Req SF330s Att A.pdf

Remote Sensing Division National Geodetic Service

National Ocean Service National Oceanic and Atmospheric Administration U.S.

Department of Commerce

Statement of Work / Specifications Shoreline Mapping under the

NOAA Coastal Mapping Program

Contents Acronyms

1 Purpose

2 General

3 Scope

3.1. Topographic/Bathymetric LiDAR

3.2. Aerial Imagery

3.3. Ground Control Surveys

3.4. Tide/Water Level Monitoring

3.5. Geographic Cell Shoreline Cleanup, Editing, Attribution, and Compilation

3.6. Continually Updated Shoreline Product (CUSP)

3.7. Gravity for the Redefinition of the American Vertical Datum (GRAV-D)

3.8. Topographic/Bathymetric Merged DEM

3.9. Total Propagated Uncertainty

3.10. Normalized Seabed Intensity

3.11. Foundation Continuously Operating Reference Stations (FCORS)

3.12. Other Geospatial Products and Services

4 General Requirements

4.1. Pilot Projects

4.2. Task Order Management and Information System (TOMIS)

4.3. Kickoff Meetings

4.4. Quality Controls

4.5. Records and Metadata

4.6. Contract Coordinator

4.7. Key Personnel (Task Orders)

4.8. Quality Assurance

4.9. Laws, Regulations, Procedures and Permits

4.10. Travel

4.11. Contractor Confidentiality

4.12. Contractor Innovation

4.13. Deliverables

4.14. IT Security Requirements

4.15. Information Systems

4.16. Protecting Information

Acronyms ASP Aeronautical Survey Program ASPRS American Society for Photogrammetry and Remote Sensing CMP Coastal Mapping Program CMTS Committee on the Marine Transportation System COR Contracting Officer’s Representative CUSP Continually Updated Shoreline Product DEM Digital Elevation Model FAA Federal Aviation Administration FCORS Foundation Continuously Operating Reference Stations FGDC Federal Geographic Data Committee GC Geographic Cell GIS Geographic Information System GPS Global Positioning Systems GRAV-D Gravity for the Redefinition of the American Vertical Datum IOCM Integrated Ocean and Coastal Mapping IOOS Integrated Ocean Observing System ISSO Information System Security Officer IWG-OCM Interagency Working Group on Ocean and Coastal Mapping JALBTCX Joint Airborne LiDAR Bathymetry Technical Center of Expertise LiDAR Light Detection and Ranging

MHW Mean High Water

MLLW Mean Lower Low Water

NAS National Airspace System

NAVO Naval Oceanographic Office

NIST National Institute of Standards and Technology

NOAA National Oceanic and Atmospheric Administration

NOS National Ocean Service

NGS National Geodetic Survey

NVA Non-vegetated Vertical Accuracy

NSDI National Spatial Data Infrastructure

NSRS National Spatial Reference System

QA Quality Assurance

QC Quality Control

RSD Remote Sensing Division

SOW Statement of Work

TOMIS Task Order Management and Information System

TPU Total Propagated Uncertainty

USACE United States Army Corps of Engineers

USGS United States Geological Survey

VVA Vegetated Vertical Accuracy

XML Extensible Markup Language

1 Purpose This Scope of Work (SOW) includes multiple geospatial tasks to support coastal mapping including, but not limited to, remote sensing, digital shoreline mapping, surveying, and associated tasks. Geospatial products and services purchased through this contract will support the U.S. Department of Commerce, National Oceanic and Atmospheric Administration (NOAA), National Ocean Service (NOS), National Geodetic Survey’s (NGS), Coastal Mapping Program (CMP) in support of NOAA’s nautical chart production. NOAA’s charting responsibilities date back to 1807 when President Thomas Jefferson founded the Survey of the Coast. Over the years the agency name has changed several times, but the enormous responsibility for producing accurate maps and charts of the nation’s entire shoreline has remained constant. The nautical chart has been called the most fundamental of navigation instruments making the chart’s accuracy and completeness essential for maritime safety. A nautical chart depicts water depths, shoreline, topographic features, navigational hazards, aids to navigation, landmarks, vertical (overhead) clearances and other navigational information.

Vessel navigators use charts to determine their position, the location of their destination, and the safest and most economical route between these points. Charts used to be paper products, but are now widely available electronically. Contract personnel working on this contract must have a thorough understanding of nautical charts as well as familiarity with the specific charts depicting the project area.

