Attachment J - Sample Work Orders.pdf

Work Order 1-1400.01.01 Agency Cybersecurity Architecture, Engineering, and Technical Standards

Year of Work: FY 2020

Description

Funding Organization: V WOR Org: V OCIO Code: V Funding Type: AMO

Period of Performance:

10/01/2019-09/30/2020

Customer Overall Objectives/Specific Work Requirements:

The Cybersecurity Standards and Engineering Team (CSET) supports the Agency OCIO under the Chief Cybersecurity Engineer/Architect. The CSET group supports the NASA CIO in ensuring that NASA's information assets are configured and managed in a manner consistent with Federal policies, procedures, and legislation and that the Agency's Information Resources Management strategy is aligned with NASA's vision, mission, and strategic goals.

CSET provides this support through: developing Agency cybersecurity standards, roadmaps, and technical reference architectures; providing cybersecurity engineering and technical consultancy; and supporting NASA projects, programs, and missions in providing technical cybersecurity requirements and designs to meet objectives.

Overall Objective: Agency-wide cybersecurity standards (per NASA NPR 7120.10)

• Provide up-to-date research and systems expertise in the areas of cybersecurity, distributed systems, virtual computing, collaboration, networking, cloud, applications and others, to be applied and integrated into NASA's cybersecurity standards.

• Deliverables:

o Produce NASA's cybersecurity standards, handbooks and specifications (in the STD, HBK and SPEC 2600 series) as required.

o Research, recommend, promote, advertise, and revise Agency cybersecurity standards for Windows, UNIX, Apple computing systems, cloud/SaaS, networking, applications and data management of Agency/Center CIO initiatives.

o Deliverables: Attend, and when possible participate in, appropriate Federal and Private Sector conferences, presentations, and working groups to remain current on the evolving IT landscape efforts aimed at managing cybersecurity risk to support NASA's mission, enabling integration of business (mission) processes and information across organizational boundaries, achieving efficiencies and ensuring that IT is efficiently and securely implemented through the successful application of technical standards.

Overall Objective: Agency Security Configuration Standards and related Compliance Content

• Lead the NASA Agency Security Configuration Standards (ASCS) Project to ensure NASA compliance with system configuration requirements of the Federal Information Systems Management Act (FISMA).

• Deliverables:

o Author, solicit and incorporate stakeholder feedback, and route through established governance channels for the Agency SAISO approval of Security Configuration Specifications in the STD, HBK and SPEC 2600 series as required.

o Create, maintain, and support compliance content that utilizes or feeds into the Agency CDM Toolset to accurately measure target system compliance with ASCS Specifications.

o Evaluate, establish and maintain processes for implementation, and facilitate deployment and auditing of Security Configuration Specifications for NASA by engaging with the appropriate cybersecurity service provider and adhering to processes defined in ASCS OLAs.

o Maintain NASA Membership in the CIS.

o Assist with related Agency IT Security initiatives and incorporate security into CSET standards and other deliverables.

o Maintain an awareness of other federal agency posture and efforts. Communicate with federal and Agency peers to leverage inter- and intra-agency knowledge, lessons learned and resources regarding platform-specific security and compliance information.

Overall Objective: Enterprise Cybersecurity Architecture: Support development and maintenance of an Agency Cybersecurity Architecture

• CSET's cybersecurity architecture scope includes assisting in the execution of the vision, strategic direction, and initiative roadmap for Agency technology projects; defining the reference and implementation architectures for strategic, business, and technology projects; and providing technical guidance to Agency and Information Technology (IT) leaders on the architectural direction for strategic technology projects.

• Deliverables:

o Maintain an awareness of and make contributions to the overall NASA IT Enterprise Cybersecurity Architecture effort.

o Track and provide consultation on the development of the cybersecurity architecture. Maintain an in-depth awareness of the NASA IT Enterprise Cybersecurity

Architecture and identify opportunities for leveraging the standards and cybersecurity architecture in support of the NASA Enterprise IT Architecture.

o Assess enterprise technologies for their ability to integrate into the NASA environment by engaging Agency Stakeholders and applying an Assessment Framework. Recommend technologies that will maximize NASA's investment by having the greatest overall impact to the environment. Propose any necessary modifications to the environment to accommodate recommendations.

o Develop actionable blueprints, principles, models, designs, standards and guidelines for assigned projects/initiatives to ensure information technology architecture is consistent, usable, secure and adds value to the Agency.

Overall Objective: NASA 7120.7 Project support:

• CSET's engineering responsibilities include significant support of NASA 7120.7 projects with cybersecurity engineering and development.

• Deliverables:

o Develop and deliver to assigned projects the appropriate requirements and design packages during the life of the project.

o As requested, provide a presence at critical Agency working groups and supporting (or participating as) System Engineering Review Team (SERT) members for IT-related Agency projects that align with the goals of CSET. This requires consulting, attending teleconferences and face-to-face meetings as necessary, monitoring mailing lists and discussion forums, reviewing documents and completing other action items as required.

