(U) Attachment A_Objectives_For_Portico_Requirement (PWS draft).docx

UNCLASSIFIED

SOURCE SELECTION SENSITIVE

National Geospatial-Intelligence Agency (NGA)

Objectives For Portico

Version 1

February 2024

TABLE OF CONTENTS

Change Log

General Introduction The mission of the National Geospatial-Intelligence Agency (NGA) is to provide world-class geospatial-intelligence (GEOINT) and lead the Global GEOINT Enterprise. The Globe is NGA’s virtual front door for mission users and the primary web presence for the discovery of GEOINT for the intelligence community (IC) and the Department of Defense (DoD).

Background NGA is a DoD combat support agency providing timely, relevant, and accurate GEOINT to the national decision-making process and the IC, DoD, and civilian partners supporting National Security Objectives.

The Globe is NGA’s online connection to geospatial knowledge serving as the front door for NGA customers since 2008. Portico is the follow-on contract to the Agile Web Presence (AWP) II contract number HM047620F0193 The Globe provides a modern, clean, and secure interface for discovering and presenting GEOINT in an engaging online environment. The Globe aggregates web-based access, presentation, search, and discovery of geospatial information available at NGA. The Globe is a peer capability to other agencies’ home pages such as CIA Wire, DIA Source, and NSA Pulse.

The core capabilities under Portico include The Globe, the web-based front door to NGA; mGlobe, the front door for Denied, Disrupted, Intermittent, and Limited bandwidth (DDIL) environments; CapNet, the front door for the U.S. Congress; Discovery Catalog, the database for content holdings; and Product Dissemination Services (PDS). The Globe capabilities act as a presentation layer to display NGA points of contact (POC), the latest GEOINT information, and GEOINT tools from other NGA programs of record.

NGA provides Globe services on multiple cloud-hosted security domains; Non-classified Internet Protocol Router Network (NIPR), Secret Internet Protocol Router Network (SIPR), Joint Worldwide Intelligence Communication System (JWICS), and StoneGhost. The IC, DoD, civilian, and others responsible for executing mission-related activities, responding to natural disasters, and supporting international security events and other national security issues have access to these resources.

Over the course of this contract it is expected that the Globe will establish a consistent user experience for enterprise discovery services by deploying resilient Globe instantiations on distributed GEOINT content stores for regional and theater nodes capable of supporting GEOINT operations in a DDIL environment. By integrating with distributed GEOINT Search and Retrieval (GSR) services, the Globe will empower users to easily and rapidly discover local GEOINT data, products and services supporting regional and theater operations. This Globe capability will minimize training efforts by establishing a standard interface for discovery services while ensuring GEOINT consumers maintain the ability to rapidly access NGA products and services independent of location and reduce product dissemination timelines for critical GEOINT retrieval.

Objective The purpose of the contract is to obtain the required expertise to maintain user-facing services providing access to GEOINT data and products and software in an on-line, on-demand, and geospatially relevant environment to the IC, DoD, other Federal Government Agencies across the National System for Geospatial Intelligence (NSG), the Allied System for Geospatial Intelligence (ASG), and other IC partners. This contract is designed to provide flexibility in satisfying existing and emerging Information Technology (IT) requirements required to work within the NGA IT infrastructure, complement and support other NGA efforts, and adapt to new and emerging requirements as missions evolve and leading-edge technologies become available. The contract should also facilitate the Government Program Management Office’s (GPMO) goals to ensure that the look and feel of the Globe is current, the content is curated with appropriate stakeholders, and end users have the best possible experience when searching for GEOINT information for their mission needs.

