A_PWS.pdf

PERFORMANCE WORK STATEMENT

Mapping and Cartographic Services, Electronic Navigation Products

U.S. Department of Commerce National Oceanic & Atmospheric Administration

Office of Coast Survey Marine Chart Division

1. Program Goals and Objectives

The Marine Chart Division (MCD) of the Office of Coast Survey (OCS), National Ocean Service (NOS), National Oceanic & Atmospheric Administration (NOAA), a bureau of the U.S. Department of Commerce, maintains a Nautical Chart System (NCS) that underpins production of NOAA nautical charts, which are tools for safe, efficient and environmentally sound navigation in U.S. waters. Our mission is to provide up to date charts and chart products for use in the maritime transportation system that moves over two thirds of all consumer goods purchased in the United States.

MCD’s current NCS consists of two production systems that maintain and generate nautical chart products for commercial and recreational mariners. The Nautical Chart System I (NCS I), is a raster-based chart system and the Nautical Chart System II (NCS II), is an electronic based chart system which is used to create all of MCD’s products and maintain MCD’s suite of approximately 2250 Electronic Navigation Charts (ENCs). This Performance Work Statement (PWS) covers activities related to the NCS II System products and deliverables. The Nautical Chart System I, used to produce the paper nautical charts, is currently being phased out and is not a requirement of this

PWS.

Updated ENCs generated from the NCS II Systems serve commercial and recreational mariners, coastal resources managers, the scientific community, other NOAA programs and U.S. Government agencies, including the U.S.

Coast Guard, U.S. Navy, National Geospatial Intelligence Agency, and non-governmental organizations, including the American Pilots Association and US Power Squadron.

The NCS II programs conform to special work instructions, guidelines, Standard Operating Procedure (SOPs), Task Assistant Manager (TAM) documentation, specifications and standards contained in the MCD Nautical Chart Manual (NCM), Chart 1 Nautical Chart Symbols, Abbreviations, and Terms publication, MCD websites and Digital Geo-referenced document source Registry database (DREG). ENC products conforms to the International Hydrographic Organization Standard S-57, Transfer Standard for Digital Hydrographic Data, Edition 3.0 including Appendix B.1, the ENC production specifications and the most current version of Appendix B.1, Annex A, Use of the Object Catalog for ENC. ENC products must also pass quality assurance standards by conforming to S-58 validation checks performed using sevenC’s and dKart software. S-101 validation checks also will be required when S-101 becomes the international standard.

2. Activities and Results

NCS II

NCS II production will occur partially on-site, mostly off-site. The NCS II production line consists ENCs and ENC derived products. ENCs are vector data sets that support all types of marine navigation. Originally designed for large commercial vessels using a sophisticated navigational computer called an Electronic Chart Display and Information System (ECDIS), ENCs are now also being used on simpler electronic chart systems and “chart plotters” on many types of ships and recreational boats. NOAA ENCs help provide real-time ship positioning, as well as collision and grounding avoidance. NOAA ENCs comply with the International Hydrographic Organization ENC Product Specification. ENCs are produced around the world by many different national hydrographic or charting agencies.

NOAA maintains more than 2,250 NOAA ENC datasets over U.S. coastal waters and the Great Lakes.

Background Knowledge

ENCs are updated through compilation of source materials upon the ENC dataset, using ESRI ArcMap software.

Compilations are additions, deletions and revisions to chart features and attribution derived from source data, applied to the ENC, and synched back into the Network Information Service (NIS) database. The NIS is a seamless Oracle database of all ENC vector data. Source data is the information that MCD receives on a daily basis, which is analyzed and applied to the charting products. Source data providers are diverse and data is received in multiple and varied formats. The NCS II System is used in the maintenance of NOAA’s current suite of ENCs and ENC products such as the ENC Online Viewer, ECDIS Display Service, Nautical Chart Display Service, and ENC Direct to Geographic Information Systems (GIS). The ENC Online Viewer is a seamless display of all NOAA electronic navigational charts using ECDIS symbology. ENC Direct to GIS allows users to display, query, and download all available base editions of NOAA ENC data in a variety of GIS/Computer-Aided Design (CAD) formats, using web mapping service technology.

Vector products - multiple formats

- ENCs distributed electronically

- ENC Direct to GIS

- ENC Online

- ENC Re-gridding/Re-scheming and Product Library Creation

- ENC Topography/Roads

The ArcGIS Maritime Solution software, developed by ESRI for Hydrographic and Cartographic Office users, is used to produce ENCs for MCD. MCD has loaded all ENC data into a single, seamless, NIS Database solution, the NCS II and validated the data against International Hydrographic Organization (IHO) standards using sevenCs and dKart software. ENCs are downloadable online in various GIS/CAD formats and viewable through the ENC Online website.

