Attachment B - Statement of Work.docx

Office for Coastal Management National Ocean Service National Oceanic and Atmospheric Administration U.S. Department of Commerce

Coastal Geospatial Services Contract Statement of Work / Specifications

May 2020

TABLE OF CONTENTS

1.0. Purpose

The National Oceanic and Atmospheric Administration (NOAA) Office for Coastal Management (OCM), hereinafter referred to as the "Government," requires professional geospatial services, in support of various local, state, and regional coastal resource management needs. OCM’s primary areas of technological expertise include geographic information systems (GIS), remote sensing, habitat mapping, data acquisition, hazards resilience, ecosystem services, and training. In its 25 years of existence, the organization has worked with state and other coastal resource managers, academia, non-governmental organizations, and the private sector to address coastal and ocean issues.

Lessons learned and emerging geospatial technologies and information developed from these efforts are shared broadly across the coastal resource management community enabling them to address similar problems. In developing products for its constituents, OCM collaborates with its state and local partners and private industry to address issues such as hazard mitigation, sea level rise, coastal development, habitat restoration, environmental monitoring, and ocean planning.

OCM’s geographic scope is nationwide, including all coastal and Great Lakes states and island territorial jurisdictions. OCM manages NOAA’s Digital Coast which is an enabling platform of actionable information that provides data, tools, and training used by coastal communities to manage and address their coastal issues. OCM works very closely with each state’s coastal zone management program, local governments, non-government organizations, and other Federal agencies to provide solutions to coastal and ocean management issues.

This contract will serve to allow OCM to meet mission requirements to support coastal resource managers in their decision-making processes. This contract will be used by OCM, other NOAA line offices, as well as other Federal, State, and local agencies. All data, geospatial products, and training produced through this contract will be made available publicly through the Digital Coast.

2.0. General

Except for those items specifically identified in individual task orders as Government furnished, the contractor, operating as an independent contractor and not as an agent of the Government, shall furnish all facilities, labor, material, and equipment necessary to provide goods and services in accordance with the terms, conditions, and specifications set forth below. The contractor shall plan, schedule, and coordinate performance of all work associated with task orders in accordance with the requirements described in this SOW and those of the individual task orders. During the performance of the work, the contractor shall provide adequate professional supervision and quality control to assure the timeliness, accuracy, quality, completeness, and progress of the work.

Unless specifically stated otherwise, the term "contractor," as used in this SOW and in the contract, shall be interpreted as the prime contractor.

3.0 Scope

Geospatial services are vital to OCMs mission. The services are highly technical in nature and require specialized technical expertise that necessitates seamless, end-to-end capability. To meet such extensive and critical requirements, NOAA requires contractors to demonstrate full capability and capacity to simultaneously accomplish, and quickly react, to multiple tasks throughout the United States, its possessions, and territories.

Firms must have end-to-end capability to provide all of the below listed services:

1. Lidar and imagery data acquisition using multiple platforms including, but not limited to aerial and satellite systems

2. High-resolution topographic / bathymetric product generation

3. Thematic mapping (e.g., land use / cover, impervious surfaces, wetland and benthic habitats) including training data / ancillary data collection and processing, supervised classification (including data science methods), quality assurance and editing, and accuracy assessment

4. Survey and control services, including, but not limited to, tide and water level stations for tidal datum determination, and airborne Global Positioning Systems (GPS) technology

5. Geospatial Services: geospatial data and map service development, data management, data conversion, data integration, data analysis, data modeling, data visualization,, and cartographic production in support of land use planning; coastal conservation; coastal hazards; marine planning; water quality; and climate change

6. Geospatial Training

A list of required disciplines that the government considers the minimum requirements for the contract can be found in Appendix A. The contractor shall provide fully loaded rates for each of these disciplines in their cost proposal along with a brief description of their requirements for that position. The contractor may provide a description and cost proposal for other disciplines that they would like to make available for this contract. Other disciplines should be cross-walked to the Appendix A list, if applicable. The contractor shall provide only one rate for each discipline that is applicable to the prime and all of the subcontractors.

4.0 General Requirements

Work and Quality Control Plan The contractor shall develop a Work and Quality Control (Work/QC) plan for each task order, unless otherwise directed in that task order, to guide and monitor the product development and delivery.

