iSToRE-PWS-v4.1_December 2025_Draft.docx

UNCLASSIFIED

National System for Geospatial-Intelligence

Performance Work Statement (PWS) for the Acquisition of Information Store (iSToRE) Follow-On

10 Dec 2025

Version 1.0

THIS PAGE INTENTIONALLY LEFT BLANK

Table of Contents

1.0 INTRODUCTION

1.0.1 (U) The Contractor will provide all personnel, supervision, and non-personnel services required to fulfill this Information Store (iSToRE) Performance Work Statement (PWS). This support includes the iSToRE Open Geospatial Consortium (OGC) service implementation, two baseline update deliveries, program management, engineering, and test support to include any associated travel. The iSToRE Follow-On Period of Performance (POP) will be a maximum of 60-months with a 12-month base period, 29 June 2026 through 28 June 2027, and four (4) 12-month option periods.

1.1 BACKGROUND

1.1.1 (U) The National Geospatial-Intelligence Agency (NGA) seeks to procure capabilities for the iSToRE Program System requirements to develop, deploy, integrate and manage a software only solution necessary to provide an Enterprise and multiple site iSToREs for ingest, validation, storage, discovery, retrieval, dissemination and archival of Geospatial Intelligence (GEOINT) and Imagery products.

1.1.2 (U) The Information Store (iSToRE) is one of the systems that comprise the National System for Geospatial Intelligence (NSG). Its primary role is the short term (less than 5 years) storage & retrieval of imagery and imagery-derived products in support of the Intelligence Community, Department of Defense (DoD), Federal, and local governments. The users of iSToRE serve many roles from Analysts to Policy Makers. The iSToRE is able to import, store, secure, transform, mensurate and export geospatial and imagery data of multiple types including both structure and unstructured. Users are able to access iSToRE holdings via external discovery tools via Representational State Transfer (REST) Application Program Interface (APIs). Some of NGA’s most highly used systems directly interface with iSToRE via OGC services, such as: the Integrated Exploitation Capability (IEC and Orchestration Services (AoS/ Cedalion)

1.1.3 (U) iSToRE software is capable to run and operated on current and future Windows® operating systems. It is currently deployed at over 100 sites worldwide, on different types of platforms ranging from laptops to enterprise servers running the Microsoft Windows® 64-Bit operating system. The end-user for this application varies from Joint Task Force Headquarters and Intelligence Centers to forward-deployed Warfighters.

1.2 (U) The contractor shall provide a software solution which satisfies iSToRE capability requirements and is configurable to various site Concepts of Operations (CONOPs) and architectures. The responsibility for the provision of operational infrastructure lies with the deployed site.

1.2.1 (U) The concept for deployment of iSToRE is limited on-site, contractor-assisted installations, with a majority of deployments accomplished without the need for any on-site contractor support.

2.0 REQUIREMENTS

2.0.1 (U) The contractor’s solution shall meet all requirements specified in the iSToRE System Requirements Document (SRD) (S1CI00 Rev B) and Addendum (S1CI00 Add. 1), and subsequent revisions and change notices due to approved RFC’s or Government direction. In the event of a conflict in requirements, the following order of precedence is observed:

(1) iSToRE SRD (S1CI00)

(2) iSToRE SRD Addendum (S1CI00 Add. 1)

(3) All other documents listed as either Compliance or Guidance

2.0.2 (U) The contractor shall provide all the necessary personnel to perform software enhancements at contractor classified and unclassified facilities and services required to expand, sustain, and support deployment of the software baseline capabilities. The scope of work shall include the following activities:

a) Software baseline enhancements coming from any and all NGA-approved and funded Request For Change (RFC) – that impact iSToRE – to or above the vendor’s offered software baselines.

b) Contract Data Requirements List (CDRL) development and delivery

c) Test and Evaluation, e.g., NGA Configuration Management (CM) Tests, NGA Enterprise Tests, government witnessed Factory Acceptance Tests (FATs), and other vendor tests

d) Integration and deployment

e) Operations and sustainment

f) Security of both catalog metadata and protection controls of file-based access without use of iSToRE catalog

g) Program Management and Engineering

h) Training

i) Travel

j) Decommissioning

k) Schedule

2.0.3 (U) The contractor shall be capable of delivering at least two major software releases per year.

2.0.4 (U) The contractor shall support the installation requirements of their software at CONUS and OCONUS sites.

2.1 Hardware

(U) The contractor shall characterize the hardware platform requirements necessary to meet the iSToRE performance requirements specified in the iSToRE Systems Requirements Document.

