Attachment A_ENX Statement of Work.pdf

ATTACHMENT A

Statement of Work

Enterprise Next (ENX)

RFP 80GSFC27R0018

CONTRACT TBD

October 2026

Table of Contents

Section 1 Introduction

1.1 Background

1.2 Scope

1.3 Applicable and Reference Documents

Section 2 Requirements

2.1 Technical Requirements

2.2 IT Policy Requirements

2.3 Super Intelligence (SI) Requirements

Section 1 – Introduction

This contract provides enterprise-level development, sustaining engineering, and operations for

NASA’s Science Data Archives managed by the Goddard Space Flight Center (GSFC). Key activities include the evolution, engineering, and operation of on-premises and commercial cloud-based infrastructures that deliver common enterprise data capabilities, including but not limited to:

• Cloud-based data environments and infrastructure

• Compliant enterprise application hosting platforms

• Cloud-based data ingest and archive services

• Centralized metadata repositories and management services

• Unified data search and discovery interfaces

• Enterprise authentication and user identity management

• Global system metrics and usage analytics

• Mission data gateways and automated ingest pipelines

• Data transformation, processing, and visualization systems

For additional information about NASA’s scientific data systems, archive projects, and enterprise components, please visit the NASA Science Mission Directorate or the central NASA data portals (e.g., science.data.nasa.gov).

1.1 Background

NASA’s Science Data Archive Projects oversee the complete life cycle of the agency's scientific data; from acquisition through processing, archiving, and distribution. The primary goal is to maximize the scientific return from NASA's diverse missions and experiments. Central to this mission, NASA promotes the full and open sharing of all data with research and applications communities, private industry, academia, and the general public.

NASA's Science Data Archives serve as the core capability within this framework, responsible for ingesting, processing, archiving, and distributing data from numerous missions and instruments. These archives develop and operate enterprise tools and services that allow users to search, discover, transform, analyze, and visualize data, ultimately enabling cross-disciplinary science and accelerating the pace of new scientific research.

To modernize these capabilities, NASA is actively transitioning key data infrastructure

(including ingest, archive, and distribution components) into the commercial cloud. The goal is to establish a predominantly cloud-based enterprise that balances cost efficiency with mission responsiveness, serving as a robust platform for external partners and application developers.

Concurrently, given the heightened focus on cybersecurity, NASA is redoubling its efforts to maintain a proactive security posture across its entire data portfolio. A critical ongoing challenge is balancing stringent security and data integrity with the accessibility required to support

NASA's open-source science initiatives.

1.2 Scope

The ENX contractor shall coordinate and integrate activities with Data Archive Projects, other science data centers, science investigator teams, user communities, other contractors, and

Science Mission Directorate (SMD) organizations. The overarching goal is to continuously improve system performance, scalability, and reliability while reducing operational and maintenance costs by modernizing capabilities and retiring legacy services.

The contractor may be tasked to:

• Develop new systems or execute major upgrades to existing systems.

• Leverage commercial cloud solutions to replace or augment current systems.

• Conduct Government-directed engineering studies.

• Maintain and sustain hardware and software (including COTS/FOSS) to meet user availability requirements.

• Deliver engineering solutions that reduce overall cloud and limited on-prem systems maintenance and operation costs.

• Provide user support.

• Operate enterprise system components, tools, and services

• Collect, develop, and maintain system and user metrics

1.3 Applicable Reference Documents

1.3.1 Applicable Documents

The following are applicable documents for this contract statement of work:

• NPR 1382.1B NASA Privacy Procedural Requirements

• NPR 2810.1F Security of Information and Information Systems

• NPR 2810.7 Controlled Unclassified Information

• NIST SP-500-267 A Profile for IPv6 in the U.S. Government – Revision 1

• NIST SP-500-273 IPv6 Test Methods: General Description and Validation

• NIST SP-500-281 USGv6 Testing Program User's Guide

The following handbooks relevant to the development, authorization, and maintenance of NASA information systems. (Current versions as posted on https://cset.nasa.gov/ascs/cspd-handbooks/ )

• ITS-HBK-AASTEP0.v1.0.0 Step 0: Prepare Policy

• ITS-HBK-AASTEP1.v1.0.0 Step 1: Categorize Policy

• ITS-HBK-AASTEP2.v1.0.0 Step 2: Select Policy

• ITS-HBK-AASTEP3.v1.0.0 Step 3: Implement Policy

• ITS-HBK-AASTEP4.v1.0.0 Step 4: Assess Policy

• ITS-HBK-AASTEP5.v1.0.0 Step 5: Authorize Policy

• ITS-HBK-AASTEP6.v1.0.0 Step 6: Monitor Policy

Section 2.0 Requirements

The contractor shall provide personnel, tools, materials, facilities, and other resources necessary to execute the elements within the Statement of Work (SOW), excluding Government Furnished

Property (GFP). The Government anticipates acquiring the Program Management and Sustaining

Engineering elements via Firm-Fixed Price (FFP) tasks, while the remaining elements will be acquired through Cost-Plus-Fixed-Fee (CPFF) Tasks due to their variability and complexity.