Overall Objective: Desktop Smartcard Integration (DSI) and Identity, Credential, and Access Management Engineering (ICAM) Support:

• Facilitate NASA's continued compliance with Federal ICAM initiatives including Homeland Security Presidential Directive 12 (HSPD-12) and OMB-11-11 (Continued Implementation of Homeland Security Presidential Directive Policy for a Common Identification Standard for Federal Employees and Contractors).

• Deliverables:

o Provide leadership in the areas of smartcard integration and compliance with federal computer security configuration regulations contained in NIST SP 800-53.

o Provide investigation, integration, and cybersecurity testing necessary to ensure that selected infrastructure and components (including but not limited to: smartcard readers, smartcard middleware, device drivers, public key infrastructure clients, system configurations, etc.)

o Provide engineering support for technologies involving ICAM Device Integration, and oversight of authentication and authorization components. This includes: smartcard and other secure element related implementations; PKI trust anchor management;

single-sign-on; derived credentials; trusted application site reference management; and other duties as needed by NASA OCIO ICAM Service Executives.

Overall Objective: Testbed Maintenance: Maintain the CSET System Security Plan, the associated dev-test facility (ETAF), and associated services.

• CSET's test facilities are an important and integral part of the team's ability to produce meaningful and technically sound results. The timely administration, maintenance, continual improvement, and overall security of these facilities are critical

• Deliverables:

o Support necessary system configuration, application testing, and network services to ensure that CSET group recommendations and other Agency efforts are based on sound technical solutions.

o Identify opportunities for improving the dev-test environment.

o Ensure both the security and availability of the environment for evaluating and testing the integration of services into the NASA environment.

o Develop and Maintain IT Security Plans and Risk Assessments for all testbed systems.

o Provide expertise in Microsoft Windows, MacOS, Linux, and associated hardware technologies, especially as they relate to providing enterprise-wide cybersecurity solutions.

Overall Objective: CSET Office Management: In collaboration with the CSET Program Manager, ensure the efficient operations of CSET business functions.

• Deliverables:

o Track and maintain CSET hardware, software, and services inventory.

o Initiate and track purchase requests, and maintain the data in a searchable manner that will expedite data calls, automate warranty and software renewal notifications, and ensure compliance with Center and Agency asset tagging, location, and verification requirements.

o Assist in tracking the Project Management actuals by creating phasing plans, tracking workforce data, and responding to data calls as required.

o Ensure reporting obligations to PACE, Center, and Agency channels or dashboards are met in a timely and professional manner.

o Ensure that CSET communications are professional, consistent, and support a positive group identity to effectively advertise and promote the technical standards and work products as established by CSET.

Additional Support: Provide critical analysis of existing NASA Cybersecurity posture and services relative to their integration into the NASA infrastructure.

• Deliverables: Respond to ad-hoc requests for information and consulting to the Agency Cybersecurity and Privacy Program and the Agency OCIO.

Detailed Deliverables:

Work Order

Milestone / Deliverable Title / Description

Original Due Date

Revised Due Date

Actual Delivery Date

Comments

1400.01.01 ASCS Specification Release FY20R1

01/31/2020

Release to contain novel and updated specifications pre-requested by the Customer and agreed upon as achievable in the release timeframe

1400.01.01 ASCS Specification Release FY20R2

07/31/2020

Release to contain novel and updated specifications pre-requested by the Customer and agreed upon as achievable in the release timeframe

1400.01.01 Maintain NASA Membership in the CIS

04/30/2020

1400.01.01

Support the development of templates, processes and feedback loops to ensure security operations informs policy

01/01/2020

Per the CSPP Program Plan Goal 4 “Security Architecture”, this is the expected outcome of “Develop Agency-wide security architecture to manage complexity while meeting strategic goals”

1400.01.01

Support the weekly reporting requirements to both the GRC OCSS and the Agency OCIO IT Leadership Dashboard

Weekly

Work Order 1-1400.01.02 Security Training and Support

Funding Organization: VR WOR Org: VR OCIO Code: VR Funding Type: AMO

Task Summary:

The Information Technology Security Awareness and Training Center (ITSATC) is responsible for providing agency-wide IT Security training, awareness activities and products. The focus of task

1400.01.02 is to provide the technical expertise and support for the agency-wide IT Security training initiatives and program operated from NASA Glenn. The subtask below describes and defines the particulars of the current efforts and deliverables. This work will enable NASA to continue its efforts in safeguarding computer resources by enhancing IT Security awareness, knowledge, and skills across the Agency.

Overall Objectives:

The PACE IV contractor shall provide a Work Order Manager and Support Staff team for the development, implementation, procurement, research and reporting of Awareness, Training and Education in support of the Agency IT Security. This includes the development of specific course content as agreed upon. Administrative support shall be provided for the planning, advertisement, scheduling of online and instructor-led training, and reporting of training metrics for vendor procured secure web coding and other ITS procured courses for Agency participation.

The PACE IV Work Order Manager will provide support in the form of oversight of the contractor support staff to include managing the completion of tasks within the ITSATC Program and reporting task status and deliverables to the NASA Program Manager. The PACE IV Work Order Manager will lead and assign all work to the PACE IV support staff, provide support in the form of project management of the workflow and monitor the progress and status of projects contained within the Microsoft Project Plan document, which captures all work. It is understood that the NASA PM and PACE IV Work Order Manager as well as the support service contractor staff will use mutually respectful communications.

