Attachment J-1 OMS IDIQ PWS.pdf

Attachment J-1

Operations, Maintenance, and Sustainment (OMS)

Indefinite-Delivery Indefinite-Quantity (IDIQ)

Draft Performance Work Statement (PWS)

November 22, 2019

National Environmental Satellite, Data, and Information Service (NESDIS)

Office of Satellite and Product Operations (OSPO) and

Office of Satellite Ground Services (OSGS)

DRAFT

DRAFT OPERATIONS, MAINTENANCE, AND SUSTAINMENT IDIQ

PERFORMANCE WORK STATEMENT

Table of Contents

1. Scope 5

1.1 Introduction 5

1.2 Place of Performance 8

1.3 Government Furnished Equipment and Information 9

1.3.1 Government Furnished Equipment (GFE) and Supplies 9

1.3.2 Government Furnished Information (GFI) 9

1.4 Definitions 10

1.4.1 Program Management 10

1.4.2 Development 11

1.4.3 Operations 11

1.4.4 Maintenance (Tier 1 and 2) 11

1.4.5 Extended Maintenance (Tier 3a) 13

1.4.6 Sustainment (Tier 3b) 13

1.4.7 Integration and Test 13

1.4.8 Cloud Computing 14

2. References 14

3. Requirements 15

3.1 Program Management 16

3.1.1 Deliverables 16

3.1.2 Reports 17

3.1.3 Contract Transition 17

3.2 Operations 17

3.3 Maintenance 18

3.3.1 Maintenance Activities 18

3.3.2 Network & Systems Administration 18

3.3.3 Capacity Planning 19

3.3.4 Telecommunications Support 19

3.3.5 Preventative and Corrective Maintenance 19

3.3.6 Installation, De-installation and Relocation 20

3.3.7 Web Development Support 20

3.3.8 Antenna Maintenance Support 20

3.3.9 Cloud Services 20

3.4. Sustainment 21

3.4.1. Obsolescence Prevention and Remediation 21

3.4.2. Sustainment Support 21

3.4.3 Sustainment Test and Integration 22

3.4.4 User Access Sustainment 23

3.5. Information Cyber Security & Support 23

3.5.1 Information Cyber Security 23

3.5.1.1 Security Continuous Monitoring and Situational Awareness 24

3.5.1.1.1 Incident Response 24

3.5.1.1.2 System and Network Monitoring 24

3.5.1.1.3 Audit and Logging 24

3.5.1.1.4 Vulnerability Assessment 24

3.5.1.2 Contingency Planning 25

3.5.1.3 Flaw Remediation 25

3.5.1.4 Malicious Code Protection 26

3.5.2 Cyber Security Program Management Support 26

3.5.2.1 Cyber Security Awareness & Training 26

3.5.2.2 Cyber Security Assessment & Authorization 26

3.5.2.2.1 Continuous Monitoring and Assessment & Authorization (A&A) 26

3.5.2.2.2 Plans of Action & Milestones (POA&M) Management 27

3.5.2.2.3 System Interconnection 27

3.5.2.2.4 System Security Documentation 27

3.5.2.3 Security Support for Systems Engineering and Change & Configuration

Management 27

Appendix A. NESDIS System Boundary General Correspondence to NESDIS Missions/

Functions (FY18 Data - Will be updated in final solicitation) 29

Appendix B. OMS Information & Cyber Security Support Task Accountability Matrix 39

Appendix C. Acronym Listing 44

1. Scope

1.1 Introduction

The National Oceanic and Atmospheric Administration’s (NOAA) National Environmental

Satellite, Data, and Information Service (NESDIS) provides satellite products, services, environmental information, and official assessments of the environment in support of societal and economic decisions. NESDIS satellite ground systems are the infrastructure for generating and distributing these satellite products and services. NESDIS satellite ground systems are entering a new era with the launch of the next-generation geostationary and polar-orbiting satellites. Both the Geostationary Operational Environmental Satellite “R” Series (GOES-R)

Program and Joint Polar-orbiting Operational Satellite System (JPSS) Program include new ground systems for NESDIS.

This Performance Work Statement (PWS) describes services to operate, maintain, sustain, and dispose of existing NESDIS legacy satellite ground systems until these new ground systems and their associated observatory constellations fully transition to operations. Key activities involve migration of existing business functions to an enterprise ground architecture and using shared services as they become available for satellite operations.

Within NESDIS, the Office of Satellite and Product Operations (OSPO) and the Office of

Satellite Ground Services (OSGS) require operations, maintenance, sustainment and disposal support of its legacy ground systems and related support for its data products. OSPO operates and maintains and OSGS sustains the ground systems covered under this contract. NESDIS intends to support these legacy ground systems through preventative maintenance, sparing, and failed component replacement (corrective maintenance) while actively managing performance risk and cost risk as the legacy systems are decommissioned.

