Attachment 1 - Mock TO1 PWS - Standards Support.pdf

Standards Support CAPSS Sample TO 1 Performance Work Statement

1. Background

1.1. Tasks 1 and 2

The American National Standards Institute (ANSI) Federation’s primary goal is to enhance the global competitiveness of U.S. business and the American quality of life by promoting and facilitating voluntary consensus standards and ensuring their integrity. The Institute, which is active in both national and international standardization, is a major proponent of the United States Standards Strategy (USS). This document establishes a framework that can be used by all interests including companies, government, nongovernmental organizations, standards developers and consumers, to further improve U.S.

competitiveness abroad while continuing to provide strong support for domestic markets. Using the USS as a guide, ANSI is successfully facing the standardization challenges of a global economy while addressing key quality-of-life issues such as safety and the environment.

Although ANSI itself does not develop American National Standards (ANSs), it provides all interested U.S.

parties with a neutral venue to come together and work towards common agreements. The process to create these voluntary standards is guided by the Institute’s cardinal principles of consensus, due process and openness, and depends heavily upon data gathering and compromises among a diverse range of stakeholders. The Institute ensures that access to the standards process, including an appeals mechanism, is made available to anyone directly or materially affected by a standard that is under development. Thousands of individuals, companies, government agencies, and other organizations such as labor, industrial, and consumer groups voluntarily contribute their knowledge, talents, and efforts to standards development.

In addition to facilitating the formation of standards in the U.S., ANSI promotes the use of U. S.

standards internationally, advocates U.S. policy and technical positions in international and regional standards organizations, and encourages the adoption of international standards as national standards where these meet the needs of the user community.

The Institute is the sole U.S. representative and dues-paying member of the two major non-treaty international standards organizations, the International Organization for Standardization (ISO), and, via the U.S. National Committee (USNC), the International Electrotechnical Commission (IEC). As a founding member of the ISO, ANSI plays a strong leadership role in its governing body while U.S. participation, via USNC, is equally strong in the IEC.

Part of ANSI’s responsibilities as the U.S. member body to the ISO includes accrediting U.S. Technical Advisory Groups (U.S. TAGs). The primary purpose of these groups is to develop and transmit, via ANSI, U.S. positions on activities and ballots of the Technical Committees (and as appropriate, Subcommittees and policy committees). These technical issues include the approval, reaffirmation, revision and withdrawal of ISO standards.

INCITS—the International Committee for Information Technology Standards—is the central U.S. forum dedicated to creating technology standards for the next generation of innovation. INCITS members combine their expertise to create the building blocks for globally transformative technologies. The INCITS Committee on Cyber Security (INCITS/CS1) was established in April 2005 to serve as the US TAG for ISO/IEC Joint Task Committee 1 SubCommittee 27 (ISO/IEC JTC 1/SC 27) and all SC 27 Working Groups (WGs).

The National Institute of Standards and Technology (NIST) Computer Security Division (CSD) is currently providing a lead researcher who presides in person (or virtually) at all CS1 meetings as Chair and serves as U.S. Head of Delegation at all international meetings of the ISO/IEC JTC1/SC27 and its WGs. This person is a facilitator of meetings—domestic and international in-person (or virtual) meetings. This person also handles the coordination and administrative needs in order to facilitate the proposal and approval processes of standards within INCITS CS1 and SC27. This person, however, is retiring.

1.2. Task 3

NIST Special Publication 800-63 Digital Identity Guidelines provides technical requirements for federal agencies implementing digital identity services. The guidelines cover identity proofing and authentication of users (such as employees, contractors, or private individuals) interacting with government IT systems over open networks. They define technical requirements in each of the areas of identity proofing, registration, authenticators, management processes, authentication protocols, federation, and related assertions.

While intended for the Federal government, NIST SP 800-63 revision 3 has had broader impacts on the Identity Ecosystem such as within the international standards community.

OMB Policy Memo M-19-17 assigned the Department of Commerce (NIST) the responsibility for three specific activities for developing new and updating existing NIST guidance related to the Federal Government’s Identity and Access Management Programs. Specifically, OMB M-19-17 directed NIST to:

1. Develop and maintain additional resources to assist federal agencies in the implementation of

NIST SP 800-63 revision 3 and any future revisions and updates.

