Attachment_1_-_GFNMS_Support_PWS.pdf

PERFORMANCE WORK STATEMENT

Greater Farallones National Marine Sanctuary

Program Support Services

1.0 BACKGROUND

The National Oceanic Atmospheric Administration (NOAA) is a United States Federal agency dedicated to understanding and predicting changes in the Earth’s environment and to conserve and manage coastal and marine resources to meet United States economic, social, and environmental needs. In coordination with federal, state, territorial, local, tribal and international authorities, NOAA manages the use of these environments, regulating fisheries and marine protected areas as well as protecting threatened and endangered marine species.

The Office of National Marine Sanctuaries (ONMS), established in 1972 by the National Marine Sanctuaries Act (NMSA) and administered by NOAA’s National Ocean Service, protects a network of special marine and freshwater areas. The goal of the NMSA is to set aside and manage areas for resource protection, research, enhanced public education, and compatible public and private uses. At the present time, the ONMS system comprises thirteen national marine sanctuaries, one marine national monument and two further national marine sanctuaries undergoing the designation process.

Management activities for each sanctuary site are detailed in site-specific management plans which outline regulatory goals, describe boundaries, identify staffing and budget needs, and set priorities and performance measures for resource protection, research, and education programs. In order to carry out these management activities, program support services are required.

2.0 SCOPE OF WORK

In accordance with Federal Acquisition Regulation Subpart 37.1, the requirements herein are for “non-personal service”. The Contractor is an independent entity and not an agent or employee of the Government. The Contractor shall provide services, personnel, material, supplies, supervision, labor, expertise, and equipment, (except that specified as Government-furnished) required to operate, oversee, and assist in the implementation of sanctuary programs in accordance with this PWS and applicable laws. This PWS also provides for the ability for additional expertise and resources to support evolving sanctuary requirements.

The Contractor shall provide related services as specified, in accordance with the terms, conditions, general and special contract requirements, specifications, drawings, attachments and exhibits contained herein or incorporated by reference.

2.1 PLACE OF PERFORMANCE

The majority of tasks under this contract will be performed at the Greater Farallones National Marine Sanctuary (GFNMS) Headquarters facility on Crissy Field at the Presidio of San Francisco, CA. Extensive field work, field programs and classes for the public, trainings, program development, and meetings with partners require tasks to be completed outside of the main office complex. Some tasks could be completed in other sanctuary regions around the country.

Attachment 1 RA133C-17-RP-0105

3.0 GENERAL REQUIREMENTS

The contractor shall provide support services necessary to conduct a variety of tasks such as education, outreach, stakeholder engagement, administrative, resource protection and Geographic Information Systems (GIS) services.

3.1 TASKS

Tasks may include the following requirements:

3.1.1 Education & Outreach Services

• Operate the sanctuary Visitor Center on weekdays and at least one weekend day as assigned: greet visitors and invited guests, interpret exhibits and answer questions from the public. The Visitor Center is open 10 am to 4 pm, Wednesday through Sunday.

• Maintain and clean the Visitor Center exhibits, including several cold saltwater aquaria. Maintain all necessary aquarium supplies and food for aquarium animals.

Stock brochures and sanctuary materials. Maintenance and cleaning should be scheduled during closed hours.

• Assist with exhibit updates and improvements, including exhibit concept, design, and fabrication.

• Schedule school groups for Visitor Center activities

• Assist with sanctuary education activities and outreach

• Assist with the development and instruction of school group programs on week days.

• Advertise and lead monthly programs for the public on weekend days.

• Assist in the coordination of the Sanctuary’s lecture series, interpretive trips, outreach fairs and special events.

• Assist with the recruitment and training of Visitor Center volunteers.

• Assist with management, tracking and reporting related to sanctuary volunteers.

• Coordinate and deliver summer camps

• Assist with outreach programs, social media, web updates and other on-line media.

• Coordinate and deliver sanctuary K-12 school education programs.

• Assist with coordination and outreach related to maritime heritage.

• Assist with outreach, press releases, and notifications to media.

• Attend and provide briefings at staff meetings

3.1.2 Stakeholder Engagement Services

• Provide a wide variety of stakeholder engagement services, including stakeholder meeting coordination, social media, outreach product development and communication.

• Coordinate, conduct and support four advisory council meetings and one retreat per year, including setting meeting agendas with superintendent and executive committee, preparing council letters and resolutions, and taking and distributing notes from meetings.

• Participate in bimonthly program coordinator’s meetings and track sanctuary programs for appropriate meeting dates for presentations/action items.

• Produce annual council work plan, council accomplishments, and annual council report.

• Prepare following year topics, meeting schedule, and workplan.

• Communicate issues/information relevant to the sanctuary to important stakeholders and the advisory council.

• Maintain stakeholder content on the sanctuary web site.

