RFI FNA-CPO-0126 Attachment - Draft Performance Work Statement.pdf

1 | P a g e

Draft Performance Work Statement (PWS)

Data Verification and Validation Link Analysis Software Platform - Artificial Intelligence (AI) Solutions for Network Performance Analytics and Data Validation

First Responder Network Authority (FirstNet Authority), U.S. Department of Commerce

2 | P a g e

Table of Contents

1. Purpose

2. Background

3. Scope of Work

3.1. Data Ingestion, Validation, and Quality Assurance

3.2. Data Analytics for NPSBN Network Performance

3.3. Predictive Modeling and AI-Driven Insights

3.4. Platform Capabilities and User Experience

3.5. Data Strategy, Visualization, and Decision Support

3.6. AI/ML Transition

3.7. System Performance Characteristics

3.8. Data Rights and Ownership

3.9. Risk and Change Management

3.10. Security, Privacy, Regulatory Compliance

3.11. Service Support

3.12. Tasks, Deliverables, and Reporting

3.13. Section 508 Compliance

3.14. Non-Disclosure and Sensitive Data Handling

4. Period of Performance

5. Place of Performance

3 | P a g e

1 Purpose The purpose of this contract is to acquire a Data Verification and Validation Software Platform that will bring data analytic automation capabilities to the First Responder Network Authority (FirstNet Authority) that can support network performance analytics, data validation, predictive modeling and data visualization.

The Agency seeks an Artificial Intelligence (AI)-based solutions enabling real-time data correlation, automated validation, and advanced analytics across complex contractor-submitted datasets. The solution underpins the Agency’s ability to deliver transparent, accountable, and data-driven oversight of the Nationwide Public Safety Broadband Network (NPSBN) performance, supporting both 47 USC§1426(b)(1)(d) and 47 USC§1426(c)(1)(e).

2 Background The FirstNet Authority was established under the Middle-Class Tax Relief and Job Creation Act of 2012 to deploy and operate a nationwide, interoperable broadband network dedicated to public safety.

The FirstNet Authority’s Network Program Management Office (NPM) currently relies on manual review by Subject Matter Experts (SMEs) to verify and validate contractor-submitted information. While this “best effort” sampling approach provides valuable oversight, it cannot ensure complete accuracy or data integrity. The process is challenged by the absence of standardized validation criteria, inconsistent data formats, and a lack of automated tools.

Data relevant to the NPSBN is distributed across multiple platforms—including secure file transfer systems, SharePoint, OneDrive, and email—and exists in both structured and unstructured formats. These limitations hinder the Authority’s ability to meet performance goals, comply with Inspector General (IG) or audit findings, and maintain high standards of data accuracy.

To address these challenges and advance its mission of deploying and operating a nationwide, interoperable broadband network for public safety, the FirstNet Authority seeks solutions that shall:

Support centralized, scalable, and efficient data validation and verification, enabling data-driven decision-making, improved oversight of contractor obligations, and alignment with regulatory and audit standards.

Predict performance trends and identify network impairments.

Benchmark network quality against commercial carriers.

Integrate and analyze geospatial datasets (e.g., FCC coverage maps, GIS layers).

Ensure compliance with privacy, cybersecurity, and audit requirements.

4 | P a g e

Support measurable accuracy and performance goals, including the ability to report on compliance with IG/audit findings.

Automate and enhance the validation and analysis of carrier-provided network, cybersecurity, and crowdsourced data, while establishing and enforcing data validation standards to ensure consistency and reliability.

3 Scope of Work The solution shall encompass the following core capabilities:

3.1 Data Ingestion, Validation, and Quality Assurance

Ingest and process large volumes of structured and unstructured data (initial data volumetrics starting at 5TB and scaling to 150TB (TBR)) from multiple sources, including:

o Carrier-provided network and cybersecurity data o Crowd-sourced performance data o Federal Communications Commission (FCC) Form 477 and Broadband Data

Collection (BDC)) datasets o Geographic Information System (GIS) and geospatial data layers

Apply AI/Machine Learning (ML) techniques to:

o Cleanse and validate incoming data o Detect anomalies, corrupted records, and outliers o Ensure data integrity and consistency across time and geography o Provide automated data quality scoring and audit trails