The primary work will be to:

• Support Agency-wide IT Security Awareness and Training Center (ITSATC).

• Compile reports as agreed upon and provide to ITSATC Program Manager.

• Support all information requests for initial discovery and implementation for Office of Cyber Security Support (OCSS)

• Submit weekly project updates delivered to the ITSATC Program Manager.

• Manage and assign all workflow related to task projects.

• Update and develop training courses and provide recommendations to the Program Manager when significant changes must be made.

• Utilize multimedia technology and authoring tools to complete deliverables

• Determine appropriate method of delivery based on need, requirements, cost and budget

• Procure training, materials and videos as requested

• Track online annual awareness training and instructor-led training for Vendor training participation by NASA Centers

The PACE IV support staff for the 1400.01.02 task will provide computer application services including the following:

• Organize data to facilitate preparation of reports and data analysis

• Prepare spreadsheets, tables, charts, and graphs to present metrics and other data as requested

• Act as an Agency Administrator for IT Security Training for the Learning Management System (SATERN) and extract data from NASA's Learning Management System (SATERN) database as required

• Collect and post materials to Agency website

• Facilitate Monthly Agency-wide webinars to include all workflow aspects

• Maintain the project management files

• Extrapolate data from vendor data tools to gather test scores and completions

Specific Work Requirements & Deliverables: Dates could be subject to change upon mutual agreement, unanticipated urgent actions or data calls and/or due to circumstances outside the contractor's control.

Schedule may be altered due to delays provided by external support services. When requested, Pace IV staff will assist in presenting findings to the GRC management, OCSS and CSPD.

The PACE IV support services team assigned to 1400.01.02 shall complete tasks under the projects listed below and provide the described deliverables as agreed upon. Deliverables will be examined and reviewed for the erroneous (spelling, grammar, accuracy) to ensure high-quality products (i.e., coursework text and design, research, calendar, posters, presentations, newsletters, etc.) and the support service team will incorporate feedback and edits provided by the NASA PM.

1. Awareness Activities & Communication Efforts

• Increase IT Security Awareness through communication with the IT Security Community and support the development of appropriate awareness material.

• Marketing materials - market ITSATC's product and services…include awards. This should be done in the form of posters, infographics (poster), paper products and/or brochures.

• Foster awareness support in the form of puzzles, posters, handouts, etc. pending funding.

• Assist all Centers with Awareness Day Activities.

• Post Security Sense Articles and Newsletter to website

• Support Bi-weekly teleconference call with Agency ITSEC POCs and craft minutes

• Make available multiple learning opportunities for programmers to participate in training enhancing their secure programming techniques

• Provide help desk support agency-wide regarding FAQs, metrics data scrubbing and course inquiries regarding awareness and role-based training content

• Package and mail materials as needed

• Manage vendor purchased IT Security Training videos and gamification tools for use

Deliverable: ITSATC Marketing and Catalog materials- Agreed upon Date Deliverable: ITSATC Annual Calendar - 9/1/2020

2. External Vendor Training: Specialized Training, SANS Vouchers, RBT, and other

• Advertise the availability of both online portal training and instructor-led training throughout the Agency.

• Work w/vendor to ensure ease of access for programmers to train either online or onsite at NASA centers.

• Work with vendor to compile database of user activity and track learners’ completions

• Work with ITSATC PM and Centers (CISO, ITS Training POC, members of SOC and WASP, etc.) to determine what live courses should be offered.

• Develop a plan and schedule for the Instructor-Led Training (ILT).

• Work with each Center (CISO, ITS Training POC, OHRD, Communications, etc.) to assist in the scheduling of on-location instructor-led training.

• Serve as interface between the vendor and the Centers. Support centers on-site when needed.

• Work with vendor, Centers, and users to establish and maintain online accounts Advise users on how to access online training.

• Assist with help desk and troubleshooting for online portal and on-site training.

• Assist in the completion of Agency metrics reporting the number of participants completing training and working with the Security Operations Center to gather data on reported and confirmed incidents related to web applications presented to the PM.

• Manage requests via spreadsheet for SANS, FED VTE, and COL Training Opportunities and Voucher applicants and application forms.

Deliverable: Schedule centers as identified by the NASA PM for Instructor-Led Training facilitated by vendors and all associated logistics- Agreed upon Date Deliverable: Provide requesting applicant packages for FedVTE and SANS vouchers to PM for registration and/or final approval- Agreed Upon Date

3. Conference attendance and Site Visits

• Support the development and execution of ITSATC Face 2 Face event for Agency ITSEC POCs

• Support the PM's presentations with relevant NASA proof points and graphics that enhance the presentation of NASA’s Awareness and Training program findings and accomplishment.