This SOW also supports collection for NGS’ Aeronautical Survey Program (ASP), including remote sensing and ground surveys. Airport products and services are critical to the safety of aircraft in the Federal Aviation Administration (FAA) National Airspace System (NAS) and on the ground. In addition, this SOW supports collection for NGSs Gravity for the Redefinition of the American Vertical Datum (GRAV-D) program. Geospatial products and services from this SOW may also be used to support the Integrated Ocean and Coastal Mapping (IOCM) programs, and other NOAA programs that need geospatial products and services.

NGS/RSD/CMP requires the collection of geospatial spatial products and services to enable accurate and consistent measurement of the national shoreline and nearshore bathymetry. The shoreline is defined as the land water interface at a specific tidal datum. The CMP works to provide a regularly-updated and consistent national shoreline to define America’s marine territorial limits and manage coastal resources. This shoreline is applied to NOAA nautical charts and is considered authoritative when determining the official shoreline for the United States. The nearshore bathymetry requirement is centered around deriving depths up the Navigable Area Limit Line (NALL) that ranges from 0 to 4.0 meters for most of the United States. NGS recognizes there are many other uses to these products and services to support additional mapping, charting, geodesy services, shoreline change, resource management, and for other purposes in coastal states.

NGS participates with the Interagency Working Group on Ocean and Coastal Mapping (IWGOCM) and the Committee on the Marine Transportation System (CMTS) to develop common standards for coastal mapping and charting products. These standards were developed in conjunction with the Joint Airborne LiDAR Bathymetry Technical Center of Expertise (JALBTCX) partner agencies (U.S. Army Corps of Engineers (USACE), U.S. Naval Oceanographic Office (NAVO), and the U.S. Geological Survey (USGS).

2 General Except for those items specifically identified in individual task orders as Government furnished, the contractor, operating as an independent contractor and not as an agent of the Government, shall furnish all facilities, labor, material, and equipment necessary to provide goods and services in accordance with the terms, conditions, and specifications set forth below. The contractor shall plan, schedule, and coordinate performance of all work associated with task orders in accordance with the requirements described in this SOW and those of the individual task orders. During the performance of the work, the contractor shall provide adequate professional supervision and quality control to assure the timeliness, accuracy, quality, completeness, and progress of the work.

Unless specifically stated otherwise, the term "contractor," as used in this SOW and in the contract, shall be interpreted as the prime contractor.

3 Scope Geospatial services are vital to NGSs mission. The services are highly technical in nature and require specialized technical expertise that necessitates seamless, end-to-end capability. To meet such extensive and critical requirements, NOAA requires contractors to demonstrate full capability and capacity to simultaneously accomplish, and quickly react, to multiple tasks throughout the United States, its possessions, and territories.

Typical projects may include one or more phases of shoreline mapping or other surveying and mapping tasks including: planning; collecting geospatial products and services from ground, aircraft, boat and/or satellite based sensors, with positioning and orientation parameters;

conducting ground geodetic surveys using conventional and/or precise Global navigation satellite system (GNSS)methods; installing tide gauges and tidal benchmarks, making tidal and leveling observations, and processing these products to determine tidal datums, predicted tide values, and actual tide values; performing Aero Triangulation; performing digital map compilation, with attribution; producing orthophotos; controlling quality, including equipment calibrations; processing imagery and LiDAR products; and writing reports. Projects may also include: airport aerial photography, LiDAR or other geospatial products and services over airports, ground control surveys and obstruction surveys on airports, emergency response to disasters; and/or leveling, gravity surveys, and other special case surveying and mapping tasks.

These deliverables may include: LiDAR, SAR, imagery, acoustic products, vertical land motion products, gravity products and/or geospatial products and services. Individual Project Instructions provided with each Request for Proposal will define any unique project specific requirements. All products and services provided under this contract will meet the requirements of the NOAA Coastal Mapping Program Technical Specification Document (latest version).

CMP projects may be along any portion of the U.S. shoreline, including U.S. possessions in the Caribbean and the Pacific, as well as other areas of interest. ASP projects may be at any airports across the U.S. including U.S. possessions in the Caribbean and the Pacific, as well as other areas of interest. Individual project limits will be defined in the Project Instructions and will be outlined on government provided diagrams (paper or digital) of the area. The CMP photo coverage is planned to include all of the shoreline within the project area and all of the land within 2000 feet of that shoreline and sufficiently seaward to include all offshore hazards to navigation (e.g., islands and rocks).

