Attachment 1 IDIQ PWS.pdf

Office of Projects, Planning, and Analysis (OPPA)

IDIQ

Performance Work Statement for Ground Station as a Service (GSaaS)

OPPA Ground Station as a Service (GSaaS) IDIQ Performance Work Statement

Contents 1 Introduction

Purpose

Background

2 Scope of Work

Primary Service

2.1.1 Space to Ground Communication Service

Ancillary Support Services

2.2.1 Systems Compatibility Assessment Services

2.2.2 Proficiency Test and Demonstration Services

2.2.3 Technical Support and Troubleshooting Services

2.2.4 Unique Implementation and Deployment Services

3 Period of Performance

4 Data Standards and Security

Space to Ground Communication

Physical and Environmental Security

Controlled Unclassified Information

Data Policy

Data Rights

Security Process

Security minimum

5 Reports

1 Introduction

Purpose The National Oceanic and Atmospheric Administration (NOAA) National Environmental Satellite, Data, and Information System (NESDIS), Office of Projects, Planning, and Analysis (OPPA) requires an Indefinite Delivery/Indefinite Quantity (IDIQ) contract for Ground Station as a Service (GSaaS) including site certification, telemetry downlink data services, and satellite commanding data services. This will satisfy NESDIS current requirements for commercial remote telemetry-only downlink for partner missions, Constellation Observing System for Meteorology Ionosphere and Climate-2 (COSMIC-2), Korea Multi- Purpose Satellite–5 (KOMPSAT-5), and PAZ. The GSaaS contract will provide agility for NESDIS to add or reduce ground station service task orders for future NESDIS or partner missions as they are defined.

Background In recent years, NESDIS has been using commercial ground stations to augment in-house and interagency and international partnership resources to lower data latency from our partners’ environmental satellite programs. COSMIC-2 is a joint program with NOAA as the lead US Agency with the National Space Organization (NSPO) in Taiwan. For COSMIC-2, NOAA assembled a world-wide network of ground stations through interagency and international partnerships. Two telemetry-only commercial ground stations augment this network to meet the low latency and regional downlink requirements of the mission. NESDIS also partnered with the Korea Aerospace Research Institute, and with Hisdesat, a government satellite operator in Spain to facilitate use of their science data for world-wide operational environmental forecast. In return for use of science telemetry, NESDIS provides telemetry-only ground services for the KOMPSAT-5 and PAZ satellites respectively to augment partners’ full-service ground stations, providing contact latency to support international weather services’ environmental forecast.

NESDIS anticipates that GSaaS will provide the flexibility to scale Telemetry, Tracking and Command (TT&C) aperture services. The “as a Service” (aaS) model, first formalized in the information technology industry in the sense of “Software as a Service”, is the concept of providing infrastructure, hardware, and/or software preconfigured and owned by the vendor and operated by or made available to customers on a “pay-as-you-go” on-demand basis. For NESDIS, GSaaS offers the benefit of minimizing upfront investment in infrastructure procurement and site construction as well as avoiding operation, maintenance, permitting, and other ownership costs. Under GSaaS, the contractor has the ability to quickly scale ground station services, at no or low risk to NESDIS essential in-house ground service operation; with significantly reduced planning; and without direct ground site capital investment. In addition to direct procurement costs, deployments of traditional satellite-specific ground sites require long-term commitments not only in up-front planning. At the end of satellite life, these purpose-built sites present NESDIS with stranded equipment that may not be compatible with the next satellite mission. GSaaS will permit greater mission agility with lower up-front capital expenditure. These services will augment core NESDIS or partner ground station service capability to decrease data latency or to acquire supplementary environmental data to enhance or extend NOAA capability.

2 Scope of Work

Primary Service

2.1.1 Satellite to Ground Communication Service

The Government will provide the orbit and communications specifications, the number of contacts of each type expected per time period, and details related to scheduling and delivery interfaces.

Government Service Specifications will be called out in each Task Order. Service Specifications may include but is not limited to:

• Satellite Communication Parameters – The Government will specify communications parameters such as frequency, polarization, carrier rate, modulation scheme, data format, and other specifications related to the radio frequency TT&C communications.

• Ground Station Capability Parameters – The Government will specify attributes required of ground station services. Example parameters may be required receive antenna gain over noise temperature (G/T) performance, required transmitter Effective Isotropic Radiated Power (EIRP) capability, system security classification, or other technical requirements for the ground service.

• Ground Station siting requirements – The Government will describe the NESDIS mission goals that drive the geographic location or distribution of ground service sites. Driving requirements may include total mission time coverage, minimization of mission system-wide data latency, or ability of particular service sites to complement mission service sites already established.

• Orbit and Scheduling Parameters and Interface – The Government will describe or specify how scheduling parameters are to be exchanged such as via ad-hoc or routine recurring means, and if automated, what method of automation. Examples might be a formatted email with particular information sent to specific mailing addresses or a known API exercised a number of days, hours or minutes before the intended contact.

