20261103_U_PWS_DRAFT.docx
DOCX document 606 KB Posted
- Solicitation number
- RFI_CMSII_11032026
About this file
This is a Performance Work Statement (PWS) for the National Geospatial-Intelligence Agency (NGA) GEOINT Professional Certification (GPC) Candidate Management System (CMS II), dated November 3, 2026. The PWS establishes comprehensive requirements for implementing, operating, maintaining, and sustaining a COTS-based candidate management system to support the full end-to-end lifecycle of GPC candidates and credentialed GEOINT professionals, capable of scaling to approximately 55,000 active/inactive records. The system must manage certification eligibility, exam administration, credential conferral, recertification workflows, and Professional Development Unit (PDU) tracking, with automated communications, role-based access controls, and business intelligence dashboards for program administrators.
Key operational requirements include: 99.9% system uptime (excluding scheduled maintenance); secure, encrypted HTTPS traffic with multi-factor authentication; compliance with DoD security standards (DoDI 1322.26, NIST SP 800-53, DoD Privacy Program); annual Authority to Operate (ATO) certification from NGA Security; semi-annual software updates with all changes validated in a sandbox environment before production deployment; and data retention for a minimum of ten years. The contractor must maintain routine database and server image backups with Service Level Agreements mandating resolution of minor incidents within 72 hours and major incidents within 48 hours. Deliverables include weekly resource meetings and minutes, quarterly program management reviews, annual functional enhancement reports, monthly invoices, and a Quality Control Plan due within 35 days of contract award. The contractor must provide two key personnel: a Program Manager with minimum five years of relevant program management experience and a Technical Account Manager with minimum two years of direct experience administering credentialing systems and two years of computer programming and COTS workflow engine configuration experience. No Government-furnished property will be provided, and work shall be performed at the contractor's facility. The PWS references related CDRLs and includes detailed performance requirements with surveillance methods, including performance deductions for failure to meet uptime and reporting standards.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 20261019_U_GPC_CMS_II_RFI_Questions.docx | DOCX document | |
| CMSII_RFI_v1.0.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
National Geospatial-Intelligence Agency
Performance Work Statement
GEOINT Professional Certification (GPC) Candidate Management System (CMS II) II
National Geospatial-Intelligence Agency
November 03, 2026
PWS Revision Log
| Date |
| Section/ Description of Change |
| Author/ Approver |
| Revision Number |
1.0 Introduction
1.1 Background
The GEOINT Professional Certification (GPC) Program operates in compliance with the standards of the National Commission for Certifying Agencies (NCCA) in support of Undersecretary of Defense for Intelligence and Security (USD(I&S)) and Director of National Intelligence (DNI) initiatives to professionalize the National System for Geospatial-Intelligence (NSG) workforce. The program provides standards and enables synchronization and alignment of individual capabilities within the NSG through portable credentials deemed critical to the successful execution of GEOINT missions and functions. The credentials are documented, managed and maintained by contract support staff and a Candidate Management System (CMS), providing a means to assess proficiency levels against core occupational competencies. The GPC Program Management Office (PMO) aligned under the Human Development (HD) Directorate within the National Geospatial-Intelligence Agency (NGA) is responsible for the administration of the GEOINT Professional Certification (GPC) Program.
In January 2018, NGA selected LearningBuilder as the technology platform to manage aspects of the GEOINT initial certification and recertification processes. Prior to LearningBuilder, NGA managed the credentials using custom internal databases and spreadsheets, which required significant administrative time and resources. After launching LearningBuilder, NGA has evolved the scope of the initial requirements and continually evolved the platform to increase operational functionality and bring more aspects of the GPC specific certification process into the system.
1.2 Objective
The objective of this PWS is to provide a comprehensive solution for managing the GPC lifecycle. This includes providing NGA with an end-to-end credential managing system to manage certification eligibility, exams, and renewals, while tracking compliance and giving program administrators tools to handle exceptions and monitor program success.
1.3 Scope
The Contractor is required to implement, operate, maintain, and sustain an established CMS (to support the full end-to-end lifecycle of GPC candidates and credentialed GEOINT professionals, capable of scaling up to an estimated population of 55,000 active/inactive records over the life of the contract. The Contractor is responsible to fulfill the following tasks to meet the contract requirement:
Task 1: CMS Implementation, Operation, Maintenance, and Administration Task 2: System and Data Configuration Services Task 3: System Security and Information Assurance Task 4: Infrastructure and Disaster Recovery Task 5: Functional Enhancements
2.0 Requirements
2.1 CMS Implementation, Operation, Maintenance, and Administration The Contractor shall implement, operate, maintain, and sustain an established CMS (to support the full end-to-end lifecycle of GPC candidates and credentialed GEOINT professionals (CDRL A0001). This includes maintenance and/or conversion of all legacy records, which are currently in LearningBuilder.
