Tab 04 SOW Revised.pdf

STATEMENT OF WORK (SOW)

Technical Surveillance Countermeasures (TSCM) — One-Time Survey Service

NASA Langley Research Center (LaRC)

TABLE OF CONTENTS

1.0 INTRODUCTION

1.1 BACKGROUND

1.2 SCOPE

1.3 Organizational Conflict of Interest (OCI) Requirement

2.0 APPLICABLE DOCUMENTS

3.0 DESCRIPTION OF WORK

3.1 TSCM Survey Service Requirements

3.2 Facilities and Areas to be Examined

3.3 DELIVERABLES

4.0 GENERAL PROVISIONS

5.0 SECURITY

6.0 TRAVEL AND OTHER DIRECT COSTS (ODCs)

7.0 QUALITY CONTROL

APPENDIX A: FACILITIES SURVEY SCHEDULE

APPENDIX B: REFERENCE DOCUMENTS

APPENDIX C: ACRONYMS

1.0 INTRODUCTION

The Contractor shall provide all equipment, supervision, and other items necessary to perform a one-time, non-personal Technical Surveillance Countermeasures (TSCM) survey service in support of the National Aeronautics and Space Administration (NASA)

Langley Research Center (LaRC), as defined in this Statement of Work (SOW), except for those items specified as Government-Furnished Property (GFP) and services.

This SOW describes a non-personal services requirement. The Government shall not exercise any supervision or control over the Contractor's service personnel performing the surveys herein. Such service personnel shall be accountable solely to the Contractor, who is responsible to the Government for the quality and completeness of all survey activities.

No Government-to-Contractor employer-employee relationship is created or implied by this SOW. The Contractor is engaged to provide a defined service outcome, not to supply or place personnel into NASA positions.

1.1 BACKGROUND

NASA LaRC is responsible for conducting world-class scientific research. In support of these activities, LARC maintains sensitive facilities, communications systems, and areas where Controlled Unclassified Information (CUI) and classified information may be processed or discussed. The protection of these environments from technical surveillance threats is a critical element of the Center's overall security posture.

The NASA LARC Security OƯice, in coordination with the NASA OƯice of Protective Services, requires periodic technical security assessments to detect, deter, and neutralize potential technical surveillance threats directed against LARC facilities and personnel. This SOW establishes the requirements for a single, one-time TSCM survey of designated facilities at LARC, Hampton, Virginia.

1.2 SCOPE

Except for those items specified as Government-furnished property and services, the Contractor shall provide a complete, one-time TSCM survey service for designated NASA LARC facilities. The scope of this one-time service is limited to the following functional activities:

Routine Physical Survey: Systematic physical examination of designated spaces for the detection of concealed electronic eavesdropping devices, anomalous wiring, and unauthorized technical modifications to rooms, furniture, fixtures, and equipment.

Radio Frequency (RF) Signal Survey: Detection, identification, and analysis of RF signals within and in proximity to designated survey areas to identify unauthorized transmissions or signals of interest.

Acoustic/Physical Security Assessment: Evaluation of physical and acoustical security characteristics of surveyed spaces, identification of deficiencies, and development of corrective action recommendations.

Telephone and Communication Infrastructure Inspection: Inspection of telephone systems, network access points, and communication infrastructure within surveyed areas for evidence of unauthorized interception devices or tampering.

TEMPEST/Emanations Review (as applicable): Preliminary assessment of electronic processing equipment and associated cabling for potential emanation security vulnerabilities within the surveyed spaces.

This SOW does not establish a recurring contract, an ongoing support relationship, or require the Contractor to hire or assign personnel to work at NASA LARC on a continuing basis. The Contractor is engaged solely to perform a defined, one-time survey service event.

Building A on facility list must be completed in approximately early-December for planning purposes.

Remainder of facilities may be completed at the same time or as contractor schedule permits in coordination with CO.

1.3 ORGANIZATIONAL CONFLICT OF INTEREST (OCI) REQUIREMENT

Prime Contractors are informed that an actual and/or perceived Organizational Conflict of Interest (OCI) may arise in the performance of this requirement. This one-time service provides technical security survey support to NASA LARC. These eƯorts may include access to facility layout information, security system configurations, and sensitive space descriptions.

Should an OCI arise under this contract, the Contractor shall notify the Contracting OƯicer (CO) immediately and provide an OCI Mitigation Plan for the CO's review and approval within 48 hours of notification to the CO.

2.0 APPLICABLE DOCUMENTS

The following documents are applicable to the performance of this SOW. A complete reference list is provided in Appendix B.

