RFI FNA-CPO-0126_Attachment - Draft Performance Work Statement.pdf

1 | P a g e

Draft Performance Work Statement (PWS)

Data Verification and Validation Link Analysis Software Platform - Artificial Intelligence (AI) Solutions for Network Performance Analytics and Data Validation

First Responder Network Authority (FirstNet Authority), U.S. Department of Commerce

2 | P a g e

Table of Contents 1 Purpose

2 Background

3 Scope of Work

3.1 Data Ingestion, Validation, and Quality Assurance

3.2 Data Analytics for NPSBN Network Performance

3.3 Predictive Modeling and AI-Driven Insights

3.4 Platform Capabilities and User Experience

3.5 Data Strategy, Visualization, and Decision Support

3.6 AI/ML Transition

3.7 System Performance Characteristics

3.8 Data Rights and Ownership

3.9 Risk and Change Management

3.10 Security, Privacy, Regulatory Compliance

3.11 Platform & Implementation Support

3.12 Tasks, Deliverables, Verification & Validation, Reporting

3.13 Section 508 Compliance

3.14 Non-Disclosure and Sensitive Data Handling

4 Period of Performance

5 Place of Performance

3 | P a g e

1 Purpose The purpose of this contract is to acquire a Data Verification and Validation Software Platform that will bring data analytic automation capabilities to the First Responder Network Authority (FirstNet Authority) that can support network performance analytics, data validation, predictive modeling and data visualization.

The Agency seeks an Artificial Intelligence (AI)-based solutions enabling real-time data correlation, automated validation, and advanced analytics across complex contractor-submitted datasets. The solution underpins the Agency’s ability to deliver transparent, accountable, and data-driven oversight of the Nationwide Public Safety Broadband Network (NPSBN) performance, supporting both 47 USC§1426(b)(1)(d) and 47 USC§1426(c)(1)(e).

2 Background The FirstNet Authority was established under the Middle-Class Tax Relief and Job Creation Act of 2012 to deploy and operate a nationwide, interoperable broadband network dedicated to public safety.

The FirstNet Authority’s Network Program Management Office (NPM) currently relies on manual review by Subject Matter Experts (SMEs) to verify and validate contractor-submitted information. While this “best effort” sampling approach provides valuable oversight, it cannot ensure complete accuracy or data integrity. The process is challenged by the absence of standardized validation criteria, inconsistent data formats, and a lack of automated tools.

Data relevant to the NPSBN is distributed across multiple platforms—including secure file transfer systems, SharePoint, OneDrive, and email—and exists in both structured and unstructured formats. These limitations hinder the Authority’s ability to meet performance goals, comply with Inspector General (IG) or audit findings, and maintain high standards of data accuracy.

To address these challenges and advance its mission of deploying and operating a nationwide, interoperable broadband network for public safety, the FirstNet Authority seeks solutions that shall:

• Support centralized, scalable, and efficient data validation and verification, enabling data-driven decision-making, improved oversight of contractor obligations, and alignment with regulatory and audit standards.

• Predict performance trends and identify network impairments.

• Benchmark network quality against commercial carriers.

• Integrate and analyze geospatial datasets (e.g., FCC coverage maps, GIS layers).

• Ensure compliance with privacy, cybersecurity, and audit requirements.

4 | P a g e

• Support measurable accuracy and performance goals, including the ability to report on compliance with IG/audit findings.

• Automate and enhance the validation and analysis of carrier-provided network, cybersecurity, and crowdsourced data, while establishing and enforcing data validation standards to ensure consistency and reliability.

3 Scope of Work The solution shall encompass the following core capabilities:

3.1 Data Ingestion, Validation, and Quality Assurance

• Ingest and process large volumes of structured and unstructured data from multiple sources, including:

o Carrier-provided network and cybersecurity data o Crowd-sourced performance data o Federal Communications Commission (FCC) Form 477 and Broadband Data

Collection (BDC)) datasets o Geographic Information System (GIS) and geospatial data layers

• Apply AI/Machine Learning (ML) techniques to:

o Cleanse and validate incoming data o Detect anomalies, corrupted records, and outliers o Ensure data integrity and consistency across time and geography o Provide automated data quality scoring and audit trails

