REQUEST FOR QUOTATION

(THIS IS NOT AN ORDER)

THIS RFQ IS IS NOT A SMALL BUSINESS SET-ASIDE

15. DATE OF QUOTATION

16. SIGNER

a. NAME (Type or print)

c. TITLE (Type or print)

b. TELEPHONE

AREA CODE

NUMBER

STANDARD FORM 18 (REV. 6/1995)

Prescribed by GSA-FAR (48 CFR) 53.215-1(a)

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition not usable

8. TO:

b. COMPANYa. NAME

c. STREET ADDRESS

d. CITY e. STATE f. ZIP CODE

9. DESTINATION

a. NAME OF CONSIGNEE

b. STREET ADDRESS

d. STATE e. ZIP CODE

7. DELIVERY

FOB DESTINATION

OTHER

(See Schedule)

10. PLEASE FURNISH QUOTATIONS TO THE

ISSUING OFFICE IN BLOCK 5a ON OR BEFORE CLOSE OF BUSINESS (Date)

IMPORTANT: This is a request for information and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it to the address in Block 5a. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or service. Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotation must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NUMBER

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS (%) b. 20 CALENDAR DAYS (%) c. 30 CALENDAR DAYS (%) d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations are are not attached.

13. NAME AND ADDRESS OF QUOTER

a. NAME OF QUOTER

b. STREET ADDRESS

c. COUNTY

d. CITY e. STATE f. ZIP CODE

14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

PAGE OF PAGES

1. REQUEST NUMBER 2. DATE ISSUED 3. REQUISITION/PURCHASE REQUEST NUMBER 4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG. 1

RATING

5a. ISSUED BY 6. DELIVER BY (Date)

NAME TELEPHONE NUMBER

AREA CODE NUMBER

c. CITY

5b. FOR INFORMATION CALL (NO COLLECT CALLS)

716 West Cedar Street, UNIT E

USGS OAG SACRAMENTO ACQUISITION BR.

MODOC HALL, CSUS

3020 STATE UNIVERSITY DRIVE EAST

SACRAMENTO CA 95819-6027

0044043250140G0326Q0120

Joahnne Ongjoco

278-9328

US GEOLOGICAL SURVEY

95501

06/12/2026

06/18/2026 0900 ED

Eureka

CA

Firm, fixed price.

ANTICIPATED AWARD OF PURCHASE ORDER FOR

THIS REQUIREMENT WILL NOT RESULT IN

STATUS AS A FEDERAL EMPLOYEE.

All interested parties must be actively registered in the System for Award

Management (SAM) at the time of submitting a quote to be considered for an award of a federal contract. For information, review the SAM website at www.SAM.gov.

The U.S. Geological Survey (USGS) requires custom computer programming

Continued...

1 38

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGES

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C)

NSN 7540-01-152-8067

140G0326Q0120 services to modify PINGMapper source code for studies involving reservoir sediments and effects on benthic substrates and ecological habitats in the downstream river environment of

Klamath River, California in accordance with the attached performance work statement (PWS), Section 508, FISMA, provisions, and clauses.

This work requires expert level knowledge in geospatial analysis of sonar data in river environments and expert level skill in

PINGMapper source code and Python programming.

Estimated period of performance: July 1, 2026

- June 30, 2027

Evaluation method is Trade-Off. Please see evaluation factors as described in FAR 52.212-2 in the provisions of attachment.

It is the responsibility of all interested parties to check back periodically for any amendments to the solicitation. All amendments must be signed and included when the quote is submitted.

Award will be made in accordance with

Revolutionary FAR Overhaul (RFO), FAR Subpart

12.204, Award. Anticipated award date is June

29, 2026. All responsible sources may submit a quotation which will be jointly considered DOI and USGS.

If interested, please include the following in your quotation:

1. Firm, fixed price

2. Sufficient information to be considered for evaluation factors

3. Signed, standard form (SF) 18

4. SAM UEI#

**Please submit your technical quote and price quote as separate attachments.

Questions due: June 17, 2026 at 0900 hours

Eastern Time.

Quotations are due as indicated under block 10

Continued...

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGES

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C)

NSN 7540-01-152-8067

140G0326Q0120 of SF 18.

Questions and quotations are accepted only by email to Joahnne_Ongjoco@ios.doi.gov. Hardcopy or submission by other means will not be considered.

