DRAFT SOW.pdf

DEPARTMENT OF COMMERCE (DOC)

NATIONAL OCEANIC AND ATMOSPHERIC

ADMINISTRATION (NOAA)

National Environmental Satellite, Data, and Information

Service (NESDIS) Consolidated Antenna and Ground

Systems Services (NCAGSS)

Indefinite-Delivery Indefinite-Quantity (IDIQ) Statement Of Work Statement (SOW)

Office of Satellite and Product Operations (OSPO) and

Office of Common Services (OCS)

August 21, 2025

Contents

1.0 Introduction

1.1 Purpose

1.2 Background

1.3 Scope

1.4 Place of Performance

1.5 Government Furnished Equipment and Information

1.5.1 Government Furnished Equipment (GFE) and Supplies

1.5.2 Government Furnished Information (GFI)

1.6 Contract Execution

2.0 Applicable Documents

3.0 Requirements

3.1 General Requirements

3.1.1 Program/Project Management

3.1.2 Incoming and Outgoing Transition

3.1.3 Cloud Infrastructure Services

3.1.4 Cybersecurity

3.1.4.1 Continuous Monitoring and Situational Awareness

3.1.4.2 Incident Response

3.1.4.3 System and Networking Monitoring

3.1.4.4 Audit and Logging

3.1.4.5 Vulnerability Assessment

3.1.4.6 Cybersecurity Compliance

3.1.4.7 Contingency Planning

3.1.4.8 Flaw Remediation

3.1.4.9 Malicious Code Protection

3.1.4.10 Cybersecurity Program Management Support

3.1.4.11 Cybersecurity Awareness & Training

3.1.4.12 Continuous Monitoring and Assessment & Authorization (A&A)

3.1.4.13 Plans of Action & Milestones (POA&M) Management

3.1.4.14 System Interconnection

3.1.4.15 System Security Documentation

3.1.4.16 Security for SE, Change Management, and Configuration Management

3.2 Program Integration

3.2.1 Systems Engineering

3.2.1.1 Systems Engineering Expertise

3.2.1.2 Systems Engineering Management Planning

3.2.1.3 Requirements Management

3.2.1.4 Risk Management

3.2.1.5 Configuration Management of Technical Baseline

3.2.1.6 Knowledge Management

3.2.1.7 Ground Systems Engineering Support

3.2.1.8 Test Support

3.2.1.9 Transition to Operations

3.3 Operations

3.4 Maintenance

3.4.1 Maintenance System Engineering

3.4.2 Maintenance Activities

3.4.3 Capacity Planning

3.4.4 Preventative and Corrective Maintenance

3.4.5 Installation, Removal and Relocation

3.5 Sustainment

3.5.1 Sustainment System Engineering

3.5.2 Obsolescence Prevention and Remediation

3.5.3 Sustainment Support

3.5.4 Sustainment Integration and Test

3.5.5 Radio Frequency (RF) Engineering Support

Appendix A: NCAGSS Information & Cybersecurity Support Task Accountability Matrix

Appendix B: Applicable Reference and Security Documents

Appendix C: Acronyms

1.0 Introduction

1.1 Purpose

The purpose of this Statement of Work (SOW) is to describe the services the Contractor shall provide to support the NESDIS Antenna as a Service (NAaaS) program. The services are essential to provide NOAA/NESDIS with flexibility and responsiveness required to support the scope, complexity, and evolution of how NOAA/NESDIS acquires, manages and operates antenna services.

1.2 Background

The mission of NOAA/NESDIS is to provide timely access to global environmental data from satellites and other sources to promote, protect, and enhance the Nation's economy, security, environment, and quality of life. To meet its mission responsibilities, NESDIS acquires and manages the antenna ground systems for the Nation's operational environmental satellites and provides antenna ground system services to partner missions.

The NOAA/NESDIS antenna enterprise is comprised of antennas at the Wallops Command and Data Acquisition Station (WCDAS) in Wallops Island, VA; the Fairbanks Command and Data Acquisition Station (FCDAS) in Fairbanks, AK; the Consolidated Backup (CBU) Facility in Fairmont, WV; and the NOAA Satellite Operations Facility (NSOF) in Suitland, MD and may include other sites in the future.

The antenna ground system supports spacecraft in various orbital regimes including Geostationary Earth Orbit (GEO), Low Earth Orbit (LEO), and Space Weather Operations (SWO) Lagrange Point Orbits used by both NOAA and its partners. The NOAA/NESDIS antenna ground system simultaneously supports satellites actively collecting weather data as well as satellites in a backup on-orbit storage mode and satellites in transfer phase. Spacecrafts include those owned/operated by NOAA, non-NOAA US partners, and international partners.

Through the NAaaS program, NESDIS seeks to achieve cost savings and efficiencies by offering users access to antenna services or infrastructure enabling transitions from operating as a single user/mission to a common service-oriented architecture.

The NAaaS initiatives will also seek to consolidate and manage existing and new antennas as non-mission-unique assets; enable multi-mission, multi-orbit use; and when advantageous to the Government, leverage use of commercial Ground Segment as a Service (GSaaS) providers for additional coverage and/or capacity.

Figure 1.1-1 represents an operational viewpoint of the NAaaS architecture and the functional flows between the spacecraft supported and the NOAA and partner missions on the ground.

Figure 1.1-1. Representation of NOAA Satellites, Ground Systems and NAaaS

1.3 Scope

This Statement of Work (SOW) is for the base IDIQ. Task orders (TOs) will be issued for specific services within the scope of this Indefinite-Delivery Indefinite-Quantity (IDIQ) over the period of performance.