3.2 Data Analytics for NPSBN Network Performance

• Deliver real-time and historical analytics (from 2017 to present date) ) with initial data volumetrics starting at 5TB and scaling to 150TB (TBR) on key performance indicators (KPIs), including:

o Throughput, latency, jitter, and packet loss o Service availability, Network availability and reliability o Connections related to include adoption and churn rates o RF Coverage, Temporary Coverage data including Recovery Time Objectives o User experience metrics (e.g., call success rate, session drops)

• Enable benchmarking of NPSBN performance against commercial networks

• Support differentiation between indoor and outdoor RF coverage and usage

• Provide spatial and temporal granularity down to the census block or geohash level

3.3 Predictive Modeling and AI-Driven Insights

• Implement ML models to:

o Forecast network performance trends and degradation risks

5 | P a g e o Identify emerging coverage gaps and capacity constraints o Prioritize infrastructure investments based on usage patterns and risk

• In addition to traditional machine learning models, the Contractor shall incorporate Large Language Models (LLMs) to support natural language querying, semantic searches, automated summarization of network performance reports, and generative analytics.

o LLMs shall be fine-tuned or configured to operate securely within the platform and support user interactions through conversational interfaces or embedded assistants.

• Support scenario modeling and “what-if” analysis for planning and optimization

• Integrate geospatial indexing (e.g., Hexagonal Hierarchical Geospatial Indexing System

(H3), geohash) for scalable spatial analyses

3.4 Platform Capabilities and User Experience

• Deploy a secure, cloud-native analytics platform that includes:

o Intuitive dashboards for technical and non-technical users o Role-based access control and audit logging o Customizable reporting and alerting features

• Provide access to raw and processed data via:

o RESTful Application Programming Interface (API)s o Structured Query Language (SQL)-based query interfaces o Downloadable formats for offline analysis

• Maintain historical data access for a minimum of 18 months

3.5 Data Strategy, Visualization, and Decision Support

• Develop and maintain data pipelines for:

o ETL (Extract, Transform, Load) operations o Real-time and batch processing o Integration with enterprise data warehouses

• Create visualization solutions that improve usability, analytical depth and decision support, as required. Apply AI/ML to:

o Enhance data exploration and pattern recognition o Optimize network performance and resource allocation o Support executive-level decision-making

3.6 AI/ML Transition

• Execute a seamless transition of all AI/ML assets, data pipelines, and analytics platforms from the incumbent provider, including but not limited to:

o Knowledge transfer and documentation Initial user training shall be conducted for up to 25 government personnel User acceptance testing shall be conducted for all data pipelines and use cases

(between 25-35)

6 | P a g e o Coordination with outgoing Contractor

• Validate and migrate:

o Existing AI/LLM/ML models and dashboards o Historical datasets and metadata o Platform configurations and user roles

3.7 System Performance Characteristics

• The Contractor shall ensure the platform meets the following performance requirements:

o System uptime of 99.9% or higher, excluding scheduled maintenance.

o Average response time for user queries shall not exceed 2 seconds under normal load.

o Support for a minimum of 75 concurrent users without degradation in performance.

o The Contractor shall notify the FirstNet Authority when cloud hosting storage resources reach 50% of the aggregate threshold and again at 75% for each base and option period of this contract.

For the purpose of the RFI, the Contractor shall offer storage and performance scalability options and recommendations as separately priced CLINs.

3.8 Data Rights and Ownership

• All data ingested, processed, or generated under this contract shall be and remain the exclusive property of the U.S. Government.

• The Contractor shall provide unrestricted access to raw and processed data, including metadata and audit logs.

• The Contractor shall not use, share, or retain any government data for purposes outside the scope of this contract without prior written approval.

• The Contractor shall identify any proprietary components that may affect data access or portability and propose mitigation strategies.

• The Contractor shall support data export in a common format upon request or at contract end. The Contractor shall comply with Federal Acquisition Regulation (FAR) 52.227-14 and 52.227-19 for data rights and software licensing.

3.9 Risk and Change Management

• The Contractor shall implement a Risk Management Process following commercial best practices, that identifies potential technical, operational, and cybersecurity risks, including appropriate mitigation and resolution steps as needed.

• The Contractor shall implement a Change Management (CM) Process following commercial best practices, for all updates to the platform, including AI model changes, software patches, and infrastructure modifications. The CM process shall include, but not be limited to the following:

o Maintaining version control for all AI/ML models used in the platform.

7 | P a g e o Maintaining documentation of changes, performance benchmarks, and validation results.

o The Contractor shall notify the Government of any planned updates at least 10 business days in advance.

o The Government reserves the right to review and approve model updates prior to deployment.