The NCS II system currently consists of two distinct components, the first is the NIS and the second, the Product Library (PLIB). The NIS is the repository for all Maritime feature data stored in vector format. This repository allows all vector and raster production from a single database solution. The PLIB is a complete library of products created by the NCS II system. Each product definition contains all of the metadata necessary to produce the product, either ENC or raster, including the product footprint. ENC products are generated directly from the NCS II system by combining the PLIB product definition with the NIS Vector data for that product area. Changes to the vector data in the NIS are periodically replicated (pushed) down to the product database. Once the data is replicated, a new or updated product is produced from the system.

Activity 1 - Creation and Maintenance of ArcGIS based vector files for Electronic Navigational Chart cells in the NIS database through application of source data

NCS II services are required to supplement the MCD nautical charting program existing staff and processes for continual maintenance of the ENC chart suite within the NIS. ENC maintenance will be achieved through source application and compilation to edit versions pulled from the NIS. All applications and compilation must conform the Nautical Chart Manual, IHO S-57 standards and acceptable cartographic practices.

The Contractor shall provide all services necessary to receive, perform compilation maintenance, quality assure and return deliverables for NCS II activities. Main task as follows:

A. Maintenance of ArcGIS based vector files for Electronic Navigational Chart cells in the NIS database through application/compilation of source data

Contractors will provide program support to the MCD’s NIS sufficient to update and maintain ENC source data.

This includes all services necessary to analyze, review, and process source data into the ENC cells in the NIS database according to the NCM and acceptable cartographic practices. ArcGIS Maritime Solution software, developed by ESRI for Hydrographic and Cartographic Office users, produce and maintain MCD’s suite of ENCs.

Replication of individual feature objects in the seamless database into product geo-databases using the Product Library is a key function. This system receives and processes source data from various private and Government agencies to build nautical products needed by the maritime community to support safe navigation, for ENC’s, as well as producing weekly Critical chart updates.

NCS II Source Data

Source data consists of, but are not limited to the following:

Blue Prints (BPs) – Consisting of various formats in analog or digital form from various private or Government agencies and providing data for various types of surveys which may include but are not limited to U.S. Army Corps of Engineers (USACE) channel surveys, private agency drawings for bridges, overhead and submerged pipelines and cables, wharfs, piers, harbor facilities, etc.

Letters (Ls) – Consisting of various formats in analog or digital form from various private or Government agencies (Internal and External) and providing data for various types of land and water information. Letters are typically associated and referenced to other types of data which include but are not limited to, Blue Prints, Letters, Field Exams, Geographic Cells, Hydrographic surveys, and Chart Forwards. Letters typically contain the metadata and analog data to be used in reference and conjunction to other source data for proper compilation. Letter information may include, but not be limited to the following:

USACE Channel Condition Reports (CCRs) and tabulations, authorization of new charts or chart cancellations, MCD chart policy letters, USACE anchorages and basins, overhead and submerged cables and pipelines, bridges, wrecks, boundaries and limit lines, tides, chart forwards, channel legends, platforms, shoals, rocks, obstructions, wrecks, tanks, towers, stacks, buildings, geographic names, fish havens, aquaculture, landmarks, etc.

Digital Data (DDs) – Consisting of various digital formats from various private or Government agencies (Internal and External) and providing data for various types of land and water information. DDs are typically associated and referenced to other types of data which include but are not limited to, Blue Prints, Letters, Field Exams, Geographic Cells, Hydrographic surveys, and Chart Forwards. DDs contain the digital form of the data to be ingested into Bentley Map composite files or the NIS.

Field Exam (FEs) – Consisting of various formats of analog and digital data from various private or Government agencies and providing data for Hydrographic surveys of limited scope. FEs are investigations of specific features, such as obstructions, rocks, and wrecks, or basic hydrographic surveys of limited extent.

Hydrographic Survey (Hs) - Consisting of various formats of analog and digital data from various private or Government agencies and providing data for hydrographic conditions. A Hydrographic Survey is a complete and thorough survey of the seafloor. For charting purposes, a Hydrographic survey must be adequate to supersede all prior surveys of the same area. A Hydrographic survey verifies or disproves the existence of all charted or reported features of significance. Hydrographic surveys will be delivered to MCD via the The National Bathymetric Source (NBS) project. The NBS creates and maintains high-resolution bathymetry composed of the best available data. This project enables the creation of next-generation nautical charts while also providing support for modeling, industry, science, regulation, and public curiosity. Primary sources of bathymetry include NOAA and U.S. Army Corps of Engineers hydrographic surveys and topographic bathymetric (topo-bathy) lidar (light detection and ranging) data.