Firms must have end-to-end capability to provide all of the below listed services:

3.1. Topographic/Bathymetric LiDAR.

Topographic/Bathymetric LiDAR shall be collected and processed per the requirements of the NOAA Coastal Mapping Program Technical Specification Document (latest version). A LiDAR sensor capable of collecting both topographic and bathymetric products concurrently is required. Bathymetric LiDAR products are typically required from the water’s edge seaward from the land/water interface, to the specified extent as detailed in the provided project boundary shapefile or to laser extinction, whichever comes first. For shoreline mapping and modeling uses, it is particularly important to have good bathymetric products in the very shallow (0-4 m) areas. For this reason, the LiDAR systems, software, and processing procedures shall enable measurement of bathymetry in this very shallow region. The sensor used for this mapping shall have an operational measurement depth range equal to or greater than a 1.5 secchi depth. In addition, for certain projects NOAA may require use of a deep channel sensor with an operational measurement depth range equal to or greater than a 3.0 secchi depth. The sensor technology utilized for a project must be pre-approved by NOAA.

Water clarity conditions in the project sites shall be monitored to determine suitable times for acquisition.

3.2. Aerial Imagery.

Aerial imagery shall be collected and processed per the requirements of the NOAA Coastal Mapping Program Technical Specification Document (latest version). Aerial imagery for the CMP is usually required to meet three main parameters: sun angle of at least 25 degrees, clear sky, and tide coordination. However, additional parameters and requirements for aerial imagery acquisition may be included in the Project Instructions. The Contractor is required to plan the flight lines given the project area and other information contained in the Project Instructions. Flight line maps shall be depicted with a NOAA nautical chart as the background. The photo coverage shall be planned to include all of the shoreline within the project area, all of the land within 2000 feet of that shoreline, and offshore features such as islands, rocks, man-made obstructions, fixed aids to navigation, piers, and jetties. The Project Instructions may require that imagery for the CMP be tide coordinated. When shoreline products are to be compiled using aerial photographs, RGB (Color), Color Infra-Red (Color IR), and/or Black-and-White IR (B&W IR) images may be required to be captured when the water level is at observed or predicted Mean High Water (MHW), observed or predicted Mean Lower Low Water (MLLW), and/or below or between these water levels. Normally NGS allows a tolerance on either side of MHW and MLLW. All remotely sensed imagery (including color and infrared) for the CMP shall be positioned using airborne Kinematic GNSS

(with dual-frequency, carrier-phase measurements) with direct georeferencing shall be used as required. Satellite based correction services will be considered on a project by project basis, An aircraft with dual camera ports may be required for CMP projects so that two sensors can collect geospatial products simultaneously.

3.3. Ground Control Surveys.

Ground surveys shall be collected and processed per the requirements of the NOAA Coastal Mapping Program Technical Specification Document (latest version). For each acquisition region detailed in the provided LiDAR and project boundary shapefile, the contractor must follow the guidance of recommended number of control/check points to be used for vertical referencing and accuracy testing of elevation products and for horizontal referencing and accuracy testing of digital orthoimagery products from the ASPRS Positional Accuracy Standards for Digital Geospatial Data. The contractor must follow the guidance for the recommended number of checkpoints based on the project area for Non-vegetated Vertical

Accuracy (NVA) and Vegetated Vertical Accuracy (VVA). Check points must be distributed generally proportionally among the various land cover types in the project. The contractor must propose a control/checkpoint acquisition plan for the project area to the COR and NGS, and the COR's approval granted, before proceeding. All raw control products, notes and logs must be provided along with the processed results of each area. The contractor must tie all control into the National Spatial Reference System (NSRS), unless otherwise directed.

Additional survey related requirements may include: recovering survey marks, setting marks, constructing photo panels, photo identifying control points, writing digital mark descriptions and/or mark recovery notes, using conventional and/or GPS survey methods, including leveling, taking digital photographs during the ground surveys, and preparing visibility diagrams.