The SOW defines the requirements for services to deliver solutions for performing antenna ground system upgrades, building new antennas when required, decommissioning and removing existing antennas, and leveraging commercial services and products. In addition, it defines the requirements for services to install, when needed, a common service antenna infrastructure that supports maintenance and sustainment services to ensure extensibility, reliability, and continued IT security policy compliance. It also defines the requirements for a NAaaS enterprise Programmatic Integrator (PI) who will ensure integration across all TOs.

Table 1.1-1 lists the antenna systems that the Office of Satellite Product Operations (OSPO) currently operates, maintains, and/or sustains. The Office of Common Services (OCS) will manage the development and acquisition of antenna services for the NAaaS program. The specific antennas and systems will be defined at the TO level. Individual system inventories, drawings, descriptions and interfaces are available in the NCAGSS Acquisition Document Library. The term NAaaS antenna portfolio includes but is not limited to the items in the table.

Examples of the NAaaS antenna portfolio contents include the frequency bands, Interface infrastructure, Low Noise Amplifiers (LNAs), High Power Amplifiers (HPAs), Front End Processors (FEPs)/radios, and matrix switches. The NCAGSS Acquisition Document Library will provide additional details.

Antennas Current Supported Missions Frequency Bands

Wallops 3.8m 1 DCS UHF (468-470 MHz)

Wallops 3.8m 2 DCS UHF (468-470 MHz)

Wallops 3.8m 3 DCS UHF (468-470 MHz)

Wallops 7.2m GOES-NOP L Band (1670-1710 MHz)

Wallops 8m GOES-NOP L Band (1665-1700 MHz)

Wallops 13m A LEO, METOP, JASON L Band (1670-1710 MHz) S Band (2200-2400 MHz) X Band (7250-8500 MHz)

Wallops 13m B LEO, METOP, JASON L Band (1670-1710 MHz) S Band (2200-2400 MHz) X Band (7250-8500 MHz)

Wallops 14.2m COSMIC (LEO/JASON Backup) L Band (1544.5 MHz) L Band (1670-1710 MHz) S Band (2200-2300 MHz)

Wallops 18m A DSCOVR S Band (2200-2300 MHz)

Wallops 16.4m

HR1

GOES-NOP, GOES-R,

DSCOVR

L Band (1670-1710 MHz) S Band (2200-2290 MHz)

Wallops 16.4m

HR2

GOES-NOP,GOES-R, DSCOVR L Band (1670-1710 MHz) S Band (2200-2290 MHz)

Wallops 16.4m

HR4

GOES-NOP,GOES-R L Band (1670-1695 MHz) S Band (2200-2240 MHz) X Band (8100-8350 MHz)

Wallops 16.4m

HR5

GOES-NOP,GOES-R L Band (1670-1695 MHz) S Band (2200-2240 MHz) X Band (8100-8350 MHz)

Wallops 16.4m

HR6

GOES-NOP, GOES-R L Band (1670-1695 MHz) S Band (2200-2240 MHz) X Band (8100-8350 MHz)

Wallops 26m ACE VHF (136-138 MHz) L Band (1670-1710 MHz) S Band (2200-2300 MHz)

Fairbanks 2.4m Multiple Missions L Band (1682-1710 MHz) S Band (2200-2300 MHz) X Band (7700-8500 MHz)

Fairbanks 4.06m JPSS K Band (26450-26950 MHz)

Fairbanks 5m

MAL

PAZ, KOMPSAT S Band (2200-2290 MHz) X Band (8025-8400 MHz)

Fairbanks 5m

DAT

KOMPSAT S Band (2200-2300 MHz) X Band (7600-8500 MHz)

Fairbanks 13m A METOP, JPSS, DMSP L Band (1670-1710 MHz) S Band (2200-2400 MHz) X Band (7250-8500 MHz)

Fairbanks 13m B METOP, JPSS, DMSP L Band (1670-1710 MHz) S Band (2200-2400 MHz) X Band (7250-8500 MHz)

Fairbanks 13m C METOP, JPSS, DMSP L Band (1670-1710 MHz) S Band (2200-2400 MHz) X Band (7250-8500 MHz)

Fairbanks 21m DSCOVR L Band (1670-1710 MHz) S Band (2200-2300 MHz)

Fairbanks 26m GOES NOP, KOMPSAT VHF (136-138 MHz) L Band (1670-1710 MHz) S Band (2200-2300 MHz)

Barrow 2.4m KOMPSAT, POES L Band (1682-1710 MHz) X Band (7700-8500 MHz)

Barrow 5m JASON S Band (2200-2300 MHz)

Suitland 9.1m 1 GEO Missions L Band (1670-1698 MHz)

Suitland 9.1m 2 GEO Missions L Band (1670-1698 MHz)

Suitland 9.1m 3 GEO Missions L Band (1670-1698 MHz)

Suitland 9.1m 4 GEO Missions L Band (1670-1698 MHz)

CBU 16.4m HR7 GOES-R L Band (1670-1695 MHz) S Band (2200-2240 MHz) X Band (8100-8350 MHz)

CBU 16.4m HR8 GOES-R L Band (1670-1695 MHz) S Band (2200-2240 MHz) X Band (8100-8350 MHz)

CBU 16.4m HR9 GOES-R L Band (1670-1695 MHz) S Band (2200-2240 MHz) X Band (8100-8350 MHz)

3.8m Pilot DCS UHF (468-470 MHz)

3.8m Pilot DCS UHF (468-470 MHz)

Table 1.1-1 Antenna Systems OSPO currently operates, maintains, and/or sustains.