Data submitted through the NOAA Office of Coast Survey’s external source data process are also included, with gaps in deep water filled through Global Multi-Resolution Topography, a merged model of bathymetry. Different vertical datums and file formats are made available to meet various uses. The BlueTopo folder includes multilayer floating point GeoTIFFs with associated Raster Attribute Tables (RAT) containing elevation, vertical uncertainty, with other quality metrics and source information. These files are arranged in a tiling, naming, and resolution scheme corresponding to the Electronic Navigational Chart (ENC) but are not for navigation due to the inclusion of additional non-navigation data and non-navigation vertical datums.

W Survey (Ws) - Consisting of various formats of analog and digital data from various private or

Government agencies and providing data for hydrographic conditions. W surveys are outside source surveys that have not been acquired under an official Hydrographic Surveys Division (HSD) project and may be evaluated for use in nautical charting.

Geographic Cell (GCs) - Consisting of various formats of analog and digital data from various private or Government agencies and providing data for topography, including but not limited to, shoreline, low water line, land-water interfaces, man-made features, etc. GCs may also consist of near shore Topo-bathymetry.

Topobathymetric data (“topobathy”) are a merging and rendering of both topography (land elevation) and bathymetry (water depth) to provide a single product useful for nearshore mapping and a variety of other applications.

Re-gridding and Re-Scheming ENC cells (RGRS) – Consisting of ENC cells. Re-schemed and Re-gridded ENC’s may first need to be created as new instances of ENC products within the NIS Product Library (PLIB). Each new instance will contain all the correct metadata and have the correct footprint for the cell. Cells are created within the Product Library database using the following steps:

Select a single Area of Interest (AOI), provided by the Government, in the exact footprint required for the new ENC instance and copy it into the Product Library ENC AOI database.

Modify the metadata of the newly created cell to accurately reflect the ENC’s name, scale, datum, and other attributes.

Utilize the New Nautical Product Wizard in the Product Library to create a new cell within the correct Coast Guard District.

Continue to update the metadata of the cell to reflect the correct agencies, datums, units, and S-57 product name definitions. After the Product Libraries have been created, the next step is to extract the Area Of Interest (AOI) from the NIS to a disconnected file geodatabase. Rescale the extracted data to the desired compilation scale. Clip overlapping data to cell boundaries, retaining the largest scale data wherever possible. Merge all like features that intersect at new cell boundaries. Generalize shoreline, rivers, detached features to vertex spec of compilation scale. Create new text note files for the reschemed cells. Submit histories for newly compiled rescheme cells upon delivery. New re-gridded and re-schemed cells will be created through source Letters from the Nautical Data Branch (NDB) with all relevant geographic information, shapefiles, specification sheet of the new ENC’s requested, as well as a graphic representation of the requested new cells. The number of requested new cells can vary from single digit to double digits.

The average time for compilation is 10 hours per ENC cell.

Topography and Roads (T&R) – Consisting of copied ENC cell(s) geodatabases loaded with topographic and road data in order to preserve the original ENC’s for reference. Delete excess ROADWY/RAILWY features, be mindful of the reference scale, the appearance of the road network should be a very generalized grid intended to only show roads that would be visible and relevant for use in navigation. Apply the BUAARE to reflect the revised ROADWY network. Adjust LNDELV contours to the BUAARE boundary and smooth out as necessary. Also avoid small gaps where a contour is missing a section because of BUAARE-either expand to cover it (delete contour) or reduce BUAARE (preserve contour). Edge match adjacent ENC assigned cells for all features (ROADWY, RAILWY, LNDELV). Export each cell, with no warnings or errors introduced for the source features edited. For identifying duplicate vertices, use ENC Analyzer rather than the duplicate vertex check in data reviewer. Compilation of Roads and Topography are delivered as ENC’s and average about 145 hours of compilation time per ENC. These times will vary buy scale and data density.

NCS II Activities:

The Contractor shall prepare a management plan describing the performance and management of this work, including use of personnel, resources, and technology to be furnished in the performance of NCS II activities. The plan shall address workload expansion, high personnel turnover, labor categories and rates, and absenteeism. Adequate experienced personnel are required at all times in all areas. The plan shall address changes in charting policy, technology, software, and equipment that will occur during the life of this contract. The plan shall address personnel training on existing MCD software and changes in technology, software and equipment during the life of this contract.

