20250515 Holmes IDIQ SOW.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency (NGA)

J-01 IDIQ Statement of Work (SOW)

For Holmes

Solicitation # TBD

15 May 2025

Rev 1 ii | P a g e

Table of Contents 1 General

1.1 Purpose

1.2 Objective

1.3 Background

1.4 Period and Place of Performance

1.5 Scope

2 Service Areas

2.1 Program Management

2.2 Development – Operations (DevOps)

2.3 Software Maintenance

2.4 Content Management

2.5 Systems Engineering

3 Constraints

3.1 Environments

3.2 Miscellaneous

4 Other Direct Costs/Travel

4.1 ODC

4.2 Travel

5 Security

5.1 Classified Work Performance

5.2 Personnel Security Requirements

5.3 Physical Security Requirements

5.4 Unclassified Work Performance/Uncleared Personnel Security Requirements

5.5 Information Security Requirements

5.6 Cyber Security

5.7 Insider Threat Requirements

6 Transition

6.1 Transition Program Administration

iii | P a g e

6.2 Transition of DevOps Support

7 Government Property

7.1 Government Responsibilities

7.2 Contractor Responsibilities

8 Special Requirements

8.1 Intellectual Property

8.2 Data Handling at Contractor Exit

APPENDIX A : Acronyms

APPENDIX B: CDRLS

ADDENDIX C: Compliance and Reference Documents

ADDENDIX D: Meeting Requirements

ADDENDIX E: Key Personnel Job Descriptions and Qualifications

ADDENDIX F: Architecture Document Library

ADDENDIX G: Performance Measures

ADDENDIX H: Development – Operations (DevOps) – Tier Definitions

List of Figures iv | P a g e

SOW Change History Matrix

Revision # Change Summary Date

TBD/TBR List

TBD/TBR# Description Status

TBR-001 2.3.8-e – Determine if additional technical documentation is required.

Open

TBR-002 2.5.9-e Determine if additional test requirements are needed

Open

TBR-003 Appendix E – Determine required and desired skills and qualifications for all key positions.

Review and update Responsibilities

Open

TBR-004 Appendix F: Determine required artifacts Open

TBR-005 Appendix B: Determine required CDRLs Open

TBR-006 Appendix C: Determine required compliance and reference documents

Open

TBR-007 Insert GSR OV or similar diagram based on

Refactor

Open

1 | P a g e

1 General

1.1 Purpose

This Indefinite Definition Indefinite Quantity (IDIQ) Statement of Work (SOW) describes the overall technical objectives, purpose and scope for The National

Geospatial-Intelligence Agency (NGA) Holmes contract. This effort is a consolidation follow-on of two legacy contracts: Agile Web Presence II (AWPII) and Yorktown II

(YTII), focusing on overall Operations and Sustainment of the following key capabilities:

a) The Globe

b) GEOINT Search and Retrieval (GSR)

1.2 Objective

This SOW is to establish the contract base set of objectives, which will be applicable for any individual contract Task Order (TO) issued and its associated Performance

Work Statement (PWS). The objectives include but are not limited to:

a) Establish unified, efficient, and optimized Operations and Sustainment contract for legacy AWPII and YTII programs.

b) Alignment with the Vision for the Intelligence Community (IC) Information Environment, May 2024, NGA Strategy 2025, National System for Geospatial (NSG) Strategy 21-25, NGA Agency Mission Essential Task List (AMETL) and NGA Chief Technology Officer (CTO) initiatives.

c) Alignment with the NGA Software Way.

d) Integrate Human Centered Design methodologies.

e) Support of a Continuous Release process enhancing current DevSecOps pipeline thereby speeding delivery of new user features, security improvements, and new product integration. Automating software deployment using Continuous Integration/Continuous Delivery (CI/CD).

f) Provide all necessary services and support required to develop, test, integrate, and deploy software to maintain/enhance current capabilities and deliver new capabilities/emerging requirements.

g) Provide all necessary support ensuring the system integrity and responsiveness of all the Globe and GSR applications and services.

h) Alignment with Open Information Technology initiatives to achieve Government-wide (i.e., across the IC, Department of Defense (DoD), Federal, State, first responders and local Government organizations) optimization and efficiencies gained through integration and alignment with cloud architecture.

1.3 Background

The mission of NGA is to provide timely, relevant, and accurate Geospatial

Intelligence (GEOINT) to policy makers, the IC, DoD, other federal agencies, and

2 | P a g e civilian and international partners in support of National Security and related objectives.

The Director of NGA is the functional manager for the National System for

Geospatial-Intelligence (NSG), which is the combination of people, technology, policies, capabilities, doctrine, and activities necessary to produce GEOINT in an integrated multi-intelligence environment in support of national security objectives.

