Enterprise Records Management - Feith SOW_v2_FINAL.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency (NGA)

Office of the Chief Data Officer (OCDO)

Enterprise Records Management (ERM)

Statement of Work (SOW) Version 1.0

9 September 2026

FINAL

TABLE OF CONTENTS

1.0 Introduction

1.1 Background

1.2 Scope ……………………………………………………………………………………………………………………………………………………………5

2.0 Applicable Documents

2.1 Compliance Documents

2.2 Reference Documents

3.0 Description of Work

3.1 RMA iQ Platform Installation and Configuration

3.2 System Integration Services

3.3 Legacy System Migration

3.4 AI-Powered Categorization and Metadata Management

3.5 Solutions-level Architecture Support

3.6 Level of Effort ......................................................................................................Error! Bookmark not defined.

Table 1: Base Year Level of Effort

4.0 Transition

Table 2: Transition Availability

4.1 Security Onboarding

4.2 Sensitive Compartmented Information Facility (SCIF)

4.3 Transition Closeout

5.0 Deliverables

5.1 Kick-Off Meeting

5.2 Biweekly Meetings

5.3 Quarterly Reviews

5.4 Monthly Financial Report (MFR)

5.5 Monthly Staffing Report (MSR)

5.6 Monthly Activity Report (MAR)

5.7 Trip Reports

5.8 Technical Exchange Meetings (TEM)

5.9 CDRL Matrix

6.0 General Provisions

6.1 Primary Place of Performance

6.2 Telecommuting (Telework)

6.3 Government Furnished Property (GFP)

7.0 Security

7.1 Classified Work Performance Security Requirements

7.2 Unclassified Work Performance Security Requirements

7.3 Information Handling

SOW Version Change Section/Page Number Date

1.0 Introduction

This Task Order (TO) will provide Electronic Records Management (ERM) implementation services for the Office of the Chief Data Officer (CDO) within the National Geospatial-

Intelligence Agency (NGA). The contractor shall install, configure, integrate, and provide ongoing support for the Feith RMA iQ platform to enable enterprise-wide electronic records management across classified networks in compliance with federal records management regulations and NARA requirements.

1.1 Background

NGA requires a comprehensive Electronic Records Management solution to manage the full lifecycle of all agency records in compliance with the Federal Records Act, NARA Universal

Electronic Records Management (UERM) requirements, 36 CFR 1236 Electronic Records

Management, and relevant Executive Orders. The agency currently lacks an enterprise-wide records management system capable of managing records across both NIPR and JWICS networks with automated compliance, AI-powered categorization, and integrated metadata management.

Along with the people who support NGA's critical mission, NGA data is a key strategic asset that fuels decision support and mission advantage at all levels. The Office of the Chief Data

Officer (CDO) realizes NGA's data roadmap to support accessing, sharing, and managing content and analytics. The ERM implementation directly supports CDO's key goals:

• Manage Data as a Strategic Asset: Flexible, adaptive governance framework provides autonomy and flexibility to mission areas to enable decision making at the speed of mission, including acceleration of the data stewardship program to support rapid, transparent decision making.

• Deliver Shared Data Services: Deploy shared data services that break down data silos and enable the NGA workforce to directly and intuitively discover and access the data they need.

• Scale Data and Analytic Capabilities: Coordinate and scale best of breed data and analytics initiatives across the enterprise to accelerate the identification, acquisition, and adoption of advanced GEOINT capabilities.

The RMA iQ platform will enhance NGA's records management program through automation of cataloging, records dispositioning, and metadata assignment to electronic records. Search capabilities will be enhanced to decrease retrieval timelines for records in Freedom of

Information Act requests, congressional inquiries, and litigations. This implementation supports

NGA's collaboration with the National Archives and Records Administration for the revision of the Records Control Schedule (RCS) 700 Series Intelligence and Imagery Files as an agency efficiency effort to modernize the preservation of NGA records in an electronic era.

1.2 Scope

The Contractor shall perform ERM implementation and support services in accordance with the requirements specified in this TO. The Contractor shall install and configure the RMA iQ platform to manage permanent records for 5,000 members across one classified network, integrate with existing NGA infrastructure, migrate legacy records system, implement AI-powered categorization and metadata management capabilities, and provide ongoing technical support through a dedicated on-premises System and Application Administrator in Option Year

1. A brief description of the activities to be supported under this TO are as follows:

• RMA iQ Platform Installation and Configuration: Install, configure, and deploy the RMA iQ platform across the JWICS network to support the management of the permanent records of 5,000 members with full NARA compliance capabilities.

• System Integration Services: Integrate RMA iQ with existing NGA infrastructure including credentialing systems, SharePoint, email server, file shares, OneDrive, Teams, and legacy system to enable automated records capture.

