SOW_26_June_Final.docx

Managerial Support Services – International Fisheries Program

NOAA/NATIONAL MARINE FISHERIES SERVICE (NMFS)

Pacific Islands Fisheries Science Center Computer Programmer IV

I. Statement of Work:

Under this purchase order, the Contractor shall provide professional, non-personal services to support the NOAA Fisheries International Fisheries Program and the Pacific Islands Fisheries Science Center’s Fisheries Research and Monitoring Division.

(1) Computer Programmer IV

II. Background:

The Pacific Islands Fisheries Science Center of the National Marine Fisheries Service (NMFS) is part of the National Oceanic and Atmospheric Administration (NOAA). The Center administers scientific research and monitoring programs that support domestic and international conservation and management of living marine resources.

The Pacific Islands Fisheries Science Center (PIFSC) is headquartered in Honolulu, Hawai‘i. The Center has taken a leading role in marine research on ecosystems, in the insular and pelagic environments. It is implementing a multidisciplinary research strategy including an ecosystem observation system, and scientific analysis to support ecosystem approaches to management and restoration of living marine resources. It conducts a wide range of activities including resource surveys and stock assessments, fishery monitoring, economic and sociological studies, oceanographic research and monitoring, critical habitat evaluation, life history and ecology studies, and advanced oceanographic and ecosystem modeling and simulations.

The Fisheries Research and Monitoring Division (FRMD) coordinates the Center's programs for fisheries monitoring, fisheries data management, fisheries interactions, fish life history studies, and stock assessment. The mission of the Division is to provide the scientific foundation to enable informed and effective implementation of ecosystem-based management and conservation strategies for U.S. fisheries throughout the Pacific Islands Region.

To accomplish this mission, the Division carries out extensive activities to monitor U.S. fisheries of the Pacific Islands and oceanic waters of the central and western Pacific, assess the status of exploited fish stocks, and provide scientific advice to fishery managers. These activities are guided by mandates and authorities derived primarily from the Magnuson-Stevens Fishery Conservation and Management Act and international agreements.

III. Description of work and services:

This is a fixed price non-personal services purchase order. Government personnel will be responsible for the overall scheduling of project activity and will provide the Contractor with scheduling information, as appropriate.

The PIFSC is working to streamline database management in the FRMD. The main objectives for this purchase order are: (1) develop automated import modules, associated Oracle data models, and Oracle Views for electronically submitted data and (2) maintain and update existing Oracle Application Express APEX projects and develop additional features upon request. The contractor will be granted access to various government systems including email. The contractor will be required to comply with all protocols, safeguards, and IT security requirements and hold confidential any sensitive or PII information.

IV. Minimum experience or background requirements of Contractor personnel:

● Bachelor’s Degree in Computer Science, Information Technology, or related field.

● 2-4 years of progressively responsible work experience in an Information Technology or related field.

Preferred Qualifications:

● Previous development experience with automated import modules in a language such as python or equivalent,

· Familiarity with Oracle data models and Oracle views.

● Experience administering Macintosh computers or other non-Windows systems.

V. Place of Performance and Government Furnished Property:

All work shall be performed at the contractor’s facility. Occasional meetings may be required at the NOAA, Daniel K. Inouye Regional Center for coordination with the technical point of contact. No government furnished equipment will be provided for use during this purchase order.

VI. Deliverables:

1. The contractor will develop automated import modules for electronically submitted data. They will provide technical maintenance of the modules and consultation for users.

2. The contractor will develop and maintain Oracle APEX applications to manage and report on South Pacific Tuna Treaty data streams.

3. Written monthly updates should accompany invoices.

VII. Schedule:

The Contractor is not authorized to perform work under this order on days where the Center is closed (holidays, inclement weather, government furloughs, power outages, etc.).

Overtime is not anticipated nor authorized for this purchase order.

VIII. Program Coordination:

The contractor shall provide overall management pertaining to all Contractor technical and contractual support, including state and local requirements, insurance and liability coverage for its employee. The Contractor shall be responsible for adherence to all federal, state, local, and site-specific safety regulations.