3.4. Tide/Water Level Monitoring.

Tide and water level monitoring shall be performed per the requirements of the NOAA Coastal Mapping Program Technical Specification Document (latest version). The contractor may be required to predict water levels, observe water levels in real time, install water level gauges and tidal benchmarks, collect water level products, level between benchmarks, GPS observations on tidal benchmarks, or process all these observations. Water level products shall be submitted in CO-OPS and NGS specified formats.

3.5. Geographic Cell Shoreline Cleanup, Editing, Attribution, and Compilation.

The Geographic Cell (GC) is a set of Esri shapefiles, containing the geometry and attribution of shoreline and associated coastal features, extracted from imagery or other remotely sensed source products, for application to the nautical charts. The Contractor may be required to clean, edit, and attribute preliminary shoreline features extracted and provided by the government, and/or compile new features directly from the source products. The contents, attribution, and formats of GCs shall conform to all requirements found in the NOAA Coastal Mapping Program Technical Specification Document (latest version).

3.6. Continually Updated Shoreline Product (CUSP).

NOAA’s Continually Updated Shoreline Product (CUSP) has been developed to provide the most current seamless nationwide shoreline representation of the United States and its territories to support mapping scales as large as 1:1,000 to a minimum of 1:24,000. CUSP maintains the highest available resolution from all of its sources, which include LiDARderived and image-extracted shoreline products from a variety of sources, including federal and state agencies. Wherever applicable, CUSP will reference a MHW shoreline, usually based on vertical modeling or image interpretation. CUSP products shall be per the requirements of the NOAA Coastal Mapping Program Technical Specification Document (latest version).

3.7. Gravity for the Redefinition of the American Vertical Datum (GRAV-D).

NGS has a federal mandate to provide accurate positioning, including heights, to all federal non-military mapping activities in the United States. NGS launched the GRAV-D Project with the specific goal to create and maintain a sufficiently accurate gravimetric geoid (a surface of the gravity field, very closely related to global mean sea level) to serve as the basis of a new vertical datum (which is the zero surface on topographic maps). The GRAV-D Project has successfully used airborne gravity observations to collect precise gravity measurements throughout Continental United States, Alaska, and their littoral regions. The contractor shall provide the aircraft, pilots, and maintenance, in support of the GRAV-D project in accordance with the specifications as described in the specific task order. Gravity collection and processing by the operators will follow the specifications published in the GRAV-D Operations Handbook, which is available at https://geodesy.noaa.gov/GRAVD/pubs.shtml.

3.8. Topographic/Bathymetric Merged DEM.

The contractor shall provide a consistent resolution merged Digital Elevation Model (DEM) from high quality elevation products acquired along the entire project area. The contractor must prepare a detailed work plan defining their process for performing the merge and where and how they intend to fill in the voids. Issues to consider are gaps, interpolation of points/DEMs, and size of water bodies, rivers.

3.9. Total Propagated Uncertainty.

NGS uses topographic/bathymetric LiDAR products collected throughout the coastal zone for nautical chart updates. To support nautical charting, these products must include Total Propagated Uncertainty (TPU) which accounts for all contributing measurement uncertainties.

The contractor shall calculate TPU using parametric uncertainty estimates calculated using

NOAA’s TPU tool “cBlue”.

3.10. Normalized Seabed Intensity.

Corrections shall be performed to raw intensity values from the bathymetric LiDAR returns to account for attenuation due to depth and angle of incidence. The return intensity values shall be further normalized to account for swath-to-swath variability and the corrected values stored in the standard LAS 1.4 deliverable. The normalized bathymetric return intensities will provide the baselines for generating benthic habitat maps in the study areas without the need for rigorous radiometric calibration. The benthic habitat maps will support analysis of seagrass availability and potentially provide a spatially continuous baseline for monitoring nearshore aquatic habitats.

3.11. Foundation Continuously Operating Reference Stations (FCORS) NGS currently owns and operates 38 CORS stations located within the United States and its territories, plus stations in Brazil and Bermuda. NGS is seeking support for services for the following; Repair / upgrade / harden existing NGS-owned CORS stations, Repair, upgrade, design and installation of lightning protection and grounding systems, Perform Reconnaissance, Design and installation of new braced monument CORS stations, Design, testing and installation of synthetic aperture radar (SAR) corner reflectors and customized monument, Conduct Station Condition Assessments (SCA), Design and installation of optical targets, Educational Program and Design Support Services, and International Earth Rotation & Reference System Service (IERS) Site Survey Program Support. FCORS products and services shall be per the requirements of the Foundation CORS Station Support Technical Specifications Document (latest version).