The anticipated contractual vehicle for the NGA’s requirement prescribed through the Performance Work Statement (PWS) draft is TBD. The anticipated Period of Performance (PoP) is TBD. Services and support provided for all capabilities and mission spaces should align with the following:

a) NGA Strategy 2025 (e.g. goals and core values (Ref: current version 1.1));

b) NGA Technology Strategy (May 2020) (e.g. vision and principles);

c) NGA Software Way;

d) Use of DevSecOps and the NGA Endor External Cloud development environment;

e) Alignment of Globe code to evolve into a more modular structure and incorporate micro-services and test-driven development;

f) Current and emerging Government organization architectures; and,

g) Open IT initiatives to achieve Government-wide (i.e., across the IC, DoD, Federal, State, first responders and local Government organizations) optimization and efficiencies gained through integration and alignment with cloud architecture.

Type of Contract Contemplated If awarded, a hybrid indefinite delivery/indefinite quantity (IDIQ) consisting of: a twelve (12) month base and four (4) twelve (12) month Option Years (OY) is projected. Potential Contract Type(s): FFP, LH/TM, CR, CPFF, Cost (no fee).

Scope Scope The contractor will ensure the following Globe scope is supported in the following categories:

a) Program Management: Activities required to ensure total program integration and support during all phases and across contract task orders.

b) Operations and Sustainment: Activities and services to run operational hardware, software and daily operational capabilities securely, efficiently and effectively.

c) Software Maintenance: Services to engineer, integrate, test, and provide software maintenance (Corrective, Adaptive, Preventative, and Perfective) to the current software baseline

d) Systems Engineering: Services required to establish, balance, and integrate stakeholder requirements, develop appropriate lifecycle models and process approaches, and analyze alternatives in a manner that optimizes the delivery of capabilities (e.g., optimize performance, reduce infrastructure cost, etc.) while managing risk and cost.

e) User Engagement: Activities supporting customer outreach in the form of briefings, demonstrations, obtaining customer feedback for prototypes and User Interface (UI) enhancements. Customer engagement may include online tutorials specifically for Globe interfaces and workflows.

f) Content Management: Services required to maintain, create, design, sustain, modify, and improve the crisis pages and specialty pages on The Globe. These activities typically require immediate attention with a short-term completion window.

Program Management The GPMO requires a single Point of Contact (POC) at the Program Manager level to communicate Globe activities and status. The Program Manger (PM) must manage and administer the programmatic and technical efforts associated with contract to include contract administration, cost, schedule, performance, security administration, configuration control, and property control. This person is responsible for the monthly Program Management Review (PMR) (CDRL A003) tailored to accommodate agile program processes and dynamics and may change at Government direction. The PM is responsible to ensure full and adequate participation in technical reviews, weekly status reviews and other management meetings by appropriate staff as required and defined by the GPMO and ensure technical participation for delivery of continual service improvement (CSI) and Business Process Reengineering efforts to improve customer experience, system performance, and deployment cycle time. Further the PM oversees production of an annual comprehensive holistic assessment of Globe architecture and UI. The main purpose of this is to provide a technical baseline assessment of system efficiency and opportunities for cost reduction (CDRL A014).

Operations and Sustainment The GMPO requires operational support and Tier I – III helpdesk support, or a similar elevated priority support implementation. All Globe operations must adhere to agreements with NGA enterprise service providers to ensure proper integration and operation of Globe systems. The Globe’s users are worldwide and operate 24X7. Operations support needs to take this into account to ensure high availability and rapid customer response time. It is anticipated that there will be times when standard system coverage (coverage 0600-1800 ET Monday – Friday (excluding observed federal holidays), with on-call support after those times) will need additional surge support. Such surge coverage may need to expand to 24X7 Monday – Sunday and include Federal holidays.

Other operations activities include but are not limited to detection, notification and remedy of system issues, outages or degradations; creation and maintenance of an Operational Status Dashboard (CDRL A006); performing system administration services on all domains to meet performance objectives.

Tier I, Tier II, and III support is required that coordinates with NGA’s Enterprise Management (EM) Service Now system and the NGA Enterprise requirement policy for monitoring. It is not expected that Globe help desk support duplicate NGA Enterprise Service Center (ESC) services at any tier.

