PWS - Research Security Program.docx.pdf

(IRMP TASK ORDER) Performance Work Statement (PWS)

Version 1.3

U.S. Department of Commerce (NOAA/ OCIO/ Internal Risk Mitigation

Program/ Research Security Program) Performance Work Statement

June 30, 2025

PART 1

INFORMATION

1.0 Detailed PWS Information

Background:This program will enhance the agency’s ability to secure sensitive research data, intellectual property, and systems across federal research environments.

NOAA is seeking a contractor to develop and implement a Federal Research Security Program that complies with the implementation guidance for National Security Presidential Memorandum-33 (NSPM-33) on National Security Strategy for United States Government-Supported Research and Development. As a designated federal research agency subject to NSPM-33, the program requirements focus on ensuring the protection of critical technologies and intellectual property, preventing foreign influence, and safeguarding national security within the context of federally funded research. As a key document for securing U.S. research and technological advancements, NSPM-33 provides guidance on strengthening cybersecurity, risk management, and compliance with export controls for research environments. The NOAA Internal Risk Office is responsible for developing, implementing, and managing a NOAA Research Security Program.

1.02 Objectives:

The primary objective of this effort is to create and implement a comprehensive Federal Research Security Program based on NSPM-33 implementation guidelines. The program will support the agency in enhancing cybersecurity, mitigating risks associated with research data, ensuring compliance with federal security regulations, and establishing a culture of security within NOAA research environments.

1.03 Tasks

Task 1: Assessment and Gap Analysis

● Perform an assessment of NOAAs current research security environment, including existing policies, procedures, and technologies. Identify NOAA policies that need to be updated to comply with NSPM-33 requirements.

● Conduct a gap analysis to identify deficiencies in current security measures and non-compliance with NSPM-33 provisions.

● Deliver a report outlining findings and recommended improvements to align with NSPM-33 and improve research security.

● Assess and map where NOAA research activities involve critical and emerging technologies as defined by NSPM-33 and other relevant directives including the White House Critical and Emerging Technologies (CET) List

● Assess NOAA Foreign National Registration System (FNRS) for compatibility to current meet operational needs

Task 2: Program Design and Framework Development

● Develop a customized NOAA Research Security Program framework based on NSPM-33 implementation guidance, NIST IR 8484, and aligned with federal cybersecurity standards and associated frameworks.

● Develop a strategy for ensuring compliance with NSPM-33’s security requirements across NOAA research operations.

Task 3: Policy and Procedure Development https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-united-states-government-supported-research-development-national-security-policy/ https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-united-states-government-supported-research-development-national-security-policy/ https://nvlpubs.nist.gov/nistpubs/ir/2023/NIST.IR.8484.pdf https://nvlpubs.nist.gov/nistpubs/ir/2023/NIST.IR.8484.pdf

● Draft and implement comprehensive research security policies and procedures that adhere to the implementation guidance of

NSPM-33

● Identify NOAA critical technologies and deliver a NOAA Critical Assets List

● Develop standardized disclosure requirements, disclosure forms and formats, requirements for peer reviewer and advisory committee member disclosure of affiliations and positions and additional disclosure requirements outlined in NSPM-33

● Identify current capabilities and develop due Diligence process (classified (JWICS) and unclassified)

● Identify current capabilities and develop procedures to collaborate with other federal agencies and stakeholders

● Develop clear instructions on how NOAA covered institutions can satisfy applicable NSPM-33 requirements

● Develop how NOAA will incorporate digital persistent identifiers (DPIs) into disclosure processes

● Develop consequences for Violation of Disclosure Requirements

● Develop risk register to be incorporated into the NOAA Risk Expert Network (REN)

● Develop SOP for Research Security support to NOAA SBIR due diligence process

Task 4: Implementation of NOAA Export Control Policies

● Develop a NOAA wide Export Control Policy compliant with NSPM-33 and related security requirements

● Assess current NOAA Technology Control Plans and provide recommendations on changes to support NSPM-33 requirements

Task 5: Training and Awareness Programs

● Develop training programs for all research staff, including federal employees, contractors, and uniformed services, on security best practices and the new policies and procedures.

● Create specialized training for personnel handling sensitive research data and those involved in risk management processes.

