Attachment 1 - IDIQ SOW.docx

NCAGSS IDIQ SOW 02/23/26 DRAFT

DEPARTMENT OF COMMERCE (DOC)

NATIONAL OCEANIC AND ATMOSPHERIC ADMINISTRATION (NOAA)

National Environmental Satellite, Data, and Information Service (NESDIS) Consolidated Antenna and Ground Systems Services (NCAGSS)

Indefinite-Delivery Indefinite-Quantity (IDIQ) Statement Of Work (SOW)

Office of Satellite and Product Operations (OSPO) and Office of Common Services (OCS)

April 2026

Prepared by:

U.S. Department of Commerce

NCAGSS IDIQ SOW 02/23/26 DRAFT

National Oceanic and Atmospheric Administration (NOAA) National Environmental Satellite, Data, and Information Service (NESDIS)

Table of Contents

1.0 Introduction

1.1 Purpose

The purpose of this Statement of Work (SOW) is to describe the services the Contractor(s) shall provide to support the NESDIS Antenna as a Service (NAaaS) program. The services are essential to provide NOAA/NESDIS with flexibility and responsiveness required to support the scope, complexity, and evolution of how NOAA/NESDIS acquires, manages and operates antenna services.

1.2 Background

The mission of NOAA/NESDIS is to provide timely access to global environmental data from satellites and other sources to promote, protect, and enhance the Nation's economy, security, environment, and quality of life. To meet its mission responsibilities, NESDIS acquires and manages the antenna ground systems for the Nation's operational environmental satellites and provides antenna ground system services to partner missions.

The NOAA/NESDIS antenna enterprise is comprised of antennas at the Wallops Command and Data Acquisition Station (WCDAS) in Wallops Island, VA; the Fairbanks Command and Data Acquisition Station (FCDAS) in Fairbanks, AK; the Consolidated Backup (CBU) Facility in Fairmont, WV; NOAA Satellite Operations Facility (NSOF) in Suitland, MD, and McMurdo Station located on Ross Island, Antarctica and may include other sites in the future.

The antenna ground system supports spacecraft in various orbital regimes including Geostationary Earth Orbit (GEO), Low Earth Orbit (LEO), and Space Weather Operations (SWO) Lagrange Point Orbits used by both NOAA and its partners. The NOAA/NESDIS antenna ground system simultaneously supports satellites actively collecting weather data as well as satellites in a backup on-orbit storage mode and satellites in transfer phase. Spacecrafts include those owned/operated by NOAA, non-NOAA US partners, and international partners. A list of current NAaaS Program partnerships and missions are in the NCAGSS Acquisition Document Library.

Through the NAaaS program, NESDIS seeks to achieve cost savings and efficiencies by offering users access to antenna services or infrastructure enabling transitions from operating as a single user/mission to a common service-oriented architecture.

The NAaaS initiatives will also seek to consolidate and manage existing and new antennas as non-mission-unique assets; enable multi-mission, multi-orbit use; incorporate next generation technology (i.e. AI enabled, cloud based, digital ground components, phased array apertures) and when advantageous to the Government, leverage use of commercial Ground Segment as a Service (GSaaS) providers for additional coverage and/or capacity.

Figure 1.2-1 represents an operational viewpoint of the NAaaS architecture and the functional flows between the spacecraft, including commands (CMD), ranging (RNG), and telemetry (TLM), and the NOAA and partner missions on the ground. Telemetry is inclusive of housekeeping data and unprocessed mission data.

Figure 1.2-1. Representation of NOAA Satellites, Ground Systems and NAaaS

1.3 Scope

This Statement of Work (SOW) is for the base IDIQ. Task orders (TOs) will be issued for specific services within the scope of this Indefinite-Delivery Indefinite-Quantity (IDIQ) over the period of performance, which consists of a base period of five years and an option period of five years.

The SOW defines the requirements for services to deliver solutions for performing antenna ground system upgrades, building new antennas when required, decommissioning and removing existing antennas, and leveraging commercial services and products. In addition, it defines the requirements for services to install, when needed, a common service antenna infrastructure that supports maintenance and sustainment services to ensure extensibility, reliability, and continued IT security policy compliance. It also defines the requirements for a NAaaS enterprise Programmatic Integrator (PI) who will ensure integration across all TOs.

The Contractor(s) shall not perform any inherently governmental functions as defined in FAR 7.503, nor shall Contractor(s) personnel be permitted to act in a manner that reasonably could be interpreted as an official act of the Government. Functions such as the direct conduct of contract management, budget execution, source selection, award determinations, or supervision of federal employees are reserved exclusively for Federal personnel. The Contractor(s)’s role is limited to providing technical, advisory, or support services as specified in the contract, and all final decision-making authority will remain with duly authorized Federal officials.

