Attachment 2_NAIS_AK_PWS_7.2.26 Draft.docx

PERFORMANCE WORK STATEMENT FOR

NATIONWIDE AUTOMATIC IDENTIFICATION SYSTEM AND VERY HIGH FREQUENCY/DIGITAL SELECTIVE CALLING SUPPORT SERVICES IN ALASKA

1.0 General

1.1 Background

The United States Coast Guard’s (USCG) Nationwide Automatic Identification System (NAIS) enhances maritime domain awareness with a focus on improving security, navigational safety, search and rescue, and environmental protection services. NAIS is based on the Automatic Identification System (AIS), a technology sanctioned by the International Maritime Organization (IMO) as a global standard for ship-to-ship, ship-to-shore, and shore-to-ship communications.

NAIS uses digital VHF waveforms to continually transmit and receive voiceless data. The system combines received AIS data—such as vessel location, source, and speed—with other government information to form a holistic view of maritime traffic. This allows decision-makers to better respond to safety and security risks.

In addition to receiving vessel data, the NAIS network also provides the critical capability to transmit messages from shore-based stations to AIS-equipped vessels. These shore-to-ship transmissions support essential U.S. Coast Guard missions by disseminating safety and security-related messages, broadcasting virtual Aids to Navigation (AtoN), and issuing other mission-specific advisories to vessels operating in the waterways of Alaska. This two-way communication strengthens national security by allowing the USCG to actively manage and influence the maritime domain.

In addition to NAIS, the USCG operates Rescue-21 (R-21) Alaska, an emergency communications network that includes radio systems, core processing and dispatch systems, remote fixed facilities (RFFs), and operator consoles at USCG Sector Command Centers (SCCs). The system is an unclassified IT system that interfaces with Very High Frequency (VHF) Frequency Modulated (FM) radios that are standard for maritime communications and aboard Coast Guard assets, providing short range communications with commercial and recreational mariners, Coast Guard assets, and Federal, State, Tribal, and Local partner agencies in support of all Coast Guard missions. It is used to maintain a channel 16 guard, command & control, and broadcast information on navigational conditions within the region. R-21 Alaska also includes Digital Selective Calling (DSC) capabilities. This effort seeks to augment existing R-21 Alaska coverage to address geographic "dead zones" and areas suffering from long-term infrastructure outages.

1.2 Scope

The purpose of this PWS is for the U.S. Coast Guard (USCG) to obtain comprehensive Automatic Identification System (AIS) services, VHF-FM maritime voice communications, and DSC (data) communications for designated regions and ports of Alaska, 24 hours a day, 7 days a week.

This contract covers four primary functions:

1. AIS Data and Maintenance Services: The contractor shall provide, manage, and maintain a network of terrestrial AIS sites to ensure the continuous reception of vessel data. This data will be delivered to the USCG to support maritime domain awareness.

2. AIS Transmission Services: The contractor shall provide the capability for the USCG to transmit messages from shore-based stations to AIS-equipped vessels. These transmissions will support navigational safety, security notifications, environmental alerts, and the broadcast of synthetic and virtual Aids to Navigation (AtoN).

The AIS data and transmission capabilities will be used by the USCG and shared with other Government agencies to support missions including maritime safety, security, environmental protection, and search and rescue.

3. VHF-FM Maritime Voice Communications: The contractor shall provide, manage, and maintain VHF-FM capabilities to ensure the continuous reception and transmission of VHF communications (VHF CH16) between shore-based stations and vessels in Alaskan waterways beyond the existing Rescue-21 Alaska coverage areas.

4. DSC (data) communications: The contractor shall provide, manage, and maintain DSC capabilities (CH 70) to ensure continuous reception of DSC data in Alaskan waterways beyond the existing Rescue-21 Alaska coverage areas.

1.3 Contractor Personnel

1.3.1 Project Manager. The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this contract. The Project Manager is further designated as Key by the Government (see PWS 1.4).

a) The Project Manager shall be a single point of contact for the Contracting Officer and the Contracting Officer’s Representative (COR). It is anticipated that the Project Manager shall be one of the senior level employees provided by the Contractor for this work effort. The name of Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak and understand English. They shall also possess basic computers skills, the ability to produce reports required in PWS paragraph 1.15 utilizing Microsoft Word and Adobe Acrobat, and a general knowledge of AIS data, systems, and standards

b) The Project Manager shall be available to the COR via telephone between the hours of 0800 and 1700 (Alaska Time), Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within two (2) hours of notification.

