20261103_U_PWS_DRAFT.docx

DOCX document 606 KB Posted

Attached to
GEOINT Professional Certification (GPC) Candidate Management System (CMS II)
Solicitation number
RFI_CMSII_11032026
Issued by

About this file

This is a Performance Work Statement (PWS) for the National Geospatial-Intelligence Agency (NGA) GEOINT Professional Certification (GPC) Candidate Management System (CMS II), dated November 3, 2026. The PWS establishes comprehensive requirements for implementing, operating, maintaining, and sustaining a COTS-based candidate management system to support the full end-to-end lifecycle of GPC candidates and credentialed GEOINT professionals, capable of scaling to approximately 55,000 active/inactive records. The system must manage certification eligibility, exam administration, credential conferral, recertification workflows, and Professional Development Unit (PDU) tracking, with automated communications, role-based access controls, and business intelligence dashboards for program administrators.

Key operational requirements include: 99.9% system uptime (excluding scheduled maintenance); secure, encrypted HTTPS traffic with multi-factor authentication; compliance with DoD security standards (DoDI 1322.26, NIST SP 800-53, DoD Privacy Program); annual Authority to Operate (ATO) certification from NGA Security; semi-annual software updates with all changes validated in a sandbox environment before production deployment; and data retention for a minimum of ten years. The contractor must maintain routine database and server image backups with Service Level Agreements mandating resolution of minor incidents within 72 hours and major incidents within 48 hours. Deliverables include weekly resource meetings and minutes, quarterly program management reviews, annual functional enhancement reports, monthly invoices, and a Quality Control Plan due within 35 days of contract award. The contractor must provide two key personnel: a Program Manager with minimum five years of relevant program management experience and a Technical Account Manager with minimum two years of direct experience administering credentialing systems and two years of computer programming and COTS workflow engine configuration experience. No Government-furnished property will be provided, and work shall be performed at the contractor's facility. The PWS references related CDRLs and includes detailed performance requirements with surveillance methods, including performance deductions for failure to meet uptime and reporting standards.

View the file

Other files

File Type Posted
20261019_U_GPC_CMS_II_RFI_Questions.docx DOCX document
CMSII_RFI_v1.0.docx DOCX document

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

National Geospatial-Intelligence Agency

Performance Work Statement

GEOINT Professional Certification (GPC) Candidate Management System (CMS II) II

National Geospatial-Intelligence Agency

November 03, 2026

PWS Revision Log

Date
Section/ Description of Change
Author/ Approver
Revision Number

1.0 Introduction

1.1 Background

The GEOINT Professional Certification (GPC) Program operates in compliance with the standards of the National Commission for Certifying Agencies (NCCA) in support of Undersecretary of Defense for Intelligence and Security (USD(I&S)) and Director of National Intelligence (DNI) initiatives to professionalize the National System for Geospatial-Intelligence (NSG) workforce. The program provides standards and enables synchronization and alignment of individual capabilities within the NSG through portable credentials deemed critical to the successful execution of GEOINT missions and functions. The credentials are documented, managed and maintained by contract support staff and a Candidate Management System (CMS), providing a means to assess proficiency levels against core occupational competencies. The GPC Program Management Office (PMO) aligned under the Human Development (HD) Directorate within the National Geospatial-Intelligence Agency (NGA) is responsible for the administration of the GEOINT Professional Certification (GPC) Program.

In January 2018, NGA selected LearningBuilder as the technology platform to manage aspects of the GEOINT initial certification and recertification processes. Prior to LearningBuilder, NGA managed the credentials using custom internal databases and spreadsheets, which required significant administrative time and resources. After launching LearningBuilder, NGA has evolved the scope of the initial requirements and continually evolved the platform to increase operational functionality and bring more aspects of the GPC specific certification process into the system.

1.2 Objective

The objective of this PWS is to provide a comprehensive solution for managing the GPC lifecycle. This includes providing NGA with an end-to-end credential managing system to manage certification eligibility, exams, and renewals, while tracking compliance and giving program administrators tools to handle exceptions and monitor program success.