The antenna ground system supports spacecraft in various orbital regimes including Geostationary Earth Orbit (GEO), Low Earth Orbit (LEO), and Space Weather Operations (SWO) Lagrange Point Orbits used by both NOAA and its partners. Appendix A lists the antenna ground systems the Office of Satellite Product Operations (OSPO) currently operates, maintains, and/or sustains. As listed in Appendix A, these systems fall into three groups:

1. Those owned and operated by NOAA.

2. Those owned by NOAA but operated under contract.

3. Other antennas contracted for utilization by NOAA.

The Office of Common Services (OCS) will manage the development and acquisition of antenna services for the NAaaS program.

The term NAaaS antenna portfolio includes but is not limited to the antenna ground systems in Appendix A. Examples of the NAaaS antenna portfolio contents include the frequency bands, Interface infrastructure, Low Noise Amplifiers (LNAs), High Power Amplifiers (HPAs), Front End Processors (FEPs)/radios, and matrix switches. NOAA currently has partnership agreements with National Aeronautics and Space Agency (NASA), U.S. Space Force, Kongsberg Satellite Systems (KSAT) and Norway to provide antenna services that currently fall outside of the NAaaS portfolio of antennas and outside of the IDIQ SOW.

While all antenna ground systems listed in Appendix A shall be operated and maintained, there are a limited subset of antennas and systems that will be initially sustained and are defined in Sustainment (TO4). In addition, Operations (TO2) and Maintenance (TO3) antennas and ground system interfaces are only applicable to NSOF, CBU and McMurdo Station. Partnership agreements, individual system inventories, drawings, descriptions and interfaces are available in the NCAGSS Acquisition Document Library. Appendix B contains the NCAGSS Information and Cybersecurity Support Task Accountability Matrix, Appendix C contains Applicable Reference and Security Documents links (in addition to NCAGSS Acquisition Document Library), and Appendix D contains acronyms and meanings.

1.4 Place of Performance

The places of performance include the following locations:

a. NESDIS Consolidated Back-up Unit (CBU) located in Fairmont, West Virginia

b. NOAA Satellite Operations Facility (NSOF) located in Suitland, Maryland The Government will not provide on-site facilities for the day-to-day execution of this contract. All work will occur at the Contractor’s facility, either the corporate offices or elsewhere as defined in the offerors’ proposal and as agreed to by the Government. Periodic on-site support at the following facilities is expected to fulfill the requirements of this contract of the locations below:

a. NESDIS Command and Data Acquisition (CDA) Station Fairbanks, Alaska

b. NESDIS Command and Data Acquisition (CDA) Station, Wallops Island, Virginia

c. Utqiagvik (Barrow), Alaska

d. Mission Partner OCONUS Sites (Mawson Lakes, Australia, Bayswater, Australia, Nittedal, Norway)

e. Mission Partner CONUS Sites (Centennial, CO, Offutt AFB, NE)

f. McMurdo Station located on Ross Island, Antarctica

g. NASA White Sands Complex (WSGT/WSC) Les Cruces, New Mexico

h. European Organisation for Exploitation of Meteorological Satellites (EUMETSAT) (Darmstadt, Germany)

i. Svalbard Satellite Station (Svalbard, Norway)

j. Godard Space Flight Center (GSFC), Greenbelt, Maryland

k. Contractors’ facilities

1.5 Government Furnished Equipment and Information

1.5.1 Government Furnished Equipment (GFE) and Supplies

The Government will provide the Contractor(s) personnel located at the Government buildings and other potential sites with basic supplies and materials normally available to Government employees including personal computers and software.

The Contractor(s) shall coordinate with the Government property manager regarding the transfer receipt of all assets, the management of all property, and the program’s inventory. The Government furnished equipment (GFE) list will be provided to the Contractor(s) at the TO level and will contain the list of equipment available to the Contractor(s) for use in the performance of the TO. The GFE will be used and maintained by the Contractor(s) in accordance with FAR clause 52.245-1, Government Property.

During contract transition, the Contractor(s) will work with the Government property manager to transfer any GFE at the incumbent Contractor(s) location. The Contractor(s) shall receive, manage, and maintain all GFE throughout the duration of the TO.

Hardware and software procured by the Government will be received, managed, and tracked by the Contractor(s). Data packages for hardware and software procured by the Contractor(s) shall be submitted to the Government.

1.5.2 Government Furnished Information (GFI)

Government furnished information (GFI) includes, without limitation, all software, related documentation, and training materials, including design documentation, and working papers that are the property of the Government or are subject to the license restrictions of other vendors. The NCAGSS Contractor(s) shall be authorized to modify, maintain, test, or enhance existing software to support growth for future missions. All subsequent software purchases or changes will remain the property of the U.S. Government. For any existing government owned systems, the Government will provide licenses. If for any new system, the Contractor(s) would be responsible for acquiring any required licenses.

