1 Statement of Work Final.docx

Statement of Work GeoServer Enterprise Support Services for Precision Marine Navigation and nowCOAST Requisition Number: 141009-25-0082

1. Purpose National Ocean Service’s Office of Coast Survey (OCS) requires technical support to maintain and improve nowCOAST’s open source map server and map services to support NOAA’s Precision Marine Navigation and nowCOAST projects.

The Precision Marine Navigation Project relies on foundational oceanographic, meteorological, and electronic navigational charting data; observations; predictions and model forecast guidance, and marine weather forecasts to support safe and efficient navigation within U.S. waterways. The Precision Marine Navigation Data Gateway Viewer (https://beta.marinenavigation.noaa.gov/gateway/) is a GIS Web Mapping application to make navigational information easily accessible and readily available and to allow users to explore NOAA’s S-100 map services.

nowCOAST (https://nowcoast.noaa.gov) is an operational GIS-based web mapping portal which provides coastal users with situational awareness of present and future environmental conditions. nowCOAST integrates and displays observations, analyses, imagery, warnings, forecasts and model forecast guidance from across NOAA and is used daily by a variety of user communities including commercial and recreational mariners, emergency managers at all levels of government, offshore oil/gas platform operators, coastal managers, and risk managers.

OCS is migrating nowCOAST to the AWS Cloud Environment and to use all open-source software. This includes the use of GeoServer and GeoWebCache. GeoServer is an open-source map server that allows users to process and edit geospatial data and publish the data via OGC- compliant Web Map Services, Web Map Tile Services, Web Feature Services, and Web Coverage Services. GeoWebCache is a tiling server which runs as a proxy between a map client and map server, caching (storing) tiles as they are requested, eliminating redundant request processing. GeoWebCache is integrated with GeoServer.

2. Scope of Work

The vendor shall provide 100 Hours of Professional Support Services for GeoServer and GeoWebCache to support the Precision Marine Navigation and nowCOAST Projects. This includes technical consultancy, custom development, bug fixes, notification about vulnerabilities, and/or optimization. In addition, the vendor shall have the experience and ability to contribute to the GeoServer code base. The vendor shall be able to provide low-level code changes for GeoServer for new features as needed.

3. Technical Requirements

The key tasks/services required for this effort over the one-year period of performance (100 hours of professional support) include the following:

A. Provide technical consultancy, performance tuning, analytics, bug fixes, and/or optimization for open source geospatial suite products including GeoServer and GeoWebCache. In particular, assist with diagnosing and eliminating memory errors in GeoServer and assist with improving resilience of GeoServers within nowCOAST

B. Provide advance notifications of GeoServer security vulnerabilities prior to public CVE disclosure. Offer remediation support, including guidance on safe GeoServer versions or patches, as well as assistance with installation and upgrades

C. Produce code level changes as needed in support of new features for GeoServer or its supporting libraries on behalf of nowCOAST including but not limited to:

· GeoServer (https://github.com/geoserver/geoserver)

· JAI-Ext (https://github.com/geosolutions-it/jai-ext)

· ImageIO-Ext (https://github.com/geosolutions-it/imageio-ext)

· GeoServer Docker (https://github.com/geoserver/docker)

4. Deliverables

Deliver monthly progress reports over the (nominal) period of performance, September 15, 2025 through September 14, 2026. Progress reports shall include itemized statements of hours of services performed. Progress reports shall be submitted via email to the Government Point of Contact, Wilbert Battle, at wilbert.battle@noaa.gov with a courtesy copy to Adam Gibbons (Adam.M.Gibbons@noaa.gov) by the tenth (10th) day of the next succeeding month. Deliverables include additions and/or improvements to open source software GeoServer and GeoWebCache and accompanying documentation.

5. Invoicing Schedule

Invoices shall be submitted upon delivery and acceptance of quarterly progress reports and/or deliverables, and at the conclusion of the Period of Performance. Each invoice will represent 25% of the total purchase order value., Invoicing is contingent upon approval of the quarterly progress reports/deliverables by the designated Government Point of Contact.

6. Invoices

Invoices shall be submitted through the Invoice Processing Platform at www.ipp.gov.

A copy of the invoices shall be sent via email to:

Wilbert Battle Email: Wilbert.Battle@noaa.gov NOAA OCS, Coast Survey Development Laboratory 1315 East-West Highway SSMC3 Room 6811 (N/CS1) Silver Spring, MD 20910 Office: (304) 460-8777

7. Period and Place of Performance Period of performance: September 15, 2025 through September 14, 2026. The work is assumed to be performed remotely through a dedicated ticket portal with available voice support for investigating ongoing projects.