1.4 Place of Performance

The places of performance include the following locations:

a. NESDIS Command and Data Acquisition (CDA) Station Fairbanks, Alaska

b. NESDIS Command and Data Acquisition (CDA) Station, Wallops Island, Virginia

c. NESDIS Consolidated Back-up Unit (CBU) located in Fairmont, West Virginia

d. NOAA Satellite Operations Facility (NSOF) located in Suitland, Maryland

e. Utqiagvik (Barrow), Alaska

f. Contractors’ facilities

1.5 Government Furnished Equipment and Information

1.5.1 Government Furnished Equipment (GFE) and Supplies

The Government will provide the Contractor personnel located at the Government buildings and other potential sites with basic supplies and materials normally available to Government employees including personal computers and software.

The Contractor shall coordinate with the Government property manager regarding the transfer receipt of all assets, the management of all property, and the program’s inventory. The Government furnished equipment (GFE) list will be provided to the Contractor at the TO level and will contain the list of equipment available to the Contractor for use in the performance of the TO. The GFE will be used and maintained by the Contractor in accordance with FAR clause 52.245-1, Government Property.

During contract transition, the Contractor will work with the Government property manager to transfer any GFE at the incumbent Contractor’s location. The Contractor shall receive, manage, and maintain all GFE throughout the duration of the TO.

Hardware and software procured by the Government will be received, managed, and tracked by the Contractor. Data packages for hardware and software procured by the Contractor shall be submitted to the Government.

1.5.2 Government Furnished Information (GFI)

Government furnished information (GFI) includes, without limitation, all software, related documentation, and training materials, including design documentation, and working papers that are the property of the Government or are subject to the license restrictions of other vendors. The NCAGSS contractors shall be authorized to modify, maintain, test, or enhance existing software to support growth for future missions. All subsequent software purchases or changes will remain the property of the U.S. Government. For any existing government owned systems, the Government will provide licenses. If for any new system, the contractor would be responsible for acquiring any required licenses.

1.6 Contract Execution

This IDIQ will encompass proposals against four task orders listed below.

a. TO1: Program Integration

b. TO2: Operations

c. TO3: Maintenance

d. TO4: Information Technology (IT) Infrastructure Sustainment

Each task order will individually be addressed and evaluated against the following criteria. Details on the criteria will be tailored for each task order. It is the intent of the government to make one or multiple awards for each task order proposal except TO1.

a. Technical approach

b. Management approach

c. Past performance

d. Small business participation

e. Price

Figure 1.6-1 NAaaS PI Task Order Integration Functions

TO 1 NAaaS Programmatic Integrator functions are depicted in Figure 1.6-1.

The execution for NAaaS PI, operations, maintenance, and sustainment functions of NESDIS-deployed antenna hardware, firmware, and antenna ground systems includes support for:

a. Satellite-to-Ground communications, including radio frequency (RF) antenna systems.

b. Common service capabilities that support mission scheduling, antenna ground system software/subsystem functions, and antennas monitoring and control.

c. Program execution and delivery of services using the National Institute of Standards and

Technology (NIST) and other security control guidelines.

d. Technical baseline evolution, both hardware and software that changes components or adopts new technology.

e. Utilizing Government approved cloud infrastructure services for Satellite Data Processing and distribution and Satellite Operations services.

2.0 Applicable Documents

Documents applicable to this contract include the NESDIS Systems Engineering and Program Management Policies and Procedures and OSPO Systems Description documents that apply to all OSPO systems. The most current editions are included in the NCAGSS Acquisition Document Library. Other reference documents include the most current edition of the DOC and NOAA IT Security Policies. These may be found at https://www.csp.noaa.gov/policies/.

The NIST Federal Information Processing Standards (FIPS) and Special Publications (SP) documents listed in Appendix B, Applicable Documents apply to all OSPO systems and reference the latest applicable revision of the document. The most current edition of the NIST FIPS and SP document may also be found at https://csrc.nist.gov/publications.

3.0 Requirements

NOAA may issue TOs as new mission requirements, evolving technologies or emerging services are identified for the Contractor to perform the requirements identified in this SOW. General requirements, provided below, are applicable to all TOs. Additional specific requirements are provided in each TO for Program Integration, Operations, Maintenance and Sustainment. Note some IDIQ TO requirements may be duplicated across TOs and are clearly identified as such.

3.1 General Requirements

The Contractor shall develop an Associate Contractor Agreement (ACA) per the requirements specified in Section H, Special Contract Requirements, in the IDIQ contract. The intent of this agreement is to provide a basis for sharing information, data, technical knowledge, expertise, and resources essential to the integration of the NAaaS program and to ensure the greatest degree of cooperation for the development of the program to meet the terms of the IDIQ contract.