• Prepare the Federal Register Notice and additional announcements for member recruitment, manage council applications, solicit members for application review committees and coordinate review, work with the application review committee and sanctuary superintendent to determine new council members.

• Coordinate Advisory Council new member orientation

• Participate in conference calls with Advisory Council executive committee, ONMS council coordinator and ONMS council executive committee.

• Attend one council meeting per California site per year, as budget allows.

• Attend annual, week-long, advisory council summit, as budget allows.

• Support superintendent with issues related to sanctuary policy development, communication and implementation.

• Support other program activities important to stakeholders, including but not limited to ship strikes, whale entanglements, overflight zones, ocean noise, climate impacts, and sanctuary boundary expansion.

3.1.3 Resource Protection Services

• Work with sanctuary staff to integrate emerging issues such as climate change and ocean acidification into science, policy, education, and operations programs.

• Present sanctuary policies and information at meetings and offer trainings as budget allows

• Coordinate with other sanctuaries and participate in ONMS subcommittees and advise on national program strategies

• Develop content for and maintain web pages related to policy or emerging issues

• Assist with emergency response activities at incident command or in the field

• Assist with NEPA compliance and review

• Assist with sanctuary permitting activities

• Meet monthly with Sanctuary Superintendent

• Provide support to sanctuary resource protection programs

3.1.4 Administrative Services

• Greet all visitors to the sanctuary office and assist them with their needs; answer phones, check general voicemail daily, answer or route calls/messages as needed.

• Manage government vehicle fleet, get vehicles cleaned and serviced as required.

• Manage sanctuary room and vehicle reservations on Google Calendar and serve as building contact.

• Manage the mailroom/box, accept and sort deliveries; assist with mailings of outreach materials; manage postage machine.

• Assist with UPS services; schedule or drop-off as needed; order supplies.

• Manage and organize supplies and supply room, including ordering and stocking office, printer and plotter supplies. Return used printer cartridges; recycle used supplies and batteries.

• Attend & support all Staff meetings (send reminders, develop agendas, take notes and distribute summaries).

• Coordinate time & attendance for federal employees.

• Support office travel; reserve flights, hotels & vehicles, create travel orders, process vouchers. Track travel spending.

• Serve as office contact for janitors, exterminator, building safety, fire department, Park Service, etc.

• Serve as point of contact for scheduling stakeholder engagement meetings with superintendent.

• Secure advisory council meeting venues, manage RSVPs, and coordinate logistics including ordering supplies, assembling member packets, and meeting set-up and clean-up.

• Prepare advisory council draft notes and collect presentations from advisory council meetings.

• Maintain sanctuary calendar and distribute as required.

• Assist with printing, mailing and faxing.

• Manage media/IT equipment check-out list/process and assist with inventory accountability.

• Assist with coordinating employee enrichment activities.

• Assist with website maintenance.

• Coordinate sanctuary Green Team.

• Raise & take down flags on all good weather days.

• Liaison with the sanctuary headquarters and regional office as needed.

3.1.5 Geographic Information Systems (GIS)

• Work with sanctuary staff and partners to identify spatial data needs and develop GIS and cartographic products accordingly.

• Analyze spatial information to create products that convey complex topics to sanctuary stakeholders, partners and the public.

• Obtain, organize, update, archive and manage the spatial data required to implement sanctuary priorities.

• Create and update all metadata in compliance with Federal Geographic Data Committee (FGDC) standards.

• Coordinate and manage existing seafloor map data, and identify priority areas for future mapping.

• Integrate new data into the existing GIS databases of biological, oceanographic, geologic, socioeconomic, cultural, water quality and other thematic data.

• Communicate with local, regional, state and national GIS and sanctuary staff to ensure effective data exchange and to keep spatial information up to date.

• Present geospatial information at meetings and discussions with sanctuary partners, stakeholders and the public.

• Respond to spatial information requests from other NOAA components, Federal agencies, state and local governmental bodies, private organizations, academic and research institutions, and the public.

• Gather ocean monitoring information from regional scientists

• Evaluate and implement new GIS technology.

• Develop GIS products to post on sanctuary web site.

• Attend and provide briefings at staff

3.2 PROGRAM COORDINATION

The Contractor shall provide overall management pertaining to all Contractor technical and contractual personnel, including state and local requirements, insurance, and liability coverage for its employees. The Contractor shall be responsible for adherence to all federal, state, territorial, local and site-specific safety regulations. Required minimum qualifications are specified below in section 4.1. The Government and the contractor understand that no employer-employee relationship exists between the Government and the contract employees assigned under this contract (non-personal services).

3.3 QUALITY CONTROL MANAGEMENT

The Contractor shall establish, implement, and maintain a Quality Control management program to ensure quality of all work products and service performed under this contract consistent with the Performance Requirements Summary in section 13.0 below. The Contractor shall measure the appropriate metrics and report the results accordingly.