The Work/QC plan shall include the elements which are critical to the successful completion of that task order. The contractor shall use discretion in evaluating what level of detail will work best for preparing an effective Work/QC plan. At a minimum, the plan shall include the following:

4.1.1 Methods for meeting the specifications of that task order

4.1.2 Methods for maintaining the quality of data and products delivered under the task order

4.1.3 Description of methodologies to be used in product/data development

4.1.4 Description of accuracy assessment methodologies, if applicable

4.1.5 Methods for ensuring consistency between different analysts, if applicable

4.1.6 Schedule for deliverables

4.1.7 Detailed description of tasks

The plan will be reviewed by the government upon receipt from the contractor.

Kickoff Meeting The contractor shall attend a kickoff meeting virtually or at an OCM facility, generally within 30 days of each task order award, unless otherwise specified. This meeting will serve as an information exchange and planning meeting for future activities. The contractor shall prepare an agenda for this meeting with input from the government. The contractor shall take notes and prepare and distribute the minutes of the meeting to all attendees.

Quality Control Quality control (QC) is essential throughout the entire task order process and is solely the responsibility of the contractor. The contractor's quality control system shall, at a minimum, be composed of the basic quality system elements from the ANSI/ISO/ ASQC Q9002-1994, Quality Systems - Model for Quality Assurance in Production Installation and Servicing (or later). The Government reserves the right to inspect all contractor processes and documentation to assess the contractor's compliance with and commitment to the basic Quality System. Acceptance of the final deliverables is contingent upon meeting the requirements stated in the task order. The contractor shall provide the government with documentation that their final product has met the specifications of the task order. The contractor shall document this process and the government shall approve that process prior to task order award. The contractor shall develop a QC plan to ensure that requirements of the contract are met as specified. The contractor shall provide a copy of the Plan to the COR within fourteen (14) days of contract award date. The QC plan will be reviewed and must be approved by the government within 14 days of receipt from the contractor. The contractor shall update the QC plan and provide an updated copy to the COR as applicable.

Records and Metadata Metadata records shall be formatted as machine-readable, syntactically-valid Extensible Markup Language (XML) files based on international standards. Unless otherwise noted in specific task orders, the default encoding for metadata shall be the International Organization for Standardization (ISO) Geographic Metadata Standard. The ISO version currently in effect at NOAA is ISO 19115-2 (2009)10 conceptual model with ISO 19139-2 (2012)11 XML schema.

Required content The metadata records shall contain any and all elements, including those that are considered optional, applicable to the data or data product. The metadata record shall contain sufficient detail to ensure that the data or data product can be fully understood for future use and for posterity. At a minimum, metadata shall include appropriate information on data collection or lineage, data processing, data quality/assurance, data format, geospatial reference information (such as geodetic model, grid coordinate system), and definitions and descriptions of all observations and parameters delivered.

Documentation of data collection methods shall include instrument used and vehicle/platform (such as aircraft) used along with all pertinent information regarding the instrument and platform (such as last calibration).

Metadata for benthic habitat data shall also include all appropriate information per the Coastal and Marine Ecological Standard (CMECS). Information on CMECS can be found on the FGDC website (https://www.fgdc.gov/standards/projects/FGDC-standards-projects/cmecs-folder/cmecs-index- page)and at https://iocm.noaa.gov/cmecs/index.html.

Delivery The metadata records shall be delivered free of errors in both content and format. The metadata records will be subject to review and approval prior to final acceptance by the Government.

Contractor Coordination Communication and coordination between both the contractor and the government is considered vital to the satisfactory accomplishment of each task order. Periodic interaction with government staff must be maintained to ensure clear understanding of the anticipated products and satisfactory progress. The contractor shall provide monthly reports at a minimum discussing the work that had been performed during that reporting period, problems encountered (if any), schedule and deliverable status, and planned work for the next reporting period. The contractor shall schedule teleconferences after issuance of the monthly reports if there is a need to discuss the progress of each project and any issues that may need to be addressed.

In addition, a bi-yearly meeting, either in person or per teleconference may be scheduled by the government with the contractor to discuss their overall performance on the contract.