Task 6: Incident Response and Testing

● Develop an incident response plan tailored to research security related risks/threats.

● Conduct tabletop exercises and simulations to test NOAA’s readiness to respond to incidents in research environments.

● Revise and update the incident response plan based on test results, evolving threats, and feedback from participants.

Task 7: Ongoing Monitoring and Compliance

● Establish a continuous monitoring system to ensure compliance with NSPM-33

● Develop research security assessments to identify vulnerabilities, monitor adherence to the security program, and track improvements over time.

● Develop monthly or quarterly compliance reports outlining security status, risks, threats, and any actions taken to address gaps.

Task 8: Research Security Program Programmatic Implementation

Capture government requirements and integrate industry best practice based recommendations in order to facilitate the development of the following tasks:

● Define operational objectives for securing intellectual property and research data across various federal research institutions.

● Establish a governance structure, including roles, responsibilities, and coordination mechanisms, to ensure program effectiveness.

● Identify formalized framework to address security risks, including nation-state threats, cyberattacks, and vulnerabilities within the supply chain.

● Develop a comprehensive strategy for complying with national security policies, including NSPM-33, and ensuring that federal research security standards are met.

● Integrate industry best practices for cybersecurity, intellectual property protection, and risk management specific to the research environment.

● Design a compliance framework for continuous monitoring, reporting, and risk mitigation across all research-related operations.

● Establish an incident response plan that includes protocols for addressing security breaches, with a focus on minimizing damage to research assets

1.04 Deliverables

Task Deliverable Deliverable Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria

Task 1: Assessment and Gap Analysis

Assessment Report

A comprehensive report detailing NOAA’s current research security environment.

Review of existing policies, procedures, technologies, and current security measures.

Identification of gaps and deficiencies with

NSPM-33

compliance. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Must identify gaps and non-compliance with NSPM-33 requirements.

Alignment with best practices for mitigating nation-state threats and supply chain risks is required.

Task 1: Assessment and Gap Analysis

Gap Analysis Report

Detailed report of deficiencies in current security measures and areas of non-compliance.

Specific gap analysis findings and impact on security posture.

Recommendations for improvement. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Deliverable must identify and document areas where NOAA security protocols fall short of industry best practices in mitigating cyber and research

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria security risks.

Task 1: Assessment and Gap Analysis

Policy Update Recommendati ons

List of policies to be updated to meet NSPM-33 compliance.

Detailed list of policies requiring updates with rationale and proposed changes. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Recommendations must align with federal security standards and best practices for nation-state threat intelligence and cyber risk management.

Task 1: Assessment and Gap Analysis

Critical and Emerging Technologies Mapping

A map of NOAA research activities involving critical and emerging technologies.

Mapping of technologies identified in NSPM-33, including risk assessments and compliance checks. One-time

PDF or Excel Sheet

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Must include mapping in line with federal standards and best practices for identifying and securing critical technologies.

Task 1: Assessment and Gap Analysis

FNRS

Compatibility Assessment

An assessment of NOAA’s Foreign National Registration System.

Assessment of FNRS compatibility with operational needs and recommendations for One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Compatibility must meet both operational needs and federal security guidelines, addressing potential

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria improvement. vulnerabilities in handling foreign nationals.

Task 2: Program Design and Framework Development

Customized Research Security Program Framework

A customized framework based on NSPM-33, NIST IR 8484, and federal cybersecurity standards.

Full framework design with compliance strategies and best practices for implementation. One-time

PDF or PowerPoint Presentation

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Framework must include nation-state threat management, supply chain risk assessments, and the integration of emerging technologies.

Task 2: Program Design and Framework Development

Compliance Strategy Document

Strategy document to ensure ongoing compliance across

NOAA.

Clear strategy for implementing and maintaining compliance with NSPM-33, including roles and responsibilities. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Strategy must be clear, feasible, and measurable, with defined milestones for compliance and risk mitigation.

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria

Task 3: Policy and Procedure Development

Research Security Policies and Procedures

Comprehensive policies and procedures for research security based on NSPM-33.

Set of research security policies, procedures, and processes to guide day-to-day operations. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Must align with federal security standards, integrating best practices for cybersecurity and mitigating advanced threats (e.g., nation-state actors).