1.6 Contract Execution

This IDIQ will encompass four functional service areas as listed below. There is a separate pool of vendors for three functional areas: Operations, Maintenance, and Sustainment. The Program Integration functional area will have only one vendor.

a. Functional Area 1: Program Integration

b. Functional Area 2: Operations

c. Functional Area 3: Maintenance

d. Functional Area 4: Sustainment

Figure 1.6-1 NAaaS PI Task Order Integration Functions

TO 1 NAaaS PI functions are depicted in Figure 1.6-1. The execution for NAaaS PI, operations, maintenance, and sustainment functions of NESDIS-deployed antenna hardware, firmware, and antenna ground systems includes support for:

a. Satellite-to-Ground communications, including radio frequency (RF) antenna systems.

b. Common service capabilities that support mission scheduling, antenna ground system software/subsystem functions, and antennas monitoring and control.

c. Program execution and delivery of services using the National Institute of Standards and Technology (NIST) and other security control guidelines.

d. Technical baseline evolution, both hardware and software that changes components or adopts new technology.

e. Utilizing Government approved cloud infrastructure services for Satellite Data Processing and distribution and Satellite operations services.

2.0 Applicable Documents

Documents applicable to this contract include the NESDIS Systems Engineering and Program Management Policies and Procedures and OSPO Systems Description documents that apply to all OSPO systems. The most current editions, along with TO applicable and reference documents, are included in the NCAGSS Acquisition Document Library. Other reference documents include the most current edition of the DOC and NOAA IT Security Policies. These may be found at https://www.csp.noaa.gov/policies/.

The NIST Federal Information Processing Standards (FIPS) and Special Publications (SP) documents listed in Appendix C, Applicable Reference and Security Documents apply to all OSPO systems and reference the latest applicable revision of the document. The most current edition of the NIST FIPS and SP document may also be found at https://csrc.nist.gov/publications.

3.0 Requirements

NOAA may issue TOs as new mission requirements, evolving technologies or emerging services are identified for the Contractor(s) to perform the requirements identified in this SOW. General requirements, provided below, are applicable to all TOs. Additional specific requirements are provided for each TO task area in this IDIQ SOW for Program Integration, Operations, Maintenance and Sustainment. The sample TOs for Program Integration, Operations, Maintenance, and Sustainment contain additional TO requirements. Note some IDIQ TO requirements may be duplicated across TOs.

3.1 General Requirements

The Contractor(s) shall develop an Associate Contractor Agreement (ACA) per the requirements specified in Section H, Special Contract Requirements, in the IDIQ contract. The intent of this agreement is to provide a basis for sharing information, data, technical knowledge, expertise, and resources essential to the integration of the NAaaS program and to ensure the greatest degree of cooperation for the development of the program to meet the terms of the IDIQ contract.

The NAaaS PI and TO Contractor(s) shall:

a. Work with and share information with other Contractor(s) to facilitate NAaaS enterprise Programmatic Integration.

b. Perform operations, maintenance, integration and sustainment activities as defined in individual TOs at locations/sites listed in Section 1.4.

c. Leverage use of commercial services including commercial Ground Systems as a Service (GSaaS) for additional coverage and/or capacity when conducting trades for meeting new service requirements.

d. Provide personnel that possess the required education, level of experience, and professional and technical certifications per attachment J-2, Labor Category Description, of the IDIQ contract.

e. Provide personnel that possess the required security clearance which will be identified at the TO level.

f. Deliver products and services in accordance with the deliverables section of each TO.

g. Furnish labor as necessary, for packing, unpacking and placement of equipment when in the possession of the Government.

h. Use Commercial Off the Shelf (COTS) or open-source software wherever possible and, when cost effective, and obtain Government approval for all modifications to COTS.

i. Adhere to cybersecurity requirements.

j. Perform financial management and control of the execution of the work.

k. Provide financial management of the contract TOs including, spend plans, invoicing, fund status, engineering assessments (EAs) and travel management.

l. The Contractor(s) shall participate in NAaaS monthly program management reviews conducted by the PI. Contractor(s) for Operations, Management, and Sustainment are to conduct monthly project management reviews providing project related information to the NAaaS PI within 10 days of the program review.

m. The Contractor(s) shall perform configuration management in accordance with the OSPO configuration management plan (current version) that includes support to Government enterprise tools; meeting management services; related documentation; configuration change documentation and related forms of applicable systems; coordinate with the Government updates needed to document in a designated Government library via the PI; configuration control board support; and operations procedure support.

n. The Contractor(s) shall establish and maintain an enterprise-wide configuration baseline of all hardware and software that comprise the NAaaS system. The Contractor(s) shall track software licenses usage and compliance, reclaim idle or stale software licenses, and be capable of removing any unauthorized software.

o. The Contractor(s) shall support the physical configuration audit and tools to include regularly scheduled scans and inventories and related documentation/report deliveries.

p. The Contractor(s) shall perform the following:

1. Provide property management support (to include shipping and receiving tasks).

2. Ensure the currency of software licenses, hardware maintenance and warranties.

3. Provide procurement support.

4. Provide a written quarterly property and license status as part of the program review package

q. The Contractor(s) shall provide deliverables for each TO in the content and format that is approved by the Government.

r. The Contractor(s) shall submit reports in electronic format, as detailed in Task Order appendices for Deliverables. The Contractor(s) shall work with numerous file formats, including Microsoft Office® (.doc, .xls, .ppt, .mpp, .pdf, VISIO, and XML). The frequency of submission of program deliverables is specified in the Deliverable appendices.