• Legacy System Migration: Migrate digitized legacy records holdings in accordance with

36 CFR 1236 Subpart D and E, implementing automated metadata capture and quality assurance processes.

• AI-Powered Categorization and Metadata Management: Implement and optimize AI-powered auto-categorization, metadata extraction, and semantic search capabilities to automate records classification and enhance discoverability.

• Training and Documentation: Develop comprehensive training materials and system documentation to enable NGA personnel to effectively utilize the ERM platform.

• Ongoing Technical Support: Provide dedicated on-premises System and Application

Administrator throughout option years to deliver continuous technical support, system optimization, and records application expertise.

2.0 Applicable Documents

Applicable documents specified in this section are required for execution of the work described in the SOW. These documents provide additional detail to those listed in the Base SOW.

2.1 Compliance Documents

• Federal Records Act (44 U.S.C. Chapters 21, 29, 31, and 33)

• 36 CFR Chapter XII, Subchapter B - Records Management

• 36 CFR 1236 - Electronic Records Management

• 36 CFR 1236 Subpart D - Digitizing Permanent Records

• 36 CFR 1236 Subpart E - Digital Preservation

• NARA Bulletin 2015-04 - Metadata Guidance for the Transfer of Permanent Electronic

Records

• NARA Universal Electronic Records Management (UERM) Requirements

• DoDI 5015.02 - DoD Records Management Program

• DoDM 8180.01 - Cybersecurity of DoD Information Systems (as applicable)

• ICD 503 - Intelligence Community Information Technology Systems Security Risk

Management, Certification and Accreditation

• Executive Order 13556 - Controlled Unclassified Information

• 32 CFR Part 2002 - Controlled Unclassified Information

• CNSSI 1253 - Security Categorization and Control Selection for National Security

Systems

• FedRAMP Security Assessment Framework

2.2 Reference Documents

• NGA Records Control Schedule (RCS) 700 Series Intelligence and Imagery Files

• NGA Records Management Policy

• NGA Information Technology Security Policy

• DoD 5015.02-STD - Electronic Records Management Software Applications Design

Criteria Standard

• NIST SP 800-53 Rev. 5 - Security and Privacy Controls for Information Systems and

Organizations

• NIST SP 800-88 Rev. 1 - Guidelines for Media Sanitization

3.0 Description of Work

3.1 RMA iQ Platform Installation and Configuration

The Contractor shall install and configure the RMA iQ Electronic Records Management platform to support the management of the permanent records of 5,000 members across NGA’s

JWICS network. Installation and configuration activities include, but are not limited to:

• Install RMA iQ software on government-provided infrastructure or government-provided cloud environment as directed by the Government, ensuring compliance with NGA security requirements and FedRAMP authorization standards.

• Configure the platform to support 1,000 concurrent users, supporting up to 5,000 user accounts, with role-based access controls, ensuring appropriate permissions based on user clearance levels, organizational affiliation, and functional responsibilities.

• Implement NARA-compliant metadata schemas capturing all required metadata fields including unique identifiers, author, office, creation date, CUI markings, classification markings, and rights management information.

• Configure retention schedules based on NGA's Records Control Schedule (RCS), including the 700 Series Intelligence and Imagery Files, and General Records Schedule

(GRS) categories, ensuring automated application of retention rules upon record capture.

• Establish disposition workflows with automated notifications to Records Officers when records become eligible for deletion or transfer to NARA, including approval processes and audit trail requirements.

• Configure legal hold capabilities to prevent disposition of records subject to litigation, FOIA requests, or other legal requirements, with appropriate tracking and release mechanisms.

• Implement Capstone email management approach, automatically designating emails sent to and from Capstone Official accounts as permanent records while applying appropriate retention policies to non-Capstone emails.

• Configure access controls for Controlled Unclassified Information (CUI) and classified records, ensuring compliance with 32 CFR Part 2002 and appropriate security markings.

• Establish audit logging to capture all user interactions with records including access, modifications, transfers, and deletions, maintaining tamper-proof audit trails for compliance verification.

• Configure ERA 2.0 transfer capabilities to generate NARA-compliant transfer packages meeting 36 CFR 1236.58 Subpart F requirements, including required metadata, manifests, and logs.

• Implement cryptographic hash generation for all ingested records to create digital fingerprints preventing tampering and enabling integrity verification.

• Configure fixity checks using checksums to verify data integrity and detect corruption or unauthorized modifications.

• Establish system health monitoring and performance dashboards providing real-time visibility into ingestion rates, indexing progress, storage utilization, and system performance metrics.

3.2 System Integration Services

The Contractor shall integrate the RMA iQ platform with existing NGA infrastructure to enable automated records to capture from scoped agency record sources. Integration activities include:

• Integrate with NGA's credentialing system to enable Single Sign-On (SSO), Common

Access Card (CAC), and Personal Identity Verification (PIV) authentication, ensuring seamless user access while maintaining security controls.