The broad scope of this work includes support for:

● Operations, maintenance, and sustainment of NESDIS-deployed hardware, firmware, and software ground systems

● Satellite-to-Ground communications, including radio frequency (RF) and terrestrial communications networks, telemetry over Internet Protocol (IP), and RF antenna systems

● Systems that support mission scheduling, ground system software/subsystem functions, and satellite command and control

● Secure data ingest from both NOAA-operated satellite missions and external sources;

● Data Collection System (DCS) satellite services

● Product generation, storage, monitoring, and distribution systems supporting new and improved satellite products, services, and algorithms

● Provision of information to the National Centers for Environmental Information (NCEI) for archive and stewardship

● Program execution and delivery of services using National Institute of Standards and

Technology (NIST) and other security control guidelines

● Technical Baseline evolution, both hardware and software that changes components or adopts new technology

● Cloud computing utilizing government approved cloud services for Satellite Data processing and distribution

Table 1.1-1 illustrates the ground systems that OSPO currently supports. The specific assigned systems will be defined at the task order level. Individual system inventories, drawings, descriptions and interfaces are available in the OMS document library. Additional satellite ground control systems and products may be added as a part of the scope of this Contract.

Table 1.1-1 Currently Operated, Maintained, and/or Sustained OSPO Supported

Systems

System Boundary Full Name

GOES Ground System

(NOAA5003)

Legacy Geostationary Operational Environmental

Satellites

PAAN Antenna/Networking

(NOAA5047)

Partner Antenna Access Network

DSCOVR Antenna/Networking

(Included within NOAA5003) Deep Space Climate Observatory (Subsystem of GOES)

DCS

(NOAA5004)

Data Collection System

ESPC

(NOAA5045)

Environmental Satellite Processing Center

NJGS

(NOAA5046)

NOAA Jason Ground System

POES Ground System

(NOAA5026)

Legacy Polar-orbiting Operational Environmental Satellite

MSL

(NOAA5044)

Mission Support Local Area Network (LAN)

SARSAT

(NOAA5023)

Search and Rescue Satellite-Aided Tracking System

CLASS

(NOAA5040)

Comprehensive Large Array-data Stewardship System

GOES R

(NOAA5050)

Geostationary Operational Environmental Satellites R

Series

JPSS

(NOAA5042)

Joint Polar Satellite System

DMSP Defense Meteorological Satellite Program

Table 1.1-2 shows administrative Local Area Network (LAN) system interfaces for the systems contained in Table 1.1-1. All other aspects of these networks (except the interfaces) are operated, maintained, and sustained in a separate, external contract.

Table 1.1-2. Networks Interfaces to Ground Systems in Table 1.1-1

NOAA Environmental Satellite, Data and Information Service (NESDIS) Local Area Network

(LAN), Silver Spring MD

National Climate Data Center (NCDC) LAN, Asheville, NC

National Ocean Data Center (NODC) LAN, Silver Spring, MD

National Geophysical Data Center (NGDC) LAN, Boulder, CO

Center for Satellite Applications and Research (STAR) LAN, College Park, MD

1.2 Place of Performance

Figure C.1.1-1 illustrates the NESDIS Ground Enterprise (NGE). Work locations for this contract include, but are not limited to:

● NOAA Satellite Operations Facility (NSOF) located in Suitland, MD

● OSGS Program Offices located in Greenbelt, MD and Silver Spring, MD

● NOAA Center for Weather and Climate Prediction (NCWCP) located in College Park, MD

● NASA’s Goddard Space Flight Center located in Greenbelt, MD

● NESDIS Command and Data Acquisition (CDA) Stations located in Wallops, VA:

Fairbanks, AK; and Utqiagvik, AK

● NESDIS NCEI located in Asheville, NC; Boulder, CO; and Silver Spring, MD

● NESDIS Consolidated Back-up Unit (CBU) located in Fairmont, WV

● USAF Environmental Satellite Operations Center (ESOC) located at Schriever Air Force

Base, Colorado Springs, CO

● Remote Ground System (RGS) locations as required

Figure C1.1-1. Representation of NOAA Satellites and Ground Systems

1.3 Government Furnished Equipment and Information

1.3.1 Government Furnished Equipment (GFE) and Supplies

The Government will provide the Contractor personnel located at the Government buildings with basic supplies and materials normally available to Government employees including personal computers and software.

The Contractor shall coordinate with the Government property manager regarding the transfer receipt of all assets, the management of all property, and the program’s inventory. The

Government Furnished Equipment (GFE) List will be provided to the Contractor at the Task

Order level and will contain the list of equipment available to the Contractor for use in the performance of this contract. This property will be used and maintained by the Contractor in accordance with the provisions of the “Government Furnished Property Clause” of the Master contract, see FAR 52.245-1 Government Property.

During contract transition, the Contractor shall work with the Government property manager to transfer any property at the incumbent contractor location.

The Contractor will receive, manage, and maintain all GFE for the duration of the contract.

Hardware and software procured by the Government will be received, managed, and tracked by the Contractor. Data packages for hardware and software procured by the Contractor will be submitted to the Government.

1.3.2 Government Furnished Information (GFI)

GFI includes, without limitation, all software, related documentation, and training materials, explicitly including design documentation, working papers, and source code that is the property of the U.S. Government or that is subject to the license restrictions of other vendors. The OMS contractor will be authorized to modify, maintain, test, or enhance any existing software. All subsequent software purchases or changes will remain the property of the U.S. Government.