Examples of help desk support include but are not limited to monitoring and responding to email, Rocket Chat and NGA Service Management Solutions (e.g. Service+); leveraging EM and Globe monitoring to support response efforts covering all aspects of sustainment and operations; ensuring availability of Globe services to users in support of designated functions and at required performance levels; providing code and database configurations to meet reliability, availability, and functionality requirements; and participating in NGA operational forums as designated and required by the GPMO; and resolving incidents, defects, and other issues.

Software Maintenance Software maintenance ensures the Globe meets mission critical performance criteria, buys down technical debt and ensures secure user experience. Because of the mission critical status, the contractor must be positioned to deliver short notice (no more than 6 weeks after tasking) software/website changes to include modified and/or new source code in order to meet Government requirements. The contractor will inherit more than 1.4M Equivalent Lines of Code spanning multiple operational capabilities Software maintenance includes but is not limited to software development, release planning and scrum management, configuration management, test and evaluation, software integration, and system security assurance.

Development at all levels should include development templates, leverage the NGA Common Operations Release Environment (CORE) and associated best practices to include automated testing and optimized and Continuous Integration / Continuous Delivery (CI/CD) pipeline with zero downtime and rapid code deployment. The contractor must deliver capabilities using NGA's enterprise-managed DevSecOps environment and where appropriate using Government approved techniques or methodologies on all domains. The contractor must also follow The NGA Software Way to deliver software products designed and built with users, are able to be automatically updated in production, and use product-specific metrics to make decisions.

For configuration management the Globe GPMO requires the software code be developed, tested, integrated, deployed and documented. To achieve that a software library in the Government-controlled system is needed. The library must include, at minimum, gold copy source code, Commercial of the Shelf (COTS) license information, installation packages, and software changes and configurations required for integration and deployment of baselines (CDRL A008). Accordingly, the GMPO needs all version changes documented in the Version Description Document (VDD) (CDRL A009).

Elements of software maintenance and integration include, but may not be limited to: identification of required maintenance actions; incorporation of user interface changes as a result of collaboration between the Product Manager, Product Owner, User Subject Matter Experts (SMEs), UX/UI Design Experts, System Architect, Security, System Engineers, and other SMEs resulting in a consistent look and feel across all security domains. For the purpose of defining maintenance and integration actions the following definitions apply:

· Corrective Maintenance: to identify, isolate and/or rectify a fault or problem to restore and/or correct the application, system, or data

· Preventive Maintenance, use system and application changes and updates to prevent service degradation, operating system optimization, monitor servers for vulnerabilities, manage disk storage, manage certificates, and Business Continuity and Disaster Recovery

· Adaptive Maintenance, adapt system variations to address changing operational environments; changes to infrastructure, middleware, software dependencies, technology refreshment, content, interfaces supporting software, application re-hosting

· Perfective Maintenance, modify to optimize operations and performance based on data driven analysis, comply with relevant policy and directives, (e.g., operating system and support software updates, security patches), manage cloud resources for optimal performance, optimize the user interface, optimize the front-end administrative features

· Features and Enhancements, software development enhancements to add features and/or functionality to the existing baseline For release planning the NGA enterprise recommends Scaled Agile Framework (SAFe) processes. The GPMO therefore requests at a modified SAFe process for release planning that accounts for coordination with, and with participation by, the GPMO on a mutually agreed schedule and documented in the release plan (CDRL A007). This includes managing and maintaining new requirements in a backlog tool (current NGA system is JIRA) with the ability to capture GPMO prioritization and which is accessible by the Government at all times.

The Globe requires the standard software test activities of unit, system, end to end, and regression testing along with test and evaluation coordination with the NGA Test Organization (NTO). As part of NTO testing the Globe is required to perform requirements testing to measure adequacy, functionality, security, performance, interoperability, and stability using the Assisted Service Testing (AST) process within the NGA Test Organization for prior to moving code to Operations. The goal of the GPMO is to automate testing as much as practical.