2. Develop conformance (accreditation) criteria to support the assessment and determination of conformity to the normative requirements and controls for all volumes of SP 800-63-3.

3. Use federal agency feedback to update SP 800-63-3 for revision 4 and future revisions.

The purpose of this task is to obtain support services for NIST activities to align international standards with the scope, technical and procedural requirements, and controls in SP 800-63.

2. Scope The coordination, facilitation, and administrative duties that will be required under this effort are divided into those for a leadership role in the INCITS CS1 and those for a leadership role in the U.S.

Delegation to ISO/IEC JTC1/SC27. The Contractor shall also provide technical support for the NIST international standardization activities to align international standards with the U.S. standards of Special Publication (SP) 800-63 (e.g., ISO/IEC 29115 Entity Authentication Framework).

This task order is under the Cybersecurity and Privacy Support Services (CAPSS) IDIQ and is a hybrid Firm-Fixed-Price (FFP) and Time & Materials (T&M) task order.

3. Tasks All meetings referred to in this Task Order may be in-person or virtual depending on the COVID-19 pandemic and current safety requirements. If travel is required for domestic trips, the contractor will be notified at least 3 weeks in advance of the start of the meeting. If travel is required for international trips, the contractor will be notified at least 6 weeks in advance of the start of the meeting, or as early as possible if there is a required trip within the first 6 weeks of the Period of Performance (PoP).

3.1. Specific Restrictions:

• The contractor may attend meetings with or without a NIST representative, may participate in discussions, may perform technical work related to standards setting, but may not represent NIST at those meetings.

• The contractor may never express personal opinions on significant policy issues since they might be construed to be official NIST policy, nor may they express opinions on behalf of NIST.

• The contractor does not have the authority to decide on the NIST technical contributions or positions but may be tasked to develop inputs for NIST, with NIST oversight.

https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf

• The contractor attending standards meetings shall identify themselves as such to avoid creating an impression in the minds of the other participants that they are a Government official.

• The government will not pay separate membership fees for contractor organizations to join any listed consortia.

3.2. CLIN 0001 - Task 1: INCITS CS1 Leadership (FFP)

The contractor shall ensure that the “Program of Work” is conducted in a prompt, efficient, and effective manner, in accordance with the objectives, policies, and procedures of the INCITS standards program. The contractor shall provide support services to process the appointment of officers, editors, and liaisons for the committee. The contractor shall conduct scheduling for CS1 and its Ad Hoc group meetings for a full calendar year. The contractor shall ensure administrative meeting arrangements are addressed. The contractor shall notify the INCITS Secretariat to update the Meeting Schedule and Calendar on the INCITS web site. The contractor shall ensure that liaison responsibilities are carried out in a timely manner. The contractor shall also assist in representing the body to other committees and organizations through emails, virtually, and in-person as required by CS1.

The contractor shall plan, convene, and facilitate up to 4 domestic in-person (or virtual) CS1 meetings to serve in a facilitator capacity for the meetings. The contractor shall participate in 1 annual domestic in-person (or virtual) INCITS meeting as an attendee. The contractor shall assist with any administrative requirements of and participate in up to 2 additional virtual CS1-related meetings.

The contractor shall assist with preparing the CS1 Annual Report which provides a high-level summary of the quarterly reports. The contractor shall prepare a presentation on the CS1 Annual Report as required by CS1.

Reporting requirements for the CS1 Chair shall include information about:

• Administrative duties regarding any letter ballots.

• Administrative duties assigned by CS1, such as maintaining mailing lists or recording attendance of meetings.

• Administrative duties such as preparing and forwarding to the INCITS Secretariat press releases or other publicity materials about the subgroup’s “Program of Work.”

• Administrative duties assigned by CS1 regarding committee documents.

• Administrative duties assigned by CS1 regarding meeting notices and agendas.

• Reporting status of international work at each meeting of the subgroup.

• Administrative duties assigned by CS1 regarding the development and distribution of any agendas and schedules.

• Preparing supporting documentation for submission of draft proposed standards to the next higher level.

• Administrative duties assigned by CS1, such as preparing minutes in accordance with requirements shown in INCITS/RD-2 and submitting those minutes to the Secretariat for review and approval prior to distribution to the committee.