(U) In addition, the contractor shall provide a complete list of the minimum hardware required for users to run iSToRE, as described in PWS section 3.4.4.5. (CDRL A021)

2.2 Software Licenses

(U) The iSToRE contractor shall deliver Commercial-Off-The-Shelf (COTS) software as needed to meet the performance requirements. All COTS software licenses delivered by the iSToRE contractor shall meet the following requirements:

· Acceptance and delivery of licenses/executables is contingent upon passing IV&V

· Perpetual licenses with unrestricted use for any iSToRE capability

· Number of licenses required by contract Period of Performance:

· The Government requires End User License Agreement (EULA) in support of operational and mission use of the capabilities provided, with unrestricted ability to transfer purchased licenses between all government-identified, authorized/approved iSToRE users or partner sites (such as NGA employees, DoD employees, Military Services, Other Government Agencies, and Government contractors supporting the agencies) with a validated NGA iSToRE requirement in accordance with this PWS, and , not to exceed the number of licenses bought.

· (U) Ensure that any exports of defense articles, defense services, technical data or other goods and services controlled under the International Traffic in Arms Regulations (“ITAR”) or the Export Administration Regulations (“EAR”) are conducted only with export licenses from the Department of State or the Department of Commerce, or have been authorized in writing by the NGA Office of General Counsel (OGC).

· (U) Unrestricted core structure. No license restriction on the quantity of Computer Processing Units (CPUs) systems used or number of users accessing the system/data.

2.3 Software Maintenance as a Product

(U) iSToRE’s Offeror’s proposal shall include Maintenance as a Product for the Software Maintenance. This product includes routine upgrades, normal periodic updates, and out of cycle priority updates at the government’s direction to the software during the period of performance. It may also include other no-additional-charge support included in the initial purchase price of the product, such as limited telephone, email or web-based general technical support (e.g., help desk).

2.3.1 (U) The iSToRE contractor shall ensure coordinated software delivery for all the software configuration items being delivered. The contractor shall ensure that all software being delivered has completed module testing and has been properly controlled in NGA’s configuration management system at a minimum, and optimally also in a contractor CM system. In addition, all required checklists and any special delivery instructions shall have been completed. The contractor shall monitor updates to third party software and ensure these updates do not adversely affect the iSToRE application. For estimating purposes, the government anticipates the contractor shall provide two software deliveries per year, not including security patches and up to two priority out of cycle software deliveries at the governments discretion on an as needed basis. The government reserves the right to not use out of cycle software deliveries for iSToRE when not necessary.. All software deliveries must be compliant with the NGA Configuration Management, Readiness and Transition policies.

2.3.2 (U) The software delivery shall include all software required to operate the iSToRE, with the exception of the operating system. The software delivery shall also include computer-based training (CBT) and the Software Operations Procedure Manual (SOPM) for the iSToRE version being delivered (CDRL A015). The contractor shall document and maintain in the SOPM all information required to install, configure, and operate iSToRE software. The SOPM shall be updated and delivered for each new software delivery.

2.3.3 (U) The contractor shall provide a test procedure within the SOPM for the customer to perform diagnostic testing after installation of the iSToRE product to validate operational/functional capability.

2.3.4 (U) The contractor shall directly deliver software packages to user locations either electronically or via physical media, as directed by NGA.

2.3.5 (U) The contractor shall generate a Software Version Description Document (SVDD) (CDRL A016) for each software version delivered to the Government or an operational site. The SVDD shall contain the following information:

a) (U) List complete whitelist inventory and associated Software Whitelist Identification (SWID) numbers that makeup the iSToRE software delivery.

b) (U) Source file name, directory path, and version number of all Configuration Management (CM) files being delivered with software version.

c) (U) Changes (new functionality) to baseline being included in this delivery.

d) (U) Issues/problems fixed with this delivery.

e) (U) Issues/problems scheduled to be fixed, but were not, with this delivery.

f) (U) Definition of the amount of operational downtime and any unusual risks or activities expected to be associated with the delivery/installation.

2.3.6 (U) The Contractor shall deliver developed, Executables and Associated Licenses (CDRL A017) for each software delivery. The Government shall have Limited Use Rights for all software and software documentation developed under this contract.

2.4 Integration & Deployment/Operations & Sustainment

(U) The contractor shall provide all labor, services, and supplies to support the requirements for integration, deployment, discrepancy and issue reporting and tracking, and training.

2.4.1 Deployment Support

2.4.1.1 (U) The contractor shall support a phased deployment during the transition period. Approximately 80% of sites will be integrated virtually without travel. The Intel Community and Agency Partner Level Units, Combatant Commands (CCMDs) and Military Intel Centers will require on site deployment. For all other sites, the software has to be robust enough to integrate in a virtual manner.

• (U) The Contractor shall adhere to DoD, IC, and NGA security policies and procedures regarding use of External Cloud (XC), unclassified, secret, and top-secret networks. All Geospatial Information Systems (GIS) in the Federal Enterprise Architecture must follow Federal regulations and guidance mandates for Information systems Security including Office of Management and Budget (OMB) Circular No. A-130 Appendix III, NIST Special Pub 800-53, and Intelligence Community Directive (ICD) 503.