Software integration includes the piecing together of components resulting in the creation of complex GEOINT information systems. This process may include designing or building a customized architecture or application, integrating it with new or existing hardware, packaged and custom software, and communication to provide new or enhanced operational capabilities, data consumption, and provisioning. Key components of integration include, but are not limited to, content sources (i.e., data) and changing content source configurations; understanding and working within the constraints of interfaces and data structures associated with new and emerging capabilities; and leveraging Infrastructure Service Provider (ISP) and IC Common Services (e.g., Geospatial Intelligence Access and Information Sharing (GEOAxIS), IC Desktop Environment, CORE, C2S, etc.).

System security on the Globe is of utmost importance to NGA. System security establishes and maintains security assessment and authorization (A&A) (including continuous monitoring). Activities result in secure systems and baselines along with the creation of the associated required security body of evidence (BoE) artifacts needed to meet the A&A milestone.

The Government’s Information Security Officer(s) (ISO) must be aware of and concur with the actions taken by the contractor team to secure and maintain system security and accreditation and the associated documentation. To facilitate this the GPMO requires an Information Systems Security Officer (ISSO) to monitor the system and application security, accreditation and audit activities for the Globe. System security activities include but are not limited to prevent malfunctions and seeks opportunities for system optimization; provide services for internal or external audit requests, provide risk assessments to systems and applications to determine if suitable for deployment into operations; and provide and maintain a System Security Plan (CDRL A013).

Systems Engineering (SE) Systems Engineering considers technical and business (programmatic) requirements associated with recommended courses of action. The objective of SE is the management of risk through analyzing system challenges and identifying solutions, and providing impact assessments to include technical and cost implications for changes to hardware or software (e.g., backlogged items, new capabilities and/or functionality, OS migrations, cloud cost estimations, resource planning, etc.).

Systems Engineering requirements include the delivery of engineering assessments for current and future requirements and strategic roadmap functions. It also includes providing responses as requested to support NGA’s RFC process, assessing alternatives, and providing estimates of work required to improve existing and/or provide new capabilities, services, and functionality.

Systems Engineering includes the creation of and/or updating of system documentation, such as system architecture diagrams illustrating key system components, deployment instructions, and System Requirements Documents (SRD). Creation and updates to documents must be in line with the NGA Enterprise Systems Engineering Plan, NSG/ASG Enterprise TEMP, and NGA Configuration Management Plan (NCMP).

Systems Engineering supports the Globe GPMO with compliance to the NGA GEOINT Enterprise Architecture reporting requirements, Transport and Cybersecurity Services (TSC) requirement traceability and the creation and update of the Architecture Document Library.

The Globe GPMO wants to ensure that all system or UI enhancement be based on metrics, data analytics and user feedback. For this reason, it is critical that the Globe have robust system and user metrics enabled at every level of the system. It is expected that System Engineering will facilitate metric collection at all levels of Globe planning and execution.

User Engagement User engagement and feedback drives design, engineering, and implementation of accessible, efficient, relevant, and pleasant experiences for Globe users. User engagement focuses on the point(s) of interaction between users and digital capabilities in order to provide the most useful experience. User engagement is a critical element of user centric feature design. It includes customer outreach in the form of briefings and demonstrations but is more focused on working with the Product Manager to obtain customer feedback for prototypes and User Interface (UI) enhancements. User engagement does not include classroom training, virtually or in person. Although, it may include pre-recorded online tutorials specifically for The Globe. User Engagement services may also include monitoring request tickets for help with and understanding of how users interact with the Globe. User engagement includes evaluating, analyzing, innovating, and optimizing how users feel about (i.e., how easy it is for them to use or interact with) the Globe services and capabilities. The Government expects the User Engagement effort to work closely with the Globe PMO (Product Manager and Frontend Team Lead) to coordinate on vision, target user groups and overall priorities.

