5yr_RFI_Message_Operations__SOW.pdf

UNCLASSIFIED

NATIONAL GEOSPATIAL-INTELLIGENCE

AGENCY

Message Operations and Information Exchange

Support

Request for Information (RFI) Organizational Messages Statement of

Work (SOW)

Date: 16 January 2025

Table of Contents

1 Introduction

2 Scope

3 Description of Work

4 Security

5 Deliverables

6 Travel

7 Government Property

8 Holidays

9 Place of Performance ................................................................................................. Error! Bookmark not defined.

10 Period of Performance ............................................................................................... Error! Bookmark not defined.

1 Introduction

The National Geospatial-Intelligence Agency (NGA) has a requirement to produce and disseminate geospatial-intelligence (GEOINT) information throughout the Department of Defense (DoD) and Intelligence Community (IC). This Statement of Work (SOW) outlines NGA’s requirements for sustainment and enhancement of an organizational messaging application and details requirements for Application Service Provider (ASP) Operational, Tier 1 and Tier 2 support. This application is responsible for the exchange and discovery of intelligence reporting information allowing internal and external users and customers access to NGA-authored and created reporting . It will also provide for a greater breadth and understanding of global intelligence issues resulting in more meaningful and deeper NGA reporting.

The purpose of this SOW is to procure from, and contractor install, configure and maintain Commercial

Off The Shelf (COTS) organizational messaging software able to meet the National Geospatial-

Intelligence Agency's (NGA) messaging mission on to NGA provided (either on premises or on 3rd party cloud architecture) at geographically separated sites, with two (2) contractor FTE system administrators on-site support during normal business hours at one of the NGA sites. Furthermore, provide vendor

24/7 help desk support for problem and discrepancies. In addition, limited enhancements in support of

NGA's messaging missions at the Top-Secret level is required. The solution needs to support both on and off-site remote users, at two (2) NGA sites that can operate independently of the other during downing events. If a primary and alternate site solution, it shall provide automated/no manual intervention failover to the alternate site if a mission failure (be it hardware or software) occurs.

2 Scope

NGA, referencing the Department of Defense (DoD) and Intelligence Community (IC) guidelines, requires 99.9% mission availability and connectivity to DoD and IC partners. The Contractor shall be responsible for the Application and Configuration portions of the OM IT systems. While NGA specifies two (2) sites be stood up (as described later in this document), the design should be such that a single mission capable site is sufficient for this metric.

Using the OM application, analysts can draft, coordinate and release information in all three message formats (ITS/Information Transport Service, GENSER/General Service and DSSCS/Defense Special

Security Communications System), create and manage profiles, perform a retrospective search/query of the entirety of OM holdings (current and historical). Users can specify e-mail delivery of any information matching the terms of a profile or query. The OM IT system will require contractor assistance to be accredited for the handling of information at the TOP SECRET//HCS/SI-G/KLM/TK level.

Organizational messages are owned by the government and used throughout NGA for:

o Real-time discovery and access of intelligence reports and open-source information through persistent agent profiles o Discovery and access of intelligence reports or open-source information based on user-defined retrospective or historical queries o Delivery of intelligence reports to the Library of National Intelligence (LNI) and other mission applications or entities through persistent agent profiles o Drafting, coordinating, and release of intelligence reports and official administrative communications through electrical record messaging o Store and forward exchange of NGA-authored intelligence reporting and information in organizational message formats to external customers o Receive and store intelligence reporting and information authored by external organizations for discovery and access by NGA systems or connected systems, and employees.

3 Description of Work

A. On-Site and Help Desk Support

Two (2) Full Time Equivalent (FTE) System Administrators/Program Engineers for operations and maintenance during normal business hours at a NGA facility supported by a Contractor 24/7 Help Desk.