IX. Insurance:

The Government does not provide insurance to the Contractor and, under most circumstances, is not liable for injuries suffered by the Contractor during the performance of duties.

X. Confidentiality:

Work described herein may require that personnel have access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a, FAR 52.224-1, Privacy Act Notification, and FAR 52.224-2, Privacy Act. Contractor personnel are responsible for maintaining confidentiality of all subjects and materials. Contractors will safeguard and hold confidential all PII/sensitive information and shall seek instruction from the CO on requirement protocols as needed.

XI. Payments to the Contractor:

This is a firm fixed price purchase order. The vendor will only be paid for the hours incurred and as reflected on the monthly progress reports submitted by the Contractor. The Government will not pay the contractor for sick leave or vacation time. Sick leave and vacation time shall be reflected in the contractor’s overhead, if deemed necessary.

XII. Non-Personal Service Contract Statement:

Contractor employees performing services under this order will be controlled, directed and supervised at all times by the Contractor's Project Manager or personnel designated by the Contractor. Contractor employees will perform work independent of and without the supervision of any Government official. Actions of contractor employees may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated funds of the U.S. Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulation. The Government will perform the inspection and acceptance of the completed work.

Computer, network, and information security is of paramount concern for the Department of Commerce (DoC), NOAA, and NMFS. NMFS must ensure that hardware and software does not compromise the security of its NMFS OCIO infrastructure and/or contribute to the disclosure of sensitive, proprietary, or other non-public data. The vendor guarantees that any systems or software provided by the vendor is free of known vulnerabilities that are identified in the National Vulnerability Database (https://nvd.nist.gov). At a minimum, the vendor would be expected to provide evidence of the following security measures:

· Fully comply with all Federal Statutes, Executive Orders and Regulations; as well as DoC, NOAA, and NMFS policies.

· The vendor must ensure that all hardware that is acquired for use pursuant to this contract meets the requirements of Section 515 of the Consolidated Appropriations Act of 2014. The vendor will be fully responsible for any cost associated with component replacement resulting from violations of this provision.

· Maintain separate environments for production and non-production systems. Developers should not typically have unmonitored access to production environments.

· Test application software for coding errors and potential vulnerabilities prior to deployment using automated static code analysis software, as well as manual testing and inspection. In particular, input validation and output encoding routines of application software should be reviewed and tested.

· Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic flowing to the web application for common web application attacks, including but not limited to cross-site scripting, SQL injection, command injection, and directory traversal attacks. For applications that are not web-based, specific application firewalls should be deployed if such tools are available for the given application type. If the traffic is encrypted, the device should either sit behind the encryption or be capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web application firewall should be deployed.

· Test third-party-procured web applications for common security weaknesses using automated remote web application scanners prior to deployment, whenever updates are made to the application, and on a regular recurring basis. Include tests for application behavior under denial-of-service or resource exhaustion attacks.

· Do not display system error messages to end-users (output sanitization).

· Ensure that all software development, database, and system administrator personnel routinely receive training in current security best practices for their specific development environment and role.

· In addition to the web application vulnerability scanner, the evaluation team must also run static code analysis tools and database configuration review tools against Internet-accessible applications to identify security flaws prior to moving any changes into production. A quarterly scan will be required if no updates have been made.

· Unless approved by NMFS OCIO, any security flaws deemed to be moderate or greater must be remediated within 30 days of discovery.

· Unless approved by the NMFS OCIO, all browser accessible applications must be capable of full functionality with the latest browser releases and updates from Microsoft, Apple, Mozilla, and Google.

· All software provided by the vendor must be capable of operating on the latest vendor provided updates. This includes operating system and middleware (such as Java and Flash).

· Unless approved by NMFS OCIO, all licensing for operating systems, middleware, applications, data, or any other licensing required for the successful operation of the application or systems shall be with the Government as licensee.

· Unless waived by NMFS OCIO, throughout this contract and all support periods of the initial or subsequent contracts, the vendor will provide a security point of contact who meets DoC CITR-006 minimum requirements.

