Horizon_IDIQ_Draft SOW_10062025 v1.docx

UNCLASSIFIED

Horizon

Draft - Statement of Work (SOW)

6 October 2025

Content

1.0 INTRODUCTION

The National Geospatial-Intelligence Agency (NGA) delivers Geospatial Intelligence (GEOINT) information that provides a decisive advantage to policymakers, warfighters, intelligence professionals, humanitarian efforts and first responders. NGA is part of the National System for Geospatial Intelligence (NSG), which supports our Department of Defense (DoD), Department of Homeland Security (DHS) and the Intelligence Community (IC). NGA leads the world in timely, relevant, accurate and actionable GEOINT.

An important subset of GEOINT, called Foundation GEOINT (FG) describes/models the physical and political characteristics of the Earth. The FG Program, which has Geomatics, Geography, Aeronautical and Maritime components, facilitates the integration of geospatial data, information, and services. The components are moving towards a products-as-a-service verse producing standard data production under previous contracts.

2.0 SCOPE

This multi-award Indefinite Delivery/Indefinite Quantity (IDIQ) contract will provide NGA a means to acquire high-resolution commercial elevation and 3D data to meet global requirements for its DoD/IC/DHS user communities. Over a 5-year period, vendors will fulfill Horizon requirements that will require the contractor to deliver gridded elevation data, 3D point clouds, 3D meshes, and associated support products. The contractor shall fulfil global elevation requirements requirements ranging from sub-meter resolution to 5-meter resolution. The contractor shall provide high-accuracy data with demonstrated absolute vertical and horizontal accuracies less than 5-meters.

The contractor shall provide data under one of two End User License agreements defined by NGA at the time of purchase, 1) USG+ licensing aligned with the NRO Electro-Optical Commercial Layer (EOCL) USG+ licensing agreement, 2) USG+ FVEY including the USG+ terms plus data release to FVEY partners for national security purposes.

The contractor shall provide equipment, supplies, facilities, personnel, and network access, per agreement with NGA, needed to accomplish the required task.

The contractor shall produce Emerging Products as directed by NGA, including new DEM formats, 3D formats, geospatial and error prediction metadata, 3D generation algorithms, and integration of new imaging and elevation sensors.

3.0 DATA CONNECTIVITY

The contractor shall establish electronic connectivity to provide data, products, and services to NGA within 30 days of the start of the contract PoP. Connectivity shall be maintained throughout the life of the contract. NGA shall be granted access to connect to Horizon 3D services. The contractor shall establish the necessary requirements (e.g., Public Key Infrastructure (PKI) and approved logins) to connect to NGA outward facing webpages and data repositories.

3.1 Electronic Connectivity Specifics

The contractor shall establish PKI certification within 30 days of the start of the contract PoP to communicate securely over the required security domain and appropriately encrypt data and information to share with NGA. This requirement does not preclude the contractor from establishing, at its own expense, connectivity at the required security domains; however, if implemented, the contractor shall conform to DoD security requirements to include user authentication and use of secure networks.

The contractor is responsible for internet connectivity to support communications, source harvesting, data sharing, and data delivery.

User access to Government Source GEOINT data will be controlled via user accounts and/or using PKI certificates for user authentication and secure communication. NGA will provide user PKI certificates for use with the vendor network connection. Limits on the number of NGA provided PKI certificates will be established in accordance with contract requirements.

The contractor shall use PKI certificates obtained through the DoD External Certification Authority (ECA) program or other DoD approved PKI, for user authentication and secure communication over the required security networks. The contractor shall possess the ability to send and receive encrypted email over networks using PKI.

Once network connectivity is established at an appropriate security level, the contractor shall transition to electronic data delivery, unless otherwise instructed by the Contract Officer Representative (COR). NGA will provide network sites (to include Cloud) for receipt of contractor deliverable data. The contractor shall conform to contract instructions for formatting, packaging and delivering data electronically to NGA.

3.2 Cloud Connectivity

NGA is moving to a Cloud architecture. NGA will provide guidance and timelines for establishing connectivity. The contractor shall establish electronic connectivity to provide data and products to NGA and to allow for virtual NGA data/product quality review. NGA will provide Cloud access points for receipt of contractor deliverable data. Connectivity will be required for data delivery and/or retrieval such as retrieval of source material.