2.4.1.2 (U) The contractor shall support integration trips as directed by the government. The purpose of integration trips will be to conduct site integration of the iSToRE capability to include, but are not limited to:

· (U) Installation of iSToRE software onto approved site hardware

· (U) Configuration of iSToRE

· (U) Authorization & Assessment (A&A) system scanning, security findings, Security Technical Implementation Guides (STIGs), Information Assurance Vulnerability Alert (IAVA), and Security Recommendation Guides (SRG) mitigation and POA&M creation and implementation in accordance with ICD 503 (see appendices for compliance documents)

· (U) Localized testing of iSToRE (Site Acceptance Testing)

· (U) Migration of existing data onto new storage media and/or cataloging of data

· (U) Training of local system administrators and users

· (U) Back up of local system

2.4.1.3 (U) The contractor shall develop site acceptance test procedures (SAT) (CDRL A001) for on-site installation activities to verify system is operational/functional to support site operational acceptance criteria and validate initial operational capability (IOC) of iSToRE product.

2.4.1.4 (U) The contractor shall support up to six (6) system restoral site-visit trips per period of performance with up to a 7-day duration per trip, on an ad hoc basis, as directed by the government. These trips will be to conduct rapid restoration of operational capability and may include, but are not limited to:

· (U) Problem fault isolation and trouble shooting

· (U) Upgrading iSToRE software

· (U) Back up of local system

· (U) A&A system scanning, mitigation and POA&M implementation

2.4.1.5 (U) The contractor shall maintain the ability to support a minimum of two (2) trips per person per Period of Performance. Some concurrent trips for multiple people might be required.

2.4.1.6 (U) The contractor shall submit a Deployment Report (CDRL A002) no later than five (5) working days after each completed deployment. The Deployment Report will include, but is not limited to:

· (U) Purpose of trip

· (U) Version of system at conclusion of activity

· (U) Supplemental security update/patch version at conclusion of activity

· (U) Detailed technical narrative, by day, of activity

· (U) Non-standard configuration changes made at site

· (U) CONOPS discussions with site

· (U) Special requests (e.g., functionality, future improvements, interfaces, etc.) made by site

· (U) Description of back up performed at conclusion of activity

· (U) Lessons learned

2.4.2 Help Desk

2.4.2.1 (U) The contractor’s iSToRE Help Desk shall be staffed at a minimum Monday-Friday, 0800-1600 Eastern Standard Time/Eastern Daylight Time (EST/EDT), and outside of these hours the contractor shall respond to the call initiator within two (2) hours. The contractor is fully responsible for after-hours support.

2.4.2.2 (U) Help Desk Reports – The contractor shall prepare Help Desk Reports (CDRL A003), detailing at least, but not limited to, the following. Historically, for estimating purposes, the government has produced on average 10 per month.

· (U) Incident/ticket number

· (U) Site name/ID

· (U) Software version

· (U) Problem

· (U) Status (and resolution when ticket closed)

· (U) Date ticket opened

· (U) Date ticket closed

· (U) Any Defect Report (DR) generated from the ticket

2.4.3 Defect/Issue Reporting and Tracking

2.4.3.1 (U) The iSToRE contractor shall provide a process for the reporting of issues and discrepancies with the software and a mechanism for tracking resolution status. This process shall be in compliance with applicable Contractor and NGA configuration management plans (e.g., NCMP). In addition, the contractor shall, as requested, provide pertinent DR/Issue information (e.g., technical investigations) and status in support of internal NGA processes (i.e., Consolidated Systems Engineering Review Board (CSERB) and similar boards).

(U) The Contractor shall provide a quarterly report with Quarterly Program Management Review (QPMR) CDRLs summarizing all new DRs, all open DRs, and all newly closed DRs since the previous report. (CDRL A023).

2.4.4 Training

2.4.4.1 (U) The iSToRE contractor shall provide effective and efficient training. The approach should leverage on existing or planned training facilities, equipment and personnel. The Contractor’s training shall enable personnel to acquire concepts, skills, and aptitudes to effectively use the iSToRE software and allow for effective local system administration. Conduct and support up to two (2) training classes per period of performance as requested by the iSToRE Government Program Office (GPMO). Training will occur at an NGA Facility, at sites, at the contractor facility, or via computer-based training – as directed by the government. The content, format, and depth of training are dependent upon the complexity of new capabilities and/or changes of each software delivery.

2.4.4.2 (U) The iSToRE contractor shall develop and maintain a Training Plan (CDRL A004) and associated Training Materials (CDRL A005), and update for each delivery, as required. Training topics should cover, at a minimum, iSToRE User, System Administration (e.g. Computer/Database/Custom Software/Network/Security Administration), and iSToRE diagnostics.

2.4.4.3 (U) The contractor shall have the ability to provide on-site training as requested by GPMO.

2.5 Open Geospatial Consortium (OGC) Services Implementation

2.5.1 (U) The contractor shall implement and provide up to eight (8) updates per period of performance to the OGC services interface within the iSToRE capability as outlined in the NSG Consolidated Library (NCL) Implementation Profiles at minimum during each major iSToRE release (two (2) times per PoP). The contractor shall provide OGC Applications and Services (e.g., Cedalion) required for full OGC services capabilities.