In addition, the plan shall address workload expansion, mitigation for instances of high personnel turnover and labor categories and rates. Adequate experienced personnel are required at all times in all areas.

3. Key Personnel

A quantity of two (2) GIS Analyst Level IV personnel are required. The GIS Analyst Level IV labor category is considered Key Personnel. The duties, responsibilities, minimum experience and education are listed below.

Duties/Responsibilities:

The GIS Analyst Level IV works independently and provides technical assistance and guidance on GIS issues and statistical techniques, solve and provide assistance to others on GIS task oriented problems with only a general description of the desired end product, be responsible for all database requirement models, and details within development task, conduct technical reviews of other GIS analyst work when necessary to solve problems or improve functionality, write papers, develop procedure documentation, develop presentation materials, present projects results to small and large groups, and provide training to others in the use and application of GIS for real world applications. The position will be required to have advanced knowledge of GIS, raster, vector and statistical techniques for analyses, demonstrated ability to solve natural resource related problems with ESRI ARC software products, SDE and/or ArcServer, and will also have knowledge and use of statistical software packages such as S- Plus, R, and ArcGIS.

Minimum Experience/Training:

Three (3) years' experience in the application of GIS and statistical techniques to the analysis of natural resource issues.

Minimum Education:

Bachelor’s Degree or four (4) to five (5) years' experience in the application of GIS and statistical techniques to the analysis of natural resource issues.

A Master’s Degree or PhD in Natural Resources, Natural Sciences, Landscape Architecture, GIS or related field preferred or three (3) years' experience in the application of GIS and statistical techniques to the analysis of natural resource issues.

4. Deliverables

Activity 1 - NCS II - Maintenance of ArcGIS based vector files for Electronic Navigational Chart cells in the NIS database through application of source data

Deliverables - Updated FGDBs of Checkout Replicas or Edit

Versions extracted from the NIS for each chart panel of each type of source application or combination of source applications listed below

Delivery Date Deliver to Reference

Blue Prints Within 10 days of assignment or within established delivery schedule COR Section 2

Letters Within 10 days of assignment or within established delivery schedule COR Section 2

Digital Data Within 10 days of assignment or within established delivery schedule COR Section 2

Field Exam Within 10 days of assignment or within established delivery schedule COR Section 2

Geographic Cell Within 10 days of assignment or within established delivery schedule COR Section 2

Hydrographic Survey Within 10 days of assignment or within established delivery schedule COR Section 2

W Surveys Within 10 days of assignment or within established delivery schedule COR Section 2

Re-gridded and Re-schemed ENC’s and Product Libraries

Within 10 days of assignment or within established delivery schedule COR Section 2

Roads and Topography compiled to ENC’s

Within 10 days of assignment or within established delivery schedule COR Section 2

5. Service Quality and Performance Standards

All services shall be provided at a level of quality that consistently meets the requirements set forth herein. Any and all interaction with the public must be coordinated and approved by the COR. Under no circumstance may the contractor disseminate information from or about the office, or otherwise cause information to be published that has not been previously approved in writing for dissemination by the COR. The contractor shall not present itself in any way as a representative of the office or the Government. The performance standards associated with the areas of responsibility are included in the description below and the following publications:

A. Quality

Publication Location

NOS/OCS/MCD Nautical Chart Manuals Charting Policy https://sites.google.com/noaa.gov/nos-ocs-mcd-csg/nautical-chart-manual?authuser=0

Chart 1 Nautical Chart Symbols, Abbreviations, and Terms publication https://nauticalcharts.noaa.gov/publications/docs/us-chart-1/ChartNo1.pdf

International Hydrographic Organization Standard S-57, Transfer Standard for Digital Hydrographic Data, Edition 3.1 including Appendix B.1 https://iho.int/uploads/user/pubs/standards/s- 57/31Main.pdf

B. Performance Standards

NCS II

The Government may also have time-sensitive critical source document application that will need to be applied sooner than the stated 20 business days. In such cases, the Government will notify the contractor that the time-sensitive source document application is required to be completed and submitted in two (2) business days. The Government anticipates approximately 30 time sensitive critical source document applications per year.

All source delivery dates will be established and be managed by the Digital Geo-Referenced Source Registry databases (DREG). All source document application errors, returns, due date change requests, and any delays in submitting source document applications for review will be tracked by the Government on a monthly basis through the use of DREG. DREG will be used in conjunction with monthly progress reports to monitor and assess contract performance.