4.0 CONTRACTOR DELIVERABLES

4.1 Commercial Data Orders or Subscriptions

4.1.1 Multiview Electro-Optical derived elevation data and 3D mesh Multi-view stereo (MVS) derived mesh and 3D data utilizes multiple overlapping images from different viewpoints to reconstruct 3D surfaces through photogrammetric techniques. This passive sensing approach extracts feature points across images and triangulates their 3D positions to create textured mesh models of terrain and structures. The resulting data combines geometric accuracy with photorealistic textures, providing both structural and visual information about target areas. The photogrammetric process involves image matching, dense point cloud generation, mesh creation, and texture mapping to produce visually accurate 3D models. Common delivery formats include GeoTIFF, Cesium 3D Tiles, and I3S. These models often include level of detail (LOD) variations to support different viewing distances and processing capabilities. DoD and IC applications include virtual mission rehearsal environments, immersive intelligence analysis, 3D visualization for military planning, cultural heritage documentation, urban tactical training simulations, and damage assessment after natural disasters or conflict. MVS data is particularly valuable for operations requiring contextual understanding of target environments, allowing analysts to virtually explore locations before physical deployment. The visual nature of the data supports rapid familiarization with target areas, identification of key terrain features, and assessment of ingress/egress routes. These models can be integrated with other intelligence sources to create comprehensive common operating pictures and support mission planning tools across the full spectrum of military operations.

4.1.2 LIDAR derived elevation data

LIDAR (Light Detection and Ranging) is an active remote sensing technology that uses laser pulses to measure variable distances to Earth. The sensor emits laser light and measures the time it takes for reflections to return, creating precise 3D point clouds of terrain and structures. These point clouds capture detailed surface characteristics including building footprints, vegetation canopy, and terrain features at centimeter-level accuracy. Common delivery formats include LAS/LAZ (industry standard for point clouds) and segmented point clouds with attributes such as height, intensity, return number, and classification codes (ground, building, vegetation, etc.). LIDAR data typically includes metadata documenting collection parameters, point density, vertical accuracy, and processing methodologies. DoD and IC applications include high-precision terrain mapping for military operations, line-of-sight analysis, helicopter landing zone assessment, urban environment modeling, critical infrastructure analysis, and counter-IED operations. LIDAR excels in areas where detailed elevation data is required for mission planning, particularly in complex urban environments where building structure details are crucial for tactical operations. The technology supports route planning, concealment analysis, and hydrological modeling for flood prediction. Advanced processing techniques allow for automatic feature extraction, including building footprints, tree heights, and power line locations, providing intelligence analysts with detailed environmental context for operational planning and situational awareness.

4.1.3 SAR derived elevation data

Synthetic Aperture Radar (SAR) derived elevation data is generated by radar systems that emit microwave signals and measure their backscatter to create digital elevation models. This active sensing technology penetrates cloud cover and operates in day/night conditions, making it ideal for persistent monitoring regardless of weather. SAR interferometry compares phase differences between multiple radar acquisitions to calculate elevation changes with centimeter precision, allowing for detection of subtle surface deformations over time. The collected data undergoes sophisticated processing including phase unwrapping, geocoding, and filtering to produce consistent gridded elevation datasets. Common delivery formats include GeoTIFF/Cloud Optimized GeoTIFF (COG) with comprehensive metadata describing acquisition parameters, processing steps, and accuracy metrics. Resolution typically ranges from sub-meter to tens of meters depending on collection mode and processing techniques. DoD and IC applications include wide-area terrain analysis, detecting subtle ground deformation that may indicate underground facilities or tunneling activity, identifying changes in infrastructure, monitoring denied areas, supporting navigational systems for military platforms, and conducting change detection analysis in areas of interest. SAR elevation data is particularly valuable for monitoring Earth surface changes in remote or hostile environments where optical systems are ineffective due to cloud cover or darkness. The all-weather capability supports intelligence collection continuity in regions with persistent cloud cover or during monsoon seasons when optical systems face significant limitations.