• Any requirements by CS1 to send timely warning letters on endangered memberships (“jeopardy letters”).

3.3. CLIN 0002 - Task 2: U.S. Delegation Leadership (T&M- Labor)

1) The contractor employee that served as a facilitator within CS1 shall also serve as a facilitator for the U.S. Delegation to ISO/IEC JTC 1/SC 27. The contractor shall ensure that reports of meetings are submitted to ANSI, the INCITS Secretariat (acting in the role of TAG administrator), and INCITS Subgroups within 30 calendar days of the adjournment of a meeting.

2) The contractor shall facilitate CS1’s approval of U.S. delegations in a timely manner, considering the following:

a. The call for delegates/experts

b. The sufficiency of proposed delegation/experts with respect to the meeting agenda (e.g.

technical knowledge, committee experience, international experience, negotiating skill, the training of new delegates)

3) The contractor shall review ISO/IEC JTC 1 and subgroup meeting resolutions and documents. The contractor shall establish a suspense control (tickler file) for required U.S. comments, technical contributions, and votes.

4) The contractor shall submit to ANSI, through the INCITS Secretariat, a list of approved delegates and experts to meetings of ISO/IEC JTC 1 SCs, JTC 1 WGs, and other external WGs for which the subgroup has Technical Advisory Groups (TAG) responsibility. Each delegate list shall be submitted using the required template (see Appendix D for a sample) and shall contain:

a. Name, business, and email address for each delegate

b. Designation of Head of Delegation (HOD)

c. Designation of chief spokesperson for WG or other WG

5) The contractor shall facilitate through regular email and voice/video communications that cognizant U.S. TAG Chairs, International Representatives (IRs), or TAG Administrators have provided input to the U.S. Delegation.

6) If required by CS1, the contractor shall introduce the U.S. Delegation at international meetings. The contractor shall serve as a spokesperson for all affected entities from the U.S. (industry, individuals, etc.) at international meetings.

7) The contractor shall arrange for delegation caucuses and conduct delegation caucuses as required.

8) The contractor shall facilitate the provisioning of delegation assignments prior to and during meetings.

9) The contractor shall interact via email, in-person meetings, and voice/video communications with other National Body delegations.

10) The contractor shall ensure all delegates are aware of (a) RD-2 Section 5.7.12.2, Participation in International Meetings; and (b) the requirement to be familiar with U.S. positions before any international meetings.

11) The contractor shall travel to (if being held in person) and participate in the Fall and Spring SC27 meetings as the primary coordinator for the U.S. Delegation. The contractor shall assist with any administrative requirements of and participate in up to 2 additional virtual SC27-related meetings.

12) Reporting requirements for the contractor shall include information about:

a) Any responses and contributions prepared in the appropriate format required by the most recent revision of the ISO/IEC JTC 1 Directives.

b) All responses made in accordance with the procedures found in INCITS/RD-2.

c) Any letters prepared for a delegate’s management requesting the delegate’s participation for the TAG Administrator’s signature, when required.

d) Preparing the international meeting report for ANSI, the INCITS Secretariat, and INCITS CS1 as required by CS1 and/or SC27.

3.4. CLIN 0003 - Task 3: National and International Identity Management Standards Development and Advancement (T&M- Labor)

The contractor shall provide technical expertise, strategic advice, facilitation, and leadership in pursuit of the wider adoption and advancement of identity-related standards. Furthermore, to be effective for widely accepted online credentials, identity management standards must be consistent and coordinate in the international community.

3.4.1. Specific Tasks:

1) Support for NIST identity management related standardization activities and goals within the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) Joint Technical Committee (ISO/IEC JTC 1) standards development environment. The contractor shall:

a) Study period contributions including development, analysis, and stakeholder coordination of contributions in the areas of Identity Assurance Framework, Entity Authentication Framework (ISO/IEC 29115), identity related risk management, identity landscape, identity roadmap, and mobile driver’s license.

b) Provide support services to the Government as the Editor and Rapporteur ISO/IEC 29115 (Identity Assurance Framework) as this standard moves into becoming a Draft International Standard (DIS) including: planning and managing meetings to discuss and develop content;

analysis and support for comment disposition; drafting, reviewing, and refining content;

analyzing relevant or supporting standards; reviewing and providing recommendations for adjudication; and attending relevant meetings to advance the updated document.

c) Provide support services to the Government in the review for revision of ISO/IEC 24760 (Framework for Identity Management) Parts 2 and 3 for alignment with ISO/IEC 29115 revision and international adoption.

d) Meeting attendance and support (1 Contractor personnel) at ISO/IEC JTC 1 SC 27 WG 5 (Identity Management and Privacy Technologies) and attendance as needed at online meetings to monitor key issues, take notes, analyze documents and proposals, and assist in resolving issues.