Intelligence Community Directive (ICD) 705, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities (SCIFs)

DODI 5240.05, Technical Surveillance Countermeasures (TSCM), 03 April 2014

NASA Policy Directive (NPD) 1600.2, NASA Security Policy

NASA Procedural Requirements (NPR) 1600.1, NASA Security Program Procedural Requirements

National Industrial Security Program Operating Manual (NISPOM), 32 CFR Part 117

NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations

Federal Acquisition Regulation (FAR) Parts 4, 31, and 52

IC Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities (IC Tech Spec for ICD/ICS 705), Version 1.5.1

3.0 DESCRIPTION OF WORK

3.1 TSCM Survey Service Requirements

The Contractor shall provide a complete, one-time TSCM survey service for the NASA LARC facilities identified in Section 3.2. The Contractor shall furnish all personnel, tools, equipment, instrumentation, and materials necessary to perform the survey. No Government-Furnished Equipment (GFE) is anticipated for Contractor use in performing the survey, except as noted in Section 4.0.

3.1.1 Physical Search

The Contractor shall conduct a thorough physical search of all designated areas listed in Section 3.2. This includes, but is not limited to:

Systematic physical examination of all walls, ceilings, floors, and structural voids accessible without destructive disassembly

Inspection of all furniture, fixtures, installed equipment, wall plates, electrical outlets, light fixtures, smoke detectors, clocks, picture frames, and similar items

Examination of telephone instruments, conferencing equipment, audiovisual equipment, and desktop electronics

Inspection of accessible ceiling and floor plenum spaces

Examination of all HVAC components, ductwork, and ventilation access points within survey spaces

Review of all visible cabling, conduit, and wire runs for unauthorized additions or modifications

3.1.2 Electronic/RF Signal Detection

The Contractor shall employ calibrated electronic detection equipment to conduct a thorough RF signal sweep of all designated areas. This includes:

Non-linear junction detection (NLJD) sweep of walls, furniture, and fixtures

Broadband and narrowband RF signal analysis across relevant frequency spectra

Time Domain Reflectometry (TDR) analysis of telephone and low-voltage wiring as applicable

Carrier current device analysis of AC power infrastructure within surveyed spaces

Infrared (IR) and optical detection sweeps for covert optical transmitters

Detection and logging of all signals of interest, including frequency, modulation type, and bearing

3.1.3 Acoustic and Physical Security Assessment

The Contractor shall assess each surveyed space for physical and acoustical security vulnerabilities. This includes:

Evaluation of wall, floor, and ceiling construction for sound transmission deficiencies

Assessment of door and window seals, glazing, and acoustic baƯling

Identification of structural pathways for potential audio exploitation (conduits, pipes, HVAC ducts)

Documentation of all identified physical security deficiencies with prioritized corrective action recommendations

3.1.4 Telephone and Communication Infrastructure Inspection

The Contractor shall inspect all telephone systems, voice communication equipment, and low-voltage wiring infrastructure within designated spaces. This includes:

Physical and electronic inspection of telephone instruments and conferencing equipment

Inspection of wall-mounted telephone interface boxes, junction blocks, and patch panels within surveyed spaces

Review for evidence of bridging, recording devices, or unauthorized modifications

3.1.5 Preliminary TEMPEST/Emanations Review

Where applicable and within the agreed scope, the Contractor shall conduct a preliminary assessment of electronic processing equipment within surveyed spaces for potential TEMPEST/emanation vulnerabilities. This review shall identify equipment warranting further formal TEMPEST evaluation and document observations for NASA's Certified TEMPEST Technical Authority (CTTA) review.

3.1.6 Expected Outcomes

Upon completion of the one-time survey service, NASA expects the following outcomes:

Successful detection and identification of any unauthorized surveillance devices within all surveyed areas

A complete written TSCM Survey Report documenting all findings, signals of interest, identified vulnerabilities, and recommended corrective actions

A prioritized list of physical and acoustical security deficiencies with specific, actionable mitigation recommendations

Documentation of the survey methodology, equipment used, and frequency coverage achieved

Verbal out-brief to the NASA LARC Security OƯicer and designated Government representatives upon survey completion

Final written survey report delivered within 10 business days of survey completion

All identified devices or anomalous items turned over to the NASA LARC Security OƯicer and documented in a formal chain-of-custody record

3.2 FACILITIES AND AREAS TO BE EXAMINED

The following table identifies the NASA LARC buildings, room types, and approximate square footage designated for the one-time TSCM survey. All areas are located at NASA LARC, Hampton, Viriginia, unless otherwise noted. The Government will provide the Contractor with a detailed floor plan package and access coordination information at the pre-survey kickoƯ meeting.