3.12. Other Geospatial Products and Services

Other geospatial products and services in support of NGS and their partners may include but is not limited to; high-resolution topographic / bathymetric product generation, satellite derived bathymetry, satellite imagery, Uncrewed Aircraft System acquired imagery, crewed and uncrewed boat based acoustic acquisition and processing, SAR acquisition and processing, hyperspectral imagery, thermal imagery, geospatial map service development, http://www.ngs.noaa.gov/GRAV-D/pubs.shtml https://geodesy.noaa.gov/GRAV-D/pubs.shtml https://geodesy.noaa.gov/GRAV-D/pubs.shtml https://geodesy.noaa.gov/GRAV-D/pubs.shtml https://geodesy.noaa.gov/GRAV-D/pubs.shtml https://geodesy.noaa.gov/GRAV-D/pubs.shtml analysis, geospatial management and modeling, geospatial consulting and analysis, and aircraft services.

The NGS may identify areas within the CONUS, OCONUS, or United States territories where the Contractor has already collected coastal topographic/bathymetric LiDAR products and services. The NGS may purchase these products and services and require Contractor support to process these products into a format that meets NGS’s specific standards. Specific formats for NGS standards will be provided dependent on the project instructions provided for each task order requirement

4 General Requirements

4.1. Pilot Projects

The contractor shall select a Pilot Area for each project and submit this proposed Area to NOAA for approval. This Pilot Area, constituting approximately 10% of a single subproject (assuming the project is subdivided), should contain a representative sample of shoreline and associated features contained in the project as a whole. Once the Technical Proposal is accepted and the notice to proceed has been received, the Contractor shall compile this area and submit Interim Shapefiles (see NOAA Coastal Mapping Program Technical Specification Document) covering the Pilot Area. The Contractor shall not begin compilation on other portions of the project until NGS approves the Pilot Area compilation. The purpose of the Pilot Area is to ensure the Contractor’s understanding of compilation requirements and thereby mitigate the risk of lengthy correction and resubmission cycles.

4.2. Task Order Management and Information System (TOMIS)

The Contractor shall submit a completed TOMIS spreadsheet containing a listing of all Deliverables, percentages, and due dates, and in the specified format with their Technical Proposal. Deliverables will be submitted and reviewed using NOAA’s TOMIS.

4.3. Kickoff Meetings

The contractor must participate in a kickoff meeting with the NOAA NGS within 30 days of contract award unless otherwise agreed upon by NOAA and the contractor. The meeting must be held at the NOAA Headquarters in Silver Spring, MD unless otherwise agreed upon by NOAA. The contractor must prepare an agenda for this meeting and issue meeting minutes within 7 days after the meeting.

4.4. Quality Controls

Quality control (QC) is essential throughout the entire task order process and is solely the responsibility of the contractor. The contractor's quality control system shall adhere to the specifications of the ISO 9001:2015 Quality Management System standard (or later). The Government reserves the right to inspect all contractor processes and documentation to assess the contractor's compliance with and commitment to the basic Quality System. Acceptance of the final deliverables is contingent upon meeting the requirements stated in the task order. The contractor shall provide the government with documentation that their final product has met the specifications of the task order. The contractor shall document this process and the government shall approve that process prior to task order award. The contractor shall develop a QC plan to ensure that requirements of the contract are met as specified. The contractor shall provide a copy of the Plan to the COR within fourteen (14) days of task order award date. The QC plan will be reviewed and must be approved by the government within 14 days of receipt from the contractor. The contractor shall update the QC plan and provide an updated copy to the COR as applicable.

4.5. Records and Metadata

The contractor must document all delivered geospatial products and services (including options if exercised) according to Executive Order 12906 https://www.fgdc.gov/policyandplanning/executive_order/) for the whole of the project in one metadata product. Specifically, the contractor must deliver for all products and services, metadata records which detail all flight lines, flight dates and times, datums, transformations, reprojections, resampling algorithms, processing steps, field records, positional accuracy, and any other pertinent information. The metadata records must conform to the Content Standards for Digital Geospatial Metadata (FGDC-STD-001-1998) as published on May 1, 2000, by the Federal Geographic Data Committee (FGDC) or to any format that supersedes it as determined by the FGDC (https://www.fgdc.gov/metadata/csdgm/). Profiles and extensions to the standard that have been endorsed by the FGDC must be used if they are applicable to the products and services. The metadata records must contain any and all elements, including those that are considered optional, wherever applicable to the products and services. The metadata record must contain sufficient detail to ensure the products and services can be fully understood for future use and for posterity.