• Whenever at attendance at events highlighting cybersecurity best practices, provide a short synopsis of the Annual Event when government covers the cost of participation

Deliverable: Short synopsis of best practices and conference highlights in the form of a report- Agreed upon date

4. IT Security Awareness Materials (Newsletter, Video Creation, CSTV)

• Create monthly newsletter fashioned as a training tool to increase appropriate use of NASA assets and SBU information

• Create real-time one-page publications when a security event arises that should influence NASA asset user behaviors

• Create and develop IT Security Awareness materials to support Agency IT Security Awareness Program, including quarterly Newsletter, Weekly Tips, and coordinating with Center personnel to deliver awareness products.

• Update existing electronic ITSATC catalog to include new and revised offerings

• Create and develop awareness marketing materials for distribution Agency-wide

• Identify awareness materials and recommend to Centers for use

• Create videos to be incorporated into course training

• Support the maintenance and updating of the CSTV website, which contains cyber videos (vendor and Pace created)

Deliverable: Quarterly Newsletter for electronic distribution- Agreed Upon Date Deliverable: One page publication of the latest threat, vulnerability, etc to be published within 48hr (2 business days).

Deliverable: Distribution of Marketing Materials- As requested w/Agreed Upon Date

5. IT Security

• Serve as subject matter experts in IT Security Training. Keep abreast of the latest trends in training and awareness activities.

• Develop and implement a process for remaining informed of the latest IT security issues, concerns, and technologies and develop a mechanism for incorporating those into the appropriate training vehicles.

• Provide other miscellaneous support services for this task based on schedule and availability.

• Maintain and promote knowledge of general IT Security and training best practices and understanding of policies as it relates to IT Security within NASA and the Federal Government.

Changes in policies should be shared with the government when detected and verified

• Establish and implement a process to create NASA ITS certificates for bands of RBT courses*

6. Metrics collection, Analysis & Report generation

• Assist in the completion and analysis of Agency reporting metrics as it relates to IT Security Training and Awareness and Role-Based Training

• Review and update process for metrics generation and reporting for continuous improvement based on reported issues – (ongoing)

• Provide weekly metrics reporting on completed IT Security Awareness training at the center level/weekly reporting.

• Provide bi-weekly reporting for Secure Web Code Training participation

• Work with the SATERN SAL(s) to ensure that proper credit is listed in SATERN for external courses

Deliverable: Deliver annual security training metrics to the Program Manager (Weekly beginning March 1- August 15)- Thursdays by Noon Deliverable: Provide compilation of Secure Web Code metrics for Instructor-Led and Computer- Based training courses (Bi-weekly and final September 15) Deliverable: Provide and support recommended process for tracking mandatory RBT course completions in accordance with the NASA RBT Handbook- Agreed Upon Date

7. Procurement

• Craft purchase orders for government requested services, registrations and trainings

• Procure IT Security related training materials and courses for NASA on an as-needed basis as resources are allocated.

• Research vendors based on customer requests for new training

• Work with vendors and PACE IV procurement staff to purchase training

• Provide logistic support to Centers to ensure seamless execution of training (e.g. requirements, dates of service, identification of on-site POC, etc.)

Deliverable: Manage funds/budget, generate individual purchase orders and pay invoices from all vendors as needed- Date contingent upon request Deliverable: Facilitate vendor training execution- As Agreed Upon Deliverable: Facilitate the purchasing process of SANS Vouchers- as requested and funding is available

8. Reporting & Meetings

• Provide electronic version of project and workflow status using project planning tool

• Provide detailed Role-Based Training Plan schedule by course with update steps

• Provide Agency Role-based training course metrics

• Provide a quarterly Accomplishments report

• Provide other miscellaneous status reports as requested w/agreed upon conditions

• Weekly Team Meetings with NASA Project Manager (re overall operations, annual course and ad-hoc)

• Weekly Meeting: NASA Project Manager and Pace IV Peerless Technologies Work Order Manager

• Provide support for the ITSATC Bi-Weekly Telecon to include meeting invite, preparation and delivery of agenda, slide deck presentation preparation as needed, roll call, drafting and delivery of meeting notes

• Code V: Enterprise Capabilities Meetings and OCSS meetings- and others as requested by NASA

PM

Deliverable: Master Project Plan- Weekly Updates (Thursdays or as needed when no major changes occur) Deliverable: Role-Based Training Mandatory Implementation Action Plan- Weekly Updates incorporated into Master Project Plan (Thursdays)* Deliverable: Accomplishments report (Quarterly report 15th day before quarter ends) Deliverable: FISMA reporting data- As Agreed upon Deliverable: Meetings-Tuesdays: standing weekly meeting -Tuesdays: standing weekly meeting or as needed (NASA PM & PEERLESS TM)- Agreed Upon* Deliverable: Deliver agenda to POCs and final meeting notes electronically- As Agreed Upon

Deliverable: Slide deck presentations for bi-weekly meetings- As requested and Date to be Agreed Upon

9. SATERN Administration

• Serve as NASA ITS Discipline Representative

• Support NASA LMS selection, migration and upgrade process

• Serve as subject matter experts within the SATERN training system, and the use of the SATERN system to accomplish the goals of the IT Security Awareness and Training Center (ITSATC).

