers and services; data storage for high-resilience data; and data storage for bulk data.

2.0 Requirements

2.1 Package A: Computers and Services

Package Composition

This package is intended to support the IT needs of 15 NOAA users throughout the period of performance and up to four additional NOAA users in any of the option years.

Services Required

a. For all NOAA users, the contractor shall supply, at user’s choice, a desktop or laptop computer with at least the following specification:

● Windows-based computer system (Windows 11);

● Modern Intel Core Ultra 7/9-based CPU, or equivalent;

● At least 32GB RAM;

● At least 1TB SSD disk space;

● NVIDIA RTX graphics card, or equivalent;

● 2x 24” monitors or larger, with at least 1080p resolution (desktops) OR 1x 24” monitor or larger with at least 1080p resolution for laptop systems;

● Microsoft Office or 365 Standard Suite (Retail);

● Adobe Acrobat Standard software (Retail);

● Centrally managed threat prevention applications;

● Full system backup software and services;

Throughout the period of the contract, the contractor shall supply the following services for all NOAA users:

● Network connectivity to local services at least 1Gbps;

● Network connectivity to Internet at least 1Gbps;

● Internet connectivity with firewall and ingress/egress traffic filtering;

● Central monitoring for network performance and security;

● Central monitoring for threat prevention applications;

● Central backup services for all local data on the provided machine

● Telephone, walk-in, and electronic Helpdesk support services during normal business hours (CCOM/JHC operates business hours between 8am-5pm Monday through Friday);

● Access to server-based data storage services;

● Support and maintenance for UNH-provided remote workstations, which may include administrative tasks such as software updates/upload, uploading data packages on site, and local drive support;

● File transport services, such as receiving/scanning NOAA hard drives for installation/transfer to data storage system and preparing NOAA hard drives for shipping by USG;

● Use of laptop computer from a loaner pool for offsite work or travel needs, with comparable performance to primary desktop and laptop computer

2.2 Package B: IT service as needed

Package Composition This package is intended to provide available on-site connectivity and technical support, as needed, for NOAA-owned and managed IT Equipment assigned to the NOAA employees or contractors stationed at or visiting the Joint Hydrographic Center.

Services Required The contractor shall supply the following services:

● Secured guest wireless internet connectivity for up to 20 NOAA employees or contractors working at or visiting the Joint Hydrographic Center;

● Provide internet connectivity connections with firewall, including ingress/egress traffic filtering on UNH networks, for six users throughout the period of performance and up to two additional NOAA users in any of the option years

● Telephone Helpdesk support services during normal business hours for access from OCS Service Desk;

● On-site technical assistance and support to complete approved OCS service tickets that require on-site personnel, such as replacing hardware shipped from

OCS.

2.3 Package C: High-performance Data Storage

Package Composition This package is intended to support data storage requirements where data access is fast, reliable, and provides redundancy. The unit of storage for this package is one terabyte

(TB).

Services Required For the period of the contract, the contractor shall supply 110 TB units, as well as up to an additional 100 TB of data storage capacity, as needed, for each option year with:

● Server or cloud-based storage spanning multiple storage systems;

● Multiple fault-tolerant redundancies and failover for all data;

● Network connectivity to the user network with at least 1 Gigabyte per second

(GB/s) connections and 10Gb/s aggregate bandwidth;

● Native support for CIFS and NFS access protocols;

● Automatic de-duplication of storage;

● Mandatory per-user permission enforcement on a per-dataset basis;

● Power protection and redundancy at storage facility;

● Physically secured storage facility with electronic entry logging;

● On-line backup of stored data to tape or other media;

● Off-site storage of backup tapes or other media in a secure, climate-controlled location.

3.0 Period of Performance

The period of performance for this contract shall be one year from the date of commencement for the base year with four additional 12-month option periods, to be exercised at a later date if a determination is made that an ongoing requirement exists for these services. For the option years, the government shall have the option to specify the number of additional NOAA users and data storage, up to the number specified in section 2.1.

4.0 Hours of Operation

The contractor is responsible for performing between the hours of 8:00am and 5:00pm EST, Monday through Friday, except Federal holidays or when the UNH facility is closed due to local or national emergencies, administrative closings, or similar facility closings.