1.3.2 Qualified Personnel. The Contractor shall provide qualified personnel to perform all requirements specified under this Contract. All Contractor employees under this contract shall be citizens or legal residents of the United States.

1.3.3 Employee Identification. Contractor employees visiting Government facilities shall wear an identification badge that, at minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

1.3.4 Removing Employees for Misconduct or Security Reasons. The Government may, at its sole discretion, direct the Contractor to remove any Contractor employee from USCG facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under any contract awarded. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

1.3.5 Conflict of Interest. The Contractor shall not employ any person who is an employee of the United States Government if that employment would or would appear to cause a conflict of interest.

1.4 Key Personnel.

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance and provide the name and qualifications of any proposed substitute(s). The Contractor shall not replace Key Contractor personnel without acknowledgment from the Contracting Officer. The Government may designate additional Contractor personnel as Key at the time of award.

1.5 Security

Contractor access to operationally sensitive information is required under this contract. Contractor and/or sub-contractor’s employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and government policy and regulation. Additionally, the contractor shall abide by all industrial security requirements below and included in the Industrial Security Addendum attached to this PWS to include security requirements contained in any policies, directives, and instructions referenced in the attached addendum.

(1) Contractor employee access to Controlled Unclassified (for-official-use-only) Information (CUI) is required under this contract.

(2) The government may require the contractor employee to complete a minimum background investigation (NACI) at government expense if the employee does not already have a qualifying background investigation on record sufficient to obtain a government issued common access card (CAC).

(3) Contractor personnel shall read, complete and sign the Department of Homeland Security Non-Disclosure Agreement – DHS Form 11000-6 (series). This form will be maintained on file by the Contracting Officer or servicing CG Command Security Officer.

(4) DHS Instruction 121-01-007 Personnel Security, Suitability, and Fitness Program states that waivers to the U.S. citizen requirement may only be granted by the Head of the Component or designee with the concurrence of both the DHS CSO and CIO or their designees.

(5) The contractor’s facility security officer (FSO) shall provide a visit authorization letter (VAL) to the place of performance at least five business days in advance of commencing work. The VAL shall identify all contractor employees requiring access to the job site. Questions concerning VAL requirements shall be directed to C3CEN’s Command Security Officer at (757) 638-2673.

(6) All contractor employees working on-site shall be required to complete a security arrival brief upon check-in.

(7) All contractor personnel requiring routine (1) unescorted logon access to a DHS/CG Computer Information System, (2) unescorted access to CG controlled classified material, (3) unescorted access to federal facilities, or (4) requiring Public Key Infrastructure (PKI) authentication to perform their required duties under this contract/task order shall be issued a Common Access Card (CAC). A completed background investigation (BI) with favorable adjudication must be completed in order for a CAC to be issued. For persons without a completed BI, a BI must have been initiated.

(8) Contractor or subcontractor employees who are declined a CAC via Trusted Associate Sponsorship System (TASS) are ineligible to perform work that requires a CAC under this contract/task order.

(9) When an employee with a CAC is no longer performing work under this contract/task order, the employee must surrender the CAC to the COR or the company project manager on the same day the employee stops working. Additionally, the COR will immediately advise the servicing Command Security Officer of the sponsoring unit.

In all cases, the CAC shall be delivered to the COR no more than five business days following the departure of the employee.

(10) Contractor’s employees shall comply with all applicable government regulations, policies and procedures, e.g., security, safety, sanitation, and environmental protection when visiting or working at government facilities. The contractor shall ensure contractor employees present a professional appearance at all times and that their conduct shall not bring discredit on the United States, the Department of Homeland Security or the U.S. Coast Guard. The contractor employee shall not release any government personnel contact information or information concerning official unit business or operations to unauthorized parties.

(11) The government may, at its sole discretion, direct the contractor to remove any contractor employee from Coast Guard and Department of Homeland Security facilities for misconduct or security reasons. Removal does not relieve the contractor of the responsibility to continue providing the services required in this contract/task order.

The government will provide the contractor with an immediate written explanation of the request to remove the employee through the Coast Guard KO.

(12) All contractor developed processes and procedures, and other forms of intellectual property developed under this contract/task order shall be considered government property.