00010 PINGMapper Python Programming Services in accordance with the attached performance work statement (PWS).

Product/Service Code: DA10

Product/Service Description: IT AND TELECOM -

BUSINESS APPLICATION/APPLICATION DEVELOPMENT

SOFTWARE AS A SERVICE

Period of Performance: 07/01/2026 to

06/30/2027

Attachment: 35 pages

U.S. Geological Survey California Water Science Center Performance Work Statement

1.0 INTRODUCTION

Consumer-grade, low-cost, side-scan sonar enables efficient, repeat imaging of river substrate conditions. However, manual post-processing of sonograms and classification of sonar mosaics are extremely labor-intensive due to the large volume of data. PINGMapper (Bodine et al., 2022;

https://cameronbodine.github.io/PINGMapper/) is an open-source Python interface that automates the post-processing of sonar recordings and segmentation and classification of sonar mosaics using deep learning (DL) models (Bodine et al., 2024). Final products are georeferenced sonar mosaics and substrate maps with seven classes (fines ripples, fines flat, cobble boulder, hard bottom, wood, other, and shadow. This scope of work (SOW) outlines modifications to the PINGMapper source code for use in coarse-grained rivers, as well as post-processing and analysis of existing datasets to assess substrate conditions to support USGS science studies in the Klamath River, California.

2.0 BACKGROUND

Recently, the largest dam removals in U.S. history occurred on the Klamath River. In 2023, one low-head dam was removed; in 2024, three large dams were removed simultaneously. During reservoir drawdowns and dam removal, approximately 1.2 million metric tons of fine-grained (silt/clay), organic‑rich sediments were released downstream into a coarse-grained (gravel/cobble) river environment. In 2022 and 2023, before the dam removals, the USGS surveyed 120 km of the mainstem Klamath River using consumer-grade, low-cost side-scan sonar (Humminbird 710292-1 XM 14 HW MSI T SOLIX) and repeated the surveys in 2025 after the dam removals. This SOW addresses two important questions related to the dam removals. What was the fate of the fine-grained reservoir sediments released into the coarse-grained river environment? How did benthic substrates and ecological habitats change?

3.0 SCOPE

U.S. Geological Survey (USGS), California Water Science Center (CWSC) requires software programming services to provide modifications of the PINGMapper source code, integration of auxiliary high-resolution GPS data for sonogram georeferencing, and change-detection analysis aligned with USGS research objectives to address the fate of reservoir sediments and effects on benthic substrates and ecological habitats in the downstream river environment.

The contractor shall provide monthly progress reports by email. During the first 3 months of the award period, the contractor shall meet with USGS staff for bimonthly virtual discussions. After the first 3 months, the contractor and USGS staff will schedule virtual meetings, as needed, to ensure product delivery meets QA/QC requirements and project timeline (described under 7.0 Technical Requirements)

3.1 AREA OF INTEREST

The area of interest (AOI) includes 120 river kilometers along the mainstem of the Klamath River in California.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 4 of 38 https://cameronbodine.github.io/PINGMapper/

4.0 SUPPORTING INFORMATION

• Bodine, C.S., Buscombe, D., Hocking, T.D. (2024). Automated river substrate mapping from sonar imagery. Journal of Geophysical Research – Machine Learning and Computation, 1, e2024JH000135. https://doi.org/10.1029/2024JH000135

• Bodine, C.S., Buscombe, D., Best, R.J., Redner, J.A., & Kaeser, A.J. (2022). PING‑Mapper:

Open‑source software for automated benthic imaging and mapping using recreation‑grade sonar. Earth and Space Science, 9, e2022EA002469. https://doi.org/10.1029/2022EA002469

5.0 PLACE OF PERFORMANCE

• All work will take place at the contractor’s facility.

6.0 TECHNICAL REQUIREMENTS

This project requires demonstrated:

• experience modifying open-source Python-based geospatial processing software, preferably including PINGMapper or similar sonar processing platforms

• knowledge in geospatial analysis of sonar data in river environments.

The contractor shall modify the PINGMapper source code for use in coarse-grained rivers. Modifications will include: 1) incorporating confidence thresholds to support selection of appropriate class thresholds and optimization of classified substrate maps, and 2) incorporating auxiliary high-resolution GNSS data for georeferencing sonar mosaics. The contractor will use the modified PINGMapper code to 3) post-process existing sonar recordings and produce optimized substrate maps for the AOI, 4) conduct change detection analysis for the AOI, and 5) deliver USGS-ready data release and supporting information for a manuscript.

6.1 TASK 1 Confidence Thresholding

The contractor shall modify the PINGMapper source code to 1) compute per-patch confidence scores directly from model outputs for substrate classes, 2) summarize the per-patch multi-class statistics (mean, minimum, maximum, standard deviation), and 3) set low-confidence patches to ‘Unknown’ to minimize false positives and determine optimized class-specific thresholds for coarse-grained rivers.

• Deliverable: Exportable patch-level summary statistics of substrate class likelihoods (e.g.

confidence scores) in *csv format.

• Method: Upload supporting data and information and modified source code to a GitHub repository.