Key Personnel (Task Orders) The contractor’s Project Manager shall be considered key personnel for the contract (See H.3 of contract). Additional key personnel may be assigned for individual task orders. The Project Manager shall be the contractor’s single point of contact for general matters concerning the contract. The contractor may assign a task order manager to individual task orders; however, the Project Manager will have the overall responsibility of meeting the requirements of the contract.

Quality Assurance The government will review all task order deliverables for quality, accuracy, timeliness, and completeness. The government will assess if satisfactory progress is being made and determine if the task order is on schedule for planned completion. If during the government Quality Assurance (QA) process the deliverables are found to not meet the requirements of the task order, the contractor shall correct the deficiencies and re-deliver the deliverable at no additional cost to the government.

Laws, Regulations, Procedures and Permits The contractor shall comply with all applicable laws, ordinances and regulations and procedures (federal, state, county, city, or otherwise) and shall be responsible for obtaining all necessary permits for work performed under the contract and shall include all costs, if any, of such compliance in the prices quoted in its proposal.

Travel The contractor is responsible for the planning, coordination, and funding of travel for its employees in support of the performance of requirements outlined in each task order. The government expects that some travel will be necessary in order to meet the specifications of most task orders; however, it is not mandatory. The contractor shall separately indicate travel expenses in each task order cost proposal.

Contractor Confidentiality The contractor shall have access to government data and information during the contract period. The contractor shall not use, for any purpose outside the terms of the contract, proprietary raw data. The contractor shall not distribute processed data and derived products developed for the government in connection with this contract prior to quality review and acceptance by the government.

Contractor Innovation The contractor shall remain alert to possible improvements in technical methods and administrative procedures used to provide products under the contract. The contractor shall propose such improvements to the government and obtain concurrence prior to implementing a change.

Deliverables Specific deliverables will be outlined in the individual task orders. All deliverables shall meet all applicable international, national and Federal information technology and geographic information standards, particularly those identified by the Federal Geographic Data Committee (FGDC) as supporting the National Spatial Data Infrastructure (NSDI). Product deliveries shall meet defined schedules. All deliverables, including Monthly Reports, shall be submitted using OCM’s Task Order Management and Information System (TOMIS).

IT Security Requirements

The base IDIQ/BPA contract is awarded without acquiring any information technology and/or service(s), but serves as a vehicle to order acquiring information technology and/or service(s); therefore will not be using either government owned systems or contractor owned systems.

a) For this base IDIQ/BPA, the Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

b) For this base IDIQ/BPA, the Contractor shall not access any Furnished Equipment (GFE) or access Government IT systems for this effort.

c) For this base IDIQ/BPA, the Contractor shall not access any Government Furnished Information (GFI) that is not within the public domain for this effort.

Each task order shall include its own statement of work or equivalent and the required Information Security in Acquisitions Checklists. All task orders will also require an IT Security review and assessment to determine what IT Security requirements are applicable.

Acquisition Risk Acceptance for using Contractor Owned Equipment

The Contractor shall provide a description of how they secure their contractor owned equipment being used for this acquisition. The Contractor shall use the IT Security Questionnaire (titled: Information and Information Systems Security Requirements for Acquisitions) to assist in their response.

a) The Contractor can request assistance from the government assigned Information System Security Officer (ISSO) in describing how they secure their equipment. The IT Security Questionnaire developed following National Institute of Standards and Technology (NIST) Special Publications (SP) 800-53 Revision 4 Security and Privacy Controls for Federal Information Systems and Organizations.

b) The Contractor shall disclose any third-party independent assessments and/or audits conducted on the cloud computing services that make up this acquisition as part of their response.

c) The government shall evaluate the contractor’s response to the questions and determine the potential contractor’s information security risk to the Government. If the Government determines the information security risk to be acceptable, the Authorizing Official will document their acceptance in a risk acceptance memo.