• Implement SharePoint Connector to enable continuous synchronization of documents, ensuring new and modified records are automatically captured and preserved with complete version history.

• Implement Email Connector to capture email records from Exchange server, applying

Capstone policies and retention schedules automatically based on sender/recipient

Capstone status.

• Implement File Share Connector to continuously scan designated network drives and shared folders, detecting and capturing records as they are created or modified without manual intervention.

• Implement OneDrive Connector to capture records from user OneDrive accounts, ensuring personal work products are appropriately preserved as agency records.

• Implement Teams Connector to capture collaboration records including chat messages, channel posts, and shared files from Microsoft Teams environment.

• Develop and implement custom API connector for integration with NGA's SAP system to enable day-forward record capture of business system records.

• Develop and implement custom API connector for integration with SuccessFactors to capture human resources records in accordance with retention requirements.

• Configure connectors to preserve complete version history when records are modified in source systems, maintaining auditable record of all changes.

• Implement automated sweepers for SharePoint, File Shares, OneDrive, and Teams to continuously monitor integrated systems, detecting new records and modifications without requiring human intervention.

• Configure metadata mapping to automatically extract and populate required NARA metadata fields from source system attributes during record capture.

• Establish error handling and notification processes to alert administrators of integration failures, connectivity issues, or records that cannot be automatically captured.

• Conduct integration testing to verify seamless data flow from all source systems, validate metadata accuracy, and confirm retention rules are correctly applied.

• Document all integration specifications, API endpoints, authentication methods, and data mapping logic in government-owned technical documentation.

3.3 Legacy System Migration

The Contractor shall migrate digitized legacy records holdings to consolidate NGA's records into the centralized RMA iQ platform in accordance with 36 CFR 1236 Subpart D and E.

Migration activities include:

• Conduct inventory and assessment of legacy records systems identified by the

Government, documenting record volumes, formats, metadata completeness, and migration complexity.

• Develop migration plans for legacy systems, defining extraction methods, data mapping, metadata enrichment approaches, quality assurance procedures, and migration schedules.

• Extract records from legacy systems using appropriate methods including database queries, API calls, file system access, or manual export processes as required by source system capabilities.

• Implement automated detection and removal of redundant, obsolete, trivial, and duplicate records during migration, reducing unnecessary data retention while maintaining records integrity.

• Map legacy metadata fields to RMA iQ NARA-compliant metadata schema, enriching incomplete metadata through AI-powered extraction where possible and flagging records requiring manual metadata completion.

• Preserve document relationships and links during migration, updating references to maintain navigability and context between related records.

• Apply structured validation to migrated records, verifying file integrity, metadata completeness, and successful transfer into RMA iQ.

• Implement AI-powered metadata extraction to automatically identify and capture

NARA-required metadata fields from digitized documents, including document type, author, date, subject matter, and office of origin.

• Apply AI-powered auto-categorization to classify digitized and migrated records according to appropriate GRS or RCS categories, assigning retention schedules automatically.

• Conduct quality assurance checks on migrated records, sampling records to verify metadata accuracy, image quality, successful categorization, and system accessibility.

• Generate migration reports documenting records processed, metadata enrichment performed, duplicates removed, quality assurance results, and any records requiring manual intervention.

• Provide Government with recommendations for legacy system decommissioning once migration is verified complete and records are accessible in RMA iQ.

3.4 AI-Powered Categorization and Metadata Management

The Contractor shall implement and optimize AI-powered capabilities to automate records classification and metadata management, leveraging the Government-provided LLM. AI implementation activities include:

• Configure AI-powered auto-categorization using Record Insight's hybrid approach, applying rule-based categorization for well-structured records and Large Language

Model (LLM) analysis for unstructured records lacking complete metadata.

• Inform AI models on NGA's Records Control Schedule (RCS) categories and General

Records Schedule (GRS) categories, enabling the system to autonomously assign records to correct retention schedules.

• Configure confidence scoring thresholds, establishing Government-approved minimum confidence levels below which the system refrains from automatic categorization and routes records for manual review.

• Implement transparent rationale generation for each AI classification decision, ensuring defensibility and enabling Records Officers to understand and validate automated categorization.

• Configure AI-powered metadata extraction to automatically identify and populate

NARA-required metadata fields from record content, including document type, author, office, creation date, subject matter, and CUI markings.

• Implement Semantic Vector technology to enable context-aware analysis of record content, improving classification accuracy for records with ambiguous terminology or complex subject matter.

• Configure pattern-based detection for sensitive data including Social Security numbers, project codes, agency-specific keywords, and CUI indicators, automatically applying appropriate access controls and security markings.

• Implement AI-powered CUI Finder (if selected by Government) to automatically scan record content for Controlled Unclassified Information and Personally Identifiable

Information, flagging sensitive records for appropriate handling.

• Configure semantic search capabilities enabling users to find records using natural language queries, synonyms, and conceptual relationships rather than exact keyword matching.