The Contractor shall provide on-site operational support at an NGA facility Monday through Friday, with a suggested time between 0600 and 1800 (Eastern). In the event one of the two contractors miss work due to illness or for other reasons, coverage and support will be provided remotely by the off-site Support Help Desk team. If contacted after business hours the Contractor shall respond by telephone not more than twenty (20) minutes or four (4) hours, depending on severity, after notification. If Mission need requires, the contractor will respond on-site at NGA in order to resolve technical issues and restore operations within 4 hours from notification. Otherwise, the Help Desk will note the problem (either a break fix, or an enhancement) and work during normal business hours. Contractor will be required to provide up to but not exceed eight hours of after hour support per month. The Contractor will provide written Technical Support Help Desk call procedures to NGA.

System Administration and Cybersecurity

1. Identify messages that have failed message format validation for continued processing.

2. Troubleshoot and resolve connectivity issues with connected systems/applications.

3. Perform message system configuration and database modifications, network configuration changes, and security configuration or communications line security parameters based on NGA government direction.

4. Test message application software releases and/or patches with existing connected systems.

5. Coordinate and collaborate with other Application Service Providers (ASP)/Infrastructure Support Providers (ISP) on hardware, operating system, transport, or other issues that impact the OM system functionality and availability.

6. Manage and assist in NGA’s OM software access and permissions to the Information Transport Service (ITS), message operators, NGA GEOINT Operations Center (NGOC), Command and Control, Production System Operations Cell (PSOC), Library of National Intelligence (LNI), NGA Cedalion, etc.

7. Manage and configure new communication lines to include functional testing with the distant end based on NGA government direction.

8. Mission availability should be maintained at 99.9% (8.77 hours of downtime per year). This is based on the operational system mission performance and not just uptime on the OM server or application. For example, an individual component can be down, but if mission is performed successfully, no downtime will be assessed against for the purpose of this requirement.

9. Provide support to all agents, real-time dissemination of incoming organizational record messages based on user-created profiles/agents, retrospective search of historical information and composition, coordination, and release of organizational record messages.

10. Provide a monthly report via email to the Government program manager (PM) and OM Branch Government Leads with status and summary of NGA Help Desk calls, work in progress and any outstanding issues, including digests of any applicable discrepancy reports.

11. The Contractor shall provide a system design document that details the existing system design, including interfaces, ports, protocols, connections and POCs (names and telephone numbers) with other systems on an annual basis and/or after a significant system change as part of Intelligence Community Directive (ICD) 503 Continuous Monitoring, currently within NGA’s Xacta system. (Xacta training to be provided by the Government).

a. The Contractor shall provide documents, user's manual and configuration manual in sufficient detail to support organizational message switch application system configuration and operation.

12. If required, during non-business hours, one of Contractor’s System Administrators will respond on-site at an NGA Facility, in order to resolve technical issues and restore operations within 4 hours from notification from the NGA’s PSOC help desk and/or Government Point-of-Contact (GPOC). The Contractor shall provide written Technical Support Help Desk call procedures to NGA.

13. Perform routine application preventive maintenance functions and database back-ups.

14. The Contractor shall support all NGA and Non-NGA outages that impact the OM servers. The Contractor shall provide assistance with continuous monitoring of the accreditation process of the messaging systems in accordance with ICD-503 in order to support government ATO (Authority to Operate).

15. The contractor shall request, install and update certificates (servers) to ensure the servers are properly maintained and functional.

16. The Contractor shall comply and support applicable Department of Defense (DoD) security policies as well as NGA Information Technology Risk Management initiatives.

17. The Contractor shall support ongoing NGA cybersecurity initiatives and respond to system vulnerabilities as they pertain to the OM application(s) per NGA’s direction and prioritization.

Technical Help Desk Support

1. The Contractor shall provide Technical Help Desk Support via telephone or internet email.

Technical support must respond within 20 minutes by phone for Code 1 (System/Mission Failure) and within four (4) hours of notification by phone or email of Priority 2 and Priority 3 calls. The Contractor will provide NGA the telephone numbers and email addresses needed to obtain support.

2. Break fixes for problems that do not immediately impact mission, and simple enhancements for evolving mission will be logged and worked during normal business hours.

3. The Contractor, as the ASP, shall resolve all OM operational system problems as determined to be a result of the OM application in priority order. Otherwise, the Contractor will work with NGA’s ISP to resolve system problems not OM application/ASP related that impact operations.