3.4 WORK SCHEDULES

Unless otherwise specified in Section 3.1 (Tasks), the Contractor will generally work during the normal operating hours of eight (8) hours per day, five (5) days per week, Monday through Friday, unless there are duties that require work on weekends, after hours or alternative work schedules. Contractor employee work schedules including routine and episodic telework will be proposed in writing by the contractor and approved by the Contracting Officer’s Representative (COR) in coordination with local project managers.

Work is not billable, or allowed, at NOAA facilities when the facilities are closed, such as Federal holidays, except when the work is conducted at sea, during field surveys or at special events sponsored by the site.

In the event of a government closure, work is not allowed on site at the government facility unless specifically authorized by the Contracting Officer (CO) and/or COR.

3.5 FIELD DAYS

Sanctuaries conduct a variety of projects in the field, on land and at sea, that require specialized Contractor personnel for periods of days to weeks at a time. Some examples include, but are not limited to, ship and shore-based activities, special outreach programs or other events involving a particular stakeholder group, sanctuary partner or the public.

Because timing of these projects is unknown and variable, some schedules during projects may be intensive (including overnight travel or weekend work).

3.6 ENVIRONMENTAL CONSIDERATIONS

This acquisition does not require an environmental assessment or an environmental impact statement. Contractor staff will be informed of those efforts at the Government facilities that are focused on meeting the following environmental objectives:

a. promote energy-efficiency and water conservation;

b. promote the use of non-hazardous and recovered materials;

c. promote cost-effective waste reduction; and

d. consider the use of bio-based products.

The Contractor shall adhere to all Federal and State environmental laws, regulations and policies.

4.0 PERSONNEL

The primary purpose of this contract is to provide professional technical and administrative support. All personnel shall be experienced in Windows and/or Macintosh operating systems.

All personnel shall have a valid driver’s license.

The contractor shall provide a sufficient number of qualified personnel to perform the work described in this PWS and in accordance with subsequent task orders. These personnel shall provide the core of knowledge for the Contractor to ensure uninterrupted performance at acceptable quality levels.

Contract supervisors shall provide day-to-day supervision of contract personnel including, but not limited to, work monitoring, payroll records, leave, etc. At no time shall Government personnel supervise contractor personnel. Government assistance shall be available to provide technical and policy guidance through the COR.

The contractor shall assign a full-time employee as the Project Manager who has final responsibility for the contract. This individual shall have full authority to act for the contractor in all day-to-day matters relating to contractor performance and shall work with the Government's COR in the administration, management, performance, and procedural and technical matters pertaining to this contract. The Project Manager, or a fully capable temporary alternate, shall be readily available during the hours of 8:00 am and 5:00 pm Pacific time. An alternate shall be designated in writing to the COR in one (1) business day in advance of the Project Manager’s absence. The Contractor shall provide telephone numbers of the Project Manager and alternate(s) where these persons may be contacted outside of normal duty hours. The Project Manager and any individual(s) designated to act for the Contractor shall have full authority to contractually commit the Contractor, and act without delay on matters pertaining to execution of the contract.

4.1 PERSONNEL REQUIREMENTS

The following are the titles, minimum education, experience and the general duties required for contractor personnel under this PWS.

4.1.1 EDUCATOR/NATURALIST

Perform tasks under Education & Outreach services. See section 3.1.1 above.

Education/Experience:

Five years of experience providing natural science classes and interpretation to students and the public. Extensive knowledge and understanding of CA Current ecology, and ability to communicate complex scientific topics in lay terms for students, public, and interested stakeholders is required. Strong knowledge of Next Generation Science Standards, Ocean and Climate Literacy principles is required. Experience maintaining cold saltwater aquariums and multiple social media platforms are required. BS or BA degree in education, marine biology, environmental studies or related field is required.

4.1.2 STAKEHOLDER ENGAGEMENT SPECIALIST

Perform tasks under Stakeholder Engagement services. See section 3.1.2 above.

Education/Experience:

A minimum of 2 years of experience coordinating stakeholder engagement and public meetings to inform policy and management. Extensive experience providing program coordination support to a natural resource management agency; extensive knowledge and understanding of Sanctuary and ONMS policies and procedures regarding Advisory Councils;

ability to communicate complex topics to interested stakeholders and the public; advanced degree in marine policy or related field; ability to have friendly interactions with the staff and the general public; excellent oral communication and interpersonal skills are required.

Advanced organizational skills are essential. Some lifting will be required to support meeting logistics. Travel required within the Bay Area, and elsewhere depending on budget.

4.1.3 RESOURCE PROTECTION SPECIALIST

Perform tasks under Resource Protection services. See section 3.1.3 above.

Education/Experience:

Extensive experience providing program coordination support to a natural resource management agency regarding policy and planning issues including but not limited to climate change. Extensive knowledge and understanding of the effects of climate change on sanctuary resources, including vulnerability assessment, and adaptation and mitigation planning and implementation; ability to communicate complex climate change topics to interested stakeholders and the public; experience building capacity at other organizations to address climate change are required. A graduate degree or equivalent in climate sciences, marine biology, environmental management or a related field with an emphasis on the marine environment is required.

