Performance Work Statement 2023 05 03 - M-PAGES v03.docx

The National Geodetic Survey M-PAGES improvements

I. SCOPE

The National Geodetic Survey (NGS) is a program office under the National Ocean Service (NOS). NGS provides the framework for all positioning activities in the Nation. The foundational elements - latitude, longitude, elevation, shoreline information and their changes over time - contribute to informed decision making and impact a wide range of important activities including mapping and charting, navigation, flood risk determination, transportation, land use and ecosystem management. NGS' authoritative spatial data, models, and tools are vital for the protection and management of natural and manmade resources and support the economic prosperity and environmental health of the Nation.

In providing this service for the Nation, NGS routinely processes vast amounts of data from Global Navigation Satellite Systems (GNSS). Historically, NGS has had capabilities to use only the U.S. Global Positioning System (GPS) data. Adding capability for multi-GNSS processing is an important part of NSRS modernization, allowing NGS to provide increased positioning accuracy with shorter occupations. To add this capability, NGS has developed its own multi-GNSS processing software, called M-PAGES.

M-PAGES is written primarily in C++11, with supporting scripts in Python and extensive HTML documentation. M-PAGES is capable of processing RINEX 2.x and 3.x data from all Global Navigation Satellite Systems (GNSS) with two or more frequencies: GPS, GLONASS, Galileo, BeiDou and QZSS. The M-PAGES suite includes single-difference and double-difference solution methods, and was written to allow future expansion to precise point positioning (PPP). At this time M-PAGES is used strictly to position ground-based receivers in NGS’s OPUS services. In the near future, M-PAGES will be used for monitoring coordinates of the NOAA CORS Network, and capabilities will be expanded for orbit determination as part of NGS’s participation in the International GNSS Service (IGS) as an Analysis Center.

Interested parties can learn more about M-PAGES current approach, capabilities, and performance from the 2022 August NGS webinar on this topic: https://geodesy.noaa.gov/web/science_edu/webinar_series/multi-ngss-world-at-ngs.shtml.

II. DESCRIPTION OF WORK

Access to the M-PAGES code will be provided on request to evaluate the level of effort.

The M-PAGES software is currently operational and producing excellent results for small-network cases. At this time, NGS is only using the software to post-process data and yield the position of ground-based static GNSS receivers (not orbit solutions, or positioning kinematic platforms).

In brief, the software takes in GNSS observations and orbits, models the GNSS observations, builds a system of normal equations which obey the observation model for GNSS signals, and solves the system of equations using least squares. This contract addresses only the last stages - improvements to building and solving the system of equations.

The code which builds and solves the system of equations is called SdSolve, for “single difference solution”. This program is written in object-oriented C++ and uses the Eigen libraries for matrix manipulations. The following C++ pseudocode demonstrates the overall flow of SdSolve:

loadConfigFiles() initialize() // set up parameters while (!AmbFixed) { iterateSolution() initNormalEquations(TempParams) while (CurrentEpoch <= EndTime) {

addConstraints() X_HAT = solve() // calls appropriate GMM solver

computePostFitResiduals() writeJsonOutputFile()

Note that the software applies different types of constraints to GNSS parameters. Cholesky factorization is used to manipulate the sparse system of equations. The appropriate Gauss Markov Model (GMM) is used to solve the equations. For the application of positioning ground-based static receivers, the software solves for station positions and integer biases (ambiguities) as well as related GNSS parameters (station biases, clocks, troposphere).

Given the above, only vendors with deep GNSS expertise plus experience with large matrix manipulation and associated linear algebra numerical methods can be expected to understand the complexity of the observation and adjustment models and current (functional but slow) algorithm, and be capable of satisfying the contract terms.

Tests show that current M-PAGES normal equation construction and reduction methods are inefficient for the large data volume of large network adjustments. The NGS-developed SdSolve algorithm shows an exponential growth in runtime as data are added to the adjustment. As shown in the below test of M-PAGES v0.7.0 network processing, processing times are acceptable for 10 or fewer stations but quickly become onerous with additional data (in this case, more stations, but the same issues are expected for higher rate data or more GNSS systems observed). Most parts of the M-PAGES data processing flow grow linearly or not at all as the size of the problem is increased, whereas the “Solve” portion (normal equation construction, reduction, and solution) exhibits exponential growth in runtimes.

Runtime information for M-PAGES v0.7.0 network processing, using 16 hours of 30-sec GPS-only data at stations in Missouri, as a function of number of stations in the adjustment.