• Upon request, need or recommendation, a review of identified courses in NASA’s LMS (currently SATERN) will be conducted with the feedback of NASA SMEs (CS/SSC) to gather new objectives for each training module based upon an agreed-upon schedule.

• Provide SATERN reports as requested or needed.

• Complete all tasks associated with SATERN Administrator role

Deliverable: Attendance at SATERN Administration Agency-wide meetings and provide updates of progress- As Needed Deliverable: Provide SATERN report summary of learner usage (customized based on request)- As request w/ Date to be Agreed Upon

10. Training Courses: Course content will cover and comply with NASA NPR 2810.1, NIST 800-16 & other Federal or NASA standards as identified and confirmed by internal and/or external SMEs.

• Develop new courses and/or supplemental materials (includes the full range of course/material creation and acting as the subject matter expert for related curriculum) when requested with agreed-upon timeline.

• Research, develop, program, review, and release Role-Based Training Courses, as needed.

• Research, review and support incorporation of new requirements for IT Security Handbooks.

• Develop or procure, review, and implement the Annual IT Security Awareness Training Course and Role-Based Training courses.

• Create text and design specifications for each course, ready for programming/conversion into the NASA online training site.

• Incorporate high-grade multi-media into the course to include

• Implement web-based application that functions as a server to host training courses with high-grade media features such as gamification and awareness video snippets to highlight security topics.

• Manage the course development process from start to finish, including approval of final product prior to going live.

• Develop slide decks for ITS courses to include Annual Training, Physical-Access only Annual Training and ADA Annual Training (disabled learners)

• Review and edit Annual ITS training materials for all training audiences per NASA ITS Handbooks specification

• Whenever schedule permits, facilitate three reviews of each course (outline, text, and final product) by the potential trainee audience selected by ITSATC, and integrate reviewers’ comments into the course material when relevant.

• Research, develop, program, review and release 2020 Annual IT Security Training Course.

• Procure, Update or Develop NASA-specific role-based training for all roles defined as having "significant security responsibilities" (Training 2.0)

• Provide as appropriate and technically feasible, the necessary efforts to test and enable course operation under disparate operating systems (i.e. - UNIX, Windows XP, MAC OS X, etc.) and Agency approved web browsers.

• Upon request, pilot School of Cybersecurity that offers professional internal NASA certifications for all IT Security Professionals with SSR.

• Upon request, need or recommendation, a review of identified courses in NASA’s LMS (currently SATERN) will be conducted with feedback of NASA SMEs (CS/SSC) to gather new objectives for each training module based upon an agreed-upon schedule.

Deliverable: Annual IT Security FY20- Deliver (launch) during week of October 1, 2019 unless circumstances by PACE's control exist Deliverable: Provide Annual IT Security FY20 slide deck in three versions (regular/Physical Access-only and ADA compliance) Deliverable: INCORPORATE new training materials into New Employee Training for FY20 in collaboration with NSSC- Agreed upon Date Deliverable: Update Annual IT Security FY21- Deliver (launch) during week of October 1, 2020 unless circumstances by PACE's control exist Deliverable: Provide Annual IT Security FY21 slide deck in three versions (regular/Physical Access-only and ADA compliance) Deliverable: INCORPORATE new training materials into New Employee Training for FY21 in collaboration with NSSC- Agreed upon Date Deliverable: Update to Role-Based Training courses- Agreed Upon: see Role-Based Training Schedule Deliverable: Initiate a formal disposition process for the FY21 Annual Course and New Employee Course update

11. Webinar

• Identification of speakers for webinar sessions

• Interface with speaker to set up Skype, review content and support any technical issues for presentation

• Conduct Agency-wide monthly webinars to include advertisement, scheduling, registration, and survey administration

• Conduct special webinar series with SYNOPSYS and other selected vendors

Deliverable: Facilitate and Host Monthly Webinars up to 10- Monthly basis (one per month)- Last Thursday of each month

Deliverable: Provide compilation of survey results for each Webinar to PM- No more than 7 days after the event

12. Website Maintenance

• Public-facing website to include link to a list of Training we offer, Security Tips, Webinars, and Contact Us page. Pages may be condensed as long as the information is displayed

• Maintain a web site, which will be used to communicate the efforts of the ITSATC to the rest of the Agency.

• Update and maintain the ITSATC website with up-to-date information that provides guidance and useful content to the NASA community.

• Provide website metrics on number of hits per quarter.

• Internal Site - Include blogging page for ideas; if any, present during Tuesday morning meeting.

Deliverable: Bi-weekly IT Security Tips posted to website - posted bi-weekly excluding holidays Deliverable: Provide website metrics as a part of the quarterly accomplishments report

13. Policy and procedure creation support

• Policy for handling additions to Role-Based Training HBK roles and course content creation

• Policy for adding videos to CSTV from NASA ITS community

• Policy for submitting data to HQ.

• Policy/Procedure for tracking CUI training completion.

• Policy support for OCSS data calls during alignment and implementation phases

• Track all pertinent procedures/processes for operations of training center

Deliverables: Provide NASA PM with updated procedures and processes as adjusted and created for operational execution of tasks.