s. The Contractor(s) shall employ deployment strategies that will minimize the risk of interference, loss of downtime (to include critical weather days), or compromise system operations while performing all operations, maintenance and sustainment TO activities.

t. The Contractor(s) shall maintain the NAaaS antenna portfolio for compliance with technical, functional, performance, availability, reliability, and security requirements and specifications.

u. The Contractor(s) shall submit and track defects, problems, change controls requests, and anomalies in a Government provided in a NAaaS Enterprise Configuration Management (ECMT) system.

v. The Contractor(s) shall maintain its credentials for access to the Government electronic data repository for the duration of the NCAGSS contract.

w. The Contractor(s) are responsible for working with the NOAA Property Custodians to decommission and/or excess any accountable property.

x. The Contractor(s) shall work with the mission operations team to support ground system requirements for future missions or upcoming launches.

3.1.1 Program/Project Management

Program management tasks and activities are performed to support all NESDIS antenna ground segments. These include: project management, contract transition management, schedule, deliverables (including key documents, plans, meeting support, meeting minutes and other documents), financial operations and cost management, staff management, configuration management, data management, systems engineering, asset management (includes inventories and audits), supply chain management (e.g., purchasing of hardware and software, firmware, software licenses, maintenance agreements/renewals), quality management, risk management, and training.

Program management is defined at the NAaaS program level and performed by the PI Contractor. Project management is defined at the TO level and performed by the TO Contractor(s). Both the PI and TO Contractor(s) shall perform the following:

a. Provide program/project execution, cost and schedule control, assessment, and recommend and implement improvements.

b. Effectively manage and utilize subcontractor(s) (as documented in a subcontracting plan).

c. Manage staff as documented in the staffing plan that includes support projections covering all TOs.

d. Provide quality assurance support (to include quality assurance plan and data call support).

e. Perform risk management and mitigation support (including risk management status reviews).

f. Provide personnel training (to include training plans during the contract period of performance).

3.1.2 Incoming and Outgoing Transition

The Contractor(s) shall perform effective management and documentation of contract transition without impact to operations (as documented in Phase-in Transition and Phase-out Transition Plans for all activities). Transition requirements apply to all TOs.

The Contractor(s) shall support transition of task responsibilities to and from other contracts as well as between TOs on this contract. These transition activities shall be closely managed so no operational impacts occur to any systems. Detailed transition requirements will be specified in the TOs.

The Contractor(s) shall provide all resources to assume, transition, and execute the implementation for operating, maintaining, and/or sustaining one, or several systems over the contract period of performance.

The Contractor(s) shall coordinate with the Government scheduling a Technical Interchange Meeting (TIM) within 10 business days for the purpose of providing a status on the Transition Plans.

3.1.3 IT Security Requirements for High Risk Contracts

The Contractor(s) shall comply with the IT Security requirements of the Department of Commerce as outlined in Commerce Acquisition Regulation (CAR) 1352.239-72, Security Requirements For Information Technology Resources (April 2010). CAR 1352.239-72, section (d) includes the DOC IT Security Baseline Policy, the NOAA IT Security Manual, and the NESDIS IT Security Handbook. The Contractor shall comply with FAR Clauses 52.204-21, 52.224-1, 52.224-2 and 52.239-1.

Contractor personnel will be screened in accordance with the requirements for High Risk contracts as specified by CAM 1337.70 section 2.2 (Oct 2015); specifically, in accordance with CAR 1352.237-70, Security Processing Requirements—High or Moderate Risk Contracts (April 2010).

The Contractor shall notify the Government of any issues or problems with IT Security compliance.

Contract personnel who are Foreign Nationals shall abide by the requirements of CAR 1352.237-73, Foreign National Visitor and Guest Access to Departmental Resources (APR 2010).

The Contractor shall submit security forms required by CAR clause 1352.237-70 two (2) weeks prior to each new contract employee’s start of work so NOAA staff has sufficient time to process requests for background checks, NOAA badges, and network access.

Contractor personnel shall complete all NOAA required security, safety, and other training consistent with contract requirements.

3.1.4 Cloud Infrastructure Services

NOAA will continue to implement their cloud strategy documented in the NOAA Cloud Strategy, 2019-2024 (https://sciencecouncil.noaa.gov/wp-content/uploads/2022/08/2020- Cloud-Strategy.pdf), NESDIS will build out cloud based services using the NESDIS Common Cloud Framework (NCCF), which is an integrated cloud-based system that facilitates the flow of data from various sources including NOAA satellites, commercial partners, and other data providers through a comprehensive production pipeline.

