Web_API_Services_Statement_of_Work.pdf

1. Introd

The Natio National G variety of emergenc collect thi partners a along coa Hurricane NOAA’s and assess address lo Applicatio satellite im referenced

Figure 1:

2. Scope

NGS requ geocoding https://sto

Web Appli duction/Back onal Oceanic Geodetic Surv f spatially-refe y response re is information and well as the astlines impac e Katrina in 2 emergency re s storm dama ocations (Figu on Program In magery maps d emergency

NGS Emerge of Work:

uires commerc g/address look orms.ngs.noaa ication Progr kground:

and Atmosph vey (NGS) Re erenced remo equirements. M n providing hi e general pub cted by numer 005, Hurrican esponse imag age through an ure 1). In orde nterface (API and geocodin response ima ency Respons cial web API kup to suppor a.gov. NGS re

STATEM

ram Interfac heric Adminis emote Sensin ote-sensing da Most frequen igh resolution blic. These im rous major hu ne Sandy in 2 ery products n interactive w er to fulfill its I) services inc ng/address loo agery via the w se Imagery fro services inclu rt emergency equires a map

MENT OF W

ce Services fo stration (NOA ng Division (R atasets to supp tly, NOAA N n geo-referenc mages have ass urricanes datin 2012 and Hurr are made ava web map by p s mission, NG cluding unlim okup services web.

om Hurricane uding web m response ima pping platform

WORK

or the Nation

AA), National RSD) acquire port coastal m

NGS RSD use ced images to sisted with re ng back to Hu ricanes Irma, ailable via the panning, zoom

GS requires th mited base lay s to support th e Harvey show map base layer agery web del m for develop nal Geodetic l Ocean Servi s and rapidly mapping, hom es digital aeria o federal, stat esponse and re urricane Isabe Harvey and M e web where u ming or searc he acquisition er street map he disseminat wn as a web m r street maps, livery require pers, offering

Survey ice (NOS), disseminates meland securit al cameras to te and local ecovery effor el in 2003, Maria in 2017 users can brow ching specific n of web s for context, tion of geo-map overlay satellite map ements throug a suite of AP s a ty and rts

7.

wse s and gh:

PIs and tools for building online interactive web map applications. APIs have become an integral part of both the Emergency Response / Post-storm assessment and coastal mapping programs within the RSD of the NGS. RSD requires digital tiled street map layers built from contemporary open source “Open Street Map” source data along with recent worldwide mosaic satellite imagery to serve as base-layer contextual information for the emergency response aerial imagery acquired by RSD after hurricanes or other natural disasters. RSD also requires a geocoding / address lookup service accessible through a JavaScript client library.

3. Product Specifications

Component Qty/Duration

Unlimited Map Views 1 year

Minimum of 10 million temporary geocodes 1 year

Support services to include e-mail and telephone support, 7 days/week from 8:30am to 6:00pm; 99.9% server uptime

1 year

Option years for uninterrupted services 4 years

The API shall provide JavaScript accessible unlimited web map views for a single price per year. Due to the unpredictable nature of emergency response imagery acquisition and data dissemination where web traffic can surge to high levels generating large increases in map views within a matter of hours, RSD does not seek a pricing structure with a set ceiling for map views where overage charges are implemented once the number of web views exceeds a predetermined ceiling.

The API shall also offer a Representational State Transfer (REST) service for geocoding/address searching that allows RSD customers to provide an address or location lookup for emergency response imagery data layers. A minimum of 10 million address lookups per year is required and must be accessible through a JavaScript client library to integrate with exist emergency response code.

Support services shall include e-mail and telephone support, seven (7) days/week with availability from 8:30 a.m. to 6:00 p.m. EST. Server reliability shall be at 99.9% uptime.

The API must be able to handle web traffic surges during an emergency response event. As a baseline, web traffic may range from 5,000,000 map views (normal non-emergency usage) to 200,000,000 (2017 hurricane season) for a single hurricane season (Jun – Nov).