• Optimize AI model performance through iterative testing on NGA-specific records, incorporating feedback from Records Officers on classification accuracy and adjusting confidence thresholds as needed.

• Monitor AI categorization accuracy and generate reports on confidence score distributions, manual review rates, and categorization trends to support continuous improvement.

• Provide Government with AI model documentation including testing data sources, confidence scoring methodology, and performance metrics to ensure transparency and auditability.

3.5 Solutions-level Architecture Support

The Contractor shall develop and deliver comprehensive training and documentation to enable

NGA personnel to effectively utilize the RMA iQ platform. Training and documentation activities include:

• Develop role-based training curriculum tailored to different user groups including end users, Records Officers, system administrators, and technical support personnel.

• Deliver on-site training sessions at NGA facilities for initial user onboarding, providing hands-on instruction in records search, retrieval, categorization, and lifecycle management.

• Deliver remote instructor-led training classes via secure video conferencing for geographically distributed users, ensuring all NGA personnel have access to training regardless of location.

• Develop on-demand training videos covering key system functions, enabling users to access just-in-time training and refresh their knowledge as needed.

• Conduct train-the-trainer programs to develop internal NGA subject matter experts capable of providing ongoing peer support and conducting future training sessions.

• Develop comprehensive user guides covering all system functions including search and retrieval, manual categorization, metadata editing, legal hold management, and disposition approval processes.

• Develop system administrator guides covering platform configuration, user management, retention schedule administration, integration monitoring, and troubleshooting processes.

3.6 Basis of Price and Scope Assumptions

The services described in Sections 3.1 through 3.5 shall be performed on a firm-fixed-price basis.

Table 1 defines the professional services hours allocated by task area for this SOW, reflects the basis on which the Base Year price was developed, and states the assumptions on which each allocation is based. The Contractor may redistribute effort among task areas as needed to complete the services. Services requested beyond the allocated hours, or outside the scope and assumptions in Sections 3.1 through 3.5 and Table 1, will be addressed with the Contracting

Officer and incorporated by contract modification.

The allocations assume completion within the Base Year period of performance, with

Government-furnished information, access, accounts, environment readiness, and approvals provided within a reasonable amount of time. Delays in Government-dependent inputs that extend performance will be addressed by contract modification.

Table 1: Base Year Level of Effort

Professional Services

Task Area

SOW

Ref

Est.

Hours Scope Assumptions

Platform Installation 3.1 160

1 production and 1 non-production environment in a single enclave; Government-provided infrastructure meeting the Contractor's published specifications

Retention Schedule

Implementation

3.1 160

NGA RCS categories mapped to GRS and system rules;

Government provides the approved RCS in Excel or equivalent format

RMA iQ

Implementation

3.1 160 Implementation of core RMA iQ module

Credentialing System

Integration

3.2 160 1 credentialing system; standard PKI or CAC integration eMail Capstone

Ingestion

3.2 160

1 Exchange or Exchange Online tenant; up to 5,000 accounts

SharePoint Ingestion 3.2 160 1 SharePoint tenant to be implemented with assistance from NGA Technical team

File Share Ingestion 3.2 160 File share roots to be implemented with assistance from

NGA Technical team

OneDrive Ingestion 3.2 160 1 tenant; up to 5,000 user accounts

Teams Ingestion 3.2 160 1 tenant; up to 5,000 user accounts and their associated teams

Legacy

Migration/Ingestion

3.3 720

Up to 1 legacy source systems; Government provides source system access and export in agreed format; 1 QA cycle per source

AI Categorization

Implementation

3.4 300

Up to 300 hours on configuration and testing for AI

Categorization prompts

Training, 3.5 160 Up to 2 role-based sessions, delivered remotely or on site

Professional Services

Task Area

SOW

Ref

Est.

Hours Scope Assumptions

Documentation at one location; one set of user and administrator guides

Project Management

3.1 to

3.5

12-month Base Year performance period; weekly status meetings; monthly status reports

SAP ARC

Implementation

3.2 160

Contractor provides documentation and instruction on utilizing the API for Records Capture and builds internal cabinets and structures to receive records. Government deploys web service within SAP workflow.

SuccessFactors ARC

Implementation

3.2 160

Contractor provides documentation and instruction on utilizing the API for Records Capture and builds internal cabinets and structures to receive records. Government deploys web service within SuccessFactors workflow.

Total 3,675

The Option Year quotes allocate professional services hours to continued configuration and implementation support, AI implementation and support, and project management. Services in any exercised Option Year are based on the allocations and assumptions in the applicable Option

Year quote; services beyond those allocations will be addressed with the Contracting Officer and incorporated by contract modification.