3.2 Data Analytics for NPSBN Network Performance

Deliver real-time and historical analytics (from 2017 to present date) on key performance indicators (KPIs), including:

o Throughput, latency, jitter, and packet loss o Service availability, Network availability and reliability o Connections related to include adoption and churn rates o RF Coverage, Temporary Coverage data including Recovery Time Objectives o User experience metrics (e.g., call success rate, session drops)

Enable benchmarking of NPSBN performance against commercial networks

Support differentiation between indoor and outdoor RF coverage and usage

Provide spatial and temporal granularity down to the census block or geohash level

3.3 Predictive Modeling and AI-Driven Insights

Implement ML models to:

o Forecast network performance trends and degradation risks

5 | P a g e o Identify emerging coverage gaps and capacity constraints o Prioritize infrastructure investments based on usage patterns and risk

In addition to traditional machine learning models, the Contractor shall incorporate Large Language Models (LLMs) to support natural language querying, semantic searches, automated summarization of network performance reports, and generative analytics.

o LLMs shall be fine-tuned or configured to operate securely within the platform and support user interactions through conversational interfaces or embedded assistants.

Support scenario modeling and “what-if” analysis for planning and optimization

Integrate geospatial indexing (e.g., Hexagonal Hierarchical Geospatial Indexing System (H3), geohash) for scalable spatial analyses

3.4 Platform Capabilities and User Experience

Deploy a secure, cloud-native analytics platform that includes:

o Intuitive dashboards for technical and non-technical users o Role-based access control and audit logging o Customizable reporting and alerting features

Provide access to raw and processed data via:

o RESTful Application Programming Interface (API)s o Structured Query Language (SQL)-based query interfaces o Downloadable formats for offline analysis

Maintain historical data access for a minimum of 18 months

3.5 Data Strategy, Visualization, and Decision Support

Develop and maintain data pipelines for:

o ETL (Extract, Transform, Load) operations o Real-time and batch processing o Integration with enterprise data warehouses

Create visualization solutions that improve usability, analytical depth and decision support, as required. Apply AI/ML to:

o Enhance data exploration and pattern recognition o Optimize network performance and resource allocation o Support executive-level decision-making

3.6 AI/ML Transition

Execute a seamless transition of all AI/ML assets, data pipelines, and analytics platforms from the incumbent provider, including but not limited to:

o Knowledge transfer and documentation

- Initial user training shall be conducted for up to 25 government personnel

- User acceptance testing shall be conducted for all data pipelines and use cases

(between 25-35)

6 | P a g e o Coordination with outgoing Contractor

Validate and migrate:

o Existing AI/LLM/ML models and dashboards o Historical datasets and metadata o Platform configurations and user roles

3.7 System Performance Characteristics

The Contractor shall ensure the platform meets the following performance requirements:

o System uptime of 99.9% or higher, excluding scheduled maintenance.

o Average response time for user queries shall not exceed 2 seconds under normal load.

o Support for a minimum of 75 concurrent users without degradation in performance.

o The Contractor shall notify the FirstNet Authority when cloud hosting storage resources reach 50% of the aggregate threshold and again at 75% for each base and option period of this contract.

For the purpose of the RFI, the Contractor shall offer storage and performance scalability options and recommendations as separately priced CLINs.

3.8 Data Rights and Ownership

All data ingested, processed, or generated under this contract shall be and remain the exclusive property of the U.S. Government.

The Contractor shall provide unrestricted access to raw and processed data, including metadata and audit logs.

The Contractor shall not use, share, or retain any government data for purposes outside the scope of this contract without prior written approval.

The Contractor shall identify any proprietary components that may affect data access or portability and propose mitigation strategies.

The Contractor shall support data export in a common format upon request or at contract end. The Contractor shall comply with Federal Acquisition Regulation (FAR) 52.227-14 and 52.227-19 for data rights and software licensing.

3.9 Risk and Change Management

The Contractor shall implement a Risk Management Process following commercial best practices, that identifies potential technical, operational, and cybersecurity risks, including appropriate mitigation and resolution steps as needed.

The Contractor shall implement a Change Management (CM) Process following commercial best practices, for all updates to the platform, including AI model changes, software patches, and infrastructure modifications. The CM process shall include, but not be limited to the following:

o Maintaining version control for all AI/ML models used in the platform.

