Attachmane 1 NIST Requirements.docx

NIST Requirements Document Optical Frequency Domain Reflectometer

I. Background/Purpose:

The research work of the National Institute of Standards and Technology (NIST) Microsystems and Nanotechnology Division within the Physical Measurement Laboratory (PML),as part of the CHIPS metrology program has a requirement for an optical frequency domain reflectometer to help develop advanced measurement methods and test structures for integrated photonics manufacturing. The need is for a system that covers the telecommunications C and L bands with high spatial resolution and high dynamic range in the analysis of back reflection and transmission signals from photonic integrated circuit components such as resonators, waveguides, couplers, interferometers, and filters. The overall system will be used for spectral measurement of reflection, transmission, and insertion loss.

II. Minimum Requirements

The Contractor shall provide a Firm Fixed Price quotation for an optical frequency domain reflectometer. The optical frequency domain reflectometer must meet or exceed the technical specifications listed below. All items must be new. Used or remanufactured equipment will not be considered for award. Experimental, prototype, or custom items will not be considered. The use of “gray market” components not authorized for sale in the U.S. by the proposer is not acceptable. All line items shall be shipped in the original manufacturer’s packaging and include all original documentation and software, when applicable.

Line Item 0001: Optical Frequency Domain Reflectometer Quantity: 1 Technical Specifications:

1. Wavelength coverage: at least 1520 nm to 1630 nm

2. Measurement modes: both reflection and transmission

3. Laser source: external bench top unit included and satisfying all of the wavelength, power, and linewidth requirements listed above and below

4. System should also have the ability to work with a user-provided laser source that meets the wavelength, power, and linewidth requirements listed above (#1) and below (#5 and #6)

5. Internal laser source linewidth: less than 300 kHz

6. Wavelength accuracy: +/-1.5 pm or better

7. Length measurement modes: provision of three measurement modes, with mode #1 working for a length that is between 1 m and 5 m, mode #2 working for a length that is between 10 m and 20 m, and mode #2 working for a length that is between 40 m and 60 m.

8. Two-point sampling resolution: for the length measurement modes described in #7, the two-point sampling resolution should be 8 micrometers or better for a measurement time of 5 seconds or less. At least two lower resolution measurements (e.g., 16 um, and 32 um) should also be available provided that they come with reduced measurement times.

9. Return loss measurements with a dynamic range of 120 dB or better, resolution of +/-0.2 dB or better, accuracy of +/-0.4 dB or better, and sensitivity of -135 dB or better

10. Insertion loss measurements with a dynamic range of 115 dB or better, resolution of +/-0.2 dB or better, accuracy of +/-0.4 dB or better, and sensitivity of -118 dB or better.

11. Instrument remote control by ethernet or equivalent, with all relevant software control or application programming interface drivers (e.g, via Labview, Python, or Matlab) provided.

12. Overall system must come with at least a 12 month warranty.

III. Deliverables:

Delivery shall be FOB destination and shall occur within 120 days. FOB Destination means: The contractor shall pack and mark the shipment in conformance with carrier requirements, deliver the shipment in good order and condition to the point of delivery specified in the purchase order, be responsible for any loss of and/or damage to the goods occurring before receipt and acceptance of the shipment by the consignee at the delivery point specified in the purchase order; and pay all charges to the specified point of delivery. The contractor shall deliver all Line Items to:

National Institute of Standards and Technology 100 Bureau Drive Gaithersburg, MD 20899-1640

ATTN: TBD

IV. Inspection and Acceptance

In addition to the inspection and acceptance terms articulated in FAR 52.212-4, the Government reserves the right to perform such performance tests and evaluations as defined below to verify specified system performance. Such tests and evaluations, if performed, shall be conducted within the environment that the system is to be operated. The Contractor has the right to be present during the tests and evaluations, if performed, at the Contractor’s expense.

V. Training

No in-person training is required. The vendor will provide any relevant videos, operating manuals, and other materials needed to use the equipment.

VI. Warranty

The contractor shall warrant the system and provide support for a minimum of one year and shall be in accordance with terms in FAR 52.212-4.

VII. Payment Schedule

The Contractor shall be paid, in accordance with Net 30-day payment terms, upon receipt and acceptance of a proper invoice, in accordance with the following schedule:

1. 100% after receipt, installation, and acceptance by the Technical Point to Contact (TPOC) of fully delivered equipment

2. The Government anticipates inspection will occur within two weeks of equipment delivery.

NOTE: Partial shipments and partial invoices will not be accepted, unless otherwise requested and accepted by the Contracting Officer prior to award offer. Proposed payment schedules shall be submitted with vendor’s response to the RFQ for consideration.

VIII. Cybersecurity Privacy Requirements

NIST seeks a solution that provides security and privacy protection consistent with requirements defined by applicable federal laws, regulations, policies, and standards (e.g., the Federal Information Security Management Act (FISMA), OMB Circular A-130, and FIPS Publication 200). The solution provider (including subcontractors) may meet these requirements through various means, including but not limited to FedRAMP authorization, current third-party assessments (e.g., SSAE, PCI), and/or responses to NIST special publication control set SP 800-171.

Minimally Acceptable Controls

· System security plan describing physical, technical, and administrative controls implemented to protect systems and sensitive personally identifiable information (SPII).

· IT management processes to establish and manage secure configuration baselines including routine patching for all operating systems and applications.

· Access to SPII is restricted to those with a need to know. Personnel with access to SPII have background investigations performed (e.g. criminal, financial etc.), and are trained on secure handling of SPII.

· Access Controls for SPII meet or exceed industry best practices for access and identification control including, but not limited to, connectivity to servers and databases, multi-factor authentication for remote accesses for administration, secure configurations for any devices accessing the system, and strong physical security for any place where the data is accessed.

· The solution supports multifactor authentication for users and/or supports integration with customer federation services for Single-Sign capability.

· Processes for scanning on a continual basis for vulnerabilities and proper configurations for all aspects of the system, as well as processes for timely mitigation of findings.

· Auditing and Incident Response processes including customer notification of suspected or actual incidents and logging with sufficient information to perform forensics on any incident. Processes for notifying and providing appropriate mitigations, including but not limited to credit monitoring services, for subsidy applicants in the event of suspected or actual incidents.

· SPII is encrypted in transit using TLS 1.2 or better and encrypted at rest in all places the SPII is stored. All encryption algorithms and modules are FIPS 140-2/140-3 validated.

If unable to meet any of the requirements listed above, the solution provider may provide details of mitigations or alternative protections in place to ensure the appropriate handling and protection of SPII.

If the solution provider provides services to other Federal agencies, provide a general description of the security risk management approach and client point of contact.