Applanix IDIQ PWS NCNJ10002000546 (1).pdf

Indefinite Delivery / Indefinite Quantity (ID/IQ) Contract

Between NOAA and Applanix, Inc.

for

Software and Hardware Associated with Hydrographic Surveying, Airborne Mapping and Global Positioning of Marine Vessels and Aircraft

Requisition Number: NCNJ1000-20-00546

1. Background

National Oceanic and Atmospheric Administration (NOAA) program offices rely on Applanix cameras, equipment, sensors and software to assist in accomplishing NOAA’s overall mission of hydrographic survey and aerial mapping and imaging. NOAA uses the Applanix equipment to observe, map, analyze, and photograph coastlines and other land masses for the purposes of hydrographic surveying, snowpack analysis and other weather-related functions. Applanix equipment and software also assists NOAA in tracking the position of its vessels and aircraft.

This equipment is used in a variety ways, such as being deployed on shipboard studies or by being attached to aircraft. Rigorous use of this equipment during shipboard and airborne studies throughout NOAA causes the equipment to deteriorate and degrade, which can result in less accurate data collection. The instruments require performance assessment, testing, evaluation, repair, re-certification and calibration to maintain the accuracy of the data collected. Consistency in the specifications and methods of the services provided are a major factor in the accuracy of the data collected.

2. Scope of Work

The Contractor shall provide the products and associated services listed within Applanix’s product and price list. Each delivery order placed will specify the items and quantity of equipment and associated services to be purchased from Applanix’s product and price list. If repairs are needed, the delivery order will specify what equipment requires repairs and any upgrades that are needed. Repairs and upgrades shall consist of electronic software/firmware upgrades, hardware upgrades, software/firmware repairs, and physical repairs to existing NOAA Applanix-manufactured or -supported equipment, as well as other Applanix-manufactured or -supported equipment to be integrated into the NOAA inventory.

3. Requirements

The equipment to be provided under this requirement shall be in accordance with Applanix’s product and price list. When purchasing equipment, the equipment shall meet specifications in Applanix’s product manuals. When providing maintenance, repair and/or upgrade services, the procedures followed shall be in accordance with Applanix’s standard operating procedures for maintenance, repair and/or upgrade of equipment.

The equipment in need of repair and/or upgrade will be shipped to the Contractor’s facility at the expense of the Government. The Contractor shall be responsible for repairing and/or upgrading the equipment and the cost of shipping the repaired and/or upgraded equipment to the appropriate NOAA facility from which it originated.

Requisition Number: NCNJ1000-20-00546 Page 2 of 4

For repairs and/or upgrades, the Contractor shall first diagnose the problem(s) and evaluate the requested repairs and/or upgrades. After diagnosis and evaluation, the Contractor shall provide the Contracting Officer’s Representative (COR) with an estimated timeframe for the repair and/or the upgrade to take place and the total cost of the repair and/or upgrade. Upon review and approval by the COR, the appropriate Contracting Officer (CO) will authorize the work for the repair and/or upgrade. The Contractor shall not undertake any repairs and/or upgrades prior to the CO’s authorization.

During this time, Applanix shall also provide loaner equipment for NOAA to use in the interim period while the original equipment is repaired and/or upgraded.

Upon completion of repairs and/or upgrades, the Contractor shall perform inspection and acceptance testing on the equipment to ensure that the repair and/or upgrade was successful. The Contractor shall provide the following documentation with the return of each piece of equipment:

• Detailed description of the repair and/or upgrade that was performed;

• List of parts that were replaced;

• Data sheet documenting the results of the inspection and acceptance tests that were performed.