The NAaaS PI and TO contractors shall:

a. Work with and share information with other Contractors to facilitate NAaaS enterprise Programmatic Integration.

b. Perform operations, maintenance, integration and sustainment activities as defined in individual TOs at locations listed in Section 1.4 for items listed in Tables 1.1-1.

c. Leverage use of commercial services including commercial Ground Systems as a

Service (GSaaS) for additional coverage and/or capacity when conducting trades for meeting new service requirements.

d. Provide personnel that possess the required education, level of experience, and professional and technical certifications per attachment J-2, Labor Category Description, of the IDIQ contract.

e. Provide personnel that possess the required security clearance which will be identified at the TO level.

f. Deliver products and services in accordance with the deliverables section of each TO.

g. Furnish labor as necessary, for packing, unpacking and placement of equipment when in the possession of the Government.

h. Use Commercial Off the Shelf (COTS) or open-source software wherever possible and, when cost effective, and obtain Government approval for all modifications to COTS.

i. Adhere to cybersecurity requirements.

j. Perform financial management and control of the execution of the work.

k. Provide financial management of the contract TOs including, spend plans, invoicing, fund status, engineering assessments (EAs) and travel management.

l. The Contractor shall participate in NAaaS monthly program reviews, providing project related information to the NAaaS PI.

m. The Contractor shall perform configuration management in accordance with the OSPO configuration management plan (current version) that includes support to Government enterprise tools; meeting management services; related documentation; configuration change documentation and related forms of applicable systems; support to the technical documentation library; configuration control board support; and operations procedure support.

n. The Contractor shall establish and maintain an enterprise-wide configuration baseline of all hardware and software that comprise the NAaaS system. The Contractor shall track software licenses usage and compliance, reclaim idle or stale software licenses, and be capable of removing any unauthorized software.

o. The Contractor shall support the physical configuration audit and tools to include regularly scheduled scans and inventories and related documentation/report deliveries.

p. The Contract shall perform the following:

a. Provide property management support (to include shipping and receiving tasks).

b. Ensure the currency of software licenses, hardware maintenance and warranties.

c. Provide procurement support.

d. Provide a written quarterly property and license status as part of the program review package

q. The Contractor shall provide deliverables for each TO in the content and format that is approved by the Government.

r. The Contractor shall submit reports in electronic format, as detailed in Task Order

Appendix A, Deliverables. The Contractor shall work with numerous file formats, including Microsoft Office® (.doc, .xls, .ppt, .mpp, .pdf, VISIO, and XML). The frequency of submission of program deliverables will be specified in Appendix A of the TOs.

3.1.1 Program/Project Management

Program management tasks and activities are performed to support all NESDIS antenna ground segments. These include: project management, contract transition management, schedule, deliverables (including key documents, plans, meeting support, meeting minutes and other documents), financial operations and cost management, staff management, configuration management, data management, systems engineering, asset management (includes inventories and audits), supply chain management (e.g., purchasing of hardware and software, firmware, software licenses, maintenance agreements/renewals), quality management, risk management, and training.

Program management is defined at the NAaaS program level and performed by the PI contractor.

Project management is defined at the TO level and performed by the TO contractors. Both the PI and TO contractors shall perform the following:

a. Provide program/project execution, cost and schedule control, assessment, and recommend and implement improvements.

b. Effectively manage and utilize subcontractors (as documented in a subcontracting plan).

c. Manage staff as documented in the staffing plan that includes support projections covering all TOs.

d. Provide quality assurance support (to include quality assurance plan and data call support).

e. Perform risk management and mitigation support (including risk management status reviews).

f. Provide personnel training (to include training plans during the contract period of performance).

3.1.2 Incoming and Outgoing Transition

The Contractor shall perform effective management and documentation of contract transition without impact to operations (as documented in Phase-in Transition and Phase-out Transition Plans for all activities). Transition requirements apply to all TOs.

The Contractor shall support transition of task responsibilities to and from other contracts as well as between TOs on this contract. These transition activities shall be closely managed so no operational impacts occur to any systems. Detailed transition requirements will be specified in the TOs.

The Contractor shall provide all resources to assume, transition, and execute the implementation for operating, maintaining, and/or sustaining one, or several systems over the contract period of performance.

3.1.3 Cloud Infrastructure Services

NOAA will continue to implement their cloud strategy documented in the NOAA Cloud Strategy, 2019-2024 (https://sciencecouncil.noaa.gov/wp-content/uploads/2022/08/2020- Cloud-Strategy.pdf), NESDIS will build out cloud based services using the NESDIS Common Cloud Framework (NCCF), which is an integrated cloud-based system that facilitates the flow of data from various sources including NOAA satellites, commercial partners, and other data providers through a comprehensive production pipeline.

Agile/DevSecOps methodologies are implemented under the Scaled Agile Framework’s (SAFe) Large Solution construct. TOs may be issued to implement technical objectives in information system operations, sustainment and modernization, as applicable. Objectives include cloud solutions to implement approved technology improvements, optimizations and efficiencies and lower total cost of ownership. NCAGSS tasks for cloud implementations will utilize Government-approved contract vehicles to procure cloud services per defined requirements, including, but not limited, to these FedRamp areas:

a. Virtual machine (or compute) services

b. Cloud testing services

c. Storage services

d. Network bandwidth (or data transfer) services

e. Management capabilities and tools

f. Professional services

g. Adopt and integrate implemented/existing NESDIS Enterprise tools and processes wherever feasible

The Contractor shall utilize Government-approved contract vehicles placed in service to procure cloud services per defined requirements provided in individual TOs, including these FedRamp areas:

a. Virtual machine or compute services

b. Cloud testing services

c. Storage services

d. Network bandwidth or data transfer services

e. Management capabilities and tools

f. Professional services

For such task requirements, the Contractor shall be expected to define, plan and document, implement, test, and verify all cloud implementation requirements, coordinate with the cloud provider, and monitor the cloud solution performance via metrics.

3.1.4 Cybersecurity

3.1.4.1 Continuous Monitoring and Situational Awareness

The Contractor’s designated security liaison shall coordinate with and report to the assigned NOAA Information and Cybersecurity program-designated Point of Contact (POC) to assist in implementing the required security controls for the compliant operation of satellite control and product processing systems. Please refer to Appendix A, NCAGSS Information & Cybersecurity Support Task Accountability Matrix Personnel Security Requirements for current roles and responsibilities between NCAGSS security support tasks and the IT Security program.