4.1.4 ADMINISTRATIVE SPECIALIST

Performs tasks under supervision such as providing administrative, front office management and communications support. See section 3.1.4 above.

Education/Experience:

Two years of experience providing administrative, logistics and planning support for NOAA or similar government agency or university; ability to have friendly interactions with the staff and the general public; excellent oral communication and interpersonal skills; advanced organizational skills are required. Interest in California Current marine ecosystems and environment is a plus.

4.1.5 GIS ANALYST

Performs tasks under GIS support services. See section 3.1.5 above.

Education/Experience:

Minimum of 5 years GIS experience. Master’s Degree with concentration in geography, GIS, marine science, or equivalent is preferred. Advanced understanding of spatial data concepts, including projections, relational databases, and cartographic production; advanced knowledge of GIS database administration and management principles, methods and techniques, including quality control methods and practices; expertise in data analysis and visualization; expertise in ArcGIS platforms are required. Excellent verbal and written skills in communicating complex, technical GIS information to professional and lay audiences is required. Ability to interact and work effectively with sanctuary staff, partners, and the public to disseminate GIS data and cartographic products is required. Experience with management of marine biology, ecology, habitat, and/or oceanography data sets is required.

5.0 INFORMATION TECHNOLOGY AND SECURITY CONSIDERATIONS

This is not an IT acquisition, however, as the situation may require, the Contractor may have access to the NOAA network through computers provided by NOAA. There is no current requirement for the Contractor to have access to any other DOC or NOAA IT systems, and no access to classified materials. The Contractor’s staff will be subject to DOC Security Processing Requirements for Contractor/Subcontractor Personnel Working on a Department of Commerce Site. The Contractor is required to comply with the DOC IT Security Program Policy & Minimum Implementation Standards available online at:

http://ocio.os.doc.gov.

The Contractor is required to meet the DOC IT Security Program Policy (ITSPP) and Commerce Information Technology Requirements (CITRs) (available at:

https://connection.commerce.gov/policy/20140528/it-security-program-policy-and-commerce-information-technology-requirements). DOC has issued Commerce Information Technology Requirements (CITRs) as policy enhancements to the DOC IT Security Program Policy and carries the same authority as the DOC ITSPP. The contractor is required to meet the NOAA IT Security Manual [NOAA policy] (available at:

https://www.csp.noaa.gov/policies/manual/212-1301-V5-6-final.pdf). The DOC and NOAA policies identified above are sensitive documents and will be provide after contract award.

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239- 72 do not apply, and a Security Accreditation Package is not required.

The government will provide the necessary computer equipment and information to perform this contract. All work must be performed upon government furnished equipment and if additional hardware and/or software is/are needed, the Contractor must request the additional requirements from the Contracting Officer Representative (COR). It is a mandatory requirement for every NOAA IT user (government, Contractor, associate, or temporary personnel) to complete the NOAA Information Technology Security Awareness Course every year. Temporary personnel include visitors, guest workers, etc., who plan to work at a NOAA site and use NOAA IT resources. Both new and temporary employees must take the course within three days after initial issuance of NOAA IT equipment and annually.

http://ocio.os.doc.gov/ https://connection.commerce.gov/policy/20140528/it-security-program-policy-and-commerce-information-technology-requirements https://connection.commerce.gov/policy/20140528/it-security-program-policy-and-commerce-information-technology-requirements https://www.csp.noaa.gov/policies/manual/212-1301-V5-6-final.pdf

The Contractor must use government furnished equipment (GFE), which is currently covered by an existing government Assessment and Authorization (A&A) package Contractor staff needing to perform work off-site using GFE shall sign all appropriate agreements and follow all appropriate regulations per NOS, NOAA, and DOC policies including NOAA and NOS property regulations. The Contractor shall comply with Help Desk and/or property requests to make the GFE available upon request to meet organizational property requirement and/or to maintain the GFE in accordance with the organizational defined security posture. All users who have been issued a Government furnished client endpoint computing device shall be accountable for the integrity and security of that device.

The Contractor shall comply with existing and new NOS policies and memorandums specifically covering issued GFE.

It is the contractor’s responsibility to ensure Government Furnished desktops and or laptops are scanned, patched, and updated during the specified times mentioned above by keeping the desktop and laptops turned on and connected to the network when the devices are not being used, or by connecting laptops to the VPN or the internet when the devices are being used outside of the office. If an issue arises and require onsite helpdesk support, the contractor shall obtain helpdesk support at the Silver Spring location.