4.0 Transition

Contract Initiation Plan Officer’s Representative (COR) within 7 calendar days of award detailing the onboarding process of all personnel identified in Appendix A of this SOW to ensure successful performance during the transition period. The plan shall document the process used to transition personnel and resources at the start of work, identify appropriate in-processing activities (e.g., training, security, equipment, etc.), and include Contractor employee names, company, clearance information, polygraph information, and security nomination (eNomination) submission dates.

The Contractor shall comply with the guidance in the table below.

Table 2: Transition Availability

Calendar Days After

Award Contractor Personnel

7 Days & 14 Days

• All Key Personnel eNomination Requests (eNom) submitted (within 7 days) and available for task order performance (within 14 days).

15 Days

• At least 25% of all staff eNom submitted and available for task order performance.

30 Days

• At least 50% of all staff eNom submitted and available for task order performance.

45 Days

• At least 75% of all staff eNom submitted and available for task order performance.

60 Days

• 100% of all staff eNom submitted and available for task order performance.

4.1 Security Onboarding

The Contractor’s key personnel and any other personnel requiring access to classified systems shall have active Top Secret and be Sensitive Compartmented Information (TS/SCI) eligible at contract award.

To minimize the risk of a delay in supporting transition startup, the Contractor’s Security Office shall use the NGA eNomination system to nominate employees for personnel security clearances, facility badges, and system access. Upon security clearance approval, the Contractor shall schedule their personnel for clearance briefing and badges with the appropriate office(s) at NGA.

4.2 Sensitive Compartmented Information Facility (SCIF)

Any SCIF(s) that will be utilized to perform SCI work at contract sites must be coordinated with the Contracting Officer (CO) and NGA Physical Security Team 7 days after award to ensure

NGA authorization and accreditation is granted for work to be performed in the Contractor SCIF.

Note: All SCI work performed at a Contractor site must be performed in either an NGA accredited Sensitive Compartmented Information Facility (SCIF) or an Other Government

Agency (OGA) SCIF that has either a Memorandum of Agreement (MOA), Memorandum of

Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this effort.

4.3 Transition Closeout

The Contractor shall support transition to another Contractor or to Government personnel as directed by the Government. Transition support shall commence upon written notice from the

Contracting Officer, which the Government shall issue no later than 90 days before the end of the period of performance, and shall be performed within the level of effort and funding established under CLIN [XXXX], Transition Support. Transition support to a successor

Contractor shall be limited to knowledge transfer regarding the items listed in this section. The

Contractor shall not be required to perform installation, configuration, training, or other services on behalf of a successor Contractor. The Contractor shall review and transition knowledge and relevant information concerning the Government’s implementation of the RMA iQ Electronic

Records Management platform, system integrations, AI-powered categorization configurations, metadata management, and standard operating procedures developed or configured under this contract. The Contractor shall provide the following items by the end of the contract in accordance with the following Government direction:

• RMA iQ Platform Documentation that provides a description of the current operational baseline of the Government’s instances for each security domain (JWICS). The documentation will contain the following: system architecture, configuration management, software configuration, integration specifications, retention schedule configurations, metadata schema definitions, AI configuration parameters, user role definitions, access control matrices, and capture of the hardware and software architectures. For commercial software components, this documentation shall consist of the Contractor's standard product documentation together with the Government-specific configuration settings.

• System Integration Documentation detailing all connectors and integrations configured or developed by the Contractor during contract performance, including credentialing system integration, SharePoint connector configuration, email capture settings, file share sweeper configurations, OneDrive and Teams connectors, SAP API connector specifications, and SuccessFactors API connector specifications. Documentation shall include API endpoints, authentication methods, data mapping logic, error handling procedures, and integration testing results as configured and executed in the

Government’s environment. For connectors that are commercially licensed components of the RMA iQ product, documentation shall consist of the standard product documentation and the Government-specific configuration settings.

• AI Configuration Documentation providing complete details of AI-powered auto-categorization configuration established for the Government's implementation, including confidence scoring thresholds, categorization rules, semantic vector index configurations, metadata extraction patterns, CUI detection parameters, and AI categorization performance metrics as measured during contract performance. Documentation shall be sufficient to describe the configuration in place at the end of the period of performance.

The language models underlying the auto-categorization capability are commercial components and are not trained or fine-tuned on Government data; model weights, training data, and model architecture are Contractor or third-party proprietary information and are not deliverables under this contract

• Records Control Schedule (RCS) and Retention Configuration documentation detailing all retention schedules implemented in the system under this contract, including mappings between NGA RCS categories, General Records Schedule (GRS) categories, and system retention rules. Documentation shall include disposition workflows, approval processes, legal hold procedures, and ERA 2.0 transfer configurations as configured in the Government’s instances.

• Legacy System Migration Documentation providing records of all migration activities performed under this contract, including source system inventories, migration plans, data mapping specifications, metadata enrichment procedures, quality assurance results, duplicate removal reports, and final migration status for each legacy system processed, in the form generated and retained during contract performance.