• Date: 3 months from the date of the award

6.2 TASK 2 Auxiliary GPS Integration

The contractor shall modify the PINGMapper source code to 1) accept auxiliary sources of high-resolution GNSS data (*csv format) for georeferencing PINGMapper products, 2) match auxiliary GPS points to sonar recordings via timestamps and account for clock offsets, when necessary, 3) update PINGMapper workflows to utilize the new GPS data source in subsequent geoprocessing workflows and data outputs.

• Deliverable: PINGMapper functionality to ingest auxiliary GPS sources and propagate positioning into metadata in the form a python script.

• Method: Upload supporting data and information and modified source code to a GitHub repository.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 5 of 38 https://doi.org/10.1029/2024JH000135 https://doi.org/10.1029/2022EA002469

• Date: 5 months from the date of the award

6.3 TASK 3 Sonar Scan Processing

The contractor shall 1) batch-process existing sonar recordings collected by the USGS, 2) apply optimized Klamath-specific confidence thresholds, and 3) export optimized substrate maps for 75 sites (approximately 0.5-1.0 km reaches) collected across three years (2022, 2023, 2025), and 4) load optimized substrate maps into a file geodatabase (*fgb) and compress into a zip file.

• Deliverable: Georeferenced sonar mosaics and fine-tuned substrate maps for 75 sites across three survey years; auxiliary GPS integrated for 2025 scans in the form of georeferenced rasters and polygon features.

• Method: All data and supporting information shall be delivered by electronic transfer to be published on a USGS repository.

• Date: 7 months from the date of the award

6.4 TASK 4 Reach-Level Change Analysis

The contractor shall 1) determine categories suitable for change detection and communication of study findings, 2) calculate reach-level class proportions for each scan year, 3) quantify inter-annual changes, and 4) complete robust QA/QC and error analysis.

• Deliverable: Change analysis and summary tables and graphs by scan year in an EXCEL spreadsheet.

• Method: All data and supporting information shall be delivered by electronic transfer to be

• Date: 8 months from the date of the award

6.5 TASK 5 Deliverables

The contractor shall 1) curate final mosaics, maps, and metadata into a USGS-ready data release package with accuracy assessment, and 2) provide supporting information for a manuscript.

• Deliverable: USGS-ready data release package with accuracy assessment and supporting information (figures and tables in EXCEL spreadsheets, and text in a WORD document)

• Method: All data and supporting information shall be delivered by electronic transfer to be

• Date: 11 months from the date of the award

7.0 DATA RIGHTS

All raw and processed data, as well as derived maps and analyses produced under this order, will be delivered to USGS. Source code enhancements to PINGMapper will remain open‑source under the existing license, with appropriate documentation. USGS has the right to use, disclose, modify, distribute, and reproduce any raw and processed data as above, as well as any deliverables resultant from order.

8.0 GOVERNMENT FURNISHED INFORMATION

The USGS will provide the contractor with the following:

• Side scan sonar recordings collected in 2022, 2023, and 2025

• Auxiliary GPS data collected in 2025

9.0 PERIOD OF PERFORMANCE

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 6 of 38

July 1, 2026 – June 30, 2027

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 7 of 38

ICT Accessibility Requirements Statement per Section 508 of the Rehabilitation Act

PING-Mapper Open Source Python Interface

E201 Application

E201.1 Scope. ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards.

E206 Hardware

E206.1 General. Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

E207 Software

E207.1 General. Where components of ICT are software and transmit information or have a user interface, such components shall conform to E207 and the requirements in Chapter 5

Exception from E207.1 General: Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to the requirements in Chapter 5.

E207.2 WCAG Conformance. User interface components, as well as the content of platforms and applications, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

Exceptions from E207.2 WCAG Conformance:

● Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to E207.2.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 8 of 38

● Non-web software shall not be required to conform to the following four Success Criteria in WCAG 2.0: 2.4.1 Bypass Blocks; 2.4.5 Multiple Ways;

3.2.3 Consistent Navigation; and 3.2.4 Consistent Identification.

● Non-Web software shall not be required to conform to Conformance Requirement 3 Complete Processes in WCAG 2.0.

E208 Support Documentation and Services

E208.1 General. Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

E302 Functional Performance Criteria

302.1 Without Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color. Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

302.5 With Limited Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech. Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 9 of 38

302.7 With Limited Manipulation. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities. ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

501 General

501.1 Scope. The requirements of Chapter 5 shall apply to software where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

Exception from E501.1 Scope: Where Web applications do not have access to platform accessibility services and do not include components that have access to platform accessibility services, they shall not be required to conform to 502 or 503 provided that they conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

502 Interoperability with Assistive Technology

502.1 General. Software shall interoperate with assistive technology and shall conform to 502.

Exception from E502.1 General: ICT conforming to 402 shall not be required to conform to 502.