2.5.4 (U) The iSToRE contractor shall provide operations and sustainment (O&S) support for OGC web services. O&S support will involve the following activities:

a) (U) The contractor shall provide technical support to external consumers of the OGC Web Interface

b) (U) The contractor shall identify and resolve minor issues with the code baseline

c) (U) The contractor shall update OGC Web Interface installation / configuration documentation as required

d) (U) The contractor shall distribute the OGC Web Services application and documentation updates on the monthly iSToRE Supplemental Security Disk (SSD)

e) (U) Develop and maintain an automated installer for OGC Web Services

f) (U) Develop and maintain a SoapUI OGC Test Harness to validate:

· (U) Catalog Service for Web (CSW)

· (U) Catalog Service for Web Extensions (CSWX)

· (U) Web Coverage Service (WCS)

· (U) Web Coverage Service Extensions (WCSX)

· (U) Web Coverage Service-Transactional (WCST)

· (U) Web Notification Service (WNS)

(U) It is important that the Software design take into account the trend in the Intelligence Community (IC) towards shared Cloud environments. The contractor shall architect the Software so that it is a service and supports deployment to an IC Cloud computing environment.

3.0 Program Management & Engineering

(U) The iSToRE contractor shall provide effective management of all activities to achieve schedule, and technical performance required. The contractor shall provide all labor, supplies, and services necessary to accomplish program requirements defined in this PWS. The contractor shall support meetings & reviews as directed by the program office. These include, with anticipated frequency:

3.1 Engineering & Management Team

3.1.1 (U) The iSToRE contractor program management team shall maintain all program processes and shall conduct required Quarterly Program Management Reviews (QPMRs) as indicated in this PWS, Section 3.6.

3.1.2 (U) The iSToRE contractor shall designate a Program Manager (PM) who is the single management interface to the Government and has the experience level to:

a) (U) Meet or exceed the schedule and performance parameters of the contract;

b) (U) Staff the program with properly trained and qualified personnel; and

c) (U) Ensure required materiel and data are available on schedule and in required quantities.

3.1.3 (U) The iSToRE contractor shall identify a Chief Engineer who will provide technical oversight to the program management team.

3.1.4 (U) The iSToRE contractor shall identify personnel to provide direct support for operational and test iSToRE servers in the classified SC2S and C2S domains from the NGA Washington and from the Contractors facility.

3.1.5 (U) The iSToRE contractor shall identify a Test Engineer who will provide Subject Matter Expertise (SME) at the NGA Test Organization (NTO). The Test Engineer shall provide the following support:

a) (U) Resident at NTO Test facility

b) (U) SME support to NTO Staff testing iSToRE

c) (U) SME support to other segments requiring iSToRE interface testing

d) (U) Support to troubleshoot interface issues

e) (U) Apply appropriate patching, to include security patching, to iSToRE systems deployed at the NTO

f) (U) Review of NTO generated test plans for accuracy and input

g) (U) TEMs (Technical Exchange Meetings) to discuss/review testing methods to be employed

h) (U) Support chart package creation, editing, and submission in support of TEMs

i) (U) Daily status meetings with NTO staff (per NTO Schedules)

j) (U) Work with other program SMEs as needed to meet iSToRE test goals

k) (U) Support NGA CM Test Events and Enterprise Testing as required

3.1.5 (U) The iSToRE contractor shall identify a Security Manager who will provide program security oversight to the contractor program team. The Security Manager shall ensure the iSToRE program meets the security requirements as specified in PWS Section 7.0, compliance documents and NGA direction.

3.2 Program Organization

3.2.1 (U) The iSToRE Contractor shall identify the formal organization it will employ to support the requirements of the PWS. A clear line of authority shall exist among all organization elements.

3.2.2 (U) The contractor shall provide a skill mix with the technical expertise to support all contract requirements throughout the period of performance. All Key Personnel, must have a TS/SCI clearance as described in Section 7.

Key Personnel

(U) Table is UNCLASSIFIED in its entirety.

Program Manager Responsible for general oversight and overall execution of the contract providing support and direction to meet targeted outcomes and satisfy the PWS requirements.

Must be the single point of contact for any programmatic issues that may arise under this task order.

Required

Education: Minimum of Bachelor’s Degree in Business Administration, Engineering, or Management.

Experience: Minimum of seven (7) years of information technology Project management.

Desired Certification: Program Management Professional (PMP) or the DAWIA Program Management (PM) Advanced certification.

10 years hands-on experience in project management, agile development, software engineering or equivalent experience.

Is the primary point of contact for any technical issues that may arise under this task order.

Required Education: Minimum of Bachelor’s Degree in Engineering, Computer Sciences, or Information Technology, or strongly related field.

Experience:

· Minimum of Bachelor’s Degree plus seven years – or Master’s Degree plus five years – of experience in systems engineering, software development or software maintenance, computer programming, or information technology.