2.1 Technical Requirements

CLIN (Contract Line Item) 0001 - FFP Task Order for Project Management &

Sustainment:

Project Management

The ENX contractor shall plan, develop, integrate, and execute the program management activities necessary to successfully execute the requirements of this contract. The contractor shall provide the necessary skills and staffing levels to ensure successful performance on this contract.

These activities shall include, but are not limited to, program planning, detailed technical planning; conduct of technical and program reviews; financial and technical progress reporting;

financial management; purchasing and procurement of required products, services and resources;

subcontract management; configuration management; safety management; security and property management; quality management; risk management; and performance assurance.

Sustainment and Maintenance

The ENX contractor shall perform hardware and software engineering sustainment and maintenance of science data systems in accordance with authorized tasks. Engineering maintenance shall consist of a large spectrum of activities including, but not limited to, replacing, removing and/or upgrading custom software, FOSS/COTS software, COTS hardware and system media; performing vendor recommended preventative maintenance; updating to latest secure versions of software; configuration management; computer resource analysis and utilization planning; training of personnel as necessary; installation; documentation updates and testing.

Sustainment includes ongoing changes made to an operational system and associated documentation in response to the evolving needs and feedback of the user or customer. It may also include updates to the system that address errors, performance, efficiency, maintainability and general design deficiencies in order to keep the system running at its peak capability.

The contractor shall also plan, document, implement, and maintain the hardware and software maintenance and sustainment processes to be used throughout the life of the ENX contract, including detailed patch and release documentation.

CLIN 0002 - CPFF Task Order for Systems Engineering, Development, IT Security, User

Services, Operations, Testing:

System Engineering

The ENX contractor shall perform system engineering on science data system hardware and software systems in accordance with authorized tasks. System Engineering activities shall include, but not be limited to requirements development, new feature, analyses; interface document development; concepts of operation; architecture diagrams; trade studies; make or buy analysis; whitepapers related to recommending enhancements to the archive system and/or its components for cost saving and/or cost avoidance; capacity growth; performance, reliability, maintainability and/or operational improvements; technology refresh; design improvements;

process improvement; usability studies; end to end validation; evolution roadmap development;

product management and other similar type upgrades.

Development

The ENX contractor shall perform design, prototyping, development, test and implementation activities for new systems and major enhancements to existing systems. New development efforts are those that result in new or substantially modified systems. Development activities may span multiple cycles of development and require a high degree of planning and collaboration. New development activities shall include, but not be limited to, hardware and/or software requirements analysis, test plan development (functional and performance), test activity planning and coordination, design, interface definition and/or compliance with standards cited within this contract, security compliance, test and integration, training, quality assurance and documentation development. New development is complete when the system transitions into operations.

The contractor shall also plan, document, implement, and maintain the hardware and software development processes to be used throughout the life of the ENX contract, including detailed patch and release documentation.

IT Security

The ENX contractor shall perform security engineering activities that safeguard the confidentiality, integrity, and availability of science data archive systems. This includes a wide variety of activities including, but not limited to, detecting, analyzing, and responding to cybersecurity incidents, monitoring of systems for vulnerabilities, addressing vulnerabilities within NASA required timelines, conducting risk assessments, responding to Agency penetration testing and independent third-party security assessment findings, implementing required security mandates and responding to data calls related to security mandates, maintaining security documentation and supporting ATO assessments. The contractor will plan, design, implement and document all aspects of security engineering.

User Services

The ENX contractor shall provide support to the science and application user community in accordance with authorized tasks. Support shall include, but not be limited to, training in the use of the science systems, including instruction on data access, tools, and transformation services. It also includes training and community engagement to better understand user needs, identify user pain points, and the identification of potential system modifications to improve user experience.

Operations

The ENX contractor shall provide operations support in accordance with authorized tasks. It includes two key elements, operational support of system components and operational support for data system.