7 | P a g e o Maintaining documentation of changes, performance benchmarks, and validation results.

o The Contractor shall notify the Government of any planned updates at least 10 business days in advance.

o The Government reserves the right to review and approve model updates prior to deployment.

3.10 Security, Privacy, Regulatory Compliance

Ensure full compliance with applicable laws and regulations, including:

o Federal Information Security Modernization Act (FISMA) o National Institute of Standards and Technology (NIST) Special Publication (SP)

800-53 and 800-171 o General Data Protection Regulation (GDPR) o California Consumer Privacy Act (CCPA)

Implement robust privacy-preserving techniques, including:

o Anonymization of personal and device identifiers o Opt-in/opt-out mechanisms for data sharing o Provide a cybersecurity framework that protects sensitive data and supports incident response o Provide and manage a secure and scalable cloud environment (FedRAMP

Moderate or equivalent) as part of the solution.

FedRAMP and Security Compliance o The Contractor shall ensure the platform is hosted in a FedRAMP-certified

Amazon Web Services (AWS) GovCloud environment and complies with NIST SP 800-53, FIPS 200, and FIPS 199 standards.

Authority to Operate (ATO) Support o The Contractor shall support the ATO and Initial Authority to Test (IATT) processes in coordination with FirstNet Authority OCIO.

o The Contractor shall support the FirstNet Authority in achieving and maintaining an Authority to Operate (ATO) for all systems, platforms, and services delivered under this contract.

o The Contractor shall collaborate with FirstNet Authority’s Information Security and IT teams to ensure all security documentation, assessments, and controls are completed for the software solution provided, in accordance with the Risk Management Framework (RMF) and NIST SP 800-53 requirements.

o The Contractor shall provide the following ATO-related deliverables and support activities as applicable to the software solution provided:

System Security Plan (SSP) inputs and technical documentation Security Assessment Plan (SAP) and Security Assessment Report (SAR) support

8 | P a g e

Plan of Action and Milestones (POA&M) development and remediation tracking

Continuous Monitoring (ConMon) strategy and implementation Support for security control testing and validation

The Contractor shall ensure that all software components, including AI/ML models and data pipelines, are compliant with applicable federal cybersecurity standards and are appropriately documented for ATO review.

The Contractor shall participate in security reviews, audits, and meetings associated to the software solution provided, as required by the FirstNet Authority’s Authorizing Official (AO) or designated representatives.

Security Incident Reporting o The Contractor shall notify the COR and CO within 1 hour of a suspected breach and provide a written report within 24 hours. Ongoing updates and a mitigation plan are required.

3.11 Platform & Implementation Support

The Contractor shall provide core platform support, training, cloud infrastructure support, deployment, training, cloud hosting, and full lifecycle support, amongst others.

In particular:

o The Government is responsible for the initial integration support (e.g., the initial build using the provided platform).

o The Contractor shall provide advanced integration support (e.g., Tier 2-3), a cloud Infrastructure, system performance and training to meet the requirements specified in this contract.

o For integration use cases, the Contractor shall optimize two-week sprint cycles with bi-monthly User Acceptance Tests (UATs) as part of use case integration delivery.

o The Contractor shall establish an incident response and escalation structure to support the SLA requirements specified in this contract.

o The Contractor shall provide training materials and on-demand resources to include user guides, admin training. video tutorials, reference guides, feedback sessions, as required.

Incident response and resolution times shall comply with the following Service Level Agreements (SLAs):

o Critical issues: response within 1 hour, resolution within 4 hours.

o High priority: response within 4 hours, resolution within 1 business day.

o Medium priority: response within 1 business day, resolution within 3 business days.

o Low priority: response within 2 business days, resolution within 5 business days.

9 | P a g e

3.12 Tasks, Deliverables, and Reporting

The Contractor shall provide recurring and ad hoc deliverables to support program oversight, performance tracking, and compliance. All deliverables must be submitted to the COR and any appointed Technical Lead for inspection, review, and acceptance.

Formal acceptance occurs upon COR signature.

Deliverable Description Due Date

Kick-Off Meeting

The FirstNet Authority COR will schedule and organize the introduction meeting invite within 5 days of contract award.