The Contractor shall safeguard GFE assigned for the duration of the contractor unless returned to the Government prior to the end of the contract. Lost, misplaced, or stolen GFE issued to the Contractor through this contract shall be reported to the Task Manager within 4 hours of detection. The Contractor shall assist with any security incident report filed related to the loss of the GFE and shall report to the Help Desk the GFE loss within 24 hours of detection. The Contractor or contractor staff assigned the GFE can be held accountable to reimburse the Government for cost of the GFE depending on the circumstance that resulted in the GFE loss.

The Contractor must consider IT Security controls throughout the lifecycle of this contract as outlined in NIST Special Publication 800-64 (http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf).

The use of remote sensing technologies (e.g., unmanned aerial vehicles) will require additional compliance with DOC and NOAA policies including Privacy Act of 1975.

Cloud Services If the vendor proposes the use of cloud services, NOS requires an integrated technical solution that meets the security requirements below. These requirements apply to each PaaS, SaaS and/or IaaS tier to be managed by the Contractor and to any Contractor-supplied or third party supplied management interface that will be used to manage the service. The Contractor must adhere to the following security requirements:

1. Meet DOC and NOAA defined parameters for security control implementations;

2. Support Low and Moderate Impact IT Security Categorizations (per Federal Information

Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems" February 2004, and NIST Special Publication http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf

800-60 Volume I & II, "Guide for Mapping Types of Information and Information Systems to Security Categories" August 2008);

3. Comply with DOC and NOAA Information Technology Security Policies;

4. Provide FIPS-201 compliant two factor authentication capability;

5. Provide Role-Based Access Control (RBAC) to services areas;

6. Possess a FedRAMP Agency Authorization to Operate (ATO) or Provisional

Authorization to Operate (PATO) at Moderate Impact Security Categorization for the integrated technical solution (covering all functionality layered on top and the IaaS solution including the prime, integrator, broker and Infrastructure as a Service cloud service provider) throughout the length of this contract. The Contractor shall make the following reports available upon written request within five (5) business days and annually:

● Authorization Letter from General Services Administration GSA (or other Federal agency) providing its Authorization To Operate (ATO) through the FedRAMP program (FedRAMP Cloud Computing Security Requirements Baseline, http://cloud.cio.gov/document/fedramp-security-controls);

● Security Assessment Report (http://cloud.cio.gov/fedramp/templateshttp://www.gsa.gov/portal/getMediaData ?mediaId=172015);

● Comprehensive inventory, description, risk assessment, and status of all existing Plan of Action and Milestones (POA&M);

● System Security Plan (http://cloud.cio.gov/fedramp/templates);

● Customer Responsibility Matrix identifying controls that the solution requires the Government to address:

● FedRAMP Control Implementation Summary (CIS) report (http://cloud.cio.gov/fedramp/templates);

● FedRAMP Control Tailoring Workbook (CTW) document (http://cloud.cio.gov/fedramp/templates);

● FedRAMP Security Assessment Plan (SAP) document (http://cloud.cio.gov/fedramp/templates); and

● FedRAMP Self-Attestations (http://cloud.cio.gov/fedramp/templates).

7. Provide Government with on-site or remote access to perform annual security assessment activities;

8. Provide Government with access to System Security Package (SSP) and results of security tests performed at least annually;

9. Provide real-time access to VM system audit logs and scan data of technical solution utilized by NOAA;

10. Capability for VMs to integrate with DOC and NOAA Cybersecurity operation solutions:

http://cloud.cio.gov/document/fedramp-security-controls http://cloud.cio.gov/fedramp/templates http://cloud.cio.gov/fedramp/templates http://www.gsa.gov/portal/getMediaData?mediaId=172015 http://cloud.cio.gov/fedramp/templates http://cloud.cio.gov/fedramp/templates http://cloud.cio.gov/fedramp/templates http://cloud.cio.gov/fedramp/templates http://cloud.cio.gov/fedramp/templates

● Include NOAA Security Operations Center (SOC) integration;

● Integrate into NOAA's implementation of ArcSight system providing real-time input data, which is physically located on the Silver Spring Metro Campus. TCP connection over SSL with sufficient bandwidth to send logs in a format ArcSight will accept;

● Integrate with NOAA Computer Incident Response Team (N-CIRT), for addressing suspected and actual incident handling, reporting and forensic data exchange to meet DOC, NOAA, and federal reporting requirements;

● Integrate with NOAA’s implementation of Homeland Security Presidential Directive 12 (HSPD-12) implementation for a Common Identification Standard for Federal Employees and Contractors (http://www.dhs.gov/homeland-security-presidential-directive-12);

● Integrate with NOAA Enterprise Continuous Monitoring Operations (ECMO) integration for meeting OMB memoranda M-10-15 and M-10-19, which requires all Federal agencies to continuously monitor security-related information from across the enterprise;

11. Ensure all NOAA data and applications (including VMs) must reside within the United States;

12. Provide an "Alternate Processing Site" in accordance with the NIST Security Control CP- 7 (1), CP-7 (2), and CP-7 (3);

13. Provide role-based access controls and auditing of administrative actions;

14. Secure interface capabilities including but not limited to Secure Sockets Layer (SSL), Transport Layer Security (TLS), Internet Protocol (IP) Security (IPSec), and Secure Shell (SSH) for encrypted communications between NOAA locations and cloud-based services as well as between cloud-based services and the end users of NOAA applications on the Internet; and

15. Provide Government with full administrative control to the master account or its equivalent. A master account is defined as a highest (or root) level access mechanism to Government's information technology resources resident within the Contractor's cloud infrastructure. Full administrative control must support granular Role-based Access Controls (for example: Government granting access to cloud resellers/partners with limited access to the CSP financial and billing).