(13) All documents, records, reports and correspondence generated under this contract/task order by the contractor employee are the property of the U.S. government.

Any disposal or destruction of such material must be pre-approved by the COR.

(14) The contractor employee shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, the contractor employee shall secure work areas, equipment and materials to prevent loss.

(15) The government is the only source for media release information. The contractor employee shall not provide any government-related information to the media and shall refer all queries to the COR or KO.

(16) Contractor access to CUI is required under this contract. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with DHS MD 11042.1, “Safeguarding CUI/FOUO information.” CUI includes information categorized by DHS or other government agencies as: For Official Use Only (FOUO); Official Use Only (OUO); Sensitive Homeland Security Information (SHSI); Limited Official Use (LOU); Law Enforcement Sensitive (LES); Safeguarding Information (SGI); Unclassified Controlled Nuclear Information (UCNI); and any other identifier used by other government agencies to categorize information as sensitive but unclassified. The Contractor shall sign a non-disclosure agreement (NDA) (DHS Form 11000-6).

(17) The contractor shall implement procedures whereby any loss, compromise, or suspected loss or compromise of sensitive but unclassified information or material issued under this contract is promptly reported to the designated Contracting Officer Representative (COR). The COR shall provide a complete report of the loss to the servicing USCG Command Security Officer and Contracting Officer.

(18) Contractor employees granted access to USCG IT systems shall adhere CG information system rules and regulations to safeguard government information. All contractor IT equipment interconnected with NAIS will be hardened, at a minimum, per DHS 4300 hardening guidelines, appropriate Government hardening guidelines (i.e. STIGS, DOD 8500.1, or etc.), or per the appropriate National Institute of Standards and Technology (NIST) operating system checklist, which can be found at: http://checklists.nist.gov/ or per specific waivers to hardening guidelines requested, documented, and approved by appropriate ISSM.

1.5.1 The contractor shall protect all data and information systems in order to maintain confidentiality, integrity, and availability, in accordance with DHS Sensitive Systems Policy Directive 4300A, the NIST SP 800-53 minimum security controls, and FIPS 199 Security Categorization. The Contractor shall ensure that all connections meet the requirements of the highest categorized system.

1.5.2 Both organizations will ensure that virus and spyware detection and eradication capabilities are used where appropriate (for example, workstations, laptops, servers, and so forth.) and that adequate system access controls are in place and maintained on all components connected to the systems.

1.5.3 All remote access connections are monitored by the Coast Guard Cyber Command Network Operations & Security Center (NOSC) 24/7. The NOSC monitors, handles and reports incidents in accordance with DHS 4300A Sensitive Systems Handbook Attachment F, Incident Response and Reporting. All security incidents will be reported to the system ISSOs. NAIS security personnel will take appropriate steps to isolate and respond to such incidents, in accordance with their respective incident response procedures.

1.5.4 For incidents determined to be significant in nature, the respective System Owner or Program Officer will be notified, and a formal incident report will be submitted to the Coast Guard Cyber Command Network Operations & Security Center (NOSC). NOSC can be contracted via phone: (866) 424-2478/(703) 313-6422 or email: CGCYBER-SOC@uscg.mil. The designated counterparts will receive formal notification in writing within five days after the detection of the incident.

Both parties are responsible for auditing system security events and user activities involving interconnection. Activities that will be recorded include:

· Event Type

· Date and Time of Event

· User Identification

· Workstation/Server Identification

· Success or Failure of Access Attempts

· Security Actions taken by SAs or ISSOs.

1.5.5 Audit logs will be retained for 90 days on-line and be available for at least one (1) year.

1.5.6 Data received from the government per this contract must only be used for the stated purpose as defined. Secondary dissemination is prohibited. A new request must be submitted and approved prior to using the data for purposes other than those already stated in this contract. Any unauthorized redistribution or retransmission of data received under this agreement will result in suspension of the connection per DHS policy 11005.

Requests for data received per this user agreement, made to the contractor from entities outside of the contractor’s Network, will be forwarded to the USCG.

1.5.7 All hardware, software, and services provided must be compliant in accordance with 140-01 Information Technology Systems Security and the DHS Sensitive Systems Handbooks 4300A or 4300B.