· Minimum of five years of software development or maintenance.

· Demonstrated ability to lead the engineering tasks supporting the development, integration, and maintenance required to fulfill this contract.

· Demonstrated success in delivering software baselines, and in fixing discrepancy reports.

Desired:

· Knowledge of current technologies used in the NSG and ASG.

· INCOSE Certified Systems Engineer Professional (CSEP).

· IEEE Certified Software Development Professional (CSDP).

18 years hands-on experience in software engineering, development, maintenance, or integration; information technology; or computer programming.

Education: Minimum of Bachelor’s Degree in Engineering, Computer Sciences, or Information Technology, or strongly related field.

Location: Resident at NTO Facility

Experience:

· Minimum of Bachelor’s Degree plus seven years – or Master’s Degree plus five years – of experience in systems engineering, software development or software maintenance, computer programming, or information technology.

· Minimum of five years of software test.

Desired:

· Knowledge of current technologies used in the NSG and ASG.

· Working knowledge of NSG segments.

· Hands-on experience troubleshooting interface issues

· Hands-on experience applying software patching

· Experience reviewing and following NTO generated test plans.

11 years hands-on experience in software engineering, test, maintenance, or integration.

3.3 Program Infrastructure

3.3.1 (U) The iSToRE contractor shall provide facilities that are cleared for Top Secret/SCI level required to perform the work under this contract as well as store and process classified information on day one of the contract. Software integration will be performed at the Contractor’s facility. The Government will provide space for a contractor employee supporting Program and NTO Testing Activities.

3.3.2 (U) The iSToRE contractor shall provide the infrastructure to support the following:

a) (U) Internet e-mail connectivity

b) (U) Secure network connectivity (e.g., COE, NGANet, CWAN, NMIS)

c) (U) Secure telephones SCI capable and teleconference capabilities (both secure and open)

d) (U) Secure and open facsimile capabilities

e) (U) Secret and Top Secret/SCI facilities (SCIF)

3.3.3 (U) The contractor shall provide a classified and unclassified development/test facility with associated equipment, network and infrastructure to support the development, maintenance, integration, and verification activities identified herein prior to the shipment of the iSToRE software.

a) (U) The ability to obtain privileged user accounts and Shield Access on SBUNet, SECNet, NGANet.

3.4 Program Controls and Management Functions

3.4.1 Integrated Master Plan

(U) The iSToRE contractor shall develop and maintain an Integrated Master Plan (IMP) (CDRL A006) for effective configuration management, development management and software delivery. The IMP shall also explain the software integration and release process, to include timelines. The IMP shall contain the integrated management framework for successful achievement of cost, schedule and technical contract performance. The Contractor shall describe and maintain in the IMP narrative an effective organizational structure, staffing plan and management approach to meet the requirements and schedule herein. The IMP shall contain management and supporting process narratives that document the contractor’s total work effort and shall provide the Government insight into how the Contractor will develop, test, deploy, implement, train, and maintain the software identified within this PWS and complete the total contracted effort.

3.4.2 Schedule Management

(U) The contractor shall develop and maintain an Integrated Master Schedule (IMS) (CDRL A007), as directed by the Government Program Manager, Contracting Officer (CO) or Contracting Officer’s Representative (COR). The IMS shall include all activities required to complete the effort, including the options, and identify the schedule for future releases. The IMS should identify key external predecessor dependencies and include linkages. The contractor shall provide a written description and supporting analysis of the critical path as part of this CDRL. The IMS shall also identify any Contractor’s schedule risks and opportunities with best/worst case outcomes identified.

3.4.3 Risk Management

(U) The contractor shall develop a Risk Management Plan (CDRL A008) which identifies any risks to successful, timely completion of the contracted effort, to include likelihood of occurrence, impact to overall schedule and performance, and recommended/planned risk mitigation.

3.4.4 Systems Engineering Support

3.4.4.1 (U) The Contractor shall provide a mechanism which allows the Government visibility into the status of development/repair of software changes to the COTS baseline, e.g., Defect Reports (DRs).

3.4.4.2 (U) The contractor shall develop and maintain a System Engineering Management Plan (SEMP) (CDRL A009) using the NGA Configuration Management Plan (NCMP) and Test and Readiness process as guidance. The SEMP shall document the contractor’s overall system engineering approach to satisfy the overall iSToRE contract.

3.4.4.3 (U) The contractor shall prepare Rough Order of Magnitude estimates (ROMs) as required.

3.4.4.4 (U) The contractor shall review all RFCs scheduled for the NGA Configuration Control Board (CCB) and provide Impact Assessments with summary technical and cost information on impacts to the iSToRE software baseline in accordance with the NCMP. The government estimates up to 200 RFC reviews per year, and up to 15 of those will require impact statements.