Agile/DevSecOps methodologies are implemented under the Scaled Agile Framework’s (SAFe) Large Solution construct. TOs may be issued to implement technical objectives in information system operations, sustainment and technology refreshes, as applicable. Objectives include cloud solutions to implement approved technology improvements, optimizations and efficiencies and lower total cost of ownership. NCAGSS tasks for cloud implementations will utilize Government-approved contract vehicles to procure cloud services per defined requirements, including, but not limited, to these FedRamp areas:

a. Virtual machine (or compute) services

b. Cloud testing services

c. Storage services

d. Network bandwidth (or data transfer) services

e. Management capabilities and tools

f. Professional services

g. Adopt and integrate implemented/existing NESDIS Enterprise tools and processes wherever feasible

For such task requirements, the Contractor(s) shall be expected to define, plan and document, implement, test, and verify all cloud implementation requirements, coordinate with the cloud provider, and monitor the cloud solution performance via metrics.

3.1.5 Cybersecurity

3.1.5.1 Continuous Monitoring and Situational Awareness

The Contractor(s)’s designated security liaison shall coordinate with and report to the assigned NOAA Information and Cybersecurity program-designated Point of Contact (POC) to assist in implementing the required security controls for the compliant operation of satellite control and product processing systems. Please refer to Appendix B, NCAGSS Information & Cybersecurity Support Task Accountability Matrix Personnel Security Requirements for current roles and responsibilities between NCAGSS security support tasks and the IT Security program.

3.1.5.2 Incident Response

The Contractor(s) shall coordinate and report remedial actions in response to IT security events or incidents to the NOAA Cybersecurity Center (NCSC) within 24 hours, or as specified in the OSPO Incident Response (IR) Plan.

3.1.5.3 System and Networking Monitoring

The Contractor(s) shall complete monitoring activities of system and security logs and report issues to the designated Government POC.

3.1.5.4 Audit and Logging

The Contractor(s) shall review system monitoring logs and complete reports, per the System Security Plans (SSP).

3.1.5.5 Vulnerability Assessment

The Contractor(s) shall complete required vulnerability assessment activities, including authenticated monthly and quarterly scans and reporting.

The Contractor(s) shall either upload completed vulnerability and configuration compliance scan reports to the NOAA enterprise vulnerability scanning tool or initiate the scans from the enterprise tool by the first day of each month for monthly vulnerability scans and website scanning. Vulnerability scans are due on the 15th day of the last month of the quarter (12/15/YY, 3/15/YY, 6/15/YY, 9/15/YY) or as required by NESDIS.

The Contractor(s) shall maintain and update scanning tools and plugins for associated vulnerabilities one time a month.

The Contractor(s) shall maintain and update scanning products and associated vulnerability at least monthly.

The Contractor(s) shall initiate and complete scans from the NOAA Tenable Security Center or the single user NESSUS tool, the current NOAA standard vulnerability scanning tool. In some cases, other scanning tools may be used for specific components, e.g. WebInspect Enterprise or WebInspect single user for web pages.

The Contractor(s) shall implement federal guidelines for CyberScope reporting as directed by DOC, NOAA, NESDIS, or OSPO policy.

The Contractor(s) shall maintain a Scanning Exclusion List of system components excluded from automated vulnerability scanning due to age, mission, or technical considerations, and update and publish monthly per the NCAGSS Configuration Management process.

The Contractor(s) shall assess all components identified on the Scanning Exclusion List for vulnerabilities using other technical means including manual evaluation, testing, and complete assessments as part of the monthly and quarterly vulnerability assessments reports.

The Contractor(s) shall remediate vulnerabilities for all components identified on the Scanning Exclusion List.

3.1.5.6 Cybersecurity Compliance

The Contractor(s) shall ensure this contract meets Department of Commerce (DOC) Enterprise Cybersecurity Policy (ECP) program requirements in accordance with Acquisition of Approved Products and Services for Personal Identity Verification (FAR 4.1302), Personal Identity Verification (PIV) of Federal Employees and Contractor (FIPS PUB 201-3), and Homeland Security Presidential Directive (HSPD)-12. FAR part 11.002(g) requirements which state that unless the agency Chief Information Officer waives the requirement, when acquiring information technology using Internet Protocol, the requirements documents must include reference to the appropriate technical capabilities defined in the USGv6 Profile (NIST Special Publication (SP) 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program. To meet this requirement each DOC acquisition of IP protocol technology must express requirements for IPv6 capabilities in terms of the USGv6 Profile (i.e., using the USGV6 Capabilities Check List) and vendors must be required to document their product’s support of the requested capabilities through the USGv6 test program, using the USGv6 Suppliers Declaration of Conformity (USGv6 Profile Supplier's Declaration of Conformity | NIST).

3.1.5.7 Contingency Planning

The Contractor(s) shall provide support for input and support to maintaining the system Disaster Recovery/COOP and contingency activities plan. These plans shall be updated semi-annually, unless directed otherwise.

The Contractor(s) shall coordinate with and provide input to the IT security representative to maintain the Contingency Plan Test Plan and Report (CPTPR). This plan is updated annually.

The Contractor(s) shall participate in quarterly Contingency Plan (CP) training. All Contractor(s) staff shall complete CP training at least semi-annually.

The Contractor(s) shall participate in testing the system Contingency Plan annually, and test system backup procedures quarterly. The failed actions related to contingency system testing shall be fully reflected in the annual Contingency Plan with established mitigations to correct the actions during the next test.