· Unless approved by the NMFS OCIO, all systems and applications must be fully functional in a VMware environment.

· Vendor must adhere to NMFS configuration management process and must maintain documentations on configuration management for operating system, middleware, applications, data or other components Protecting data dissemination:

While federal data can range from low sensitivity through multiple classified layers, OMB Memorandum M-06-16 (“Protection of Sensitive Agency Information”) directs that all government data is sensitive, “... unless the data is deemed to be non-sensitive, in writing, by your Deputy Secretary or an individual he/she may designate in writing.” While the data may ultimately be intended for publication, until it is published by the government, it is deemed to be sensitive and may not be disclosed without the written approval of the government.

The contractor agrees, in the performance of this contract, to keep the information furnished by the Government and designated by the Contracting Officer or Contracting Officer’s Technical Representative in the strictest confidence. The contractor also agree not to publish or otherwise divulge such information in whole or part, in any manner or form, nor to authorize or permit others to do so, taking such reasonable measures as are necessary to restrict access to such information while in the contractor’s possession, to those employees needing such information to perform the work provided herein, i.e., on a “need to know” basis. The contractor agrees to immediately notify the Contracting Officer in writing in the event that the contractor determines or has reason to suspect a breach of this requirement.

Secure Communications: The contractor must verify with the government prior to transmission of information that all information designated as sensitive will meet National Institute of Standards and Technology (NIST) Federal Information Processing FIPS 140-2 validated cryptographic module(s).

The contractor agrees that it will not disclose any information described in performance of this activity to any persons or individual unless prior written approval is obtained from the Contracting Officer. Whenever the contractor is uncertain with regard to the proper handling of information/data under the contract, the contractor shall obtain a written determination from the Contracting Officer. The Contractor agrees to insert the substance of this clause in any consultant agreement or subcontract hereunder.

Upon completion of the work, the contractor will certify in writing to the contracting officer that:

Except as approved in writing by the contracting officer, they have not disclosed and any data or media collected, developed, and/or correlated in the performance of this acquisition.

They have not retained any data or media collected, developed, and/or correlated in the performance of this acquisition.

All instances of data or media in the possession or under the control of the contractor has been destroyed using one of the methods for secure destruction of unclassified but sensitive information recommended by the National Security Agency in the Media Destruction Guidance available online at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml.

Information Technology Standards for Applications General Policies Review

1. NMFS OCIO must approve all software and hardware.

2. Vendors are not authorized to install software or hardware under any circumstances without the approval of NMFS OCIO.

3. No hardware, applications, or software may be put into a production environment until all applicable NIST 800-53 controls are documented and tested.

Software

1. All applications and software must be capable of operating in both 32-bit or 64-bit configurations.

2. All applications must be multi-threaded.

3. Unless approved by NMFS OCIO, all software and applications must be capable of full operations employing the NMFS approved standard security baselines without additional deviations.

a. Administrator rights needed for installation only.

b. All actions performed under Administrator account must be logged and auditable.

c. Ability to remove all default accounts and passwords.

d. All new software must be capable of running on the most current Operating Systems and configurations approved by the NMFS OCIO. In addition to ensuring that the software is fully functional with all Operating System, and middleware patches and service packs applied, vendor would be expected to support the migration of software through one Operating System full version upgrade.

e. Without the approval of the NMFS OCIO, dongles (hardware keys) are not approved for usage within the environment. Vendors need to supply a soft key that does not adversely impact the handling of the equipment.

f. All internet connections must be approved by the NMFS OCIO.

g. Without the approval of the NMFS OCIO, hard-coded IP addresses are not allowed. The application should depend on DNS name resolution and have provision for using FQN (fully qualified names).

h. Auto-download and installation of components and/or updates is prohibited.

4. Applications or systems requiring data connection must be meet the requirements specified by the respective data owners, information system security officers, system owners, and authorizing officials, and the NMFS OCIO. All connections must be accurately documented. All changes will require updated documentation and approvals.

5. Unless otherwise approved by the NMFS OCIO, all applications requiring authentication must, be capable of granting access via the NMFS Active Directory.