3.4.4.5 (U) The contractor shall provide an Engineering Report (CDRL A021) which will provide a hardware and software configuration recommendation using iSToRE and other COTS IT systems that will meet the requirements for deployments utilizing iSToRE PMO capabilities and then to demonstrate through appropriate testing, modelling, and simulation, that the solution will meet these requirements.

3.4.5 Funds Management

(U) The contractor shall complete the Contract Funds Status Report (CDRL A010) monthly in the standard DI-MGMT-81468 format.

3.5 Program Reviews and Meetings

(U) The iSToRE contractor shall conduct Quarterly Program Management Reviews, Software Release/Update Reviews, Product Demonstrations, and User Engagement meetings as described in detail below. In addition, contractor shall attend and participate in technical and management meetings, to include deployment TEMs, relevant to iSToRE and other interfacing programs.

3.5.1 Program Reviews

3.5.1.1 (U) The Contractor shall conduct Quarterly Program Management Reviews (QPMRs) (estimate 4 per year) at a venue appropriate to the required level of information exchange. Attendance will include government, Federally Funded Research and Development Center (FFRDC), System Engineering and Technical Assistance (SETA), System Integrator, contractor, subcontractor personnel, and others deemed necessary by the Government. All QPMR Briefing Charts (CDRL A013) shall be submitted to the government at least three (3) working days before the review.

3.5.1.2 (U) At a minimum, the Quarterly Program Management Reviews shall address the following areas:

· Upcoming major events

· RFC and in-scope change status

· Action item status

· Near-term issues with Government Furnished Property (GFP) and licenses

· Risk management and mitigation/opportunity details

· Special interest items

· Program technical merits (actual versus threshold)

· Development/Sustainment status

· Status of investigation of reported S/W problems

· Outstanding technical issues

· Requirements awaiting action

· Detailed RFC review and assessment status

· Future software deliveries and test/demo support activity progress/status

· Logistics status/issues

· Security certification/accreditation status

· Transition status (site data migrations/transitions)

· Major event and milestone schedule for the next quarter

· Status of GFP, licenses, maintenance agreements, and COTS

· List of any proprietary software, hardware, firmware, documents, etc.

· Status of any obsolescence issues by priority

· Personnel staffing by discipline/functional area

· Help Desk calls by site, to include problem and status

3.5.1.3 (U) The iSToRE contractor shall document and submit the QPMR minutes (Reports/Minutes (CDRL A012)) no later than five business days after each QPMR.

3.5.2 Software Release/Readiness/Update Reviews

3.5.2.1 (U) Periodic Product Reviews: Before each COTS release, the iSToRE Contractor shall present upcoming relevant changes to the iSToRE PM 90 days prior to implementation. The PM, CO or COR will be allowed input into these changes. This will provide NGA an opportunity to anticipate shortfalls and add input to future improvements the Contractor might make.

3.5.2.2 The iSToRE contractor shall prepare Software Release & Demonstration Charts (CDRL A014) which describe (at a minimum) the following:

· New capabilities provided

· Discrepancies fixed or mitigated with release

· Provide description of the user-base scenarios to be used in the product demonstration referenced in section 3.6.3 – Product Demonstrations

· Data migration approach as required

· Estimated upgrade timeline (time it takes to install/upgrade and configure)

· Training plan associated with this release

· Integration & Factory Test Report (CDRL A019)

3.5.3 Product Demonstration

(U) The Contractor shall conduct government witnessed user-based scenario demonstrations as required by the iSToRE PM. These Demonstrations shall be detailed enough to validate that the software has the ability to support the requirements contained within the PWS and SRD, and that its design supports a “Day-in-the-Life” (DITL) of an average Geospatial/Imagery Analyst. Detail for these shall be included as part of CDRL A014 referenced above.

3.5.4 User Engagement Meetings

(U) The contractor shall support up to two (2) User Engagement meetings per year. The focus of the User Engagement meeting is to inform the iSToRE user community of status of operational DRs, upcoming releases, improvements, and to act as a forum for user feedback. The Contractor shall provide the resources necessary to support and participate in technical and management meetings (including secure teleconference communications). The Contractor shall provide written Reports/Minutes (CDRL A012) of all coordination activities as required by the Government.

3.6 Test and Evaluation (T&E)

(U) The iSToRE contractor shall develop and maintain a comprehensive approach for conducting factory integration and system test/evaluations to ensure that each version of the iSToRE baseline is suitable for further NGA independent test and evaluation and deployment to operational sites. This test approach shall be documented in the iSToRE Test Evaluation and Master Plan (TEMP), to include timelines for the product release and test process (CDRL A018). The test results shall be documented in the iSToRE Test Report (CDRL A019). Factory test result artifacts used for validation criteria should be delivered to GPMO prior to Independent Verification and Validation (IV&V) testing.

3.6.1 NITFS Certification

(U) The iSToRE contractor shall support Joint Interoperability Test Command (JITC) National Imagery Transmission Format Standard (NITFS) compliance certification as prescribed in the NITFS Standards Compliance and Interoperability Test and Evaluation Program Plan in conjunction with factory testing. The Contractor shall coordinate with the JITC and government program office on specific test event planning and provide products/samples to the JITC for evaluation. All iSToRE issues identified by the JITC shall be resolved in accordance with normal iSToRE contractor discrepancy work off procedures.