1.5.8 Access to Unclassified Facilities, Information Technology Resources, and Sensitive Information.

a) The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information, describes how Contractors must handle sensitive but unclassified information. DHS MD 140.01 Information Technology Systems Security and the DHS Sensitive Systems Handbook prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering contractors that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the Contractor except as specified in the contract.

1.6 Performance Requirements Summary

This contract includes a Performance Requirements Summary (PRS) which plays an integral role in the administration of the contract. The PRS shall serve as a primary tool for inspection and acceptance of services. Evaluation of the Contractor’s overall performance shall be in accordance with the performance standards set forth below.

1.7 Period of Performance

The period of performance for this contract is:

1.8 Place of Performance

The primary place of performance will be at the Contractor’s facilities.

1.9 Hours of Operation

The contractor shall provide data 24 hours a day, 7 days a week. Scheduled outages for routine maintenance shall be announced to the COR and USCG CYBER NOSC at least 3 calendar days in advance and will not count against operational time. Unscheduled outages shall be reported to USCG CYBER NOSC and COR within 2 hours of detection.

1.10 Travel

The contractor is responsible for any travel necessary for routine preventative or emergency corrective maintenance to the Contractor’s equipment or data network, or for any network surveillance to fulfill the service terms of this contract. The Government will not reimburse the Contractor for travel to the primary place of performance. All travel required by the Government outside of these activities will be reimbursed to the Contractor in accordance with the Federal Travel Regulations (FTR). The Contractor shall be responsible for obtaining prior COR approval (electronic mail is acceptable) for any reimbursable travel to include a budgeted amount in advance of each travel event.

1.10.1 Coordination of Field Visits

The Contractor shall be responsible for ensuring all visits to the USCG units and Third-Party Sites are properly coordinated with the Contracting Officer’s Representative (COR) and Site Owner or Point of Contact prior to travel.

1.10.2 AIS and VHF-FM/DSC Site Locations

The Contractor shall provide Automatic Identification System (AIS) data services within all regions/ports of Alaska as well as offshore out to 2000nm and beyond. The regions/ports of Alaska currently covered by the US Coast Guard are shown in the figures that follow:

Figure 1 Current AIS Sites owned by the US Coast Guard The Contractor shall provide VHF/FM and DSC services within all regions/ports of Alaska as well as offshore out to 20nm where coverage US Coast Guard coverage doesn’t currently exist. The regions/ports of Alaska currently covered by the US Coast Guard are shown in Figure 2.

Figure 2 Current VHF Site Coverage Owned by the US Coast Guard In addition to extending the coverage shown in Figure 2, areas of higher priority are as follows:

· Sector Southeast Alaska

· Petersburg

· Wrangell (including the Wrangell Narrows)

· Craig

· Klawock

· Pelican to Sitka

· Sector Western Alaska

· Knight Island Pass

· Old Harbor – Kodiak

· East of Cordova to Copper River Delta

· Naknek & Egegik

· Northern Cook Inlet

· Other areas

· North Slope

1.11 Kick-Off Meeting

The Contractor shall attend a Kick-Off Meeting via teleconference with the Contracting Officer, the COR and Sponsor Representative (SR) NLT five (5) business days after the date of award. The purpose of the Kick-Off Meeting, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's project plan. The Kick-Off Meeting will be held via teleconference.

1.12 Project Plan

The Contractor shall provide a draft Project Plan at the Kick-Off Meeting for Government review and comment. The Contractor shall provide a final Project Plan to the COR not later than 5 business days after the Kick-Off Meeting.

1.13 Status Reports

The Project Manager shall provide a monthly progress/availability report to the Contracting Officer, COR, and the SR via electronic mail. This report shall include a summary of all Contractor work performed, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations from the previous month.

1.14 Status Meetings

The Project Manager shall be responsible for keeping the Contracting Officer and COR informed about Contractor progress throughout the performance period of this contract and ensure Contractor activities are aligned with USCG objectives.

1.14.1 At minimum, the Project Manager shall review the status and results of contractor performance with the COR monthly by email.

1.15 General Report Requirements

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with Coast Guard Standard Workstation (Windows 11 and Microsoft Office 365 Applications).

1.16 Data Rights

All documentation, electronic data, processes and procedures and/or other forms of information generated by the Contractor in support of this contract/task order shall be considered Government property and shall be provided to the Government at the end of the performance period in accordance with FAR Clause 52.227-14 in a format accessible and usable by the Government.

