20250515 Holmes TO2 SW Maint PWS - Globe.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency (NGA)

J-02 Performance Work Statement (PWS)

For Holmes Task Order 2

Software Maintenance - Globe

Solicitation # TBD

15 May 2025

Rev 1 ii | P a g e

1 General

2 Service Areas

3 Constraints

4 Other Direct Costs (ODC)/Travel

5 Security

6 Transition

7 Government Property

8 Special Requirements

APPENDIX A : Acronyms

APPENDIX B: CDRLS

ADDENDIX C: Compliance and Reference Documents

ADDENDIX D: Meeting Requirements

ADDENDIX E: Key Personnel Job Descriptions and Qualifications

ADDENDIX F: Architecture Document Library

ADDENDIX F: Performance Measures

ADDENDIX G: Development – Operations (DevOps) – Tier Definitions

List of Figures iii | P a g e

PWS Change History Matrix

Revision # Change Summary Date

TBD/TBR List

TBD/TBR # Description Status

TBR-001 Appendix B – Determine CDRLS applicable to this TO

Open

TBR-002 Appendix G – Determine Performance Measures Open

1 | P a g e

1 General

1.1 Purpose

The Government’s overall purpose for this task order (TO) under NGA’s IDIQ Holmes contract is to provide software maintenance, content management and systems engineering services to support the Globe IT system for the Holmes contract. This task order applies to the following IT systems:

a) The Globe

1.2 Objective

This task order will provide direction to the Contractor on the required software maintenance, content management, and systems engineering requirements required to maintain the current and future Globe system to achieve the overall program objectives as per IDIQ SOW

Section 1.2 Objective.

1.3 Background

See Section 1.3 of the IDIQ SOW for background.

1.4 Period and Place of Performance

1.4.1 Ordering Period

The ordering period for this PWS is one (1) base year with four (4) one (1) year options and an additional six (6) month option to extend the task order services in accordance with FAR

52.217-8.

1.4.2 Place of Performance

The primary place of performance for the task order is detailed under Section 1.4.2 of the

IDIQ SOW.

1.5 Scope

The Contractor shall provide all of the Content Management, Software Maintenance and

Systems Engineering requirements for the Globe IT system as described in the following service areas.

2 | P a g e

2 Service Areas

2.1 Program Management (Not applicable to this task order)

2.2 Development – Operations (DevOps) (Not applicable to this task order)

2.3 Software Maintenance

2.3.1 The Contractor shall perform all service requirements and provide all CDRLs listed in Section 2.3 of the IDIQ SOW.

2.3.2 The Contractor shall implement features as prioritized by the Government during Agile Program Increment (PI) planning and documented in NGA USMS JIRA project for The Globe.

2.4 Content Management

2.4.1 The Contractor shall perform all service requirements and provide all CDRLs listed in Section 2.4 of the IDIQ SOW.

2.5 Systems Engineering

2.5.1 The Contractor shall perform all service requirements and provide all CDRLs listed in Section 2.5 of the IDIQ SOW.

3 Constraints

3.1 This task order is subject to the operating constraints outlined in Section 3 of the IDIQ SOW.

4 Other Direct Costs (ODC)/Travel

4.1 ODC for this task order shall be in accordance with Section 4.1 of the

IDIQ SOW.

4.2 Travel for this task order shall be in accordance with Section 4.2 of the IDIQ task order.

5 Security

5.1 The Contractor shall perform all security services and adhere to the security requirements detailed under Section 5 of the IDIQ SOW.

6 Transition (Not applicable to this task order)

7 Government Property

3 | P a g e

7.1 The Contractor shall adhere to all Government Property requirements listed in Section 7 of the IDIQ SOW.

8 Special Requirements

8.1 The Contractor shall adhere to all Government Property requirements listed in Section 8 of the IDIQ SOW.

4 | P a g e

APPENDIX A : Acronyms

See Appendix A of the IDIQ SOW.

5 | P a g e

APPENDIX B: CDRLS

The below CDRL items shall be provided under this task order, submitted in accordance with Appendix B of the IDIQ SOW. TBR-001

CDRL Title CDRL #

*Master (M) deliverable for the contract

6 | P a g e

ADDENDIX C: Compliance and Reference Documents

See Appendix C of the IDIQ SOW.

7 | P a g e

ADDENDIX D: Meeting Requirements

See Appendix D of the IDIQ SOW.

8 | P a g e

ADDENDIX E: Key Personnel Job Descriptions and

Qualifications

Not Applicable to this Task Order.

9 | P a g e

ADDENDIX F: Architecture Document Library

See Appendix F of the IDIQ SOW.

10 | P a g e

ADDENDIX G: Performance Measures

TBR-002

Appendix H: Performance Measures

Appendix H: Performance Measures

ID Performance Objective Reference Acceptable Performance Level (APL)

Software Maintenance Services S-1 Knowledge Management IDIQ SOW

6.2.3.1 Section

(a), 6.3.2

Section (a)

Number of software maintenance Configuration Items (CI)s in the CMS must exceed 95% accuracy.

A minimum of 90% of information updated within 1 week of a change to a CI and 95% within 2 weeks.

S-2 Software Maintenance IDIQ SOW

6.2.2 Section

(a)

Notification of an outage or degradation to PMO, and other parties defined by PMO, no later than 30 min of identification.

S-3 Cyber Security IDIQ SOW

9.4.5

Mitigates/remediates FISMA findings within the specified period defined by NGA.

S-4 Cyber Security IDIQ SOW

9.4.2

Maintain 100% compliant with NGA Information Assurance

Vulnerability Assessment (IAVA), Security Technical

Implementation Guides (STIGs) and other security vulnerabilities notifications in accordance with NGA security policies, directives and guidelines. Enforce Zero Trust initiatives during development and operational state.

S-5 User Story Development IDIQ SOW

6.3.2 Section

(f), 6.4.2, 6.4.3

Utilizing an agile methodology, deliver a minimum of 90% of planned user stories during each sprint/iteration.

S-6 Test Automation IDIQ SOW

6.3.4 Section

(a)

90% of software baseline per release shall be testable via automation in customer test environment.

S-7 Test Completion IDIQ SOW

6.3.4 Section

(a)

95% of test cases per release (customer system) shall have a status of passed with no liens or conditional statements.

S-8 Tested Code IDIQ SOW

6.3.4 Section

(a)

Minimum of 90% of code covered by automated tests. All areas of code are meaningfully tested.

S-9 Properly Styled Code IDIQ SOW

6.3.4 Section

(d)

New standard for NGA Software Way is to achieve Zero linting errors and zero warning. The vendor will set the coding standard on any new code and have one year for legacy code to produce zero linting errors and zero warnings in any final deployed code from onset of PoP.

S-10 Secure Code scanning IDIQ SOW

6.3.4 Section

(d)

New NGA Software Way Standard – Code is free of known static and runtime vulnerabilities. Code submitted must have zero Critical, high and medium-level static and dynamic security vulnerabilities 100% for each deployed code.

Negotiation with medium and low can be achieved in coordination between GSR GPMO and NGA Security and must follow NGA security guidelines.

11 | P a g e

ADDENDIX H: Development – Operations (DevOps) – Tier

Definitions

See Appendix I of the IDIQ SOW.