OMS_IDIQ_PWS_-_Draft_03-07-2018.pdf

DRAFT OPERATIONS, MAINTENANCE, AND SUSTAINMENT IDIQ PERFORMANCE WORK STATEMENT

Source Selection Information – See FAR 2.101 and 3.104-4

National Environmental Satellite, Data, and Information Service (NESDIS)

Office of Satellite and Product Operations (OSPO) and

Office of Satellite Ground Services (OSGS)

Draft Operations, Maintenance, and Sustainment (OMS) Indefinite Delivery/Indefinite Quantity (IDIQ) Performance Work Statement (PWS)

March 7, 2018

Table of Contents

1. Scope 4

1.1 Introduction 4

1.2 Place of Performance 7

1.3 Activities 8

1.4 Definitions 8

1.4.1 Development 8

1.4.2 Operations 9

1.4.3 Maintenance 9

1.4.4 Sustainment 10

1.4.5 Integration and Test 10

2. References 11

2.1 Department of Commerce References 11

2.2 Department of Commerce Specifications 11

3. Requirements 11

3.1 Program Management 11

3.2 Operations 12

3.3 Maintenance 13

3.3.1 Maintenance Activities 13

3.3.1.1 Network & Systems Administration 13

3.3.2 Capacity Planning 14

3.3.3 Telecommunications Support 14

3.3.4 Preventative and Corrective Maintenance 14

3.3.5 Installation, De-installation and Relocation 15

3.3.6 Web Development Support 15

3.3.7 Antenna Maintenance Support 15

3.4 Sustainment 15

3.4.1 Obsolescence Prevention and Remediation 15

3.4.2 Sustainment Support 16

3.4.3 Sustainment Test and Integration 16

Source Selection Information – See FAR 2.101 and 3.104-4

3.4.2 User Access Sustainment 17

3.5 Information & Cyber Security Support 18

3.5.1 Information and Cyber Security 18

3.5.2 Security Continuous Monitoring and Situation Awareness 18

3.5.2.1 Contingency Planning 19

3.5.2.2 Flaw Remediation 20

3.5.2.3 Malicious Code Protection 20

3.5.3 Cyber Security Program Management 20

3.5.3.1 Cyber Security Awareness & Training 20

3.5.3.2 Cyber Security Assessment & Authorization 20

3.5.3.2.1 Continuous Monitoring and Assessment & Authorization (A&A) 20

3.5.3.2.2 Plans of Action & Milestones (POA&M) Management 21

3.5.3.2.3 System Interconnection 21

3.5.3.2.4 System Security Documentation 21

3.5.3.3 Security Support for Systems Engineering and Change & Configuration Management 21

Personnel Security Requirements 21

Source Selection Information – See FAR 2.101 and 3.104-4

1. Scope

1.1 Introduction

The National Oceanic and Atmospheric Administration’s (NOAA’s) National Environmental Satellite, Data, and Information Service (NESDIS) provides satellite products, services, environmental information, and official assessments of the environment in support of societal and economic decisions. NESDIS satellite ground systems are the infrastructure for generating and distributing these satellite products and services. NESDIS satellite ground systems are entering a new era with the launch of the next-generation geostationary and polar-orbiting satellites. Both the Geostationary Operational Environmental Satellite “R” Series (GOES-R) Program and Joint Polar-orbiting Operational Satellite System (JPSS) Program include new ground systems for NESDIS.

This Performance Work Statement (PWS) describes services to operate, maintain, sustain and dispose of existing NESDIS legacy satellite ground systems until these new ground systems and their associated observatory constellations fully transition to operations. The contractor shall migrate existing business functions to an enterprise ground architecture and use shared services as they become available for satellite operations.

Within NESDIS, the Office of Satellite and Product Operations (OSPO) and the Office of Satellite Ground Services (OSGS) require operations, maintenance, sustainment and disposal support to our legacy ground systems. OSPO operates and OSGS maintains and sustains the ground systems covered in this PWS. NESDIS intends to sustain legacy ground systems through preventative maintenance, sparing, and failed component replacement (corrective maintenance) while actively managing performance risk and cost risk as the legacy systems approach retirement and disposal.

The broad scope of this work includes support for:

● Operations, maintenance, and sustainment of NESDIS-deployed hardware, firmware, and software ground systems;

● Satellite-to-Ground communications, including radio frequency (RF) and terrestrial communications networks, telemetry over Internet Protocol (IP), and RF antenna systems;

● Systems that support mission scheduling, ground system software/subsystem functions, and satellite command and control;

● Secure data ingest from both NOAA-operated satellite missions and external sources;

● Data Collection System (DCS) satellite services;

● Product generation, storage, monitoring, and distribution systems supporting new and improved satellite products, services, and algorithms;

● Provision of information to the National Centers for Environmental Information (NCEI) for archive and stewardship of these products.

● P T

● T ad

Figur systems a

Fi

T items list PWS. Th Boundary

Table

GOES

Anten

DRAFT O

So rogram exec Technology ( Technical Ba dopts new te re 1.1-1 illus and covered igure 1.1-1.

Table 1.1-1 sh ted in Table he specific s y General C e 1.1-1 NESD

S Ground Sys

PAAN

nna/Network

PERATIONPERF

ource Selecti cution and de (NIST) secur seline evolu echnology.

strates the Fe elements fo

NOAA NE

hows the gro 1.1-1 may b systems in m orresponden

DIS System stem king

NS, MAINTFORMANCE

ion Informat elivery of se rity control g ution, both H ederal Inform or this Contra

SDIS FISM

ound system be referred to more detail is nce to NESD s that may b thi

Legacy Geo

TENANCE, E WORK S

tion – See FA ervices using guidelines.

