SON_for_RFQ.pdf

NOAA Office for Coastal Management RTK Field Equipment and Training

Statement of Need

Scope:

The National Oceanic and Atmospheric Administration (NOAA) is a world leader in coastal science and management. NOAA’s Office for Coastal Management (OCM) provides the technology, information and management strategies used by local, state, and national organizations to address complex coastal issues.

OCM has a requirement for obtaining three Trimble R8 Real-time Kinematic (RTK) system (base and rover) with integrated Global Navigation Satellite System (GNSS) Model 60 to support our integrated surveying efforts. These systems must be configurable to two different levels (base and rover mode and rover/network rover mode). This is a very flexible, scalable system that integrates efficiently (training/operation) with our other Trimble R8 systems. OCM has additional requirements for radio equipment and training as identified in the table. Products must be new and substitutions are not acceptable. Maintenance, support and technical assistance are essential for the successful execution of this contract. Equipment will be warrantied for 12 months after acquisition.

Technical Specifications: System with identified parts.

System Description Item Number Quantity Trimble R8 Model 60, single receiver, firmware version 5.41 with transport (hard) case.

R8S10160 6

Trimble R8s Configuration level – Base and Rover mode (Base, Rover/network rover, dual frequency tracking, triple frequency tracking, SBAS, QZSS, GLONASS, Beidou, Galileo, Precision level max, trimble data collector support, 20Hz)

R8SCFG00143 3

Trimble R8s Configuration Level – Rover/Network Rover Mode (rover/network rover, dual frequency tracking, SBAS, QZSS, GLONASS, precision level max, and trimble data collector support)

R8SCFG00142 3

Period of Performance:

This equipment shall be received by the government no later than 1 August 2019. The equipment shall be delivered to: Attn: Nina Garfield, 1305 East West Highway, SSMC4, 10th Floor, Silver Spring, MD 20910. Phone number: 240-533-0817. All equipment shall be new and come with 12 months manufacturer’s warranty. Technical assistance on equipment will be provided to NOAA Staff located in Silver Spring, Maryland.

The Trimble Business Software training will be delivered within 12 months of the contracts approval. The training topics and approach will be determined by NOAA’s National Estuarine

Ranger 3XC Survey Pro Software version 6.5.0.41.

GNSS with integrated Bluetooth, WIFI 8021lg, GPS, Compass, 5 MP Camera and WWAN. It must have an 800MHz processor with 256 MB of RAM and 8 GB of Flash. Comes with standard:

international charger, rechargeable li-ion battery, USB interface cable, nylon carry case, hand strap, stylus lanyard, package of two screen protectors, ranger getting started guide and two spring tipped stylus pens

RG3G01003 3

Trimble TSC3 GNSS Accessory kit includes (Pole Bracket, TSC3 Cradle, Lemo- 9-pin Cable)

8276800 3

Trimble TDL 450H UHF Radio System Kit (410-430 MHz) to include Cable 17.

The radio needs to be programmed to specific NOS approved frequencies 412.325 MHZ C and 413.9125 MHZ C.

7445192 3

Trimble Whip Antenna

5DB 410 – 430 MHZ PDL

518711030 3

Trimble Business Center Software training to be provided (in person and via webinar)

20 hours

Research Reserve System, but will include a combination of web based training and in–person training in Silver Spring, MD and other locations as required.

IT Security Requirements:

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The contractor will only supply hardware and/or software and/or product license and will not require the use of any contractor owned equipment. The contractor will not have remote access to any government owned equipment. The contractor must ensure the hardware and/or software provided disables “phone home” or similar capabilities.

The contractor includes the necessary product support and supporting documentation for the hardware and/or software that allows the sanitization (following NIST Special Publications 800- 88 Guidelines for Media Sanitization, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) of the hardware and/or software upon the disposal of the product.

The contractor must provide sufficient document demonstrating the software being provided complies with Office of Management and Budget Memorandum M-07-18 entitled Ensuring New Acquisitions Include Common Security Configurations and the FAR 39.101(d) regulations involving NIST common security configuration checklists including United States Government Configuration Baseline (USGCB) initiative. More information is available at National Checklist Program (NCP), (http://checklists.nist.gov), is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low-level guidance on setting the security configuration of operating systems and applications.