2.1.1 Lifecycle Workflow Administration and Candidate Pathways The Contractor shall ensure the CMS successfully executes and tracks all stages of the following credentialing lifecycle:
· Eligibility and Registration: Eligibility determination, automated prerequisite validation, workflow tracking, and exam registration.
· Role Ordering and Application Pathways: Facilitate visual and structured application progression that enables candidates to track current credentials and systematically plan advanced career pathways. The system shall visually highlight active applications, dynamically order eligible roles, and provide guided pathways for candidates to explore and pursue additional GPC.
· Exam Administration: Secure exam scheduling, test delivery tracking, and automated posting of score results and diagnostic feedback.
· Credential Conferral and Document Generation: Processing conferral recommendations, conferring official credentials, and generating electronic certificates and formal award letters. The Contractor shall ensure digital certificates and award letters render consistently across platforms and that both current and historical archival records remain verified and accurate.
· Streamlined Recertification and Automated PDU Logging: Supports Continuous management of Professional Development Unit (PDU) logs updates, recertification applications, and random/targeted audit workflows. The CMS shall automatically calculate and award PDU credits toward existing recertification cycles upon the conferral of a new specialty credential (e.g., GPC-F, PL-II), eliminating redundant manual submissions.
2.1.2 Access Control and Role-Based Permissions
The Contractor shall administer and maintain secure, role-based access for all designated user populations. Prior to granting access, the Contractor shall ensure authorized administrative users execute NGA-approved Nondisclosure Agreements (NDAs). Role permission shall be configured to support:
· Candidate Access: Secure portal for profile management, pathway exploration, exam scheduling, score reporting, digital form submissions (renewals, appeals, waivers), and PDU tracking.
· System Administrator / Program Manager Access: Centralized interface to analyze program-wide metrics, manage item banks, audit recertification records, configure audit percentages, set audit date ranges, and oversee automated conferral processes.
· Component Service Representative (CSR) Access: Segmented, organizational-level access to view reports and approve exam registrations only for candidates within their assigned components/services, with the capability to submit incident tickets on behalf of candidates.
2.1.3 Automated Communications and Reporting
· The CMS shall generate and deliver clear, event-driven email notifications to candidates and stakeholders to provide real-time status updates throughout the credentialing and recertification lifecycles.
· The system shall support international address formats for global practitioners and military postal formats (e.g., APO/FPO/DPO).
· The Contractor shall maintain interactive, web-based forms enabling digital approval workflows across NGA, DoD Components, and approved industry partners.
2.1.4 Data Analysis and Business Intelligence
· The Contractor shall ensure that the GPC PMO has all necessary dashboards and visualizations to support program decision making.
2.2 System and Data Configuration Services
The Contractor shall perform system configuration, database upkeep, and integration maintenance to adapt the COTS-based CMS platform to evolving GPC program requirements (CDRL A0002).
2.2.1 Application Configuration and Upgrades
· Workflow Optimization: The Contractor shall optimize application workflow configurations and business rules to align with evolving GPC policies and DoD credentialing directives.
· The Contractor shall support the long-term maintainability of the CMS through the continuous review of custom stored procedures for possible conversion into configurable core platform capabilities, while producing recommendations and product features for reducing customizations and improving upgradability. The Contractor shall include their recommendations in the annual Functional Enhancement Report (CDRL A0003).
· Vendor Software Baseline: The Contractor shall implement semi-annual software updates and scheduled patches to keep the CMS on a fully supported, secure vendor code base, integrating new product innovations to optimize administrative workflows.
· Integration and APIs: The Contractor shall manage and maintain Application Programming Interfaces (APIs) and secure data connectors to ensure seamless, real-time data transfers with Government-designated third-party systems.
2.2.2 Enhanced Bulk Data Import and System Synchronization
The Contractor shall configure, optimize, and administer bulk data import capabilities enabling NGA and program administrators to upload large volumes of data in streamlined batches with automated system updates. The bulk import capability shall support:
· Creating and provisioning new user accounts.