Errors to contractor NCS II source document application

The criteria the Government will use to define errors in contractor edits, source applications are as follows:

Unacceptable due to critical correction errors; unacceptable due to non-critical correction errors; unacceptable due to both critical and non-critical correction errors. A critical correction error will be defined in three ways:

A. The contractor submits a source document application and does not write a Notice to Mariner report and the Government identifies that a Notice to Mariner report should have been generated by the contractor.

B. The contractor submits a source document application, which required a Notice to Mariner report and the Government identifies an error with the Notice to Mariner report generated by the contractor.

C. The Government identifies a critical error in the contractor source document application that requires a Notice to Mariner report to be generated if the chart were to be published.

The Contractor shall have two (2) business days to correct all source document application errors called for by the Government. If the contractor feels the corrections called for by the Government will take longer than two (2) days because of difficulty or the amount of corrections precludes the source application from being completed within the two-day standard timeframe, the contractor shall forward an extension request to the Government for approval through the use of the DREG.

6. Monthly Progress Report

Each invoice shall be accompanied by a progress report that clearly summarizes the following for NCS II activities:

A. Activities and accomplishments during billing period B. Anticipated activities/accomplishments during next 30 days C. An on-going list of deliverables required and submitted (as set forth in this PWS).

Each report shall separately identify each activity and project including performance objectives, accomplishments, and costs incurred during the reporting period. The report may include additional information, including findings and recommendations that would assist the Government in evaluating progress under this contract.

Methodology the Government will use to apply the above criteria to the monthly invoices

All edits, source document applications will be reviewed to determine adherence to the standards listed herein. The contractor shall be required to comply with these standards and specifications for submitted to MCD for review.

NCS II source applications:

The contractor is responsible for identifying any NCS II system source applications that have inconsistencies/problems or any unresolved conflicts not covered by the Nautical Chart Manual, Chart 1, or any references listed in section 3. When a contractor identifies an error or inconsistency in the shape-file or source application, they are required to notify the MCD or Government designated Point of Contact (POC) for clarification within five (5) business days. The MCD reviewer or POC may in turn forward this issue to the Quality Assurance Standards and Plans Branch where a decision will be reached. The edits will be put on hold until further documentation is generated to address the issue identified by the contractor.

The Government will provide the contractor documentation citing the reasons for any correction errors called for in the contractor’s edits and source document applications by way of reference to the relevant nautical charting standards.

The Government will review all source applications submitted by the contractor, which require critical corrections within 15 business days. The Government will review all source applications submitted by the contractor which do not require critical corrections (non-critical) within 20 business days, unless the size and/or difficulty requires a non-standard amount of time for review such as some geographic cells and hydrographic survey edits.

All source document application errors returned to the contractor for corrections as well as any delays in submitting source document application for review will be tracked by the Government on a monthly basis and feedback will be provided to the contractor.

7. Government Supplied Space / Supplies / Property

The Government will provide limited onsite work space with assigned workstations with access to laptop docking stations and monitors, standard office supplies and equipment. Access to Government network and information will follow NOAA security policy for CAC card and 2-factor authentication using Government furnished and maintained laptop computers.

8. Work Location and Hours of Operation

Work Location/Remote Work Remote work is permitted under this contract. However, at the discretion and direction of the COR, contractor employees may be required to be on-site during an otherwise regularly scheduled remote day, should circumstances require their physical presence. Although contractor employees will predominately be working remotely, the individuals’ remote work location must be within a reasonable commuting distance from the OCS Headquarters office in Silver Spring, MD.

The on-site work location is the OCS Headquarters, 1315 East West Highway, Silver Spring, MD 20910. The contractor is expected to maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed.

Hours of Operation For informational purposes, the normal hours of operation for the Government facilities are 8:30 am EST and 4:30 pm EST, Monday through Friday (except Federal holidays). At the COR’s discretion, there may be occasions when Contractor employees may work other than normal business hours, including weekends and holidays, to fulfill requirements under this PWS.

The Government recognizes the following federal holidays: New Year's Day, Birthday of Martin Luther King, Jr., Washington's Birthday, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day. When any such day falls on a Saturday, the preceding Friday is observed as a federal holiday. When any such day falls on a Sunday, the following Monday is observed as a federal holiday. In addition to the days designated as holidays, the Government observes the following days: any other day designated by Federal Statute, any other day designated by Executive Order, or any other day designated by a President's Proclamation.