NGA is also a major contributor to the Allied System for Geospatial-Intelligence

(ASG). The ASG represents the GEOINT relationship among the international community: Australia, Canada, New Zealand, United Kingdom, and United States.

The ASG is an integrated, collaborative community of GEOINT professionals working together to meet our collective warfighting and intelligence needs; providing each other with global, regional, and civil GEOINT support.

The NGA Enterprise Services (TE) group provides and secures the enterprise IT infrastructure, transport, platforms, data, and services that enable NGA operations and delivery of GEOINT to the tactical edge. The GEOINT Services Office (TEG) is dedicated to revolutionizing the delivery of geospatial content, services, and applications when and where customers need them. TEG’s mission is to provide

NSG users with the ability to find, get, use, and contribute geospatial data, content, and capabilities on all domains, at all times, and in any mission environment. These

IT systems provide a broad range of capabilities and services for search, discovery, presentation, and dissemination of a variety of GEOINT data from both internal NGA and selected external content providers.

1.3.1 The Globe IT System

The Globe is NGA’s online connection to geospatial knowledge serving as the front door for NGA customers since 2008 currently hosted in NGA’s CORE OpenShift platform. mGlobe is NGA’s low bandwidth Globe instance hosted on the NGA’s AWS

Cloud environment. Globe integrates geospatial content, tools, and intelligence in an engaging environment. It provides mission value to DoD and the Intelligence (IC) by providing easy access to NGA generated GEOINT, robust search, curated topic pages, a listing of NGA services and tools, Discovery Catalog, and NGA Support

Team contacts. This is provided across four networks and includes a unique view for

Congressional support (CAPNET).

Unclassified Secret Top

Secret/SCI Stone Ghost

The Globe

The Globe - CapNet mGlobe

3 | P a g e

Figure 1 - Globe IT Instantiations

The Globe is positioned to further the NGA Strategic and Operational Objectives 2023 with a centralized web presence and flexible search capabilities. The Government plans to focus on user experience, performance, process improvements, and content relevance improvements.

Figure 2 - Globe Operational View (OV)

1.3.2 The GSR IT System

The GSR IT system is a set of application services hosted in NGA CORE OpenShift platform on all three security domains providing user and system search, discovery, and dissemination of a variety of GEOINT data from both internal NGA and selected external content providers. GSR provides capabilities to easily search and retrieve content needed for missions regardless of the producer, format, or storage location of the data. Additionally, GSR streamlines the process for integrating new or updated

4 | P a g e content with a flexible ingest pipeline which includes extensive data engineering to normalize disparate metadata into a common framework for a better user experience.

Figure 3 - GSR Operational View (OV) (TBR-007)

1.4 Period and Place of Performance

1.4.1 Ordering Period

The ordering period for the Indefinite Delivery/Indefinite Quantity (IDIQ) is five (5) years. The period of performance (PoP) for each task order under the contract shall be specified in the individual task order. Task orders may be issued at any time during the PoP, and the task order end date may extend no more than 365 days beyond the end of contract ordering period.

1.4.2 Place of Performance

a) The primary place of performance shall be the Contractor’s facilities. The facilities shall be available at proposal submission. Any telework arrangements shall be approved by the Government Program Management Office (GPMO) and Contracting Officer’s Representative (COR).

b) The Contractor shall provide secure facilities, communications infrastructure, NGA connectivity, and NGA workstations, including security to support the goals of the contract in accordance with the National Industrial Security

Program.

c) All Key and technical personnel shall have continuous access to the appropriate secure contractor facilities and networks to continuously monitor

Government secure communications (e.g. emails) and provide timely responses within 24 hours of receipt.

d) Temporary access to Government owned and operated equipment (e.g., NGANet or Desk Top Environment (DTE) workstations) may be made available onsite at NGA facilities in Springfield, VA, St Louis, MO, or Arnold, MO, on a pre-coordinated basis, subject to NGA facilities standards, practices, and availability to fulfill contractual obligations (e.g., onsite workstation access to perform Operations and Sustainment (O&S) during transition). This temporary accommodation does not eliminate the requirement stated in 1.4.2, pertaining to the primary place of performance.

5 | P a g e

e) At the time of award, the Sensitive Compartmented Information Facility (SCIF) for classified work conducted at a Contractor site shall be available. The

Contractor shall have connectivity to the NGA Top Secret (NGANet), NGA

Secret Collateral (SECNet), NGA Sensitive but Unclassified (SBUNet), and

NGA Stone Ghost (FVEY) domains with the appropriate workstations to accomplish all work outlined within this SOW no later than 90 days after contract start. The Contractor shall also provide all equipment, supplies, tools, and other items necessary to provide the capability to perform unclassified work at the Contractor site(s) at contract award.