If the Contractor is proposing the use of custom developed software solutions (includes mobile application, web application and/or software product development), the Contractor must ensure secure management of user credentials (storing, transmitting, authenticating of user password must be encrypted). If the Contractor solutions use a Contractor developed or government furnished [mobile/web] application/ database/ network operating systems, the Contractor must:

1. DOC has issued Commerce Information Technology Requirements (CITRs) as policy enhancements to the DOC IT Security Program Policy and carries the same authority as the DOC ITSPP. The DOC ITSPP and DOC CITRs may not specifically identify [mobile/web] application/ database/ network operating systems, which may be applicable and will require Contractor compliance with the requirements. The DOC http://www.dhs.gov/homeland-security-presidential-directive-12 http://www.dhs.gov/homeland-security-presidential-directive-12 policies will be provided to the Contractor at the start of the project. DOC policies are controlled unclassified information (CUI) and are restricted to only authorized personnel.

2. Throughout the lifecycle, the Contractor is required to incorporate security requirements. Development lifecycle must take into account the security controls catalogue contained within National Institutes of Standards and Technology’s (NIST) Special Publications 800-53 (SP 800-53) revision 4 Security and Privacy Controls for Federal Information Systems and Organizations.

● Organization’s Information System Security Officer (ISSO) will provide guidance to the Contractor for identifying security controls, documenting security controls and ongoing continuous monitoring of security controls.

● The Contractor must provide their security controls implementation including applicable architecture, diagrams, documentation, standard operating procedures supporting the development and operation of their solution. This documentation will be incorporated by the ISSO into appropriate Federal Information Security Management Act (FISMA) system security boundary, identified as NOAA6602.

3. All updates must undergo vulnerability scanning, secure baseline compliance scanning and mitigation of vulnerabilities and provide the appropriate documentation to the government for each update demonstrating this requirement has been met.

If the Contractor is proposing the use of mobile application, web application and/or software product development, appropriate planning needs to be included during the assessment of needs, requirements, development and testing. Security requirements must be incorporated into the mobile application development lifecycle along with the user functional requirements.

1. The developer must select and document secure baseline/checklist (see National

Checklist Program below) for the application/software being developed to address IT security issues.

2. The developer must document any deviations/exceptions from selected secure baseline.

This secure baseline best practice must be implemented throughout development of product.

3. The developer must perform a full source code review and application code scanning for vulnerabilities must be conducted. Any identified source code review deficiencies or scanner-identified vulnerabilities must be mitigated and any other generated supporting documentation including the raw vulnerability scanner reports must be provided. This applies to all source code updates that must undergo a full source code review, full source code scanning and mitigation of vulnerabilities with the appropriate documentation provided to the government for each update demonstrating this security requirement has been met. Source code must be provided to the government for each product update, enhancement and/or security flaw remediation.

4. If the solution includes a network operating system (i.e., Windows, Linux, etc.) or web server (i.e., Apache, Microsoft IIS, etc.) then all components (application, web server and network operating system) must have security checklist implemented and documented.

System development lifecycle management of the application, web server and network operating system is expected. The government will provide, upon request, the current secure benchmarks being used for existing technologies to ensure compatibility. All updates must undergo vulnerability scanning, secure baseline compliance scanning and mitigation of vulnerabilities with the appropriate documentation provided to the

5. The developer must ensure the solution doesn’t contain any spyware, malicious software, coding flaws or programming backdoors to circumvent the application functionality or the security of the application as described by the government. The solution must not access data stored on the device or request end user information without following all government (including OMB) requirements. The solution must not transmit stored data from the installed device without clearly notifying, fully describing the required data being transmitted and receiving the government’s approval.

If the Contractor is proposing the use of database development, appropriate planning needs to be included during the assessment of needs, requirements, development and testing.

Security requirements must be incorporated into the database development lifecycle along with the user functional requirements.

1. The databases must implement a secure baseline checklist (see National Checklist

Program below) for each database and perform databases vulnerability scanning for vulnerabilities.

2. The databases weaknesses as identified from any vulnerability/compliance scanner identified vulnerabilities must be mitigated. Mitigation supporting artifacts must include any generated supporting documentation including raw vulnerability scanner reports and documented security checklist with deviations, if deviations exist, must be provided.