Hardware and mation Secur act.

MA Systems/ ms that are wi o as “assigne provided in

DIS Missions be Operated s Contract ostationary O

Partner An

AND SUSTSTATEMEN

AR 2.101 an g National In d Software th rity Manage

/ Covered C ithin the sco ed systems” n Appendix 1 s/Functions.

d, Maintain

Operational E ntenna Acces

TAINMENTNT

nd 3.104-4 nstitute of St hat changes ement Act (F

Contractual ope of this co within the b

1. NESDIS S

ned, and Sus

Environment ss Network

T IDIQ

tandards and components

FISMA) defi

Elements ontract. The body of this System stained und tal Satellites d s or ned der s

Source Selection Information – See FAR 2.101 and 3.104-4

Table 1.1-1 NESDIS Systems that may be Operated, Maintained, and Sustained under this Contract

DSCOVR

Antenna/Networking

Deep Space Climate Observatory (Subsystem of GOES)

DCS Data Collection System

ESPC Environmental Satellite Processing Center

NJGS NOAA Jason Ground System

POES Ground System Legacy Polar-orbiting Operational Environmental Satellite

MSL Mission Support LAN

GRAVITE

Government Resources for Algorithm Verification, Independent

Test and Evaluation

Table 1.1-2 lists several Mission Ground Systems whose interfaces are within the scope of the OMS contract.

Table 1.1-2 System Interfaces or Limited Operations Support Covered Under the OMS Contract for These NESDIS Ground Systems

Search and Rescue Satellite aided Tracking System (SARSAT)

Comprehensive Large Array-data Stewardship System (CLASS)

Geostationary Operational Environmental Satellites (GOES) – R Series

Joint Polar Satellite System (JPSS)

Table 1.1-3 shows administrative Local Area Network (LAN) system interfaces with the systems contained in Table 1.1-1. These interfaces are covered in the scope of the OMS contract.

Source Selection Information – See FAR 2.101 and 3.104-4

All other aspects of these networks (except the interfaces) are operated, maintained, and sustained in another NOAA contract (not the OMS contract).

Table 1.1-3. Networks Interfaces Ground Systems in Table 1.1-1

NOAA Environmental Satellite, Data and Information Service (NESDIS) Local Area Network (LAN), Silver Spring MD

Fairbanks Command and Data Acquisition Station (FCDAS) LAN, Fairbanks, AK

National Climate Data Center (NCDC) LAN, Asheville, NC

National Ocean Data Center (NODC) LAN, Silver Spring, MD

National Geophysical Data Center (NGDC) LAN, Boulder, CO

Center for Satellite Applications and Research (STAR) LAN, College Park, MD

Wallops Command and Data Acquisition Station (WCDAS) LAN, Wallops Island, VA

A detailed list of NESDIS systems is in Appendix A1. Individual system inventories, drawings, descriptions and interfaces are available in the technical document library.

1.2 Place of Performance

Figure C.1.1-1 illustrates the NESDIS Ground Enterprise (NGE). Work locations for this contract include:

● NOAA Satellite Operations Facility (NSOF) located in Suitland, MD

● OSGS Program Offices located in Greenbelt MD and Silver Spring, MD

● NOAA Center for Weather and Climate Prediction (NCWCP) located in College Park, MD

● NASA’s Goddard Space Flight Center located in Greenbelt, MD

● NESDIS Command and Data Acquisition (CDA) Stations located in Wallops, VA:

Fairbanks, AK; and Barrow, AK

● NESDIS NCEI located in Asheville, NC; Boulder, CO; and Silver Spring, MD

● The NESDIS Consolidated Back-up Unit (CBU) located in Fairmont, WV.

1.3 A

T

NESDIS

Maintena support f or Sustai defined i

W performe verify an and proce

(PRS).

1.4 D

1.4.1 D

Deve

NESDIS

process t

● Deter

DRAFT O

So

Figure C

Activities

This PWS inc in the execu ance, and Su functions per nment requi n individual

While this is ed as part of nd validate ch edural perfo

Definitions

Development elopment act products an hat includes rmining syst

PERATIONPERF

ource Selecti

C1.1-1. Repr cludes requir ution of the c ustainment. T rformed by t irements of t l Task Order not a develo sustainment hanges made rmance metr t tivities are pe nd services v the followin tem function

NS, MAINTFORMANCE

ion Informat resentation o rements and contract. Ac The term “ac the Contract this PWS. Th rs (TO).

opment contr

t. In addition e during both rics are liste erformed to via hardware ng developm nal and perfo

TENANCE, E WORK S

tion – See FA of NOAA Sa activities w ctivities unde ctivities” wil or and neede he specific a ract, certain n, Integration h maintenan d in the Perf create new s , software an ment phases:

ormance requ

AND SUSTSTATEMEN

AR 2.101 an atellites and G which the Con er this contr ll be used to ed to fulfill t activities and developmen n and Test ac nce and susta formance Re systems and nd networkin uirements

TAINMENTNT

nd 3.104-4

Ground Syst ntractor shal ract will inclu mean any se the Operatio d assigned sy nt-like activi ctivities will ainment activ equirements d capabilities ng compone

T IDIQ

tems ll perform fo ude Operatio ervices or ons, Mainten ystems will b ties may be l be used to vities. Techn Summary s in support o ents, using a or ons, nance be nical of

Source Selection Information – See FAR 2.101 and 3.104-4

● Designing system features to satisfy baselined requirements

● Documenting business rules and operations processes

● Acquiring hardware, software and communication services

● Writing new and/or modifying existing (including repurposing) software code

● Installing and verifying the system in test and then operational facilities

● Transitioning the system to operations, including user training

1.4.2 Operations

Operations activities and functions are performed to ensure the efficient and effective command and control of satellites and selected reference climate networks, data acquisition from a spectrum of observing and computational systems, product generation, archive, product distribution and the execution of broadcast services. Operations are often supported on a 24 hours x 7 days x 365 days per year basis with defined remote back-up and contingency capabilities that ensure the high availability and reliability of products and services. NESDIS operations transform satellite and in-situ environmental observations into desired data and information products and related services that either create or deliver value to NOAA and other customers (both internal and external to NOAA).