· Adding and updating Certification Roles (e.g., GPC Fundamentals [GPC-F], Professional Level II [PL-II], and emerging specialty credentials).
· Uploading bulk exam results and third-party testing vendor outcome data.
· Processing bulk conferral recommendations and issuing bulk credential conferrals.
· Creating and maintaining authorized testing center and exam site profiles.
2.2.3 Test Environment ("Sandbox") Maintenance
· The Contractor shall maintain a fully functional, non-production "sandbox" or pilot environment that mirrors production data structures and business rules.
· All configuration changes, feature updates, bulk import schemas, and API modifications shall be successfully tested and validated in the sandbox environment to ensure zero disruption to the active production environment prior to deployment.
2.3 System Security and Information Assurance
The Contractor shall protect candidate data, personal information, and infrastructure in compliance with federal and DoD cybersecurity mandates (CDRL A0004).
2.3.1 Security Compliance Standards
· The Contractor shall ensure the CMS operates in alignment with DoDI 1322.26 (implementing xAPI protocols where applicable), DoD Directive 5400.11 ("DoD Privacy Program"), and DoDM 5200.01 ("Information Security Program") concerning the handling of Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII).
· The Contractor shall ensure adherence to National Institute of Science and Technology (NIST) SP 800-53 security controls, to include receiving and maintaining the Authority to Operate (ATO) from NGA Security (CDRL A0005).
2.3.2 Infrastructure Security Protocols
The Contractor shall manage and execute the following security operations:
· Restrict all application traffic via Hypertext Transfer Protocol Secure (HTTPS), ensuring data-in-transit is fully encrypted.
· Manage authentication using secure, hardened server images that comply with DoD standards.
· Support secure user authentication via multi-factor credentials, digital identity certificates, or strong usernames/passwords.
· Conduct routine system Assured Compliance Assessment Solution (ACAS) and Security Technical Implementation Guide (STIG) scans.
· Promptly remediate security vulnerabilities and apply software patches.
· Maintain a shared security stack including network firewalls, Web Application Firewalls (WAF), Intrusion Detection Systems (IDS), and Network Address Translation (NAT).
· Maintain and submit required system security documentation (e.g., SSP, CONOPS, SCTM, ConMon, STP) in compliance with NGA authorizations.
2.4 Infrastructure and Disaster Recovery
The Contractor shall maintain hosting infrastructure that ensures system performance, wide accessibility, and robust data protection (CDRL A0006).
2.4.1 System Performance and Compatibility
· The CMS shall maintain compatibility with current and previous releases of standard web browsers (including Microsoft Edge, Mozilla Firefox, Apple Safari, and Google Chrome).
· The infrastructure shall provide sufficient storage capacity to preserve all active and inactive candidate information, assessment delivery logs, digital attachments (appeals, waivers, PDU proof documents), and system templates for a minimum of ten (10) years, in accordance with NCCA standards.
2.4.2 Data Backups and Incident Response SLA
· The Contractor shall perform secure, routine backups of database files and server images to ensure business continuity.
· In the event of an incident impacting candidate data, PII, CUI, or system availability, the Contractor shall resolve the issue and restore normal operations in accordance with the following Service Level Agreements (SLAs):
· Minor Impact ( users affected): Complete system resolution within seventy-two (72) hours of incident discovery.
· Major Impact ( users affected): Complete system resolution within forty-eight (48) hours of incident discovery.
· Reporting: Submit a comprehensive After Incident Report to the GPC PMO within 1 business day after the incident is resolved.
2.5 Functional Enhancements
As the GPC Program’s operations and certification requirements evolve, new necessary features will be identified, defined, and funded. This includes customizations that need additional work for future forward system compatibility as well as Product Innovations (as defined in Appendix A), all of which allow a continuation of support within the contract scope.
· The Contractor shall provide an Annual Functional Enhancement Report (CDRL A0003) on recommended functional enhancements.
· The Contractor shall provide support for functional enhancements which will be within the general scope of this PWS and include ad hoc activities and tasks, both of which will be negotiated as they arise (CDRL A0007).
3.0 General Requirements
3.1 Program Management
The Contractor shall provide proactive program management to ensure all deliverables, schedules, and quality requirements are met. Program management shall have professional oversight, transparent communication, and proactive risk management that prevents service disruptions. The Contractor shall provide a Program Manager (PM) a single point of contact for contract administration. The PM shall participate in quarterly reviews with the Contracting Officer (CO) and/or Contracting Officer’s Representative (COR) to discuss contract execution, system metrics, identified risks, and mitigation strategies.