Work Order 2-2100.01.01 Applications/Systems Support

Funding Organization: VE WOR Org: VE OCIO Code: VE Funding Type: CMO

10/1/2019 to 09/30/2020

Summary

Provide enterprise and business applications support services to GRC for Information Technology systems that process information for GRC and NASA organizations and may interface to other NASA-wide systems. Provide Database and System Administration services in support of enterprise and business applications. Services include web application systems support and security administration. Provide system environment support for the Web Application Development (WADe) environment and approved commercial off the shelf (COTS). The contract shall utilize appropriate best practice development processes, agile, waterfall, hybrid, as projects dictate.

Overall Objectives

Objective 1: Manage and support Web application development projects. Utilize appropriate policies, and procedures as they pertain to these projects.

Objective 2: Manage and support Web applications throughout their lifecycle, including maintenance and enhancements. Utilize appropriate policies, and procedures as they pertain to these projects.

Objective 3: Maintain up-to-date, reliable, and secure web application development (WADe) environments. Support software tools, policies, and procedures as they pertain to these environments.

Provide assistance to developers in application development activities as needed.

Objective 4: Develop, support and maintain up-to-date, reliable and secure database schema environments.

Specific Work Requirements:

General:

Work Prioritization: All application and environment support activities including projects, major environment changes, upgrades, and service enhancements are agreed to by and prioritized in conjunction with the Work Order Requester (WOR).

Portfolio Management: Utilize and support the OCIO Application Governance Board process. All application support should follow the current NPR 7120 and 7150. The application portfolio should be updated and accurate. Atlassian and ServiceNow will be used to track all project and demands approved by the OCIO AGB as requested.

GRC Standards and Policies: Software changes and upgrades shall be implemented in accordance with GRC configuration management requirements and performed within GRC approved maintenance windows unless an exception has been approved by the customer.

Procurements: Software purchases and licensing shall be coordinated with the customer.

Monthly Reports: Monthly reports shall be documented in TOMS. Weekly updates shall be provided to the WOR.

Reporting: Maintain accurate dashboard of applications and level of effort applied to develop and support each application.

Environment Availability: All environments/ schemas shall be operational 24 x 7, excluding approved maintenance windows and other system outages.

Software Version: Software will be at the current vendor's version within 6 months of release unless otherwise agreed upon by the customer and the contract.

Security: Support the GRC IT Security Program office for each application, as needed to augment the environment plan.

Environment shall comply with the terms of the data center IT System Security Plan. Support security plan development and maintenance in coordination with the GRC IT Security Program office for each application, as needed to augment the environment plan.

1. Implement security controls required to maintain authority to operate NIST Moderate level systems.

2. Implement security controls to maintain ATO as defined in the SSPs.

3. Implement and enforce all NASA IT security policies

4. Attend security plan meetings as requested

5. Provide input to security plan and supporting documentation

6. Support security audit and review activities

7. Address outstanding Certification and Accreditation POA&Ms, ensuring completion by required dates

8. Apply all security-related software patches as required by GRC and NASA

9. Monitor systems, logs, and software configurations on a regular basis, as agreed upon by the customer

10. Provide support for application developers to properly secure applications and assist them in development of application related security documentation

Response Time: WADe site and schema creation/modification requests are completed within sixteen hours of receipt, provided no issues with provided data model exists unless otherwise determined by the customer. Requests defined as urgent by the customer are completed within four hours of receipt within extended coverage hours. Service Desk work flows and associated Service Level Agreements as defined and agreed upon will be followed.

Objective 1: Web application development projects.

Provide support in the development of new web applications or major enhancements to existing web applications.

Perform development activities including but not limited to developing schedules, identifying resource requirements, gathering technical requirements, creating interface designs, developing data models, coding, testing and implementing software. Work with customers to define requirements, explore options, propose work areas, and help with the customer agreements.

Ensure all software is in compliance with 508 Accessibility standards and other federal or NASA software development standards.

Support IT security best practices in coordination with the GRC IT Security Program office

Objective 2: Web application maintenance and enhancements

Ensure system functionality is maintained and software problems are resolved promptly

Respond to notification of user problems as defined in the Service Desk Work Flow Service Level Agreements.

Upon request provide the customer with estimated resolution time.

Objective 3: Web Application Development (WADe) environment

Install, support, troubleshoot, and maintain the WADe application development software suite, which includes but is not limited to ColdFusion, ERWin data modeling software, PVCS or other designated source control software.

Create application sites and migrate between environments.

Obtain and install SSL certificates

Support IP access control and Windows user authentication methods

Support eAuthentication initiatives

Provide troubleshooting and problem resolution services as needed

Interface with firewall team to facilitate access to applications

Support the Web Services Office in the evaluation of new tools, systems, and software to update the WADe environment

Objective 4: Database support

Develop, modify, troubleshoot, and maintain database schemas in all environments which includes schema development, modification, maintenance and deletion.

Current platforms include Oracle, mySQL, and SQL Server.

Provide data modeling services as requested.

Provide database access control and security administration where required. This includes support in implementing Agency authentication initiatives.

