01 Requirements draft.pdf

Statement of Requirements

Hypack Software Annual Maintenance Renewal

1. Introduction

NOAA’s Office of Coast Survey (OCS) manages the production of NOAA nautical charts and its nautical data collection and information programs. This integrated suite of programs in hydrography and cartography helps protect life and property, supports economic growth and development, and protects the environment, in addition to the overall mission of promoting safe navigation.

The Office of Coast Survey’s IT Services Branch supports and manages the hardware, software, licenses, electronic system security, business applications, projects, and other IT-related endeavors required by more than 300 employees of Coast Survey and other offices working throughout the United States.

Hypack software is an industry standard for marine surveying, positioning, and navigation, and is critical for NOAA’s mission to collect accurate hydrographic survey data (including, but not limited to, bathymetry from multibeam sonar). NOAA’s hydrographic fleet currently has more than 40 perpetual licenses of Hypack software in use, and has a continued requirement to access critical security patches, new software releases and updates, feature enhancements, and technical support for this mission-essential software.

2. Scope of Work

An annual maintenance renewal and new software purchase contract is required for Hypack software.

This renewal and new software purchase contract includes NOAA’s Office of Coast Survey (Coast Survey Staff, Coast Survey Development Laboratory [CSDL], Hydrographic Surveys Division [HSD], and Navigation Services Division [NSD]), all NOAA Office of Marine and Aviation Operations (OMAO) hydrographic survey platforms, the NOAA Ocean Exploration office (OER), and the National Centers for Coastal Ocean Science (NCCOS).

2.1 Covered Service Items

The following service items shall be provided to NOAA for all software products covered under this annual maintenance renewal and new software purchase contract (as defined in Section 2.2, Covered Software Products):

● Critical software security patches

● Software new releases and updates

● Feature enhancements

● Technical support

2.2 Covered Software Products

The following software packages shall be covered under the annual maintenance renewal contract:

● Hysweep

● Hypack Max

● Hysweep Max

● Hypack Survey

● Hypack ECHO

● Any and all combinations of the above software packages

2.3 Existing Perpetual License Renewals

The following perpetual licenses, and any future license purchases, shall be covered under this annual maintenance renewal contract:

Software Product Key ID Number of Keys

Hysweep 15683314 1

Hypack Max 15682364, 15683309, 15682378 3

Hypack Survey 15682355, 15682356, SL 1417 3

Hypack Max & Hysweep (Combination)

15683310, 15683311, 15683323, 15688367, 15688492, 15692580, 15692581, 15692582, 15686807, 15692584, 15694862, 15702558

Hypack Survey & Hysweep (Combination)

15682365, 15682366, 15682376, 15682386, 15682387, 15682394, 15682395, 15682396, 15682398, 15683303, 15683304, 15683312, 15686962, 15687257, 15688285, 15693529, 15694069, 15682385, 15691317, 15691318, 15703307, 15681095*

Hypack ECHO SL 2017, SL 2018 2

* One license (Hypack Survey & Hysweep #15681095) has a different period of performance than the rest in the base year only: August 16, 2025, though September 29, 2026.

2.4 Options to Purchase Additional Software Licenses

NOAA will have the option to purchase additional software packages, in any of the above single or combination packages, in Option Years One through Four, at the price(s) quoted in this contract, with new licenses including a one-year warranty. Upon completion of the included one-year warranty period for new software purchases, those software packages purchased will be added to the existing licenses listed above, and included in successive Option Year warranty periods.

3. Specifications

For Hypack software maintenance, an Enterprise Licensing Agreement is required that includes access to the forty-three (43) existing licenses of the software described in Section 2, Scope of Work. This agreement shall utilize single license keys. The license keys can only be distributed within NOAA Office of Coast Survey (Coast Survey Staff, CSDL, HSD, and NSD), OMAO, OER, and NCCOS.