6. Unless specifically approved for use by the NMFS OCIO, test and evaluation software may not be installed on production systems.

7. All data connections must be approved by NMFS OCIO.

8. All hardware, including and not limited to servers, computer workstations, networking equipment, wireless access points, keyboards, mice, etc; that will connect to DoC NOAA NMFS network must be approved by the NMFS OCIO.

9. No DoC NOAA NMFS data will be downloaded, exported, or copied without the approval of NMFS OCIO.

10. Without the approval of NMFS IT Security Program Manager or their delegee, the use of production data for testing is prohibited.

11. Active Directory security will be utilized for all applications. Exception must be approved by NMFS OCIO.

12. If applications and/or data is not included in an existing NMFS backup strategy, a clearly documented strategy for automated/unattended daily backups and a restore strategy should be provided by the vendor. This will include a quarterly demonstration that randomly selected data can be recovered.

Database Technology

1. Without the approval of NMFS OCIO, all data must be stored within existing NMFS database instances. Current NMFS databases are Oracle Database 12 and Microsoft Windows SQL 12.

2. All database services must run as a domain service account supplied by NMFS OCIO.

3. Unless approved by NMFS OCIO, file system based data stores that do not use a Server/Engine for database connectivity are prohibited.

4. All transactions should be completed within the application or by a NMFS OCIO approved data connection. Users should not need to download data to perform routine transactions.

5. Data elements identified by NMFS as being sensitive must be capable of being encrypted without impact to system or application performance.

6. Data elements that are deemed as sensitive and transactional, must have the capability of being purged from the application at the conclusion of the transaction.

7. All transactions within the database must be logged and be auditable. Vendor must support log transmittals to the NMFS approved event correlation solution

8. Transaction errors must have the capability of being corrected via front end process, employing NMFS OCIO approved segregation of duties, and not require direct database access.

If data is to be stored within an Oracle database or equivalent, the following standards must be met:

1. Unless otherwise approved by the NMFS CIO, all applications that access the database must be located at DoC NOAA NMFS.

2. It is understood the DoC NOAA NMFS DBA Team installs Oracle Server using the typical installation with typical sort order and character set.

3. During installation a temporary System Administrator user id will be created for application installation. This will allow all objects to be created with the owner ‘dbo’.

4. Applications are not allowed use of the SA login nor are they allowed the use of the “System Administrator” server role after installation.

5. Database ownership must be ‘sa’ and no user is allowed to be in the ‘db_owner’ role. All attempts will be made to remove dbo from the application.

6. Databases must be in “Full” or “Bulk-logged” recovery mode to ensure point-in-time recovery.

7. All database objects must be owned by ‘dbo’.

8. Applications must have ability to reside on a separate server from the database.

9. Applications must have an acceptable Purge Plan documented in writing.

10. No application will use Oracle Authentication except if application is connecting using an application user ID for all DSNs from all computers or web server. This exception must be documented in writing and be approved by the DoC NOAA NMFS DBA.

11. All applications must agree to have a new version upgrade 12 months after a major version release and 6 months after a Service Pack.

12. All changes to the database schema must go through the DBA in the form of scripts or be part of an upgrade process. No ad hoc schema changes.

13. All application team must provide the DBA a schema view of the database with indexes for review; this should be documented in writing.

Special Security Requirements

· All applications involving law enforcement case data must be Criminal Justice Information Services (CJIS) compliant.

· All applications and systems that are fee based and involve the use of credit cards must, at all times during the base period of the contract and all support periods of the initial or subsequent contracts must meet Payment Card Industry (PCI) Standards.

· All systems, applications, and/or software that involved with collecting Taxpayer Identification Numbers (Social Security Numbers, Employer Identification Numbers, etc.) must be reviewed and approved by the NMFS IT Security Program Office.

· Requirements for firewall access must be reviewed and approved by NMFS OCIO. Upon approval, required accounts must be created and setup.

· Requirements for VPN access must be reviewed and approved by NMFS OCIO.

· Requirements for Internet access must be reviewed and approved by NMFS OCIO.