602 Support Documentation

602.1 General. Documentation that supports the use of ICT shall conform to 602.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 10 of 38

603 Support Services

603.1 General. ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

Instructions to Offerors

1 Provide an Accessibility Conformance Report (ACR) for each commercially available Information and Communication Technology (ICT) item offered through this contract. Create the ACR using the Voluntary Product Accessibility Template Version 2.1 or later, located at https://www.itic.org/policy/accessibility/vpat. Complete each ACR in accordance with the instructions provided in the VPAT template. Each ACR must address the applicable Section 508 requirements referenced in the Work Statement. Each ACR shall state exactly how the ICT meets the applicable standards in the remarks/explanations column, or through additional narrative.

All "Not Applicable" (N/A) responses must be explained in the remarks/explanations column or through additional narrative. Address each standard individually and with specificity, and clarify whether conformance is achieved throughout the entire ICT Item (for example - user functionality, administrator functionality, and reporting), or only in limited areas of the ICT Item. Provide a description of the evaluation methods used to support Section 508 conformance claims. The agency reserves the right, prior to making an award decision, to perform testing on some or all of the Offeror’s proposed ICT items to validate Section 508 conformance claims made in the ACR.

2 Describe your approach to incorporating universal design principles to ensure ICT products or services are designed to support disabled users.

3 Describe plans for features that do not fully conform to the Section 508 Standards.

4 Describe "typical" user scenarios and tasks, including individuals with disabilities, to ensure fair and accurate accessibility testing of the ICT product or service being offered.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 11 of 38 https://www.itic.org/policy/accessibility/vpat

Acceptance Criteria

1 Prior to acceptance, the government reserves the right to perform testing on required ICT items to validate the offeror’s Section 508 conformance claims. If the government determines that Section 508 conformance claims provided by the offeror represent an inaccurate level of conformance than what is actually delivered to the agency, the government shall, at its option, require the offeror to remediate the delivered item to align with the required Section 508 conformance claims prior to acceptance.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 12 of 38

FISMA 18-Point Checklist – IT Security Guidelines

U.S. Geological Survey Office of Acquisition and Grants Questions to askoag@usgs.gov

December 14, 2022 Page 1 of 6

COTS

Hardware or Software

Development or

Maintenance of

Custom

Applications

Outsourced IT Services or On-site Support

Requirements herein are incorporated as part the Statement of Work/ Performance Work Statement:

1 N/A Background Investigations. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information Technology.”

2 N/A Non-disclosure Agreement. Prior to receiving access to USGS computers, contractor employees shall be required to sign nondisclosure or other system security agreements, depending on the systems to be used and level of access granted.

Applies whenever any contractor employee has unsupervised access to a

USGS system (even if only basic network, internet or email or will develop custom applications) such as:

• User Access to USGS IT Systems known to contain sensitive or proprietary data

Contractor will have • IT Support services (greater than user access) access to Privacy • Development or Maintenance of Custom Applications

Act System of

Records - Work

• On-site contractor support and management of IT system

• Off-site contractor Oversight and Management of IT System under this contract will involve design,

• IT Security Services development or Privacy Act System: [Identify covered system(s) to which the contractor operation of (access

to) system(s) of records containing may have access] personal information protected by the

Work to be performed: [Summarize nature of the contractor's use of such records, such as]

Privacy Act (5 U.S.C.

Section 552a).

• User-level access to system containing protected records

• Operation or maintenance of Privacy Act System of records or computers hosting such system

• Design or modification of a Privacy Act system of records]

The contractor is not required or permitted to respond to requests for Privacy Act data or to make decisions about releases of data under the

Act. Contractor shall ensure its employees are instructed to safeguard against improper use or release of such data and advise them that violation of the Act may involve criminal penalties. The contractor will comply with FAR clause 52.224-2, Privacy Act, incorporated herein by reference and with DOI Privacy Act regulations at 43 CFR 2, Subpart D

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 13 of 38 mailto:askoag@usgs.gov

Questions to askoag@usgs.gov

December 14, 2022 Page 2 of 6

COTS

Hardware or Software

Development or

Maintenance of

Custom

Applications

Outsourced IT

Services or On-site Support

Requirements herein are incorporated as part the Statement of Work/

Performance Work Statement:

3 N/A Training. The Contractor shall perform in accordance with clause

“Security Requirements: Facility Access and Information Technology” -

Contractor employees must successfully complete DOI’s end-user computer security awareness training prior to being granted access to

DOI data or being issued a user account. Training must be renewed annually. Additionally, the contract employees must sign a Statement of

Responsibility (SOR) that states they have read the appropriate Rules of

Behavior and other applicable Information security policies.

4 N/A Personnel Changes. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information

Technology” - The contractor must notify the COR immediately when an employee working on a DOI system is reassigned or leaves the contractor’s employ.