3.1.5.8 Flaw Remediation

The Contractor(s) shall identify and report on information system vulnerabilities.

The Contractor(s) shall test software updates related to flaw remediation for effectiveness and potential side effects on all affected systems before installation.

The Contractor(s) shall maintain and implement DOC, NOAA, or flaw remediation tools, as applicable.

The Contractor(s) shall provide input for the SSP on the reasons related to any component that cannot be patched such as age, mission, or technical impact.

3.1.5.9 Malicious Code Protection

The Contractor(s) shall identify and document specific components unable to implement anti-malware protections. The Contractor(s) is responsible for documenting, in conjunction with the ISSO, technical and operational considerations for equipment and software within their scope, facilitating the SSP and FIPS 200 risk acceptance process.

The Contractor(s) shall maintain and implement the NOAA enterprise anti-malware tool.

3.1.4.10 Cybersecurity Program Management Support

The OSPO Cybersecurity Division manages the security architecture and engineering for each of the OSPO IT systems. The OSPO Cybersecurity Division manages the overall security compliance requirements for each of the OSPO IT systems utilizing a separate OSPO Cybersecurity contract. The OSPO Cybersecurity Division will provide comprehensive IT security services, complete tasks, and submit deliverables and artifacts produced by NCAGSS Contractor(s) in support of all aspects of IT security and IT security management for OSPO systems.

The OSPO Cybersecurity Division will implement required security control policies to ensure confidentiality, integrity and availability of the information resources integral to the successful operation of OSPO antenna systems, product processing and distribution systems, and Admin LANs.

IT and cybersecurity services for DOC NOAA systems will be implemented on a separate contract vehicle. However, security-related support for the NCAGSS contract will involve coordination with the OSPO Security Program (who leads critical IT and cybersecurity activities) to enable security solutions. Appendix B, of the NCAGSS Information & Cybersecurity Support Task Accountability Matrix, designates the task number, task description, whether the NCAGSS IT Contractor(s) leads or provides input for a task, and whether the task requires documentation, reporting, action, or a combination thereof. The NCAGSS contract security liaison shall provide oversight, leadership, coordination of all security related activities, and manage the NCAGSS support staff in achieving the functions below. This information applies to all TOs.

a. Perform scans, patching, and hardening.

b. Implement technical security controls.

c. Collect artifacts for security control assessments and technical Plan of Action & Milestones (POA&M).

d. Acquire security-related solutions identified by the NESDIS IT Security Program.

e. Implement and maintain the identified security-related solutions.

f. Provide input to security related document deliverables.

g. Perform component assessments, and other security related activities.

h. Adopt and integrate implemented/existing NESDIS Enterprise tools and processes wherever feasible.

3.1.5.11 Cybersecurity Awareness & Training

All Contractor(s) personnel shall complete the required NOAA training to include the Annual NOAA IT Security Awareness Training.

All Contractor(s) personnel shall complete the Annual NOAA Role-Based Security Training 30 days before the established deadline each fiscal year.

3.1.5.12 Continuous Monitoring and Assessment & Authorization (A&A)

The Contractor(s) shall support processes enabling the OSPO Cybersecurity Program Office to achieve compliance with Government security mandates and obtain/maintain an Authority to Operate (ATO) for each system.

The Contractor(s) shall submit assigned Security Control Assessment (SCA) artifacts to the OSPO Cybersecurity Program Office as scheduled.

The Contractor shall apply IT security requirements for all phases of implementation of the design in accordance with the laws, statutes, and regulations as published in the US DOC Enterprise Cybersecurity Policy (ECP), Security and Privacy Controls Matrix (SPCM) and the NOAA IT Security Manual (212-1301).

3.1.5.13 Plans of Action & Milestones (POA&M) Management

The Contractor(s) shall manage technical POA&M milestones using NAaaS enterprise configuration management tools.

3.1.5.14 System Interconnection

The Contractor(s) shall support information requests for all system Interconnection Security Agreements.

The Contractor(s) shall review and implement connections in accordance with the Interface Control Documents (ICD) and report any discrepancies or changes to the Government.

3.1.5.15 System Security Documentation

The Contractor(s) shall support information requests for Security Authorization Package for all NAaaS antenna portfolios and additional information or documentation required by updates to DOC, NOAA, NESDIS policies/procedures.

3.1.5.16 Security for SE, Change Management, and Configuration Management

The Contractor(s) shall adhere to requirements specified in the approved Security Authorization Package Core Documents in Appendix B for all assigned NCAGSS systems and referenced requirements in DOC, NOAA, NESDIS, and OSPO policies and procedures.

The Contractor(s) shall formulate and draft a plan for security patching for implementation after concurrence with the OSPO Cybersecurity Division.

The Contractor(s) shall ensure the security posture of NAaaS enterprise antennas remain current and compliant with the OSPO Security Program.

The Contractor(s) shall ensure that sustainment, update and/or patching of software will not alter the configuration setting from the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIG) for servers and network devices.