3.6.2 NTO Test Support

(U) The iSToRE contractor shall support testing with the NGA Test Organization-Test Environment (NTO-TE), as required. This includes supporting test planning meetings and exchanging data with segments located at the NTO-TE and enterprise test events and creating or editing chart packages in support of testing. The knowledge and experience of the NSG and Enterprise Test processes to support TACA testing as it relates to Certification to Field (CtF) for iSToRE releases, any DR testing, other segment or Enterprise test events.

3.7 Engineering and Development

(U) The contractor shall engineer iSToRE software solutions to interoperate within the NSG Enterprise. The contractor shall conduct engineering activities based on industry/commercial best practices to successfully implement requirements. This shall include engineering activities to plan, direct, control, and execute the development, integration, conduct test and evaluation, architectural document updates, delivery, deployment, installation, checkout, verification, training, and transition to support new software releases.

(U) The contractor shall implement the requirements defined in the iSToRE Requirements Document (S1CI00 Rev B), and Addendum (S1C00 Add. 1), and subsequent revisions and change notices due to approved RFCs or Government direction. The contractor should have a thorough understanding of the National System for Geospatial-Intelligence Product Description Document (NSGPDD) (All applicable Addendums and Appendices) . In the event of a conflict in requirements, the following order of precedence is observed:

1. iSToRE SRD (S1CI00)

1. iSToRE SRD Addendum (S1CI00 Add.1)

1. NSGPDD, Appendices, and Addendums

1. All other documents listed as either Compliance or Guidance

(U) The contractor shall be responsible for implementing and deploying the software regardless of whether the integrated components were originated by the contractor, its subcontractors, associate contractors, COTS, Free and Open-Source (FOSS), or Government off the Shelf (GOTS) (including other NSG programs).

(U) The contractor shall ensure full interoperability and compatibility between the iSToRE software baseline and Program, and the Government’s Information Service Provider/Application Service Provider (ISP/ASP) systems. The Contractor shall document all technical integrations, including APIs, data exchange formats, and security protocols for review and approval by the Contracting Officer’s Representative (COR).

4.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND INFORMATION

4.1 (U) The Government will provide on-site facilities when necessary to perform work required under this contract. On-site facilities include desk, chair, telephone, computer equipment with LAN/WAN interface, commercial-off-the-shelf software, document file cabinets, office supplies and access to copier and facsimile machine. Upon completion of this contract, the Contractor shall return all non-expendable Government issued supplies to the COR.

4.2 (U) The contractor shall provide management and accountability for all GFE/GFI assets under their control.

5.0 CONTRACTOR FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

5.1 (U) The Contractor shall provide all necessary qualified personnel, supervision, management, non-personnel services, and tools of the trade to accomplish the tasks for this contract.

6.0 QUALITY CONTROL

6.1 (U) The contractor shall create, deliver, and maintain a Quality Assurance Plan (QAP) (CDRL A011) which is consistent with industry standard quality requirements, best practices, and contractor policies.

6.2 The QAP shall:

· describe the method for identifying and tracking single point failures.

· describe the methods for identifying and preventing problems before the level of performance becomes unacceptable, indicate how the Contractor will ensure its products meet standards, to include image quality standards.

· address how third-party software including Windows® based operating system updates are monitored, integrated, and tested to ensure the iSToRE baseline is not adversely impacted.

7.0 SECURITY

7.0.1 (U) The contractor personnel supporting iSToRE Deployments shall possess the necessary certification mandated by the NGA, IC, and DoD mandated certifications (e.g., DoDM 8140.03). Deployment personnel must be able to obtain Gamma and Human Control System caveats.

7.0.2 (U) The contractor shall ensure the system being engineered, developed, and maintained is certifiable and satisfies all applicable security requirements. This also includes supporting physical security, security briefings and debriefings, discussions with program security offices, security arrangements for project meetings at Contractor facilities, and coordination of special courier support (as required).

7.0.3 The contractor shall maintain a System Security Assurance Plan (SSAP) (CDRL A020) detailing how the security requirements in this PWS will be addressed and achieved. Additionally, the SSAP shall include the plan to detect, mitigate, and test security vulnerabilities in third-party software included in the iSToRE deliverable.

7.1.1 (U) Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to NGA facilities, when performing duties within TS/SCI environments, and for access to TS/SCI NGA computer systems. Contractors are subject to a Counterintelligence Scope Polygraph, as requested by the Government. All Contractor personnel shall possess a current Top-Secret Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access. The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel IAW Security Executive Agent Directive (SEAD): “Reciprocity of Background Investigations and National Security Adjudications”. NGA will sponsor SCI accesses, NGA Badges, Common Access Cards (CAC), computer accounts, and other items (e.g., parking hangtags) when applicable, for required contract personnel.