2) Other SDO and Consortia Specifications and Support – Support standards, specifications, and profile development to advance USG/NIST positions within standards consortia addressing identity management issues, protocols, and controls. Specific consortia to be tracked and prioritized for meeting attendance: Open Identity Foundation (OIDF), Fast Online Identity (FIDO), Internet Engineering Task Force (IETF), and Kantara Initiative.

3) International Standards Coordination and Cross-Border Government Engagement – support implementation of cross-border recognition of identity management systems through meeting support, requirements/controls mappings and analysis, developing proposals to demonstrate international cross-border trust for identity management systems to include the United Kingdom and Canada.

3.5. CLIN 0004 – Travel for CLINs 0001-0003

There is the potential for up to five (5) domestic trips and two (2) international trips for Tasks 1 and 2.

Four (4) of the domestic trips will be for CS1 in-person meetings, and one (1) domestic trip will be for an INCITS meeting. There is the potential for up to two (2) international trips for Task 3 for SC27 meetings.

If a meeting is going to be in-person, and therefore requires travel, the contractor will be notified at least three (3) weeks before the start of the meeting for domestic trips and six (6) weeks before the start of the meeting for international trips. If a trip is required during the opening weeks of the period of performance, as much advanced notice will be given as possible.

For the purposes of estimation, at least two (2) of the domestic trips for a 3-day conference should be estimated for a northern California destination, such as San Jose. One (1) international trip for a 5-day conference should be estimated for Auckland, New Zealand.

All travel costs for any in-person meetings will be covered by this CLIN. All travel costs shall be approved by the Contracting Officer’s Representative (COR) in advance of booking. The contractor is responsible for making all travel arrangements for contractor personnel. Travel costs will be paid in accordance with Federal Travel Regulations and the DOC Travel Handbook.

3.6. CLIN 0005 – Task 4: Planning and Reporting (FFP)

3.6.1. Project Work Plan

All work to be accomplished under this task order shall be managed through an Integrated Project Work Plan (IPWP). The contractor shall provide the initial IPWP at the kick-off meeting. NIST will approve the IPWP or provide comments for revision within ten (10) business days of delivery. After the contractor accepts and incorporates the comments, the IPWP will be considered the baseline for the work effort.

The contractor shall provide status on the IPWP monthly and send the updated IPWP to the project stakeholders, to include the Government Contracting Officer’s Representative (COR), Technical Lead and Project Sponsor (optional), as well as the contractor’s Task Order Manager and Key Personnel (optional) at least 3 days prior to the monthly status meeting. The IPWP shall contain Government dependencies highlighted in yellow. Updates to the plan that do not impact the critical path can be resolved at the monthly status meeting as a function of the project plan. Changes that extend the period of performance or impact product delivery (i.e., removing PWS defined deliverables or adding new deliverables) will be addressed. However, no changes may be made to the contract without the Contracting Officer’s approval. All anticipated changes shall be communicated to the Contracting Officer prior to execution of any changes to the Statement of Work and, if approved, will be formally revised by way of a bilateral modification via SF30 form. No work shall be performed outside of the established tasks or obligated funding without formal approval and execution by the Contracting Officer.

3.6.2. Kick-off Meeting

The contractor shall attend one kick-off meeting, held virtually, no later than 10 business days after award of the task order. The kick-off meeting shall be utilized to introduce all members of the contractor’s team, review all task order requirements and deliverables. The contractor shall provide their critical path analysis of the IPWP and the decomposition of the government Work Breakdown Structure (Figure 1) to the level of work packages. The IPWP shall include an identification of contractor resources, deliverables and completion dates, sequence of events, start dates, and duration for each activity.