8. Government Points of Contact Technical Task Lead:

Adam Gibbons Office: 603-862-0862 Email: adam.m.gibbons@noaa.gov

Government Point of Contact (GPOC) Wilbert Battle Office: (304) 460-8777 Email: Wilbert.Battle@noaa.gov

9. IT Security

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The Contractor shall only supply Information Technology (e.g. software, etc.) and shall not require the use of any OCS government-owned equipment. The contractor will not have remote access to any OCS government-owned equipment. The final delivered solution will be vetted by OCS prior to deployment on NOAA resources.

The following is a list of relevant information the Department of Commerce (DOC) Information Technology (IT) Security takes into consideration when assessing the security requirements and risk for procuring IT products and services.

a) The acquiring information technology is engineered for trustworthy and security that is consistent with the engineering-based trustworthy secure solutions as outlined in NIST Special Publication 800-160 Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1.pdf).

b) The acquiring information technology complies with Office of Management and Budget Memorandum M-07-18 Ensuring New Acquisitions Include Common Security Configurations and the Federal Acquisitions Regulations (FAR) 39.101(d) regulations require NIST common security configuration checklists including United States Government Configuration Baseline (USGCB) initiative. More information is available at National Checklist Program (NCP), (https://nvd.nist.gov/ncp/repository), the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low-level guidance on setting the security configuration of operating systems and applications. The acquiring information technology takes into account the following requirements:

i. Software procured meets the standard installation, operation, maintenance, updates and/or patching of software shall not alter the configuration settings from the approved USGCB/other secure configuration.

ii. Applications designed for normal end users run in the standard user context without elevated system administration privileges.

iii. Supporting documentation or reference(s) that describes the security capabilities, the design and development processes and the testing and evaluation procedures used by the product or services being provided for this acquisition.

iv. Supporting documentation or reference(s) that describes all product or service updates and enhancements as they are implemented. The product or service supporting documentation could be the user and system administrator guides, which is documents the functional properties of the security controls employed to permit the analysis and testing of the security controls.

c) The acquiring information technology complies with the Homeland Security Presidential Directive 12 (HSPD-12) Policy for a Common Identification Standard for Federal Employees and Contractors requirements from FAR 4.1302 stating: (a) In order to comply with Federal Information Processing Standard (FIPS) 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors (https://doi.org/10.6028/NIST.FIPS.201-3), agencies must purchase only approved personal identity verification products and services, (b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

d) The acquiring information technology complies with Internet Protocol Version 6 (IPv6) requirements from FAR part 11.002 requirements that state the agency Chief Information Officer can waive this requirement provided the acquisition requirements documents the appropriate technical capabilities defined in the USGv6 Profile available in the NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-program) and the corresponding declarations of conformance. To meet this requirement each DOC acquisition of IP protocol technology must express requirements for IPv6 capabilities in terms of the USGv6 Profile (i.e., using the USGV6 Capabilities Check List) and vendors must be required to document their product’s support of the requested capabilities through the USGv6 test program (https://www.nist.gov/programs-projects/usgv6-program/usgv6- revision-1) using the USGv6 Suppliers Declaration of Conformity.

The Contractor shall use of Government identified and approved cloud service providers. For any cloud services used by the contractor to support this acquisition; the Contractor shall meet the following conditions:

a) Shall comply with DOC and NOAA cybersecurity and privacy policies;

b) Shall comply with the NOAA Cloud Computing Security Testing, Authorizing and Continuous Monitoring Standard Operating Procedure (SOP) prior to production use of any cloud services. The Contractor shall not use any cloud services until approved NOAA or NOS Authorization to Operate (ATO) or received a NOAA or NOS approved risk acceptance.