Complete metadata must be provided for each of these products. The metadata must be in extensible markup language (xml) format. Draft version of the metadata must be provided to NOAA for review prior to final submittal. An example of the minimum content that must be included is provided as a supplement to these Project Instructions.

4.6. Contract Coordinator

Communication and coordination between both the contractor and the government is considered vital to the satisfactory accomplishment of each task order. Periodic interaction with government staff must be maintained to ensure clear understanding of the anticipated products and satisfactory progress. The contractor shall provide monthly reports at a minimum discussing the work that had been performed during that reporting period, problems encountered (if any), schedule and deliverable status, and planned work for the next reporting period. The contractor shall schedule teleconferences after issuance of the monthly reports if there is a need to discuss the progress of each project and any issues that may need to be addressed. In addition, a bi-yearly meeting, either in person or per teleconference, may be scheduled by the government with the contractor to discuss their overall performance on the contract.

4.7. Key Personnel (Task Orders)

The contractor’s Project Manager, Aerial Photographer, Aerial Pilot, Compilation Supervisor, Compilation Technician, GIS Analyst, LiDAR Specialist, Photogrammetrist Supervisor, Photogrammetrist Technician, Quality Manager, Remote Sensing Operator, Senior Project Manager, Survey Chief, Geodesist, and Geodetic Surveyor shall be considered key personnel for the contract. Additional key personnel may be assigned for individual task orders. The Project Manager shall be the contractor’s single point of contact for general matters concerning the contract. The contractor may assign a task order manager to individual task orders; however, the Project Manager will have the overall responsibility of meeting the requirements of the contract.

https://www.fgdc.gov/policyandplanning/executive_order/ https://www.fgdc.gov/policyandplanning/executive_order/ https://www.fgdc.gov/metadata/csdgm/ https://www.fgdc.gov/metadata/csdgm/

4.8. Quality Assurance

The government will review all task order deliverables for quality, accuracy, timeliness, and completeness. The government will assess if satisfactory progress is being made and determine if the task order is on schedule for planned completion. If during the government review process the deliverables are found to not meet the requirements of the task order, the contractor shall correct the deficiencies and re-deliver the deliverable at no additional cost to the government.

4.9. Laws, Regulations, Procedures and Permits

The contractor shall comply with all applicable laws, ordinances and regulations and procedures (federal, state, county, city, or otherwise) and shall be responsible for obtaining all necessary permits for work performed under the contract and shall include all costs, if any, of such compliance in the prices quoted in its proposal.

4.10. Travel

The contractor is responsible for the planning, coordination, and funding of travel for its employees in support of the performance of requirements outlined in each task order. The government expects that some travel will be necessary in order to meet the specifications of most task orders; however, it is not mandatory. The contractor shall separately indicate travel expenses in each task order cost proposal.

4.11. Contractor Confidentiality

The contractor shall have access to government information during the contract period. The contractor shall not use, for any purpose outside the terms of the contract, proprietary raw products. The contractor shall not distribute processed and derived products developed for the government in connection with this contract prior to quality review and acceptance by the government.

4.12. Contractor Innovation

The contractor shall remain alert to possible improvements in technical methods and administrative procedures used to provide products under the contract. The contractor shall propose such improvements to the government and obtain concurrence prior to implementing a change.

4.13. Deliverables

Specific deliverables will be outlined in the individual task orders. All deliverables shall meet all applicable international, national and Federal information technology and geographic information standards, particularly those identified by the FGDC as supporting the National Spatial Data Infrastructure (NSDI). Product deliveries shall meet defined schedules. All deliverables, including Monthly Reports, shall be submitted using NOAA’s TOMIS.

4.14. IT Security Requirements

The base IDIQ contract is awarded without acquiring any information technology and/or service(s);.

a) For this base IDIQ, the Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

b) For this base IDIQ, the Contractor shall not access any Government Furnished Information (GFI) that is not within the public domain for this effort.