Table 1. NASA LARC TSCM Survey — Facilities and Areas Inventory

Item

Building No.

Room/Space Type Approximate Square Footage

Notes

1 A Conference Room/Auditorium

~2400 sq. ft. Includes AV equipment

2 B Administrative OƯice ~12000 sq. ft.

Active workstations present, AV equipment

3 C Administrative OƯice ~600 sq. ft.

Active workstations present, AV equipment

4 D Technical Operations Room

~1600 sq. ft.

High density of electronic equipment

5 E Operations Center ~550 sq. ft.

High density of electronic equipment

6 E Administrative OƯice ~200 sq. ft.

Active workstations present

7 F Administrative OƯice ~425 sq. ft.

Active workstations present

Total Approximate Survey Area: ~18000 square feet

Room Type Definitions (for survey planning purposes):

Room Type Description

Conference Room General-purpose meeting room with AV and/or telephone equipment

Operations Center Room housing mission or network operations with high electronic equipment density

Technical Operations Room

Server rooms, network operations centers, or similar technically dense spaces

Administrative OƯice StaƯ oƯice space; may contain sensitive documents or communications

Access and Coordination Requirements:

The Contractor shall coordinate all facility access with the NASA LARC COR and NASA LARC Security OƯicer (SO) a minimum of [10] business days prior to the scheduled survey date.

Survey activities in classified spaces shall require documented approval from the NASA LARC SO prior to entry. All Contractor personnel entering classified spaces must possess the requisite security clearance and indoctrination.

The Contractor shall not photograph, sketch, or otherwise document room layouts beyond what is required for the TSCM report without prior written COR approval.

Survey scheduling shall be coordinated to minimize operational disruption. After-hours or weekend surveys may be required for certain spaces, to be coordinated with the COR.

3.3 DELIVERABLES

The following deliverables are required under this one-time service SOW:

# Deliverable Title Due Date Delivered To Format

Contractor Visit Authorization Letter

Prior to commencing survey activities

NASA LARC

Security OƯicer

NISPOM and NASA required information

# Deliverable Title Due Date Delivered To Format

2 Survey Execution Plan 5 business days prior to survey start

COR

Contractor-defined, Government-approved

Equipment Calibration Certificates

Day of survey commencement

COR

Contractor-furnished documentation

Verbal Out-Brief / Preliminary Findings

Same day as survey completion

NASA LARC

Security OƯicer / COR

In-person or secure teleconference

TSCM Survey Report (Draft)

Within 5 business days of survey completion

COR

Written report, Contractor-defined format, Government-approved

TSCM Survey Report (Final)

Within 10 business days of survey completion

COR / LARC

Security OƯicer

Written report, classified/marked IAW NASA guidelines

Chain-of-Custody Documentation (if devices/anomalies found)

Concurrent with out-brief

COR / LARC

Security OƯicer

Formal chain-of-custody form

Corrective Action Recommendations Summary

Included in Final Survey Report

COR

Prioritized list with implementation guidance

Report Content Requirements:

The Final TSCM Survey Report shall include, at a minimum:

1. Executive Summary of findings

2. Survey scope, methodology, and equipment inventory (with calibration dates)

3. Frequency coverage log and RF signal analysis results

4. Room-by-room findings, including negative findings (areas found clear)

5. Description and documentation of any anomalous items or devices discovered

6. Physical and acoustical security deficiency findings with photographs (as approved)

7. Prioritized corrective action recommendations

8. Preliminary TEMPEST observations (if applicable)

9. Survey team credentials and certifications

10. Date, time, and duration of survey activities per space

4.0 GENERAL PROVISIONS

Period of Performance: The period of performance for this one-time service contract is estimated as follows:

Pre-Survey Coordination Phase: [45] business days from contract award

Survey Execution Phase: [5] consecutive business days on-site at NASA LARC

Reporting Phase: Within 10 business days following survey completion

Total Estimated Period of Performance: Not to exceed [180] calendar days from contract award

Place of Performance: All survey activities shall be performed at NASA LARC, Hampton, Virginia, in the specific buildings and rooms identified in Section 3.2. Post-survey report preparation may be performed at the Contractor's facility, subject to applicable information security and handling requirements for any sensitive findings.

Non-Personal Services: This is a non-personal services contract. The Contractor's service personnel are not NASA employees, are not subject to NASA supervision in the performance of their technical work, and shall not be placed in any organizational role, position, or supervisory relationship within NASA. The Contractor is responsible for the professional supervision and management of its own service personnel.

No Recurring Obligation: Nothing in this SOW shall be construed to create an obligation for NASA to award any follow-on contract, exercise any options, or engage the Contractor for any services beyond the single survey event described herein.