1.5 Scope

This section describes requirements the Contractor shall perform to support the

Holmes service categories as described below. In all service areas and activities, the

Contractor shall adhere to all NGA policies and procedures and coordinate with other

NGA organizations as required by policy and shall meet all performance measures described in Appendix H: Performance Measures (Acceptable Performance Levels

(APL)) specified in the task order PWS. Holmes requirements are divided into the following service areas.

• Program Management Support (2.1): All administrative and/or functional tasks required to provide oversight and direction for the cost, schedule, and technical performance of the contract.

• Develop – Operations Support (DevOps) (2.2): Services supporting the operational systems, test systems and daily production activities including supporting cross functional team integration in accordance with the DevOps Model – Build, Test, Release, Monitor Plan.

• Software Maintenance (2.3): Services to engineer, integrate, test, and provide software maintenance (Corrective, Adaptive, Preventative, and Perfective) and deploy software enhancements/emerging requirements to the current software baselines. This service area includes supporting cross functional team integration in accordance with the DevOps Model – Build, Test, Release, Monitor Plan.

• Content Management (2.4): Services to ensure timely and accurate creation and updates for custom-generated web pages and content. Services covering all data engineering necessary to analyze, design, and implement new/modified content.

• Systems Engineering (2.5): Services to provide engineering and technical support for operations, sustainment, and software maintenance.

2 Service Areas

2.1 Program Management

These tasks and deliverables provide necessary activities for program management of the Holmes contract and any individual task order. In all activities, the Contractor

6 | P a g e shall adhere to all NGA policies and procedures, and coordinate with other NGA organizations as required by policy.

2.1.1 The Contractor shall manage cost, schedule, and performance across all task orders as specified in the applicable PWS.

2.1.2 The Contractor shall conduct all meetings as listed in Appendix D.

2.1.3 The Contractor shall conduct a contract kick-off meeting with the Government within 21 days of contract start date.

2.1.4 The Contractor shall develop, maintain and adhere to a Program Management Plan (PMP) (Contract Data Requirements List (CDRL) A001).

2.1.5 The Contractor shall develop, maintain and adhere to an Integrated Master Schedule (IMS) (CDRL A009) which, at a minimum, shows the status of sprints, releases, emerging requirements, CDRLs, and document delivery.

2.1.6 The Contractor shall develop, maintain and adhere to a Risk Management Plan (RMP) (CDRL A014) used to document risk management processes and outlining the processes for creation and maintenance of the program risk registry (CDRL A036).

2.1.7 The Contractor shall develop and maintain a staffing plan (CDRL A017) to reflect proposed personnel by name, position, duties, employer, work location including designation of classified vs unclassified work environment, and when applicable, planned departure date. The plan shall include an ability to surge for the purposes of supporting emerging requirements.

2.1.8 The Contractor shall conduct monthly Program Management Reviews (PMR) (CDRL A023) to evaluate the Contractor’s progress, address risks, review staffing changes, review program schedule and address concerns, issues, or additional topics of mutual interest. The content of these reviews shall be tailored to accommodate agile program processes and dynamics and shall be described in the Program Management Plan (CDRL A001). All active Task Orders shall be included.

2.1.9 The Contractor shall ensure full and adequate participation in technical review, weekly status reviews and other management meetings by appropriate staff as required and defined by the GPMO.

2.1.10 The Contractor shall ensure compliance with all appropriate policies and guidance related to all service areas and activities listed in Appendix C.

2.1.11 The Contractor shall provide qualified personnel for key positions commensurate with the responsibilities and tasks required within this SOW, in terms of necessary skills at the requisite level of knowledge and experience as described in Appendix E - Key Personnel Job Descriptions and Qualifications.

2.1.12 The Contractor shall ensure individuals assigned to key personnel positions (Appendix E) shall possess an active TS/SCI clearance at the time of proposal submission and shall meet the required experience and qualifications. Key

7 | P a g e personnel shall possess a current CI Polygraph or shall schedule a CI polygraph within 30 days of start.

2.1.13 The Contractor shall ensure personnel identified for key personnel positions shall have e-Nomination submitted within 7 days of contract start and shall have an indoctrination date scheduled within 7 days of approval to brief.

2.1.14 The Contractor shall provide updates to the Contracting Officer’s Representative (COR) concerning changes to all personnel assigned to this contract within ten (10) calendar days of any change and shall be noted through the PMR documentation (CDRL A023).

2.1.15 The Contractor shall ensure all personnel requiring elevated or privileged user access shall meet all DoD Manual 8570 and NGA requirements. Proof of these qualifications are to be provided to the COR and PM for verification.