Core functional areas of NESDIS satellite & product operations include:

● Support of launch, activation, and evaluation of new satellites

● Monitoring and verification of satellite health and status

● Configuration/commanding of satellites to meet user’s needs

● Detection, identification and assessment of satellite and ground system anomalies

● Managing, monitoring, and configuring associated ground segment elements

● Ensuring a secure operational environment

1.4.3 Maintenance

Maintenance activities are performed to ensure the continued operation of a system that has been formally transitioned to the operational organization where data or information are observed, transmitted, calibrated, processed, or distributed. Maintenance activities ensure that the overall system continues to meet scientific, technical, functional, and performance requirements in addition to availability and reliability requirements and that the appropriate security posture for the particular system is maintained. Types of maintenance include:

● Preventive Maintenance- changes to ground systems or software with the intent to prevent errors, problems or failures before they occur

● Corrective Maintenance- reactive (emergency) and/or routine (planned) fixes that are needed as a result of anomalies such as network and data outages, data format changes, hardware failures, security vulnerabilities and/or software problems

● Science Maintenance- calibration updates and algorithm changes necessary to ensure product quality, correct for unanticipated anomalies or artifacts

Source Selection Information – See FAR 2.101 and 3.104-4

● Limited Scope Adaptive Maintenance- product and system modifications that can be performed by operations support personnel, and that maintain current system requirements and the controlled configuration and interfaces

In all cases, system testing and regression testing is performed to verify the results of the maintenance action and to ensure that none of the modifications negatively impact the functional performance of the operational baseline system.

1.4.4 Sustainment

Sustainment activities are typically larger scale and pre-planned activities performed to develop, modernize, or enhance components. Sustainment activities are conducted to reduce life cycle costs (or provide the best return on the investment), leverage technology advancements and improvements, improve the capability, reliability and robustness of the system, and extend the system life to meet program-life requirements.

Sustainment activities include the modernization (or technology refreshment) of existing hardware and software, and adding new capabilities to meet Government requirements.

Sustainment activities may include:

● Developing, integrating, testing and implementing new or improved science algorithm or application capability, or a new sub-component of an existing system

● Enhancing operations by improving existing system components or capabilities

● Adding new capabilities to meet NOAA requirements to provide the best return on investments

● Addressing life cycle issues, including the impacts of aging sensors (calibration adjustments), sensor and spacecraft anomalies, and the impacts of the gain or loss of data sources in order to maintain the highest quality (most accurate) products and services

● Upgrading to new versions of COTS software and hardware

● Installing and enabling new enterprise tools

1.4.5 Integration and Test

Integration and Test (I&T) activities are performed within the development, sustainment and maintenance functions to bring individually-tested components of a new or modified system together into a subsystem or fully functioning system, and to verify that a particular system component, subsystem, or the system itself meets a set of new or modified requirements or capabilities. Verification methods include testing, demonstration, inspection, trending and analysis.

Test and demonstration are characterized by the detailed collection of data under a tightly controlled set of conditions and component configurations. Activities include:

● Implementing specialized testing environments as needed

● Detecting and resolving errors and anomalies

Source Selection Information – See FAR 2.101 and 3.104-4

● Ensuring standards and governance compliance (statutory and policy) and interoperability among hardware and software systems

● Ensuring that hardware and software systems perform as designed, and understanding the impacts upon graceful degradation (e.g. loss of data sources, satellite failures, degraded hardware performance)

● Verifying the data streams, communications infrastructure (and fault detection), and generation of quality products and associated metadata and quality flags

2. References

2.1 Department of Commerce References

The Department of Commerce relies on voluntary standards, both domestic and international, whenever feasible and consistent with law and regulation pursuant to law.

Examples of voluntary standards include those provided by the American National Standards Institute (ANSI) and the Institute for Electrical and Electronics Engineers Standards Association

(IEEE-SA).

2.2 Department of Commerce Specifications

The Contractor shall operate, maintain and sustain a suite of systems already in operations. These systems are of varying levels of age and complexity. Most activities have pre-existing Standard Operating Procedures (SOP) to guide Contractor execution, which the Government will make available.

3. Requirements

The Contractor shall:

● Provide subject matter expertise, personnel, material, equipment, services, and facilities necessary to perform and deliver operations, maintenance, and sustainment products and services in order to execute the contract with no interruption of services.

● Perform operations, maintenance, and sustainment activities at all program sites listed in section 1.2. for all items listed in Table 1.1-3.

● Provide personnel that possess professional and technical certifications commensurate with their responsibilities.

● Provide deliverables in accordance with the deliverables section of each task order.