Applies whenever any contractor employee has unsupervised access to a USGS system (even if only basic network, internet or email or will develop custom applications) such as:

• User Access to USGS IT Systems known to contain sensitive or proprietary data

• IT Support services (greater than user access)

• Development or Maintenance of Custom Applications *

• On-site contractor support and management of IT system

• Off-site contractor Oversight and Management of IT System

• IT Security Services *

*May not be applicable for off-site performance.

5 N/A Contractor Location. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information Technology.”

Applies whenever any contractor employee has unsupervised access to a USGS system (even if only basic network, internet or email or will develop custom applications) such as:

• User Access to USGS IT Systems known to contain sensitive or proprietary data

• IT Support services (greater than user access)

• Development or Maintenance of Custom Applications

• On-site contractor support and management of IT system

• Off-site contractor Oversight and Management of IT System

• IT Security Services

No portion of the services to be performed hereunder may be performed outside the United States without the express written permission of the Contracting Officer.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 14 of 38

Questions to askoag@usgs.gov

December 14, 2022 Page 3 of 6

T

COTS

Hardware or Software

Development or

Maintenance of

Custom

Applications

Outsourced IT

Services or On-site Support

Requirements herein are incorporated as part the Statement of Work/

Performance Work Statement:

If services are proposed to be performed abroad, the Contractor shall provide an acceptable security plan that addresses mitigation of problems related to communication, control, and protecting the confidentiality, integrity, and availability of IT systems and information.

A Security Plan Template is available upon request from the Contracting Officer.

6 N/A N/A Applicable Standards. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information

Technology” - Contractor must follow the DOI System Development Life Cycle (SDLC), NIST SP 800-64 and the DOI SDLC Security Integration Guide.

7 N/A Asset Valuation-Security Categorization: The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information Technology.”

User Access to USGS IT Systems – The Government is responsible for security categorization on USGS systems to which the Contractor may have access under this contract.

IT Support Services greater than User-Level Services Choose one:

➔ The Government is responsible for security categorization on USGS systems to which the Contractor may have access under this contract.

-➔ he Government has defined the [insert name of system to be developed, operated or maintained by the contractor] to be a [Major Application], [Minor Application] or [General support system] as defined in OMB Circular A-130, Appendix III and NIST SP800-53. The following risk and sensitivity levels have been assigned based on the FIPS 199 and the NIST SP 800-60.

Mission impact:

Data sensitivity:

Risk level:

Bureau/departmental/national criticality:

Off-Site Oversight and Management of IT System- The Contractor shall use the FIPS 199 and the NIST SP 800- 60 to determine information types and security categorization based on mission impact, data sensitivity, risk level, and bureau / departmental / national criticality for Contractor-owned and operated systems used to provide services under this contract. Solicitations must include either the complete publication or a reference to public facilities, such as a website or office, where it may be accessed.

IT Security Services - Applies only if the purpose of the contract includes obtaining asset valuation services.

The Contractor shall use the FIPS 199 and the NIST SP 800- 60 to determine information types and security categorization based on mission impact, data sensitivity, risk level, and bureau / departmental / national criticality for Contractor-owned and operated systems used to provide services under this contract. Solicitations must include either the complete publication or a reference to public facilities, such as a website or office, where it may be accessed.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 15 of 38 https://doimspp.sharepoint.com/sites/usgs-OAG/AOP/guidefordevelopingsecurityplans.pdf

Questions to askoag@usgs.gov

May 11, 2021 Page 4 of 6

COTS

Hardware or Software

Development or

Maintenance of

Custom

Applications

Outsourced IT

Services or On-site Support

Requirements herein are incorporated as part the Statement of Work/

Performance Work Statement:

8 Property Rights.

1. For Federal Supply Schedule orders or orders under an existing contract, rights to software acquired hereunder are set forth in the basic contract.

2. For open market contracts, the Government's rights in software delivered hereunder shall be as described in software developer's commercial software license agreement or the clause FAR 52.227-

19, Commercial Computer Software-Restricted Rights, whichever is greater.

The Government Select either shall be granted COTS or custom unlimited rights in software software or data language as produced applicable. If hereunder as both apply, described in FAR identify clause 52.227- software/data

17, Rights in deliverables

Data—Special governed by

Works, each clause.

incorporated by reference herein.

9 N/A Independent Verification and Validation (IV&V). The

Government is responsible for independent software verification and validation prior to being moved into production.

On-Site Contractor Support and Management of IT System Choose one:

➔ Software will be independently verified and validated by the Government or another selected contractor prior to being moved into production.