4. Period of Performance

Base Period: September 1, 2020, through August 31, 2021 Option Period One: September 1, 2021, through August 31, 2022 Option Period Two: September 1, 2022, through August 31, 2023 Option Period Three: September 1, 2023, through August 31, 2024 Option Period Four: September 1, 2024, through August 31, 2025

5. Government Points of Contact

Technical Task Leads:

Jamie Kum 1315 East West Highway N/NGS32, Room 8138 Silver Spring, MD 20910 Phone: (240) 533-9573 Email: jamie.kum@noaa.gov

Eric Younkin 1315 East West Highway N/CS11, Room 6604 Silver Spring, MD 20910 Phone: (240) 847-8208 Email: eric.g.younkin@noaa.gov

Contracting Officer’s Representative (COR):

Teresa Fleisher 1315 East West Highway N/CS1, Room 6708 Silver Spring, MD 20910 Phone: 240-847-8252 Email: Teresa.Fleisher@noaa.gov

Requisition Number: NCNJ1000-20-00546 Page 3 of 4

6. Statement of IT Security Requirements

The base IDIQ contract is awarded without acquiring any information technology and/ or service(s), but serves as a vehicle to order acquiring information technology and/or service(s); therefore will not be using either government owned systems or contractor owned systems.

a) For this base IDIQ, the Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

b) For this base IDIQ, the Contractor shall not access any Furnished Equipment (GFE) or access Government IT systems for this effort.

c) For this base IDIQ, the Contractor shall not access any Government Furnished Information (GFI) that is not within the public domain for this effort.

d) For this base IDIQ, the Contractor shall comply with the DOC IT Security Baseline Policy (ITSBP) and Commerce Information Technology Requirements (CITRs) (available at:

https://connection.commerce.gov/policy/20140528/it-security-program-policy-and-commerce-information-technology-requirements). DOC issues Commerce Information Technology Requirements (CITRs) and policy memorandums as policy enhancements and carries the same authority as the DOC ITSBP. The Contractor shall comply with the NOAA IT Security Manual [NOAA policy] (available at:

https://www.csp.noaa.gov/policies/manual/212-1301-V6-0_02-05-2019.pdf). The DOC and NOAA policies identified above are sensitive documents and will be provide after contract award.

Each task order shall include its own statement of work or equivalent and the required Information Security in Acquisitions Checklists. All task orders will also require an IT Security review and assessment to determine what IT Security requirements are applicable.

Minimal security clauses for all task orders:

The Assessment and Authentication (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The contractor will not have access to any government owned equipment or be furnished government privileged information. The subscription is to Satellite positioning which will be capture and processed through GNSS receiver equipment or other navigation equipment. Government information is NOT uploaded or stored to vendor site. All required information is downloaded to government owned resources utilized software licenses. The contractor will only supply software and/or product license. The contractor will not access, store, process or transmit any government privileged information. The contractor will not have access to any non-public government systems or networks.

The Contractor shall include the necessary product support and supporting documentation that allows the sanitization for the acquiring Information Technology and/or service(s) upon the disposal of the product. The Contractor shall use one of the methods for secure destruction of unclassified but sensitive information recommended by either NIST Special Publications 800-88 Guidelines for Media Sanitization (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) or the

Requisition Number: NCNJ1000-20-00546 Page 4 of 4

National Security Agency in the Media Destruction Guidance (https://www.nsa.gov/resources/everyone/media-destruction/).

The Contractor shall ensure the acquiring information technology or service(s) are engineered for trustworthy and security and shall be maintain throughout the lifecycle of this contract following the engineering-based trustworthy secure solutions as outlined in NIST Special Publication 800-160 Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1.pdf).

The Contractor shall provide all supporting documentation or a reference to obtain the necessary material, which describes the security capabilities, the design and development processes and the testing and evaluation procedures used by the acquiring information technology or service(s). The Contractor shall provide all supporting documentation or a reference to obtain the necessary material, which describes all information technology or service(s) updates and enhancements when implemented. The information technology or service(s) supporting documentation examples include, but not limited to the user guide, system administrator guides and/or hardening guide. The Contractor shall provide document(s) or a reference to obtain the information that describes the functional properties of the security controls employed to permit the analysis and testing of the security controls for the acquiring information technology or service(s).

The Contractor shall provide sufficient document demonstrating the acquiring information technology or service(s) provided complies with the following:

a) The standard installation, operation, maintenance, updates and/or patching of software shall not alter the common secure configuration settings (e.g., USGCB and/or other secure baseline),

b) Applications designed for normal end users shall run in the standard user context without requiring elevated system administration privileges.