3. All updates must undergo vulnerability scanning, secure baseline compliance scanning and mitigation of vulnerabilities with the appropriate documentation provided to the

4. If the solution includes a network operating system (i.e., Windows, Linux, etc.) then both (database and network operating system) must have security checklist implemented and documented. System development lifecycle management of the database and network operating system is expected.

All electronic provided information by the Contractor must undergo malicious software scanning using a commercial anti-virus and anti-spyware software to ensure the information is free of known malicious software. The Contractor must work with the COR prior to sending the information to establish a secure method for transfer. One option could be a file encrypted with a password using a product like WinZip. The Contractor must encrypt any sensitive information that will be sent electronically (i.e., email); sensitive information includes, but not limited to:

• All information describing the implementation, configuration, settings, etc. for solution being developed (including Information Technology (IT) configuration, IT management, IT security, IT administration, IT architecture and/or information obtained while performing privileged access roles),

• The source code and database schema,

• The vulnerability scanning, secure baselines scanning, mitigation results,

• The secure baseline deviations,

• Internet Protocol, subnet mask and similar identification,

• System or component inventory information (hostname, IP address, MAC address, location, operating system, etc.),

• Personally identifiable information (PII) and/or Business-identifiable information

(BII).

The Contractor must protect sensitive information and/or non-public information from unauthorized disclosure or modification. The Contractor working with the ISSO to determine the applicable sensitive security requirements that must be addressed. Sensitive information includes personally identifiable information (PII), Business-identifiable information (BII), Information Technology (IT) configuration, IT management, IT security, IT administration, IT architecture and/or information obtained while performing privileged access roles.

The Contractor includes the necessary product support and supporting documentation for the hardware and/or software that allows the sanitization (following NIST Special Publications 800-88 Guidelines for Media Sanitization, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) of the hardware and/or software upon the disposal of the product.

The Contractor must provide sufficient document demonstrating the software being provided complies with Office of Management and Budget Memorandum M-07-18 entitled Ensuring New Acquisitions Include Common Security Configurations and the FAR 39.101(d) regulations involving NIST common security configuration checklists including Federal Desktop Core Configuration (FDCC) or United States Government Configuration Baseline (USGCB) initiative. More information is available at National Checklist Program (NCP), (http://checklists.nist.gov), is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low-level guidance on setting the security configuration of operating systems and applications.

The Contractor must provide sufficient documentation that demonstrates the acquiring information technology has implemented common security configurations. Common security configurations are available from the National Institute of Standards and Technology’s website at http://checklists.nist.gov.

The Contractor must ensure that the product being purchased complies with the Homeland Security Presidential Directive 12 (HSPD-12) requirements from FAR 4.1302 stating: (a) In order to comply with FIPS PUB 201, agencies must purchase only approved personal identity verification products and services. (b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf http://checklists.nist.gov/ http://checklists.nist.gov/

HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

The Contractor must ensure that the product being purchased complies with Internet Protocol Version 6 (IPv6) requirements from FAR part 11.002 requirements which state that unless the agency Chief Information Officer waives the requirement, when acquiring information technology using Internet Protocol, the requirements documents must include reference to the appropriate technical capabilities defined in the USGv6 Profile (NIST Special Publication (SP) 500-267- http://www.nist.gov/itl/antd/usgv6.cfm) and the corresponding declarations of conformance defined in the USGv6 Test Program (http://www-x.antd.nist.gov/usgv6/index.html). To meet this requirement each DOC acquisition of IP protocol technology must express requirements for IPv6 capabilities in terms of the USGv6 Profile (i.e., using the USGV6 Capabilities Check List) and vendors must be required to document their product’s support of the requested capabilities through the USGv6 test program (reference http://www.antd.nist.gov/usgv6/) using the USGv6 Suppliers Declaration of Conformity.

The Contractor must provide sufficient document demonstrating the software being provided meets the following:

1. The standard installation, operation, maintenance, update and/or patching of software shall not alter the configuration settings from the approved FDCC/ USGCB/other secure configuration.

2. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

The Contractor must provide all supporting documentation or a reference to obtain the necessary material which describes the security capabilities, the design and development processes and the testing and evaluation procedures used by the product or services being provided for this acquisition. The Contractor must provide all supporting documentation or a reference to obtain the necessary material that describes all product or service updates and enhancements as they are implemented. The product or service supporting documentation could be the user and system administrator guides, which is documents the functional properties of the security controls employed to permit the analysis and testing of the security controls.