2.1.16 The Contractor shall support Government-led customer engagement and outreach activities.

a) Requirements gathering/refinement

b) Create and contribute to marketing and communications materials

c) Technical Exchange Meetings

d) Software Demonstrations

2.2 Development – Operations (DevOps)

These tasks and deliverables provide requirements for DevOps on the Holmes contract as specified in individual task order PWS.

2.2.1 The Contractor shall provide DevOps coverage 0600-1800 ET Monday – Friday (excludes observed federal holidays), with on-call support in accordance with the Information System Continuity Plan (ISCP) (A018) to address high priority outages/issues.

a) Implement and execute a defect/incident investigation and tracking process for defects, incidents, outages, and system degradations.

b) Detect system issues and provide notifications in accordance with NGA processes as specified by the government.

c) Identify issue root cause and provide resolution in accordance with performance measures specified task order PWS.

d) Submit and Respond to Service + incidents and provide after action reports (AAR).

e) Adhere to the NGA Incident Response process and documentation in the knowledge management system and utilize the NGA service management solution with a cross reference between the two.

2.2.2 The Contractor shall support Tier I and provide Tier II, and III help desk resource support in accordance with NGA’s Enterprise Management (EM) requirements policy for monitoring. Support at all tiers is intended to enable

8 | P a g e monitoring and administration of the system operational baseline. Support will fully integrate with, but not duplicate, NGA Enterprise Service Center (ESC) services at any tier of support. Reference Appendix I: DevOps – Tier Definitions.

a) Tier 1 support consists of the following activities:

i. Use of NGA Service Management Solutions (e.g. Service+) for service request management, change (CHG) management, incident management, knowledge management, configuration management

(CM), and IT asset management.

ii. Enable all relevant ESC/Service Management Solutions features supporting stakeholder needs in production

b) Tier II consists of the following activities

i. Leverage EM and application-level monitoring to support response efforts covering all aspects of sustainment and operations.

ii. Ensure availability of IT services to mission customers in support of their designated functions and at required performance levels.

iii. Provide code and database configurations to meet reliability, availability, and functionality requirements.

iv. Participate in NGA operational forums as designated and required by the GPMO.

v. Provide notifications as required for the resolution of outages and incidents.

vi. Provide updates twice daily during business hours for any outages or degradations.

c) Tier III support consists of the following activities:

i. Support operations to resolve incidents, defects, and other issues as defined by the GPMO.

ii. Provide software patches, hotfixes, configuration changes, workarounds, etc.

iii. Coordinate and collaborate with other NGA internal and external systems and service providers to resolve issues.

2.2.3 The Contractor shall support corrective, preventative, adaptive, and perfective maintenance as required or directly by the Government.

2.2.4 The Contractor shall track and report on software licenses to ensure renewals are implemented prior to system disruption/degradation.

2.2.5 The Contractor shall perform DevOps and system administration services on all domains required to maintain the performance measure specified in the task order PWS.

a) Adhere to agreements with NGA enterprise service providers to ensure proper integration and operation of the IT systems

9 | P a g e

b) Perform requirements collection, management, and analysis based on system performance, collected metrics, user experience, and maintenance activities.

2.2.6 The Contractor shall collect, report, and display application/system performance and user metrics.

a) Monthly (PMR)

b) Dashboards

c) Reports

d) Historical

2.2.7 The Contractor shall support all Information System Security tasks required to monitor the system and application security, accreditation and audit services to any system or application described in the PWS and any subsequent requirements as they emerge from the enterprise.

a) Support Government ISSO and ISO on all aspects of information security.

b) Ensure system and applications are certified and accredited and meet security controls and processes as described in the Intelligence Community Directive (ICD) 503.

c) Seek system optimization opportunities to prevent and reduce system malfunctions.

d) Provide services for any internal audit requests.

e) Provide risk assessments to system systems and applications to determine if suitable to be deployed into operations.

2.2.8 The Contractor shall support Government-led customer engagement and outreach activities.

a) Requirements gathering and refinement

b) Create and contribute to marketing and communications materials

2.3 Software Maintenance

These tasks and deliverables provide requirements for software maintenance on the

Holmes contract as specified in the individual task order PWS. Software maintenance includes software and system corrective, preventative, adaptive, perfective maintenance and enhancements/modifications to support emerging requirements.

2.3.1 The Contractor shall perform software maintenance based upon priorities established by the Government in accordance with AGILE principles and in accordance with the Agile Development Management Plan (ADMP) (CDRL

AXXX).

10 | P a g e

a) Corrective – System changes to correct error and operational degradation.

• Troubleshooting and fixing minor application bugs, including system restarts.