➔ Contractor will ensure that independent verification and validation is performed on software deployed on contractor managed systems containing USGS data, in accordance with DOI SDLC Security Integration Guide

Off-Site Contractor Operation and Management of IT System-Contractor will ensure that independent verification and validation is performed on software deployed on contractor managed systems containing USGS data, in accordance with DOI SDLC Security Integration Guide

IT Security Service - Applies only if the purpose of the contract includes obtaining IV&V services.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 16 of 38

Questions to askoag@usgs.gov

December 14, 2022 Page 5 of 6

COTS

Hardware or Software

Development or

Maintenance of

Custom

Applications

Outsourced IT

Services or On-site Support

Requirements herein are incorporated as part the Statement of Work/

Performance Work Statement:

10 N/A Certification & Accreditation.

User Access to USGS IT Systems or IT Supports Services (Greater than User Access Certification and Accreditation on USGS systems to which the Contractor may have access under this contract will be conducted by the Government or another of its contractors.

Development or Maintenance of Custom Applications The contractor will perform Certification and Accreditation (C&A) services on the application developed or maintained hereunder prior to going into production. The application must be re-accredited every three years or whenever there is a major change that affects security.

C&A documents will be provided to the COR in both hard copy and electronic forms. The contractor must follow NIST SP 800-37, 800-18, 800-30, 800-60, 800-53A, Federal Information Processing Standard (FIPS) 199 and 200, the associated DOI guides/templates, the DOI Security Test & Evaluation (ST&E) Guide, and the DOI Privacy Impact Assessment.

NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/ FIPS documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/.

The contractor may request copies of DOI documents by contacting the Contracting Officer.

The government reserves the right to conduct the ST&E using either Government personnel or an independent contractor. The contractor will take immediate and timely action to correct or mitigate any weaknesses discovered as necessary to bring the application or system into compliance with the above requirement.

On-Site Contractor Support and Management of IT System or Off-Site Contractor Operation and Management of IT System The Contractor must maintain systems that are compliant with NIST SP 800-18, 800-30, 800-37, 800-53A, 800-60, Federal Information Processing Standard (FIPS) 199 and 200, the associated DOI guides/templates, the DOI Security Test & Evaluation (ST&E) Guide, and the DOI Privacy Impact Assessment. As required by the above, Major Applications and General Support Systems shall be certified and accredited (C&A) prior to going into production and re-accredited every three years or whenever there is a major change that affects security. C&A documents will be provided to the COR in both hard copy and electronic forms. NIST documents are available on the internet at http://csrc.nist.gov/publications/nistpubs/. The contractor may request copies of DOI documents by contacting the Contracting Officer. The government will reserve the right to conduct the ST&E, using either Government personnel or an independent contractor. The contractor will take immediate and timely action to correct or mitigate any weaknesses discovered as necessary to bring the application or system into compliance with the above requirement.

Applies if the purpose of the contract includes obtaining C&A services.

11 N/A for COTS

HW & SW, User Access to USGS IT Systems (other than IT services), IT Support Services (User Level or greater access)

N/A Internet Logon Banner. The Contractor shall perform in accordance with clause “Security Requirements: Facility Access and Information

Technology.”

Development or Maintenance of Custom Applications OR On-Site Contractor Support and Management of IT System OR Off-site Contractor Oversight and Management of IT

System- Web-based applications developed or maintained under this contract must contain a USGS approved logon banner:

https://portal.doi.net/CIO/ITPMgmt/Documents/IT Standards/IT Security/DOI Security Control Standards (based on NIST SP 800-53 Revision 3)/Access Control v1.4.pdf

12 N/A Incident Reporting. The Contractor shall perform in accordance with contract clause “Security Requirements: Facility Access and

Information Technology” - The contractor must report computer security incidents affecting DOI data or systems in accordance with the DOI Computer Incident Response Guide.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 17 of 38 mailto:askoag@usgs.gov http://csrc.nist.gov/publications/nistpubs/ http://csrc.nist.gov/publications/nistpubs/ http://csrc.nist.gov/publications/nistpubs/ https://portal.doi.net/CIO/ITPMgmt/Documents/IT%20Standards/IT%20Security/DOI%20Security%20Control%20Standards%20(based%20on%20NIST%20SP%20800-53%20Revision%203)/Access%20Control%20v1.4.pdf https://portal.doi.net/CIO/ITPMgmt/Documents/IT%20Standards/IT%20Security/DOI%20Security%20Control%20Standards%20(based%20on%20NIST%20SP%20800-53%20Revision%203)/Access%20Control%20v1.4.pdf

Questions to askoag@usgs.gov

December 14, 2022 Page 6 of 6

COTS

Hardware or Software

Development or

Maintenance of

Custom

Applications

Outsourced IT

Services or On-site Support

Requirements herein are incorporated as part the Statement of Work/

Performance Work Statement:

13 Quality Control. All software or hardware purchased must be free of malicious code such as viruses, Trojan horse programs, worms, spyware, etc. Validation of this must be written into the contract.