3.10 Security, Privacy, Regulatory Compliance

• Ensure full compliance with applicable laws and regulations, including:

o Federal Information Security Modernization Act (FISMA) o National Institute of Standards and Technology (NIST) Special Publication (SP)

800-53 and 800-171 o General Data Protection Regulation (GDPR) o California Consumer Privacy Act (CCPA)

• Implement robust privacy-preserving techniques, including:

o Anonymization of personal and device identifiers o Opt-in/opt-out mechanisms for data sharing o Provide a cybersecurity framework that protects sensitive data and supports incident response o Provide and manage a secure and scalable cloud environment (FedRAMP

Moderate or equivalent) as part of the solution.

• FedRAMP and Security Compliance o The Contractor shall ensure the platform is hosted in a FedRAMP-certified Amazon Web Services (AWS) GovCloud environment and complies with NIST SP 800-53, FIPS 200, and FIPS 199 standards.

• Authority to Operate (ATO) Support o The Contractor shall support the ATO and Initial Authority to Test (IATT) processes in coordination with FirstNet Authority OCIO.

o The Contractor shall support the FirstNet Authority in achieving and maintaining an Authority to Operate (ATO) for all systems, platforms, and services delivered under this contract.

o The Contractor shall collaborate with FirstNet Authority’s Information Security and IT teams to ensure all security documentation, assessments, and controls are completed for the software solution provided, in accordance with the Risk Management Framework (RMF) and NIST SP 800-53 requirements.

o The Contractor shall provide the following ATO-related deliverables and support activities as applicable to the software solution provided:

System Security Plan (SSP) inputs and technical documentation Security Assessment Plan (SAP) and Security Assessment Report (SAR) support

8 | P a g e

Plan of Action and Milestones (POA&M) development and remediation tracking

Continuous Monitoring (ConMon) strategy and implementation Support for security control testing and validation

The Contractor shall ensure that all software components, including AI/ML models and data pipelines, are compliant with applicable federal cybersecurity standards and are appropriately documented for ATO review.

• The Contractor shall participate in security reviews, audits, and meetings associated to the software solution provided, as required by the FirstNet Authority’s Authorizing Official (AO) or designated representatives.

• Security Incident Reporting o The Contractor shall notify the COR and CO within 1 hour of a suspected breach and provide a written report within 24 hours. Ongoing updates and a mitigation plan are required.

3.11 Platform & Implementation Support

• The Contractor shall provide core platform support, training, cloud infrastructure support, deployment, and full lifecycle support, amongst others. In particular:

o The Contractor shall provide integration support, a cloud Infrastructure, system performance and training to meet the requirements specified in this contract.

o For integration use cases, the Contractor shall optimize two-week sprint cycles with bi-monthly User Acceptance Tests (UATs) as part of use case integration delivery as specified in this contract.

o The Contractor shall establish an incident response and escalation structure to support the SLA requirements specified in this contract.

o The Contractor shall provide training materials and on-demand resources to include user guides, admin training. video tutorials, reference guides, feedback sessions, as required.

• Incident response and resolution times shall comply with the following Service Level Agreements (SLAs):

o Critical issues: response within 1 hour, resolution within 4 hours.

o High priority: response within 4 hours, resolution within 1 business day.

o Medium priority: response within 1 business day, resolution within 3 business days.

o Low priority: response within 2 business days, resolution within 5 business days.

3.12 Tasks, Deliverables, Verification & Validation, Reporting

• The Contractor shall provide recurring and ad hoc deliverables to support program oversight, performance tracking, and compliance.

• The Contractor shall verify a fully implemented use case that meet the following requirements:

9 | P a g e

1. Requirements Completed & Approved

a. Business requirements and success criteria are documented and approved by the Government Product Owner.

2. Data Integration & Validation

a. All necessary data sources are identified, ingested, and validated for accuracy and completeness.

3. Model Development & Testing

a. AI/ML model or analytics solution is developed, tested, and meets performance benchmarks (e.g., accuracy, precision, recall) as defined in the acceptance criteria.

4. Deployment

a. The use case is deployed into the production environment or designated operational environment and is accessible for end-users.

5. Documentation

a. Technical documentation, user guides, and operational procedures are delivered and approved.

6. Performance Reporting

a. Post-deployment performance metrics are provided, demonstrating that the use case meets agreed KPIs.