1.3 Scope

The Contractor is required to implement, operate, maintain, and sustain an established CMS (to support the full end-to-end lifecycle of GPC candidates and credentialed GEOINT professionals, capable of scaling up to an estimated population of 55,000 active/inactive records over the life of the contract. The Contractor is responsible to fulfill the following tasks to meet the contract requirement:

Task 1: CMS Implementation, Operation, Maintenance, and Administration Task 2: System and Data Configuration Services Task 3: System Security and Information Assurance Task 4: Infrastructure and Disaster Recovery Task 5: Functional Enhancements

2.0 Requirements

2.1 CMS Implementation, Operation, Maintenance, and Administration The Contractor shall implement, operate, maintain, and sustain an established CMS (to support the full end-to-end lifecycle of GPC candidates and credentialed GEOINT professionals (CDRL A0001). This includes maintenance and/or conversion of all legacy records, which are currently in LearningBuilder.

2.1.1 Lifecycle Workflow Administration and Candidate Pathways The Contractor shall ensure the CMS successfully executes and tracks all stages of the following credentialing lifecycle:

· Eligibility and Registration: Eligibility determination, automated prerequisite validation, workflow tracking, and exam registration.

· Role Ordering and Application Pathways: Facilitate visual and structured application progression that enables candidates to track current credentials and systematically plan advanced career pathways. The system shall visually highlight active applications, dynamically order eligible roles, and provide guided pathways for candidates to explore and pursue additional GPC.

· Exam Administration: Secure exam scheduling, test delivery tracking, and automated posting of score results and diagnostic feedback.

· Credential Conferral and Document Generation: Processing conferral recommendations, conferring official credentials, and generating electronic certificates and formal award letters. The Contractor shall ensure digital certificates and award letters render consistently across platforms and that both current and historical archival records remain verified and accurate.

· Streamlined Recertification and Automated PDU Logging: Supports Continuous management of Professional Development Unit (PDU) logs updates, recertification applications, and random/targeted audit workflows. The CMS shall automatically calculate and award PDU credits toward existing recertification cycles upon the conferral of a new specialty credential (e.g., GPC-F, PL-II), eliminating redundant manual submissions.

2.1.2 Access Control and Role-Based Permissions

The Contractor shall administer and maintain secure, role-based access for all designated user populations. Prior to granting access, the Contractor shall ensure authorized administrative users execute NGA-approved Nondisclosure Agreements (NDAs). Role permission shall be configured to support:

· Candidate Access: Secure portal for profile management, pathway exploration, exam scheduling, score reporting, digital form submissions (renewals, appeals, waivers), and PDU tracking.

· System Administrator / Program Manager Access: Centralized interface to analyze program-wide metrics, manage item banks, audit recertification records, configure audit percentages, set audit date ranges, and oversee automated conferral processes.

· Component Service Representative (CSR) Access: Segmented, organizational-level access to view reports and approve exam registrations only for candidates within their assigned components/services, with the capability to submit incident tickets on behalf of candidates.

2.1.3 Automated Communications and Reporting

· The CMS shall generate and deliver clear, event-driven email notifications to candidates and stakeholders to provide real-time status updates throughout the credentialing and recertification lifecycles.

· The system shall support international address formats for global practitioners and military postal formats (e.g., APO/FPO/DPO).

· The Contractor shall maintain interactive, web-based forms enabling digital approval workflows across NGA, DoD Components, and approved industry partners.

2.1.4 Data Analysis and Business Intelligence

· The Contractor shall ensure that the GPC PMO has all necessary dashboards and visualizations to support program decision making.

2.2 System and Data Configuration Services

The Contractor shall perform system configuration, database upkeep, and integration maintenance to adapt the COTS-based CMS platform to evolving GPC program requirements (CDRL A0002).

2.2.1 Application Configuration and Upgrades

· Workflow Optimization: The Contractor shall optimize application workflow configurations and business rules to align with evolving GPC policies and DoD credentialing directives.