Task 3: Policy and Procedure Development

NOAA Critical Assets List

List of critical technologies identified for NOAA research activities.

A comprehensive list of critical technologies with associated risk assessments. One-time

Excel Sheet or PDF

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

List must reflect the importance of securing critical technologies and intellectual property from cyber threats.

Task 3: Policy and Procedure Development

Standardized Disclosure Requirements

Templates and formats for disclosure forms and peer reviewer/advisory committee member disclosures.

Detailed requirements and templates for disclosures, including necessary affiliations and positions. One-time

Word or Excel Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Must align with NSPM-33 guidelines, ensuring full transparency in research collaboration and mitigating risks

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria associated with foreign influence.

Task 3: Policy and Procedure Development

Due Diligence Process Documentation

Process for classified (JWICS) and unclassified due diligence.

Clear documentation outlining due diligence steps for both classified and unclassified research. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Process documentation must incorporate industry best practices for protecting sensitive information and intellectual property.

Task 3: Policy and Procedure Development

Collaboration Procedures

Procedures for collaborating with federal agencies and stakeholders.

Document outlining collaboration processes and security protocols for joint research initiatives. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Procedures must follow federal interagency collaboration protocols, ensuring that all research partners adhere to appropriate security standards.

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria

Task 3: Policy and Procedure Development

Compliance Instructions for Institutions

Detailed guidance for NOAA institutions on NSPM-33 compliance.

Clear instructions on steps for NOAA institutions to comply with NSPM-33. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Must ensure comprehensive understanding of NSPM-33 compliance steps, addressing research security needs and national security risks.

Task 3: Policy and Procedure Development

DPI Integration Guidance

Instructions on incorporating digital persistent identifiers into the disclosure process.

Detailed guidelines on how DPIs should be integrated into research security processes. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Guidance must include clear instructions on using DPIs for research tracking and intellectual property protection.

Task 3: Policy and Procedure Development

Disclosure Violations Consequences

Documentation on the consequences for disclosure violations.

Clear consequences for violations, including penalties and remedial actions. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Must align with federal guidelines and best practices for managing research-related disclosures and

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria ensuring compliance.

Task 3: Policy and Procedure Development Risk Register

A risk register to be incorporated into NOAA Risk Expert Network

(REN).

A detailed risk register with identified risks, mitigation strategies, and compliance tracking. One-time

Excel Sheet or PDF

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Must be comprehensive, tracking identified risks, vulnerabilities, and proposed mitigation strategies.

Task 3: Policy and Procedure Development

SOP for SBIR Due Diligence

SOP for research security support for NOAA SBIR due diligence.

A detailed SOP outlining the due diligence process in line with research security best practices. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

SOP must be clear, ensuring due diligence is conducted in compliance with federal security standards for SBIR activities.

Task 4: Export Control Policies Implementation

NOAA Export Control Policy

A compliant NOAA-wide export control policy.

A detailed export control policy document aligned with NSPM-33 and federal requirements. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Policy must meet export control requirements under NSPM-33 and other federal regulations, including robust

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria checks for nation-state threats.

Task 4: Export Control Policies Implementation

Technology Control Plan Assessment

Recommendations for changes to current NOAA Technology Control Plans.

Assessment report on existing control plans with actionable recommendations for improvements. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Assessment must ensure alignment with industry standards for securing critical technologies from external threats.

Task 5: Training and Awareness Programs

Research Security Training Program

Training program for research staff on security best practices and new policies.

Training modules for various levels of staff, including contractors and uniformed services.

One-time, ongoing updates

PowerPoint or Online Learning Module

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Training must integrate national security threat awareness, cyber risk management, and secure research practices.

Task 5: Training and Awareness Programs

Specialized Training Materials

Materials for personnel handling sensitive data and involved in risk management.

Tailored training materials for handling sensitive research data and security risks.

One-time, ongoing updates

PDF,

PowerPoint, or Online Learning Module

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Materials must be effective and comply with federal regulations on sensitive data handling and

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria intellectual property protection.

Task 6: Incident Response and Testing

Incident Response Plan

A tailored incident response plan for research-related security threats.

Detailed response plan covering roles, responsibilities, and processes in handling incidents. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

The plan must ensure a swift and effective response to nation-state cyber threats and supply chain security incidents.

