SOW.GeoTools Conf Support.071426 final.pdf

NOAA Office for Coastal Management 2027 Coastal GeoTools Conference Support

Statement of Work

SCOPE

The purpose of this procurement is to assist the National Oceanic and Atmospheric Administration (NOAA) and other partners in convening a conference on applications of geospatial technology for coastal management.

DESCRIPTION OF WORK

The Association of State Floodplain Managers (ASFPM) is an organization of professionals involved in floodplain management, flood hazard mitigation, the National Flood Insurance Program, and flood preparedness, warning and recovery. ASFPM will be hosting the Coastal GeoTools conference January 25 – 27, 2027 at the Charleston Marriott Hotel located in Charleston, SC. This conference brings together about 400 attendees from state and local coastal resource management programs, non-profit organizations, academic institutions, private industry and federal government agencies all working to help guide the conservation and wise management of the nation’s coastal resources. The meeting allows NOAA in partnership with ASFPM to continue building a network that supports coastal managers and natural resource agencies by facilitating access to and utilization of the most up-to-date technology, information, and management strategies available in the field of coastal resource management. Additionally, it will allow NOAA to make additional links to state, local, and private agencies through ASFPM’s network.

DELIVERABLES

The Contractor shall provide the following:

● Recognition of NOAA Office for Coastal Management as a conference supporter at the highest sponsorship level on printed materials, website, and conference app.

● Conference registration for twelve (12) attendees.

● Exhibit space to display NOAA outreach materials.

● Coordinate full invitational travel for up to ten (10) attendees who represent Tribal partners and the Coastal Inundation Community of Practice

● Coordinate partial invitational travel (airfare, registration, and per diem) for up to twenty seven (27) attendees who represent Climate Resilience Regional Challenge (CRRC) Coastal Resilience Fellows.

● Complete list of final conference registrants.

● Evaluation report post conference.

● Plenary session opportunities.

● Opening plenary presentation.

● Accept NOAA federal and invitee registrations by purchase order at early registration rate even if early registration rate submission timeframe has passed.

● Provide a complete list of exhibitors and sponsors.

● Access to meeting space during the conference for partner meetings

LOCATION OF WORK

The provisions to be provided under this contract shall be performed by the Association of State Floodplain Managers (ASFPM). All space and infrastructure support shall be provided by

ASFPM.

PERIOD OF PERFORMANCE

The period of performance for this contract shall be from date of contract award until February 28 2027.

TRAVEL

There is no travel required to execute this contract.

POINT OF CONTACT

Administrative contact:

Sheri Farrell 2234 South Hobson Avenue Charleston, South Carolina 29405-2413 843-481-0281 Sheri.Farrell@noaa.gov

Technical contact:

Josh Murphy 1305 East-West Highway, Room 10503 Silver Spring, Maryland 20910 240-560-3549 Joshua.Murphy@noaa.gov

IT SECURITY REQUIREMENTS

The C&A requirements of clause 73 do not apply and a Security Accreditation Package is not required.

The registration must provide an online submission form and the ability for the submitter to print the registration form to PDF format. The web site must use industry best practices (examples include DISA Security Technical Implementation guides (STIGS-http://iase.disa.mil/stigs/index.html) or NIST Special Publication 800-70 Rev. 1 “National Checklist Program for IT Products--Guidelines for Checklist Users and Developers” -http://csrc.nist.gov/publications/nistpubs/800-70-rev1/sp800-70r1.pdf) for ensuring the system hosting the web site, the web server and the web application(s) have been securely configured and maintained. The web site must also enforce HTTP over an encrypted Secure Sockets Layer (SSL) or Transport Layer Security (TLS) connection.

The contractor web site solution must ensure the processing, storing and transmitting of credit card information complies with the Payment Card Industry Data Security Standard (PCI DSS v1.2) requirements. Navigating the PCI DSS is available for download at:

https://www.pcisecuritystandards.org/pdfs/pci_dss_saq_navigating_dss.pdf. The PCI DSS requirement only applies to organizations that process, transmits, or store credit cards that use

VISA, Mastercard, Discover, American Express, or JCB. Additional information about PCI DSS is available at the PCI Security Standards Council web site (www.pcisecuritystandards.org).

The contractor must ensure the protection of the information being processed, stored and transmitted. Any combination of the three below (processing, transmitting and/or storing) credit card information requires PCI compliance. If the contractor is performing this portion or is sub-contracting out this portion of the SOW, contractor must identify which vendor is accountable for:

● Processing the financial transaction (i.e., who would be the organization that actually handles the financial transaction to ensure the customer has the appropriate funds for the purchase of the product).

● Transmitting the financial information (i.e., would be where a contractor’s web server has a registration form where the customer's credit card is typed within a web form and that information submitted to a third-party financial organization (aka bank))

● Storing the financial information (i.e., would be where a contractor’s conference on-line registration (aka web server) and/or third-party financial organization stores the customer's credit card).

PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services. Note that a merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services sold result in storing, processing, or transmitting cardholder data on behalf of other merchants or service providers.

For example, an ISP is a merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers.

PCI DSS defines different levels of a merchant based on the number of transactions that are processed. Each level of merchant has a different PCI DSS compliance requirement. The contractor or contractors performing the processing, transmitting and/or storing of the financial information must provide the appropriate PCI DSS compliance evidence. For each SAQ form, the merchant can find a sub-section entitled “Eligibility to Complete SAQ” in the Attestation section (www.pcisecuritystandards.org/saq/index.shtml). If the merchant is able to answer yes, to each question on the attestation form, then that particular form would be applicable in terms of validating compliance with the PCI DSS. If a merchant has multiple processing environments, whereby one environment qualifies it to complete SAQ form A and another qualifies it to complete SAQ form B, then it is advisable that the merchant default to the more stringent of the two SAQ forms (in this case, SAQ form B). PCI DSS recommends that the merchant contact their acquirer to ensure that they are completing the correct SAQ form.