9. Security

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The Contractor shall comply with the following DOC Department Administrative Orders (DAO): DAO 200-0 Department of Commerce Handbooks and Manuals and DAO 207-1 Security Programs (available at:

https://www.osec.doc.gov/opog/dmp/daos.html). The Contractor shall comply with the following DOC Department Organization Orders (DOOs) DOO 15-23 Chief Information Officer (available at:

https://www.osec.doc.gov/opog/dmp/doos.html). The Contractor shall comply with the NOAA Administrative Orders (NAO) NAO 212-13 NOAA Information Technology Security Policy and NAO 212-15 Management of Environmental Data and Information (available at: https://www.noaa.gov/organization/administration/noaa-administrative-orders). DOC issues policies under DAO 200-0, DAO 207-1 and DOO 15-23. NOAA issues cybersecurity policies under NAO 212-13. The DAO, DOO, NAO and corresponding policies are sensitive controlled unclassified information (CUI) documents that shall be limited to use only on Government Furnished Equipment and will be provide after contract award.

It is a mandatory requirement for every NOAA IT user (e.g., government employee, contractor, associate, or temporary personnel) to complete the NOAA Cyber Security and Privacy Awareness Training course every year.

Temporary personnel include visitors, guest workers, etc. who plan to work at a NOAA site, access NOAA information and/or use NOAA IT resources. Both new and temporary employees must take the course within three days after initial issuance of NOAA IT equipment and annually thereafter.

Government Furnished Equipment The government will provide the necessary computer equipment and information to perform this contract. All work in the performance of this contract must be performed upon government furnished equipment (GFE) and if additional hardware and/or software is/are needed, the contractor must request the additional requirements from the Contracting Officer Representative (COR). The Contractor is responsible to ensure GFE has the appropriate assigned Internet Protocol (IP) Address at all time. The Contractor may be changing some of the GFE to static IP Address and must ensure the GFE has internet access or network access.

GFE will include but is not limited to a workstation and, if the position warrants it, additional GFE may be issued.

The Contractor will also be provided software and other material, access to documentation, systems, and information needed for the performance of the work. This section also applies to computer and land-line telephone equipment used to perform or support on-site activities.

Contractor staff needing to perform work off-site using GFE shall sign all appropriate agreements and follow all appropriate regulations per NOS, NOAA, and DOC policies including NOAA and NOS property regulations. The Contractor shall comply with Help Desk and/or property requests to make the GFE available upon request to meet organizational property requirement and/or to maintain the GFE in accordance with the organizational defined security posture. All users who have been issued a Government furnished client endpoint computing device (e.g.

laptop, cell phone, tablet, etc.) shall be accountable for the confidentiality, integrity and security of that device. The Contractor shall comply with existing and new policies and memorandums specifically covering issued GFE.

The Government has established time frames for addressing configuration management, vulnerability management, vulnerability remediation and inventory reconciliation activities. The Contractor will be notified of any changes to established schedule and shall work with the Help Desk in meeting the schedule changes. The Contractor must connect the GFE to the internet or using Virtual Private Network at least three times per week to receive the configuration management updates and vulnerability management assessments. The current Government established times frames include:

a) Configuration management (normal updates and patching) occurs every Monday and Wednesday night at 10 pm,

b) Vulnerability Management and Remediation (vulnerability scanning and apply missing updates/patches) occurs every Wednesday and Thursday from 9 AM to 3 PM every week for both on site and VPN connected devices. Vulnerability Scanning only occurs when the GFE is directly connected to the NOS network or connected to the Government provided VPN service using Common Access Card authentication. The Government may shorten vulnerability management and remediation requirements for vulnerabilities designated as significant risk.,

c) Inventory reconciliation/management occurs annually between February and March. Ad hoc inventory activities occur if new equipment is issued, lost or stolen.

It is the contractor’s responsibility to ensure Government Furnished desktops and or laptops are scanned, patched, and updated during the specified times mentioned above by keeping the desktop and laptops turned on and connected to the network when the devices are not being used, or by connecting laptops to the VPN or the internet when the devices are being used outside of the office. If an issue arises and require onsite helpdesk support, the contractor shall obtain helpdesk support at the Silver Spring location. Any additional cost incurred with onsite helpdesk support will be reimbursed upon approval with the issuance of a modification to the contract. The associated cost shall be requested and approved in advance by the Contracting Officer’s Representative (COR). The cost request shall include the name of the individual requiring onsite helpdesk support, the reason for onsite helpdesk support, the dates and location of travel if required, and the cost including a breakdown of cost (travel and additional labor hours). The Contractor shall submit GFE software/hardware changes (install/remove/modify) operating system, software or application to the government assigned Help Desk and receive approval of the appropriate change approval process prior any change being made to the GFE software/hardware.