• Reconfiguring Commercial Off-The-Shelf (COTS) for specific user / use case errors.

• Working with ISP, CSP and other system admins to resolve

Discrepancy Reports (DRs) caused by external factors that arise in non-AWP capabilities.

• Fast, one-time fixes (aka “hot fixes”) that do not involve agile software development, backlog creation, or using the more formal development and sustainment processes described in other service definitions.

• Restoring application or system services that are down.

b) Preventative - System changes to prevent degradation of service.

• Operating System changes/optimizations.

• Removing obsolete functions/unsupported components from the capability baseline.

• Monitor and manage server disk storage including temporary storage and queues.

• Optimizing application and Government dictated platform configurations for faster execution of application, web services and making efficient use of storage space.

• Managing server certs.

• Prepare for technology insertion.

c) Adaptive – System changes to address changing operational environments

• Changes to infrastructure or middleware on which the capability is provisioned.

• Changes in software dependencies, interfaces, content, or supporting software (e.g. .Net framework, JAVA versioning, supported web browsers).

• Modify/enhance software code, including UX/UI, baseline in support of new/emerging software/system requirements in accordance with the Agile Development Management Plan (CDRL A003).

d) Perfective – System changes to optimize operations and performance and comply with relevant policy and directive.

• Security patches and hot fixes.

• Operating System and support software updating/patching.

• Fixing source code to prevent outage or triggering incidents (e.g.

malformed error handling in the source code, logic flaws in error

11 | P a g e management, substandard code documentation, suboptimal deployment packaging).

• Modify/enhance software code baseline, including UX/UI, in support of new/emerging software/system requirements and design changes in accordance with the Agile Development Management Plan (CDRL

A003).

e) Emerging Requirements – Software/System changes, modifications, upgrades and enhancements often driven by other stakeholders (e.g.

Request for Change (RFC) and/or Engineering Change Proposals (ECP).

• Provide ability to surge resources, when necessary to meet schedule constraints, customer needs, or necessary to maintain normal release cadence.

• Support simultaneous software maintenance and enhancements as defined by emerging requirements.

2.3.2 The Contractor shall integrate Government-Off-The-Shelf (GOTS), COTS, Free and Open-Source Software (FOSS), microcode, and software into the operational baselines as required and avoid proprietary software when possible. All COTS, GOTS, and FOSS shall have NGA Whitelist approval.

a) In the case of COTS, the Contractor shall support engineering, technical assessment, development, and other required activities that leverage

COTS and other technology needed for the Holmes efforts. Where COTS applications are included in the baseline, the Contractor shall incorporate any updates to those baselines.

b) In the case of custom development, the Contractor shall prioritize the reuse or refactoring of existing code over creation of new software. The

Contractor shall minimize or eliminate the use of custom integration software code (glue-ware) that limits application analytical flexibility.

2.3.3 The Contractor shall conduct/participate in Release Planning (e.g. Program Increments (PI), Release Planning Events (RPE), Program Increment Planning Events) (PIPE) in coordination with the Government.

2.3.4 The Contractor shall establish and maintain a development, integration, and test environments utilizing NGA hosted tools, services, and government dictated platform(s).

2.3.5 The Contractor shall develop, demonstrate, integrate, test and deploy software on required instances and domains in accordance with the Agile Development Management Plan (CDRL AXXX).

a) Identify software and configuration changes (CDRL AXXX VDD, CDRL

AXXX Release Notes).

b) Conduct sprint and release demonstrations.

c) Develop/Document/Conduct software and system testing.

12 | P a g e

d) Develop deployment instructions and support deployments (CI/CD).

e) Perform code scanning to ensure enforcement of code quality and syntax consistency.

f) Support domain specific code/configuration modifications necessary across the unique security domains.

g) Support cross-functional teams ensuring successful delivery of services.

2.3.6 The Contractor shall utilize NGA’s Enterprise-managed collaboration and work tools (e.g. Jira, Confluence, GitLab, Service+, etc.). All aspects of the system shall be accessible to the Government at all times.

a) Maintain/provide gold-copy source code, COTS license information, installation packages (CDRL AXXX).

b) Manage and maintain a requirement’s backlog in conjunction with the

Government.

2.3.7 The Contractor shall document all code, services, and interfaces (API) using best practices (e.g. comments, routine and subroutine descriptions) and utilizing NGA approved formats.