Protecting Information

The Contractor shall guarantee strict confidentiality of the information/data when the Government identifies Government Furnished Information/data and/or information/data generated during the performance of the task order is of a sensitive nature. Disclosure of the information/data, in whole or in part, by the contractor can only be made after the contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the contract, the contractor shall obtain a written determination from the Contracting Officer. The Contractor shall agree not to publish or otherwise divulge such information in whole or part, in any manner or form, nor to authorize or permit others to do so. The Contractor shall take such reasonable measures as are necessary to restrict access to such information while in the contractor’s possession, to those employees needing such information to perform the work provided herein, e.g., on a “need to know” basis.

The Contractor shall ensure all contract deliverables where information technology used to create deliverables and Information Technology and/or service(s) provided to the Government in performance of the contract complies with Supply Chain Risk Management requirements. The Contractor shall provide for itself and any proposed subcontractors the information required for the Government to perform a supply chain risk assessment.

To the greatest extent possible, the contractor shall scan all electronic information/data/software passed to/from NOAA with multiple commercial malicious software detection and removal products (e.g. anti-virus software, anti-malware, anti-spyware, etc.) prior to use by either entity. To the greatest extent possible, the contractor shall ensure the electronic information/data/software provided to the Government is free of known malicious software.

The Contractor shall work with the COR prior to sending the deliverables to determine if they need to be transferred in a secure manner. The Contractor shall protect sensitive information and/or non-public information from unauthorized disclosure and/or modification. The Contractor shall work with the Government assigned Information System Security Officer (ISSO) to determine the applicable sensitive security requirements. The Contracting Officer shall add the following privacy related contract clauses (FAR 52.224-1 and FAR 52.224-2) to this contract and these apply to both electronic and hardcopy information/data. The Contractor shall comply with the DOC Personally Identifiable Information (PII), Business Identifiable Information (PII), and Privacy Act Breach Response and Notification Plan. The Contractor shall contact the government assigned ISSO immediately upon detection and/or notification of a breach of PII and/or BII.

If secure transfer is required, the Contract shall ensure no sensitive information is sent using a non-encrypted format. The Contractor shall implement transmission and storage of sensitive information to meet or exceed the National Institute of Standards and Technology (NIST) Federal Information Processing FIP3 Security Requirements for Cryptographic Modules using validated cryptographic module(s). Specifically the body of the email shall not contain sensitive information unless it is encrypted. The Contractor options for sending sensitive information includes a file encrypted with a password or passphrase using a product like WinZip or using DOC Secure File Transfer solution. The Contractor shall encrypt any sensitive information that will be sent electronically (e.g., email), sensitive information includes but not limited to:

a) Personally identifiable information (PII), sensitive PII and/or Business-identifiable information (BII),

b) Non-public information and/or data,

c) Information that requires Government approval prior to release to the public,

d) All information describing the implementation, configuration, settings, etc. (including Information Technology (IT) configuration, IT management, IT security (includes security incidents (reporting, handling and mitigation) and security assessment documentation), IT administration, IT architecture, IT network management including firewall management and/or information obtained while performing privileged access roles),

e) The source code and database schema,

f) The vulnerability scanning, secure baselines scanning and/or mitigation results,

g) The secure baseline deviations,

h) Internet Protocol, subnet mask and similar identification,

i) System or component inventory information (hostname, IP address, MAC address, location, operating system, etc.).

The Contractor shall use one of the methods for secure destruction of unclassified but sensitive information recommended by either NIST Special Publications 800-88 Guidelines for Media Sanitization (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) or the National Security Agency in the Media Destruction Guidance (https://www.nsa.gov/resources/everyone/media-destruction/) upon the termination of this contract.

APPENDIX A

IfSAR Specialist

Additional Contract-Identified Labor Types

* Certifications are considered specialties and do not substitute the requirement for licensure. Licensing is a legal act on the part of states to protect the public health, safety, and welfare.

**Relevant experience may be substituted for educational requirements with approval of COR as follows:

· Master's = Bachelor’s degree + 2 years’ experience relative to the specific position or 6 years’ experience relative to the specific position.

· Bachelor's = 2 years of college + 2 years’ experience relative to the specific position or 4 years’ experience relevant to the specific position.

· Associate's = 1 to 2 years of experience relative to the specific position.

· Professional and technical certification programs may be substituted for years of education, based on credit hour equivalents.

***One (1) Project Manager shall be designated as Key Personnel at the base contract level.

Acronyms

ISO International Organization for Standardization