c) Shall inform the NOS IT Security Officer (ITSO) and government assigned Information System Security Officer (ISSO) of all cloud services/offerings being leveraged prior to using any cloud service(s)/offering(s),

d) Shall throughout the lifecycle of this purchase order ensure all custom/acquired solutions within your area of responsibility provide the necessary information to support the documentation of the security posture (NIST Special Publications 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems and Organizations or later publication). The information provided shall cover the contractor’s solution (e.g., the solution can consist of [mobile/web] application/ database/ network operating systems (aka, virtual machines), Software as a Service, Platform as a Service, etc.),

e) Shall throughout the lifecycle of this purchase order ensure all custom/acquired solutions within your area of responsibility are consistent with the engineering-based trustworthy secure solutions as outlined in NIST Special Publication 800-160 Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1.pdf).,

f) Shall ensure all NOAA information and contractor solution resides within the United States, its territories and possessions,

g) Shall integrate into DOC, NOAA and NOS enterprise solutions for systems management and incident management systems to the greatest extent possible. If integration is not possible, the Contractor shall comply with the NOS Cybersecurity Risk Management requirements.

h) Shall ensure the Government retains the full administrative control to the master account, subscription administrator or its equivalent. The Contractor shall upon request relinquish to the Government all administrative control and/or access to resources residing within the cloud subscription/boundary.

i) Shall not destroy any information unless specifically authorized by the Contracting Officer Representative/Task Manager.

j) Shall upon request of the COR/TM use one of the approved methods for secure destruction of unclassified but sensitive information. Approved methods include NIST Special Publications 800-88 Guidelines for Media Sanitization (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) or the National Security Agency in the Media Destruction Guidance (https://www.nsa.gov/Resources/Media-Destruction-Guidance/).

The Contractor shall provide a description of how they secure their contractor owned equipment being used for this acquisition. The Contractor shall use the IT Security Questionnaire (titled: Information and Information Systems Security Requirements for Acquisitions) to assist in their response.

a) The Contractor can request assistance from the government assigned Information System Security Officer (ISSO) in describing how they secure their equipment. The IT Security Questionnaire developed following National Institute of Standards and Technology (NIST) Special Publications (SP) 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems and Organizations.

b) The Contractor shall disclose any third-party independent assessments and/or audits conducted on the cloud computing services that make up this acquisition as part of their response.

c) The government shall evaluate the contractor’s response to the questions and determine the potential contractor’s information security risk to the Government. If the Government determines the information security risk to be acceptable, the Authorizing Official will document their acceptance in a risk acceptance memo.

The Contractor shall work with the government-assigned ISSO to ensure that all database development, mobile application, web application, operating systems and/or software product development updates undergo vulnerability scanning, secure baseline compliance scanning and mitigation of vulnerabilities and/or compliance findings. The Contractor shall provide the appropriate documentation to the government for each update demonstrating that this requirement has been met prior to placing the new or update into production. Vulnerability scanning and remediation is required to be performed on components residing within the system boundary (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component(s)) at least every 60 days with public-facing systems vulnerability scanning and remediation performed at least weekly. The secure baseline scanning is required to be performed at least quarterly. The Contractor shall ensure that all source code updates undergo a full source code review, full source code scanning and mitigation of vulnerabilities and secure baseline findings with the appropriate documentation provided to the government for each update demonstrating that this security requirement has been maintained. The Contractor shall provide the source code to the government for each product update, enhancement and/or security flaw remediation.

The Contractor shall throughout the lifecycle of this purchase order provide updates when changes to their solution(s), policy changes, changes to NIST guidance and legislation are implemented.

The Contractor’s solution(s) being custom developed shall ensure that the solution does not contain any spyware, malicious software, coding flaws or programming backdoors to circumvent the application functionality or the security of the application as described by the government. The Contractor’s solution(s) shall not access data stored on the device or request end user information without following all government (including OMB) requirements. The Contractor’s solution(s) shall not transmit stored data from the installed device without clearly notifying the government, fully describing the required data being transmitted and receiving the government’s approval.

Specifically for mobile application, web application and/or software product development, appropriate planning shall be included during the assessment of needs, requirements, development and testing by the Contractor. The Contractor shall incorporate the security requirements into the mobile application development lifecycle along with the user functional requirements. The Contractor’s solution shall use and support the latest version of HyperText Transport Protocol Secure (HTTPS), if the solution utilizes HTTP transport.

Upon any identified source code review deficiencies or scanner identified vulnerabilities and/or secure baseline findings, the Contractor shall mitigate, and any other generated supporting documentation including the raw vulnerability scanner reports shall be provided. The Contractor shall ensure that all source code updates undergo a full source code review, full source code scanning and mitigation of vulnerabilities and secure baseline findings with the appropriate documentation provided to the government for each update demonstrating that this security requirement has been maintained. The Contractor shall provide the source code to the government for each product update, enhancement and/or security flaw remediation.