1.4 Definitions

The following definitions are applicable to the OMS contract. The term “activities” will be used to mean any services or support functions performed by the Contractor and needed to fulfill the

Operations, Maintenance or Sustainment requirements.

1.4.1 Program Management

To manage the delivery of the OMS requirement, Program Management tasks and activities are performed to support all NESDIS ground segments within the contract, and apply to all task orders. These include: project management, contract transition management, schedule, deliveries

(including key documents, plans, meeting support, meeting minutes and other documents), financial operations and cost management, staff management, configuration management, data management, systems engineering, asset management (includes inventories and audits), supply chain management (e.g., purchasing of hardware and software, firmware, software licenses, maintenance agreements/renewals), quality management, risk management, and training.

Figure 1.4.1-1 Key OMS Program Management Functions

1.4.2 Development

Development activities may be performed as part of sustainment to create new systems and capabilities in support of NESDIS products and services via hardware, software and networking components, using a process that includes the following development phases:

● Determining system functional and performance requirements

● Designing system features to satisfy baselined requirements

● Documenting business rules and operations processes

● Acquiring hardware, software and communication services

● Writing new and/or modifying existing (including repurposing) software code

● Installing and verifying the system in test and then operational facilities

● Transitioning the system to operations, including user training

1.4.3 Operations

Operations activities and functions are performed to ensure the efficient and effective command and control of satellites and selected reference climate networks, data acquisition from a spectrum of observing and computational systems, product generation, archive, product distribution and the execution of broadcast services. Operations are often supported on a 24 hours x 7 days x 365 days per year basis with defined remote backup and contingency capabilities that ensure the high availability and reliability of products and services. NESDIS operations transform satellite and in-situ environmental observations into desired data and information products and related services that either create or deliver value to NOAA and other customers (both internal and external to NOAA).

Core functional areas of NESDIS satellite & product operations include:

● Support of launch, activation, and evaluation of new satellites

● Monitoring and verification of satellite health and status

● Configuration/commanding of satellites to meet user’s needs

● Detection, identification and assessment of satellite and ground system anomalies

● Managing, monitoring, and configuring associated ground segment elements

● Ensuring a secure operational environment

1.4.4 Maintenance (Tier 1 and 2)

Maintenance activities are performed to ensure the continued operation of a system that has been formally transitioned to the operational organization where data or information are observed, transmitted, calibrated, processed, or distributed. Maintenance activities ensure that the overall system continues to meet scientific, technical, functional, and performance requirements in addition to availability and reliability requirements and that the appropriate security posture for the particular system is maintained. These include:

● Preventive Maintenance- changes to ground systems or software with the intent to prevent errors, problems or failures before they occur

● Corrective Maintenance- reactive (emergency) and/or routine (planned) fixes that are needed as a result of anomalies such as network and data outages, data format changes, hardware failures, security vulnerabilities and/or software problems

● Science Maintenance- calibration updates and algorithm changes necessary to ensure product quality, correct for unanticipated anomalies or artifacts

● Limited Scope Adaptive Maintenance- product and system modifications that can be performed by operations support personnel, and that maintain current system requirements and the controlled configuration and interfaces

In all cases, system testing and regression testing is performed to verify the results of the maintenance action and to ensure that none of the modifications negatively impact the functional performance of the operational baseline system.

Within the definition there are several maintenance Tiers. Tier 1 is defined as return to service with support performed by Government and contract personnel. This level is the lowest level of maintenance and consists of minor repairs and configuration adjustments, and includes:

● Initial anomaly response

● Anomaly investigation, configuration adjustment, and minor repair (software, hardware, minor script adjustments, password reset, etc.) required to return the system to operational status

● Problem Request/Work Request (PR/WR) generation in the Enterprise Configuration

Management System (ECMT)

● Restart/Reboots

● Fault isolation

● Temporary workarounds

● IT security patching and scanning

● After hours support - Quick reaction for restoral of service (in accordance with the mean time to repair (MTTR)

Tier 2 is defined as system maintenance, testing, and replacement with support performed by the

Government and/or contractor. The Government leads technical monitoring, consulting, and coordination with the contract personnel support, and includes:

● Change Control Board (CCB) forum to set priorities, schedule maintenance, collect

PR/WR tracking metrics

● Baseline and Configuration Management (CM)

● Software installation/distribution

● PR/WR troubleshooting, analysis, and changes to baseline

● Testing and Integration Support to include comprehensive regression testing

● Tier 2 after hours reach-back support

● Launch and Pre-Launch activities to include 24/7 support

● Continuity of Operations (COOP) support

● Permanent Restoral of service solution

● Data archival and stewardship

1.4.5 Extended Maintenance (Tier 3a)

Tier 3a is defined as more complicated repairs that cannot be readily performed online under

Tier 1 or 2, but are limited to labor or materials needed to keep a system properly functioning, and includes:

● Systems engineering/Integrated Logistics

● Configuration, risk, and budget management

● Product Development Life Cycle

● Software license and code management, including websites

1.4.6 Sustainment (Tier 3b)

Sustainment activities are typically larger scale and pre-planned activities performed to develop, modernize, or enhance components. Sustainment activities are conducted to reduce life cycle costs (or provide the best return on investment); leverage technology advancements and improvements; improve the capability, reliability and robustness of the system; and extend the system life to meet program-life requirements. Tier 3b sustainment encompasses more complicated maintenance that cannot be readily performed online by tier 1 or 2, and are focused on labor and materials needed to make improvements in functionality. Sustainment activities include the modernization (or technology refreshment) of existing hardware and software, and adding new capabilities to meet Government requirements. These activities may include:

● Developing, integrating, testing and implementing new or improved science algorithm or application capability, or a new sub-component of an existing system

● Enhancing operations by improving existing system components or capabilities

● Adding new capabilities to meet NOAA requirements to provide the best return on investment

● Addressing life cycle issues, including the impacts of aging sensors (calibration adjustments), sensor and spacecraft anomalies, and the impacts of the gain or loss of data sources in order to maintain the highest quality (most accurate) products and services

● Upgrading to new versions of commercial off the shelf (COTS) software and hardware

● Installing and enabling new enterprise tools

1.4.7 Integration and Test

Integration and Test (I&T) activities are performed within the sustainment and maintenance functions to bring individually-tested components of a new or modified system together into a subsystem or fully functioning system, and to verify that a particular system component, subsystem, or the system itself meets a set of new or modified requirements or capabilities.

Verification methods include testing, demonstration, inspection, trending and analysis.

Test and demonstration are characterized by the detailed collection of data under a tightly controlled set of conditions and component configurations. Activities include:

● Implementing specialized testing environments as needed

● Detecting and resolving errors and anomalies

● Ensuring standards and governance compliance (statutory and policy) and interoperability among hardware and software systems

● Ensuring that hardware and software systems perform as designed, and understanding the impacts upon graceful degradation (e.g. loss of data sources, satellite failures, degraded hardware performance)

● Verifying the data streams, communications infrastructure (and fault detection), and generation of quality products and associated metadata and quality flags

1.4.8 Cloud Computing

Over time, NOAA will continue to implement its IT strategy across the agency. Future tasks may be written under the OMS contract to implement technical objectives in information system operations, sustainment and modernization, as applicable. Objectives include cloud solutions as a means to implement approved technology improvements, optimizations and efficiencies and lower total cost of ownership. Any future OMS tasks for cloud implementations shall utilize

Government-approved contract vehicles placed in service to procure cloud services per defined requirements, including these FedRamp areas:

● Virtual machine (or Compute) services

● Cloud testing services

● Storage services

● Network bandwidth (or data transfer) services

● Database management systems services

● Management capabilities and tools

● Professional services

● Business support services

2. References

The NIST Federal Information Processing Standards (FIPS) and Special Publications (SP) documents below apply to all OSPO systems. The most current edition of the NIST FIPS and SP document may also be found at https://csrc.nist.gov/publications .

● NIST SP 800-37 (latest applicable Revision): Guide for Applying the Risk

Management Framework to Federal Information Systems: A Security Life Cycle;

● NIST SP 800-53 (latest applicable Revision): Security and Privacy Controls for

Federal Information Systems and Organizations;

● NIST SP 800-64 (latest applicable Revision): Security Considerations in System

Development Life Cycle;

● NIST SP 800-82 (latest applicable Revision): Guide to ICS Security (for

Industrial Control Systems or ICS);

● NIST SP 800-128 (latest applicable Revision): Guide for Security-Focused

Configuration Management of Information Systems;

https://csrc.nist.gov/publications

● NIST SP 800-53A (latest applicable Revision): Assessing Security and Privacy

Controls in Federal Information Systems and Organizations: Building Effective

Assessment Plans;

● NIST SP 800-63 (latest applicable Revision): Electronic Authentication Guideline;

● NIST SP 800-88 (latest applicable Revision): Guidelines for Media Sanitization;

● NIST SP 800-119 (latest applicable Revision): Guidelines for the Secure Deployment of IPv6

● NIST SP 800-125 (latest applicable Revision): Guide to Security for Full

Virtualization Technologies;

● NIST SP 800-137 (latest applicable Revision): Information Security Continuous

Monitoring for Federal Information Systems and Organizations;

● NIST SP 800-146 (latest applicable Revision): Cloud Computing Synopsis and

Recommendations;

● NIST SP 800-160 (latest applicable Revision): Systems Security Engineering; and

● NIST SP 800-161 (latest applicable Revision): Supply Chain Risk Management

Practices for Federal Information Systems and Organizations (latest version).

The reference documents listed below apply to all OSPO systems and are included in the

Bidders Library.

● NOAA IT Security Manual (latest policy);

● NESDIS IT Security Policies (latest policies);

3. Requirements

NOAA may issue task orders for the Contractor to perform any of the work and meet the requirements identified in this PWS. The Contractor shall:

● Provide subject matter expertise and personnel, materials, equipment, services, and facilities necessary to perform and deliver the required operations, maintenance, and sustainment products and services of the contract, with no interruption of services, for each task order issued.

● Perform operations, maintenance, and sustainment activities at program sites listed in section 1.2. for items listed in Tables 1.1-1 and 1.1-2, as specified in individual task orders.