3.1 Program Management

Program/project management requirements include, but are not limited to, the following:

● Assist in program/project execution, control, assessment, improvement, and management

● Program Management Plan for the IDIQ and each task order

● Integrated Master Schedule

Source Selection Information – See FAR 2.101 and 3.104-4

● Financial management of the contract and tasks including spend plans, invoicing, funds status, engineering assessments, and travel requirements

● Contract transition without impact to operations (Phase-in Plan, Phase-out plan, and reporting)

● Staffing management including a Staffing Plan for each task order

● Configuration management (support to Government enterprise tools, meeting management services, and related documentation, configuration change documentation and related forms of applicable systems, support to SharePoint, NSOF library, configuration control board support, operation procedures support)

● Systems engineering (Systems Engineering Management Plan, review board support requirements, requirements baseline mangement, technical writing service support)

● Physical configuration audit support and tools, frequency of scans and inventories, and related documentation/report deliveries

● Software and hardware license and warranty agreement management

● Property management support (ship and receive tasks)

● Quality assurance support (Quality Assurance Plan, data call support)

● Risk management and mitigation support (including Risk Management Plan, risk management status reviews)

● Personnel training support, training plans over the period of performance

3.2 Operations

The Government will provide infrastructure and procedural details to the Contractor sufficient for the safe and effective execution of deployed system activities assigned.

PWS-OP01: The Contractor shall perform and support operations activities and functions to ensure the efficient and effective command and control of satellites and selected reference climate networks, data acquisition from a spectrum of observing and computational systems, product generation, archive, product distribution and the execution of broadcast services.

PWS-OP02: The Contractor shall provide operations support on a 24x7x365 basis with defined remote back-up and contingency capabilities, while ensuring the high availability and reliability of products and services.

PWS-OP03: The Contractor shall provide operations support for core functional areas of satellite operations.

Core Functional Areas include:

● Launches and transition to operations activities.

● Monitoring and verification of satellite health and status

● Configuration/commanding of satellites to meet user’s needs

● Detection, identification and assessment of satellite and ground system anomalies

● Managing, monitoring, and configuring the associated ground segment element

● Ensuring a secure operational environment

PWS-OP04: The Contractor shall provide daily operational support activities associated with managing a satellite command and control center and product processing environment.

Operational support activities include:

● Satellite launch and commanding activities

● Help desk services to operations and satellite product users

● Systems and product analysis support during operational anomalies

● Network, systems, workstation, printer and satellite hardware support

● Data center infrastructure management

● Antenna operations support

● Network and security monitoring

● Continuity of operations (COOP)

● Operations training

PWS-OP05: The Contractor shall assist the Government in maintaining the accuracy of SOPs.

PWS-OP06: The Contractor shall assist the Government in maintaining the accuracy of the Operational Systems’ Configuration Files.

3.3 Maintenance

3.3.1 Maintenance Activities

PWS-MN01: The Contractor shall perform maintenance activities on assigned systems.

PWS-MN02 The Contractor shall document changes to the system at the configuration item level in accordance with SOP and Configuration Control processes.

PWS-MN03 The Contractor shall maintain the assigned systems such that they remain compliant with technical, functional, performance, availability, reliability, and security requirements and specifications.

PWS-MN04: The Contractor shall support all required communications methods to the Government to assure prompt continued status (through a variety of means) of systems being maintained.

3.3.1.1 Network & Systems Administration

PWS-MN06: The Contractor shall provide system and network administration maintenance-related activities, including:

● Perform system and network administration functions

● System and network patch management

● Coordination with the Government on system and network maintenance with vendors

● Updates to the latest releases or versions of system and network operating systems

Source Selection Information – See FAR 2.101 and 3.104-4

● Disaster recovery activities, such as backups, migrations, and dumps of libraries and files

● Routine status reporting to the COR regarding server and storage usage

3.3.2 Capacity Planning

PWS-MN07: The Contractor shall conduct performance or capacity management activities.

Performance and Capacity Management activities include:

● Studies required by the Government

● Document Capacity Planning and Performance Management procedures that meet processing requirements. This planning shall ensure changes to servers/computers or peripherals do not adversely impact OSPO system operations.

● Monitor and report of component performance, utilization, and efficiency; ensure system capacity and storage are sufficient to handle current and future operational data volume and processing requirements and meet the metrics

● Manage component resources (e.g., devices and traffic) to meet defined availability and performance service levels

● Ensure information management practices and existing IT infrastructure keep pace with each other

● Component tuning to maintain optimum performance

● Develop and implement improvement plans

3.3.3 Telecommunications Support

PWS-MN08: The Contractor shall coordinate with telecommunications vendors, customers, partners, leased circuit providers and other mission systems to troubleshoot network problems, outages, or any other issues impacting a service level agreement.

3.3.4 Preventative and Corrective Maintenance

PWS-MN09: The Contractor shall perform preventative and corrective maintenance, modifications, planned and unplanned activities, and maintain a spares depot for assigned systems at all work locations. This includes the following functions:

● Provide and maintain a Preventative Maintenance Plan [CDRL XX]

● Creation and delivery for Government approval work packages (inclusive of material procurements and test plans) [CDRL XX]

● Quarterly visual inspections of all equipment

● Correcting error conditions per a Help Desk ticketing process

● Perform preventative maintenance on a quarterly basis; coordinate all maintenance schedules and timelines

● Identify system components and software within one year of obsolescence

● Perform all software maintenance functions, patching and software compliance

● Provide IT security maintenance support

● Planned and unplanned maintenance

● Help develop, and maintain, SOP’s

Source Selection Information – See FAR 2.101 and 3.104-4

● Recommend load balancing improvements

● Maintain specialized imagery-scheduling program

● Maintain all Government databases

● Update diagrams of all WAN and LAN data communication connections

● Maintain current satellite operations ground system equipment within acceptable quality levels

● Manage/perform spares depot level repairs, and the return of defective equipment to vendor for repair or replacement

3.3.5 Installation, De-installation and Relocation

PWS-MN10: The Contractor shall provide all schedules for Government approval, and perform all equipment upgrades, installations, de-installations and relocations within the scheduled allotted times; ensure no equipment is damaged during installations, de-installations, or relocations; and ensure 100% of all installations and relocations comply with building and electrical codes (e.g., National Electrical Code).