3.1.1 Reports and Meetings
The Contractor shall provide all necessary support, collaboration, and active participation for the following reports and meetings:
3.1.1.1 Resource Meetings
A weekly resource meeting to discuss various topics, such as changes in personnel, emerging issues, and the Contractor’s plan of action (CDRL A0008). Weekly resource meetings shall only include topics pertinent to the GPC Program Management Office (PMO). In addition, the GPC PMO or the Contractor may convene additional separate meetings, as necessary, to discuss other issues or questions as they arise. The Contractor shall provide an electronic copy of the meeting minutes to the GPC PMO and COR within two business days following the meeting. (CDRL A0009)
3.1.1.2 Quarterly Program Management Reviews (PMRs)
The Contractor shall conduct quarterly meetings to deliver updates to the Government on program status and performance outcomes (CDRL A0010). The agenda and scheduling of the PMR shall be coordinated with the COR and its content shall accurately depict the current status of performance against contract requirements (section 2.0 Requirements) and relevant financial information. The PMRs shall be virtual. In addition, the Contractor shall provide post-meeting minutes within two business days following the meeting. (CDRL A0011)
The Government will provide the Contractor with feedback at the meeting. The Contractor shall adjust as needed throughout the period of performance based on performance outcomes and feedback from the Government.
3.1.2 Cost Tracking and Invoicing
The Contractor shall provide all necessary support, collaboration, and active participation for the following cost tracking and invoicing.
3.1.2.1 Cost Tracking
The Contractor shall maintain and report out on all current and projected contract costs for each period of performance. The reporting will be included in the quarterly program management review.
3.1.2.2 Invoicing
The Contractor shall submit all invoices NLT the end of the following month in which the services were performed. (e.g. Invoice for services performed 01-31 October would be submitted NLT 30 November) (CDRL A0012).
3.2 Quality Assurance Surveillance Plan (QASP)
The Government will utilize a QASP to monitor the contractor’s performance on the contract. The QASP is a living document and can change at any time during the life of the contract. As such, the Government reserves the right to unilaterally edit the QASP at the Government’s discretion.
3.3 Quality Control Plan (CDRL 0013)
The Government is committed to a highly interactive relationship between quality control by the contractor and quality assurance by the government recipient of services. This relationship shall be achieved through an effective Quality Control Plan (QCP) dedicated to ensuring the best possible products and services to end users. The contractor shall provide their final written QCP in accordance with this PWS and as outlined in the deliverables schedule.
The Contractor shall establish and maintain a QCP to ensure the requirements of this contract are provided as specified by describing the inspection system for the requested services listed in this PWS. The CO/COR will notify the contractor of acceptance or areas requiring discussion. The QCP shall be finalized IAW the discussions and submitted not more than 35 calendar days after contract award. The QCP shall be updated as changes occur. Each update shall be submitted to the COR and CO for review and acceptance.
The Contractor’s QCP shall demonstrate a prevention-based approach by meeting all PWS objectives throughout contract performance. Developed to define the Contractor's quality management and control responsibilities, the QCP shall, at a minimum, address:
· Continuous process improvement and trend analysis.
· Inspection protocols, including scheduling, execution, and documentation.
· Discrepancy management, outlining identification, corrective actions, and resolution of Government-identified non-conformances.
· Root Cause Analysis (RCA), detailing methodologies to isolate root causes and implement corrective actions to prevent recurrence.
· Customer feedback, establishing systems for capturing and addressing client complaints.
3.4 Transition Plan (CDRL A0014)
The Contractor shall develop and maintain a Transition Plan that includes an itemized list of program and project information critical to contract transition. The plan shall address, at minimum, objectives of the transitions, the contractor’s roles and responsibilities, planning and implementation, scheduling, and reporting as part of transition activities in order to ensure full performance is completed during all transitional activities. An initial transition plan shall be provided at time of proposal. The Transition Plan shall then be updated and delivered 10 days prior to the contract kick-off meeting (detailing the phase-in period), and then again 90 days before the end of the contract (detailing the phase-out period).
3.4.1 Phase-In Period
The phase-in period shall be completed 30 days after the contract start date. The Contractor shall have all Key Personnel available full time at contract start.