● Provide personnel that possess the required education, level of experience, and professional and technical certifications per attachment J-2, Labor Category Description, of the IDIQ contract.

● Provide personnel that possess the required Security Clearance which will be identified at the task order level.

● Deliver products and services in accordance with the deliverables section of each task order.

● The Contractor shall furnish such labor as may be necessary for packing, unpacking and placement of equipment when in the possession of the Government without additional charge to the Government. Supervision of packing, unpacking and placement of the equipment shall be furnished by the Contractor without charge to the Government.

Specific requirements will be further defined at the task order level.

3.1 Program Management

Program/project management requirements include the following:

● Provide program/project execution, cost, and schedule control, assessment, and recommend and implement improvements

● Provide a written monthly program status report and monthly program review status package

● Program Management Plan (PMP) covering the IDIQ contract and all task orders

● Integrated Master Schedule covering all task orders

● Effective management and utilization of subcontractors (documented in a Subcontracting

Plan)

● Financial management of the contract task orders including spend plans, invoicing, funds status, engineering assessments (EA), and travel management

● Effective management and documentation of contract transition without impact to operations (documented in Phase-in Transition Plans and Phase-out Transition Plans for all activities). Transition requirements apply to all task orders, where applicable, and to any new scope of work, or work assignments that may be generated going forward.

● Staffing management documented in a Staffing Plan, with support projections covering all task orders

● Configuration management (including support to Government enterprise tools; meeting management services; and related documentation; configuration change documentation and related forms of applicable systems; support to SharePoint; NSOF library;

configuration control board support; operation procedures support)

● Systems engineering activities (via processes documented in Systems Engineering

Management Plan, review board support requirements, requirements baseline management, technical writing service support)

● Physical configuration audit support and tools, regularly scheduled scans and inventories, and related documentation/report deliveries

● Management of software licenses and hardware maintenance and warranties

● Property management support (ship and receive tasks)

● Procurement support

● Quality assurance support (Quality Assurance Plan, data call support)

● Risk management and mitigation support (including risk management status reviews)

● Personnel training support, training plans over the contract period of performance

3.1.1 Deliverables

The Contractor shall provide deliverables for each individual task order in the content and format that is approved by the Government.

3.1.2 Reports

The Contractor shall provide reports submitted to the Contracting Officer (CO) and Contracting

Officer Representative (COR), in electronic format. The Contractor shall work with numerous file formats, including Microsoft Office® (.doc, .xls, .ppt, .mpp. .pdf, VISIO, and XML). The frequency of submission of program deliverables will be specified in each task order deliverables list.

3.1.3 Contract Transition

The OMS contract will transition multiple efforts as legacy contracts expire. These transition activities must be closely managed such that no operational impacts occur to any other system.

Detailed transition requirements may be specified in task orders.

The Government will issue task orders to provide for both continuity of assigned systems and assignment of additional systems as the associated legacy contracts expire.

The Contractor shall provide all resources to assume, transition, and execute the implementation for operating, maintaining, and/or sustaining one, or several systems over the contract period of performance.

3.2 Operations

The Government will provide infrastructure and procedural details to the Contractor for the safe and effective execution of deployed system activities assigned.

The Contractor shall perform operations activities on OMS assigned systems as identified in individual task orders.

The Contractor shall perform and support operations activities and functions to support efficient and effective command and control of satellites and selected reference climate networks, data acquisition from a spectrum of observing and computational systems, product generation, archive, product distribution and the execution of broadcast services.

The Contractor shall provide operations support 24 hours a day x 7 days a week x 365 days a year with defined remote operational back-up and contingency capabilities, while meeting system availability and reliability requirements.

The Contractor shall provide operations support for core functional areas of satellite operations.

Core Functional Areas include:

● Launches and transition to operations activities

● Monitoring and verification of satellite health and status

● Configuration/commanding of satellites to meet user’s needs

● Detection, identification and assessment of satellite and ground system anomalies

● Managing, monitoring, and configuring the associated ground segment element

● Ensuring continuous security compliance in the operational environment

The Contractor shall provide daily operational support activities for managing a satellite command and control center and product processing environment.

Operational support activities include:

● Satellite launch and commanding activities

● Help desk services to operations and satellite product users

● Systems and product analysis support during operational anomalies

● Network, systems, workstation, printer and satellite hardware support

● Data center infrastructure management

● Antenna operations support

● Network and security monitoring

● Continuity of operations (COOP)

● Operations training

The Contractor shall provide support to the Government in updating and reviewing current

SOPs.

The Contractor shall provide support to the Government in verifying and ensuring the accuracy of the Operational Systems’ Configuration Files.

3.3 Maintenance

3.3.1 Maintenance Activities

The Contractor shall perform maintenance activities on OMS assigned systems as identified in individual task orders.

The Contractor shall document changes to the systems at the configuration item (CI) level in accordance with SOP’s and established Configuration Control processes.

The Contractor shall maintain the assigned systems for compliance with technical, functional, performance, availability, reliability, and security requirements and specifications.

The Contractor shall support all required communications methods to the Government to assure prompt, continued status of the systems being maintained.