PWS-MN11: The Contractor shall provide to the authorized Government official for approval a schedule for the implementation of any new hardware installations. The Contractor shall install new hardware after receiving written Government approval.

3.3.6 Web Development Support

PWS-MN12: The contractor shall manage and maintain mission and product webpages and associated content and content delivery services and accounts.

3.3.7 Antenna Maintenance Support

PWS-MN13: The Contractor shall provide all support to perform maintenance activities on NOAA antenna systems in Appendix X2. Antenna support shall only be provided at NSOF.

WCDAS and FCDAS have existing support located onsite.

PWS-MN14: The Contractor shall process and implement an Antenna System Maintenance Plan [CDRLXX] for the OSPO antenna systems, listing daily, weekly, monthly, semi-annual, annual, and any needed inspections necessary. The Contractor shall maintain and submit Antenna System Maintenance Records documenting the maintenance tasks performed on the antenna systems.

3.4 Sustainment

3.4.1 Obsolescence Prevention and Remediation

PWS-SU01: The Contractor shall identify all system hardware components and software within 1 year of obsolescence.

Source Selection Information – See FAR 2.101 and 3.104-4

PWS-SU02: The Contractor shall provide an annual Maintenance Plan. This plan shall capture technical refresh planning, replacement of obsolete hardware and software for assigned systems and address preventative maintenance tasks (including integration, test and check-out sufficient to verify and validate post-maintenance system performance).

3.4.2 Sustainment Support

Sustainment activities are part of a 5-year rolling Government plan associated with scheduled technology refresh windows, enterprise convergence and shared services implementations. As part of the Contractor’s Annual Spend Plan development, the Government and Contractor will reconcile the Contractor’s Preventative Maintenance Plan and the Government’s 5-year Sustainment Plan with available funding to determine a prioritized list of sustainment tasks for the coming year.

PWS-SU03: The Contractor shall track sustainment tasks in the IMS using bi-weekly milestones.

Sustainment task plans and procedures shall be in accordance with SOPs and provide a level of detail and verification commensurate with the cost and complexity of the task. The Government will approve scheduled sustainment activities and provide a minimum of one person per shift who is authorized to approve sustainment activities. Sustainment tasks shall not interfere with or compromise mission system operations.

PWS-SU04: The Contractor shall obtain approval of the Contracting Officer or their designated representative prior to commencing sustainment work.

PWS-SU05: The Contractor shall complete Configuration Change Requests to update all affected documentation, drawings and procedures within 24 hours of completing any sustainment activities.

PWS-SU06 The Contractor shall provide, maintain, and administer a requirements management process and related documentation for any requirements changes. A requirements baseline shall be established and maintained throughout the contract period of performance.

3.4.3 Sustainment Test and Integration

Assigned Systems are software-intensive and will likely require frequent patching and updating for both operational and security purposes. Successful execution will require the Contractor to assist the Government in fast and effective patching, integrating, compiling and testing of small to medium software changes of simple to moderate complexity. If large or complex software development is needed, the Government will write a separate task order.

Source Selection Information – See FAR 2.101 and 3.104-4

Should any existing software source code modifications be required, the Contractor shall identify source code and/or database changes, complete changes per an approved software development standard, ensure a clean software compile, and fully document the code changes.

Sustainment software integration and testing will take place in specified test environments after all documentation and peer reviews are successfully completed. Testing for changes that provide new program scope shall include an end-to-end test that exercises the customer interface per the Interface Requirements Document (IRD) or Interface Control Document (ICD). System tests shall include testing with customer-provided data in a testing environment that is reflective of the customer’s operational environment. Test plans for new capability shall be approved by the Government in advance.

Upon successful completion of testing and Government receipt and approval of the test results, software changes may be deployed into the operational environment. After the Government verifies successful installation, deployment testing will follow.

PWS-SU07: The Contractor shall perform software integration in accordance with documented and approved plans after formal software peer review, including a successful readiness review process, and transition to operations.

PWS-SU08: The Contractor shall permit the Government to observe all software testing.

PWS-SU08: The Contractor shall provide the Government with detailed test plans, test steps, test data sources, and expected outcomes, for review and approval no less than two weeks prior to testing to ensure releases and fixes work as intended.

PWS-SU10: The Contractor shall coordinate proposed system acceptance test schedules with the Government.

PWS-SU12: The Contractor shall maintain all documentation of test results and daily test logs throughout the release, integration and testing phases.

PWS-SU12: At the successful completion of system testing, the Contractor shall provide all test results and/ documentation to the Government

3.4.2 User Access Sustainment

PWS-SU13: The Contractor shall provide and maintain an interactive website which maintains spacecraft events and spacecraft changes.

PWS-SU14: The Contractor shall support website user access sustainment services.

PWS-SU15: The Contractor shall coordinate with the Government to collect website system requirements.

PWS-SU16: The Contractor shall provide and maintain a mobile version of the website.

PWS-SU17: The Contractor shall consolidate common website information, ensuring data accuracy.