The meeting invite will be coordinated in advance with the Contractor.

5 days from delivery of award

Weekly Meetings

Meetings that occur on a weekly basis are organized with meeting invites owned by the FirstNet Authority based on the agreed upon time with the Contractor. Weekly meetings are managed based on the discretion of the program office and COR. The following weekly meetings shall be conducted:

Weekly Integration Tag-up at the PM/COR/Lead Integration POC – 1 hour duration. Intent is to review planned sprint content for the week and discuss any risks or challenges.

Weekly Integration Technical Sync with lead integrator and assigend FN technical SMEs, per use case theme (2-3 per week) - 1 hour duration per sync. Intent is to review weekly sprint ticket progress and obtain rapid feedback

Weekly program level status to include action item reviews – 30 min duration. PM content

Recurring, agreed upon date & time

Meeting Agendas

Meeting agendas’ input shall be provided by the contractor to PM and COR, one business day prior to the scheduled meeting.

As required, 1 business day before the meeting

Meeting Minutes & Action Item Tracker

Develop meetings minutes and post at designated location.

A consolidated action item tracker shall be provided and maintained.

As required; 2 business days after the meeting

10 | P a g e

Software Platform Delivery

Within 90 days of contract award, during the base period, the integrated solution shall include successful onboarding for up to ~75active users. This active user group may fluctuate to no greater than 75.

In parallel, data connections, and operational functionality of the platform shall be completed within 90 days of contract award to allow for full solution data integration and full user experience. Operational functionality shall be achieved with successful validation by selected onboarded users.

The Contractor shall notify the FirstNet Authority when cloud hosting reached 50% of the aggregate threshold and again at 75% for each base and option period.

Within 90 days of the contract award

Project Management Report & Schedule

Detailed implementation plan with milestones with two week sprint cycle c

30 days after contract award; Monthly thereafter

Platform & Solution Deployment

Fully functional AI analytics platform with successful User Acceptance Testing (UAT) for all use cases transitioned from the incumbent

90 days after award with successful UAT’s by onboarded users

Monthly, or as required and agreed upon, UAT’s for identified use case integrations

Monthly Reports & Schedules

Summary detailing analytics, system performance, software updates, configuration changes, risk matrix, security and issues/challenges or topics as mutually agreed upon.

Schedules shall also contain detailed agile sprint activities for each agreed upon use case

Monthly or as needed and agreed upon

Transition Plan & Schedule

Strategy for seamless transition from incumbent

Transition Phase-In Plan & Schedule shall include, at a minimum:

- Management of phase-in activities

- Initial staffing levels and timeline to achieve full staffing

Transition –In: Initial with proposal, updated and finalized within 15 days after contract award

Transition – Out: Initial within 90 days of

11 | P a g e

- Monitoring and reporting of transition progress

- All phase-in activities shall be completed within 30 days of the effective date of the contract.

Transition Phase-Out Plan & Schedule shall include:

- Transfer and/or return of Government Furnished Property, materials, equipment, and data

- Management of knowledge transfer activities

- Delivery of all documentation and data completed under the contract, including final versions, drafts, and supporting research and analysis

- Monitoring and reporting of transition progress

- Submission of a final invoice contract end, updated and finalized within 60 days of contract end

Final Report Summary of outcomes, summary of achievements with KPI’s, lessons learned, and recommendations

Recurring, 30 days prior to end of the current contract year or as mutually agreed upon

3.13 Section 508 Compliance

The Contractor shall ensure all user interfaces and documentation conform to Section 508 standards. An Accessibility Conformance Report (ACR) using the VPAT template shall be provided upon request.

3.14 Non-Disclosure and Sensitive Data Handling

All Contractor personnel shall sign NDAs with FirstNet and AT&T. No public release of reports or data is permitted without CO approval. The Contractor shall safeguard all sensitive information and comply with applicable data protection requirements.

4 Period of Performance

The period of performance shall be 12 months from the date of award, with four (4) option periods (e.g., base year plus four option years).

5 Place of Performance Work may be performed remotely with coordination and periodic meetings with FirstNet Authority staff located in Reston, VA, Boulder, CO, and other CONUS designated locations .

12 | P a g e

The Contractor shall be responsible for all travel related expenses; the Government will not reimburse travel expenses.