3.3.2 Network & Systems Administration

The Contractor shall provide system and network administration maintenance-related activities, including:

● Perform system and network administration functions

● System and network patch management

● Coordination with the Government on system and network maintenance with vendors

● Updates to the latest releases or versions of system and network operating systems

● Disaster recovery activities, such as backups, migrations, and dumps of libraries and files

● Routine status reporting to the COR(s) regarding server and storage usage

3.3.3 Capacity Planning

The Contractor shall perform performance or capacity management activities. Performance and

Capacity Management activities include:

● Studies required by the Government

● Document Capacity Planning and Performance Management procedures that are compliant with processing requirements. This planning shall ensure changes to servers/computers or peripherals do not adversely impact any system operations.

● Monitor and report of component performance, utilization, and efficiency; ensure system capacity and storage are compliant to accommodate current and future operational data volumes and processing requirements

● Manage component resources (e.g. devices and traffic) to comply with defined availability and performance service levels

● Cross check information management practices and existing IT infrastructure requirements are continually consistent and not in conflict

● Component tuning to maintain optimum performance

● Develop and implement improvement plans to address capacity issues

3.3.4 Telecommunications Support

The Contractor shall coordinate with telecommunications vendors, customers, partners, leased circuit providers and mission systems to troubleshoot network problems, outages, or any other issues impacting a service level agreement.

3.3.5 Preventative and Corrective Maintenance

The Contractor shall perform preventative and corrective maintenance, modifications, planned and unplanned activities, and maintain a spares depot for assigned systems as specified in individual task orders at all work locations. This includes the following functions:

● Provide and maintain a Maintenance Plan (inclusive of preventative maintenance)

● Create and deliver for Government approval work packages (inclusive of material procurements and test plans)

● Quarterly visual inspections of all equipment

● Correcting error conditions per a Help Desk ticketing process

● Perform preventative maintenance on a quarterly basis; coordinate all maintenance schedules and timelines

● Identify system components and software within one year of obsolescence

● Perform all software maintenance functions, patching and software license compliance management

● Provide IT security maintenance support

● Planned and unplanned maintenance

● Develop and maintain SOP’s

● Recommend load balancing improvements

● Maintain a specialized satellite imagery-scheduling program

● Maintain all Government databases

● Update diagrams of all wide area network (WAN) and local area network (LAN) data communication connections

● Maintain current satellite operations ground system equipment within acceptable quality levels

● Manage/perform spares depot level repairs, and the return of defective equipment to the vendor for repair or replacement

3.3.6 Installation, De-installation and Relocation

The Contractor shall provide schedules for Government approval, and perform all equipment upgrades, installations, de-installations and relocations within the agreed-to times; ensure no equipment is damaged during installations, de-installations, or relocations; and ensure installations and relocations comply with building and electrical codes (e.g. National Electrical

Code).

The Contractor shall provide, to the COR or authorized Government official for approval, a schedule for any new hardware installations. The Contractor shall install new hardware after receiving written Government approval.

3.3.7 Web Development Support

The contractor shall manage and maintain mission and product web pages, associated content, content delivery services, and accounts.

3.3.8 Antenna Maintenance Support

The Contractor shall provide support to perform maintenance activities on OSPO antenna systems.

The Contractor shall process and implement an Antenna System Maintenance Plan for OSPO antenna systems listing daily, weekly, monthly, semi-annual, annual, and any inspections necessary. The Contractor shall maintain and submit Antenna System Maintenance Records for maintenance tasks performed on the antenna systems.

3.3.9 Cloud Services

The Contractor shall utilize Government-approved contract vehicles placed in service to procure cloud services per defined requirements, including these FedRamp areas:

● Virtual machine (or Compute) services

● Cloud testing services

● Storage services

● Network bandwidth (or data transfer) services

● Database management systems services

● Management capabilities and tools

● Professional services

● Business support services

For such task requirements, the Contractor shall be expected to define, plan and document, implement, test, and verify all cloud implementation requirements, coordinate with the cloud provider, and monitor (via metrics) the cloud solution performance.

3.4. Sustainment

Sustainment activities for OMS assigned systems will be identified in individual task orders and will include the following:

3.4.1. Obsolescence Prevention and Remediation

The Contractor shall identify all system hardware components and software within one (1) year of obsolescence.

The Contractor shall provide an annual Preventative Maintenance Plan. The Preventative

Maintenance Plan must capture technical refresh planning, replacement of obsolete hardware and software for assigned systems, and address preventative maintenance tasks (including integration, test and check-out required to verify and validate post-maintenance system performance).

3.4.2. Sustainment Support

Sustainment activities are part of a 5-year rolling Government plan associated with scheduled technology refresh windows, enterprise convergence and shared services implementations. As part of the Contractor’s Annual Spend Plan, the Government and Contractor will reconcile the

Contractor’s Preventative Maintenance Plan and the Government’s 5-year Sustainment Plan with available funding to determine a prioritized list of sustainment tasks for the coming year.

The Contractor shall track sustainment tasks in the Integrated Master Schedule (IMS) using bi-weekly milestones.