• Front-End Processing – The Government will specify any processing of telemetry received by the ground station, or processing of commands prior to transmission to the satellite.

• Ground Communication Parameters – The Government will specify the interface requirements, security protocols, and other specifications related to TT&C communications.

Depending on the mission, NESDIS may require that the contractor interface with NESDIS systems, or NESDIS partner systems.

Contractor Requirements apply based on the detailed specifications in and Contractor response to each Task Order:

• Site Requirement – The Contractor shall propose and operate GSaaS at sites that meet the technical specifications for satellite to ground communications and security, that meet mission geographical requirements, and that have availability to meet the Government’s anticipated tasking schedule.

• Scheduling Requirement – The Contractor shall accept Government service requests according to the scheduling interface agreements in the task order.

• Service Requirement – The Contractor shall meet the technical performance standard that 95% of scheduled contacts are attempted, successfully completed, that the Eb/N0 margin is greater than 3 dB, and that data are delivered to the specified NOAA internet point of presence within 60 seconds of the end of the contact.

• Security Requirement – The Contractor shall provide artifacts that demonstrate that sites and services meet security requirements according to the security frameworks established by the Contractor and approved by the Government.

• Regulatory Requirement – The Contractor shall be solely responsible for local and international regulatory compliance related to occupancy and operation of the service sites and for providing the services from those sites. The contractor shall secure, maintain, and comply with radio frequency licenses for the services provided.

Ancillary Support Services The following describes limited special or non-recurring support services that may be requested. The primary purpose of GSaaS is routine and recurring ground station services as described in section 2.1 above, however certain engineering services are also commonly performed as ancillary services of satellite ground stations in support of the primary satellite to ground communication activity. These services are individually separate and of limited scope and duration. The Government may explicitly define any required ancillary support services in each Task Order. Additionally, the contractor’s technical approach in response to a Task Order request may propose ancillary support services as deemed necessary to support the Task Order. The government will evaluate, and potentially negotiate these services and associated pricing as part of Task Order evaluation and award.

2.2.1 Systems Compatibility Assessment Services

Systems Compatibility Assessment services focus on performing an assessment of the current contractor’s systems and the Government satellite, command, scheduling, and data ingest systems.

These services may include link analysis, orbit analysis, or interface analysis to assess the compatibility of the contractor’s GSaaS to interface with the Government space and ground systems. Example Systems Compatibility Assessment Services may include, but are not limited to spacecraft to ground station link analysis, site to site network connectivity analysis, or assessment of contractor API compatibility with the Government systems. The Contractor shall deliver a written report describing assessment results and description of what Contractor or Government modifications, if any, are necessary to resolve any incompatibility.

2.2.2 Proficiency Test and Demonstration Services

Proficiency Test and Demonstration services address the contractor’s satellite to ground communication capabilities and features that meet the Government requirements. The contractor must demonstrate that their system, site, hardware, software, or other element has or continues to maintain proficiency to provide the necessary services for satellite to ground communication. Example proficiency tests and demonstrations may include but are not limited to measurement of antenna parameters, demonstration of particular service capabilities features or system to system data flow tests, pre-launch spacecraft to ground station compatibility tests, proxy satellite TT&C tests, or schedule API compatibility tests.

Demonstrations may use ground based or on-orbit actual or “proxy” systems, interface “stubs,” or sub-system simulations. The Contractor shall deliver a written report describing proficiency test or demonstration results and description of what Contractor or Government modifications, if any, are necessary to resolve any deficiencies.

2.2.3 Technical Support and Troubleshooting Services

Technical Support and Troubleshooting services address the use of contractor capability, reports, or engineering expertise to help the Government resolve service anomalies related to systems or elements not provided by the contractor. Example Technical Support and Troubleshooting service may include, but are not limited to, measuring received signal strength from the satellite, performing data flow traces, analyzing the sources of frequency interference, or trending analysis. The Contractor shall support technical exchange meetings and shall deliver findings or describe recommendations, if any, to resolve the anomaly.

2.2.4 Unique Implementation and Deployment Services

Unique Implementation and Deployment services address the implementation and deployment of the Government’s unique satellite to ground communication system interfaces. This category of ancillary services includes Contractor activity to improve systems to meet unique, unusual, or non-commercial Government mission needs. Examples of such needs could be, but are not limited to, novel encoding schemes, Government-unique security protocols, or Government-mandated using of technology or equipment that cannot be used for commercial purposes. It also includes Contractor activity to maximize efficiency or Government systems in the use of Contractor services. An example of such need, could be, but is not limited to, supporting or licensing installation of Contractor software on government systems to facilitate use of Contractor services. Deliverables under unique implementation and deployment services depend on the nature of the service. The Contractor shall support technical exchange meetings and shall deliver software or materials, if any, according to the technical approach response to each Task Order that required such service.