7.1.2 (U) Contractors must abide by the DD Form 254 - Contract Security Classification Specification and applicable security policies and regulations.

7.1.3 (U) Contractor personnel shall follow all applicable NGA, IC, and DoD information security and operational security policies and guidance during performance of contract requirements.

7.1.4 (U) The Contractor shall inform the Government when its employees no longer support the contract (see DD254). The Government desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day support ends. If Contractor personnel will no longer be supporting NGA via an NGA contract, any debriefing paperwork, notifications, and/or requests for further direction from the COR or Industrial Security shall be turned into the NGA Workforce Support Center, NGA Site Security Office, or the COR. If Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the Contractor’s security office’s responsibility to collect the items from the individual. If the Contractor debriefs the employee, the Contractor shall send a copy of the debriefing statement, plus any Government items (e.g., NGA Badge, CAC, Courier Card, parking hangtags, etc.) within four (4) business days (timeline may be extended with authorized documented exceptions by NGA Security) to an NGA Site Security Office or the NGA Workforce Support Center.

7.1.5 (U) All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at collaborator sites must be performed in either an NGA accredited SCIF or an Other Government Agency (OGA) SCIF that has either a Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this contract.

7.1.6 (U) Cleared Contractor personnel may hand-carry contract-related classified information as authorized by the COR. Contractor personnel will obtain NGA courier authorization prior to hand-carrying of contract-related classified information. Contractor personnel will be limited to hand-carrying classified information between the Contractor facilities and NGA facilities only.

7.1.7 (U) Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI) Continuous Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW SEAD 6: “Continuous Evaluation”. Cleared Contractor personnel must self-report security issues, foreign contacts, and other reporting requirements in accordance with SEAD 3: “Reporting Requirements for Personnel With Access to Classified Information or Who Hold a Sensitive Position” and NGA Instruction 5205.3, “Security Reporting Requirements”. In addition, cleared Contractors will be required to submit electronic fingerprints and will be enrolled into NGA’s Report of Arrest and Prosecution Background (RAPBack) program, which supports CES.

7.1.8 (U) Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Authority (CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances. As such, Security Executive Agent Directive (SEAD) 3 reporting requirements should continue though Defense Information Security System (DISS). DCSA will also dictate mandatory security training as the CSA for the collateral cleared community. Please note, all personnel that have NGA PeopleSoft records, will also be required to complete the NGA mandatory training. This includes any individuals cleared with SECRET or TOP SECRET. The COR can advise which SECRET or TOP SECRET cleared personnel will be required to complete the NGA mandatory training.

7.1.9 (U) Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in NGA’s annual Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20 November 2020 memorandum titled “Designation of NGA Personnel Required to Participate in the Security Financial Disclosure Program.

7.1.10 (U) Information Handling

· (U) Contractor personnel will comply with the NGA, DoD, and IC policies and regulations (to include, but not limited to, the Consolidated NGA (CoNGA) Security Classification Guide) to properly mark (to include portion marking) classified and unclassified documentation, media, etc.

· (U) Document markings will be in accordance with the lowest security classification possible to ensure the confidentiality and integrity for the greatest release to partners in accordance with NGA and mission partner marking guides for classified information.

7.1.11. (U) All Government-furnished information released to the Contractor or created in the performance of this contract will be destroyed or returned by the Contractor to NGA upon contract termination or when no longer required for contract performance. The determination to destroy or return will be at the direction of the NGA CO or COR.

7.2 Assessment & Authorization (A&A) and Network Security

7.2.1 (U) The iSToRE contractor shall provide dedicated support personnel for appropriate Assessment & Authorization (A&A) and Continuous Monitoring activities during software life cycles and A&A registration processes, as required by the Government.

a) (U) The contractor shall test all required and recommended security patches (e.g., IAVA, IAVB, IAVM, IAVT, and all applicable STIGS/SRGs, etc.) to the operating system (OS) and iSToRE software application for compatibility in accordance with ICD 503 continuous monitoring requirements. This includes security findings produced from government approved scanning tools/practices.

b) Conduct continual analysis and corrective actions to ensure all operational systems, devices, and applications remain compliant with current automated and manual DISA STIGs, SRGs, IAVM requirements, USCYBERCOM Operational Orders (OP ORD), and approved security updates. Any ongoing waivers and unmitigated risks must be briefed to the NGA government Information Systems Security Officer (ISSO) quarterly.

c) (U) The contractor shall provide the appropriate Plan of Action & Milestone (POA&M)/ mitigation documentation for all security findings within the mandatory policy compliance time. This includes, but is not limited to, any security findings resulting from required or recommended security patches, system security scans and applicable STIGS/SRG configurations, notification of required security patching, or system hardening intent.

d) Perform security audits and assessments, including the creation of a POA&M and testing of vulnerability remediation packages prior to deployment using the NGA Chief Information Officer (CIO)-T approved vulnerability scan tool.