In the alternative, if an issue arises the COR may choose to send replacement equipment instead of requiring the contractor to physically travel to the onsite helpdesk for support. The Government recognizes that said replacement equipment may need to be updated or upgraded with needed software, programs, etc. for the contractor to continue performing and schedules and time shall be addressed at the time an issue occurs. Any additional cost incurred with sending replacement equipment and time to get new equipment up and running will be reimbursed upon approval in advance by the COR. The cost request shall include the name of the individual requiring replacement equipment and time to catch up, dates, and location, and the submission must include a cost breakdown (additional labor hours).

The Contractor shall safeguard GFE assigned for the duration of the contractor unless returned to the Government prior to the end of the contract. Lost, misplaced, or stolen GFE issued to the Contractor through this contract shall be reported to the government assigned Task Manager and government assigned Help Desk within 4 hours of detection. The Contractor shall assist with any security incident report filed related to the loss of the GFE. The

Contractor or contractor staff assigned the GFE can be held accountable to reimburse the Government for cost of the GFE depending on the circumstance that resulted in the GFE loss. The Contractor shall comply with the NOAA Chief Administrative Officer’s Memorandum “What to Do When a Laptop Is Identified as Missing” issued January 27, 2009 and DOC Personally Identifiable Information (PII) and Business Identifiable Information (BII), and Privacy Act Breach Response and Notification Plan issued July 2013. Memorandum and Breach Response and Notification Plan are sensitive documents will be provided upon request after GFE has been provided. The Contractor may be required to participate in completing the above requirements.

User Accounts and Access Privileges Requirements In performance of this contract, the Contractor will need a number of non-privileged user accounts and possibly a limited number of privileged accounts based on the roles being performed. The Government will work with the contractor in determining and issuance of non-privileged and privileged accounts. The Contractor shall use these assigned accounts in the manner they are issued and not to attempt to modify permissions, elevate permissions, install unapproved software, and modify system configurations and/or application configurations without the written permission of the Task Monitor. If the Government detects any suspicious or inappropriate activities by Contractor personnel on the GFE, the Contractor shall provide the requested assistance necessary for an investigation. The Contractor shall abide by the Government’s remedial actions issued/taken to resolve the suspicious or inappropriate actions.

The Contractor shall guarantee strict confidentiality of the information/data when the Government identifies Government Furnished Information/data, controlled unclassified information (CUI) and/or information/data generated during the performance of the task order is of a sensitive nature. Disclosure of the information/data, in whole or in part, by the contractor can only be made after the contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the contract, the contractor shall obtain a written determination from the Contracting Officer. The Contractor shall agree not to publish or otherwise divulge such information in whole or part, in any manner or form, nor to authorize or permit others to do so. The Contractor shall take such reasonable measures as are necessary to restrict access to such information while in the contractor’s possession, to those employees needing such information to perform the work provided herein, e.g., on a “need to know” basis.

The Government may grant the Contractor access to Government operated applications, internal file server(s), Government collaboration tool(s) leveraging Google Workspace (i.e., Sites, Drive, Docs, Sheets, Slides, Forms. etc.)

and/or internal SharePoint portal(s) for storing and collaborating with NOS organizations in the performance of this contract. All information residing in Government operated application(s), file server(s), Government collaboration tool(s) leveraging Google Workspace and SharePoint portal(s) are designated as controlled unclassified information (CUI) and the Contractor shall protect the information at all times.

The Contractor shall ensure all contract deliverables where information technology used to create deliverables and Information Technology and/or service(s) provided to the Government in performance of the contract complies with DOC and NOAA Supply Chain Risk Management requirements.

To the greatest extent possible, the contractor shall scan all electronic information/data/software passed to/from NOAA with multiple commercial malicious software detection and removal products (e.g. anti-virus software, anti-malware, anti-spyware, etc.) prior to use by either entity. To the greatest extent possible, the contractor shall ensure the electronic information, data and/or software provided to the Government is free of known malicious software.

The Contractor shall comply with the DOC Personally Identifiable Information (PII), Business Identifiable Information (PII), and Privacy Act Breach Response and Notification Plan. The Contractor shall contact the government assigned ISSO immediately upon detection and/or notification of a breach of PII and/or BII. The Contractor shall upon request assist the Government when a compromise and/or loss of PII and/or BII. Contractor access to proprietary information is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the Privacy Act, OMB M06-16 (PII) and other pertinent laws and regulations governing the confidentiality of privileged information and Safeguarding Controlled Unclassified Information (CUI) or Sensitive But Unclassified (SBU) or For Official Use Only (FOUO) designated Information. The Contracting Officer may add the following privacy related contract clauses FAR 52.224-1 and FAR 52.224-2 to this contract and applies to both electronic and hardcopy information/data.