Reasonable expectations for M-PAGES runtimes are based on the current behavior of current NGS products. OPUS-Projects currently allows users to process up to 100 stations in a session (although this is rare). Small projects take about 5 minutes to complete, whereas the largest sessions can take up to an hour to run (Daniel Gillins, personal communication, 2022 Oct 06). Therefore M-PAGES should, at minimum, be able to process a GPS-only adjustment of 100 user stations (99 baselines) in less than 1 hour.

III. TASKS

Under the guidance of the M-PAGES Project Manager, perform the following tasks:

a) Become familiar with M-PAGES code and documentation as written; documentation will be provided by NGS

b) Improve wall-clock performance of M-PAGES with large networks

i) Profile M-PAGES performance, identifying main reasons for exponential growth in wall-clock time as a function of stations.

ii) Recommend solutions/algorithm improvements which address each of the issues identified in (bi). Either (a) provide improved code to be used directly in M-PAGES, or (b) provide guidance to M-PAGES team to implement solutions, at the discretion of the M-PAGES project manager.

VI. IT SECURITY REQUIREMENTS AND GOVERNMENT FURNISHED MATERIALS

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The Contractor shall comply with the following DOC Department Administrative Orders (DAO): DAO 200-0 Department of Commerce Handbooks and Manuals and DAO 207-1 Security Programs (available at: https://www.osec.doc.gov/opog/dmp/daos.html). The Contractor shall comply with the following DOC Department Organization Orders (DOOs) DOO 15-23 Chief Information Officer (available at: https://www.osec.doc.gov/opog/dmp/doos.html). The Contractor shall comply with the NOAA Administrative Orders (NAO) NAO 212-13 NOAA Information Technology Security Policy and NAO 212-15 Management of Environmental Data and Information (available at: https://www.noaa.gov/organization/administration/noaa-administrative-orders). DOC issues policies under DAO 200-0, DAO 207-1 and DOO 15-23. NOAA issues cybersecurity policies under NAO 212-13. The DAO, DOO, NAO and corresponding policies are sensitive controlled unclassified information (CUI) documents that shall be limited to use only on Government Furnished Equipment and will be provide after contract award.

The DAOs, DOO and NAOs and corresponding policies may not specifically identify requirements for Contractor developed solutions residing within their area of responsibility (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component, etc.), but the Contractor developed solutions shall comply with the applicable cybersecurity requirements. The Contractor shall work with the government assigned Information System Security Officer (ISSO) to determine the applicable cybersecurity requirements that must be addressed. The Contractor shall ensure the developed solutions and/or acquiring information technology or service(s) are engineered for trustworthy and cybersecurity. The Contractor shall throughout the lifecycle of this contract all developed/acquired solutions are consistent with the engineering-based trustworthy secure solutions as outlined in NIST Special Publication 800-160 Version 1, Revision 1 Engineering Trustworthy Secure Systems (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1r1.pdf) and NIST Special Publication 800-160, Volume 2, Revision 1 Developing Cyber-Resilient Systems: A Systems Security Engineering Approach (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf) or later publication.

The Contractor shall ensure all work is performed upon government furnished equipment and/or information technology and/or service(s) residing within the ISSO assigned FISMA boundary. If additional information technology and/or service(s) is/are needed, the contractor shall submit a request for the additional requirements to the Contracting Officer Representative (COR).

The Contractor shall work with the government assigned ISSO for identifying security and privacy controls, documenting security and privacy controls and ongoing continuous monitoring of security and privacy controls in support DOC, NOAA and NOS cybersecurity requirements. The Contractor shall provide their security and privacy controls implementation including applicable architecture, diagrams, documentation, standard operating procedures, secure baselines and other relevant documentation supporting the development and operation of their solution. The Contractor shall work with the government assigned ISSO to ensure developed solutions obtain baseline deviation approval, and implementation of a secure baseline/benchmark is applied to all components (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component, etc.) supporting their developed solutions residing within their area of responsibility prior to being placed into production.