3.5 Information & Cyber Security Support

Information and cyber security services for DOC NOAA systems will be implemented on a separate contract vehicle. The scope of information and cyber security support for this contract is to support the OSPO IT Security Program by providing scans, patching, hardening, implementing technical security controls, artifacts for security controls assessments, and technical POA&M milestones.

3.5.1 Information and Cyber Security

PWS-ICS01: The Contractor shall coordinate with NOAA/OSPO’s Information and Cyber Security program’s designated point of contact to assist in implementing the required security controls to ensure confidentiality, integrity and availability of the information resources integral to the successful operation of OSPO satellite and product processing systems.

3.5.2 Security Continuous Monitoring and Situation Awareness

PWS-ICS02: Incident Response : The Contractor shall coordinate and report remedial actions in response to IT Security events or incidents to the NOAA Cyber Incident Response Team (N-CIRT) within the required 24-hour period or as specified in the OSPO Incident Response (IR) Plan.

PWS-ICS03: System and Network Monitoring : The Contractor shall complete monitoring activities of Tier 2 system and security logs, and report issues through applicable means.

PWS-ICS04: System and Network Monitoring : The Contractor shall complete monitoring activities of IT systems and security logs, and report issues through applicable means.

PWS-ICS05: Audit and Logging: The Contractor shall review system monitoring logs and complete reports as documented in the System Security Plans (SSP).

PWS-ICS06: Vulnerability Assessment: The Contractor shall complete required vulnerability assessment activities, including authenticated monthly and quarterly scans and reporting.

PWS-ICS07: The Contractor shall either upload completed vulnerability and configuration compliance scan reports to the NOAA enterprise vulnerability scanning tool or initiate the scans from the enterprise tool by the 1st day of each month for monthly vulnerability scans and website

Source Selection Information – See FAR 2.101 and 3.104-4 scanning, and vulnerability scans on the 15th day of the third month for quarterly scans of the fiscal quarter (12/15/YY, 3/15/YY, 6/15/YY, 9/15/YY), or as modified by NESDIS.

PWS-ICS08: The Contractor shall maintain and update scanning plugins for associated vulnerabilities at least monthly.

PWS-ICS09: The Contractor shall maintain and update scanning products and associated vulnerability at least monthly.

PWS-ICS10: The Contractor shall provide qualified individuals to initiate scans from the NOAA Tenable Security Center or the single user NESSUS tool, the current NOAA standard vulnerability scanning tool. In some cases, other scanning tools may be used for specific components, e.g. WebInspect Enterprise or WebInspect single user for web pages.

PWS-ICS11: The Contractor shall implement federal guidelines for CyberScope reporting as directed by DOC, NOAA, NESDIS, or OSPO policy.

PWS-ICS12: The Contractor shall maintain a Scanning Exclusion List of system components excluded from automated vulnerability scanning due to age, mission, or technical considerations and update and publish monthly through the OSPO Configuration Management process.

PWS-ICS13: The Contractor shall assess all components identified on the Scanning Exclusion List for vulnerabilities using other technical means, including manual evaluation and testing and complete assessments as part of scheduled monthly and quarterly vulnerability assessments ensuring the results are documented.

PWS-ICS14: The Contractor shall remediate vulnerabilities for all components identified on the Scanning Exclusion List.

3.5.2.1 Contingency Planning

PWS-ICS15: The Contractor shall maintain system Disaster Recovery/COOP plans and publish updated plans semi-annually or as established by NOAA policy, and accurately document contingency activities and include in plan updates.

PWS-ICS16: The Contractor shall coordinate with the OSPO IT Security Program to maintain the Contingency Plan Test Plan and Report (CPTPR) documentation and update annually.

PWS-ICS17: The Contractor shall participate in quarterly Contingency Plan training and ensure all staff complete CP training at least semi-annually.

PWS-ICS18: The Contractor shall test the system Contingency Plan annually, test system backup procedures quarterly, and fully document as part of annual Contingency Plan testing.

Source Selection Information – See FAR 2.101 and 3.104-4

3.5.2.2 Flaw Remediation

PWS-ICS19: The Contractor shall identify and report information system vulnerabilities.

PWS-ICS20: The Contractor shall mitigate information system vulnerabilities.

PWS-ICS21: The Contractor shall test software updates related to flaw remediation for effectiveness and potential side effects on all affected OSPO systems before installation.

PWS-ICS22: The Contractor shall maintain and implement DOC, NOAA, or OSPO flaw remediation tools where applicable.

PWS-ICS23: The Contractor shall document in the SSP any component that cannot be patched including reasons such as: age, mission, or technical impact.

3.5.2.3 Malicious Code Protection

PWS-ICS24: The Contractor shall identify and document specific components unable to implement anti-malware protections. If a component cannot implement this control due to age or mission impact, the Contractor shall document the technical and operational considerations, mitigation in the SSP, and request risk acceptance through the FIPS 200.

PWS-ICS25: The Contractor shall maintain and implement the NOAA enterprise anti-malware tool.

3.5.3 Cyber Security Program Management

3.5.3.1 Cyber Security Awareness & Training

PWS-ICS26: All Contractor personnel shall complete all NOAA required training, including, but not limited to: No FEAR Act Training, NOAA Safety Awareness Training, NOAA Safety and Environment Awareness Training, NOAA IT Security Awareness Training.

PWS-ICS27: All Contractor staff shall complete required Role-Based Security Training 30 days before the NOAA required deadline each fiscal year.