3.4.1.1 Kick-Off Meeting (CDRL A0015)
The contractor shall lead a contract kickoff meeting with the Government Program Management (GPM) Team within 5 business days of the contract start. The Kickoff Meeting Agenda is due at least 1 business day prior to the kick-off meeting, to the COR. To minimize any decreases in productivity and to prevent possible negative impact on additional services, the contractor shall have all key personnel available to perform at contract start.
3.4.2 Phase-Out Period
Prior to the completion of this contract, an observation period may occur, at which personnel of the incoming contractor may observe operations. This will allow for orderly turnover of information, facilities, equipment, and records and will help to ensure continuity of services. The outgoing contractor is ultimately responsible for performing full services IAW the contract during the phase-out period and shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding contractor. The outgoing contractor shall fully cooperate with the succeeding contractor and the government, as not to interfere with their work or duties.
The Contractor shall provide an approach to smoothly and orderly transfer of contract responsibility to the incoming contractor.
3.5 Performance Requirement Summary (PRS)
The Performance Requirements Summary (PRS) lists the critical tasks, performance standards, acceptable quality levels (AQL), and methods of surveillance that the Government will use to evaluate Contractor performance.
| Performance Objective |
| Performance Standard |
| Acceptable Quality Level (AQL) |
| Dis-Incentive |
| Incentive |
| Method of Surveillance |
| Performance Deduction / Remedy |
| Surveillance Frequency |
| Program Management (3.1) |
| PM manages the contract effectively, meets all reporting deadlines, and conducts monthly status reviews. |
| 100% of reports submitted on time. Monthly calls conducted as scheduled. |
| Document Past-Performance report card, paying attention to performance that failed to meet the standard. |
Consideration to exercise option.
Document Past-Performance report card, paying attention to performance that exceeded the standard.
Reduced Government Surveillance.
| 100% Inspection of deliverables and review of meeting logs. |
| Re-performance of deficient reporting within 2 business days. |
| Weekly |
| Implementation, Operation, Maintenance, and Administration (2.1) |
| CMS remains accessible and operational for global GEOINT professionals, maintaining 99.9% uptime (excluding scheduled maintenance). |
| Uptime monthly. Zero unscheduled outages lasting hours. |
| Document Past-Performance report card, paying attention to performance that failed to meet the standard. |
Consideration to exercise option.
Document Past-Performance report card, paying attention to performance that exceeded the standard.
Reduced Government Surveillance.
| Automated system monitoring logs, candidate incident tickets. |
| Performance rating reduction; corrective action plan required for repeat failures. |
| Weekly |
| System and Data Configuration (2.2) |
| All software configurations, upgrades, and API changes are successfully validated in the Sandbox environment prior to production release. |
| 100% of production deployments are successfully tested in the Sandbox with zero unplanned disruptions. |
| Document Past-Performance report card, paying attention to performance that failed to meet the standard. |
Consideration to exercise option.
Document Past-Performance report card, paying attention to performance that exceeded the standard.
Reduced Government Surveillance.
| Review of Sandbox test logs and deployment records. |
| Immediate rollback of unauthorized changes; Contractor-remedied at no additional cost. |
| Weekly |
| System Security and Information Assurance (2.3) |
| System complies with DoD Privacy, PII, and security requirements. Vulnerability scans (ACAS/STIG) performed and findings remediated. |
| Zero (0) critical security findings unresolved past standard mitigation windows. 100% secure handling of PII/CUI. |
| Document Past-Performance report card, paying attention to performance that failed to meet the standard. |
Consideration to exercise option.
Document Past-Performance report card, paying attention to performance that exceeded the standard.
| Security audit reviews, ACAS scan reports, and SSP inspections. |
| Immediate contract cure notice; escalation to Contracting Officer. |
| Weekly |
| Infrastructure and Disaster Recovery (2.4) |
| System outages or data integrity issues are resolved within the specified SLA timeframes. |
| of incidents resolved within SLA windows (72 hrs minor; 48 hrs major). |
| Document Past-Performance report card, paying attention to performance that failed to meet the standard. |
Consideration to exercise option.
Document Past-Performance report card, paying attention to performance that exceeded the standard.
Reduced Government Surveillance.
| CMS Incident Report tracking and user help desk tickets. |
| Corrective Action Plan required for any unmet SLA; potential negative performance feedback. |
| Weekly |
| Functional Enhancements (2.5) |
| Present all functional enhancement deliverables on time and in the proper format identified by the GPC PMO. |
| Government accepts no less than 95% of all deliverables with no more than one edit per deliverable. |
| Document Past-Performance report card, paying attention to performance that failed to meet the standard. |
Consideration to exercise option.