3 Period of Performance The base period of performance will be five (5) years from July 1, 2022 to June 30, 2027.

4 Data Standards and Security

Satellite to Ground Communication There are several primary standards organizations laying the foundation for interoperability, including:

• International Telecommunication Union (ITU)

• Consultative Committee for Satellite Data Systems (CCSDS)

• National Institute of Standards and Technology (NIST)

The contractor shall comply with the following standards, as applicable:

Document Number Title

CCSDS 131.0-B-3 TM Synchronization and Channel Coding, Sept 2017

CCSDS 231.0-B-3 TC Synchronization and Channel Coding, Sept 2017

CCSDS 232.0-B-3 TC Space Data Link Protocol, Sept 2015

CCSDS 133.0-B-1 Space Packet Protocol, September 2003 and Corr 2, September 2012

CCSDS 401.0-B-30 Radio Frequency and Modulation Systems, Feb 2020

CCSDS 355.0-B-1 Space Data Link Security Protocol, Sept 2015

CCSDS 732.0-B-3 AOS Space Data Link Protocol, Sept 2015

Document Number Title

NTIA Redbook, 2017 National Telecommunications and Information Administration (NTIA) “Manual of Regulations and Procedures for Federal Radio Frequency Management (Redbook)", September 2017 revision.

NIST Special Publication 800-38A

Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode, Oct 2010

NIST Special Publication 800-38D

Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, Nov 2007

NIST Special Publication 800-53 Revision 5

Security and Privacy Controls for Federal Information Systems and Organizations, including integrating supply chain risk management (SCRM)

NIST FIPS 197 Advanced Encryption Standard (AES), November 26, 2001

NIST FIPS 140-2 Security Requirements for Cryptographic Modules, May 25. 2001

NIST Special Publication 500-267Ar1 Revision 1

NIST IPv6 Profile

NIST Special Publication 800-119

Guidelines for the Secure Deployment of IPv6

NIST Special Publication 800-82 Revision 2

Guide to Industrial Control Systems (ICS) Security

NIST FIPS 200 Minimum Security Requirements for Federal Information and Information Systems

NIST Special Publication 800-161 r1

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

ISO/IEC 27001:2013 Information technology — Security techniques — Information security management systems — Requirements

NIST Special Publication

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Physical and Environmental Security The contractor must maintain a physical and environmental security program that will provide assurance of adequate protections for system integrity and availability. These include site access limitations, site maintenance practices, and environmentally controlled facilities for equipment and personnel.

Controlled Unclassified Information While environmental data is open and may be redistributed, the contractor must control access to controlled unclassified information and other types of sensitive data developed or exchanged in the course of the project. Sensitive data includes, but is not limited to specific system design such as internet addresses and port numbers, security data such as passwords, authenticators or access keys, company proprietary data, sensitive personnel data such as national IDs or employment records, etc.

Data Policy The contractor must adhere to the NESDIS or partner mission data policy. No data received, produced or collected under this PWS may be shared or distributed to any entity other than NOAA NESDIS and the mission unless specific permission is obtained from the COR.

Data Rights The Government has unlimited rights (as defined at FAR 52.227-14) to all data first produced under this contract. All data shall be Government owned and the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. This data may not be used or sold by the Contractor without written permission from the Government Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

At its sole discretion, the Government may offer to transfer its ownership of selected data or software first produced under Task Orders to the Contractor in exchange for the Contractor granting to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license in such copyrighted data or software to use for any purpose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly by or on behalf of the Government.

Security Process As part of NOAA/NESDIS Security Compliance program, suppliers of data need to provide evidence that a Cyber Security Program in in place and active. (i.e. NIST 800-37; ISO/IEC 27001 or other approved standard) The Contractor may need to provide artifacts of yearly independent evaluations, current POAM activity, and/or status of the current Assessment and Authorization (A&A).

Security minimum The Contractor shall ensure, as part of the supplier compliance, that they are capable of the following:

• Use a secure protocol to transport data to NOAA or NOAA designated recipient. This protocol is to be negotiated (i.e. HTTPS, SFTP, FTPS as examples);

• Use a mutually agreed and verifiable certificate for the transport protocol. (i.e. DigiCert, RSA, AWS as examples);

• Data shall have a verifiable Hash associated with each data segment. The hash has to be SHA-1 or stronger with emphasis on a higher level.

5 Reports The contractor is responsible for delivery of Monthly Performance Reports covering the performance for the full month. Reports will provide, as a minimum, the following information:

Objective Standard Inspection, Type and Frequency

Scheduled contacts completed

95% of scheduled contacts successfully completed

Number of passes scheduled, number of contacts declined, and number of contacts completed.

Reported monthly.

Receive performance per pass

Eb/N0 margin greater than 3 dB for 95% of completed contacts.

Automated Eb/N0 metric recorded for each contact at suitable time or elevation intervals.

Reported monthly.

Data delivery performance

Less than 60 seconds time elapsed from loss of signal to delivery of data to either the designated primary or backup data management system point of presence.

Time elapsed from end of data acquisition to completion of data files delivery.

Reported monthly.

System availability

95% of scheduled contacts are attempted Return to service within 48 hours.

Derived from monthly reports listed above.

Reported monthly.

5 Reports