Each task order shall include its own statement of work or equivalent and the required Information Security in Acquisitions Checklists.

4.15. Information Systems

The Contractor shall demonstrate that the information systems employed for this requirement and for the transmission of products to NOAA systems meet the National Institute of Standards (NIST) cyber security baseline applicable to the NOAA systems receiving the product’s or the baseline’s commercial equivalent. Any other requirements (e.g., executing an Interconnection Security Agreement) triggered by an electronic interface between the contractor and NOAA may also be required.

4.16. Protecting Information

The Contractor shall guarantee strict confidentiality of the information and products when the Government identifies Government Furnished Information and/or products and services generated during the performance of the task order is of a sensitive nature. Disclosure of the information/products, in whole or in part, by the contractor can only be made after the contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/products under the contract, the contractor shall obtain a written determination from the Contracting Officer. The Contractor shall agree not to publish or otherwise divulge such information in whole or part, in any manner or form, nor to authorize or permit others to do so. The Contractor shall take such reasonable measures as are necessary to restrict access to such information while in the contractor’s possession, to those employees needing such information to perform the work provided herein, e.g., on a “need to know” basis.

The Contractor shall ensure all contract deliverables where information technology used to create deliverables and Information Technology and/or service(s) provided to the Government in performance of the contract complies with Supply Chain Risk Management requirements.

The Contractor shall provide for itself and any proposed subcontractors the information required for the Government to perform a supply chain risk assessment.

The contractor shall scan all electronic information/products/software passed to/from NOAA with multiple commercial malicious software detection and removal products (e.g., anti-virus software, anti-malware, anti-spyware, etc.) prior to use by either entity. The contractor shall ensure the electronic deliverables/products provided to the Government are free of known malicious software.

The Contractor shall work with the COR prior to sending the deliverables to determine if they need to be transferred in a secure manner. The Contractor shall protect sensitive information and/or non-public information from unauthorized disclosure and/or modification. The Contractor shall work with the Government assigned ISSO to determine the applicable sensitive security requirements. The Contracting Officer shall add the following privacy related contract clauses (FAR 52.224-1 and FAR 52.224-2) to this contract and these apply to both electronic and hardcopy information/products. The Contractor shall comply with the DOC Privacy Act (PA) Personally Identifiable Information (PII), and Business Identifiable Information (PII), Breach Response and Notification Plan. The Contractor shall contact the government assigned ISSO immediately upon detection and/or notification of a breach of PII and/or BII.

If secure transfer is required, the Contract shall ensure no sensitive information is sent using a non-encrypted format. The Contractor shall implement transmission and storage of sensitive information to meet or exceed the NIST Federal Information Processing FIPS 140-3 Security Requirements for Cryptographic Modules (https://csrc.nist.gov/publications/detail/fips/140/3/final) using validated cryptographic module(s). Specifically, the body of the email shall not contain sensitive information unless it is encrypted. The Contractor options for sending sensitive information includes a file encrypted with a password or passphrase using a product like WinZip or using DOC Secure File Transfer solution (Kiteworks). The Contractor shall encrypt any sensitive information that will be sent electronically (e.g., email), sensitive information includes but not limited to:

a) Personally Identifiable Information (PII), sensitive PII and/or Business Identifiable Information (BII),

b) Non-public information and/or products,

c) Information that requires Government approval prior to release to the public,

d) All information describing the implementation, configuration, settings, etc. (including Information Technology (IT) configuration, IT management, IT security (includes security incidents (reporting, handling and mitigation) and security assessment documentation), IT administration, IT architecture, IT network management including firewall management and/or information obtained while performing privileged access roles),

e) The source code and database schema,

f) The vulnerability scanning, secure baselines scanning and/or mitigation results,

g) The secure baseline deviations,

h) Internet Protocol, subnet mask and similar identification,

i) System or component inventory information (hostname, IP address, MAC address, location, operating system, etc.).

The Contractor shall use one of the methods for secure destruction of unclassified but sensitive information recommended by either NIST Special Publications 800-88 Rev.1 Guidelines for Media Sanitization (https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final) or the National Security Agency in the Media Destruction Guidance (https://nsa.gov/resources/everyone/media-destruction/) upon the termination of this contract.