Operational support of system components encompasses activities for both on-premises and cloud-based systems, including but not limited to, system operations, system administration, network operations, training of operations and related skilled personnel on the systems maintenance and operation, use of operational and diagnostic tools and procedures, and development of procedures to accommodate upgrades or enhancements. Key focus areas include monitoring system performance against archive goals and identification of areas for increased operational efficiency. Operations support includes diagnosis of operational problems, identification of system impacts, root causes and potential mitigations.

Operational support for archive data encompasses activities including data and metadata management for the centralized archive. This includes activities such as science data processing, the ingestion of science data into the archive, archive management, integrity checking of data, ensuring backup and recovery of the archive, ensuring accessibility of data, adding transformation and visualization services to archive data, optimization of storage costs, and metadata adjustments.

Testing

Above and beyond the product level testing provided in the Development and Operations elements, the ENX contractor shall provide enterprise level functional, usability and performance testing across the integrated suite of tools to ensure that individual development and maintenance activities result in a cohesive and performant enterprise solution for end users. This may include a combination of automated testing, manual testing and end user engagements to assess usability.

2.2 IT Policy Requirements

2.2.1 IPV6

• For a FIS that uses Internet Protocol, the contractor shall provide full feature functionality in both dual stack (IPv4 and IPv6) and IPv6-only environments in compliance with the

NIST USGv6 Testing Program as described in NIST SP-500-267, NIST SP-500-273, and

NIST SP-500-281.

• The contractor shall integrate records management and preservation considerations into the design, development, enhancement, and implementation of electronic information systems in accordance with NPR 1441.1, NASA Records Management Program

Requirements.

• Offerors shall notify the Contracting Officer of any contract specifications that do not comply with providing full feature functionality for IPv6.

2.2.2 End User Services

The Government will provide the end user devices needed in the performance of this contract through NASA's mandatory End User Device contract, as identified in the NFS Companion

Guide, Enterprise Procurement Strategies, PSL A.102-2, IT Services.

2.2.3 IT Purchase Authorization

• The contractor shall ensure all IT products and services direct charged to the contract are approved through the OCIO’s Commercial IT Request (CITR) Application. This includes, but is not limited to, FITARA, Supply Chain Risk Management (SCRM), IPv6, and 508 compliance. No purchases of commercial IT products or services should be made prior to coordination and approval by the OCIO. Contractor shall report purchases monthly utilizing DRD XX-XX, CITAR.

• This contract shall only be used to purchase software, software maintenance, hardware, or hardware maintenance necessary for the performance of this contract. NASA shall own the license(s) or subscriptions for any software or applications purchased. All hardware shall be titled to NASA.

2.2.4 Section 508 Conformance

The contractor shall ensure that all products, platforms, services, and communications delivered as part of this work statement that are Information and Communication Technology (ICT) or contain ICT, conform to the Revised Section 508 of the Rehabilitation Act Standards, 36 C.F.R.

§ 1194.1 & Apps. A, C & D. The Standards may be found at https://www.access-board.gov/ict/.

2.2.5 Records Management

• The Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the

Government and must be managed in accordance with Federal law, including but not limited to, the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at

36 CFR Chapter XII Subchapter B, as well as NASA records policies (NPD 1440.6, NASA Records Management Program, and NPR 1441.1, NASA Records Management

Program Requirements).

• The Contractor shall ensure that NASA-owned/Contractor-held records are segregated from contractor-owned records and from non-record materials and report holdings of

NASA records.

• The Contractor shall immediately notify the Contracting Officer and NASA Records

Officer upon discovery of any inadvertent or unauthorized removal, defacing, alteration, or destruction of Federal records. Destruction of Federal Records is EXPRESSLY

PROHIBITED unless in accordance with records retention schedules or as directed by the

Contracting Officer.

• All Contractor employees assigned to this contract who create, work with, or otherwise handle Federal Records are required to complete mandatory NASA- provided records management training. The Contractor shall ensure that training has been completed according to agency policies, including initial training and any required annual or refresher training.

• The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract, and require written subcontractor acknowledgment of same.

2.3 Super Intelligence (SI) Requirements

Offerors are required to disclose any intent to propose, or plan to use SI to perform contract requirements.

2.3.1 Super Intelligence (SI) Acquisitions

See Appendix A: Requirement Statement- SI Acquisition

2.3.2 Large Language Model (LLM) Transparency

See Appendix B: Requirement Statement- LLM Transparency

2.3.3 Use of Super Intelligence (SI) During Contract Performance

See Appendix C: Requirement Statement- Use of SI During Contract Performance