Government-Furnished Property (GFP) / Government-Furnished Information (GFI):

The Government will provide the following in support of survey execution:

1. Building access and escorted entry access coordination for all survey spaces

2. Facility floor plans and room diagrams for pre-survey planning (marked CUI as applicable)

3. Points of Contact (POCs) for each building/space to facilitate scheduling

4. A Government escort for all survey activities in controlled or classified spaces

5. A designated Government workroom or staging area for Contractor equipment on survey days

The Contractor shall be responsible for all survey equipment, instrumentation, tools, consumables, and materials required to perform the survey service.

Contractor-Furnished Equipment:

The Contractor shall furnish all equipment and instrumentation required to complete the TSCM survey, including but not limited to:

1. Non-linear junction detectors (NLJD)

2. Broadband and narrowband RF spectrum analyzers

3. Time Domain Reflectometry (TDR) equipment

4. Carrier current analyzers

5. Physical search tools (mirrors, fiberscopes, etc.)

6. Infrared and optical detection equipment

7. All supporting documentation and calibration records for survey instruments

All equipment shall be calibrated and in good working order. Calibration certificates shall be available for COR review upon request.

Work Hours: Survey activities shall be coordinated with the COR to minimize disruption to NASA LARC operations. Authorized survey hours are generally between 6:00 AM and 8:00 PM, Monday through Friday, excluding Federal holidays. After-hours or weekend access may be arranged with prior written COR approval for specific spaces that cannot be vacated during normal business hours.

5.0 SECURITY

Security Requirements:

Contractor company must already possess at a minimum a SECRET Facility Clearance Level from the Defense Counterintelligence and Security Agency (DCSA), no Storage Level required.

All Contractor service personnel assigned to perform survey activities under this SOW shall:

1. Possess, at a minimum, an active Secret security clearance adjudicated by a U.S.

Government cognizant security authority, prior to commencing survey activities.

2. Possess a current, valid Interagency Training Center (ITC) TSCM Certification or equivalent federally recognized TSCM certification, demonstrating technical qualification to perform TSCM survey operations.

3. Submit to identity verification and badging procedures as required by NASA LARC Security prior to initial site entry.

4. Comply with all NASA LARC visitor and contractor access control policies.

The Contractor shall provide a list of all proposed survey personnel, including full legal names, dates of birth, employer, current clearance level and granting authority, and ITC certification documentation, to the COR no later than 10 business days prior to the scheduled survey start date. No survey personnel shall be permitted on-site without prior written approval from the NASA LARC COR and Security OƯicer.

Physical Security Requirements:

All Contractor service personnel shall be escorted at all times within NASA LARC controlled or restricted areas by a designated Government escort.

Contractor personnel are prohibited from bringing unauthorized items into NASA LARC facilities, including personal cell phones, cameras, personal recording devices, personal laptop computers, or removable media, except for survey equipment specifically approved by the COR.

All survey equipment brought on-site shall be documented on an equipment manifest, reviewed and approved by the COR and LARC Security OƯicer prior to entry.

Any items of interest, anomalous devices, or potential eavesdropping equipment discovered during the survey shall be immediately reported to the Government escort and the LARC Security OƯicer. No such item shall be removed, altered, deactivated, or photographed without explicit authorization from the LARC Security OƯicer.

Information Security Requirements:

All findings, reports, notes, and working materials generated during the survey that contain sensitive information shall be handled, marked, stored, and transmitted in accordance with applicable NASA security policies and NIST SP 800-171 for CUI.

The Contractor shall not release any information pertaining to survey findings, facility layouts, or security vulnerabilities to any third party without prior written approval from the NASA LARC CO or COR.

The final survey report shall be marked at the appropriate classification or CUI designation as determined by the LARC Security OƯicer.

In accordance with FAR Part 4.7, the Contractor may retain one archival copy of the final survey report, subject to appropriate data safeguarding requirements. All other working materials shall be returned to NASA or destroyed as directed by the COR upon contract completion.

Incident Reporting:

Any discovery of an active eavesdropping device, unauthorized transmitter, or suspected technical surveillance threat shall be immediately reported to the Government escort and LARC Security OƯicer verbally, followed by written notification within 2 hours of discovery.

Any cyber incident or unauthorized access to contract-related information shall be reported to the NASA LARC COR and the NASA Security Operations Center (SOC) within 72 hours of discovery, consistent with applicable NASA cybersecurity reporting requirements.

6.0 TRAVEL AND OTHER DIRECT COSTS (ODCs)

Travel to and from NASA LARC, Hampton, Virginia, in support of the one-time survey service is an anticipated cost under this contract. All travel shall be pre-approved by the COR and reimbursed in accordance with the Federal Travel Regulation (FTR) and FAR 31.205-46.