The contractor must at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this statement of work when government personnel are in a work status.

4.1 Recognized Holidays

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day

Independence Day Christmas Day Juneteenth

In addition to the days designated as holidays, the Government observes the following days:

● Any other day designated by Federal Statute

● Any other day designated by Executive Order

● Any other day designated by a President's Proclamation

5.0 IT SECURITY REQUIREMENTS

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The contractor is required to meet the DOC ITSBP, NOAA IT Security Manual, NOS policies and OCS IT and IT Security policy and procedures.

The government will provide the necessary computer equipment and information to perform this contract. All work must be performed upon government furnished equipment and if additional hardware and/or software is/are needed, the contractor must request the additional requirements from the COR. It is a mandatory requirement for every NOAA IT user (government, contractor, associate, or temporary personnel) to complete annual NOAA Information Technology Security Awareness Training.

Government Furnished Equipment The contractor must use government furnished equipment (GFE), which is currently covered by an existing government A&A package. The Contractor is required to ensure the GFE is connected to either NOS internal network at least three times per week to receive the configuration management updates and vulnerability management assessments. The current Government established times frames include:

a) Configuration management (normal updates and patching) occurs every Monday and Wednesday night at 10 pm,

b) Vulnerability Management and Remediation (vulnerability scanning and apply missing updates/patches) occurs every Wednesday and Thursday from 9 AM to 3 PM every week for both on site and VPN connected devices. Vulnerability Scanning only occurs when the GFE is directly connected to the NOS network or connected to the Government provided VPN service using Common Access Card authentication,

c) Inventory reconciliation/management occurs annually between February and March.

Ad hoc inventory activities occur if new equipment is issued, lost or stolen.

User Accounts and Access Privileges Requirements In performance of this contract, the Contractor will need a number of non-privileged user accounts and a limited number of privileged accounts based on the roles being performed. The Government will work with the contractor in determining and issuance of non-privileged and privileged accounts. The Contractor is required to use these assigned accounts in the manner they are issued and not to attempt to modify permissions, elevate permissions, install unapproved software, and modify system configurations and/or application configurations with the written permission of the Task Monitor. If the Government detects any suspicious or inappropriate activities by Contractor personnel on the GFE, appropriate investigation and remedial actions will be taken by the Government to resolve the suspicious or inappropriate actions.

The contractor shall guarantee strict confidentiality of the information/data that it is provided by the Government during the performance of the task order. The Government has determined that the information/data that the contractor will be provided during the performance of the task order is of a sensitive nature.

Disclosure of the information/data, in whole or in part, by the contractor can only be made after the contractor receives prior written approval from the CO. Whenever the contractor is uncertain with regard to the proper handling of information/data under the contract, the contractor shall obtain a written determination from the CO.

The only cloud service authorized for use by the contractor for this acquisition is the existing or future cloud instance established by OCS as an extension of the existing authorization boundary.

Any cloud requirements must be discussed with the COR and prior approved by the ISSO. All cloud services are required to comply with the DOC Cloud Computing Policy and NOAA Cloud Computing Security Testing, Authorizing and Continuous Monitoring SOP.

For application/software product development, appropriate vulnerability planning needs to be included during the assessment of needs and requirements. This includes secure coding practices, code review, code scanning for vulnerabilities and supporting documentation. If the contractor solutions are using a contractor developed or government furnished [mobile/web] application/ database/ network operating systems to be deployed, the contractor must coordinate with OCS ITSB Chief for deployment within OCS approved solution which is compliant with agency policies. The DOC ITSBP may not specifically identify [mobile/web] application/ database/ network operating systems, may be applicable and will require compliance with these requirements. DOC policies are controlled unclassified information (CUI) and are restricted to only authorized personnel.

The Contractor shall comply with the DOC ITSBP and Commerce Information Technology Requirements (CITRs) listed in the Annex of the ITSBP are available upon request. DOC issues CITRs and policy memorandums as policy enhancements and carries the same authority as the DOC ITSBP. The Contractor shall comply with the NOAA IT Security Manual. The DOC and NOAA policies identified above are sensitive documents and will be provided after contract award.