1.17 DHS Enterprise Architecture Compliance

All solutions and services shall meet DHS and USCG Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security Enterprise Architecture (HLS EA) and USCG EA requirements:

· All developed solutions and requirements shall be compliant with the HLS and USCG EAs.

· All IT hardware and software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile and with the USCG IT Products and Standards Inventory.

· Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to USCG Enterprise Data Management Office (EDMO) and DHS EDMO for review, approval and insertion into the USCG and DHS Data Reference Model and Enterprise Architecture Information Repository.

· Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01, and all data-related artifacts will be developed and validated according to DHS data management architectural guidelines.

· Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

2.0 Government Furnished Resources

The Government will provide the following to the Contractor for work required under this contract:

2.0

2.1 Interconnect Support Agreement (ISA) for Contractor signature.

2.2 Computer(s), Power Distribution Units (PDU), Uninterruptible Power Supplies (UPS) and software with network connections to accept data from unique network port numbers for each AIS receiver and convey data to the NAIS servers.

2.3 Standby backup computer(s) and software with uninterruptible power system with network connections to accept data from each AIS receiver and convey data to the NAIS servers during failure of primary computer(s).

2.4 For Contractor Furnished VHF-FM/DSC operator consoles, the Government shall provide scheduling and coordination for installation, testing, and training in each of the two Sector Command Centers.

2.5 Points of contact at USCG NOSC, C5I COR, and C5I Service Center KO.

2.6 Instruct Contractor staff on how to connect / maintain data feeds.

3.0 Contractor Furnished Property

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in section 2 of this PWS. These services shall include technicians to install, troubleshoot, maintain, and test furnished equipment, software, and connections to the AIS receiver network. The Contractor will be required to house USCG interconnection hardware and software, including climate control and power.

For VHF-FM/DSC, the Contractor shall furnish and install a standalone operator console in each of the two Sector Command Centers.

4.0 Requirements

The Contractor shall provide a comprehensive Automatic Identification System (AIS) data and transmission services package and VHF-FM/DSC communications services for 7 Geographic Regions of Alaska. This service will support United States Coast Guard (USCG) and other government agency missions by providing real-time and historical AIS data and access to VHF-FM/DSC communications in gapped areas of Alaska.

4.1 AIS Data Reception Services

4.1.1 Regional Coverage: The Contractor shall provide AIS data services from sensor/receiver sites along coastal Alaska, with locations approved by the USCG to meet mandated regional coverage.

AIS Type 1 refers to vessel stations with antenna height of at least 10 meters and nominal transmit power of 12.5 watts.

AIS Type 2 refers to vessel stations with antenna height of at least 1 meter and nominal transmit power of 2.0 watts.

4.1.2 Site List Modification: The USCG may modify the list of AIS sites at any time to improve regional coverage without incurring additional costs.

4.1.3 Data Access: The Contractor shall provide the Government with access to all AIS data collected from all available receiver sites in the regions identified.

4.1.4 Data Feed & Formatting: The Contractor shall provide an AIS data feed as defined in the Interconnection Service Agreement (ISA). Each receiver site’s AIS data shall be uniquely identified as specified in the ISA. The Contractor shall not alter the AIS data format without prior written consent from the Contracting Officer's Representative (COR).

4.1.5 Receive Coverage Maps: The Contractor shall provide AIS receive coverage equal to or greater than the baseline coverage demonstrated at time of proposal submission. In addition, the contractor shall provide actual receive coverage maps to demonstrate track data collected from existing AIS receiver sites. Receive coverage maps shall clearly identify known gaps in coverage.

4.2 AIS Transmission Services

4.2.1 General Mandate: The Contractor shall provide Automatic Identification System (AIS) transmission services from shore-based stations to AIS-equipped vessels in designated regions/ports of Alaska. AIS transmission services shall support USCG and other government missions including maritime safety, security, navigation, environmental protection, and domain awareness.

4.2.2 Transmission Capabilities: The system shall transmit standard AIS messages from shore-based stations to AIS-equipped vessels. Users must be able to control the content of messages, select recipients (either specific vessels or all vessels in a geographic area), and determine the timing of transmissions, including one-time, manual repeat, or automatic repeat at user-defined intervals.