· The Contractor shall support the long-term maintainability of the CMS through the continuous review of custom stored procedures for possible conversion into configurable core platform capabilities, while producing recommendations and product features for reducing customizations and improving upgradability. The Contractor shall include their recommendations in the annual Functional Enhancement Report (CDRL A0003).

· Vendor Software Baseline: The Contractor shall implement semi-annual software updates and scheduled patches to keep the CMS on a fully supported, secure vendor code base, integrating new product innovations to optimize administrative workflows.

· Integration and APIs: The Contractor shall manage and maintain Application Programming Interfaces (APIs) and secure data connectors to ensure seamless, real-time data transfers with Government-designated third-party systems.

2.2.2 Enhanced Bulk Data Import and System Synchronization

The Contractor shall configure, optimize, and administer bulk data import capabilities enabling NGA and program administrators to upload large volumes of data in streamlined batches with automated system updates. The bulk import capability shall support:

· Creating and provisioning new user accounts.

· Adding and updating Certification Roles (e.g., GPC Fundamentals [GPC-F], Professional Level II [PL-II], and emerging specialty credentials).

· Uploading bulk exam results and third-party testing vendor outcome data.

· Processing bulk conferral recommendations and issuing bulk credential conferrals.

· Creating and maintaining authorized testing center and exam site profiles.

2.2.3 Test Environment ("Sandbox") Maintenance

· The Contractor shall maintain a fully functional, non-production "sandbox" or pilot environment that mirrors production data structures and business rules.

· All configuration changes, feature updates, bulk import schemas, and API modifications shall be successfully tested and validated in the sandbox environment to ensure zero disruption to the active production environment prior to deployment.

2.3 System Security and Information Assurance

The Contractor shall protect candidate data, personal information, and infrastructure in compliance with federal and DoD cybersecurity mandates (CDRL A0004).

2.3.1 Security Compliance Standards

· The Contractor shall ensure the CMS operates in alignment with DoDI 1322.26 (implementing xAPI protocols where applicable), DoD Directive 5400.11 ("DoD Privacy Program"), and DoDM 5200.01 ("Information Security Program") concerning the handling of Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII).

· The Contractor shall ensure adherence to National Institute of Science and Technology (NIST) SP 800-53 security controls, to include receiving and maintaining the Authority to Operate (ATO) from NGA Security (CDRL A0005).

2.3.2 Infrastructure Security Protocols

The Contractor shall manage and execute the following security operations:

· Restrict all application traffic via Hypertext Transfer Protocol Secure (HTTPS), ensuring data-in-transit is fully encrypted.

· Manage authentication using secure, hardened server images that comply with DoD standards.

· Support secure user authentication via multi-factor credentials, digital identity certificates, or strong usernames/passwords.

· Conduct routine system Assured Compliance Assessment Solution (ACAS) and Security Technical Implementation Guide (STIG) scans.

· Promptly remediate security vulnerabilities and apply software patches.

· Maintain a shared security stack including network firewalls, Web Application Firewalls (WAF), Intrusion Detection Systems (IDS), and Network Address Translation (NAT).

· Maintain and submit required system security documentation (e.g., SSP, CONOPS, SCTM, ConMon, STP) in compliance with NGA authorizations.

2.4 Infrastructure and Disaster Recovery

The Contractor shall maintain hosting infrastructure that ensures system performance, wide accessibility, and robust data protection (CDRL A0006).

2.4.1 System Performance and Compatibility

· The CMS shall maintain compatibility with current and previous releases of standard web browsers (including Microsoft Edge, Mozilla Firefox, Apple Safari, and Google Chrome).

· The infrastructure shall provide sufficient storage capacity to preserve all active and inactive candidate information, assessment delivery logs, digital attachments (appeals, waivers, PDU proof documents), and system templates for a minimum of ten (10) years, in accordance with NCCA standards.

2.4.2 Data Backups and Incident Response SLA

· The Contractor shall perform secure, routine backups of database files and server images to ensure business continuity.