3.1.4.2 Incident Response

The Contractor shall coordinate and report remedial actions in response to IT security events or incidents to the NOAA Cyber Incident Response Team (N-CIRT) within 24 hours, or as specified in the OSPO Incident Response (IR) Plan.

3.1.4.3 System and Networking Monitoring

The Contractor shall complete monitoring activities of system and security logs and report issues to the designated Government POC.

3.1.4.4 Audit and Logging

The Contractor shall review system monitoring logs and complete reports, per the System Security Plans (SSP).

3.1.4.5 Vulnerability Assessment

The Contractor shall complete required vulnerability assessment activities, including authenticated monthly and quarterly scans and reporting.

The Contractor shall either upload completed vulnerability and configuration compliance scan reports to the NOAA enterprise vulnerability scanning tool or initiate the scans from the enterprise tool by the first day of each month for monthly vulnerability scans and website scanning. Vulnerability scans are due on the 15th day of the last month of the quarter (12/15/YY, 3/15/YY, 6/15/YY, 9/15/YY) or as required by NESDIS.

The Contractor shall maintain and update scanning tools and plugins for associated vulnerabilities one time a month.

The Contractor shall maintain and update scanning products and associated vulnerability at least monthly.

The Contractor shall initiate and complete scans from the NOAA Tenable Security Center or the single user NESSUS tool, the current NOAA standard vulnerability scanning tool. In some cases, other scanning tools may be used for specific components, e.g. WebInspect Enterprise or WebInspect single user for web pages.

The Contractor shall implement federal guidelines for CyberScope reporting as directed by DOC, NOAA, NESDIS, or OSPO policy.

The Contractor shall maintain a Scanning Exclusion List of system components excluded from automated vulnerability scanning due to age, mission, or technical considerations, and update and publish monthly per the NCAGSS Configuration Management process.

The Contractor shall assess all components identified on the Scanning Exclusion List for vulnerabilities using other technical means including manual evaluation, testing, and complete assessments as part of the monthly and quarterly vulnerability assessments reports.

The Contractor shall remediate vulnerabilities for all components identified on the Scanning Exclusion List.

3.1.4.6 Cybersecurity Compliance

The Contractor shall ensure this acquisition meets Department of Commerce (DOC) Enterprise Cybersecurity Policy (ECP) program requirements in accordance with Acquisition of Approved Products and Services for Personal Identity Verification (FAR 4.1302), Personal Identity Verification (PIV) of Federal Employees and Contractors (FIPS PUB 201-3), and Homeland Security Presidential Directive (HSPD)-12.

3.1.4.7 Contingency Planning

The Contractor shall provide support for input and support to maintaining the system Disaster Recovery/COOP and contingency activities plan. These plans shall be updated semi-annually, unless directed otherwise.

The Contractor shall coordinate with and provide input to the IT security representative to maintain the Contingency Plan Test Plan and Report (CPTPR). This plan is updated annually.

The Contractor shall participate in quarterly Contingency Plan (CP) training. All contractor staff shall complete CP training at least semi-annually.

The Contractor shall participate in testing the system Contingency Plan annually, and test system backup procedures quarterly. The failed actions related to contingency system testing shall be fully reflected in the annual Contingency Plan with established mitigations to correct the actions during the next test.

3.1.4.8 Flaw Remediation

The Contractor shall identify and report on information system vulnerabilities.

The Contractor shall test software updates related to flaw remediation for effectiveness and potential side effects on all affected systems before installation.

The Contractor shall maintain and implement DOC, NOAA, or flaw remediation tools, as applicable.

The Contractor shall provide input for the SSP on the reasons related to any component that cannot be patched such as age, mission, or technical impact.

3.1.4.9 Malicious Code Protection

The Contractor shall identify and document specific components unable to implement anti-malware protections. The Contractor is responsible for documenting, in conjunction with the ISSO, technical and operational considerations for equipment and software within their scope, facilitating the SSP and FIPS 200 risk acceptance process.

The Contractor shall maintain and implement the NOAA enterprise anti-malware tool.

3.1.4.10 Cybersecurity Program Management Support

The OSPO Cybersecurity Division manages the security architecture and engineering for each of the OSPO IT systems. The OSPO Cybersecurity Division manages the overall security compliance requirements for each of the OSPO IT systems utilizing a separate OSPO Cybersecurity contract.

The OSPO Cybersecurity Division will provide comprehensive IT security services, complete tasks, and submit deliverables and artifacts produced by NCAGSS Contractor in support of all aspects of IT security and IT security management for OSPO systems.

The OSPO Cybersecurity Division will implement required security control policies to ensure confidentiality, integrity and availability of the information resources integral to the successful operation of OSPO antenna systems, product processing and distribution systems, and Admin LANs.