3.6.3. Monthly status and reporting

In addition to the Monthly IPWP updates described above, the Contractor shall attend a monthly program status meeting to provide a full status of the project using Microsoft Project, or similar application, to the government Program/Project Manager (P/PM), COR, and Project Sponsors. Status shall include task percent complete metrics, burn rate (both current and projected), Cost Performance Index (CPI), and critical path analysis. The burn rate analysis and CPI shall only be determined for the T&M tasks. The Contractor shall provide written impact statements for any event or circumstance that could impact the cost, schedule of project, or quality of the project work. Impact statements are due no later than 1 week after the determination of the impact. At the discretion of the P/PM or COR, the contractor may be asked to conduct a monthly status meeting with the government technical leads and key personnel to resolve issues identified/presented at the standing monthly Program Manager’s meeting.

Figure 1: Government Work Break Down Structure (WBS)

3. Tasks

Task 1 - CS1 Leadership

Quarterly Reports on Activities

Trip/Meeting Reports

Virtual Meeting Reports

Task 2 - U.S. Delegation Leadership

Quarterly Reports on Activities

Trip/Meeting Reports

Virtual Meeting Reports

Task 3 - Identity Standards

ISO/IEC JTC 1 SC 27 Identity Support

Other SDO & Consortia Specifications and Support

International Standards Coordination and Cross-Border Government Engagement

Task 4 - Reporting & Management

Intergrated Project Work Plan

Kick-off Meeting Agenda & Materials

Monthly Status Meetings

4. Deliverables and Performance Requirements Summary

Deliver-able Task Description

Quantity/Media and Performance Standard

Projected Completion Date Monitoring Method

1 1 CS1 Annual report Report in MS Word or Adobe Acrobat that conforms to CS1 standards, policies, and procedures. Report shall be of a professional quality and free of typographical errors. Report is expected to be 5 – 10 pages in length. Electronic copy.

As specified in COR-approved work plan

Tech Lead and COR review

2 1 Presentation on the CS1 Annual Report MS PowerPoint or Adobe Acrobat; up to 10 slides. Electronic copy.

As specified in COR-approved work plan

Tech Lead and COR review

3 1 Quarterly reports per Appendix A Four quarterly reports in MS Word or Adobe Acrobat that resemble the sample template provided in Appendix A. Reports shall be of a professional quality and free of typographical errors. Reports are expected to be 2 – 5 pages in length each.

Electronic copy.

As specified in COR-approved work plan

Tech Lead and COR review

4 1 Trip/meeting report for 4 domestic CS1 in-person (or virtual) meetings per Appendix B

Reports in MS Word or Adobe Acrobat that resemble the sample template provided in Appendix B. One report per trip. Reports shall be of a professional quality and free of typographical errors.

Reports are expected to be 1 - 3 pages in length each. Electronic copy.

As specified in COR-approved work plan

Tech Lead and COR review

5 1 Trip/meeting report for 1 annual in-person (or virtual) INCITS meeting per Appendix B

Report in MS Word or Adobe Acrobat that resembles the sample template provided in Appendix B. Report shall be of a professional quality and free of typographical errors. Report is expected to be 1 – 3 pages in length. Electronic copy.

As specified in COR-approved work plan

Tech Lead and COR review

6 2 Trip/meeting report for 2 international SC27 in-person (or virtual) meetings per Appendix B

Reports in MS Word or Adobe Acrobat that resemble the sample template provided in Appendix B. One report per trip. Reports shall be of a professional quality and free of typographical errors.

Reports are expected to be 1 - 3 pages in length. Electronic copy.

As specified in COR-approved work plan

Tech Lead and COR review

7 2 Tickler file for tracking US comments/tech contributions/votes

Running list kept in MS Office.

8 1 & 2 Meeting reports for virtual meetings per Appendix C

Reports in MS Word or Adobe Acrobat that resemble the template provided in Appendix C. One report per virtual meeting; up to 2 CS1 and up to 2 SC27 meetings. Reports shall be of a professional quality and free of typographical errors. Reports are expected to be 1 – 3 pages in length each.

Electronic copy.

As specified in COR-approved work plan

Tech Lead and COR review

9 3 ISO/IEC JTC 1 SC 27 meeting notes, analysis, and evidence of support

Notes in MS Word / MS PowerPoint.