Sustainment tasking and procedures shall be in accordance with SOP’s and include a level of detail and verification commensurate with the cost and complexity of the task. The Government will approve scheduled sustainment activities and provide a minimum of one person per shift who is authorized to approve sustainment activities. Sustainment tasks shall not interfere with or compromise system operations.

The Contractor shall obtain written approval from the Contracting Officer or the CO’s designated representative prior to commencing sustainment work.

The Contractor shall update all Configuration Change Requests (CCR) for OMS documentation, drawings and procedures within 24 hours of completing any sustainment activities.

The Contractor shall provide, maintain, and administer a requirements management process and related documentation for requirements changes. A requirements baseline shall be established and maintained throughout the contract period of performance.

3.4.3 Sustainment Test and Integration

Assigned Systems are software-intensive and will require frequent patching and updates for both operational and security purposes. Successful execution will require the Contractor to assist the

Government in timely and efficient patching, integrating, compiling and testing of small to medium software changes of simple to moderate complexity. Large or complex software development may be required.

Should existing software source code modifications be required, the Contractor shall identify source code and/or database changes, complete any changes per an approved software development standard, ensure a clean software compile, and fully document the code changes.

Sustainment software integration and testing will be performed in specified test environments after all documentation and peer reviews are successfully completed. Testing for changes that provide new program scope shall include an end-to-end test that exercises the customer interface per an Interface Requirements Document (IRD) or Interface Control Document (ICD). System tests shall include testing with customer-provided data in a testing environment that is reflective of the customer’s operational environment. Test plans for new capability shall be approved by the Government in advance.

Upon successful completion of testing and Government receipt and approval of the test results, software changes may be deployed into the operational environment. After the Government verifies successful installation, deployment testing will follow.

The Contractor shall perform software integration in accordance with documented and approved plans after formal software peer review, including a successful readiness review process, and transition to operations.

The Contractor shall permit the Government to observe all software testing.

The Contractor shall provide the Government with detailed test plans, test procedures, data sources, and expected outcomes for review and approval no less than two weeks prior to testing to ensure releases and fixes work as intended.

The Contractor shall coordinate proposed system acceptance test schedules with the

Government.

The Contractor shall maintain all documentation of test results and test logs throughout the release, integration and testing phases.

Upon successful completion of system testing, the Contractor shall provide all test results and documentation to the Government.

3.4.4 User Access Sustainment

The Contractor shall provide and maintain an interactive website which contains spacecraft events and spacecraft changes.

The Contractor shall support website user access sustainment services.

The Contractor shall coordinate with the Government to collect website system requirements.

The Contractor shall provide and maintain a mobile version of the website.

The Contractor shall consolidate common website information, ensuring data accuracy.

3.5. Information Cyber Security & Support

3.5.1 Information Cyber Security

Information and cyber security services for DOC NOAA systems will be implemented on a separate contract vehicle. However, security-related support for the OMS contract will involve coordination with the IT Security Program (who leads critical IT and cyber security activities), and enabling security solutions. Appendix B, OMS Information & Cyber Security Support Task

Accountability Matrix, designates the task number, task description, whether the OMS IT contract leads or provides input for a task, and whether the task requires documentation, reporting, action, or a combination thereof. The OMS contract security manager shall provide oversight, leadership, coordination of all security related activities, and manage the OMS support staff in achieving the functions below. This information applies to all task orders.

● Perform scans, patching, and hardening

● Implement technical security controls

● Collecting artifacts for security control assessments, and technical POA&M milestones

● Acquire security-related solutions identified by the NESDIS IT Security Program

● Implement and maintain the identified security-related solutions

● Provide input to security related document deliverables

● Perform component assessments, and other security related activities

The Contractor’s designated security manager shall coordinate with and report to the assigned

NOAA Information and Cyber Security program-designated point of contact to assist in implementing the required security controls for the compliant operation of satellite control and product processing systems. Refer to Appendix B. OMS Information & Cyber Security Support

Task Accountability Matrix Personnel Security Requirements for current roles and responsibilities between OMS security support tasks and the IT Security program.

3.5.1.1 Security Continuous Monitoring and Situational Awareness

3.5.1.1.1 Incident Response

The Contractor shall coordinate and report remedial actions in response to IT Security events, or incidents to the NOAA Cyber Incident Response Team (N-CIRT) within 24-hours, or as specified in the OSPO Incident Response (IR) Plan.

3.5.1.1.2 System and Network Monitoring

The Contractor shall complete monitoring activities of system and security logs and report issues to the designated Government point of contact (POC).

3.5.1.1.3 Audit and Logging

The Contractor shall review system monitoring logs and complete reports, per the

System Security Plans (SSP).

3.5.1.1.4 Vulnerability Assessment

The Contractor shall complete required vulnerability assessment activities, including authenticated monthly and quarterly scans and reporting.

The Contractor shall either upload completed vulnerability and configuration compliance scan reports to the NOAA enterprise vulnerability scanning tool or initiate the scans from the enterprise tool by the 1st day of each month for monthly vulnerability scans and website scanning, and vulnerability scans on the 15th day of the third month for quarterly scans of the fiscal quarter (12/15/YY, 3/15/YY, 6/15/YY, 9/15/YY), or as required by NESDIS.