The DOC ITSBP, DOC CITRs and NOAA IT Security Manual policies may not specifically identify Contractor custom solutions ([mobile/web] application/ database and/or network operating) systems that will require the Contractor to comply with the applicable requirements. The Contractor shall work with the OCS ISSO to determine the applicable security requirements that must be addressed. The Contractor shall ensure the acquiring information technology or service(s) are engineered for trustworthy and security and shall be maintained throughout the lifecycle of this contract following the engineering-based trustworthy secure solutions as outlined in the appropriate National Institute of Standards and Technology (NIST) Special Publications.

The Contractor shall work with the OCS ISSO for identifying security controls, documenting security controls and ongoing continuous monitoring of security controls.

The Contractor shall provide their security controls implementation including applicable architecture, diagrams, documentation, standard operating procedures and secure baselines supporting the development and operation of their solution. This documentation shall be incorporated by the OCS ISSO into the appropriate FISMA system security boundary.

The Contractor shall work with the OCS ISSO to ensure all database development, mobile application, web application, operating systems and/or software product development updates undergo vulnerability scanning, secure baseline compliance scanning and mitigation of vulnerabilities and/or compliance findings. The Contractor shall provide the appropriate documentation to the government for each update demonstrating this requirement has been met prior to placing the new or update into production. Vulnerability scanning and remediation is required to be performed on a component residing within the system boundary (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component(s)) at least every 60 days with public facing systems vulnerability scanning and remediation performed at least weekly. The secure baseline scanning is required to be performed at least quarterly.

The Contractor shall throughout the lifecycle of this contract provide updates when changes to their solution(s), policy changes, changes to NIST guidance and legislation.

The Contractor’s solution(s) being custom developed shall ensure the solution does not contain any spyware, malicious software, coding flaws or programming backdoors to circumvent the application functionality or the security of the application as described by the government. The Contractor’s solution(s) shall not access data stored on the device or request end user information without following all government (including DHS and/or Office of Management and Budget (OMB)) requirements. The Contractor’s solution(s) shall not transmit stored data from the installed device without clearly notifying, fully describing the required data being transmitted and receiving the government’s approval.

The Contractor shall work with the OCS ISSO to ensure secure management of user credentials (storing, transmitting, authenticating of user credentials shall be encrypted).

Specifically for mobile application, web application and/or software product development, appropriate planning shall be included during the assessment of needs, requirements, development and testing by the Contractor. The Contractor shall incorporate the security requirements into the mobile application development lifecycle along with the user functional requirements. The Contractor’s solution shall use and support the latest version of Hypertext Transport Protocol Secure (HTTPS), if the solution utilizes HTTP transport.

The Contractor shall work with the OCS ISSO to perform a full source code review and application code scanning for vulnerabilities at least every 60 days with public facing systems being vulnerability scanning and remediation performed at least weekly. The Contractor shall provide documentation on any identified source code review deficiencies, scanner identified vulnerabilities, secure baseline findings, and/or raw vulnerability scanner reports. The Contractor shall ensure all source code updates undergo a full source code review, full source code scanning and mitigation of vulnerabilities and secure baseline findings with the appropriate documentation provided to the government for each update demonstrating this security requirement has been maintained. The Contractor shall provide the source code to the government for each product update, enhancement and/or security flaw remediation.

To the greatest extent possible, the contractor shall scan all electronic information/data/software passed to/from NOAA with multiple commercial malicious software detection and removal products (e.g., anti- virus software, anti-malware, anti-spyware, etc.)

prior to use by either entity. To the greatest extent possible, the contractor shall ensure the electronic information/data/software provided to the Government is free of known malicious software.