B. Licensing, Developmental and Maintenance Support

Provide for purchase, install, configure and accredit OM software application(s) onto two (2) NGA geographically separated, interconnected data centers. Provide license(s) and maintenance of the OM application(s). Provide a list of size (memory, and size & type of storage) and operating system with configuration needed to properly operate the OM application(s) for five (5) years for the Government to give NGA’s ISP to properly provision hardware.

Installation, Configuration and Accreditation The Contractor shall:

1. Install, configure and test each instance of the OM applications unto NGA provided VMs and Network attached storage in two data centers.

2. Troubleshoot and resolve issues with installation and configuration.

3. Interact and coordinate with NGA’s ISP on hardware, operating system, transport, or other issues that impact the OM application(s) installation, functionality and availability.

4. Enable the OM application(s) access and permissions to the message operators, ITS, NGA

Operations Center (NOC), Command and Control, Production System Operations Center

(PSOC), Library of National Intelligence (LNI), NGA Cedalion, etc.

5. Configure existing communication lines to include functional testing with the distant end.

6. Provide support to all agents, real-time dissemination of incoming organizational record messages based on user-created profiles/agents, retrospective search of historical information and composition, coordination, and release of organizational record messages.

7. Provide documents, user's manual and configuration manual in sufficient detail to support organizational message switch application system configuration and operation.

8. Support with documentation of sufficient detail to populate NGA’s Disaster

Recovery/Contingency of Operations for OM operations as detailed in the Information

System Contingency Planning (ISCP) tool.

9. Support with documentation of sufficient detail to populate NGA’s Assessment and

Authorization (A&A) ICD-503 accreditation system Xacta (see Cybersecurity Support below).

10. Reconfigure, at need any, Hardening Guide / Security Technical Implementation Guides

(STIGs) and OM application related Information Assurance Vulnerability Alert (IAVA) findings.

11. Support any software supplied by the contractor, including third party software and applications necessary for the proper operation of the messaging software that is not delivered and maintained by NGA’s ISP with installation, configuration and maintenance, including bug fixes and security updates.

12. Upon the Government's discretion, utilize a classified test environment (either an alternate operational site, or a Government Testing System) to test new builds, break fixes or security patches with real operational messages before installation on the active operational site. This facility would supplement, not replace, any testing, validation and verifications efforts normally performed by the contractor as part of a normal software build.

Cybersecurity / Information Assurance Support

1. The Contractor shall provide ongoing Cybersecurity Subject Matter expertise to provide support with the A&A security, certification and accreditation via Continuous Monitoring

(including but not limited to IAVA work off) of OM system(s).

2. The Contractor shall comply and support applicable Department of Defense (DoD) security policies as well as NGA Information Technology Risk Management requirements.

3. The Contractor shall support ongoing NGA cybersecurity initiatives and respond to system vulnerabilities per NGA’s direction and prioritization.

4. The Contractor shall provide expertise to support NGA’s Risk Management and

Cybersecurity efforts required to obtain and retain an Authority to Operate (ATO). This includes adherence to the NGAM 8010.1 Information Systems (IS) Risk Management

Framework (RMF) guide and Intelligence Community Directive (ICD) 503 in developing the

Security Plan, Risk Assessment Report, Security Assessment Report and Plan of Actions and

Milestones (POA&M), as well as compliance with NGA’s Enterprise Security Services cybersecurity initiatives. The Contractor shall use industry leading tools and work with appropriate security stakeholders to implement continuous monitoring capabilities.

5. The Contractor shall create an ICD‐503 compliant system security plan in NGA’s Xacta system by entering relevant information into, as well as subsequent proof of compliance

(documentation and demonstration) with any assessed security controls. The Contractor shall create any needed Firewall Change Requests (FCRs) via NGA’s Service+ portal. The

Contractor shall support Technical Exchange Meetings (TEMs) with NGA’s Risk

Management Team (Registration, Security Onboarding TEM, Pre-Categorization and

Selection TEM, Categorization and Selection TEM and Security Controls Assessment) to achieve an Authority To Operate (ATO). {Government training will be provided for the proper use of NGA processes.}

6. The Contractor shall utilize ACAS vulnerability scanning via the NESSUS agent, evaluate and remediate, mitigate or patch vulnerabilities, utilizing NGA’s Authorized Outage

(AO)/Change Request process. {Government training will be provided.}

7. The Contractor shall investigate Quest Authentication Services (QAS) to “join” Active

Directory, and, if feasible, install upon Government direction.

