SOW.GeoTools Conf Support.pdf

NOAA Office for Coastal Management 2025 Coastal GeoTools Conference Support

Statement of Work

SCOPE

The purpose of this procurement is to assist the National Oceanic and Atmospheric Administration (NOAA) and other partners in convening a conference on applications of geospatial technology for coastal management.

DESCRIPTION OF WORK

The Association of State Floodplain Managers (ASFPM) is an organization of professionals involved in floodplain management, flood hazard mitigation, the National Flood Insurance Program, and flood preparedness, warning and recovery. ASFPM will be hosting the Coastal GeoTools conference January 27 – 30, 2025 at the Wilmington Convention Center located in Wilmington, NC. This conference brings together about 400 attendees from state and local coastal resource management programs, non-profit organizations, academic institutions, private industry and federal government agencies all working to help guide the conservation and wise management of the nation’s coastal resources. The meeting allows NOAA in partnership with ASFPM to continue building a network that supports coastal managers and natural resource agencies by facilitating access to and utilization of the most up-to-date technology, information, and management strategies available in the field of coastal resource management. Additionally, it will allow NOAA to make additional links to state, local, and private agencies through ASFPM’s network.

DELIVERABLES

The Contractor shall provide the following:

● Recognition of NOAA Office for Coastal Management as a conference supporter at the highest sponsorship level on printed materials, website, and conference app.

● Conference registration for twelve (12) attendees.

● Exhibit space to display NOAA outreach materials.

● Coordinate travel for up to 15 attendees who represent historically underserved communities

● List of final participants.

● Evaluation report post conference.

● Plenary session opportunities.

● Opening plenary presentation.

● Accept NOAA federal and invitee registrations by purchase order at early registration rate even if early registration rate submission timeframe has passed.

● Provide a complete list of exhibitors and sponsors.

● Access to meeting space during the conference for partner meetings

LOCATION OF WORK

The provisions to be provided under this contract shall be performed by the Association of State Floodplain Managers (ASFPM). All space and infrastructure support shall be provided by

ASFPM.

PERIOD OF PERFORMANCE

The period of performance for this contract shall be from date of contract award until February 28 2025.

TRAVEL

There is no travel required through this contract.

POINT OF CONTACT

Administrative contact:

Sheri Farrell 2234 South Hobson Avenue Charleston, South Carolina 29405-2413 843-481-0281

Sheri.Farrell@noaa.gov

Technical contact:

Jan Kucklick

2234 South Hobson Avenue Charleston, South Carolina 29405-2413

(843) 868-1147 Jan.Kucklick@noaa.gov

IT SECURITY REQUIREMENTS

The C&A requirements of clause 73 do not apply and a Security Accreditation Package is not required.

The registration must provide an online submission form and the ability for the submitter to print the registration form to PDF format. The web site must use industry best practices (examples include DISA Security Technical Implementation guides (STIGS- https://public.cyber.mil/stigs/) or NIST Special Publication SP 800-70 Rev. 4 “National Checklist Program for IT Products-- Guidelines for Checklist Users and Developers” -https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-70r4.pdf) for ensuring the system hosting the web site, the web server and the web application(s) have been securely configured and maintained. The web site must also enforce HTTP over an encrypted Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection.

The contractor web site solution must ensure the processing, storing and transmitting of credit card information complies with the Payment Card Industry Data Security Standard (PCI DSS v1.2) requirements. Navigating the PCI DSS is available for download at:

https://www.pcisecuritystandards.org/pdfs/pci_dss_saq_navigating_dss.pdf. The PCI DSS requirement only applies to organizations that process, transmits, or store credit cards that use

VISA, Mastercard, Discover, American Express, or JCB. Additional information about PCI DSS is available at the PCI Security Standards Council web site (www.pcisecuritystandards.org).

The contractor must ensure the protection of the information being processed, stored and transmitted. Any combination of the three below (processing, transmitting and/or storing) credit card information requires PCI compliance. If the contractor is performing this portion or is sub -mailto:Sheri.Farrell@noaa.gov mailto:Jan.Kucklick@noaa.gov https://www.pcisecuritystandards.org/pdfs/pci_dss_saq_navigating_dss.pdf http://www.pcisecuritystandards.org/ contracting out this portion of the SOW, contractor must identify which vendor is accountable for:

● Processing the financial transaction (i.e., who would be the organization that actually handles the financial transaction to ensure the customer has the appropriate funds for the purchase of the product).

● Transmitting the financial information (i.e., would be where a contractor’s web server has a registration form where the customer's credit card is typed within a web form and that information submitted to a third-party financial organization (aka bank))

● Storing the financial information (i.e., would be where a contractor’s conference on-line registration (aka web server) and/or third-party financial organization stores the customer's credit card).

PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services. Note that a merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services sold result in s toring, processing, or transmitting cardholder data on behalf of other merchants or service providers.

For example, an ISP is a merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers.

PCI DSS defines different levels of a merchant based on the number of transactions that are processed. Each level of merchant has a different PCI DSS compliance requirement. The contractor or contractors performing the processing, transmitting and/or storing of the financial information must provide the appropriate PCI DSS compliance evidence. For more information on which SAQ form, to fill out please go here:

https://listings.pcisecuritystandards.org/documents/SAQ-InstrGuidelines-v3_2_1.pdf PCI DSS recommends that the merchant contact their acquirer to ensure that they are completing the correct SAQ form.