The CO may add the following privacy related contract clauses FAR 52.224-1 and FAR 52.224-2 to this contract and applies to both electronic and hardcopy information/data. The Contractor shall comply with the DOC Personally Identifiable Information (PII), Business Identifiable Information (BII), and Privacy Act Breach Response and Notification Plan. The Contractor shall contact the OCS ISSO immediately upon detection and/or notification of a breach of PII and/or BII. The contractor must work with the COR and the OCS ISSO prior to sending the information to establish a secure method for transfer, such as the DOC Secure File Transfer application. The Contractor shall implement transmission and storage of sensitive information to meet or exceed the NIST Federal Information Processing (FIPS-3) Security Requirements for Cryptographic Modules using validated cryptographic module(s). The contractor must encrypt any sensitive information that will be sent electronically (i.e., email), to include:

● Personally identifiable information (PII), sensitive PII and/or Business-identifiable information (BII),

● Non-public information and/or data,

● All information describing the implementation, configuration, settings, etc.

(including IT configuration, IT management, IT security (includes security incidents (reporting, handling and mitigation) and security assessment documentation), IT administration, IT architecture, IT network management including firewall management and/or information obtained while performing privileged access roles),

● The source code and database schema,

● The vulnerability scanning, secure baselines scanning, mitigation results,

● The secure baseline deviations,

● Internet Protocol (IP), subnet mask and similar identification.

The contractor includes the necessary product support and supporting documentation for the hardware and/or software that allows the OCS Help Desk to complete the OCS sanitization process compliant with the appropriate NIST Special Publications.

The contractor is required to comply with the Department of Commerce’s Commerce Acquisition Manual’s (CAM) 1337.70 Personnel Security Requirements (available upon request).

The contractor is required to comply with all DOC, NOAA, and NOS, and OCS IT security requirements for taking any type of information technology component(s) on international travel. This includes mobile phone(s), mobile devices (laptop, tablets, etc.) or other mobile or portable technology (thumb drives, USB drives, etc.). Notification must be given to the OCS ITSB Chief and OCS Deputy Director to allow time for processing the international travel request for approval by the NOS Assistant Chief Information Officer (ACIO) for Government owned, Contractor owned or individual personally owned technology.

The contractor shall ensure all deliverables products and work products meet the following requirements:

License rights ‘‘Unlimited rights’’ means the rights to use, modify, reproduce, perform, display, release, or disclose a work in whole or in part, in any manner, and for any purpose whatsoever, and to have or authorize others to do so.

a) The term ‘‘works’’ includes all information and material developed in the performance of contract and submitted deliverables.

b) The Government shall have unlimited rights in works first produced, created, or generated and required to be delivered under this contract.

c) When a work is first produced, created, or generated under this contract, and such work is required to be delivered under this contract, the Contractor shall assign copyright in those works to the Government. The Contractor, unless directed to the contrary by the CO, shall place the following notice on such works: ‘‘© (Year date of delivery) United States Government, as represented by the Secretary of Commerce.

All rights reserved.”

d) The Contractor grants to the Government a royalty-free, world-wide, nonexclusive, irrevocable license to reproduce, prepare derivative works from, distribute, perform, and/or display, and to have or authorize others to do so.

e) The Contractor’s copyrighted works not first produced, created, or generated under this contract that have been incorporated into the works deliverable under this contract grants to the Government a royalty-free, world-wide, nonexclusive, irrevocable license to reproduce, prepare derivative works from, distribute, perform, and/or display.

Third party copyrighted works

a) The Contractor shall not incorporate, without the written approval of the CO, any copyrighted works in the works delivered under this contract unless the Contractor is the copyright owner or has obtained for the Government the license rights necessary to perfect a license of the scope. The Contractor must provide all evidence granting the Government rights to use.

b) The Contractor shall affix to the transmittal document a statement of the license rights obtained; or has provided a statement of the license rights obtained in a form acceptable to the CO.

Indemnification The Contractor shall indemnify, save and hold harmless the Government, and its officers, agents and employees acting for the Government, against any liability, including costs and expenses for the following:

a) For violation of proprietary rights, copyrights, or rights of privacy or publicity, arising out of the creation, delivery, use, modification, reproduction, release, performance, display, or disclosure of any works furnished under this contract, or

b) Based upon any libelous or other unlawful matter contained in such works,

c) Government-furnished information as it pertains to paragraphs Third party copyrighted works and Indemnification (above) are not applicable to information furnished to the Contractor by the Government and incorporated in the works delivered under this contract.