8. The Contractor shall enable web-based logins with NGA’s Active Directory utilizing the

GEOAxis application.

9. The Contractor shall create the documentation of Personally Identifiable Information

/Personal Health Information (PII/PHI) for the Privacy Threat Analysis (PTA) Office to determine any additional security controls. {Government training will be provided.}

10. The Contractor shall enable End Point Security/ENS (evolution of Host Based Security

System/HBSS) utilizing NGA’s Enterprise.

11. The Contractor shall enable Carbon Black managed monitoring with NGA’s Enterprise when applicable.

12. The Contractor shall enable NGA’s Insider Threat monitoring via the Enterprise User Activity

Monitoring (UAM) tool.

13. The Contractor shall collaborate with NGA’s Disaster Recovery team in the creation of the system’s Information System Contingency Plan (ISCP). {Government training will be provided.}

14. The Contractor shall aid NGA’s Production Systems Operation Cell (PSOC) with installations of monitoring widgets/APIs for after hour monitoring.

15. The Contractor shall investigate Data at Rest Encryption solutions, and, if feasible, install upon Government direction.

16. The Contractor shall utilize NGA’s SHIELD two factor authentication procedure to daily elevate privileged user access, and, if feasible, install upon Government direction.

17. The Contractor shall investigate ArcSight (Enterprise auditing integration) service for insider threat detection and off system audit log reviews, and, if feasible, install upon Government direction.

C. Personnel

The Contractor shall provide Point of Contacts that maintain primary responsibility for OM system administrator duties. All Contractor personnel assigned to this contract shall possess U.S.

citizenship and be able to read and speak fluent English. Contractor personnel must also possess necessary security clearances to gain access to facilities and equipment.

Skills

The personnel performing the above-named tasks will be thoroughly knowledgeable in the OM application (server and user facing), in organizational messaging systems applications (end-to-end), as well as knowledge in system fail-over and cybersecurity requirements as it pertains to the OM application. If new Contractor personnel are needed to support performing the above-named tasks, ample training time will be needed for new Contract personnel to become familiar with

NGA’s instance of the OM application.

D. Training

The Contractor shall provide User and System Administrator training at a mutually agreed time, though no fewer than once a year. The Contractor shall provide training material for in-cycle and for out of cycle users. This material will detail any changes to operating the application from the last training.

These training materials will be in a mutually agreed upon format.

E. Program Management Support

The Contractor shall support Intelligence Community meetings relevant to the use of the OM application upon the request of the COR.

4 Security

Note: This section is included for level of effort calculations. The DD254 will take precedence over any discrepancies.

While much of the work will require a TS/SCI clearance to enter Organizational Messages (OM) Branch workspaces and to access OM Information Systems (IS), unclassified and Controlled Unclassified Information (CUI) work can be done outside NGA in unclassified spaces.

Classified Work Performance Security Requirements

Contractors must abide by the DD Form 254 - Contract Security Classification Specification (referred to as DD254 hereafter), the National Industrial Security Program Operating Manual (NISPOM 32 CFR Part 117), and all other applicable security policies and regulations including operational security (OPSEC) requirements.

Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Agency (CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances. As such, Security Executive Agent Directive (SEAD) 3 reporting should continue to be provided to the Contractor’s Facility Security Officer (FSO) for reporting to DCSA via Defense Information Security System (DISS). DCSA will also dictate mandatory security training as the CSA for the collateral cleared community.

Personnel Security Requirements

Contractor personnel performing TOP SECRET/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to TS/SCI facilities, when performing duties within TS/SCI environments, and for access to TS/SCI computer systems for the performance of this contract. Contractors are subject to a Counterintelligence-Scope Polygraph examination, as requested by NGA. As a condition of employment and assignment, contractors who have not successfully completed polygraph testing within the last five years must immediately schedule a polygraph examination and must complete the process, in no more than three test sessions, within 90 days.