Notes shall contain at a minimum key talking points from each session of the meeting, attribution, and any “to do” items for NIST. Notes shall be of professional quality and free of typographical errors. This work is not expected to exceed 40 hours for each of the two meetings, not including any potential travel time.

As specified in COR-approved work plan

Tech Lead and COR review

10 3 Evidence of Subject Matter Expert (SME) contributions to different standards development meetings

Evidence shall be in MS Word / MS PowerPoint. Contributions shall be technically accurate, incorporate any NIST feedback, and be free of editorial errors.

Not expected to exceed 10 pages.

As specified in COR-approved work plan

11 3 Evidence of planning and managing meetings to support NIST as Editor and Rapporteur ISO/IEC 29115

Evidence shall be in MS Word / MS Excel / MS PowerPoint / MS Outlook. Agendas and meeting materials for discussion shall be prepared before meeting. Content for biweekly online meetings for document development shall be of professional quality and technically accurate. Expected 4 online ad hoc meetings and 2 in-person meetings of WG5.

As specified in COR-approved work plan

Tech Lead and COR review

12 3 3 Draft International Standard (DIS) Document updates

Shall be in MS Word. Shall address format, content, and substantial changes to draft international standard. New material not expected to exceed 25 pages total.

As specified in COR-approved work plan

Tech Lead and COR review

13 3 Comment compilation and support for comment adjudication for ISO/IEC 29115

Shall be in MS Excel. Not expected to exceed 100 comments total. There shall be 2 full comment disposition documents using ISO format for comments on Draft International Standards (DIS).

As specified in COR-approved work plan

Tech Lead and COR review

14 3 Analyzing relevant and supporting Standards for ISO/IEC 29115

Shall be in MS Excel. Not expected to exceed 10 pages of analysis. Shall be of professional quality, technically accurate, and free of editorial mistakes.

As specified in COR-approved work plan

Tech Lead and COR review

15 4 Integrated Project Work Plan The Project Work Plan shall be delivered no later than 2 business days before the Kick-off Meeting. The Project Work Plan shall include an identification of contractor resources, deliverables and completion dates, sequence of events, start dates, and duration for each activity.

The Work Plan will be available in electronic format.

2 days prior to the Kick-off Meeting

Tech Lead and COR review

16 4 Kick-off meeting agenda and materials Electronic copy of the agenda shall be delivered to the COR at least 2 business

No later than 10 days after award days before the meeting. Agenda is expected to be 1 – 2 pages in length.

17 4 Monthly Status Updates An updated project status in MS Project, MS PowerPoint, or Adobe Acrobat.

Project status is expected to be 1 – 2 pages/slides.

At the specified Monthly Status Meetings

All deliverables shall be provided to the COR and to the task Technical Lead. All materials shall be submitted to NIST via electronic submission and hosted in a NIST centralized repository.

5. Government Furnished Property, Material, Equipment, or Information NIST will provide copies of all relevant documents needed to complete the tasks. NIST will provide laptops and credentials to personnel for this TO.

6. Key Personnel It is expected that this work will require the contractor to assign at least three (3) key personnel.

Contractor Key Personnel shall meet the following minimum qualifications for each of the respective required key personnel positions. The titles of the labor categories given below are not mandatory, except for the Program Manager 2. That labor category is mandatory. The other labor categories are simply examples of titles suitable to the type of work to be performed by the respective key personnel positions. However, all minimum qualifications listed for each position below must be met by the contractor’s respective key personnel. Additionally, all proposed key personnel must meet the minimum qualifications detailed in the IDIQ contract for the labor category the candidate is proposed under.

Technical Subject Matter Expert 3 - The contractor shall have a working knowledge of CS1. The contractor shall have a working knowledge of the JTC 1 Directives and international protocol. The contractor shall have a working knowledge of applicable international issues and U.S. positions. The contractor shall have at least 12 years’ experience in the area of cybersecurity and/or cybersecurity standards.

Technical Subject Matter Expert 3 – The contractor shall have a working knowledge of ISO/IEC JTC 1, and either the IETF or Open Identity Foundation. The contractor shall have specialty knowledge in identity management issues, and preferably a working knowledge of SP 800-63-3.

Program Manager 2 - Task Order Level – The contractor shall meet or exceed the minimums set out in the base contract for this LCAT.