• Training Materials and User Documentation developed by the Contractor specifically for the Government under this contract, including all role-based training curriculum, training videos, user guides, system administrator guides, operational manuals, quick reference guides, and train-the-trainer materials.

• Operational System Data and Configuration Information, resident in the Government's instances at the time of transition, including historical data retained in the system under the Government's configured retention settings, including user account data, role assignments, organizational structure mappings, metadata catalogs, retention schedule assignments, legal hold records, audit logs, system performance data, and knowledge bases developed by the on-premises System and Application Administrator. Data shall be delivered in the system's standard export formats or, where no export function exists, in the format in which the data is natively maintained.

• Standard Operating Procedures (SOPs) developed by the Contractor during contract performance covering system administration, user account management, integration monitoring, AI model optimization, metadata governance, disposition approval processes, ERA 2.0 transfer procedures, legal hold management, FOIA request processing, troubleshooting procedures, and incident response.

• Custom Software developed under this contract, including any custom scripts, integration code, or automation tools developed by the Contractor specifically for the Government during contract performance and not forming part of the commercial RMA iQ product or its commercially licensed connectors. The Contractor shall provide the custom software in an industry standard format such as a Git repository with annotated source code and deployment instructions. The RMA iQ platform, its commercially licensed connectors, and associated product documentation are commercial computer software and commercial computer software documentation delivered under the commercial license and the data rights clauses incorporated in this contract. Source code for commercial computer software is not a deliverable.

• System Access and Administrative Credentials for Government-owned accounts and

Government-hosted environments including all administrative accounts, service accounts, API keys, certificates, and authentication credentials provisioned within the

Government's instances and required to maintain and operate the RMA iQ platform and integrated systems. Contractor-owned credentials, including software license keys, vendor support portal accounts, and code-signing certificates, are excluded from this requirement. Credentials shall be securely transferred in accordance with a written credential transfer procedure agreed between the Contractor and the designated NGA security official prior to transfer, consistent with NGA security procedures.

• Vendor Relationship Information including points of contact for Feith Systems technical support and escalation procedures. Software licensing terms, maintenance agreement terms, support contract information, and any ongoing vendor commitments or service level agreements shall be delivered to the Contracting Officer only, marked as Contractor proprietary information, and shall not be released to a successor Contractor or other third party except as required by law or with the Contractor's prior written consent under a nondisclosure agreement.

The Contractor shall conduct an organized transfer of Government-furnished information (GFI), Government-furnished equipment (GFE), and Government-furnished property (GFP), to include manufacturer maintenance agreements, software licenses, and any hardware or equipment provided by the Government during contract performance, as directed by the CO. The

Contractor shall generate a report containing the final disposition of all NGA property, including equipment serial numbers, software license keys for software licensed to the Government, return shipping documentation, and certification of data sanitization, performed in accordance with

NIST SP 800-88 or the applicable NGA sanitization standard for the security domain concerned, for any contractor-owned equipment that contained Government data.

The Contractor shall conduct transition meetings with the successor contractor or Government personnel as directed by the CO, not to exceed [XX] hours of Contractor personnel time in total during the transition period and within the level of effort established under CLIN [XXXX], providing knowledge transfer on system operations, integration maintenance, AI configuration procedures for the Government’s implementation, troubleshooting techniques, and lessons learned during contract performance. Knowledge transfer to a successor contractor shall be subject to Section 4.3.1 and shall not include Contractor proprietary information regarding the internal design of commercial software components. The on-premises System and Application

Administrator shall participate in transition activities to ensure continuity of technical support and operational knowledge.

The Contractor shall ensure all transition documentation developed by the Contractor specifically for the Government under this contract is delivered in editable formats (Microsoft

Word, Excel, PowerPoint, Visio, or PDF) and stored in Government-designated repositories, with any restrictive markings preserved and repository access limited accordingly. Standard commercial product documentation shall be delivered in the format in which the Contractor publishes it. Proprietary Feith Systems product documentation required for system operation is licensed to the Government under the commercial software license for so long as the

Government holds a valid license to the corresponding software, and may be used by

Government personnel and by Government support contractors bound by the terms of that license.

5.0 Deliverables

The following sub-sections describe each of the Contract Data Requirements List (CDRL) documents required in support of this contract. A brief summary of these CDRLs is also shown in table form in the CDRL Matrix of this document.

5.1 Kick-Off Meeting

The contractor shall schedule a kick-off meeting with the CO, Program Manager (PM) and

Contracting Officer’s Representative (COR) and Technical Monitor (TM) within 10 calendar days of task order award.

5.2 Biweekly Meetings

A biweekly telecom will be held with the CO, PM, and COR to discuss status. The weekly telecoms will be held throughout the entire performance. The Contractor shall provide an agenda, identify any issues, and document action items.