All Contractor personnel shall possess a current TOP SECRET Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access. The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel in accordance with (IAW) SEAD 7: “Reciprocity of Background Investigations and National Security Adjudications”. If needed, NGA will sponsor SCI accesses at its sole discretion. NGA will provide badges, Common Access Cards (CAC) and other items (e.g. parking hangtags) when applicable, for required Contractor personnel.

Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI) Continuous Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW SEAD 6: “Continuous Evaluation”. Cleared Contractor personnel must self-report security issues, foreign contacts, and other applicable information IAW SEAD 3: “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position” and NGA Instruction 5205.3, “Security Reporting Requirements”. In addition, cleared Contractors will be required to submit electronic fingerprints and be enrolled into NGA’s Report of Arrest and Prosecution Background (RAPBack) program, which supports CES.

Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in NGA’s annual Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20 November 2020 memorandum titled “Designation of NGA Personnel Required to Participate in the Security Financial Disclosure Program”.

The Contractor shall inform NGA as soon as practicable when its employees will no longer support the contract (see DD254). NGA desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day that contract support ends. If Contractor personnel will no longer be supporting NGA via an NGA contract, NGA shall take all appropriate action, up to and including debriefing the contractor from SCI access and terminating logical and physical access to NGA IT systems and facilities.

Upon notifying NGA that a Contractor will no longer support the contract, the Contractor must return all NGA Badges, CAC, hangtag, and any other government furnished property. These items can be returned to the NGA Workforce Support Center, NGA Site Security Office, or the Contracting Officer Representative (COR) as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

When Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the responsibility of the Contractor’s FSO to collect the items from the individual and return them to NGA as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

If the FSO debriefs their employee, the FSO shall provide a copy of the debriefing statement, plus all applicable Government-furnished items (e.g. NGA Badge, CAC, Courier Card, parking hangtags, etc.) to the NGA Site Security Office or the NGA Workforce Support Center as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

Physical Security Requirements

All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at contractor sites must be performed in either an NGA accredited SCIF, Other Government Agency (OGA) SCIF, or an approved secure collateral space that has either a Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this contract. SCIF or secure facility accreditation shall be at least the level commensurate with the level of safeguarding required by the contract DD254.

Pursuant to “IC Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Version 1.5.1; IC Tech Specs for ICD/ICS 705”, the NGA accrediting official, or designee, shall conduct periodic security inspections/reviews to ensure the efficiency of NGA accredited SCIF operations, identify deficiencies, and document corrective actions taken. Inspections/reviews of NGA accredited SCIFs shall be conducted based on threat, facility modifications, sensitivity of programs, past security performance, or at least every five years. Technical Surveillance Countermeasures (TSCM) activities in NGA accredited SCIFs will only be conducted by NGA TSCM teams consisting of NGA military, civilian, or contractor personnel who have successfully completed approved TSCM training. Authorized inspectors shall be admitted to a SCIF without delay or hindrance when inspection personnel are properly certified to have the appropriate level of security clearance and SCI indoctrination for the security level of the SCIF.

Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.

Unclassified Work Performance Security Requirements

If applicable, and after discussion with the COR, and the COR has provided written approval, uncleared Contractor personnel are authorized to work on this contract at the Unclassified level, with access up to DoD Controlled Unclassified Information (CUI) at the Contractor site without the requirement of a security clearance.

Uncleared Personnel Security Requirements

If applicable, and after discussion with the COR, and the COR has provided written approval, any Contractor personnel working with CUI information must receive a favorable HSPD-12 and/or HSPD-12 Tier 1 adjudication prior to accessing CUI information. Contractor personnel who require access to CUI for 60 days or less must receive a favorable HSPD-12 adjudication. Contractor personnel who require CUI access for more than 60 days must receive a favorable HSPD-12 Tier 1 adjudication. NGA will sponsor the HSPD-12 and HSPD-12 Tier 1 background investigation for Contractor personnel as needed.

Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract. Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default.

Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.

Information Security Requirements

NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. Access to classified information will be pursuant to the security requirements established in the DD254. The Contractor shall not access, download, print, or further disseminate any classified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.

When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies (including the Consolidated NGA (CoNGA) Security Classification Guide) for the proper marking, handling, processing, storing, and safeguarding of classified and unclassified material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.

Access to CUI will be pursuant to DFARS clause 252.204.7012. The prime contractor shall include this clause, including paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for Subcontractor performance retains its identity as covered defense information and will require protection under this clause. Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

NGA will assess and authorize Contractors to process classified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.

In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions. The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-furnished information upon contract termination or when no longer required for contract performance.

In situations when electronic transmission is not practicable, Cleared Contractor personnel may hand-carry contract-related classified information when authorized by the COR in writing. Approved Contractor personnel must obtain NGA courier authorization prior to hand-carrying of classified contract-related information. Only classified information related to the performance of this contract may be hand-carried.

Contractor personnel will be limited to hand-carrying classified information between approved Contractor facilities and US Government facilities unless the COR approves other circumstances in writing, when applicable, on a case-by-case basis.

Cybersecurity Requirements

The Contractor must, at a minimum, implement 10 U.S.C. Sections 391 and 393 along with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” requirements.

If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/)

In the event that the Contractor discovers a cyber incident that affects a covered Contractor information system or covered defense information residing therein, or that affects the Contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall—

1. Notify the DoD Cyber Crime Center (DC3) and the COR in writing within 72 hours of incident discovery.

2. Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other information systems on the

Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support.

In the event the Contractor discovers and isolates malicious software in connection with a reported cyber incident, the Contractor shall submit the malicious software to DC3 in accordance with instructions provided by the COR. The Contractor should NOT send the malicious software to the COR.

Insider Threat Requirements

Contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 “Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information” and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.” As soon as practicable, Contractor shall report to the COR events that may have an effect on the status of the entity's or an employee's eligibility for access to classified information; report events that indicate an insider threat to classified information or to employees with access to classified information; report events that affect proper safeguarding of classified information; and report events that indicate classified information has been, or is suspected to be, lost or compromised.

5 Deliverables

General Deliverable Requirements

The Contractor shall provide all required written documents in a format compatible with Microsoft Office or other format mutually agreed between the Contractor and the COR. Two (2) copies of each document will be delivered electronically to the government; one to the COR and the other to NGA Supervisor (GPOC for Contractor Personnel or the NGA Program Manager). The application deliverables will be made on portable electronic media (DVD) and sent to the OM operational locations via next day delivery services/hand carry. If the OM Administrator departs the contract, then all working documents will be moved to the appropriate shared department drive for historical and records management purposes to assist the incoming and GPOCs for NGA’s mission.

Table 5-1: (U) Contract Deliverables

Del No

Deliverable Description Due

1 Specific procedures, names, contacts, and phone numbers for NGA Help Desk contacts.

5 days after contract award

2 Monthly Status Review. Monthly status report complete with work progress (including tracked discrepancies) and status of outstanding issues.

10th day of each month

3 System design document that reflects the existing configuration and includes diagrams and interfaces between the OM system and other systems.

5 days after contract award, after significant system changes, and a final at end of POP.

4 Help Desk telephone number(s) and email address(es)

Initial and after any changes

5 Two (2) copies of software installation media for builds, break fixes and patches (needed for disaster recovery contingency purposes).

Negotiable, but at need with a Not To Exceed (NTE) frequency of quarterly. *

* Normally, the software used for installations will be delivered to NGA’s Domain Transfer Officer on the Unclassified network to be scanned and then delivered to NGA’s TS system in a transfer directory for retrieval by the contractor for installation.

Other Deliverables

Other deliverables required by this agreement include invoices and all supporting documentation such as approved. Additional ad hoc deliverables may be requested by the Contracting Officer.

6 Travel

Travel outside the National Capital Region may be required.

7 Government Property

Government Furnished Property No Government furnished property will be provided for this effort.

8 Holidays

TBD

9 Place of Performance

10 Period of Performance