4.2.3 Message Types Supported: The system shall support transmission of safety and security-related text messages, interrogation and channel assignment messages, binary application messages, Application Specific Messages (ASMs), Geographic Notices (GNs), Advisories (GAs), and synthetic and virtual AtoN broadcasts. The Contractor shall ensure that all message types are available for transmission in accordance with USCG policies and operational requirements.

4.2.4 Aids to Navigation (AtoN) Transmissions: The system shall be capable of transmitting synthetic and virtual Aids to Navigation (AtoN) messages as required by the Government and must fully support these broadcasts in accordance with USCG policies and operational requirements. To facilitate this, the system shall allow for unlimited access to transmit from all designated AIS ATON sites (Physical Shore Stations).

4.2.5 User Access and Management: The Contractor shall provide login accounts for up to twenty (20) individual users, each with audit trail capability. System privileges shall be configurable based on user roles and responsibilities. The Contractor shall provide training to ensure users can fully utilize the AIS transmission management system.

4.2.6 Transmit Coverage Area and Performance Standards: The Contractor shall ensure transmission coverage and performance as follows:

AIS Type 1 refers to vessel stations with antenna height of at least 10 meters and nominal transmit power of 12.5 watts.

AIS Type 2 refers to vessel stations with antenna height of at least 1 meter and nominal transmit power of 2.0 watts.

4.2.6 AIS Transmit Coverage Maps: The Contractor shall provide predictive AIS transmit coverage maps showing the areas in which transmitted AIS messages from AIS shore transmitters are expected to be successfully received by AIS equipped vessels. Transmit coverage predictions shall include the propagation model used, antenna height and gain, transmit power, transmission path losses, vessel receiver characteristics, terrain, and assumed thresholds. Transmit coverage maps shall clearly identify known gaps in transmit coverage. In addition, coverage maps shall clearly identify areas where transmit coverage exists without corresponding receive coverage, or where receive coverage exists without corresponding transmit coverage.

4.3 VHF-FM/DSC Requirements

4.3.1 Coverage Area and Performance Standards: The Contractor shall ensure VHF-FM/DSC coverage and performance as follows:

4.3.2 Radio and Frequency Specifications

a) VHF Capabilities Frequency Range: The system shall support VHF operation within 156-162 MHz.

Channel Guard: The system shall provide a continuous, uninterrupted guard for voice calls on VHF Channel 16 and for Digital Selective Calling (DSC) on Channel 70.

Channel Modes: Radios shall be capable of operating in the following modes:

· 25 kHz Analog Wideband

· 12.5 kHz Analog Narrowband DSC Support: The system shall support a dedicated DSC radio at each remote site, with the ability to compose, transmit, and receive calls formatted in accordance with ITU Rec-493.13.

b) Communications Coverage and Performance Coverage Standard: The system shall provide receive coverage for a 1-watt signal transmitted from 2 meters above the water out to 20 nautical miles offshore. (OBJECTIVE) Simultaneous Operation: The system shall be capable of receiving simultaneously on Channel 16 and one other channel, and shall continue receiving on Channel 16 even when another circuit is transmitting.

Line of Bearing (LOB): The system shall provide a single line of bearing with an accuracy of +/- 2 degrees. (LOB is OBJECTIVE) Operator Console: The system shall have standalone operator consoles in each of the two Sector Command Centers capable of receiving and sending calls.

c) Data Processing and System Integration Recording and Archiving: All voice transmissions shall be automatically recorded from the call start point to the call end point in the clear, time-stamped, and archived. For DSC calls, the system shall record the Maritime Mobile Service Identifier, latitude and longitude coordinates, and the status of the DSC call (distress, urgency, safety, or routine). The system shall store recordings for a minimum of 30 days and provide a method for maintaining a three-year archive.

Interoperability: The system shall be capable of patching Public Switched Telephone Network (PSTN) calls with radio circuits. The system shall provide open systems architecture for connection to future Coast Guard information systems. (OBJECTIVE)

4.4 System-Wide Requirements

4.4.1 System Availability & Maintenance: The Contractor is responsible for all maintenance required to meet the operational availability thresholds for the entire AIS system including regular vulnerability scanning, patch management, software and/or firmware updates. The following availability standards shall be maintained and calculated monthly: a regional composite operational availability (Ao) of 96% or better for each geographic receiver region; an individual site availability of 96% or better for each of the 120 key receiver sites; and an operational availability (Ao) of 96% or greater for all transmission sites. Site Availability will be calculated using the formula: (Total site up time) / (Total site up time + Total site down time – Scheduled maintenance time), with the result rounded down to one-tenth of a percent (e.g., 95.97% becomes 95.9%).

