Statement_of_Work.pdf

STATEMENT OF WORK

NOAA Fiber Maintenance

ID40160009

1. Introduction/Background

The Office of Satellite and Product Operations (OSPO) is responsible for the management and operations of the Satellite Operation Control Center (SOCC) and the Environmental

Satellite Product Center (ESPC).

ESPC manages and directs the operation of the central ground facilities which ingest, process, and distribute environmental satellite data and derived products to domestic and foreign users.

ESPC supports multiple GOES and POES production systems via virtualization. This fiber link supports real time weather data analysis by the Satellite Analysis Branch (SAB) and the National

Weather Service. The current fiber connection between NSOF and NCWCP supports ESPC and

NSOF Admin LAN connections to SPSD (SAB). To ESPC, this connection is known as the

PON.

2. Scope of Work

This procurement is to procure maintenance support of (1) pair of dark fiber between NOAA

NSOF located at 4231 Suitland Road, Suitland MD., to NOAA NCWCP located at 5830

University Research Ct., Riverdale MD. The distance between the two facilities is approximately

25 miles.

The work will include but not be limited to installing, splicing, termination, and testing. Vendor will need to provide 24x7 support and will need to have access to both facilities.

This fiber circuit is a point-to-point

3. Requested Delivery/Period of Performance

Period of Performance: One base year with two, one year options.

4. Security Requirements

The contractor shall comply with the IT Security requirements of the Department of Commerce as outlined in Commerce Acquisition Regulation (CAR) 1352.239-72, Security Requirements

For Information Technology Resources (April 2010), except that development of a Security

Accreditation Package in accordance with CAR 1352.239-72, section (i) is not required. In addition, personnel shall be screened in accordance with the requirements for High Risk contracts as specified by CAM 1337.70 section 2.2; specifically, in accordance with CAR

1352.237-70, Security Processing Requirements—High or Moderate Risk Contracts (April

2010). Any access by contract personnel who are Foreign Nationals shall be in accordance with the requirements of CAR 1352.237-73, Foreign National Visitor and Guest Access to

Departmental Resources (APR 2010).

ID40160009

a. Notice of Supply Chain Risk Assessment (Interim) (Mar 2014) Supply Chain Risk Management (SCRM) restrictions require the Department of

Commerce, among others, to assess any associated risk of cyber espionage or sabotage associated with the acquisition of an information technology system including any risk associated with such system being produced, manufactured, or assembled by one or more entities identified by the United States Government as posing a cyber threat, including, but not limited to, those that may be owned, directed, or subsidized by the People’s

Republic of China. Offerors and awardees are required to provide any information to the

Department it deems necessary to facilitate its compliance with the SCRM assessment including, but not limited to, the data requested by the Supply Chain Risk Assessment

Information (Mar 2014) questionnaire included in this solicitation. By submission of its proposal, the offeror acknowledges the Department retains the right to reject any offer without recourse or explanation if the Department determines the offeror or the equipment or software offered by the offeror or awardee, presents an unacceptable risk to national security.

(end)

b. Non Destructive and Destructive Testing (Mar 2014) The Department of Commerce may engage in non-destructive and/or destructive testing of any IT or software that it determines could negatively affect the security or performance of a Department of Commerce IT system.

c. Supply Chain Risk Assessment Information (Mar 2014) To allow the Department of Commerce to conduct a risk assessment, the offeror shall submit the following information with its proposal:

(1) Its identity, including that of each parent and/or subsidiary corporate entities.

(2) Any proposed subcontractors involved in its supply chain.

(3) The degree of any foreign ownership in or control of the entities identified under 1 or

2.

(4) The names and dates of birth of the offerors’/contractor’s corporate officers.

(5) Whether the offeror/contractor maintains a:

(a) Formal security program that includes personnel security;

(b) Information security program;

(c) Physical security program;

(d) Cyber security program; and

(e) Supply chain risk management program.

(6) The name and locations of each facility where any IT hardware or software to be delivered under the contract or task order was designed, manufactured, packaged and stored prior to distribution.

(7) Whether a separation of duties exists during the development process of any IT hardware or software to be delivered under the contract or task order.

(8) The means and method for delivering any IT hardware or software to be delivered under the contract or task order, including the name(s) of any entity responsible for

ID40160009

transport or storage. This information should address whether IT hardware of software will be direct-shipped to the Department.

(9) Who will provide any follow-on service required by the contract or task order.

(10) The identity of the entity that will provide disposal services of any IT hardware or software required by the contract or task order.

The Government may require additional information if necessary.

By submission of its offer and or acceptance of this contract, the offeror represents this information is accurate and complete. Offerors and awardees shall have a continuing obligation to amend any information that changes either during the source selection period or during the contract or task order performance period.

d. Evaluation of Supply Chain Risk Assessment Information (Mar 2014)

The Department will evaluate the information provided to assess the national security risk associated with the offeror’s proposal.

e. Novation Agreement for Acquiring Certain Information Technology (Mar 2014)

(1) “Novation agreement” means a legal instrument—(a) Executed by the--(i) Contractor

(transferor); (ii) Successor in interest (transferee); and iii) Government; and (b) By which, among other things, the transferor guarantees performance of the contract, the transferee assumes all obligations under the contract, and the Government recognizes the transfer of the contract and related assets. (FAR 2.101 – Definitions).

(2) The Department may in its interest recognize a successor in interest. The offeror and or subsequent awardee(s) agree as a condition of this contract, that any novation considered and recognized by the Department shall be subject to SCRM restrictions and applicable clauses, including “Notice of Supply Chain Risk Assessment

(Interim) (Mar 2014)”, “Non Destructive and Destructive Testing (Mar 2014),”

“Supply Chain Risk Assessment Information (Mar 2014)” and “Evaluation of

Supply Chain Risk Assessment Information (Mar 2014).”

Acquisition of approved products and services for personal identity verification.

(a) In order to comply with FIPS PUB 201, agencies must purchase only approved personal identity verification products and services.

(b) Agencies may acquire the approved products and services from the GSA, Federal Supply

Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

https://www.acquisition.gov/far/current/html/Subpart%208_4.html#wp1089480

ID40160009

(c) When acquiring personal identity verification products and services not using the process in paragraph (b) of this section, agencies must ensure that the applicable products and services are approved as compliant with FIPS PUB 201 including—

(1) Certifying the products and services procured meet all applicable Federal standards and requirements;

(2) Ensuring interoperability and conformance to applicable Federal standards for the lifecycle of the components; and

(3) Maintaining a written plan for ensuring ongoing conformance to applicable Federal standards for the lifecycle of the components.

(d) For more information on personal identity verification products and services see http://www.idmanagement.gov.

The contractor shall ensure that any changes made to the system are compliant with current security controls —as specified by the Government and based on the recommendations of NIST

Special Publication (SP) 800-53, Revision 4, Recommended Security Controls for Federal

Information Systems and Organizations —at the level required by the system’s FIPS 199 security categorization http://www.idmanagement.gov./