The Contractor shall work with the government assigned ISSO to ensure all components (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component, etc.) supporting their developed solutions residing within their area of responsibility undergo vulnerability scanning, secure baseline compliance scanning and mitigation of vulnerabilities and/or compliance findings. The Contractor shall provide the appropriate documentation to the government for each update demonstrating the requirements have been met prior to placing the changes into production. The Contractor shall perform vulnerability scanning and remediation on all public facing components residing within their area of responsibility (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component, etc.) at least every 7 days and non-public components residing within their area of responsibility at least every 60 days. The Government may shorten vulnerability scanning and remediation requirements for vulnerabilities designated as significant risk. The Contractor shall perform secure baseline scanning at least monthly on all components (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component, etc.) supporting their developed solutions residing within their area of responsibility. The Contractor shall work with the government assigned ISSO to address all baseline deviation(s) not approved upon detection within 60 days for all components (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component, etc.) supporting their developed solutions residing within their area of responsibility. The Contractor shall throughout the lifecycle of this contract provide updates to their developed solution residing within their area of responsibility when changes to their solution(s), policy changes and/or changes to NIST guidance and legislation.

The Contractor shall ensure their developed solutions residing within their area of responsibility does not contain any spyware, malicious software, coding flaws or programming backdoors to circumvent the application functionality or the security of the application as described by the government. The Contractor shall ensure their developed solutions residing within their area of responsibility does not access data stored on the device or request end user information without following all government (including OMB) requirements. The Contractor shall ensure their developed solutions residing within their area of responsibility does not transmit stored data from the installed device without clearly notifying, fully describing the required data being transmitted and receiving the government’s approval.

The Contractor shall work with the government assigned ISSO to ensure secure management of user credentials (storing, transmitting, authenticating of user credentials shall be encrypted).

The Contractor shall ensure cybersecurity and privacy requirements are included into needs assessment, requirements gathering, development and testing by the Contractor for all solutions by the Contractor. The Contractor shall incorporate the cybersecurity and privacy requirements into the development lifecycle along with the user functional requirements for their developed solutions residing within their area of responsibility. The Contractor shall ensure data encryption in transit and secure authentication for their developed solutions residing within their area of responsibility.

The Contractor shall work with the government assigned ISSO perform a full source code review and application code scanning for vulnerabilities and remediation on all public facing components residing within their area of responsibility (e.g., application(s), web site(s), database(s), servers, virtual machine(s), network component, etc.) at least every 7 days and non-public components residing within their area of responsibility at least every 60 days. The Government may shorten vulnerability scanning and remediation requirements for vulnerabilities designated as significant risk. Any identified source code review deficiencies or scanner identified vulnerabilities and/or secure baseline findings, the Contractor shall mitigate and any other generated supporting documentation including the raw vulnerability scanner reports shall be provided. The Contractor shall ensure all source code updates undergo a full source code review, full source code scanning and mitigation of vulnerabilities and secure baseline findings with the appropriate documentation provided to the government for each update demonstrating this security requirement has been maintained. The Contractor shall provide the source code to the government for each product update, enhancement and/or security flaw remediation.

The Contractor shall provide, as necessary, periodic training whenever the contractor introduces new processes, new technology or when the Contractor changes existing processes or technology. The Contractor shall thoroughly document all processes and technology changes. The Contractor shall mentor government identified personnel regarding the new or changed process or technologies. When there is a transition within the Contractor’s staffing, the Contractor shall be responsible for ensuring the incoming personnel is trained and fully versed on contract requirements, any outstanding project deadlines, roles and responsibilities before the new person arrives on the job. In the case of when the services of the contractor are no longer required, the Contractor shall begin the knowledge transfer to government personnel or its designated representative at least three weeks before the final contract termination date.

The Contractor shall guarantee strict confidentiality of the information/data when the Government identifies Government Furnished Information/data, controlled unclassified information (CUI) and/or information/data generated during the performance of the task order is of a sensitive nature. Disclosure of the information/data, in whole or in part, by the contractor can only be made after the contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the contract, the contractor shall obtain a written determination from the Contracting Officer. The Contractor shall agree not to publish or otherwise divulge such information in whole or part, in any manner or form, nor to authorize or permit others to do so. The Contractor shall take such reasonable measures as are necessary to restrict access to such information while in the contractor’s possession, to those employees needing such information to perform the work provided herein, e.g., on a “need to know” basis.

The Government may grant the Contractor access to Government operated applications, internal file server(s), Government collaboration tool(s) leveraging Google Workspace (i.e., Sites, Drive, Docs, Sheets, Slides, Forms. etc.) and/or internal SharePoint portal(s) for storing and collaborating with NOS organizations in the performance of this contract. All information residing in Government operated application(s), file server(s), Government collaboration tool(s) leveraging Google Workspace and SharePoint portal(s) are designated as controlled unclassified information (CUI) and the Contractor shall protect the information at all times.