The Contractor shall maintain and update scanning tools and plugins for associated vulnerabilities at least monthly.

The Contractor shall maintain and update scanning products and associated vulnerability at least monthly.

The Contractor shall initiate and complete scans from the NOAA Tenable Security Center or the single user NESSUS tool, the current NOAA standard vulnerability scanning tool. In some cases, other scanning tools may be used for specific components, e.g. WebInspect Enterprise or

WebInspect single user for web pages.

The Contractor shall implement federal guidelines for CyberScope reporting as directed by DOC, NOAA, NESDIS, or OSPO policy.

The Contractor shall maintain a Scanning Exclusion List of system components excluded from automated vulnerability scanning due to age, mission, or technical considerations, and update and publish monthly per the OMS Configuration Management process.

The Contractor shall assess all components identified on the Scanning Exclusion List for vulnerabilities using other technical means including manual evaluation, testing, and complete assessments as part of monthly and quarterly vulnerability assessments reports.

The Contractor shall remediate vulnerabilities for all components identified on the Scanning

Exclusion List.

3.5.1.2 Contingency Planning

The Contractor shall provide support for input and support to maintaining the system Disaster

Recovery/COOP and contingency activities plan. These plans shall be updated semi-annually, unless directed otherwise.

The Contractor shall coordinate with and provide input to the IT Security representative to maintain the Contingency Plan Test Plan and Report (CPTPR). This plan is updated annually.

The Contractor shall participate in quarterly Contingency Plan training. All contractor staff shall complete CP training at least semi-annually.

The Contractor shall participate in testing the system Contingency Plan annually, and test system backup procedures quarterly. The failed actions related to contingency system testing shall be fully reflected in the annual Contingency Plan with established mitigations to correct the actions during the next test.

3.5.1.3 Flaw Remediation

The Contractor shall identify and report on information system vulnerabilities.

The Contractor shall mitigate information system vulnerabilities.

The Contractor shall test software updates related to flaw remediation for effectiveness and potential side effects on all affected systems before installation.

The Contractor shall maintain and implement DOC, NOAA, or flaw remediation tools, as applicable.

The Contractor shall provide input for the SSP on the reasons related to any component that cannot be patched, such as: age, mission, or technical impact.

3.5.1.4 Malicious Code Protection

The Contractor shall identify and document specific components unable to implement anti-malware protections. If a component cannot implement this control due to age or mission impact, the Contractor shall document the technical and operational considerations, mitigation in the SSP, and request risk acceptance through the FIPS 200.

The Contractor shall maintain and implement the NOAA enterprise anti-malware tool.

3.5.2 Cyber Security Program Management Support

The OSPO Information Technology (IT) Security Program Office will be managing the security architecture and engineering for each of the OSPO Information Technology (IT) systems. The

OSPO IT Security Program Office will be managing the overall security compliance requirements for each of the OSPO IT systems utilizing a separate OSPO IT Security Contract.

The OSPO IT Security Program Office will provide comprehensive IT security services, complete tasks, submit deliverables and artifacts produced by OMS contractor in support of all aspects of IT security and IT security management for OSPO systems.

The OSPO IT Security Program Office will implement required security control policies to ensure confidentiality, integrity and availability of the information resources integral to the successful operation of OSPO satellite ground systems, product processing and distribution systems, and Admin LANs.

3.5.2.1 Cyber Security Awareness & Training

All Contractor personnel shall complete the required NOAA training, including, but not limited to: the Annual NOAA IT Security Awareness Training.

All Contractor staff shall complete the Annual NOAA Role-Based Security Training 30 days before the NOAA established deadline each fiscal year.

3.5.2.2 Cyber Security Assessment & Authorization

3.5.2.2.1 Continuous Monitoring and Assessment & Authorization (A&A)

The Contractor shall support processes enabling the OSPO IT Security Program Office to achieve compliance with Government security mandates and obtain/maintain an Authority to

Operate (ATO) for each system.

The Contractor shall submit assigned Security Control Assessment (SCA) artifacts to the OSPO

IT Security Program Office as scheduled.

3.5.2.2.2 Plans of Action & Milestones (POA&M) Management

The Contractor shall manage technical POA&M milestones using the established Configuration

Management tools.

3.5.2.2.3 System Interconnection

The Contractor shall support information requests for all system Interconnection Security

Agreements.

The Contractor shall review and implement connections in accordance with the Interface Control

Documents (ICD) and report any discrepancies or changes to the Government.

3.5.2.2.4 System Security Documentation

The Contractor shall support information requests for Security Authorization Package for all

OMS assigned systems and additional information or documentation required by updates to

DOC, NOAA, NESDIS policies/ procedures.

3.5.2.3 Security Support for Systems Engineering and Change & Configuration

Management

The Contractor shall adhere to the requirements per the approved Security Authorization

Package Core Documents for the assigned OMS systems.

The Contractor shall adhere to requirements specified in the approved Security Authorization

Package Core Documents (see table 3.5.3.3-1 below) for all assigned OMS systems and referenced requirements in DOC, NOAA, NESDIS, and OSPO policies and procedures.

Table 3.5.3.3-1 Security Authorization Package…