Document Past-Performance report card, paying attention to performance that exceeded the standard.
Reduced Government Surveillance.
| 100% inspection of deliverables |
| Corrective Action Plan required for deliverables that do not meet standards; potential negative performance feedback. |
| As needed |
| Final Data Export |
| Complete, uncorrupted Comma-Separated Values (CSV) data export delivered to the Government at contract completion. |
| 100% accurate, complete, and uncorrupted file delivered on schedule. Zero Contractor data retention. |
| Document Past-Performance report card, paying attention to performance that failed to meet the standard. |
Consideration to exercise option.
Document Past-Performance report card, paying attention to performance that exceeded the standard.
Reduced Government Surveillance.
| 100% Inspection and Government validation of export database file. |
| Contractor shall re-export and validate data at no additional cost until accepted. |
| As needed |
3.6 Place of Performance
Work shall be performed at the Contractor’s facility.
3.7 Key Personnel
The Contractor shall provide Key Personnel who possess the qualifications and expertise necessary to achieve the performance outcomes of this PWS. The individuals identified in Appendix B to fill two key roles are considered essential for the work performed and shall meet the mandatory qualifications. Any requests for changes to personnel in key positions must be submitted to the COR and include a detailed explanation of the circumstances necessitating the proposed change, a complete resume for the proposed substitute including details of how they meet the position description and qualifications. As determined by the CO, all proposed substitutions must have qualifications that meet or exceed the qualifications listed in Appendix B. The CO will evaluate the request and notify the Contractor, in writing, of approval or disapproval.
3.8 Government Furnished Property and Information
3.8.1 Government Furnished Property (GFP)
No Government-furnished property will be provided in support of this effort.
3.8.2 Government Furnished Information (GFI)
The Government will provide necessary GPC policies, business rules, standard operating procedures, and program documentation required for the Contractor to configure and operate the CMS
3.9 Security
Unclassified Work Performance Security Requirements Uncleared Contractor personnel are authorized to work on this contract at the Unclassified level only without the requirement of a security clearance.
Uncleared Personnel Security Requirements Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract. Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default.
Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.
Physical Security Requirements
Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.
Information Security Requirements NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. The Contractor shall not access, download, print, or further disseminate any unclassified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.
When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies for the proper marking, handling, processing, storing, and safeguarding of unclassified and CUI material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.
Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.
NGA will assess and authorize Contractors to process unclassified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR with a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.
In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions. The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-furnished information upon contract termination or when no longer required for contract performance.
4.0 Deliverables
4.1 Deliverable Schedule
The Contractor shall provide the Government with the deliverables for this program as outlined in the Deliverables Schedule table below.
4.1.1 General Deliverable Requirements
· The Contractor shall provide deliverables by the dates specified by the Government. Any changes to the delivery date shall have approval (in writing) by the Government before the deliverable is due. The request for a revised schedule shall include the impact (cost and schedule) on related tasks.
· The Contractor shall submit all deliverables in a format approved by the Government. The Contractor may use a Contractor-defined format if there is no government standard format that applies and prior approval from the COR has been received.
· The Contractor shall provide all written deliverables in easily comprehended terms and language understood by non-technical personnel (e.g., laypersons without subject matter expertise).
| CDRL |
| Title |
| PWS Reference |
| Description |
| Distribution |
| Delivery Format |
CDRL A0001
PWS p. 4
| CMS Implementation, Operation, Maintenance, and Administration |
| 2.1 |
| Implement, operate, maintain, and sustain an established CMS (to support the full end-to-end lifecycle of GPC candidates and credentialed GEOINT professionals. |
| Submit to GPC PMO |
| Re-occurring |
Format: CMS
CDRL A0002
PWS p. 5
| System and Data Configuration Services |
| 2.2 |
| Perform system configuration, database upkeep, and integration maintenance to adapt the COTS-based CMS platform to evolving GPC program requirements. |
| Submit to GPC PMO |
| Re-occurring |
Format: CMS
CDRL A0003
PWS p. 5
| Functional Enhancement Report |
| 2.2.1 |
2.5 Annual recommendations on potential functional enhancements that support the long-term maintainability of the CMS through the continuous review of custom stored procedures for possible conversion into configurable core platform capabilities, while producing recommendations and product features for reducing customizations and improving upgradability.