Task 6: Incident Response and Testing

Tabletop Exercise Report

Report on tabletop exercises and simulations testing readiness.

Summary of exercises, lessons learned, and areas for improvement.

Semi-annu al

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

The report must identify gaps and provide actionable recommendations for improving research security and threat mitigation.

Task 6: Incident Response and Testing

Updated Incident Response Plan

Revised plan based on testing results and evolving threats.

Updated version of the incident response plan incorporating feedback and evolving security As needed

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Revised plan must integrate feedback from tabletop exercises and adapt to emerging national

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria threats. security threats.

Task 7: Ongoing Monitoring and Compliance

Continuous Monitoring System Plan

Plan detailing how continuous monitoring will be conducted to ensure compliance with

NSPM-33.

Detailed plan for establishing and maintaining continuous monitoring systems. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

The plan must include ongoing monitoring of cybersecurity risks, with integration of advanced risk management tools to track compliance.

Task 7: Ongoing Monitoring and Compliance

Research Security Assessment Reports

Regular security assessments identifying vulnerabilities and tracking improvements.

Regular security assessments with actionable recommendations for improvement.

Monthly or Quarterly

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Reports must be timely, comprehensive, and actionable to ensure continuous improvement in research security.

Task 7: Ongoing Monitoring and Compliance

Compliance Reports

Monthly/quarterly reports outlining the status of compliance.

Detailed reports on compliance with security protocols, risks, and actions taken.

Monthly or Quarterly

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Reports must clearly identify compliance status, document actions taken to resolve

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria non-compliance, and measure progress over time.

Task 8: Programmatic Implementation

Concept of Operations

(CONOPS)

A programmatic CONOPS document that outlines the operational vision and execution plan.

Clear description of the program's operations, goals, resources, and workflows. One-time

PDF or PowerPoint

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

CONOPS must reflect the operational vision, address emerging cybersecurity threats, and incorporate best practices for research security.

Task 8: Programmatic Implementation

Implementation Roadmap

A strategic roadmap outlining steps for the program's phased rollout.

Milestones, timelines, resource allocation, and task dependencies. One-time

PDF or Word Document

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Roadmap must reflect strategic planning, including security risk assessments and deployment milestones.

Description

Deliverable Required Content Frequency

Medium/For mat of

Deliverable Submit To Deliverable

Acceptance Criteria

Task 8: Programmatic Implementation

Working Group Development & Support

Working group structure, process diagrams, and support plan.

Documentation of working group roles, processes, training plans, and workflow diagrams.

One-time, ongoing

PDF,

PowerPoint

COR, TM, Research Security Program Director, IRMP Director, IRMP Deputy Director

Must include a clear development plan with comprehensive workflows for operational support and stakeholder collaboration.

1.04.1 Deliverable Process

3-Month Review Phase and Approval Process

For each deliverable, a 3-month review phase is implemented after the vendor submits the draft deliverable to NOAA for review.

The following steps are involved:

1. Vendor Draft Delivery: Vendor submits the draft deliverable (e.g., report, framework, plan) to NOAA.

2. NOAA Review: NOAA reviews the draft deliverable for completeness, quality, and alignment with requirements.

3. Feedback & Revisions: NOAA provides feedback and requests necessary revisions or additional details (workflows, process diagrams, reference guides, etc.).

4. Vendor Resubmission: Vendor resubmits the revised deliverable, including all requested changes, corrections, and additions

(with workflows and reference guides).

5. Final Approval: NOAA performs a final review, and once all criteria are met, approves the deliverable.

Government Expectation for Deliverable Table submission:

● Detailed Workflows & Process Diagrams: All deliverables should include clear, professional workflows and process diagrams to aid understanding as applicable. These should be formatted using tools like Microsoft Visio or Lucidchart.

● Reference Guides for Training: Comprehensive, user-friendly reference guides should be created for both internal and external programmatic training, ensuring that all personnel understand their roles and responsibilities per approved deliverable.

● Quality Acceptance Criteria: Deliverables must adhere to high industry standards, including clarity, actionable steps, completeness, and alignment with federal and security guidelines (e.g., NSPM-33, NIST).