The API shall be able to be downloaded and hosted on NOAA servers, which eliminates the need for an external dependency. This independence also provides the flexibility to update the map code on an independent schedule rather than “patching” code after a breaking change due to modifications to externally hosted libraries which could interrupt RSD’ map services during the hurricane season.

The API shall support vector tiles compliant with the widely recognized Mapbox open Vector Tile Specification. Vector tiles are compact structured binary data files containing geometries and metadata such as streets, buildings, locations and place names. Vector tiles make it possible to render large amounts of data in the browser while still maintaining control over the design and styling of the thematic data.

4. Requested Delivery/Period of Performance:

The period of performance shall consist of a base period of twelve (12) months with an addition of four (4), 12-month option periods, as follows:

Base: 1 June 2018 – 31 May 2019 Option Period 1: 1 June 2019 – 31 May 2020 Option Period 2: 1 June 2020 – 31 May 2021 Option Period 3: 1 June 2021 – 31 May 2022 Option Period 4: 1 June 2022 – 31 May 2023

5. IT Security Requirements:

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The contractor will only supply software and/or product license and will not require the use of any contractor owned equipment. The contractor will not have remote access to any government owned equipment.

The contractor includes the necessary product support and supporting documentation for the software that allows the sanitization (following NIST Special Publications 800-88 Guidelines for Media Sanitization, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) of the hardware and/or software upon the disposal of the product.

The contractor must provide sufficient document demonstrating the software being provided complies with Office of Management and Budget Memorandum M-07-18 entitled Ensuring New Acquisitions Include Common Security Configurations and the FAR 39.101(d) regulations involving NIST common security configuration checklists including Federal Desktop Core Configuration (FDCC) or United States Government Configuration Baseline (USGCB) initiative. More information is available at National Checklist Program (NCP), (http://checklists.nist.gov), is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.

The contractor must provide sufficient documentation which demonstrates the acquiring information technology has implemented common security configurations. Common security configurations are available from the National Institute of Standards and Technology’s website at http://checklists.nist.gov.

The contractor must ensure that the product being purchased complies with the Homeland Security Presidential Directive 12 (HSPD-12) requirements from FAR 4.1302 stating: (a) In order to comply with FIPS PUB 201, agencies must purchase only approved personal identity verification products and services. (b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

The contractor must ensure that the product being purchased complies with Internet Protocol Version 6 (IPv6) requirements from FAR part 11.002 requirements which state that unless the agency Chief Information Officer waives the requirement, when acquiring information technology using Internet

Protocol, the requirements documents must include reference to the appropriate technical capabilities defined in the USGv6 Profile (NIST Special Publication (SP) 500-267-http://www.nist.gov/itl/antd/usgv6.cfm) and the corresponding declarations of conformance defined in the USGv6 Test Program (http://www-x.antd.nist.gov/usgv6/index.html). To meet this requirement each DOC acquisition of IP protocol technology must express requirements for IPv6 capabilities in terms of the USGv6 Profile (i.e., using the USGV6 Capabilities Check List) and vendors must be required to document their product’s support of the requested capabilities through the USGv6 test program (reference http://www.antd.nist.gov/usgv6/) using the USGv6 Suppliers Declaration of Conformity.

The contractor must provide sufficient document demonstrating the software being provided meets the following:

The standard installation, operation, maintenance, update and/or patching of software shall not alter the configuration settings from the approved FDCC/ USGCB/other secure configuration.

Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

The contractor must provide all supporting documentation or a reference to obtain the necessary material which describes the security capabilities, the design and development processes and the testing and evaluation procedures used by the product or services being provided for this acquisition. The contractor must provide all supporting documentation or a reference to obtain the necessary material which describes all product or service updates and enhancements as they are implemented. The product or service supporting documentation could be the user and system administrator guides, which is documents the functional properties of the security controls employed to permit the analysis and testing of the security controls.

6. Technical Point of Contact:

Not available for the purpose of the Notice of Intent