2.3.8 The Contractor shall provide generate technical documentation including but not limited to.

a) Software Design Artifacts as referenced in Appendix G – Architecture

Document Library

b) User Guides

c) Release Notes (CDRL AXXX)/Version Description Documents (VDD)

(CDRL AXXX)

d) Document Application Programming Interface (API) using machine readable documentation

e) <Others (TBR-001)>

2.3.9 The Contractor shall support API service consumers.

a) Utilize Open Application Programming Interface (API) standards and formats.

b) Document all endpoints, parameters, defaults, and outputs. Maintain and contribute to informational resources.

c) Investigate, diagnose, and resolve issues.

d) Support tracking of API users.

e) Support NGA Enterprise API Registry Processes.

f) To the greatest extent possible, ensure API modifications, additions, and enhancements support backward compatibility to reduce user impacts.

2.3.10 The Contractor shall incorporate UI/UX changes maintaining a consistent look and feel across all security domains.

13 | P a g e

2.3.11 The Contractor shall support System Monitoring and Integration by enabling the code to deliver the mission requirements at the optimum level of operational performance while meeting or exceeding availability requirements.

a) System health and status monitoring

b) Collection of system and performance metrics

c) Automated and dynamic dashboard presentation using NGA approved services/tools

2.3.12 The Contractor shall support Government-led customer engagement and outreach activities.

a) Requirements gathering/refinement

b) Create and contribute to marketing and communications materials

c) Technical Exchange Meetings

d) Software Demonstrations

2.4 Content Management

These tasks and deliverables provide requirements for content management on the

Holmes contract as specified in the individual task order PWS.

2.4.1 The Contractor shall provide timely and accurate updates to the user interface and web content on all domains to include custom and event-driven web page development and content curation (i.e. front-end support).

2.4.2 The Contractor shall create, manage, and distribute custom website(s) content to align with program and NGA mission.

2.4.3 The Contractor shall communicate with internal and external stakeholders and implement requests in a timely and accurate manner. Requests for event-driven tasks shall be staged within 24 hours of request.

2.4.4 The Contractor shall support content and data governance initiatives as defined by the Government.

2.4.5 The Contractor shall curate NGA and partner produced GEOINT, services, and tools to allow quick discovery for the NSG.

2.4.6 The Contractor shall implement design concept and ideas into functional content using Cascading Style Sheets (CSS), HTML5 markup language, browser-based technologies such as Asynchronous JavaScript and Extensible Markup (AJAX), jQuery, and Bootstrap.

2.4.7 The contractor shall use NGA’s Enterprise-managed work tracking tools (e.g JIRA, Confluence, Service+) for documentation and tracking.

2.4.8 The Contractor shall perform data engineering in support of software maintenance, emerging requirements, and specification compliance. Data engineering includes:

a) Design and implementation of content from NSG and ASG partners

14 | P a g e

b) Ensure adherence and compliance with identified standards and specifications

c) Define business rules necessary to transform and remediate content metadata to conform with standardized metadata models

d) Inform and participate in metadata governance boards, forums, and processes

2.4.9 The Contractor shall support Government-led customer engagement and outreach activities.

a) Requirements gathering/refinement

b) Create and contribute to marketing and communications materials

2.5 Systems Engineering

These tasks and deliverables provide requirements for systems engineering and technical support on the Holmes contract as specified in the individual task order

PWS.

2.5.1 The Contractor shall develop and maintain the artifacts identified in Appendix G and include in the Architecture Document Library (CDRL A008).

2.5.2 The Contractor shall provide engineering and technical management services and documentation required to complete studied and white papers, and implement technical requirements as defined by the Government.

2.5.3 The Contractor shall provide systems engineering services in support of Release Planning (e.g. Program Increments (PI), Release Planning Events (RPE), Program Increment Planning Events) (PIPE) in accordance with the

ADMP.

2.5.4 The Contractor shall provide impact assessment related to technical performance and cost (CDRL AXXX) and manage a process to support RFC’s and ECP’s.

2.5.5 The Contractor shall provide systems engineering and technical subject matter expertise (SME) support to actively engage in Enterprise Systems Engineering with NGA and collaborate to ensure emerging requirements and authorized capabilities for the NSG Enterprise are planned and executed.

2.5.6 The Contractor shall support integration of enterprise tools, applications and content providers into the supported software baselines.

2.5.7 The Contractor shall provide enterprise systems engineering and integration support to newly emerging projects, services, technology insertions, new sensor integrations, and other initiatives as directed by the Government.

15 | P a g e

2.5.8 The Contractor shall engage with publishers of finished intel and software tools to increase types of content available to include expansion of unclassified content sources.