7. Place of Performance The primary place of performance shall be the Contractor’s site or remote work location. All work shall be performed virtually until COVID-19 restrictions have been lifted from NIST’s Gaithersburg campus.

When those restrictions are lifted, meetings may occur at NIST’s Gaithersburg, Maryland, campus.

8. Period of Performance The period of performance is one year from the date of award.

9. Appendix A – Sample Quarterly Report

Dates Covered by this Report: Beginning – Month day, year Ending – Month day, year

Meetings attended during this time period:

1. Meeting title, dates, location/virtual – date meeting trip submitted

2. Meeting title, dates, location/virtual – date meeting trip submitted

Letter Ballots – Were there Letter Ballots during this time period? Yes or No If yes, please list any Letter Ballots prepared, distributed, tallied, or reported out.

1. Letter Ballot on X – prepared, distributed on MM-DD,-YYYY, tallied on MM-DD-YYYY, reported out on MM-DD-YYYY

Mailing Lists – Were any changes made to the mailing lists during this period? Yes or No If yes, please list the number of changes:

1. Number of additions to list –

2. Number of deletions from list –

Press Releases and/or Publicity Materials – Were any press release and/or publicity materials prepared and sent to the INCITS Secretariat during this period? Yes or No If yes, please list titles with the date sent to the Secretariat.

1. Press Release on X, MM-DD-YYYY

2. Press Release on Y, MM-DD-YYYY

Committee Documents – Were any committee documents registered, controlled, and/or distributed during this period? Yes or No If yes, please list the documents:

1. Document A – registered on MM-DD-YYYY; distributed on MM-DD-YYYY

2. Document B – registered on MM-DD-YYYY

Agendas – Were any 28-day or 14-day agendas developed during this period? Yes or No If yes, please list dates covered.

1. 28-day agenda for MM-DD-YYYY to MM-DD-YYYY

Draft proposed standards – Was any documentation developed for draft standards being submitted to the next higher level? Yes or No If yes, please list the standards documentation was developed for:

1. Draft Standard A

2. Draft Standard B

Jeopardy Letters – Were any jeopardy letters sent during this period? Yes or No If yes, how many? A total of X jeopardy letters were sent during this period.

Meeting Reports Submitted to ANSI, INCITS Secretariat, and/or INCITS subgroups – Were any meeting reports submitted during this period? Yes or No If yes, please list the meeting name, who the report was submitted to, and the date submitted.

1. Meeting A, submitted to ANSI, MM-DD-YYYY

2. Meeting B, submitted to INCITS Secretariat, MM-DD-YYYY

Tickler File for Required U.S. Comments, Technical Contributions, and Votes – Was the tickler file for U.S. comments, technical contributions, and votes updated during this period? Yes or No

If yes, please attach a copy to this report.

List of Approved Delegates and Experts Submitted to ANSI for Meetings – Were lists of approved delegates and experts submitted to ANSI for meetings during this period? Yes or No If yes, please list the meeting and the date the list was submitted to ANSI.

1. Meeting A, date submitted MM-DD-YYYY

2. Meeting B, date submitted MM-DD-YYYY

New Delegate Responsibilities – Were new delegates made aware of (a) RD-2 Section 5.7.12.2, Participation in International Meetings; and (b) the requirement to be familiar with U.S. positions before meetings? Yes or No

Officers, Editors, and Liaisons – Were any new Officers, Editors, and/or Liaisons appointed for the Committee during this time period? Yes or No If yes, please list the position and date appointed.

1. Editor for Document A, appointed MM-DD-YYYY

10. Appendix B – Sample Trip/Meeting Report

Meeting Covered by the Report Dates of the Meeting Location of the Meeting

Meeting Notices and/or Agendas – Please list any meeting notices and/or agendas prepared for this meeting, including the date distributed.

1. Meeting Notice for the X meeting, distributed MM-DD-YYYY

2. Agenda for the X meeting, distributed MM-DD-YYYY

Meeting Minutes – Were minutes for this meeting taken? Yes or No If yes, please attach a copy to this report.

If yes, when were these minutes submitted to the Secretariat for review and approval? MM-DD-YYYY

Approved Minutes – Were approved minutes distributed to the group? Yes or No If No, why not?

