Attachment 5_PWS_12760426Q0137.pdf

Performance Work Statement (PWS) USDA/Forest Service

Phoenix NextGen 2023 Conversion to Linux SBC National Infrared Operations (NIROPS)

March 3, 2026

1.0 Background

The USDA Forest Service, National Infrared Operations (NIROPS), operates the Phoenix airborne infrared mapping systems in support of wildland fire incident response.

Under prior BPA 12760423Q0195, modernization efforts were initiated to migrate the Phoenix NexGen system from a Windows-based environment to a Linux-based embedded Single Board Computer (SBC) platform integrated with Sheldon Instruments’ SBC/DSP/ADC architecture.

Approximately 75% of software modernization tasks were completed and accepted.

Hardware fabrication and full system-level integration were not completed prior to expiration of the period of performance.

This effort represents a logical continuation to complete the Phoenix NexGen Linux SBC modernization and achieve operational deployment of Phoenix NexGen.

2.0 Scope of Work

The Contractor shall provide all labor, materials, equipment, supervision, and technical expertise required to complete the remaining development, hardware fabrication, integration, and validation of the Phoenix NexGen Linux SBC system.

The work includes:

2.1 Completion of Software Modernization (Remaining ~25%)

Finalize and fully integrate the following previously initiated tasks:

A. Log streaming stabilization and anomaly handling

- Logging of quantized data as it comes in, which will help improve stability as opposed to the current massive dump at the end of the run.

B. Expand file compatibility between platforms

- Cross-platform file compatibility (.BIL generation from .PLF) validation.

Enable .BIL file generation from the .PLF logfile so old logfiles can be used or in case of a crash, recorded data can be used to create the orthorectified files.

C. Real time orthorectification

- Final optimization of orthorectification for Linux on ARM SBC and Xilinx DSP hardware.

D. Add diagnostics on various data sets

- Final implementation and validation of diagnostics to prevent data-driven crashes.

2.2 Hardware Fabrication

The Contractor shall:

E. Fabricate and assemble the SI-DRA-SBC compact computer system with

- M.2 hard drive slot(s).

- Provide low-noise interface support card for analog, digital sync, and ethernet inputs.

- Perform production SI-DRA-SBC hardware bring-up and integrate Phoenix

NexGen application.

3.0 Support & Maintenance.

F. Maintenance support through the period of performance.

- Provide support and maintenance of the Linux embedded system such as upgrades, software bugs, and any other problem focused operational maintenance issues.

4.0 Acceptance Testing

(a) Upon completion of work and no later than 30 calendar days prior to the end of the performance period, deliver the modernized Phoenix NexGen application, source code, libraries and install binaries through Version Controlled system or other mutually agreed to platform to the Technical Manager and coordinate the schedule for acceptance testing with the FS Technical Manager.

(b) Inspection and acceptance will be performed at the National Infrared Operations office within the National Interagency Fire Center located at 3833 S Development Avenue, Boise, ID 83705.

(c) Acceptance testing for the Phoenix NexGen will be conducted on the functionality and performance on a Phoenix NexGen mockup and/or airborne platform and must demonstrate:

1. Successful execution of the Phoenix NexGen application with the production SI- DRA-SBC hardware

2. Sustained capture and processing of 200 scan lines per second

3. Orthorectification without degradation of prior functionality while maintaining operational workflow

4. User-selectable RAW data logging

5. Successful completion of a test mission with stable operation and without fault or crash

5.0 Period of Performance

The effective period of this contract is from date of award through a time slot set to 12 months period.

6.0 Place of Performance

Work shall be performed at the Contractor’s facilities.

7.0 Rights in Data

All source code, firmware, NIROPS develop schematics and circuitry associated with the Phoenix NexGen system remain the intellectual property of the United States Government.

The Contractor shall not use, publish, or disseminate information resulting from work performed under this contract without prior written approval from the Contracting Officer.

8.0 Quality Assurance

Acceptance will be based on system-level functional demonstration and validation by the Forest Service Technical Manager.

Services must meet the performance criteria defined in Section 4.0.

9.0 Deliverables

Deliverable Description Due

Production SI-DRA-SBC Hardware

Fabricated and assembled SBC/DSP/ADC system

Prior to acceptance testing

Phoenix NexGen Executable

Fully integrated embedded Linux software

Prior to acceptance testing

All Current Source Code All source code, libraries and install binaries

Prior to final acceptance.

Delivered via Version Control System

System Demonstration Live integration and performance validation

Coordinated

Final Acceptance Documentation

Delivered upon successful testing After final acceptance

10.0 PAYMENT

Payment for services and deliverables shall be made under this contract upon completion of the work required in accordance with FAR 52.212-4(i) and submission of a proper invoice.