3.5.3.2 Cyber Security Assessment & Authorization

3.5.3.2.1 Continuous Monitoring and Assessment & Authorization (A&A)

PWS-ICS28: The Contractor shall support processes that enable NESDIS to achieve compliance with Government security mandates and obtain/maintain an Authority to Operate (ATO) for each system.

Source Selection Information – See FAR 2.101 and 3.104-4

PWS-ICS29: The Contractor shall submit assigned SCA artifacts on time.

3.5.3.2.2 Plans of Action & Milestones (POA&M) Management

PWS-ICS30: The Contractor shall manage technical POA&M milestones using OSPO’s Configuration Management program, including automated tools.

3.5.3.2.3 System Interconnection

PWS-ICS31: The Contractor shall support information requests for all system Interconnection Security Agreements.

PWS-ICS32: The Contractor shall review and implement connections IAW Interface Control Documents (ICD) and report any discrepancies or needed changes to the Government.

3.5.3.2.4 System Security Documentation

PWS-ICS33: The Contractor shall support information requests for Security Authorization Package for all assigned OSPO systems and additional information or documentation required by updates to DOC, NOAA, NESDIS, or OSPO policies and procedures.

3.5.3.3 Security Support for Systems Engineering and Change & Configuration Management

PWS-ICS34: The Contractor shall comply with configuration management requirements per section 3.1.1 of this PWS.

Personnel Security Requirements

Personnel shall be screened in accordance with the requirements for High Risk contracts as specified by CAM 1337.70 Section 2.2 (for non-national security contracts), or Section 2.3 (for national security contracts); specifically, in accordance with CAR 1352.237-70, Security Processing Requirements—High or Moderate Risk Contracts (April 2010) or CAR 1352.237-72, Security Processing Requirements -- National Security Contracts (April 2010). Any access by contract personnel who are Foreign Nationals shall be in accordance with the requirements of CAR 1352.237-73, Foreign National Visitor and Guest Access to Departmental Resources (APR 2010).

Due to the sensitivity of information and systems that the Government is responsible for, the Contractor shall screen and ensure that all personnel performing work under this PWS are cleared for High Risk Positions of Trust. To protect information confidentiality, the Contractor shall ensure that all personnel supporting this PWS sign a Non-Disclosure Agreement (NDA). In addition, the Contractor shall ensure that specifically designated roles such as Hardware Technicians, who are required to work on COMSEC hardware, shall be filled with personnel capable of getting and maintaining at least a SECRET or above security clearance.

The contractor shall submit security forms required by CAR clauses 1352.237-70, 1352.237-72, and 1352.237-73 two (2) weeks prior to each new contract employee’s start of work so that the NOAA staff has sufficient time to process requests for background checks, NOAA badges, and network access.

Source Selection Information – See FAR 2.101 and 3.104-4

Appendix A. NESDIS System Boundary General Correspondence to NESDIS Missions/ Functions

FISMA

System Number

System Name

System General Description No.

Components

Operating systems

NOAA5003 GOES The Geostationary Operational Environmental Satellites (GOES) N/O/P satellite ground system supports a constellation of three GOES satellites in orbit around Earth (GOES-13, GOES-14, and GOES-15), one satellite in orbit around the Sun (Deep Space Climate Observatory— DSCOVR), as well as three antenna stations. These spacecraft were known prior to successful launch as GOES-N, GOES-O, and GOES-P. It provides the information technology (IT) and computing resources necessary to command and control the satellites, to monitor and maintain the state of health of the satellites and the associated payloads, to receive and store instrument data, and transfer to the Environmental Satellite Processing Center (ESPC) and the National Weather Service (NWS). The ground system is located at the NOAA NSOF in Suitland, MD, at the Wallops, VA and Fairbanks, AK Command and Data Acquisition Stations (CDAs) and at the Wallops Backup facility (WBU) located at the NASA Goddard Space Flight Center in Greenbelt, MD.

Components of the GOES N/O/P ground system include:

Antennas, RF/IF distribution systems, NTACS front end processors, Multi-use Data Link (MDL) satellite modems, GOES Telemetry and Command Systems (GTACS) server, MDL Receive System and Servers (MRSS), Sensor Processing Systems (SPS), Orbit Analysis and Tracking Systems (OATS), Product Monitor systems (RPM), GOES Archive Systems (GAS), GOES Backup Subsystem (GBS), User / operator workstations and virtualized workstations, Dynamic Interaction Diagnostic (DID) workstations, External Analysis Transfer Systems (EATS), Satellite and instrument Emulator Systems (Boeing Support Equipment (BSE), SXI Emulator (SXIE)), Interconnecting networks and network hardware, switches and firewalls associated with these systems.

Two other subsystems are included within the GOES NOAA 5003 FISMA boundary: the real-time voice communication system, and the DSCOVR subsystem.