2.5.9 The Contractor shall execute Government approved test scenarios on all baseline code, configuration parameters, interfaces, user interfaces, and APIs. All areas of the code shall be tested with a pass status prior to release.

a) Utilize automation to the greatest extent possible.

b) Provide test results/reports.

c) Support NGA Government (TACA) test requirements/processes.

d) Track and communicate issues, defects, and work-off plans.

e) <Others (TBR-002)>

2.5.10 The Contractor shall support Government-led customer engagement and outreach activities.

a) Requirements gathering/refinement

b) Create and contribute to marketing and communications materials

c) Technical Exchange Meetings

d) Software Demonstrations

3 Constraints

3.1 Environments

3.1.1 The current GSR software baseline is the same across all domains but has domain specific configuration parameters due to unique characteristics of data content and infrastructure. Independent task order requirements may specify work applicable to a particular domain.

3.2 Miscellaneous

3.2.1 The Government purchases and maintains enterprise licenses for software used in the operational systems. However, if there is a compelling need, the Government will consider special cases for additional software licenses to be purchased for development that may become necessary for the long-term maintenance of the system. The Contractor shall provide the software, cost, and benefit for its use, and the Government will consider reimbursement as applicable in accordance with Section 4 of this SOW.

4 Other Direct Costs/Travel

4.1 ODC

4.1.1 All Other Direct Costs (ODC) are to be preapproved by the COR, which includes travel and materials (e.g. software licenses).

16 | P a g e

4.2 Travel

4.2.1 Travel may be required in performance of this contract. All travel requires prior Government approval/ authorization and notification to the COR. Travel costs will be reimbursed in accordance with FAR 31.205-46.

4.2.2 The Contractor shall conduct the necessary travel to accomplish the overall objectives of the program. The Contractor may be required to travel from its primary work location to other contractor facilities, NGA locations, or U.S.

Government locations within the continental United States. Local travel may be required under this contract for attendance at meetings, program/project reviews, customer meetings, conduct classroom training, and similar events within and outside the Washington D.C. and St. Louis Metropolitan areas.

Local travel will not be reimbursed. Local travel is defined as travel less than 50 miles from the duty station.

4.2.3 The Contractor shall submit the following information in its request for approval to travel:

a) Travel Authorization Request identifier and date of Government request of contactor travel.

b) Name(s) of individual(s) traveling.

c) Date(s) of travel.

d) Per Diem rate used and estimated costs, if required.

e) Transportation costs, if required (rental car, air fare, etc.).

f) Total estimated costs.

g) Reason for travel.

4.2.4 The Contractor shall submit a Trip Report NLT 10-calendar days after return from a trip and will include: Locations traveled from and to, who authorized the trip, name of site POC, and a description of what was accomplished during the trip. The Trip Report shall include actual expenses occurred in each cost category (lodging per diem, meals and incidental expenses per diem, transportation, other expenses).

5 Security

5.1 Classified Work Performance

5.1.1 Contractors must abide by the DD Form 254 - Contract Security Classification Specification (referred to as DD254 hereafter), the National Industrial Security Program Operating Manual (NISPOM 32 CFR Part 117), and all other applicable security policies and regulations including operational security (OPSEC) requirements.

5.1.2 Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Agency (CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances. As such, Security Executive Agent Directive (SEAD) 3 reporting should continue to be provided

17 | P a g e to the Contractor’s Facility Security Officer (FSO) for reporting to DCSA via Defense Information Security System (DISS). DCSA will also dictate mandatory security training as the CSA for the collateral cleared community.

5.2 Personnel Security Requirements

5.2.1 Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to TS/SCI facilities, when performing duties within TS/SCI environments, and for access to TS/SCI computer systems for the performance of this contract. Contractors are subject to a Counterintelligence-Scope Polygraph examination, as requested by NGA. As a condition of employment and assignment, contractors who have not successfully completed polygraph testing within the last five years must immediately schedule a polygraph examination and must complete the process, in no more than three test sessions, within 90 days.

5.2.2 All Contractor personnel shall possess a current Top Secret Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access. The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel in accordance with (IAW) SEAD 7: “Reciprocity of Background Investigations and National Security Adjudications”. If needed, NGA will sponsor SCI accesses at its sole discretion. NGA will provide badges, Common Access Cards (CAC) and other items (e.g. parking hangtags) when applicable, for required Contractor personnel.

5.2.3 Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI) Continuous Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW SEAD 6: “Continuous Evaluation”.

Cleared Contractor personnel must self-report security issues, foreign contacts, and other applicable information IAW SEAD 3: “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position” and NGA Instruction 5205.3, “Security Reporting Requirements”. In addition, cleared Contractors will be required to submit electronic fingerprints and be enrolled into NGA’s Report of Arrest and Prosecution Background (RAPBack) program, which supports CES.

5.2.4 Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in NGA’s annual Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20 November 2020 memorandum titled “Designation of NGA Personnel Required to Participate in the Security Financial Disclosure Program”.