3.2 Program Integration

3.2.1 Systems Engineering

Systems engineering at NESDIS requires the application of a systematic, disciplined engineering approach throughout the life cycle of a project. These processes will be applied to support all NESDIS NAaaS antenna ground segments. NESDIS has developed systems engineering policies and procedures to guide the NESDIS systems engineering activities. The Contractor ensures alignment with these processes while providing systems engineering services for the NOAA/NESDIS antenna enterprise.

NOAA/NESDIS collaborates with many domestic and international partners (e.g., NASA, USSF, EUMETSAT) to fulfill its mission. As such, in some cases, the Contractor(s) shall ensure alignment with the partners’ systems engineering approach as well as with TO1, Program Integration, Contractor guidance. In addition, the Contractor(s) shall demonstrate an ongoing commitment to innovative Systems Engineering solutions, where applicable, that promote NAaaS architectural goals and streamline services, while minimizing associated costs and risks.

The NAaaS PI and TO Contractor(s) shall provide system engineering expertise and management planning activities as described below.

3.2.1.1 Systems Engineering Expertise

The Contractor(s) shall provide subject matter expertise on systems engineering principles including Model Based Systems Engineering (MBSE) and Digital Systems Engineering (DE). The Contractor(s) shall employ the use of Digital Twins where applicable to improve the quality, cost, and schedule of the program.

3.2.1.2 Systems Engineering Management Planning

The Contractor(s) shall:

a. Document Program Plans, Project Plans and System Engineering Management Plan (SEMP) to establish system engineering processes such as requirements definition and flowdown, design definition, interface definition and control, trade studies, design analysis, requirement verification, and Integration and Test (I&T) activities.

b. Define and document Technical Performance Measures (TPM) and key performance indicators (KPI).

c. Organize and conduct management and engineering reviews.

d. Develop, update and maintain system architecture documentation and CONOPS.

e. Perform engineering analyses, assessments, trade analysis and studies, evaluations, and gap analysis of deficiencies.

f. Validate requirements.

g. Formulate and draft a plan for regression testing that includes options for not impacting antenna down time.

3.2.1.3 Requirements Management

The Contractor(s) shall perform requirements management activities for the NESDIS enterprise architecture in accordance with (IAW) procedures and processes contained in the NESDIS Requirements Management Procedural Requirements (NESDIS-PR-1303.1) or current version. The Contractor(s) shall support NOAA Administrative Order (NAO) 216-108, Requirements Management Process that specifically enables the Government to gather, analyze, allocate, decompose, and validate requirements. NAaaS baselined requirements are in the NCAGSS Acquisition Library named NAaaS Requirements Document.

3.2.1.4 Risk Management

The Contractor(s) shall support and perform Enterprise Risk Management (ERM) IAW the NESDIS Requirements Management Procedural requirements (NESDIS-PR-1303.1) or current version. Risk management planning includes the development of the Risk Management Plan (RMP), risk identification, risk assessment and analysis (qualitative and quantitative) and mitigation planning, risk handling/action, risk tracking and control, risk documentation communication and participation in an NAaaS monthly risk review.

The Contractor(s) shall develop a Supply Chain Risk Management (SCRM) Plan identifying supply chain vulnerabilities, threats, and potential disruptions throughout the supply chain and implementing mitigation strategies to ensure the security, integrity, and uninterrupted flow of materials, products, and services. The Contractor(s) shall contact SCRM_IOC@doc.gov with questions on supply chain risk considerations and/or Supply Chain Risk Assessment (SCRA) requirements.

3.2.1.5 Configuration Management of Technical Baseline

The Contractor(s) shall manage, maintain, and perform comprehensive programmatic configuration control as outlined in the NESDIS Configuration Management Procedural Requirements (NESDIS-PR-1304.1). The Contractor(s) shall use and support the Government’s Configuration Management processes including providing technical inputs regarding actions coming before the Engineering Review Boards (ERBs) and Configuration Control Boards (CCBs). The Contractor(s) shall maintain the baseline of all hardware and software assets of the NAaaS antenna systems. The Contractor(s) shall track software licenses usage and compliance, reclaim idle or stale software licenses, and remove unauthorized software in accordance with IT and Cybersecurity policy and mandates.

3.2.1.6 Knowledge Management

The Contractor(s) shall support the implementation of a Knowledge Management process and capture lessons (both positive and negative) that pertain to the success of the program. The purpose is to (a) ensure that existing knowledge and lessons learned are appropriately incorporated into the program, and (b) the lessons learned during this program are captured and incorporated throughout the program lifecycle to reduce the likelihood of repeating problems and reducing risk.

3.2.1.7 Ground Systems Engineering Support

The Contractor(s) shall provide a broad range of systems architecture, systems engineering and program/project management services to support the development and sustainment of NESDIS ground systems. The Contractor(s) shall provide expertise and working knowledge in cloud design, cloud development, DevSecOps, Agile Methodologies and best practices.

3.2.1.8 Test Support

The Contractor(s) shall provide system engineering services for test support for Qualification, Acceptance, Development, Operations, and Integration.