If Yes, please give the date of distribution. MM-DD-YYYY

Attendance – Was attendance recorded by the contractor at this meeting? Yes or No If No, why not?

Other – Please give any other pertinent and important information about this meeting:

Please complete the following only if this was a CS1 meeting.

Reporting of International Work – Was the status of international work reported to CS1 during this meeting? Yes or No

Please complete the following only if this was an international meeting.

Delegation Assignments – Did the contractor provide delegation assignments prior to and during meetings? Yes or No

Delegation Introduction – Did the contractor introduce the U.S. delegation at the meeting? Yes or No If No, why not?

Meeting Report – Was a meeting report submitted to ANSI, the INCITS Secretariat, and the INCITS Subgroup? Yes or No If yes, please list the date of submission. MM-DD-YYYY

Delegate Participation Requests – Were any letters prepared to request participation by delegates for the delegates’ management? Yes or No If yes, how many letters were prepared and sent? X letters were prepared and sent.

11. Appendix C – Sample Virtual Meeting Report

Meeting Covered by the Report Date(s) of the Meeting

Meeting Notices and/or Agendas – Please list any meeting notices and/or agendas prepared for this meeting, including the date distributed.

1. Meeting Notice for the X meeting, distributed MM-DD-YYYY

2. Agenda for the X meeting, distributed MM-DD-YYYY

Meeting Minutes – Were minutes for this meeting taken? Yes or No If yes, please attach a copy to this report.

If yes, when were these minutes submitted to the Secretariat for review and approval? MM-DD-YYYY

Approved Minutes – Were approved minutes distributed to the group? Yes or No If No, why not?

If Yes, please give the date of distribution. MM-DD-YYYY

Attendance – Was attendance recorded by the contractor at this meeting? Yes or No

Other – Please give any other pertinent and important information about this meeting:

Please complete the following only if this was a CS1 or CS1-related meeting.

Reporting of International Work – Was the status of international work reported to CS1 or the subgroup during this meeting? Yes or No If No, why not?

Please complete the following only if this was an international virtual meeting.

Delegation Assignments – Did the contractor provide delegation assignments prior to and during meetings? Yes or No

Delegation Introduction – Did the contractor introduce the U.S. delegation at the meeting? Yes or No If No, why not?

Meeting Report – Was a meeting report submitted to ANSI, the INCITS Secretariat, and the INCITS Subgroup? Yes or No If yes, please list the date of submission. MM-DD-YYYY

Delegate Participation Requests – Were any letters prepared to request participation by delegates for the delegates’ management? Yes or No If yes, how many letters were prepared and sent? X letters were prepared and sent.

12. Appendix D – Sample Delegation List

REGISTRATION FORM

18th ISO/IEC JTC 1/SC 27/WG 5 Meeting

Mexico City, Mexico, 2014-10-20/24

National Body or Liaison Organization of SC 27/WG 5 is kindly requested to complete one copy of this response form for expert(s) planning to attend the 18th SC 27/WG 5 meeting on 2014-10-20/24.

SUBMITTED BY: , US HoD

NATIONAL BODY: USA

This experts roster should be returned to the SC 27 Secretariat as soon as possible but no later than 2014-09-20.

Return to: Secretariat, ISO/IEC JTC 1/SC 27 via the SC 27 e-balloting website at:

http://isotc.iso.org/livelink/livelink/open/jtc1sc27 http://isotc.iso.org/livelink/livelink/open/jtc1sc27

Statement of Work Task Order 34 IDIQ Contract SB1341-12-CQ-0016

List of Experts

18th ISO/IEC JTC 1/SC 27/WG 5 Meeting

Mexico City, Mexico, 2014-10-20/24

Appointed by [1] [2]

Full name of expert + [Mr/Ms]

Participating in projects

(ISO/IEC no, e.g. ISO/IEC 27001)

E-mail Signature

USA

Mr. (Overall US HoD) All Projects

USA

Mr. (US IR) All Projects

USA Ms. (US HoD WG5) All Projects

USA Mr. (Backup US HoD WG5)

All Projects

USA Mr. All Projects

USA Mr. All projects

USA Mr. All Projects

USA Mr. All Projects

USA Mr. All Projects

USA Ms. All Projects

USA Mr. All Projects

USA Mr. All Projects

USA Mr. All projects