5.0 DATA CUSTOMIZATION AND ADAPTATION SERVICES

· Modification of commercial data formats to comply with NGA standards

· Implementation of NGA-specific quality checks and validation processes

· Adaptation of uncertainty/error reporting to meet NGA specifications

· Integration capabilities with existing NGA Foundation data layers

· Development of custom delivery mechanisms compatible with NGA systems

· Creation of data variants that maintain commercial characteristics while satisfying specific mission requirements

· Implementation of version control and product lineage documentation

· Data deliverables shall conform to NGA approved 2D and 3D data standards including the DGIWG DGED250, NGA.SIG.0033_1.0_ELEV, NGA.STND.0079_1.0_3DGEO, and NGA.SIG.0048_1.0_R3D. Metadata shall conform to the N3MS. Other applicable standards and formats may be directed by the COR.

6.0 DELIVERY METHODS

At the onset of this contract NGA will accept traditional and/or currently established methods of delivery until infrastructure and connectivity is in place to facilitate NGA’s desired electronic delivery. As NGA moves forward, NGA will provide guidance for contractors to obtain the necessary electronic connectivity. As NGA’s cloud transformation continues, further details and guidance of NGA’s delivery requirements will be communicated for future content deliveries.

The contractor shall deliver all data to NGA in electronic formats via Cloud solutions on the required network based on security guidelines and technical direction provided by NGA. Deliveries via FTP or physical external hard drive will be accepted while waiting for Cloud solutions but may be removed once the cloud solutions are in place per NGA guidance. The contractor shall provide electronic delivery to NGA on the Unclassified domain. The contractor shall push content directly into the Cloud as directed by NGA. Quality Control (QC) reports shall be included with each delivery. The contractor shall conform to contract instructions for formatting, packaging, and delivering data electronically to NGA and shall deliver data directly into the Cloud on the security domain NGA requires.

Contractors shall virus scan all content deliveries prior to electronic and/or media delivery. This procedure shall be documented with a statement for each delivery to certify data has been appropriately scanned for viruses.

Acceptable delivery methods include:

· NGA OpenDataStore

· Products delivered as services

· Accessing dynamic data directly from the suppliers as a service

· FTP Transfers

· External Hard Drives

· New delivery formats not yet known will be reviewed and approved by NGA for approval prior to being used

7.0 QUALITY ASSURANCE

The contractor is responsible for product/service quality as it pertains to all requirements under this SOW. The contractor shall take all steps necessary to ensure that the content meets all quality and specification aspects required by NGA and its customers. Additional information concerning production guidance, requirements, or specifications for baseline and/or custom content, and metadata are detailed in accompanying documents.

The contractor shall establish an acceptable Quality Management System (QMS), that ensures the highest quality of data and processes are maintained through the life of the contract. The contractor will present their QMS plan to NGA at post-award, prior to start of data production for approval. The contractor may need to adjust their QMS to accommodate product/service deliverables that are unique. The contractor shall submit changes or modification of their QMS, to include checklists, to NGA prior to production so that the products are consistent with quality requirements. Additionally, the contractor shall adhere to the approved QMS throughout the PoP, ensuring they continually use processes and controls to meet NGA quality standards.

If the Government creates a Supplier Corrective Action Report (SCAR) identifying a problem or observation, the contractor shall work the SCAR to completion within the timelines specified by the SCAR. The contractor shall identify the root cause and generate a proposed solution within 10 business days from receipt of the SCAR. Upon Government approval, the contractor shall immediately implement the solution and provide evidence of implementation in the timeline identified in the SCAR. NGA will assess the contractor’s adherence to their written QMS process documentation to determine compliance and ways to improve quality and effectiveness.

Production Audits may be conducted at NGA’s discretion. Audits will be conducted at the contractor site, and consist of Technical Leads, Program Management, and any necessary contract management support. Audit personnel will observe and assess production methods and processes, review written documentation, and perform interviews to determine conformity. NGA will provide at least 10 business days’ advance notice before a contractor site visit; however, NGA reserves the right to conduct no-notice production audits. Production audits will be no longer than four business days in duration.

The contractor shall provide access to their production facilities for observing analyst production methods, documenting processes and review of content production and maintenance to ensure it fulfills the requirements of this contract.