1.06 Constraints:

The following constraints have been identified relating to this PWS:

● The Contractor shall adhere to all applicable Federal, Department of Commerce and NOAA policies, rules and guidelines, procedures, directives, and laws pertaining to Information Technology. This includes but is not limited to compliance with Section 508 accessibility, privacy, and Information Technology standards (i.e. FITARA, The Federal Information Security Management Act of 2002; NIST Special Publications 800 Series and NIST FIPS).

● Work is to be performed in accordance with the federal requirements for program/project management.

● Contractor shall possess the ability to use Microsoft Office Suite and have the ability to use NOAA

● Google Unified Messaging Services – to include Google Documents, and Smartsheets.

● Designated contractors shall possess the ability to use SIPR and JWICS.

● The contractor shall be aware and understand security policy and status for various social media and third-party tools in use by

OCIO/CSD.

● The contractor must follow the practices and requirements that NOAA has provided for conducting the Risk Management

Framework (RMF) process activities. The guidance is to be considered and followed in all relevant deliverables.

● The contractor will be expected to provide necessary resources with appropriate expertise to provide deliverables as defined by the Contracting Officer's Representative (COR) and/or Government Project Lead (GPL), sometimes under compressed timelines. A prime or subcontractor, will provide development, operation, and/or administration of NOAA information and must provide an adequate plan to mitigate any actual or potential conflicts of interest in performing these duties.

1.07 Period of Performance: This contract is for a (1) one year base period and two (2) one-year option periods.

The Period of Performance reads as follows:

Base Year – August 1, 2025 - July 31, 2026 Option Year I – August 1, 2026- July 31, 2027 Option Year II – August 1, 2027- July 31, 2028

1.08 Type of Order: The government anticipates the award of a Firm-Fixed Price (FFP) task order.

1.09 Hours of Operation/Place of Performance:

The Contractor shall be made available and conduct business between the hours of 7:30am and 4:30pm (EST) Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must, at all times, maintain an adequate workforce for uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

Work performed on a Government site ("on-site", heretofore) will generally take place at the following address:

NOAA Silver Spring Campus 1315 East West Highway, Silver Spring, MD 20910

Telework or Remote work will be authorized with written approval and will be monitored by the COR. Internal Risk Office requirement onsite four days telework one day. The telework will be monitored by COR and GPL and must comply with the Department of Commerce Information Technology Requirement (CITR) 0008: Remote Access.

When the contractor personnel is not working on premise at one of potential locations above, the contractor will be responsible for providing space, internet connectivity, and any other space related accommodations for contractor personnel to execute the work within this PWS. Non local travel may be required.

1.010 Special Qualifications:

The contractor is expected to provide a fully trained workforce to the government; therefore, personal development training costs and hours are not billable to the government. If the Government elects to pay for NOAA mission-specific training not available commercially, the specific details must be provided on how training will be paid/reimbursed. There are rare circumstances where the government will reimburse for NON NOAA-specific training.

1.011 Recognized Holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Juneteenth Day

In addition to the days designated as holidays, the Government observes the following days:

● Any other day designated by Federal Statute

● Any other day designated by Executive Order

● Any other day designated by a President's Proclamation

It is understood and agreed between the Government and the contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement to compensation except as set forth within the contract. If a contractor believes that an unplanned absence has an impact on the price or period of performance, it should notify the contracting officer (CO) of the changed condition and submit a claim for equitable adjustment (see FAR 52.233-1). Nothing in this clause abrogates the rights and responsibilities of the parties relating to "stop work" provisions as cited in other sections of this contract.

1.012 Security Requirements:

The minimum investigation required is a Single Scope Background Investigation (SSBI) or a Tier 5 investigation for all Contractor personnel supporting this contract. Security requirements applicable to this contract are described on the DoD Contract Security Classification Specification (DD254).

Contractor personnel providing support under this contract will require background checks in order to obtain a user account at the Information Technology (IT) level 2 (classified network access). An in-person visit with the Department of Commerce Special Security Officer (SSO) and Department of Commerce NS3 Help Desk will be required for Contractor personnel to in-process. All Contractor personnel supporting this effort will be required to sign a Classified Non-Disclosure Agreement (SF312).

The Contractor shall perform in accordance with the National Industrial Security Program Operating Manual (NISPOM), DOD 5220.22M, and ensure that all classified material is handled in accordance with the NISPOM and the appropriate Security/Program Guides/Directives. The Contractor shall obtain appropriate security clearances for required personnel.