The Contractor shall work with the COR prior to sending the deliverables to determine if the information to be transferred requires protection. The Contractor shall protect sensitive information and/or non-public information from unauthorized disclosure and/or modification. The Contractor shall work with the Government assigned Information System Security Officer (ISSO) to determine the applicable sensitive security requirements. If secure transfer is required, the Contract shall ensure no sensitive information is sent using a non-encrypted format. The Contractor shall implement transmission and storage of sensitive information to meet or exceed the National Institute of Standards and Technology (NIST) Federal Information Processing FIPS 140-2 and/or 140-3 Security Requirements for Cryptographic Modules using validated cryptographic module(s). Specifically, the body of the email shall not contain sensitive information unless it is encrypted. The Contractor is permitted to use the DOC approved secure file transfer solution, Kiteworks, for transmitting sensitive email messages and attached files. The Contractor shall encrypt any sensitive information that will be sent electronically (e.g., email), sensitive information includes but not limited to:

a) Personally identifiable information (PII), sensitive PII and/or Business-identifiable information (BII),

b) Non-public information and/or data,

c) Information that requires Government approval prior to release to the public,

d) All information describing the implementation, configuration, settings, etc. (e.g., Information Technology (IT) configuration, IT management, IT security (e.g., security incidents (reporting, handling and mitigation) and security assessment documentation), IT administration, IT architecture, IT network management (e.g., firewall, router, switch management) and/or information obtained while performing privileged access roles),

e) Source code and/or database schema,

f) The vulnerability scanning, secure baselines scanning and/or mitigation results,

g) The secure baseline deviations,

h) Internet Protocol, subnet mask and similar identification,

i) System or component inventory information (hostname, IP address, MAC address, location, operating system, etc.).

The Contractor shall not destroy any information unless specifically authorized by the Contracting Officer Representative/Task Manager. The Contractor upon request of the COR/TM shall use one of the approved methods for secure destruction of unclassified but sensitive information. Approved methods include NIST Special Publications 800-88 Guidelines for Media Sanitization (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) or the National Security Agency in the Media Destruction Guidance (https://www.nsa.gov/resources/everyone/media-destruction/).

The Contractor shall provide a description of how they secure their contractor owned equipment being used for this acquisition. The Contractor shall use the IT Security Questionnaire (titled: Information and Information Systems Security Requirements for Acquisitions) to assist in their response.

a) The Contractor can request assistance from the government assigned Information System Security Officer (ISSO) in describing how they secure their equipment. The IT Security Questionnaire developed following National Institute of Standards and Technology (NIST) Special Publications (SP) 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems and Organizations.

b) The Contractor shall disclose any third-party independent assessments and/or audits conducted on the cloud computing services that make up this acquisition as part of their response.

c) The government shall evaluate the contractor’s response to the questions and determine the potential contractor’s information security risk to the Government. If the Government determines the information security risk to be acceptable, the Authorizing Official will document their acceptance in a risk acceptance memo.

d) If the Contractor is proposing the use of Cloud offerings, the Contractor shall comply with the NOAA Cloud Computing Security Testing, Authorizing and Continuous Monitoring Standard Operating Procedure (SOP) prior to production use of any cloud services, resources and/or offerings. The Contractor shall not use any cloud services until approved NOAA or NOS Authorization to Operate (ATO) or received a NOAA or NOS approved risk acceptance.

DOC ownership rights over data including PII/BII ‘‘Ownership’’ means the sole owner and has all rights to use, modify, reproduce, perform, display, release, or disclose a work in whole or in part, in any manner, and for any purpose whatsoever, and to have or authorize others to do so.

a) The term ‘‘works’’ includes all information and material developed in the performance of contract and submitted deliverables.

b) The Government shall have ownership of all works produced, created, or generated and required to be delivered under this contract.

c) The Government shall have ownership of all Government furnished information provided to the Contract in the performance of this contract.

The Government does not permit the Contractor to store, process or transmit any information provided, obtained or accessed in the performance of this contract in a commercial cloud service. The Contractor is not permitted to use a commercial cloud service(s) to conduct security assessment of Government resources on premise or in a commercial cloud service.

External Cloud services are NOT authorized in support of this contract.

10. Government Designated Point of Contact

The Government’s designated POC for this requirement shall be:

(To be provided at time of award)