5.3 Quarterly Reviews

The contractor shall conduct Quarterly Program Management Reviews (PMR) of the data generated in preparation of the Status Report to address quarterly data and other pertinent management information. The review shall include Government requested information and shall include, but is not limited to:

a. Contract management reporting

b. Task progress and Funding Status Report

c. Control of the contractual TO (dollars and labor hours) and distribution

d. Projected changes in manpower and redistribution based on customer organization needs, manpower and recruiting summary

e. Security issues

f. Contractual action items

g. TO accounting data documentation

h. Report by TO element of hours/rates by discipline and skill level and by job title

i. Comparison of proposed travel costs to actual travel costs for each TO element

j. Comparison of total contract funding to invoiced services

k. Any special interest items requested by the Government or provided at the contractor’s initiative

l. TO Requirements Review (as needed)

These reviews may also address, in general, the efforts, challenges, problems, and accomplishments of Contractor personnel in the respective task areas. The Contractor shall provide the PMR agenda and briefing slides three (3) business days prior to the meeting and

PMR minutes within five (5) calendar days following the meeting. Government program and contract management may require other compilations of data to ensure adequate insight into the

TO execution. This review shall be held with the Program Management Office (PMO), CO and

TO COR.

5.4 Monthly Financial Report (MFR)

The Contractor shall provide a Monthly Financial Report (MFR) that summarizes all financial activity on the TO. The report shall track and report the following for each position by CLIN:

Position ID, Name, Job Title, Skill Level, Location, Labor Rate, Monthly and Cumulative Hours

Charged, Monthly and Cumulative Invoiced, and Total Price for the Prime Contractor and all

Subcontractors. The report shall also include a breakout of any Other Direct Costs (ODC) for travel by the Prime Contractor and all Subcontractors.

5.5 Monthly Staffing Report (MSR)

As part of the Monthly Staffing Report (MSR), the contractor shall provide one (1) electronic softcopy of an updated staffing report. The MSR supports the tracking of the Contractor’s proposed personnel (i.e., designated position number or identifier, Prime/Subcontractor, name, job title, start/end date, office, geographical location, and other fields of information as may be determined at a later date). A template for the MSR will be provided.

5.6 Monthly Activity Report (MAR)

The Contractor shall submit a technical Monthly Activity Report (MAR) to the COR no later than the 15th of each month.

5.7 Trip Reports

The Contractors shall submit a trip report within 10 days after returning from COR approved travel.

5.8 Technical Exchange Meetings (TEM)

The contractor shall schedule and support Technical Exchange Meetings (TEM) to collaborate and coordinate technical planning. The Contractor shall record and submit minutes from the meetings.

5.9 CDRL Matrix

The CDRL Matrix shown in the table below is a list of all Contractor-provided deliverables that shall be met throughout the contract. All deliverables will be submitted in formats compatible with Adobe or

Microsoft Office products. Softcopy delivery (via e-mail, etc.) is the preferred method of exchange for electronic copies. Deliveries will be made to the PM, CO, COR and/or Alternate COR (ACOR) as specified in the table below.

Table 3: CDRL Matrix

CDRL Title

CDRL

SOW

Section

First

Submission Updates Delivered to

Format and number of deliverables

Quarterly

Program

Management

Reviews

5.3

Award +120

Days

Quarterly

PM/CO/COR

1 Electronic Copy to PMO Email

Address Contractor Defined, Government Approved

Monthly

Financial

Report

5.4 Award +30

Monthly

COR/TM

Address

Contractor Defined, Government

Approved

Monthly

Staffing Report 003 5.5

Award +30

Days Monthly COR/TM

1 Electronic Copy to PMO Email

Address Government Defined

Activity Report

5.6 Award +30

COR/TM

1 Electronic Copy to appropriate

TM Email Address(es)

Contractor Defined, Government Approved

Trip Reports

5.7

10 days after completion of

COR approved travel

As

Required

PM/CO/COR

Address Contractor Defined, Government Approved

Reports, Briefings, Evaluations, Technical

Assignments, Minutes, White Papers Etc.

3.0

As Required

As

Required

COR, TM

Address, or applicable Technical

Monitor

Contractor Defined, Government

Approved

6.0 General Provisions

6.1 Primary Place of Performance

The primary place of performance for this Task Order is Springfield, VA (NCE)

6.2 Telecommuting (Telework)

Contractors are responsible for predetermining and disclosing their charging practices for telecommuting in accordance with FAR 7.108, applicable cost accounting standards and company policy. Contractors shall follow their disclosed charging practices. The Contractor shall not conduct any full-time telecommuting for technical staff.

6.3 Government Furnished Property (GFP)

The Government will provide the following GFP for this SOW:

Hardware: Hardware will be provided by the Government. For Contractors located at the Government site

(on-site), this includes access to thin client COE and SBU networks; unclassified and classified VoIP phones, and printers.