11.0 INVOICES

(a) Invoices in support of the US Forest Service shall be submitted to the following:

The Contractor must follow the instructions on how to register and submit invoices via the Department of Treasury’s Internet Payment Platform (IPP) as prescribed in the previous communications from USDA and Treasury. All invoices are to be submitted via the electronic invoice processing platform. This is a mandatory requirement initiated by the U.S. Department of Treasury and you can find more information at this website https://www.ipp.gov/index.htm. Please make sure that your company has registered at https://www.ipp.gov/vendors/enrollmentvendors.htm to establish your account.

(b) The Contractor shall attach an original invoice and all required supporting documentation (travel reports & receipts) to the IPP invoice. A proper invoice shall include –

(1) Name and address of the Contractor

(2) Invoice date

(3) Contract number and the task order number

(4) Description, quantity, unit of measure, unit pricing and extended price of the items delivered

(5) Terms of any prompt payment discount offered

(6) Name and address of official to whom payment is to be sent; and

(7) Name, title, and phone number of person to be notified in event of defective invoice

(c) Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C.

3909) and Office of Management and Budget (OMB) Circular A-125, Prompt

12.0 Security

Note: SEE APPENDIX D for the USDA Cyber Supply Chain Risk Management (C-SCRM) Contract Language, which must be included in ALL IT contracts.

1. SECURITY LANGUAGE FOR ALL CONTRACTS

https://www.ipp.gov/index.htm

Section 1 By accepting this contract/agreement, the Contractor/Cooperator and other external organizations (hereafter called Contractor) providing Information Technology (IT) resources or services to the US Forest Service (FS) agrees to comply with the applicable IT security policy as outlined in this document. The Contractor and other external organizations will be responsible for IT security for all systems connected to the FS network or operated by the Contractor and other external organizations for the FS, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or electronic access to FS sensitive information that directly support the mission of the FS. The term “information technology,” as used in this clause, means any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by OMB Circular A-130.

The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

The Contractor or other external organization will not publish or disclose in any manner, without the FS Contracting Officer’s written consent, the details of any programs, documentation, data, or safeguards either designed or developed by the Contractor or other external organization under this Contract or otherwise provided by the Government. The Contractor may be required to sign non-disclosure or other appropriate security agreements. A written agreement between the FS and any contractors and other external organizations will be entered into before FS data and information otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The Contractor and other external organizations will agree to establish and follow security precautions considered by the FS to be necessary to ensure proper handling of data and information. As may be identified elsewhere in this contract, the Contractor agrees that:

• The draft and final deliverables and all associated working papers and other materials deemed relevant by the COR that have been generated by the Contractor in the performance of this contract are the property of the U.S. Government and must be submitted to the COR at the conclusion of the tasks.

• All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor’s or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of FS information.

Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements, and rendering other assistance as deemed necessary.

If new or unanticipated threats or hazards are discovered by either the Government or the Contractor or other external organization, or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the other party. The Contractor will report real or suspected incidents or violations immediately upon discovery to the USDA Computer Incident Response and Recovery Branch (CIRRB), by e-mail, at cyber.incidents@usda.gov.

The Contractor shall insert these clauses in all subcontracts when the subcontractor is required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled system. Failure to comply with said requirements will constitute cause for termination.

If a system of record on individuals is required by a system to accomplish an agency function, the Contractor will be required to design, develop, or operate a system of records on individuals subject to the Privacy Act of 1974, Public Law 93-579, December 31,1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

The Contractor Agrees To –

(a) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—

(i) The systems of records; and

(ii) The design, development, or operation work that the contractor is to perform;

(b) Include the Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(c) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract that requires the design, development, or operation of such a system of records.

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

Definitions include:

(a) “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

mailto:cyber.incidents@usda.gov https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fuscode.house.gov%2Fbrowse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3&data=04%7C01%7C%7C7244ba25b77f4be12aa408d93bfaf14a%7Ced5b36e701ee4ebc867ee03cfa0d4697%7C0%7C0%7C637606771256949694%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=VbE6huKqM1L2ncIqqFcseWt5L6qsT1rL%2B1LJ50F%2B5mw%3D&reserved=0

(b) “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(c) “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

(d) “Personally Identifiable Information", as used in this clause, means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A-130, Managing Federal Information as a Strategic Resource).

The FS will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract.

Completion of a FS-developed or FS-conducted training course shall be deemed to satisfy these elements.

The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.

The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will-

(a) Have access to a system of records;

(b) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

(c) Design, develop, maintain, or operate a system of records.