Frontend Support & Content Management Frontend support and content management includes the maintenance creation, design, sustainment, modification, and improvement of crisis (e.g., Russia-Ukraine Crisis) and specialty (e.g., Natural Disasters) pages on The Globe. This team works closely with the GPMO Front End Team Lead to provide rapid and accurate content and UI changes to ensure NGA users quickly find GEOINT needed for mission fulfilment. Frontend support includes coordination with finished intelligence producers from other NGA organizations, managing the Discovery Catalog content, new content requests, and upholding the GPMO Governance process.

Frontend support must have the ability to respond rapidly to crisis requests.

Coordination As the front door to NGA, it is essential that the team coordinates closely with many entities across NGA and the IC. With the Globe tightly coupled with GSR, this relationship and API development will need to continue as will coordination with other API providers at NGA (e.g., Map of the World and Consolidated Products Database). Therefore, maintaining a good working relationship with both Government and vendor POC’s in these organizations. Execution of IT at NGA also requires close coordination with NGA Enterprise offices for the daily execution of the system and to ensure enterprise tool changes are understood and planned. For ensuring data on the Globe is accurate and current it is critical to coordinate with key systems and offices providing content to the Globe. For support of Congress Globe has a unique role and it is essential to coordinate with NGAs Office of Corporate Communications Congressional support (OCCL).

Constraints The contractor will have access to unclassified and classified development environments. The contractor must conduct development using NGA CORE Enterprise provisioned platforms, cloud instances, and NGA CORE-associated enterprise development tools such as JIRA, GitHub/GitLab, etc., to the maximum extent possible.

The contractor must use NGA’s enterprise-managed version control (e.g., GitLab) on each of the available security domains as the version control mechanism for all software. This includes executable code and source code for all modified and newly sustained software. All infrastructure setup must be stored in the source code version control. New servers must have an automated stand-up.

The contractor must automatically build, test, and deploy all services, applications, software code, and metadata using NGA’s enterprise, CI/CD pipeline tools:

The contractor must document, register, share, and maintain all Application Programing Interfaces (APIs), associated data, and documentation in NGA’s enterprise-managed Developer Portal on all domains where the APIs exist. The contractor must document APIs in industry-standard API-specification formats (e.g., OpenAPI, RESTful API Modeling System (RAML)), rather than Portable Document Formats (PDFs) or Word documents. These documents must be accessible via self-service in a development environment with a standardized path to production. The API documentation must be readily available to all developers at NGA. All APIs must follow GEOINT standards and be ready for automatic testing for standards compliance.

The contractor must use the CORE or NGA Enterprise metric collection tools.

1.

1.1.

Development for Emerging Requirements The Government envisions the need for software development to address emerging requirements but cannot provide specifics at this time. Therefore, the Government advises the contractor that emerging requirements may result in the need for short notice development services using an agile methodology. Tasks include, but are not limited to, changes to the baseline code, implementation of new technologies, development of prototypes and the development of new functionality.

The contractor must provide interdisciplinary scrum teams with the technical expertise to execute the emerging requirements. Activities include researching new tools and emerging technologies; analyzing implementation strategies; assessing the applicability of new technologies, assisting with the planning prototyping and implementation of such emerging requirements.

It is expected that development for emerging requirements will use an interdisciplinary approach to develop, design, allocate, and manage the work to achieve desired systems outcomes. Additionally, systems and software design must consider and evaluate design tradeoffs and balance technical risk between systems and software, taking full advantage and leveraging NGA ISP/ASP processes and capabilities consistent with SEP and NCMP for the NSG and ASG.

Contractor must provide a single process for both software maintenance and emerging requirements. The same elements of testing, integration, release management, and configuration management apply to emerging requirements.

1.2.

Contract Data Requirement List (CDRL) The following table lists the deliverables for this PWS (draft). The formats of the deliverables listed as contractor defined are subject to Government approval.

Rejected deliverables must be modified and resubmitted for acceptance.