All Contractor personnel assigned to this effort will have access to information that may be subject to the Privacy Act of 1974. The Contractor is required to ensure the proper safeguarding of such information to prevent unauthorized release. All task requirements will be conducted in full compliance with DoD security regulations.

All Contractors supporting this contract must have a current TOP SECRET clearance based on an SSBI/ SBPR/ PPR or Tier 5 investigation before beginning to support this work and must maintain the level of security and eligibility required for the life of the contract. The Contractor must hold an active TOP SECRET Facility Clearance.

The Contractors that will be accessing security sensitive data will need a CAC and will need to complete a System Authorization Request and the DOC Cybersecurity Awareness Challenge or equivalent. Access to Government buildings will be granted to Contractor staff, when needed. Contractor employees must be clearly identifiable while on Government property by wearing appropriate badges at all times. The Contractor shall provide each employee with an identification badge, which identifies, by photograph, the individual as an employee of the Contractor. These badges must be presented for examination upon request from the Contracting Officer, COR, Federal Protective Services, or any other Government Official with a need to see the badge. The Contractor and its employees shall be subject to all traffic, security, and registration regulations for personnel and vehicles.

All Contractor personnel attending meetings, answering Government telephones, in electronic messages or correspondence related to this contract, working on site, where their Contractor status is not known to third parties, must identify themselves as Contractors.

Contractor personnel shall also ensure that when logged onto Government equipment that their profile shows them as Contractor personnel. Contractor-occupied facilities (on Government installations) such as offices, separate rooms, or cubicles must be clearly identified with Contractor supplied signs, name plates or other identification, showing that these are work areas for Contractor personnel.

1.0120 The systems supported under this task are Moderate and High Risk.

1.0121 Suitability/Risk Level - The suitability or risk level for this work has been determined to be: High and Moderate. As such, the contractor shall pre-screen their employees to eliminate anyone who does not meet the following criteria: The prospective employees must be U.S. Citizens or can be U.S. citizens and Foreign Nationals.

48 CFR 1352.237-70 - Security Processing Requirements—High or Moderate Risk Contracts (APR 2010)

(a) Investigative Requirements for High and Moderate Risk Contracts. All contractor (and subcontractor) personnel proposed to be employed under a High or Moderate Risk contract shall undergo security processing by the Department's Office of Security before being eligible to work on the premises of any Department of Commerce owned, leased, or controlled facility in the United States or overseas, or to obtain access to a Department of Commerce IT system. All Department of Commerce security processing pertinent to this contract will be conducted at no cost to the contractor. The level of contract risk will determine the type and scope of such processing, as noted below.

(1) Investigative requirements for Non-IT Service Contracts are:

(i) High Risk—Background Investigation (BI).

(ii) Moderate Risk—Moderate Background Investigation (MBI).

(2) Investigative requirements for IT Service Contracts are:

(i) High Risk IT—Background Investigation (BI).

(ii) Moderate Risk IT—Background Investigation (BI).

(b) In addition to the investigations noted above, non-U.S. citizens must have a pre-appointment check that includes an Immigration and Customs Enforcement agency check.

(c) Additional Requirements for Foreign Nationals (Non-U.S. Citizens). To be employed under this contract within the United States, non-U.S. citizens must have:

(1) Official legal status in the United States;

(2) Continuously resided in the United States for the last two years; and

(3) Obtained advance approval from the servicing Security Officer of the contracting operating unit in consultation with the DOC Office of Security (OSY) headquarters. (OSY routinely consults with appropriate agencies regarding the use of non-U.S. citizens on contracts and can provide up-to-date information concerning this matter.)

(d) Security Processing Requirement. Processing requirements for High and Moderate Risk Contracts are as follows:

(1) The contractor must complete and submit the following forms to the Contracting Officer's Representative (COR):

(i) Standard Form 85P (SF-85P), Questionnaire for Public Trust Positions;

(ii) FD-258, Fingerprint Chart with OPM's designation in the ORI Block; and

(iii) Credit Release Authorization.

(2) The Sponsor will ensure that these forms have been properly completed, initiate the CD-254, Contract Security Classification Specification, and forward the documents to the cognizant Security Officer.