The contractors and other external organizations will ensure that the following banner is displayed on all FS systems that contain Privacy Act information operated by the contractors and other external organizations prior to allowing anyone access to the system:

“This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93-579). Any privacy information displayed on the screen or printed must be protected from unauthorized disclosure. Employees who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both.”

1. CONTRACTORS/COOPERATORS REQUIRE BUILDING ACCESS AND/OR

INFORMATION SYSTEM ACCESS

Section 2 IT Security Training: The Contractor and other external organizations will ensure that its employees performing under this contract fulfill all Forest Service requirements for mandatory security and privacy awareness and role-based advanced security training in accordance with OMB Circular A-130, FISMA, and NIST requirements, and sign all applicable FS statements of responsibilities.

Background Investigations: All non-government employees with unescorted access to FS facilities, computer systems and/or FS information must have background investigations commensurate with the level of risk and magnitude of loss or harm. The FS will determine the level of background investigation and position classification needed.

Personal Identity Verification of Contractor Personnel: The Contractor shall be responsible for ensuring compliance by its employees with all applicable federal regulations, to include those of GSA, NIST, USDA, FS and HSPD-12. Contractors and their employees are subject to all Federal laws applicable to Government installations and are under the jurisdiction of the Federal Protective Service (FPS). The Contracting Officer Representatives (CORs; also known as Contracting Officer Technical Representatives), or other designated program/project officers, in conjunction with the FS HCM HSPD-12 staff, will assist the Contractor in processing the required Security Background Investigations/Clearances.

(1) The Contractor shall comply with the personal identity verification (PIV) policies and procedures established by U.S. Department of Agriculture (USDA) Directives 3800 series.

(2) Should the results of the PIV process require the exclusion of a Contractor’s employee, the Contracting Officer will notify the Contractor in writing.

(3) The Contractor must appoint a representative to manage this activity and to maintain a list of employees eligible for a USDA PIV ID Badge required for performance of the work.

(4) The responsibility of maintaining a sufficient workforce remains with the Contractor.

Employees may be barred by the Government from performance of the work should they be found ineligible or to have lost eligibility for a USDA PIV ID Badge. Failure to maintain a sufficient workforce of employees eligible for a USDA PIV ID Badge may be grounds for termination of the contract.

(5) The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have access to a federally controlled facility or system.

(6) The PIV Sponsor for this contract is the Contracting Officer Representative (COR), unless otherwise specified in this contract. The PIV Sponsor will be available to receive contractor identity information from * (hours and days) to * (hours and days) at * (office address for registration). The Government shall notify the Contractor if there is a change in the PIV Sponsor, the office address, or the office hours for registration.

(7) At this time, the Government will pay for and process all required security investigations/clearances, except as identified differently within this clause.

(8) The Contractor should be aware of any of its employees possibly having had a background investigation through another government agency. The investigation that was conducted, if verifiable by the FS HSPD-12 staff, and if it was completed within the last 5 years, can be accepted by the Government in lieu of a background check.

(9) The Contractor shall comply with any facility badging requirements for the issuance of building access, badges, etc.:

• Ensure that each of the Contractor’s employees has been issued either a temporary or permanent badge from the Government. A permanent badge will not be issued until the security questionnaire has been completed and favorably reviewed. Temporary or visitor badges will be provided for persons who are identified as having an infrequent or temporary legitimate business need for access to the site. As noted above, periods that exceed 180 days will require a permanent badge. The badge must be worn at all times while in the facility. It must be displayed above the waist. The individual will retain possession of the badge as long as continued admittance to the site is needed.

• Ensure the safekeeping, wearing, and visibility of Government-furnished badges.

• Immediately return all badges and permits to the Government when such need ceases to exist.

(10) The Contractor shall comply with any facility security requirements for access to the facility.

(11) The Contractor shall comply with all applicable rules governing parking at USDA locations.

Section 3

Secure Coding Skills: Contractor certifies that at least one member of each programming team working on any code (including C, Java, .Net, ASP.NET, Visual Basic) to be delivered to the Forest Service has earned the Global Information Assurance Certification for Secured Software Programming or equivalent.

Source code testing, binary code testing, application scanning, and penetration testing:

At least one week prior to delivery of any code due under this contract, Contractor will deliver to the COTR the following reports covering all code that will be delivered:

A. Source code testing results showing all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief

Information Officer of USDA. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.” The Contractor must then correct the vulnerabilities, resend the code, and ensure the health of delivered source code.

B. For web applications, web application scanning test results showing all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.”

C. For all applications: application penetration results.

Copyright Management and Responsibility: By delivering applications or programming code to the Federal Government, the vendor or Contractor certifies that they have the proper authority to transfer the property and will defend the Government against copyright or other lawsuit resulting from the application or programming delivered.