The telecommunications for NOAA satellite operations is a real-time voice communication system used by satellite operators located at the NOAA Satellite Operations Facility (NSOF) in Suitland, MD, the Fairbanks Command and Data Acquisition Station (FCDAS) in Fairbanks, AK, the Wallops Command and Data Acquisition Station (WCDAS) in

838 Brocade

Cisco IDS

CISCO IOS 12.2

CISCO IOS 12.4

CISCO IOS

HP 3PAR IBM

WebSphere DataPower

Integrated Lights Out (iLO)

Linux Kernal

Microsoft Windows 7

Microsoft Windows Server 2003

Microsoft Windows Server 2008

Microsoft Windows Server 2012

RHEL 4

RHEL 6

Solaris 10

Sun OS

Ubuntu 12.04

Ubunto 7.10

Virtual Thin Client

VMware

VMware ESXI 5.1

VMware ESXI 6.0

Source Selection Information – See FAR 2.101 and 3.104-4

Wallops Island, VA and the Consolidated Backup (CBU) facility in Fairmont, WV for satellite launch and 24x7 on-orbit mission operations. It provides a direct communications link between NSOF, FCDAS, CBU and WCDAS. It also provides a direct communications link between these sites, NASA Communications Network (NASCOM) Sites and the Air Force Satellite Control Network (AFSCN), based at Schriever Air Force Base (AFB) in Colorado. This system is currently isolated from all other FISMA networks and is documented as a subsystem within the NOAA_5003 FISMA boundary. The required support includes a Monday-Friday, 8AM-5PM local time Service Level Agreement (SLA) for each deployed site, on site stand-by assistance for no more than two events / year during scheduled events, and after hours support (e.g., potential nights or weekends) if necessary for satellite launches.

The NOAA Deep Space Climate Observatory (DSCOVR) antenna systems operates this satellite at the Lagrange point (L1) between the Sun and Earth to monitor space weather.

NOAA5004 DCS The GOES DCS is a data relay system which enables a large variety of environmental data to be gathered from point sources or Data Collection Platforms (DCP). The purpose of the DCS is to collect data from government-sponsored and government-owned DCPs and disseminate the data to all users of the DCS service. The DCS collects data from DCPs located throughout the hemisphere. DCPs include terrestrial, airborne and tethered platforms measuring such observations as wind speed, wave height, water depth, and temperature.

Users provide their own DCPs with sensors measuring conditions of interest. The primary Data Collection System (DCS) is located within the WCDAS facility. The backup DCS is located at the NSOF.

The key DCS work areas cover systems documentation updates, user/operator procedures and training, and System Incident Reports (SIR) response/resolution. Support for the DCS ground system may also include strategic planning, concept development, requirements analysis, system engineering, integration/installation, acceptance test and evaluation, integrated logistics support, training and documentation to upgrade systems.

The Contractor shall operate, maintain and sustain the systems and subsystems comprising the DCS ground system, but not the DCPs; the DCPs are owned, operated, and maintained by the user/operators. The GOES DCS ground system processes and logs data from the DCPs, and distributes the data to registered users (federal, state and local agencies). The DCS distributes data via a domestic satellite

103 Barracuda Web Filter

Brocade

Cisco ACS

Cisco ASA

Cicso IOS

Cisco IPS

Dell SAM iDRAC 6

VMware ESXI 5.5

Windows 7

Windows Server 2008

Windows Server 2012

Source Selection Information – See FAR 2.101 and 3.104-4

(DOMSAT) direct broadcast circuit. The system also automatically transmits selected DCP data to National Weather Service (NWS) users via the Internet and the National Weather Service Telecommunications Gateway (NWSTG). Many other users access the data through the Internet.

NOAA 5026 POES The NOAA Polar Operational Environmental Satellites (POES) ground system provides the IT and computing resources necessary to command and control the POES satellites, to monitor and maintain the state of health of the satellites and the associated payloads, to receive and store instrument weather and environmental data, and transfer the weather data to the Environmental Satellite Processing Center (ESPC) and the European Organization for the Exploitation of Meteorological Satellites (EUMETSAT). The POES satellite ground systems and equipment are located at Suitland, MD, Wallops, VA and Fairbanks, AK CDAs, and Barrow, AK. It also consists of multiple antenna assets located primarily in Wallops, VA, and Fairbanks and Barrow, AK. The ground system includes the Polar Acquisition and Command System (PACS) which provides spacecraft command and control, monitoring of health of spacecraft via telemetry, and retrieves environmental data for ESPC, and the Satellite Operations Management Subsystem (SOMS), a software scheduling subsystem that automates the data transfer and supports antenna contacts for POES, European Meteorological Operational Satellite (Metop), and Jason satellites, as well as Landsat-8

The contractor shall operate, maintain and sustain the systems and subsystems comprising the POES ground system, including multi-mission antenna assets. These systems includes PACS; which supports the POES mission; the Initial Joint Polar System (IJPS) ground system equipment, which supports the EUMETSAT missions; the SOMS which supports the POES, Metop, and Jason missions; and the NOAA Polar Acquisition Subsystem (NPAS) equipment, to include the EPOCH Low Earth Orbiting Terminal (LEO-T), antenna systems at the Wallops, Barrow, and Fairbanks CDAs which support the POES, Metop, Jason, Defense Meteorological Satellite Program (DMSP), Suomi National Polar-orbiting Partnership (SNPP); and assorted NASA missions that provide critical weather to NOAA’s National Weather, Ocean, and Fisheries Services and the Department of Defense.

457 Appliance

Brocade

Cyber Switching ePower PDU

DATUM

Dell IDRAC

Dell Switch OS

FB Tape Library

Free BSD iLO

OILAN

LG

Linux Kernal

Mac OS X

Microsoft Windows 7

Microsoft Windows Server 2003

Microsoft Windows Server 2008

Microsoft Windows Server 2008 R2

NetApp 8.2.2P1

NetBSD

OpenVMS

Printers

Red Hat Enterprise Linux

RHEL 5

Source Selection Information – See FAR 2.101 and 3.104-4

RHEL 6

SUSE Linux Enterprise 11

Tru64 Unix

VMS

VMware ESXi6

VxWorks

WI Tale Library

Xiplink OS

NOAA5042 JPSS Polar-orbiting environmental satellites provide mission data used to understand and predict changes in weather, climate, oceans, coasts, and space.