4.4.2 IT, Network & Support: An Interconnection Support Agreement (ISA) between the Government and the Contractor must be signed prior to connecting data sources to the Nationwide Automatic Identification System (NAIS). The Contractor shall establish and maintain a connection to the C5ISC Detachment in Kearneysville to ensure the Government receives the data feed, and this connection interface to the USCG demarcation point shall be maintained at 96% availability; any network outages will count against site availability calculations. Furthermore, the Contractor shall actively monitor its site connections and provide a technical representative to assist with remote troubleshooting. The required response time for reports of technical problems is within two (2) hours during business hours (Monday-Friday, 0800-1700 Alaska Time) and within eight (8) hours at all other times.

4.4.3 Contractor Personnel Cybersecurity Awareness Training Requirement: The Contractor shall ensure that all personnel, including subcontractors, who access Department of Homeland Security (DHS) information systems or handle DHS information, complete annual Cybersecurity Awareness Training in accordance with DHS and federal requirements. Training must be completed prior to system access and annually thereafter. The Contractor shall maintain records of training completion and provide documentation to the Contracting Officer or designated representative upon request.

4.4.4 Data Governance, Management & Compliance: The Contractor shall manage all system data in accordance with the following governance and compliance standards. The system must allow for unlimited access to transmit from all designated AIS ATON sites (Physical Shore Stations), and the Contractor shall maintain a database of all transmitted messages with access to message history and reporting features.

The Contractor is required to notify the Government as any newly commissioned transmission or receiver sites become operational. AIS data may be shared with other Government agencies (OGAs) in real-time or as historical data to support government missions; however, OGAs receiving live data are prohibited from re-sharing it, a restriction that must be documented in a signed Memorandum of Understanding/Agreement (MOU/MOA), a copy of which the Government will provide to the Contractor within 90 days of signing. Furthermore, all AIS data shall be made publicly available after 96 hours at no additional cost to the Government. Real time data will not be shared with non-government entities that may profit from its use.

Finally, all transmissions and system operations must comply with the most current versions of all applicable standards, including but not limited to International Maritime Organization (IMO) standards, ITU-R Recommendation M.1371-5, IEC 61162-1, NMEA 0183, and all USCG and DHS information assurance and security requirements.

4.4.5 Cyberspace Workforce Qualification and Management: The Contractor shall ensure that all personnel performing cyberspace workforce functions comply with the qualification and management requirements outlined in DOD Manual 8140.03, "Cyberspace Workforce Qualification and Management Program." Personnel shall possess appropriate certifications, training, and credentials as specified in the manual for their assigned roles. The Contractor shall maintain records of workforce qualifications and provide documentation to the Contracting Officer or designated representative upon request. The Contractor shall promptly notify the Contracting Officer of any changes in personnel qualifications or status.

4.4.6 Right to Audit: The Government reserves the right to conduct on-site inspections, audits, and security control assessments of the contractor's facilities, information systems, and security controls used in the performance of this contract to ensure compliance with the specified security requirements. This includes the right to review all relevant documentation, such as the System Security Plan (SSP), Plans of Action and Milestones (POA&M), and incident response plans.

These assessments may be conducted by Government personnel or a Government-designated third party. The contractor shall provide access to its facilities, personnel, documentation, and systems at reasonable times and as necessary for the Government to carry out these assessments. The Government will provide reasonable advance notice of any planned on-site inspection or assessment. Any findings of non-compliance may result in a request for corrective action, and failure to resolve such findings may be considered a breach of contract.

4.4.7 Reporting & Performance Evaluation: The Contractor shall provide monthly status reports detailing operational availability, message transmission statistics, and the status of all sites. To accompany these reports, all monthly invoicing must clearly document the operational availability of individual sites and the composite availability calculated for each geographic region.

For annual performance evaluation, the Government will document the annual cumulative average availability for Contractor Performance Assessment Reporting System (CPARS) records. This annual cumulative average is calculated by summing all regional operational availability (Ao) calculations and dividing by the total number of regions. Performance will be evaluated according to the following 3-tier scale:

4.4.8 Scheduled Maintenance Exception: Site downtime for scheduled maintenance will not count against availability thresholds if the COR is notified via email at least 3 business days in advance with a description, date, and expected start/end times for the maintenance.