The Contractor shall ensure all contract deliverables where information technology used to create deliverables and Information Technology and/or service(s) provided to the Government in performance of the contract complies with DOC and NOAA Supply Chain Risk Management requirements.

To the greatest extent possible, the contractor shall scan all electronic information/data/software passed to/from NOAA with multiple commercial malicious software detection and removal products (e.g. anti-virus software, anti-malware, anti-spyware, etc.) prior to use by either entity. To the greatest extent possible, the contractor shall ensure the electronic information, data and/or software provided to the Government is free of known malicious software.

The Contractor shall comply with the DOC Personally Identifiable Information (PII), Business Identifiable Information (PII), and Privacy Act Breach Response and Notification Plan. The Contractor shall contact the government assigned ISSO immediately upon detection and/or notification of a breach of PII and/or BII. The Contractor shall upon request assist the Government when a compromise and/or loss of PII and/or BII. Contractor access to proprietary information is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the Privacy Act, OMB M06-16 (PII) and other pertinent laws and regulations governing the confidentiality of privileged information and Safeguarding Controlled Unclassified Information (CUI) or Sensitive But Unclassified (SBU) or For Official Use Only (FOUO) designated Information. The Contracting Officer may add the following privacy related contract clauses FAR 52.224-1 and FAR 52.224-2 to this contract and applies to both electronic and hardcopy information/data.

The Contractor shall work with the COR prior to sending the deliverables to determine if the information to be transferred requires protection. The Contractor shall protect sensitive information and/or non-public information from unauthorized disclosure and/or modification. The Contractor shall work with the Government assigned Information System Security Officer (ISSO) to determine the applicable sensitive security requirements. If secure transfer is required, the Contract shall ensure no sensitive information is sent using a non-encrypted format. The Contractor shall implement transmission and storage of sensitive information to meet or exceed the National Institute of Standards and Technology (NIST) Federal Information Processing FIPS 140-2 and/or 140-3 Security Requirements for Cryptographic Modules using validated cryptographic module(s). Specifically, the body of the email shall not contain sensitive information unless it is encrypted. The Contractor is permitted to use the DOC approved secure file transfer solution, Kiteworks, for transmitting sensitive email messages and attached files. The Contractor shall encrypt any sensitive information that will be sent electronically (e.g., email), sensitive information includes but not limited to:

a) Personally identifiable information (PII), sensitive PII and/or Business-identifiable information (BII),

b) Non-public information and/or data,

c) Information that requires Government approval prior to release to the public,

d) All information describing the implementation, configuration, settings, etc. (e.g., Information Technology (IT) configuration, IT management, IT security (e.g., security incidents (reporting, handling and mitigation) and security assessment documentation), IT administration, IT architecture, IT network management (e.g., firewall, router, switch management) and/or information obtained while performing privileged access roles),

e) Source code and/or database schema,

f) The vulnerability scanning, secure baselines scanning and/or mitigation results,

g) The secure baseline deviations,

h) Internet Protocol, subnet mask and similar identification,

i) System or component inventory information (hostname, IP address, MAC address, location, operating system, etc.).

The Contractor shall not destroy any information unless specifically authorized by the Contracting Officer Representative/Task Manager. The Contractor upon request of the COR/TM shall use one of the approved methods for secure destruction of unclassified but sensitive information. Approved methods include NIST Special Publications 800-88 Guidelines for Media Sanitization (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) or the National Security Agency in the Media Destruction Guidance (https://www.nsa.gov/resources/everyone/media-destruction/). .

DOC ownership rights over data including PII/BII ‘‘Ownership’’ means the sole owner and has all rights to use, modify, reproduce, perform, display, release, or disclose a work in whole or in part, in any manner, and for any purpose whatsoever, and to have or authorize others to do so.

a) The term ‘‘works’’ includes all information and material developed in the performance of contract and submitted deliverables.

b) The Government shall have ownership of all works produced, created, or generated and required to be delivered under this contract.

c) The Government shall have ownership of all Government furnished information provided to the Contract in the performance of this contract.

V. DELIVERABLES

VI. CONTRACT PERIOD OF PERFORMANCE – 8 Months from Date of Award

VII. TECHNICAL POINT OF CONTACT

The Technical Point of Contact for M-PAGES is Andria Bilich who will be responsible for technical guidance to the contractor and should a dispute arise shall inform the Contracting Officer. This is not a personal services contract and the Technical Point of Contact or no other Federal employee will personally “supervise” the contractor.

image1.png image2.png