14 N/A N/A Self-Assessment. The Contractor shall perform in accordance with contract clause “Security Requirements: Facility Access and Information

Technology” - The contractor must conduct an annual self-assessment in accordance with annual DOI guidance on all information systems in production.

15 N/A Vulnerability Analysis. Vulnerability Analysis on USGS systems to which the Contractor may have access under this contract will be conducted by the Government or another of its contractors.

16 N/A Logon Banner. Contractor employees who access DOI information systems must acknowledge a government-approved legal warning banner prior to logging on to the system. This includes contractor owned information systems hosting DOI data.

17 N/A Security Controls.

The Contractor shall perform in accordance with contract clause “Security

Requirements: Facility Access and Information Technology” – The

Contractor shall ensure compliance with the security control requirements of the current version of NIST SP 800-53, Rev.1, which are applicable to the security categorization of the data or system. FIPS 199 and the NIST

SP 800-60 will be used to determine information types and security categorizations.

18 N/A N/A Contingency Plan.

The Contractor shall perform in accordance with contract clause “Security Requirements: Facility Access and Information Technology.”

For IT Support Services: The Contractor shall submit a contingency plan in accordance with NIST SP 800-34 and DOI IT Systems Contingency Plan

Guide.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 18 of 38

COMMERCIAL PROVISIONS

52.252-1 Solicitation Provisions Incorporated by Reference (FEB 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at https://www.acquisition.gov/far/ and at https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52.

The following provisions are incorporated by reference, with fill-ins noted as appropriate:

52.203-18 – Prohibition on Contracting with Entities that Require Certain Internal

Confidentiality Agreements or Statements-Representation (JAN 2017) 52.204-7 – System for Award Management (NOV 2024)(Deviation MAR 2026) 52.212-1 – Instructions to Offerors – Commercial Products and Commercial Services (SEP

2023)(Deviation APR 2026) 52.219-1 – Small Business Program Representations (FEB 2024)(Deviation JAN 2026, Updated FEB 2026)

52.212-2 – Evaluation-Commercial Product and Commercial Services (Nov 2021)(Deviation APR 2026)

a) Evaluation factors. The Government will award a contract resulting from this solicitation to the responsible Offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors will be used to evaluate offers:

Price, Technical Capability, and Past Performance; non-price factors are equally important to price.

Technical Capability For evaluation, the contractor shall demonstrate:

• Experience with Python development

• Experience with sonar/geospatial analysis

• Experience modifying open-source software

• Understanding of riverine substrate mapping

• Ability to meet delivery schedule

Technical Capability indicates the understanding and ability to fully meet the requirement, including the availability to perform the work in the time required, and provides qualifications to support this understanding and ability.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 19 of 38 https://www.acquisition.gov/far/ https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52

Key Personnel. The Government will evaluate the qualifications, education, technical expertise, and relevant experience of the individual(s) proposed to perform the work.

Particular consideration will be given to demonstrated experience with Python programming, PINGMapper source code, sonar data processing, geospatial analysis, and scientific software development.

Past Performance is the measure of how well the contractor has performed similar work before.

Recent and relevant past performance is preferred. Please submit:

1. A resume.

The individual proposed as the primary software developer shall be considered key personnel. Substitution of key personnel after award shall require prior notification to the Contracting Officer and shall be subject to review to ensure qualifications are substantially equivalent to those evaluated during source selection.

2. Three (3) references with contact information.

3. Examples of past projects with well demonstrated analysis, interpretation, and delivered products such as reports and scientific papers.

Offeror must submit sufficient documentation to be evaluated for the factors above. Failure to provide the requested information may result in removal from further consideration.

(b) Notice of award. A written notice of award or acceptance of an offer furnished to the successful Offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

(End of provision)

52.240-90 – Security Prohibitions and Exclusions Representations and Certifications

(Deviation MAR 2026)

(a) Definitions. As used in this provision-—

Backhaul, covered article, covered telecommunications equipment or services, critical technology, FASCSA order, Intelligence community, interconnection arrangements, national security system, roaming, sensitive compartmented information, sensitive compartmented information system, source, and substantial or essential component have the meanings provided in the clause 52.240-91, Security Prohibitions and Exclusions.

Business operations means engaging in commerce in any form, including by acquiring, developing, maintaining, owning, selling, possessing, leasing, or operating equipment, facilities, personnel, products, services, personal property, real property, or any other apparatus of business or commerce.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 20 of 38 https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52#FAR_52_240_90 https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52#FAR_52_240_90

Marginalized populations of Sudan means—

(1) Adversely affected groups in regions authorized to receive assistance under section 8(c) of the Darfur Peace and Accountability Act (Pub. L. 109-344) (50 U.S.C. 1701 note); and

(2) Marginalized areas in Northern Sudan described in section 4(9) of such Act.