The Contractor(s) shall detail all prioritized support for engineering expertise, labor, materials, documentation services, and calibration required for the installation, test, and checkout (ITCO) in accordance with the OSPO CM Plan of new or replacement equipment, modification, major repair, and/or overhaul of existing equipment, alteration and construction to accomplish the specified technical refresh sustainment objectives. The Contractor(s) shall deliver to the Government test deliverables 30 days before the tests.

3.2.1.9 Transition to Operations

The Contractor(s) shall provide support in all transition phases of systems life cycle development. These transition phases include design reviews, test campaigns, and operational readiness reviews.

3.3 Operations

Operational activities are performed to ensure effective command and control of satellites, acquisition of mission data, and efficient use of NESDIS and commercial ground networks. Operations are supported on a 24-hour x 7 days basis with defined remote backup and contingency capabilities that ensure the high availability and reliability of services. NESDIS Operations transform satellite and in-situ environmental observations into desired data and information products and related services that either create or deliver value to NOAA and other customers (both internal and external to NOAA).

Commercial antenna services may be acquired through this operations task area. Included in the acquisition the commercial service provider will include operations, maintenance and sustainment of the antennas utilized to satisfy NAaaS requirements. Since most of the effort for the acquisition of these commercial antenna services resides in the operational area within the NAaaS program, TOs to acquire these services will be executed through an operations Day 1 task order.

Core functional areas of NESDIS satellite operations include:

a. Support of launch, activation, and evaluation of new satellites.

b. Monitoring and verification of satellite health and status.

c. Collecting and distributing satellite telemetry, tracking and command (TT&C) data and Stored Mission Data (SMD).

d. Satellite commanding and ranging.

e. Managing, monitoring, and configuring associated antenna ground segment elements.

f. Ensuring a secure operational environment.

The Contractor(s) shall support all antenna related functional areas of NESDIS satellite operations.

The Government will provide infrastructure and procedural details to the Contractor(s) for the safe and effective execution of deployed system activities assigned under specific TOs.

The Contractor(s) shall perform operations activities on the NAaaS antenna portfolio as identified in individual TOs.

The Contractor(s) shall perform and support NAaaS operation activities and functions to support efficient and effective command and control of satellites and NESDIS ground networks, data acquisition from a spectrum of observing and computational systems as provided in NCAGSS Acquisition Document Library.

The Contractor(s) shall provide NAaaS operations support daily, seven (7) days per week, 365 days per year: including leap year, with defined remote operational back-up and contingency capabilities, while meeting system availability and reliability requirements.

The Contractor(s) shall provide NAaaS operations support for core functional areas of satellite operations. Core functional areas include:

a. Launches and transition to operation activities.

b. Detection, identification and assessment of antenna ground system anomalies.

c. Managing, monitoring, and configuring the associated antenna ground segment elements.

d. Ensuring continuous security compliance in the operational environment.

The Contractor(s) shall provide daily NAaaS operational support activities for managing a satellite command and control center. Antenna operational support activities include:

a. Satellite launch and commanding activities.

b. Systems analysis support during operational anomalies.

c. Network, systems, workstation, printer and satellite hardware support.

d. Antenna operations support.

e. Network and security monitoring

f. Continuity of operations (COOP)

g. Operations training.

The Contractor(s) shall provide support to the Government in updating and reviewing current Standard Operating Procedures (SOP)s.

The Contractor(s) shall provide support to the Government in verifying and ensuring the accuracy of the Operational Systems’ configuration files.

3.4 Maintenance

Maintenance activities ensure the overall NAaaS antenna ground systems continue to meet scientific, technical, functional, and performance requirements in addition to availability and reliability requirements and that the appropriate security posture is maintained. These include:

a. Preventive Maintenance: Changes to antenna ground systems or software with the intent to prevent errors, problems or failures before they occur.

b. Corrective Maintenance: Reactive (emergency) and routine (planned) fixes that are needed because of anomalies such as network and data outages, hardware failures, security vulnerabilities and software problems.

c. Limited Scope Adaptive Maintenance- Modifications that can be performed by operations support personnel, and that maintain current system requirements and the controlled configuration and interfaces.

In all cases, maintenance I&T activities and regression testing are performed to verify the results of the maintenance actions and to ensure that none of the modifications negatively impact the functional performance of the operational baseline system.

Return to service consists of repairs and configuration adjustments. These activities are performed by Government and Contractor(s) and shall include the following:

a. Initial anomaly response.

b. Anomaly investigation, configuration adjustment, and minor repair (software, hardware, minor script adjustments, etc.) required to return the system to operational status.

c. Work Request/Configuration Change Request (WR/CCR) generation in the OSPO Configuration Management System in the event escalation is needed.

d. Fault isolation.

e. Temporary workarounds.

f. IT security patching and scanning.

g. After hours support - Quick reaction for restoration of service (in accordance with the Mean Time to Repair (MTTR).

Antenna and supporting infrastructure maintenance activities consist of maintenance, testing and replacement. These activities are performed by TO Contractor(s) and shall include the following:

a. Change Control Board (CCB) forum to…