4. Period of Performance

NOAA requires a five-year contract for procurement of Hypack Software Annual Maintenance Renewals, with the option to purchase new, additional software licenses each year. The Period of Performance (POP) for this contract will be:

Base Year: September 30, 2025, through September 29, 2026 (one license POP begins August 16, 2025) Option Year One: September 30, 2026, through September 29, 2027 Option Year Two: September 30, 2027, through September 29, 2028 Option Year Three: September 30, 2028, through September 29, 2029 Option Year Four: September 30, 2029, through September 29, 2030

5. Government Points of Contact

Technical Task Lead To be determined at award

Contracting Officer’s Representative (COR)

Information System Security Officer (ISSO)

6. Statement of IT Security Requirements

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The following is a list of relevant information the Department of Commerce (DOC) Information

Technology (IT) Security takes into consideration when assessing the security requirements and risk for procuring IT products and services.

a) The Contractor shall only supply Information Technology (e.g., hardware, software, firmware, etc.) and/or product license and shall not require the use of any contractor owned equipment.

The contractor will not have remote access to any government owned equipment. The Contractor shall ensure the acquiring Information Technology provided disables “phone home” or similar capabilities.

b) Product support and supporting documentation allows for the sanitization of the acquiring Information Technology and/or product license upon the disposal of the product. Product shall allow the use one of the approved methods for secure destruction of data/information including unclassified but sensitive information. Approved methods include NIST Special Publications 800- 88 Guidelines for Media Sanitization (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) or the National Security Agency in the Media Destruction Guidance (https://www.nsa.gov/Resources/Media- Destruction-Guidance/).

c) The acquiring information technology is engineered for trustworthy and security that is consistent with the engineering-based trustworthy secure solutions as outlined in NIST Special Publication 800-160 Version 1, Revision 1 Engineering Trustworthy Secure Systems (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1r1.pdf) and NIST Special Publication 800-160, Volume 2, Revision 1 Developing Cyber-Resilient Systems: A Systems Security Engineering Approach (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf).

d) The acquiring information technology complies with Office of Management and Budget Memorandum M-07-18 Ensuring New Acquisitions Include Common Security Configurations and the Federal Acquisitions Regulations (FAR) 39.101(d) regulations require NIST common security configuration checklists including United States Government Configuration Baseline (USGCB) initiative. More information is available at National Checklist Program (NCP), (https://nvd.nist.gov/ncp/repository), the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low-level guidance on setting the security configuration of operating systems and applications. The acquiring information technology considers the following requirements:

i. Software procured meets the standard installation, operation, maintenance, updates and/or patching of software shall not alter the configuration settings from the approved USGCB/other secure configuration.

ii. Applications designed for normal end users run in the standard user context without elevated system administration privileges.

iii. Supporting documentation or reference(s) that describes the security capabilities, the design and development processes and the testing and evaluation procedures used by the product or services being provided for this acquisition.

iv. Supporting documentation or reference(s) that describes all product or service updates and enhancements as they are implemented. The product or service supporting documentation could be the user and system administrator guides, which is documents the functional properties of the security controls employed to permit the analysis and testing of the security controls.

e) The acquiring information technology complies with the Homeland Security Presidential Directive 12 (HSPD-12) Policy for a Common Identification Standard for Federal Employees and Contractors requirements from FAR 4.1302 stating: (a) In order to comply with Federal

Information Processing Standard (FIPS) 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors (https://doi.org/10.6028/NIST.FIPS.201-3), agencies must purchase only approved personal identity verification products and services, (b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

f) The acquiring information technology complies with Internet Protocol Version 6 (IPv6) requirements from FAR part 11.002 requirements that state the agency Chief Information Officer can waive this requirement provided the acquisition requirements documents the appropriate technical capabilities defined in the USGv6 Profile available in the NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-program) and the corresponding declarations of conformance. To meet this requirement each DOC acquisition of IP protocol technology must express requirements for IPv6 capabilities in terms of the USGv6 Profile (i.e., using the USGV6 Capabilities Check List) and vendors must be required to document their product’s support of the requested capabilities through the USGv6 test program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1) using the USGv6 Suppliers Declaration of Conformity.