The contractor must provide sufficient documentation which demonstrates the acquiring information technology has implemented common security configurations. Common security configurations are available from the National Institute of Standards and Technology’s website at http://checklists.nist.gov.

The contractor must ensure that the product being purchased complies with the Homeland Security Presidential Directive 12 (HSPD-12) requirements from FAR 4.1302 stating: (a) In order to comply with FIPS PUB 201, agencies must purchase only approved personal identity verification products and services. (b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

The contractor must ensure that the product being purchased complies with Internet Protocol Version 6 (IPv6) requirements from FAR part 11.002 requirements which state that unless the agency Chief Information Officer waives the requirement, when acquiring information technology using Internet Protocol, the requirements documents must include reference to the appropriate technical capabilities defined in the USGv6 Profile (NIST Special Publication (SP)

500-267- http://www.nist.gov/itl/antd/usgv6.cfm) and the corresponding declarations of conformance defined in the USGv6 Test Program (http://www-x.antd.nist.gov/usgv6/index.html). To meet this requirement each DOC acquisition of IP protocol technology must express requirements for IPv6 capabilities in terms of the USGv6 Profile (i.e., using the USGV6 Capabilities Check List) and vendors must be required to document their product’s support of the requested capabilities through the USGv6 test program (reference http://www.antd.nist.gov/usgv6/) using the USGv6 Suppliers Declaration of Conformity.

The contractor must provide sufficient document demonstrating the software being provided meets the following:

1) The standard installation, operation, maintenance, updates and/or patching of software shall not alter the configuration settings from the approved USGCB/other secure configuration.

2) Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

The contractor must provide all supporting documentation or a reference to obtain the necessary material which describes the security capabilities, the design and development processes and the testing and evaluation procedures used by the product or services being provided for this acquisition. The contractor must provide all supporting documentation or a reference to obtain the necessary material which describes all product or service updates and enhancements as they are implemented. The product or service supporting documentation could be the user and system administrator guides, which is documents the functional properties of the security controls employed to permit the analysis and testing of the security controls.

If the vendor proposes the use of cloud services, NOS requires an integrated technical solution which meets the security requirements below. For any cloud services being used by the contractor to support this acquisition, the following conditions must be met:

a. Comply with DOC and NOAA Information Technology Security Policies;

b. Must use Cloud Services that are covered under the Federal Risk Authorization

Management Program (FedRAMP; http://www.fedramp.gov/) ,

c. NOS IT Security Program and Program Office Information System Security Officer

(ISSO) must review appropriate FedRAMP package(s) and conduct a risk assessment of the appropriate FedRAMP package(s) and associated cloud services prior to using any cloud service(s),

d. The use of the cloud services must have either received an NOS or NOAA Authorization to Operate (ATO) or have a NOAA or NOS approved risk acceptance for the pending

ATO,

e. The contractor must provide the necessary information to support the documentation of the security posture (NIST Special Publications 800-53 Security and Privacy Controls for Federal Information Systems and Organizations) covering the contractor’s solution (the solution can consist of [mobile/web] application/ database/ network operating systems (aka, virtual machines)),

f. The contractor must ensure all NOAA information and contractor solution resides within the United States.

g. Integrate into DOC, NOAA and NOS enterprise solutions for systems management and incident management systems. Systems management and incident management examples include Enterprise Continuous Monitoring Operations (IBM Bigfix), enterprise logging/analysis (Arcsight), enterprise incident management, enterprise vulnerability management (Tenable Security Center), enterprise systems management (Microsoft Systems Center Configuration Manager/Redhat Satellite/JAMF Software Casper Suite), and enterprise endpoint anti-virus/anti-malware management (Intel McAfee ePolicy Orchestrator). If integration is not possible, vendor working with the government-identified Information System Security Officer must obtain a risk acceptance from Authorizing Official and Co-Authorizing Official.

h. Provide Government with full administrative control to the master account, subscription administrator or its equivalent. A master account, subscription administrator is defined as a highest (or root) privileged level access mechanism that has control over the information technology resources residing within the cloud subscription/boundary assigned to this contract. The Contractor will ensure that only the activities supporting this contract reside within the master account, subscription administrator or its equivalent. The Contractor must relinquish all administrative control and/or access to resources residing within the cloud subscription/boundary assigned to this contract. The Government may grant access to the Contractor as needed.