IT and cybersecurity services for DOC NOAA systems will be implemented on a separate contract vehicle. However, security-related support for the NCAGSS contract will involve coordination with the OSPO Security Program (who leads critical IT and cybersecurity activities) to enable security solutions. Appendix A, of the NCAGSS Information & Cybersecurity Support Task Accountability Matrix, designates the task number, task description, whether the NCAGSS IT contractor leads or provides input for a task, and whether the task requires documentation, reporting, action, or a combination thereof. The NCAGSS contract security liaison shall provide oversight, leadership, coordination of all security related activities, and manage the NCAGSS support staff in achieving the functions below. This information applies to all TOs.

a. Perform scans, patching, and hardening.

b. Implement technical security controls.

c. Collect artifacts for security control assessments and technical Plan of Action &

Milestones ( POA&M).

d. Acquire security-related solutions identified by the NESDIS IT Security Program.

e. Implement and maintain the identified security-related solutions.

f. Provide input to security related document deliverables.

g. Perform component assessments, and other security related activities.

h. Adopt and integrate implemented/existing NESDIS Enterprise tools and processes wherever feasible

3.1.4.11 Cybersecurity Awareness & Training

All Contractor personnel shall complete the required NOAA training to include the Annual NOAA IT Security Awareness Training.

All Contractor personnel shall complete the Annual NOAA Role-Based Security Training 30 days before the established deadline each fiscal year.

3.1.4.12 Continuous Monitoring and Assessment & Authorization (A&A)

The Contractor shall support processes enabling the OSPO Cybersecurity Program Office to achieve compliance with Government security mandates and obtain/maintain an Authority to Operate (ATO) for each system.

The Contractor shall submit assigned Security Control Assessment (SCA) artifacts to the OSPO Cybersecurity Program Office as scheduled.

3.1.4.13 Plans of Action & Milestones (POA&M) Management

The Contractor shall manage technical POA&M milestones using NAaaS enterprise configuration management tools.

3.1.4.14 System Interconnection

The Contractor shall support information requests for all system Interconnection Security Agreements.

The Contractor shall review and implement connections in accordance with the Interface Control Documents (ICD) and report any discrepancies or changes to the Government.

3.1.4.15 System Security Documentation

The Contractor shall support information requests for Security Authorization Package for all NAaaS antenna portfolios and additional information or documentation required by updates to DOC, NOAA, NESDIS policies/procedures.

3.1.4.16 Security for SE, Change Management, and Configuration Management

The Contractor shall adhere to requirements specified in the approved Security Authorization Package Core Documents in Appendix A for all assigned NCAGSS systems and referenced requirements in DOC, NOAA, NESDIS, and OSPO policies and procedures.

3.2 Program Integration

3.2.1 Systems Engineering

Systems engineering at NESDIS requires the application of a systematic, disciplined engineering approach throughout the life cycle of a project. These processes will be applied to support all NESDIS NAaaS antenna ground segments. NESDIS has developed systems engineering policies and procedures to guide the NESDIS systems engineering activities. The Contractors ensures alignment with these processes while providing systems engineering services for the NOAA/NESDIS antenna enterprise.

NOAA/NESDIS collaborates with many domestic and international partners (e.g., NASA, USSF, EUMETSAT) to fulfill its mission. As such, in some cases, the Contractor shall ensure alignment with the partners’ systems engineering approach as well as with TO1, Program Integration, contractor guidance. In addition, the Contractor shall demonstrate an ongoing commitment to innovative Systems Engineering solutions, where applicable, that promote NAaaS architectural goals and streamline services, while minimizing associated costs and risks.

The NAaaS PI and TO contractors shall provide system engineering expertise and management planning activities as described below.

3.2.1.1 Systems Engineering Expertise

The Contractor shall provide subject matter expertise on systems engineering principles including Model Based Systems Engineering (MBSE) and Digital Systems Engineering (DE).

The Contractor shall employ the use of Digital Twins where applicable to improve the quality, cost, and schedule of the program.

3.2.1.2 Systems Engineering Management Planning

The Contractor shall:

a. Document Program Plans, Project Plans and System Engineering Management Plan

(SEMP).

b. Define and document Technical Performance Measures (TPM).

c. Organize and conduct management and engineering reviews.

d. Develop, update and maintain system architecture documentation and CONOPS.

e. Perform engineering analyses, assessments, trade analysis and studies, evaluations, and gap analysis of deficiencies.

f. Validate requirements.

3.2.1.3 Requirements Management

The Contractor shall perform requirements management activities for the NESDIS enterprise architecture in accordance with (IAW) procedures and processes contained in the NESDIS Requirements Management Procedural Requirements (NESDIS-PR-1303.1) or current version.

The Contractor shall support NOAA Administrative Order (NAO) 216-108, Requirements Management Process that specifically enables the Government to gather, analyze, allocate, decompose, and validate requirements.

3.2.1.4 Risk Management

The Contractor shall support and perform Enterprise Risk Management (ERM) IAW the NESDIS Requirements Management Procedural requirements (NESDIS-PR-1303.1) or current version.

Risk management planning includes the development of the Risk Management Plan (RMP), risk identification, risk assessment and analysis (qualitative and quantitative) and mitigation planning, risk handling/action, risk tracking and control, risk documentation communication and participation in an NAaaS monthly risk review.

The Contractor shall develop a Supply Chain Risk Management (SCRM) Plan identifying supply chain vulnerabilities, threats, and potential disruptions throughout the supply chain and implementing mitigation strategies to ensure the security, integrity, and uninterrupted flow of materials, products, and services The Contractor shall contact SCRM_IOC@doc.gov with questions on supply chain risk considerations and/or Supply Chain Risk Assessment (SCRA) requirements.

3.2.1.5 Configuration Management of Technical Baseline

The Contractor shall manage, maintain, and perform comprehensive programmatic configuration control as outlined in the NESDIS Configuration Management Procedural Requirements (NESDIS-PR-1304.1). The Contractor shall use and support the Government’s Configuration Management processes including providing technical inputs regarding actions coming before the Engineering Review Boards (ERBs) and Configuration Control Boards (CCBs). The Contractor shall maintain the baseline of all hardware and software assets of the NAaaS antenna systems. The Contractor shall track software licenses usage and compliance, reclaim idle or stale software licenses, and remove unauthorized software in accordance with IT and Cybersecurity policy and mandates.