5.2.5 The Contractor shall inform NGA as soon as practicable when its employees will no longer support the contract (see DD254). NGA desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day that contract support ends. If Contractor personnel will no longer be supporting NGA via an NGA contract, NGA shall

18 | P a g e take all appropriate action, up to and including debriefing the contractor from SCI access and terminating logical and physical access to NGA IT systems and facilities.

5.2.6 Upon notifying NGA that a Contractor will no longer support the contract, the Contractor must return all NGA Badges, CAC, hangtag, and any other government furnished property. These items can be returned to the NGA Workforce Support Center, NGA Site Security Office, or the Contracting Officer Representative (COR) as soon as practicable, but no later than four

(4) business days from the date of Contractor departure.

5.2.7 When Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the responsibility of the Contractor’s FSO to collect the items from the individual and return them to NGA as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

5.2.8 If the FSO debriefs their employee, the FSO shall provide a copy of the debriefing statement, plus all applicable Government-furnished items (e.g.

NGA Badge, CAC, Courier Card, parking hangtags, etc.) to the NGA Site Security Office or the NGA Workforce Support Center as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

5.3 Physical Security Requirements

5.3.1 All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at contractor sites must be performed in either an NGA accredited SCIF, Other Government Agency (OGA) SCIF, or an approved secure collateral space that has either a Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this contract. SCIF or secure facility accreditation shall be at least the level commensurate with the level of safeguarding required by the contract DD254.

5.3.2 Pursuant to “IC Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Version 1.5.1; IC Tech Specs for ICD/ICS 705”, the NGA accrediting official, or designee, shall conduct periodic security inspections/reviews to ensure the efficiency of NGA accredited SCIF operations, identify deficiencies, and document corrective actions taken. Inspections/reviews of NGA accredited SCIFs shall be conducted based on threat, facility modifications, sensitivity of programs, past security performance, or at least every five years. Technical Surveillance Countermeasures (TSCM) activities in NGA accredited SCIFs will only be conducted by NGA TSCM teams consisting of NGA military, civilian, or contractor personnel who have successfully completed approved TSCM training. Authorized inspectors shall be admitted to a SCIF without delay or hindrance when inspection personnel are properly certified to have the appropriate level of security clearance and SCI indoctrination for the security level of the SCIF.

19 | P a g e

5.3.3 Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.

5.4 Unclassified Work Performance/Uncleared Personnel Security Requirements

5.4.1 If applicable, and after discussion with the COR, and the COR has provided written approval, uncleared Contractor personnel are authorized to work on this contract at the Unclassified level, with access up to DoD Controlled Unclassified Information (CUI) at the Contractor site without the requirement of a security clearance.

5.4.2 If applicable, and after discussion with the COR, and the COR has provided written approval, any Contractor personnel working with CUI information must receive a favorable HSPD-12 and/or HSPD-12 Tier 1 adjudication prior to accessing CUI information. Contractor personnel who require access to CUI for 60 days or less must receive a favorable HSPD-12 adjudication.

Contractor personnel who require CUI access for more than 60 days must receive a favorable HSPD-12 Tier 1 adjudication. NGA will sponsor the HSPD-12 and HSPD-12 Tier 1 background investigation for Contractor personnel as needed.

5.4.3 Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract. Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default

5.4.4 Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.

5.5 Information Security Requirements

5.5.1 NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. Access to classified information will be pursuant to the security requirements established in the DD254. The Contractor shall not access, download, print, or further disseminate any classified information outside the

20 | P a g e execution of the defined contract requirements without the guidance and written permission from the COR.

5.5.2 When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies (including the Consolidated NGA (CoNGA) Security Classification Guide) for the proper marking, handling, processing, storing, and safeguarding of classified and unclassified material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.

5.5.3 Access to CUI will be pursuant to DFARS clause 252.204.7012. The prime contractor shall include this clause, including paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for Subcontractor performance retains its identity as covered defense information and will require protection under this clause. Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

5.5.4 NGA will assess and authorize Contractors to process classified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.

5.5.5 In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions. The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-

21 | P a g e furnished information upon contract termination or when no longer required for contract performance.

5.5.6 In situations when electronic transmission is not practicable, Cleared Contractor personnel may hand-carry contract-related classified information when authorized by the COR in writing. Approved Contractor personnel must obtain NGA courier authorization prior to hand-carrying of classified contract-related information. Only classified information related to the performance of this contract may be hand-carried. Contractor personnel will be limited to hand-carrying classified information between approved Contractor facilities and US Government facilities unless the COR approves other circumstances in writing, when applicable, on a case-by-case basis.

5.6 Cyber Security

5.6.1 The Contractor must, at a minimum, implement 10 U.S.C. Sections 391 and 393 along with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” requirements.

5.6.2 If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/).

5.6.3 In the event that the Contractor…