(3) Upon completion of security processing, the Office of Security, through the servicing Security Officer and the Sponsor, will notify the contractor in writing of an individual's eligibility to be provided access to a Department of Commerce facility or Department of Commerce IT system.

(4) Security processing shall consist of limited personal background inquiries pertaining to verification of name, physical description, marital status, present and former residences, education, employment history, criminal record, personal references, medical fitness, fingerprint classification, and other pertinent information. For non-U.S. citizens, the Sponsor must request an Immigration and Customs Enforcement agency check. It is the option of the Office of Security to repeat the security processing on any contract employee at its discretion.

(e) Notification of Disqualifying Information. If the Office of Security receives disqualifying information on a contract employee, the COR will be notified. The Sponsor, in coordination with the Contracting Officer, will immediately remove the contract employee from duties requiring access to Departmental facilities or IT systems. Contract employees may be barred from working on the premises of a facility for any of the following:

(1) Conviction of a felony crime of violence or of a misdemeanor involving moral turpitude;

(2) Falsification of information entered on security screening forms or on other documents submitted to the Department;

(3) Improper conduct once performing on the contract, including criminal, infamous, dishonest, immoral, or notoriously disgraceful conduct or other conduct prejudicial to the Government, regardless of whether the conduct was directly related to the contract;

(4) Any behavior judged to pose a potential threat to Departmental information systems, personnel, property, or other assets.

(f) Failure to comply with security processing requirements may result in termination of the contract or removal of contract employees from Department of Commerce facilities or denial of access to IT systems.

(g) Access to National Security Information. Compliance with these requirements shall not be construed as providing a contract employee clearance to have access to national security information.

(h) The contractor shall include the substance of this clause, including this paragraph, in all subcontracts.

1.0122 Physical Security. The contractor shall be responsible for safeguarding all government property provided for contractor use.

At the close of each work period, government facilities, equipment, and materials shall be secured.

1.0123 Lock Combinations. The contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the contractor’s Quality Control Plan.

1.013 Task Manager (TM): The TM Eric Geddis - 1315 East West Hwy, SSMC3 Silver Spring, MD 20910

The TM or delegate monitors all technical aspects of the contract and assists in contract administration. The TM is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notify the Contracting Officer, COR and contractor of any deficiencies;

coordinate availability of government furnished property, and provide site entry and badging of contractor personnel. The TM is not authorized to change any of the terms and conditions of the resulting order.

1.1 General PWS Information

1.10 Conservation of Utilities. The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

1.11 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, Contracting Officer’s Representative (COR), Task Manager (TM), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the Contracting Officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.12 Contract Manager: The contractor shall provide a contract manager who shall be responsible for the performance of the work.

The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the Contracting Officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

1.13 Processing and Identification of Contractor Employees: Prior to commencing work under this contract, the contractor shall submit or have their employee submit the required security forms and number of copies as informed by the Task Manager. The contractor, when notified that the Government rejected the suitability assessment forms shall either have the rejected forms made compliant and resubmitted or withdraw the employee from consideration from working under this contract.

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. If contractors will work on-site at a NOAA facility, they must have a badge. Contractor personnel will be required to obtain and wear a badge in the performance of this service.

1.14 Quality Assurance: The contractor shall ensure quality assurance in accordance with the approved QAP as applicable to the services performed in accordance with this PWS. The contractor shall develop and implement procedures specific to this requirement to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality assurance program is the means by which he assures himself that his work complies with the requirement of the task order. At a minimum, the contractor shall develop quality assurance procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary.”

Quality Assurance Surveillance: The government shall evaluate the contractor’s performance under this task order in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

Government Remedies: The contracting officer shall pursue remedies for the contractor’s failure to perform satisfactory services or failure to correct non-conforming services in accordance with the terms and conditions of the contract.

PART 2

DEFINITIONS & ACRONYMS

● PWS – Performance Work Statement

● Contracting Officer’s Representative (COR): A representative from the required activity assigned by the Contracting Officer to perform surveillance and to act as liaison to the contractor.

● Defective Service. A service output that does not meet the standard of performance associated with it in the Performance

Work Statement.

● Quality Assurance Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance to assure services meets the requirements of the Performance Work Statement.