3.2.1.6 Knowledge Management

The Contractor shall support the implementation of a Knowledge Management process and capture lessons (both positive and negative) that pertain to the success of the program. The purpose is to (a) ensure that existing knowledge and lessons learned are appropriately incorporated into the program, and (b) the lessons learned during this program are captured and incorporated throughout the program lifecycle to reduce the likelihood of repeating problems and reducing risk.

3.2.1.7 Ground Systems Engineering Support

The Contractor shall provide a broad range of systems architecture, systems engineering and program/project management services to support the development and sustainment of NESDIS ground systems. The Contractor shall provide expertise and working knowledge in cloud design, cloud development, DevSecOps, Agile Methodologies and best practices.

3.2.1.8 Test Support

The Contractor shall provide system engineering services for test support for Qualification, Acceptance, Development, Operations, and Integration.

3.2.1.9 Transition to Operations

The Contractor shall provide support in all transition phases of systems life cycle development.

These transition phases include design reviews, test campaigns, and operational readiness reviews.

3.3 Operations

Operational activities are performed to ensure effective command and control of satellites, acquisition of mission data, and efficient use of NESDIS and commercial ground networks.

Operations are supported on a 24-hour x 7 days basis with defined remote backup and contingency capabilities that ensure the high availability and reliability of services. NESDIS Operations transform satellite and in-situ environmental observations into desired data and information products and related services that either create or deliver value to NOAA and other customers (both internal and external to NOAA).

Core functional areas of NESDIS satellite operations include:

a. Support of launch, activation, and evaluation of new satellites.

b. Monitoring and verification of satellite health and status.

c. Collecting and distributing satellite telemetry, tracking and command (TT&C) data and

Stored Mission Data (SMD).

d. Satellite commanding and ranging.

e. Managing, monitoring, and configuring associated antenna ground segment elements.

f. Ensuring a secure operational environment.

The Contractor shall support all antenna related functional areas of NESDIS satellite operations.

The Government will provide infrastructure and procedural details to the Contractor for the safe and effective execution of deployed system activities assigned under specific TOs.

The Contractor shall perform operations activities on the NAaaS antenna portfolio as identified in individual TOs.

The Contractor shall perform and support NAaaS operation activities and functions to support efficient and effective command and control of satellites and NESDIS ground networks, data acquisition from a spectrum of observing and computational systems as provided in NCAGSS Acquisition Document Library

The Contractor shall provide NAaaS operations support daily, seven (7) days per week, 365 days per year; including leap year, with defined remote operational back-up and contingency capabilities, while meeting system availability and reliability requirements.

The Contractor shall provide NAaaS operations support for core functional areas of satellite operations. Core functional areas include:

a. Launches and transition to operation activities.

b. Detection, identification and assessment of antenna ground system anomalies.

c. Managing, monitoring, and configuring the associated antenna ground segment elements.

d. Ensuring continuous security compliance in the operational environment.

The Contractor shall provide daily NAaaS operational support activities for managing a satellite command and control center.

Antenna operational support activities include:

a. Satellite launch and commanding activities.

b. Systems analysis support during operational anomalies.

c. Network, systems, workstation, printer and satellite hardware support.

d. Antenna operations support.

e. Network and security monitoring

f. Continuity of operations (COOP)

g. Operations training.

The Contractor shall provide support to the Government in updating and reviewing current Standard Operating Procedures (SOP)s.

The Contractor shall provide support to the Government in verifying and ensuring the accuracy of the Operational Systems’ configuration files.

3.4 Maintenance

Maintenance activities ensure the overall NAaaS antenna ground systems continue to meet scientific, technical, functional, and performance requirements in addition to availability and reliability requirements and that the appropriate security posture is maintained. These include:

a. Preventive Maintenance: Changes to antenna ground systems or software with the intent to prevent errors, problems or failures before they occur.

b. Corrective Maintenance: Reactive (emergency) and routine (planned) fixes that are needed because of anomalies such as network and data outages, hardware failures, security vulnerabilities and software problems.

c. Limited Scope Adaptive Maintenance- Modifications that can be performed by operations support personnel, and that maintain current system requirements and the controlled configuration and interfaces.

In all cases, maintenance integration and test activities and regression testing are performed to verify the results of the maintenance action and to ensure that none of the modifications negatively impact the functional performance of the operational baseline system.

Return to service consists of repairs and configuration adjustments. These activities are performed by Government and TO contractors and shall include the following:

a. Initial anomaly response.

b. Anomaly investigation, configuration adjustment, and minor repair (software, hardware, minor script adjustments, etc.) required to return the system to operational status.

c. Work Request/Configuration Change Request (WR/CCR) generation in the OSPO Configuration Management System in the event escalation is needed.

d. Fault isolation.

e. Temporary workarounds.

f. IT security patching and scanning.

g. After hours support - Quick reaction for restoration of service (in accordance with the Mean Time To Repair (MTTR).

Antenna and supporting infrastructure maintenance activities consist of maintenance, testing and replacement. These activities are performed by TO contractors and shall include the following:

a. Change Control Board (CCB) forum to set priorities, schedule maintenance, collect WR/CCR tracking metrics.

b. Baseline and Configuration Management (CM).

c. Software installation/distribution.

d. WR/CCR troubleshooting, analysis, and changes to baseline.

e. Testing and integration support to include comprehensive regression testing.

f. After hours reach-back support.

g. Pre-launch activities to include 24/7 support.

h. Launch and Early Orbit Phase (LEOP) activities to include 24/7 support.

i. Post-launch support.

j. Continuity of Operations (COOP) support.

k. Permanent restoral of service solution.