7. Government Acceptance

a. The Government Product Owner formally accepts the use case as complete and operational.

• All deliverables must be submitted to the COR and any appointed Technical Lead for inspection, review, and acceptance.

Deliverable Description Due Date

Kick-Off Meeting

The FirstNet Authority COR will schedule and organize the introduction meeting invite within 5 days of contract award. The meeting invite will be coordinated in advance with the Contractor.

5 days from delivery of award

Weekly Meetings

Weekly meetings organized by FirstNet Authority based on agreed time with Contractor. Includes:

- Weekly Integration Tag-up (PM/COR/Lead Integration POC) – 1 hour

- Weekly Integration Technical Sync (2–3 per week) – 1 hour each

- Weekly program-level status – 30 min

Recurring, agreed upon date & time

Meeting Agendas Contractor provides meeting agenda input to PM and COR one business day prior to the scheduled meeting.

As required; 1 business day before the meeting

10 | P a g e

Deliverable Description Due Date

Meeting Minutes & Action Tracker

Develop meeting minutes and post at designated location. Maintain a consolidated action item tracker.

As required; 2 business days after the meeting

Software Platform Delivery

Deliver integrated solution with onboarding for ~75 active users and full operational functionality validated by onboarded users. Notify FirstNet Authority at 50% and 75% cloud hosting thresholds.

Within 90 days of contract award

Project Management Report & Schedule

Detailed implementation plan with milestones and two-week sprint cycle.

30 days after award; Monthly thereafter

Platform & Solution Deployment

Fully functional AI analytics platform with successful UAT for all transitioned use cases. Monthly UATs for identified integrations.

90 days after award; Monthly or as agreed

Monthly Reports & Schedules

Summary of analytics, system performance, updates, risk matrix, security, and issues. Includes detailed agile sprint activities for each use case.

Monthly or as needed and agreed upon

Quarterly Analytics Report

Comprehensive report summarizing analytics trends, performance insights, and system optimization recommendations.

Quarterly

Sprint-Based Use Case Metrics

Metrics and progress reports for each sprint cycle, detailing use case development, testing, and integration status.

Per sprint cycle

Performance Metrics Dashboard

Interactive dashboard providing real-time performance metrics, KPIs, and system health indicators for stakeholder review.

Monthly or as agreed

Executive Level Analytics

• Provide monthly executive analytic reports and quarterly trend analysis reports per completed use case.

• Respond to ad hoc executive requests within 24 hours and deliver within 5 business days (e.g., maximum of ten (10) per quarter)

Monthly

Use Case Delivery Plan

A detailed plan outlining the delivery approach for each AI use case, including timelines, dependencies, and acceptance criteria.

- Business requirements documentation

- Data sourcing and validation

- Model development and testing

- Performance metrics and reporting

Initial within 30 days of award;

updates per sprint cycle

11 | P a g e

Deliverable Description Due Date Participate in agile ceremonies and maintain a prioritized backlog

10 Completed AI Use Cases

Delivery and validation of ten (10) contractor fully implemented and tested AI use cases as part of the solution deployment. Delivery Cadence: At least 2–3 use cases per quarter.

By end of each quarter.

Transition Plan & Schedule

Strategy for seamless transition from incumbent.

Includes phase-in and phase-out plans:

- Phase-In: Initial with proposal, finalized within 15 days after award

- Phase-Out: Initial within 90 days of contract end, finalized within 60 days

Phase-In: 15 days after award Phase-Out: 60 days after contract end

Final Report Summary of outcomes, achievements with KPIs, lessons learned, and recommendations.

30 days prior to end of contract year or as agreed

3.13 Section 508 Compliance

• The Contractor shall ensure all user interfaces and documentation conform to Section

508 standards. An Accessibility Conformance Report (ACR) using the VPAT template shall be provided upon request.

3.14 Non-Disclosure and Sensitive Data Handling

• All Contractor personnel shall sign NDAs with FirstNet and AT&T. No public release of reports or data is permitted without CO approval. The Contractor shall safeguard all sensitive information and comply with applicable data protection requirements.

4 Period of Performance The period of performance shall be 12 months from the date of award, with four (4) option periods (e.g., base year plus four option years).

5 Place of Performance Work may be performed remotely with coordination and periodic meetings with FirstNet Authority staff located in Reston, VA, Boulder, CO, and other CONUS designated locations .

The Contractor shall be responsible for all travel related expenses; the Government will not reimburse travel expenses.