Authorized travel costs include:

Round-trip transportation to/from NASA LARC for survey personnel

Per diem at applicable Government-approved rates for the duration of the survey, if overnight lodging is required

Ground transportation to/from LARC

Contractors shall not charge the Government for business- or first-class travel. Travel cost estimates shall be included in the Contractor's price proposal. All travel reimbursement claims shall be supported by receipts and submitted with the final invoice.

No OCONUS travel is anticipated under this SOW.

7.0 QUALITY CONTROL

The Contractor shall ensure that all TSCM survey activities are performed by qualified, certified personnel using calibrated, properly maintained equipment consistent with accepted TSCM industry standards and applicable IC/DOD directives.

The Contractor shall perform an internal quality review of the draft TSCM Survey Report prior to submission to the COR to ensure accuracy, completeness, and compliance with the requirements of this SOW.

The COR will evaluate the Contractor's performance against the following quality standards:

Completeness of survey coverage for all designated areas listed in Section 3.2

Timely submission of all deliverables per Section 3.3

Accuracy and clarity of the Survey Report

Professional conduct and compliance with all security requirements during on-site activities

If the Government determines that any deliverable is unsatisfactory or incomplete, the Contractor shall revise and resubmit within 5 business days of written notification, with no additional cost to the Government.

APPENDIX A: FACILITIES SURVEY SCHEDULE

Day Building No.

Room/Space Type Approximate Square Footage

Notes Estimated Hours

1 A Conference Room/Auditorium

~2400 sq. ft.

Includes AV equipment

2-3 B Administrative OƯice ~12000 sq. ft.

Active workstations present, AV equipment

4 C Administrative OƯice ~600 sq. ft.

Active workstations present, AV equipment

4 D Technical Operations Room

~1600 sq. ft.

High density of electronic equipment

5 E Operations Center ~550 sq. ft.

High density of electronic equipment

5 E Administrative OƯice ~200 sq. ft.

Active workstations present

5 F Administrative OƯice ~425 sq. ft.

Active workstations present

Total Estimated Survey Duration: [5] business days

APPENDIX B: REFERENCE DOCUMENTS

NASA Policy Directive (NPD) 1600.2, NASA Security Policy (current version)

NASA Procedural Requirements (NPR) 1600.1, NASA Security Program Procedural Requirements (current version)

Intelligence Community Directive (ICD) 705, Physical and Technical Security Standards for SCIFs

IC Technical Specifications for Construction and Management of SCIFs (IC Tech Spec for ICD/ICS 705), Version 1.5.1

DODI 5240.05, Technical Surveillance Countermeasures (TSCM), 03 April 2014

DODD 5240.02, Counterintelligence (CI), 17 March 2015

National Industrial Security Program Operating Manual (NISPOM), 32 CFR Part 117

Security Executive Agent Directive (SEAD) 3, Reporting Requirements for Personnel with Access to Classified Information

NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations

Federal Acquisition Regulation (FAR) Parts 4, 9, 31, and 52

Federal Travel Regulation (FTR), 41 CFR Chapters 300–304

Executive Order 12333, United States Intelligence Activities, as amended

CNSSI 7000, TEMPEST Countermeasures for Facilities

APPENDIX C: ACRONYMS

Acronym Definition

CDR Contractor Discrepancy Report

CI Counterintelligence

CO Contracting OƯicer

COR Contracting OƯicer's Representative

CTTA Certified TEMPEST Technical Authority

CUI Controlled Unclassified Information

FAR Federal Acquisition Regulation

FTR Federal Travel Regulation

GFE Government-Furnished Equipment

GFI Government-Furnished Information

GFP Government-Furnished Property

IAW In Accordance With

ICD Intelligence Community Directive

ITC Interagency Training Center

LARC Langley Research Center

NASA National Aeronautics and Space Administration

NLJD Non-Linear Junction Detector

NPD NASA Policy Directive

NPR NASA Procedural Requirements

NISPOM National Industrial Security Program Operating Manual

NIST National Institute of Standards and Technology

Acronym Definition

OCI Organizational Conflict of Interest

ODC Other Direct Cost

OPSEC Operational Security

POC Point of Contact

RF Radio Frequency

SEAD Security Executive Agent Directive

SOC Security Operations Center

SOW Statement of Work

TDR Time Domain Reflectometry

TEMPEST

Telecommunications Electronics Material Protected from Emanating Spurious Transmissions

TSCM Technical Surveillance Countermeasures

VTC Video Teleconference