Restricted business operations means business operations in Sudan that include power production activities, mineral extraction activities, oil-related activities, or the production of military equipment, as those terms are defined in the Sudan Accountability and Divestment Act of 2007 (Pub. L. 110-174). Restricted business operations do not include business operations that the person (as that term is defined in Section 2 of the Sudan Accountability and Divestment Act of 2007) conducting the business can demonstrate—

(1) Are conducted under contract directly and exclusively with the regional government of southern Sudan;

(2) Are conducted under specific authorization from the Office of Foreign Assets Control in the Department of the Treasury, or are expressly exempted under Federal law from the requirement to be conducted under such authorization;

(3) Consist of providing goods or services to marginalized populations of Sudan;

(4) Consist of providing goods or services to an internationally recognized peacekeeping force or humanitarian organization;

(5) Consist of providing goods or services that are used only to promote health or education;

or

(6) Have been voluntarily suspended.

Sensitive technology—

(1) Means hardware, software, telecommunications equipment, or any other technology that is to be used specifically—

(i) To restrict the free flow of unbiased information in Iran; or

(ii) To disrupt, monitor, or otherwise restrict speech of the people of Iran; and

(2) Does not include information or informational materials the export of which the President does not have the authority to regulate or prohibit pursuant to section 203(b)(3) of the International Emergency Economic Powers Act (50 U.S.C. 1702(b)(3)).

(b) Procedures.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 21 of 38

(1) Covered telecommunications and video surveillance. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities excluded from receiving federal awards for “covered telecommunications equipment or services.”

(2) FASCSA Orders.

(i) The Offeror shall search in SAM for the phrase “FASCSA order” for any covered article, or any products or services produced or provided by a source, if there is an applicable FASCSA order described in paragraph (e) of FAR 52.240-91, Security Prohibitions and Exclusions.

(ii) The Offeror shall review the solicitation for any FASCSA orders that are not in SAM but are effective and apply to the solicitation and resultant contract (see FAR 40.204-1(c)(2)).

(iii) FASCSA orders issued after the date of solicitation do not apply unless added by an amendment to the solicitation.

(c) Covered telecommunications equipment or services representations. By submission of its offer, the Offeror represents that, after conducting a reasonable inquiry (that looks at any information in the Offeror’s possession but does not need to include an internal or third-party audit)—

(1) It will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation, except as waived by the solicitation, or as disclosed in paragraph (g); and

(2) It does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services, except as waived by the solicitation, or as disclosed in paragraph (g).

(d) FASCSA Representation. By submission of this offer, the offeror represents that it has conducted a reasonable inquiry, and that the offeror does not propose to provide or use in response to this solicitation any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by an applicable FASCSA order in effect on the date the solicitation was issued, except as waived by the solicitation, or as disclosed in paragraph (g). A reasonable inquiry will look at any information in the offeror’s possession but does not need to include an internal or third-party audit.

(e) Sudan certification. By submission of its offer, the offeror certifies, after conducting a reasonable inquiry (that looks at any information in the offeror’s possession but does not need to include an internal or third-party audit), that the offeror does not conduct any restricted business operations in Sudan.

(f) Iran Representation and Certifications.

DOI, USGS RFQ 140G0326Q0120 PINGMapper Python Programming Services Page 22 of 38 https://www.sam.gov/

(1) Except as provided in paragraph (f)(2) of this provision or if a waiver has been granted in accordance with FAR 40.203-3, the offeror, after conducting a reasonable inquiry (that looks at any information in the offeror’s possession but does not need to include an internal or third-party audit), by submission of its offer—

(i) Represents, to the best of its knowledge and belief, that the offeror does not export any sensitive technology to the government of Iran or any entities or individuals owned or controlled by, or acting on behalf or at the direction of, the government of Iran;

(ii) Certifies that the offeror, or any person (as defined at section 15 of the Iran Sanctions Act of 1996, Pub. L. 104-172, 50 U.S.C. 1701 note) owned or controlled by the offeror, does not engage in any activities for which sanctions may be imposed under section 5 of the Act. These sanctioned activities are in the areas of development of the petroleum resources of Iran, production of refined petroleum products in Iran, sale and provision of refined petroleum products to Iran, and contributing to Iran’s ability to acquire or develop certain weapons or technologies; and

(iii) Certifies that the offeror, and any person owned or controlled by the offeror, does not knowingly engage in any transaction that exceeds $15,000 with Iran’s Revolutionary Guard Corps or any of its officials, agents, or affiliates, the property and interests in property of which are blocked pursuant to the International Emergency Economic Powers Act (50 U.S.C.