More complicated repairs are limited to labor and materials needed to keep the system properly functioning. These activities shall include:

a. Systems engineering/integrated logistics.

b. Configuration, risk and budget management.

3.4.1 Maintenance System Engineering

Maintenance System Engineering requirements are listed in Section 3.2.1 System Engineering.

3.4.2 Maintenance Activities

The Contractor shall perform maintenance activities on the NAaaS antenna portfolio as identified in individual TOs.

The Contractor shall document changes to the NAaaS antenna portfolio at the configuration item (CI) level in accordance with SOPs and established Configuration Control processes.

The Contractor shall maintain the NAaaS antenna portfolio for compliance with technical, functional, performance, availability, reliability, and security requirements and specifications.

The Contractor shall support all required communication methods to the Government to assure prompt continued status of the systems being maintained.

3.4.3 Capacity Planning

The Contractor shall perform performance or capacity management activities. Performance and capacity management activities include:

a. Studies required by the Government including integrated evaluation and planning for commercial products and services.

b. Document capacity planning and performance management procedures.

c. Monitor and report of component performance, utilization, and efficiency.

d. Manage component resources (e.g. devices and traffic) to comply with defined availability and performance service levels.

e. Develop and implement improvement plans to address capacity issues.

3.4.4 Preventative and Corrective Maintenance

The Contractor shall perform preventative and corrective maintenance, modifications, planned and unplanned activities, and maintain a spare depot for NAaaS antenna portfolio as specified in individual TOs at all work locations. This includes the following functions:

a. Develop and implement an Antenna System Maintenance Plan for OSPO antenna systems. This plan shall include the schedule (daily, weekly, monthly, semi-annual and annual) and type of inspections necessary to maintain the antenna system.

b. The Contractor shall maintain and submit the Antenna System Maintenance Records for maintenance tasks performed on the antenna systems.

c. Provide and maintain an antennas ground support equipment Maintenance Plan inclusive of preventative maintenance .

d. Create and deliver for Government approval work packages inclusive of material procurements and test plans .

e. Conduct quarterly visual inspections of all equipment.

f. Correct error conditions per a help desk ticketing process.

g. Perform preventative maintenance on a quarterly basis; coordinate all maintenance schedules and timelines.

h. Identify system components and software within one (1) year of obsolescence.

i. Perform all software maintenance functions, patching and software license compliance management.

j. Provide IT security maintenance support.

k. Perform planned and unplanned maintenance.

l. Develop and maintain SOPs.

m. Maintain current satellite operations ground system equipment within acceptable quality levels.

n. Manage and perform depot level spares inventory management, repairs, and the return of defective equipment to the vendor for repair or replacement.

3.4.5 Installation, Removal and Relocation

The Contractor shall provide schedules for Government approval, and perform all equipment upgrades, installations, removal and relocations within the agreed upon times; ensure no equipment is damaged during installations, removal, or relocations; and ensure installations and relocations comply with building and electrical codes (e.g. National Electrical Code).

The Contractor shall provide, to the COR or authorized Government official, for approval, a schedule for any new hardware installations. The Contractor shall install new hardware after receiving written Government approval.

3.5 Sustainment

Sustainment is defined as pre-planned activities performed to develop, modernize, or enhance components. Sustainment activities are conducted to reduce life cycle costs (or provide the best return on investment); leverage technology advancements and improvements; improve the capability, reliability and robustness of the system; and extend the system life to meet program-life requirements. Development activities shall be managed and executed using methods appropriate to the work; methods shall include both traditional waterfall and Agile/DevSecOps approaches. Sustainment activities also include the modernization (or technology refreshment) of existing hardware and software to add new capabilities to meet Government requirements.

These activities may include the following:

a. Incorporating next generation technologies to promote and further enterprise objectives.

b. Developing, integrating, testing and implementing a new sub-component of an existing system.

c. Enhancing operations by improving existing system components or capabilities.

d. Adding new capabilities to meet NOAA requirements to provide the best return on investment.

e. Upgrading to new versions of commercially available off-the-shelf (COTS) software and hardware.

f. Installing and enabling new enterprise tools.

g. Transitioning historic hardware-based components to a digital ground solution.

h. Buildout of next generation antenna capabilities.

The NAaaS concept is to scale ground common service antenna infrastructure (antenna, antenna ground system devices and network) to establish a common service antenna infrastructure supporting antennas used for multiple missions. The objectives of this concept will be met by multiple activities to include but not limited to the following:

a. Modification of Hurricane Rated (HR) antennas, which were originally designed and designated for GOES-R mission use, to support space weather missions to make them multi-mission antennas.

b. Modification of Space Weather Antenna Network (SAN) antennas, which were originally designed and designated for space weather mission use, to support GEO missions to make them multi-mission antennas.

c. Modification of the antennas (9.1m) on NSOF rooftop to re-purpose them for monitoring health and safety of the GEO satellites in spare orbit.

d. Incorporating multi-band antennas in the NAaaS architecture.

e. Inserting new emerging antenna, monitoring and control technologies such as system modeling, Artificial Intelligence (A/I), Machine Learning (M/L) into the NAaaS architecture.

f. Enterprise antennae monitor and control services

g. Implement FISMA boundary compliance

h. Interfacing…