| Submit to COR and GPC Program Management Office |
| Annually |
Format: PDF
CDRL A0004
PWS p. 6
| System Security and Information Assurance |
| 2.3 |
| Protect candidate data, personal information, and infrastructure in compliance with federal and DoD cybersecurity mandates |
| Submit to GPC PMO |
| Re-occurring |
Format: CMS
CDRL A0005
PWS p. 6
| Authority to Operate (ATO) |
| 2.3.1 |
| Maintain the Authority to Operate (ATO) from NGA Security. |
| Deliver to NGA Security |
| Annually |
Format: Provided by NGA Security
CDRL A0006
PWS p.7
| Infrastructure and Disaster Recovery |
| 2.4 |
| Maintain hosting infrastructure that ensures system performance, wide accessibility, and robust data protection. |
| Submit to GPC PMO |
| Re-occurring |
Format: CMS
CDRL A0007
PWS p. 7
| Functional Enhancements |
| 2.5 |
| Provide support for functional enhancements which will be within the general scope of this PWS and include ad hoc activities and tasks, both of which will be funded as they arise |
| Submit to GPC PMO |
| As-Needed |
Format: CMS
CDRL A0008
PWS pg. 8
| Weekly Resource Meeting |
| 3.1.1.1 |
A weekly resource meeting to discuss various topics, such as changes in personnel, emerging issues, and the Contractor’s plan of action.
Weekly resource meetings shall only include topics pertinent to GPC Program Management Office.
| Deliver to COR and GPC Program Management Office |
| Weekly |
Format: Virtual
CDRL A0009
PWS pg. 8
| Weekly Resource Meeting Minutes |
| 3.1.1.1 |
| Meeting Minutes from weekly resource meeting discussing various topics related to program deliverables. The Contractor shall also include any “Action Items” that were captured during the meeting. |
| Deliver to COR and GPC Program Management Office |
| Weekly |
Within 2 business days of the meeting.
Format: MS Word
CDRL A0010
| Quarterly Program Management Review (PMR) |
| 3.1.1.2 |
| Quarterly meeting to deliver updates to the Government on program status and performance outcomes. The materials presented accurately depict the current status of performance against contract requirements (section 2.0 Requirements) and relevant financial information. |
| Deliver to CO, COR and GPC Program Management Office |
| Quarterly |
Format: virtual
CDRL A0011
| Quarterly PMR Meeting Minutes |
| 3.1.1.1 |
Meeting Minutes from quarterly PMR discussing various topics related to program deliverables. The Contractor shall also include any “Action Items” that were captured during the meeting.
| Deliver to CO, COR and GPC Program Management Office |
| Quarterly |
Within 2 business days of the meeting.
Format: MS Word
CDRL A0012
PWS p. 9
| Invoices |
| 3.1.2.2 |
| Submit all invoices in accordance with NGA provided invoice guidelines located in NARI 5X52.232-9003. |
| Submit to CO, COR, and FMFO (via IPP) |
| Monthly |
NLT the end of the following month in which the services were performed (e.g. Invoice for services performed 01-31 October would be submitted NLT 30 November)
Format: IPP
| CDRL A0013 PWS p. 9 |
| Quality Control Plan |
| 3.3 |
| Establish and maintain a QCP to ensure the requirements of this contract are provided as specified by describing the inspection system for the requested services listed in this PWS. |
| Submit to COR and CO |
| Initial: Due within 35 calendar days after contract award. |
Updated as needed.
Format: MS Word
| CDRL A0014 PWS p. 9 |
| Transition Plan |
| 3.4 |
| Develop and maintain a Transition Plan that includes an itemized list of program and project information critical to contract transition. |
| Submit to COR and CO |
| Initial: Submitted at time of proposal. |
Updated 10-days prior to contract start.
Updated 90 days before end of contract
Format: MS Word
CDRL A0015
p. 10
| Kick-Off Meeting |
| 3.4.1.1 |
| Lead a contract kickoff meeting with the Government Program Management (GPM) Team. |
| Deliver to Government Program Team |
| Within 5 days of contract start. |
Virtually
UNCLASSIFIED
Appendix A: Solution Approach Categories
| Approach Category |
| Description |
Configuration (only)
PWS Section 2.3 The Contractor utilizes the CMS interface and existing functionality to configure the solution.
A configuration (only) approach carries the lowest risk for ongoing maintenance; a configuration is covered by the platform’s forward compatibility commitment of upgrades.