● Quality Assurance. Those actions taken by a contractor to control the performance of services so that they meet the requirements of the PWS.

● Best Effort: That effort expended by the contractor to perform within the awarded ceiling price all work specified in this task order (TO) and all other obligations under this TO and the basic contract. This effort includes providing required qualified personnel, properly supervised, and following industry accepted methodologies and other practices. The effort is further characterized by operating at all times with the Government’s best interest in mind, using efficient and effective methods, and demonstrating sound cost control. The effort must be identical to the effort that would be expended if this were a firm-fixed price TO and the contractor’s profits were dependent upon reducing costs while meeting the Government’s requirements in terms and quality and schedule. Failure to provide this required effort may result in the withholding of payment for hours expended that do not qualify as best effort or a reduction in the rate per hour to reflect decreased value of services received.

PART 3 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.01 General: The government shall provide the facilities, equipment, materials, and/or utilities listed below.

3.011 Facilities: The Government will furnish the necessary workspace for the contractor staff to provide the support outlined in this PWS to include desk space, telephones, computers and other items necessary to maintain an office environment.

3.012 Equipment: The Government will provide basic supplies and materials normally available to Government employees including personal computers and desktop software

3.03 Utilities: All utilities in the facility will be available for the contractor’s use in performance of duties outlined in this PWS. The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities. Contractor employees shall be provided the same utilities as those provided to NOAA/OCIO employees while located at the NOAA/OCIO. The Contractor shall use the Government furnished utilities in a prudent manner

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4.01 General: Except for those items specifically stated to be government furnished in Part 3, the contractor shall furnish everything required to perform this PWS.

4.02 Secret Facility Clearance: The Contractor must hold an active TOP SECRET Facility Clearance.

PART 5

APPLICABLE PUBLICATIONS

5.01 Publications applicable to this PWS are listed below.

Publication Date Page(s) Internet Address Mandatory/Advisory

NSPM-33 16 Jan 2021 All https://trumpwhitehouse.archiv es.gov/presidential-actions/pre sidential-memorandum-united-states-government-supported-r esearch-development-national-security-policy/

Mandatory https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-united-states-government-supported-research-development-national-security-policy/ https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-united-states-government-supported-research-development-national-security-policy/ https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-united-states-government-supported-research-development-national-security-policy/ https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-united-states-government-supported-research-development-national-security-policy/ https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-united-states-government-supported-research-development-national-security-policy/ https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-united-states-government-supported-research-development-national-security-policy/

TECHNICAL EXHIBIT

PERFORMANCE REQUIREMENTS SUMMARY

Item Performance

Objective Acceptable Quality Level

(AQL)

Method of

Surveillance Incentive/

Disincentive Sample Size Frequency

Task 1:

Assessment and Gap Analysis

Assessment Report

Identify gaps in NOAA’s research security posture and provide actionable recommendations for improvement.

100% Inspection None One-time

Task 1:

Assessment and Gap Analysis

Gap Analysis Report

Analyze current security measures and identify deficiencies.

Random Sampling

Sample Size:

10% of reports One-time

Task 1:

Assessment and Gap Analysis

Policy Update Recommendati ons

Provide detailed recommendations for updating NOAA’s policies.

100% Inspection None One-time

Task 1:

Assessment and Gap Analysis

Critical and Emerging Technologies Mapping

Map and identify NOAA's involvement in critical and emerging technologies.

100% Inspection None One-time

Task 1:

Assessment and Gap Analysis

FNRS

Compatibility Assessment

Assess compatibility with operational needs.

100% Inspection None One-time

Task 2:

Program Design and Framework Development

Customized Research Security Program Framework

Develop a comprehensive security framework based on

NSPM-33.

100% Inspection None One-time

Task 2:

Program Design and Framework Development

Compliance Strategy Document

Develop a strategy for ensuring compliance across NOAA research operations.

Random Sampling

Sample Size:

15% of strategies One-time

Objective Acceptable Quality Level

(AQL)

Method of

Surveillance Incentive/

Disincentive Sample Size Frequency

Task 3: Policy and Procedure Development

Research Security Policies and Procedures

Develop comprehensive policies and procedures.

100% Inspection None One-time

Task 3: Policy and Procedure Development

NOAA Critical Assets List

Identify and list NOAA's critical…