The NGA Audit Team will supply contractor management with a summary of audit findings prior to leaving the contractor’s facility. Disagreements will be documented and resolved if possible, prior to the NGA audit team leaving the contractor’s facility. If disagreements cannot be resolved, each party’s comments will become part of the audit record report. Disagreements will be referred to the COR and adjudicated by a CO. Action and decisions taken by the CO will be documented and saved for federal records retention under NI 8040.1R10, Appendix 8. The NGA Audit Team may be comprised of CO, COR, Program Management, and/or Technical Review Analysts, or another member NGA deems necessary.

NGA’s lead auditor will supply an audit report to a Contractor Management Representative within ten calendar days from the last day of the audit. The contractor shall return a copy of the audit report with an original signature from the Contractor Management Representative within ten calendar days. The signed audit report will constitute acceptance by the Contractor and closure of the audit. The NGA lead auditor may be the CO, COR, program management, or another NGA employee assigned to the role.

Each production Audit Report will contain a recommendation as determined by the NGA audit team. The recommendation will be one of the following: Satisfactory, Open, or Unsatisfactory.

· “Satisfactory” – no major or minor nonconformities are observed

· “Open” – one or more nonconformities are observed

· A corrective action plan is required

· NGA will review the corrective action plan and if approved, recommend a continuance or a “Satisfactory” rating.

· NGA reserves the right to conduct a follow-on visit for verification.

· “Unsatisfactory” – a recommendation cannot be made. Unsatisfactory audits will be given an open status and require immediate corrective action plan

The contractor shall submit any required corrective action plans to NGA within 30 calendar days of audit report acceptance. NGA will review and provide feedback to the Contractor with concurrence or non-concurrence within ten (10) calendar days of receipt of the corrective action plan.

“Major” non-conformances shall be corrected as quickly as possible, require evidence demonstrating the implementation of the proposed actions within 90 calendar days and also require a follow-up visit to verify effectiveness of the corrective action plans. “Minor” non-conformances shall be resolved prior to the next audit, although a specific time for resolution could also be set.

Examples of minor non-conformance include:

· Failure to conform to a requirement which (based on judgment and experience) is not likely to result in QMS failure.

· A single observed lapse or isolated incident.

· Minimal risk of non-conforming product or service.

Examples of major non-conformance include:

· Total breakdown of system, control, or procedure.

· A number of minor non-conformances related to the same cause.

· A non-conformity that would result in probable shipment of non-conformity or un-inspected product.

· A condition that may result in product failure or materially reduce the usability of product for intended purpose.

· A non-conformity that experiences and judgment indicate will likely result in QMS failure or materially reduce its ability to assure controlled processes and products.

All non-conformities require corrective action plans. The contractor shall submit required corrective action plans to NGA within 30 calendar days of audit report acceptance. Major non-conformities require evidence demonstrating the implementation of the proposed actions within 90 calendar days, and also require a follow-up visit to verify effectiveness of the corrective action plan. NGA will review and provide feedback to the contractor with concurrence or non-concurrence within ten calendar days of receipt of the corrective action plan. All non-concurrences of the corrective action plan must be resolved within ten calendar days of the date NGA provides notification of non-concurrence.

Disagreements will be adjudicated by an NGA Contracting Officer. Action and decisions taken by the NGA Contracting Officer will be documented and saved for Federal records retention under NI 8040.1R10, Appendix 8.

8.0 REPORTS AND MEETINGS

Communication between NGA and the Contractor is essential to achieving success in meeting our mission, conducting business, and advancing our abilities to provide GEOINT to our customers. To achieve this success, the following requirements are included in this SOW.

8.1 Project History Folder

The contractor shall deliver a project history folder (Exhibit-A0001-CDRL-Project-Hist) for each requirement. (Similar requirements may be combined and require only one project history folder.) The project history folder shall include all NGA contractual documents, modifications, addendums, and checklists. The contractor shall state what sources were used to build or improve the FG data holdings and what processes were used to produce the results. The contractor shall reference the numerical and percentage increase or improvement made. For finished products, the project history folder shall include a description of what data and processes were used to assemble the product. The project history folder shall also include the dates the work was accomplished, the area of interest of the work, project specific guidance, and any peculiarities of the requirement or processes. The folder shall also include an explanation if the project was completed ahead or behind schedule.