Deliverables:

Deliverable Description Frequency # of Planned Deliverables

Due Date

Report number of Service Desk Incidents generated for Web Applications.

Monthly 12 5th work day of each month

Report number of Service Desk New Requests generated for Web Applications.

Monthly 12 5th work day of each month

Work Order 2-2100.03.02 COMPASS Lab Support

Funding Organization: LB WOR Org: LB OCIO Code: VM Funding Type: Project

10/01/2019 - 09/30/2020

Overall Objectives:

This task provides technical support for Advanced Engineering and Engineering Design Center Environments. In particular, this effort will support the COMPASS Lab collaborative environments. The support required includes the following main categories: computer administration, computing/collaborative infrastructure integration/operation, and environment support of studies and requirements activities.

Specific Work Requirements:

Provide primary support for Computer Administration duties:

• Installation of software on Lab computer systems

• Management of collaboration room workstations, laptops and applications as necessary

• Workstation UserID and computer resources management

• Development, implementation and maintenance of Computer Security Plans for COMPASS Lab.

• Support of procurements and system integration with other collaborative systems

Computing/Collaborative infrastructure and integration duties:

• Support of collaborative environments (video, audio, and data sharing) as needed by the customer

• Integration of Engineering tools for use by Engineering Design teams (network access, platform interdependencies, etc).

• Support Security Plans, procurements, testing of new equipment, and technology planning

• Coordinate and schedule regular maintenance, new system integration, and equipment repair issues for the COMPASS Lab environments

• User support to foster the utilization of the collaborative environments to their fullest potential

End Products:

The facility will be supported in a day-to-day manner within the allocated resources to debug problems, integrate user requirements, and ensuring the smooth operation of the environment. Work will also integrate hardware and software for the lab transition to the RSB building.

# of Planned Deliverables

Due Date inventory for each room identified in the Deliverables section

Maintain security plan As needed but at least every 3 years

Undetermined Various

Install security patches and configuration changes

As needed Undetermined Various

Create/maintain purchase orders, work orders, ACES/NICS IUPs as required

As needed Undetermined Various

Work Order 2-2104.01.01 Visualization

Funding Organization: VE WOR Org: VE OCIO Code: VE Funding Type: Project

Task Summary

The Contractor shall provide data visualization support and development, visualization facility support, interactive visual simulations, natural user interface development and support, 3D model creation, Big Data analysis consulting and development, algorithm development, and scientific and visualization application development and tool support for technical computing work including high performance computing at GRC and the Agency. The Contractor shall provide visualization support for outreach events such as conferences and tours.

Overall Objectives

The primary goal of this task is to provide the highest quality products and services in the areas of visualization and scientific computing for NASA Glenn and the Agency. The products and services should result in a high level of customer satisfaction. This will be accomplished by:

• maintaining technical excellence

• working in collaboration with other work areas in Code V, NASA Glenn, and the Agency

• making use of software development and data management practices that comply with Agency standards and are proven practices in the industry

• quickly and cost-effectively adjusting to peaks and valleys of workload, technology, and funding

• leveraging efficiencies to be cost-effective

Specific Work Requirements

The contractor will provide the following as funding permits:

• Development and consulting o Develop programs or use third-party tools to perform visualizations of specific data sets based on customer requirements o Develop interactive 3D Worlds, models, animations, images and web-based entities (e.g.

Unity, VRML based models) o Develop techniques to apply Augmented Reality, Virtual Reality, and Natural User Interface technology to scientific visualization, collaborative engineering, and mission simulation o Develop scientific mobile apps o Develop interactive system simulations. Model complex systems and mission scenarios using state-of-the-art computer graphics technology o Develop virtual CAD-based design models o Develop tools, techniques, and facilities to facilitate and enhance lab-wide use of scientific visualization software o Consult, design, develop, maintain, optimize and deploy custom or existing applications that analyze large scientific datasets, e.g. Big Data o Provide consultation on best practices for the development of visualization tools and scientific codes o Modify existing codes to improve efficiency by making codes run faster and/or use fewer resources

• Outreach o Perform technical outreach duties as required to help promote Glenn projects and programs, including coordination of GRC/Code V activities and tasks required for special outreach events such as conference and trade-show exhibits, open houses, VIP visits, multi-Center projects, and off-site demonstrations

Provide demonstrations of capabilities of the GVIS and GRUVE facilities as required in support of program advocacy, education, and public awareness missions

Coordinate design and construction of technical content demonstrations and exhibits

Oversee logistical requirements for off-site technical events including equipment transportation, and event promotion

Promote and market technical programmatic missions and milestones o Work with visualization tools vendors to schedule demonstrations and training o Provide presentations on scientific visualization o Provide support for off-hour critical events when requested o Provide content for GVIS lab Web site

• Facility o Through market surveys, trade journals, and industry exhibits survey state-of-the-art hardware and software and make recommendations to the Team Lead on new acquisitions o Write procurements for required hardware and software o Maintain the security plan for the GVIS Lab outreach computers o Maintain visualization facility in operational status such that it can be used to support work or potential work that will be done as part of this task. Specifically, maintain the facility in operational status during core working hours. (Minimum 4 hrs/day between 8 am and 6 pm). Because the facility often reconfigures its equipment based on individual project needs, "operational status" is defined as having functional all critical components for all ongoing visualization tasks at that time