Configuration with Engineering Support
PWS Section 2.3 The Contractor utilizes the CMS interface and existing functionality to configure the solution but requires one-time assistance from their Engineering Support to complete the task. Common Engineering Support includes bulk data cleanup to align and transition the existing data to the new configuration.
This type of configuration is also covered by the platform’s forward compatibility commitment of upgrades.
Customization
PWS Section 2.3 and Section 2.6 When NGA has a unique business need that cannot be achieved by Configuration alone, the Contractor pursues a custom solution.
Engineering Support designs a custom stored procedure, which adds complexity to the existing CMS functionality. Once the custom stored procedure is available, the Contractor utilizes the CMS interface to configure the custom solution.
Customizations require more time to implement due to the additional upfront effort to design, validate, and configure the custom stored procedure.
Customizations are not covered by the platform’s forward compatibility commitment. At minimum, every CMS upgrade requires additional effort for each Customization, to verify forward compatibility. If that additional effort surfaces any gaps, the effort required to close those gaps may extend into Section 2.6, depending on the level of effort required.
Product Innovation
PWS Section 2.6 When NGA has a unique business need that cannot be achieved by a Configuration or Customization approach, the Contractor pursues a Product Innovation, to introduce changes to the core CMS platform. Product Innovation carries the highest level of effort and requires the longest implementation timeline. However, it produces an outcome that is more stable than a Customization solution and carries a lower ongoing risk.
Product Innovations are covered by the platform’s forward compatibility commitment.
Appendix B: Key Personnel List
| Position |
| Description |
| Required Qualifications |
| Program Manager (PM) |
| Serves as the primary point of contact for the Government and oversee contract execution. |
| Minimum five years of relevant program management experience, with a proven track record of managing projects of similar scope and complexity. |
| Technical Account Manager (TAM) |
| Oversees system configurations, platform stability, and the implementation of functional rules within the CMS. |
| Minimum two years of direct experience administering or configuring a professional credentialing/candidate management system. |
and
Minimum two years of experience with computer programming, code writing, and low-code COTS workflow engine configuration.
Appendix C: Acronym List
| ACAS | Assured Compliance Assessment Solution | |
| API | Application Programming Interface | |
| AQL | Acceptable Quality Level | |
| ATO | Authority to Operate | |
| CDRL | Contract Data Requirements List | |
| CMS | Candidate Management System | |
| CO | Contracting Officer | |
| ConMon | Continuous Monitoring | |
| CONOPS | Concept of Operations | |
| COR | Contracting Officer’s Representative | |
| COTS | Commercial Off-the-Shelf | |
| CSR | Component Service Representative | |
| CSV | Comma-Separated Values | |
| CUI | Controlled Unclassified Information | |
| DFARS | Defense Federal Acquisition Regulation Supplement | |
| DNI | Director of National Intelligence | |
| DoD | Department of Defense | |
| DoDI | Department of Defense Instruction | |
| DoDM | Department of Defense Manual | |
| FAR | Federal Acquisition Regulation | |
| GFI | Government Furnished Information | |
| GFP | Government Furnished Property | |
| GPC | GEOINT Professional Certification | |
| GPC-F | GPC Fundamentals | |
| GPM | Government Program Management | |
| HD | Human Development | |
| HTTPS | Hypertext Transfer Protocol Secure | |
| IDS | Intrusion Detection Systems | |
| NAT | Network Address Translation | |
| NCCA | National Commission for Certifying Agencies | |
| NDA | Nondisclosure Agreements | |
| NGA | National Geospatial-Intelligence Agency | |
| NIST | National Institute of Standards and Technology | |
| NSG | National System for Geospatial-Intelligence | |
| PDU | Professional Development Unit | |
| PII | Personally Identifiable Information | |
| PL-II | Professional Level II | |
| PM | Program Manager | |
| PMO | Program Management Office | |
| PMR | Program Management Review | |
| PRS | Performance Requirement Summary | |
| PWS | Performance Work Statement | |
| QASP | Quality Assurance Surveillance Plan | |
| QCP | Quality Control Plan | |
| SCTM | Security Control Traceability Matrix | |
| SLA | Service Level Agreement | |
| SSP | System Security Plan | |
| STIG | Security Technical Implementation Guide | |
| STP | Security Test Plan | |
| TAM | Technical Account Manager | |
| USD(I&S) | Undersecretary of Defense for Intelligence and Security | |
| WAF | Web Application Firewalls | |
| xAPI | Experience API |
image1.png
File details come from the government source that posted it. Updated .