Tools/Software: Any tools/software required by the Contractor, not currently identified will have to go through the NGA Software Whitelist Assurance Process (SWAP) for approval prior to being placed on any

NGA systems. The Contractor will be expected to use the provided tools/software to execute the SOW requirements until such time any new tools/software are approved and available for operational use on

NGA systems.

Data: The Government will provide access to all available NGA data to support the requirements of the

SOW.

Access: The Government will facilitate access to Government facilities (to include badges) provided that the need for the access is validated and the security requirements of the contract are met. If other personnel security accesses are required, the Government will provide the sponsorship for additional accesses. The

Government will provide access to information and data, relative to the tasks required to include sponsoring classified network connectivity.

7.0 Security

7.1 Classified Work Performance Security Requirements

• Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to NGA facilities, when performing duties within TS/SCI environments, and for access to TS/SCI NGA computer systems.

Contractors are subject to a Counterintelligence Scope Polygraph, as requested by the Government.

All Contractor personnel shall possess a current Top-Secret Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access. The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel IAW Security Executive

Agent Directive (SEAD) 7: “Reciprocity of Background Investigations and National Security

Adjudications”. NGA will sponsor SCI accesses, NGA Badges, Common Access Cards (CAC) and other items (e.g. parking hangtags) when applicable, for required contract personnel.

• Contractors must abide by the DD Form 254 - Contract Security Classification Specification and applicable security policies and regulations.

• Contractor personnel shall follow all applicable NGA, IC, and DoD information security and operational security policies and guidance during performance of contract requirements.

• The Contractor shall inform the Government when its employees no longer support the contract (see

DD254). The Government desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day support ends. If Contractor personnel will no longer be supporting NGA via an NGA contract, any debriefing paperwork, notifications, and/or requests for further direction from the COR or Industrial Security shall be turned into the NGA

Workforce Support Center, NGA Site Security Office, or the COR. If Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or

COR then it is the Contractor’s security office’s responsibility to collect the items from the individual. If the Contractor debriefs the employee, the Contractor shall send a copy of the debriefing statement, plus any Government items (e.g. NGA Badge, CAC, Courier Card, parking hangtags, etc.) within four (4) business days (timeline may be extended with authorized documented exceptions by NGA Security) to an NGA Site Security Office or the NGA Workforce Support

Center.

• All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at collaborator sites must be performed in either an NGA accredited SCIF or and

Other Government Agency (OGA) SCIF that has either a Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this contract.

• Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI)

Continuous Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW

SEAD 6: “Continuous Evaluation”. Cleared Contractor personnel must self-report security issues, foreign contacts, and other reporting requirements in accordance with SEAD 3: “Reporting

Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive

Position” and NGA Instruction 5205.3, “Security Reporting Requirements”. In addition, cleared

Contractors will be required to submit electronic fingerprints and will be enrolled into NGA’s Report of Arrest and Prosecution Background (RAPBack) program, which supports CES.

• Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in

NGA’s annual Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20

November 2020 memorandum titled “Designation of NGA Personnel Required to Participate in the

Security Financial Disclosure Program.

7.2 Unclassified Work Performance Security Requirements

• Uncleared Contractor personnel are authorized to work on this contract up to the Unclassified level.

Contractors will not have access to DoD Controlled Unclassified Information (CUI) at the

Contractor site.

• Foreign nationals are not permitted to perform unclassified work under the terms of this contract.

• Contractor personnel shall not release any unclassified information, regardless of medium (e.g. film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

• Contractor personnel visiting NGA facilities and/or sites will receive the appropriate visitor badge and be escorted, as appropriate. The visitor badge will be returned at the end of each visit day.

NOTE: NGA reserves the right to refuse access to any personnel.

• Contractor personnel are forbidden from bringing in prohibited, unauthorized, and/or Portable

Electronic Devices (PEDs) items into any NGA installation or any secure office/working location covered under this agreement. A list of PEDs includes but is not limited to cell phones, cameras, two-way pagers, laptops, recorders (e.g. digital, tape, etc.), flash drives, or any other kind of removable media, without prior approval and approval paperwork from NGA. See NGA instructions/regulations/policy for a full list of prohibited and unauthorized items. Security violation repercussions will be determined on the severity of the violation.

7.3 Information Handling

• Contractor personnel will comply with the NGA, DoD, and IC policies and regulations (to include, but not limited to, the Consolidated NGA (CoNGA) Security Classification Guide) to properly mark

(to include portion marking) classified and unclassified documentation, media, etc.

• Document markings will be in accordance with the lowest security classification possible to ensure the confidentiality and integrity for the greatest release to partners in accordance with NGA and mission partner marking guides for classified information.

All Government-furnished information released to the Contractor or created in the performance of this contract will be destroyed or returned by the Contractor to NGA upon contract termination or when no longer required for contract performance. The determination to destroy or return will be at the direction of the NGA CO or COR.