Perform configuration management and integration with necessary networks and other equipment

Perform preventive maintenance and coordinate repair with appropriate service providers

Ensure availability of all consumables through either regular procurements or available GRC stockroom supplies

Deliverables

Deliverable Description Frequency # of Planned Deliverables

Due Date

Apply security patches within 30 days of release Monthly 12 09/30/2020

Work Order 2-2104.02.01 Trick Simulation for Autonomous Power Control

Funding Organization: LEM WOR Org: VE OCIO Code: VE Funding Type: Project WBS: br549

Work Elements:

1. Work with the NASA JSC Trick software to set up an environment for the Autonomous Power Controller (APC). This work includes the integration of electrical power system simulations and the Autonomous Power Controller into the trick environment. In addition, this includes modeling of the Time-Triggered Ethernet system and use of Core Flight Software (CFS).

2. Assist the APC team in the integration of cFS into the APC.

3. Assist the APC team in the build-up and integration of the APC into the GRC Gateway tested.

Deliverables:

Deliverable Description Frequency # of Planned Deliverables

Due Date

With the support of the Autonomous Power Control team, integrate Gateway electrical power system simulation with Tricks TTE/cFS emulators.

Once 1 9/30/2020

Work Order 2-2200.01.01 Support for the NASA Environmental Tracking System (NETS)

Funding Organization: HQ WOR Org: HQ OCIO Code: VE Funding Type: Project

Overall Objectives

Provide the necessary technical, programming, coordination, training, documentation, and advisory support for the development, installation, maintenance, and enhancement of NETS.

Specific Work Requirements

All modifications or enhancements to existing applications will be accomplished to customer requirements documents and schedules.

Center standard tools will be utilized for Configuration Management of all software.

Production applications and data will be maintained separately from development and test environments.

Provide technical support to the Environmental Management Division and the communities of practice for the Agency Collaboration Roadmap.

Technical Support will be provided during core business hours.

All problem calls will be reported to the NETS Help Line or NETS Service Desk where they will be logged and tracked by the NETS Software Support Team.

PACE will also provide the following support in performance of this task:

• Meet regularly with the NASA task manager to address task work priorities to ensure consistency with NASA Headquarters Environmental Management Division, and customer needs.

• When requested, prepare and maintain a task work and deliverable schedule for review and approval by the NASA Headquarters Environmental Management Division.

• Work with NASA Headquarters Environmental Management Division and the NASA Centers and Component Facilities to identify the data requirements for external reports and agreed upon Agency-wide metrics.

• Conduct analysis on identified data requirements. The analysis shall validate that the data requirements are met for external reporting and Agency-wide metrics.

• Develop and maintain a database structure from the validated data requirements that were identified from external reports and Agency-wide metrics.

• Continue the design and development of NETS application from the validated data requirements that were identified for external reporting and Agency-wide metrics.

• Provide Hardware and software infrastructure support for NETS database and application servers.

Continue developing NETS to include additional functionality as requested. Specific Items to be accomplished are:

• Incorporate Geographical Information System (GIS) data into NETS as requested.

• Develop data requirements interface drawing from existing SAP data utilizing the Business Warehouse.

Incorporate any new reporting requirements and provide sustaining engineering for the following:

• Environmental Functional Management

• National Environmental Policy Act (NEPA)

• Pollution Prevention

• Collaboration tools including but not limited to SharePoint, ExploreNet, BOX

Ensure that all new NETS development complies with Section 508 of Rehabilitation Act related to the Access Board standards.

Provide Help Desk support, data administration support, and sustaining engineering to NETS application for completed phases.

Provide Hardware and software infrastructure support for NETS database and application servers.

Investigate and implement appropriate new technologies for NETS. This will include, but not limited to, the NETS Web Site and supplemental training media.

Deliverables:

Deliverable Description Frequency # of Planned Deliverables

Report number of Service Desk Incidents generated for Web Applications.

Monthly 12 5th work day of each month

Report number of Service Desk New Requests generated for Web Applications.

Monthly 12

Work Order 2-2200.01.02 Support for the NASA Environmental Tracking System (NETS) Environmental Compliance and Restoration (ECR)

Funding Organization: HQ WOR Org: HQ OCIO Code: VE Funding Type: Project

Overall Objectives and Specific Work Requirements

Provide the necessary technical, programming, coordination, training, documentation, and advisory support for the development, installation, maintenance, and enhancement of the ECR module which includes the eXtensible Project Reporting, Estimating, and Scheduling System (XPRESS) application.

Provide subject matter expertise related to the use of the CTC Cost Models and UDE including XPRESS software support, documentation requirements, etc.

PACE will also provide the following support in performance of this task:

• Meet regularly with the NASA task manager to address task work priorities to ensure consistency with NASA Headquarters Environmental Management Division, and customer needs.

• When requested, prepare and maintain a task work and deliverable schedule for review and approval by the NASA Headquarters Environmental…