In addition to the project history folder, the contractor shall provide Quality Assurance (QA) documentation. This should include all internal quality assurance error calls and corrective actions, and all quality assurance checklists, as applicable. Final checklists shall indicate zero defects. Any rework and reasons for it shall be addressed.

The project history folder and all additions shall be delivered to the COR as specified herein within fourteen days of delivery of the data, product, or service. Contractor shall provide email notification of delivery shipment to NGA Program Managers and the COR. Exceptions must be coordinated with the COR. All materials making up the folder and addendums shall utilize standard office business software (e.g., Microsoft Office.)

8.2 Status Reports

The contractor shall prepare a digital monthly report (Exhibit-A0002-CDRL-MonthlyStatus) to provide production progress to the NGA Program Managers and the COR. Status Reports shall use either standard office business software (e.g., Microsoft Office) file formats or electronic tracking software (e.g., JIRA or Redmine), as agreed upon with NGA. NGA will provide templates that the Contractor shall use to report information. NGA will use these delivered files to dynamically populate production management systems at NGA. Each report shall include:

Status of all Requirements:

· Title of requirement

· Location of requirement

· Percentage towards completion

· Expected and Actual Delivery Date and Comments (e.g., early delivery or complications)

· Capacity or workflow

8.3 Government Contract Reviews (GCRs)

After the initial award of the contract, a meeting will take place at the discretion of the government program management team and NGA CO, either at the contractor’s production facilities, or through remote means. The government program manager and contractor leadership will determine the most appropriate location to have this meeting. This meeting will serve as a contract kick-off.

The government program management team, NGA CO and contractor leadership team will meet to discuss programmatic and technical issues as determined by the CO/COR either at a contractor site (corporate or production) or via teleconference, videoconference, computer software, or other means. These meetings include TEMs, process reviews, and kick-offs.

The government program management team and contractor leadership will coordinate appropriate locations, schedules, and list of attendees. If travel is involved, the number of people traveling shall be kept to a minimum. When possible, practical, and timely, meetings may be coordinated in conjunction with other events—such as conferences, showcases, etc.

8.4 Program Management Review Meetings

The contractor shall conduct Program Management Reviews (PMRs), to be held at least twice a year, and presented to NGA Office Leadership and applicable Program Management and Technical team members. The PMR location shall be agreed upon by NGA and the Contractor. The contractor shall submit all PMR Briefing Charts to the Government Office Program Leads at least three (3) working days prior to the review.

The contractor shall document and submit PMR minutes (Reports/Minutes) for Government approval no later than three (3) business days following each PMR.

At a minimum, PMR’s shall address:

· Project status to include work accomplished during the last month, work to be accomplished during the next months, issues, and recommendations.

· Financial status review

· Upcoming major events and releases within a three (3) month window

· Action item status

· Risk management and mitigation/opportunity details

· Special interest items

· Quality Control activities updates

· Security certification and accreditation status

9.0 DATA/SOURCE and ELECTRONIC LIBRARY OWNERSHIP

All data acquired with this contract will have no less than Government purpose rights in accordance with the definition in DFARS 252.227-7013. The deliverable data, the databases, all database content, and finished products created by the contractor shall have government purpose rights for a five-year period that shall commence upon execution of the contract. Upon expiration of the five-year period, the Government shall have unlimited rights in the technical data.

The contractor shall use PKI certificates obtained through the DoD ECA program or other DoD approved PKI, for user authentication and secure communication over unclassified networks. The contractor shall possess the ability to send and receive encrypted email over unclassified networks using PKI.

10.0 CRISIS AND SURGE SUPPORT

The contractor shall provide rapid response capability due to crisis or surge events. As a result, production activities may be dynamically and unexpectedly realigned as the Government determines appropriate and necessary actions to satisfy immediate mission needs.

11.0 SECURITY

11.1 Classified Work Performance Security Requirements

Contractors must abide by the DD Form 254 - Contract Security Classification Specification (referred to as DD254 hereafter), the National Industrial Security Program Operating Manual (NISPOM 32 CFR Part 117), and all other applicable security policies and regulations including operational security (OPSEC) requirements.

Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Agency (CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances. As such, Security Executive Agent Directive (SEAD) 3 reporting should continue to be provided to the Contractor’s Facility Security Officer (FSO) for reporting to DCSA via Defense Information Security System (DISS). DCSA will also dictate mandatory security training as the CSA for the collateral cleared community.

11.2 Personnel Security Requirements

Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to TS/SCI facilities, when performing duties within TS/SCI environments, and for access to TS/SCI computer systems for the performance of this contract. Contractors are subject to a Counterintelligence-Scope Polygraph examination, as requested by NGA.

All Contractor personnel shall possess a current Top Secret Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access. The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel in accordance with (IAW) SEAD 7: “Reciprocity of Background Investigations and National Security Adjudications”. If needed, NGA will sponsor SCI accesses at its sole discretion. NGA will provide badges, Common Access Cards (CAC) and other items (e.g. parking hangtags) when applicable, for required Contractor personnel.

Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI) Continuous Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW SEAD 6: “Continuous Evaluation”. Cleared Contractor personnel must self-report security issues, foreign contacts, and other applicable information IAW SEAD 3: “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position” and NGA Instruction 5205.3, “Security Reporting Requirements”. In addition, cleared Contractors will be required to submit electronic fingerprints and be enrolled into NGA’s Report of Arrest and Prosecution Background (RAPBack) program, which supports CES.

Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in NGA’s annual Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20 November 2020 memorandum titled “Designation of NGA Personnel Required to Participate in the Security Financial Disclosure Program”.

The Contractor shall inform NGA as soon as practicable when its employees will no longer support the contract (see DD254). NGA desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day that contract support ends. If Contractor personnel will no longer be supporting NGA via an NGA contract, NGA shall take all appropriate action, up to and including debriefing the contractor from SCI access and terminating logical and physical access to NGA IT systems and facilities.

Upon notifying NGA that a Contractor will no longer support the contract, the Contractor must return all NGA Badges, CAC, hangtag, and any other government furnished property. These items can be returned to the NGA Workforce Support Center, NGA Site Security Office, or the Contracting Officer Representative (COR) as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

When Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the responsibility of the Contractor’s FSO to collect the items from the individual and return them to NGA as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

If the FSO debriefs their employee, the FSO shall provide a copy of the debriefing statement, plus all applicable Government-furnished items (e.g. NGA Badge, CAC, Courier Card, parking hangtags, etc.) to the NGA Site Security Office or the NGA Workforce Support Center as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

11.3 Physical Security Requirements

All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at contractor sites must be performed in either an NGA accredited SCIF, Other Government Agency (OGA) SCIF, or an approved secure collateral space that has either a Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this contract. SCIF or secure facility accreditation shall be at least the level commensurate with the level of safeguarding required by the contract DD254.

Pursuant to “IC Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Version 1.5.1; IC Tech Specs for ICD/ICS 705”, the NGA accrediting official, or designee, shall conduct periodic security inspections/reviews to ensure the efficiency of NGA accredited SCIF operations, identify deficiencies, and document corrective actions taken. Inspections/reviews of NGA accredited SCIFs shall be conducted based on threat, facility modifications, sensitivity of programs, past security performance, or at least every five years. Technical Surveillance Countermeasures (TSCM) activities in NGA accredited SCIFs will only be conducted by NGA TSCM teams consisting of NGA military, civilian, or contractor personnel who have successfully completed approved TSCM training. Authorized inspectors shall be admitted to a SCIF without delay or hindrance when inspection personnel are properly certified to have the appropriate level of security clearance and SCI indoctrination for the security level of the SCIF.

Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.

11.4 Unclassified Work Performance Security Requirements

Uncleared Contractor personnel are authorized to work on this contract at the Unclassified level, with access up to DoD Controlled Unclassified Information (CUI) at the Contractor site without the requirement of a security clearance.

11.5 Uncleared Personnel Security Requirements

Any Contractor personnel working with CUI information must receive a favorable HSPD-12 and/or HSPD-12 Tier 1 adjudication prior to accessing CUI information. Contractor personnel who require access to CUI for 60 days or less must receive a favorable HSPD-12 adjudication. Contractor personnel who require CUI access for more than 60 days must receive a favorable HSPD-12 Tier 1 adjudication. NGA will sponsor the HSPD-12 and HSPD-12 Tier 1 background investigation for Contractor personnel as needed.

Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract. Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default.

Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.

11.6 Information Security Requirements

NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. Access to classified information will be pursuant to the security requirements established in the DD254. The Contractor shall not access, download, print, or further disseminate any classified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.

When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies (including the Consolidated NGA (CoNGA) Security Classification Guide) for the proper marking, handling, processing, storing, and safeguarding of classified and unclassified material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.

Access to CUI will be pursuant to DFARS clause 252.204.7012. The prime contractor shall include this clause, including paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for Subcontractor performance retains its identity as covered defense information and will require protection under this clause. Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

NGA will assess and authorize Contractors to process classified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.

In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions. The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-furnished information upon contract termination or when no longer required for contract performance.

In situations when electronic transmission is not practicable, Cleared Contractor personnel may hand-carry contract-related classified information when authorized by the COR in writing. Approved Contractor personnel must obtain NGA courier authorization prior to hand-carrying of classified contract-related information. Only classified information related to the performance of this contract may be hand-carried. Contractor personnel will be limited to hand-carrying classified information between approved Contractor facilities and US Government facilities unless the COR approves other circumstances in writing, when applicable, on a case-by-case basis.

11.7 Cybersecurity Requirements

The Contractor must, at a minimum, implement 10 U.S.C. Sections 391 and 393 along with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” requirements.

If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) In the event that the Contractor discovers a cyber incident that affects a covered Contractor information system or covered defense information residing therein, or that affects the Contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall—

· Notify the DoD Cyber Crime Center (DC3) and the COR in writing within 72 hours of incident discovery

· Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support.

In the event the Contractor discovers and isolates malicious software in connection with a reported cyber incident, the Contractor shall submit the malicious software to DC3 in accordance with instructions provided by the COR. The Contractor should NOT send the malicious software to the COR.

11.8 Insider Threat Requirements

Contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 “Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information” and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.” As soon as practicable, Contractor shall report to the COR events that may have an effect on the status of the entity's or an employee's eligibility for access to classified information; report events that indicate an insider threat to classified information or to employees with access to classified information; report events that affect proper safeguarding of classified information; and report events that indicate classified information has been, or is suspected to be, lost or compromised.

12.0 GOVERNMENT FURNISHED EQUIPMENT, PROPERTY, INFORMATION

The contractor shall provide the list of needed GFI, government furnished equipment, proprietary information, data, etc. along with needed timelines to the Government at proposal submission. The Government will review the submission and make consideration of the GFI necessary for the completion of the contract. GFI may be provided during the contract as determined necessary for completion of ongoing work.

Note: Information and documents in Appendix A may be superseded as new guidance is created. NGA will notify the contractor if other guidance or documents are to be followed other than those originally listed in Appendix A.

All Government owned equipment, property, and information will be returned and/or destroyed upon the completion or termination of this contract.

13.0 TRAVEL

Travel may be required by the contractor in support of this contract. This travel may be to an NGA site, to a facility of the contractor, or to a site agreed upon for meetings, PMRs, or other engagements to discuss the project or project enhancements, or to address and/or resolve issues or areas of concern. Travel will be provided on a Cost Reimbursement no fee basis and converted to a firm fixed price at the end of each 12-month PoP.

APPENDIX A

LIST OF ATTACHMENTS FOR THIS CONTRACT

DTED_Spec_23May2000.pdf

Custom PSG v1.1.0 11OCT2017 (U).pdf

Defense_Gridded_Elevation_Data_DGED_Product_Implementation_Profile_21DEC2017.pdf

NMF_Minimum_V3_0_2016-0831_final.pdf

NMIS-XML_ExchangeSchema_v3.0.pdf

NGA STND 0036_1 0_0WGS84

5.1_GRiD_Training_Quick_Guide_11MAY2017(U).pdf

NGA.SIG.0033_1.0_ELEV – Digital Elevation Content Standardization Implementation Guidance

APPENDIX B

ACRONYM LISTING

1 | Page

22 | Page image1.jpeg