The contractor will submit deliverables to the GPM and COR in formats compatible with Adobe or Microsoft Office products. Softcopy delivery (via e-mail, etc.) is the preferred method of exchange for electronic copies.

All deliverables defined in this PWS will become Government property and may be used and reproduced without restriction, except as otherwise provided in DFARS 252.227-7013 and 252.227-7014.

Format: Contractor defined, Government approved

Contractor Defined, Government Approved

Format: Contractor Defined, Government Approved

NGA ISCP Template Government Approved

Contractor Defined, Government Approved

Contractor Defined, Government Approved

2.2.7

Contractor Defined, Government Approved

Contractor Defined, Government Approved

Contractor Defined, Government Approved

Contractor Defined, Government Approved

Contractor Defined, Government Approved

Contractor Defined, Government Approved

“how to” guides,

Contractor Defined, Government Approved

Appendix A - Acronyms

Appendix B - Applicable Documents Table 2.1. Compliance Documents

· NGAI 8955.6, NGA Web Properties Standards and Guidelines, Administrative Update 1, 13 May 2020

· NGAI 8040.1, Information Technology Configuration Management, dated 13 November 2023

· NGAM 4160.1, Accountability and Management of Property, Plant Equipment, and other Accountable Property, dated 16 May 2017

· NGAI 8000.1, Information Resource Management, Administrative Update 1, 16 February 2023

· NIST SP 800-137, Information System Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, dated 15 October 2019

· NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems, dated August 2011

· DoDD 8000.01, Management of Department of Defense Information Enterprise (DoD IE), 17 March 2016

· ICD 503, Intelligence Community Information Technology Systems Security Risk, dated 21 July 2015

· CoNGA SCGv.3.1.0, Consolidated NGA (CoNGA) Security Classification Guide (SCG)

· Public Law 93-979, Privacy Act of 1974

· Current Globe Concept of Operations

· The Globe Solution Architecture Narrative

· NGA Portfolio/Program and Team Level Agile Process

· NSG Enterprise Test and Evaluation Master Plan (TEMP)

· NGA Software Acquisition Management (SAM) Whitelist

Reference Documents

· National Geospatial-Intelligence Agency (NGA) Enterprise Services for Cloud, Enterprise Services Catalog (ESC-002) General Descriptions by Selections, dated 09 July

· National Security Memorandum-8, Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems, (19 January 2022)

· Intelligence Community Directorate for Information Technology Systems Security Risk Management, Assessment and Authorization (A&A) (ICD 503)

· NGA, Director, Cybersecurity Office MFR, Upgrading Vulnerable Software (24 January 2024)

· NGA Configuration Management Plan (REV F, 22 April 2022)

· NGA ICD 503 Risk Management Framework Implementation Guide (most current version)

· DODI 8531.01 Vulnerability Management (15 September 2020)

· NGAI 8550.1 Health and Performance Monitoring of Information Systems and Applications (Administrative Update 2, 22 February 2022)

· NGA Systems Engineering Plan (REV B, 23 September 2021)

· NSG/ASG Enterprise Test and Evaluation Master Plan- (REV E, 29 September 2021)

· NGAI 8010.4 Information Security Continuous Monitoring (12 September 2023)

· NGAI 8410.2 Software Asset Management (14 September 2023)

· NGA’s Annex I: Cloud Security Guidance

· NGAI 3020.26 Continuity of Operations Program (Administrative Update 1, 15 March 2023)

· NSGD 3201 GEOINT Functional Manager Standards Assessment (GFMSA) Program (1 June 2015)

· NSGM 3202 GEOINT Functional Manager Standards Assessment (GFMSA) Program (9 June 2016)

· NIST 800-34 Contingency Planning Guide for Federal and Information Systems

· DODI 8580.01 Information Assurance (IA) in the Defense Acquisition System (9 July 2004)

SOURCE SELECTION SENSITIVE

image1.png