Ensuring Knowledge Transfer The Contractor shall provide, as necessary, periodic training whenever the Contractor introduces new processes, new technology or when the Contractor changes existing processes or technology. All processes and technology changes must be thoroughly documented. It is the responsibility of the Contractor to mentor government-identified personnel regarding the new or changed process or technologies. When there is a transition within the Contractor’s staffing, the Contractor shall be responsible for ensuring the incoming personnel is fully versed on any outstanding project deadlines, roles and responsibilities before the new person arrives on the job. In the case of when the services of the Contractor are no longer required, the Contractor shall begin the knowledge transfer to http://www.antd.nist.gov/usgv6/ government personnel or its designated representative at least three weeks before the final contract termination date.

Protecting Against Data Dissemination and Restrictions Against Disclosure The Contractor agrees, in the performance of this contract, to keep the information furnished by the Government and designated by the Contracting Officer or Contracting Officer’s Technical Representative in the strictest confidence. The Contractor also agrees not to publish or otherwise divulge such information in whole or part, in any manner or form, nor to authorize or permit others to do so, taking such reasonable measures as are necessary to restrict access to such information while in the Contractor’s possession, to those employees needing such information to perform the work provided herein, i.e., on a “need to know” basis. The Contractor agrees to immediately notify the Contracting Officer in writing in the event that the Contractor determines or has reason to suspect a breach of this requirement.

The Contractor agrees that it will not disclose any information described in performance of this activity to any persons or individual unless prior written approval is obtained from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the contract, the Contractor shall obtain a written determination from the Contracting Officer. The Contractor agrees to insert the substance of this clause in any consultant agreement or subcontract hereunder.

The Contractor is required to comply with the Department of Commerce’s Commerce Acquisition Manual’s (CAM) 1337.70 Personnel Security Requirements (http://oam.eas.commerce.gov/docs/CAM1337.70%28Security%29.pdf).

6.0 TRAVEL

Travel shall only be permitted if funding is available and it is required with advance approval by the COR in coordination with project managers. Travel, lodging and meals are reimbursable in accordance with FAR 31.205-46 and up to Federal Travel Regulations (FTR) per diem amounts.

The contractor shall maintain records to support all reimbursable travel costs, which shall be made available to the Government for inspection, acceptance, and approval. Invoices must contain one copy of all receipts for reimbursable lodging and airfare expenses, and for any other approved expenditure.

Travel costs, including transportation, lodging, subsistence, and incidental expenses incurred by the contractor's personnel, or consultants, while in a travel status in connection with the performance of services required by this contract, will be reimbursed for the actual costs incurred (without profit, G&A, or overhead for firm fixed price task orders) and shall not exceed the amount listed unless approved by the COR.

Airfares shall consist of the actual, but not to exceed the lowest customary standard, coach, or equivalent airfare during normal business hours or as otherwise provided in FAR 31.205- 46(b). Per diem and/or mileage, costs shall not exceed the rates set by the Federal Travel Regulation.

http://oam.eas.commerce.gov/docs/CAM1337.70%28Security%29.pdf

The parties recognize that it may be necessary to cancel or reschedule a meeting. Where rescheduling or cancellation was due to unforeseeable cause(s) beyond the control and without fault or negligence of the Contractor, penalties imposed by airlines or other travel related services shall be treated as allowable reimbursable costs under this contract.

Prior to travelling, the Contractor shall notify the COR or CO in writing when it has reason to believe that travel costs will exceed the amount on the individual task order. The Contractor shall provide a revised travel estimate and justification for exceeding travel costs.

The reimbursable items associated with the travel determined to be necessary in the performance of this contract are subject to incorporated FAR clauses as applicable. All travel, subsistence and local transportation in support of this contract shall not exceed the rates set by the Federal Travel Regulation.

The Contractor shall pay any travel costs associated with replacing personnel.

7.0 ACCIDENT REPORTING

The contractor shall comply with all OSHA and NOAA requirements for record keeping and reporting of all incidents resulting in death, serious injury, occupational disease, or adverse environmental impact. The contractor shall provide a verbal report to the site superintendent immediately after each such occurrence. A completed typed original mishap report shall be submitted.

8.0 GOVERNMENT VEHICLES

Routine transportation requirements shall be the responsibility of the Contractor. The use of Government-owned or Government-provided vehicles may be made available to Contractor personnel in the performance of the contract work only. Use of Government vehicles will be authorized per Government regulations and with advance approval by the COR and GFNMS management. Contractor employees will only be authorized to utilize Government motor vehicles with the possession of a NOAA Common Access Card, a valid State driver’s license, and proof of insurance. Operators of Government vehicles shall become familiar with and obey all transportation/traffic laws of the States(s) and local jurisdictions in which they operate. Violation of traffic law can result in fines. Any fines imposed on the operator are his/her personal responsibility as well as any required payment thereof. This includes fines for parking violations.

9.0 GOVERNMENT-FURNISHED PROPERTY AND SERVICES

The Government shall provide, without cost to the contractor, Government Furnished Property (GFP) and services provided as part of this contract shall be used by the contractor only to perform under the terms of this contract.

Contractors assigned GFP must protect and safeguard that property in accordance with FAR 52.245-1.