4.4.9 Supply Chain Risk Management Requirement: The Contractor shall implement Supply Chain Risk Management (SCRM) practices to identify, assess, and mitigate risks associated with the procurement, delivery, and support of products and services provided under this contract. The Contractor shall ensure compliance with applicable federal and Department of Homeland Security (DHS) SCRM regulations and policies, including but not limited to: FAR 52.204-23, FAR 52.204-25, DHS Instruction 110-01-004, and NIST SP 800-161. The Contractor shall promptly report any identified supply chain risks, incidents, or vulnerabilities affecting contract deliverables to the Contracting Officer or designated Coast Guard representative. The Contractor shall cooperate with government assessments and audits related to supply chain security and provide documentation of SCRM practices upon request. The Contractor shall ensure that all subcontractors and suppliers comply with these SCRM requirements.

4.4.10 Secure Decommissioning and Data Sanitization: The Contractor shall ensure that all systems, hardware, and data associated with the NAIS are securely decommissioned at the end of their lifecycle or upon termination of the contract. Secure decommissioning activities shall include, but are not limited to:

1. Data Sanitization:

· All sensitive data, including Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), and For Official Use Only (FOUO) data, shall be securely erased from storage devices using methods compliant with NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization).

· The Contractor shall provide a certificate of sanitization for each device to the Contracting Officer Representative (COR).

2. Hardware Disposal:

· All hardware components, including servers, storage devices, and network equipment, shall be disposed of in accordance with DoD 5220.22-M standards or equivalent.

· The Contractor shall coordinate with the COR to ensure proper disposal methods, including physical destruction or recycling through approved vendors.

3. Software Decommissioning:

· All software licenses, configurations, and system settings shall be securely removed or transferred to the Government as directed by the COR.

· The Contractor shall ensure that no residual software or system configurations remain on decommissioned hardware.

4. Documentation and Reporting:

· The Contractor shall provide a Decommissioning Report to the COR detailing all sanitization, disposal, and decommissioning activities.

· The report shall include the following:

· The Contractor shall maintain a documented chain of custody for all hardware and data during the decommissioning process to ensure accountability and prevent unauthorized access.

6. Compliance Verification:

· The Government reserves the right to audit the decommissioning process to verify compliance with the above requirements.

5.0 References

5.1 National Marine Electronics Association (NMEA) 0183, STANDARD FOR INTERFACING MARINE ELECTRONIC DEVICES, most current version per the International Standards. Government will not provide this standard. It is available for purchase from NMEA. This standard defines the data structure used by certified AIS equipment and the USCG NAIS I-2 network. In particular, the NAIS I-2 network uses the TAG Block features in addition to the basic AIS equipment’s sentence structures.

5.2 ITU-R Recommendation M.1371 most current version per the International Standards, TECHNICAL CHARACTERISTICS FOR A UNIVERSAL SHIPBORNE AUTOMATIC IDENTIFICATION SYSTEM USING TIME DIVISION MULTIPLE ACCESS IN THE MARITIME MOBILE BAND. This is the standard that defines in detail how the AIS works, and is the primary AIS standard. It can be downloaded electronically from ITU.

5.3 DHS Management Directive (MD) 11042.1 Safeguarding Sensitive But Unclassified (For Official Use Only) Information

5.4 DHS MD 140.01 Information Technology Systems Security and the DHS Sensitive Systems Handbook

5.5 FIPS 140-2 and FIPS 197 Advanced Encryption Standard (AES) 256 encryption compliance

5.6 Computer Security Act of 1987 (40 U.S.C. 1441 et seq.)

5.7 Government Information Security Reform Act of 2000

5.8 Federal Information Security Management Act of 2002

5.9 OMB Circular A-130

5.10 DHS Sensitive System Policy Publication, 4300A (7.2 dated April 20, 2010)

5.11 Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135)

5.12 Title 6, Code of Federal Regulations, Part 29

5.13 Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520

For information on acquiring copies of references, you may contact the Contracting Officer.

6.0 Deliverables

7.0

IT Security Plan Outline

1. Introduction

· Purpose: Define the purpose of the IT Security Plan and its role in ensuring the security of IT resources developed, processed, or used under the contract.

· Scope: Specify the scope of the plan, including systems,…