· In the event of an incident impacting candidate data, PII, CUI, or system availability, the Contractor shall resolve the issue and restore normal operations in accordance with the following Service Level Agreements (SLAs):

· Minor Impact ( users affected): Complete system resolution within seventy-two (72) hours of incident discovery.

· Major Impact ( users affected): Complete system resolution within forty-eight (48) hours of incident discovery.

· Reporting: Submit a comprehensive After Incident Report to the GPC PMO within 1 business day after the incident is resolved.

2.5 Functional Enhancements

As the GPC Program’s operations and certification requirements evolve, new necessary features will be identified, defined, and funded. This includes customizations that need additional work for future forward system compatibility as well as Product Innovations (as defined in Appendix A), all of which allow a continuation of support within the contract scope.

· The Contractor shall provide an Annual Functional Enhancement Report (CDRL A0003) on recommended functional enhancements.

· The Contractor shall provide support for functional enhancements which will be within the general scope of this PWS and include ad hoc activities and tasks, both of which will be negotiated as they arise (CDRL A0007).

3.0 General Requirements

3.1 Program Management

The Contractor shall provide proactive program management to ensure all deliverables, schedules, and quality requirements are met. Program management shall have professional oversight, transparent communication, and proactive risk management that prevents service disruptions. The Contractor shall provide a Program Manager (PM) a single point of contact for contract administration. The PM shall participate in quarterly reviews with the Contracting Officer (CO) and/or Contracting Officer’s Representative (COR) to discuss contract execution, system metrics, identified risks, and mitigation strategies.

3.1.1 Reports and Meetings

The Contractor shall provide all necessary support, collaboration, and active participation for the following reports and meetings:

3.1.1.1 Resource Meetings

A weekly resource meeting to discuss various topics, such as changes in personnel, emerging issues, and the Contractor’s plan of action (CDRL A0008). Weekly resource meetings shall only include topics pertinent to the GPC Program Management Office (PMO). In addition, the GPC PMO or the Contractor may convene additional separate meetings, as necessary, to discuss other issues or questions as they arise. The Contractor shall provide an electronic copy of the meeting minutes to the GPC PMO and COR within two business days following the meeting. (CDRL A0009)

3.1.1.2 Quarterly Program Management Reviews (PMRs)

The Contractor shall conduct quarterly meetings to deliver updates to the Government on program status and performance outcomes (CDRL A0010). The agenda and scheduling of the PMR shall be coordinated with the COR and its content shall accurately depict the current status of performance against contract requirements (section 2.0 Requirements) and relevant financial information. The PMRs shall be virtual. In addition, the Contractor shall provide post-meeting minutes within two business days following the meeting. (CDRL A0011)

The Government will provide the Contractor with feedback at the meeting. The Contractor shall adjust as needed throughout the period of performance based on performance outcomes and feedback from the Government.

3.1.2 Cost Tracking and Invoicing

The Contractor shall provide all necessary support, collaboration, and active participation for the following cost tracking and invoicing.

3.1.2.1 Cost Tracking

The Contractor shall maintain and report out on all current and projected contract costs for each period of performance. The reporting will be included in the quarterly program management review.

3.1.2.2 Invoicing

The Contractor shall submit all invoices NLT the end of the following month in which the services were performed. (e.g. Invoice for services performed 01-31 October would be submitted NLT 30 November) (CDRL A0012).

3.2 Quality Assurance Surveillance Plan (QASP)

The Government will utilize a QASP to monitor the contractor’s performance on the contract. The QASP is a living document and can change at any time during the life of the contract. As such, the Government reserves the right to unilaterally edit the QASP at the Government’s discretion.

3.3 Quality Control Plan (CDRL 0013)

The Government is committed to a highly interactive relationship between quality control by the contractor and quality assurance by the government recipient of services. This relationship shall be achieved through an effective Quality Control Plan (QCP) dedicated to ensuring the best possible products and services to end users. The contractor shall provide their final written QCP in accordance with this PWS and as outlined in the deliverables schedule.

The Contractor shall establish and maintain a QCP to ensure the requirements of this contract are provided as specified by describing the inspection system for the requested services listed in this PWS. The CO/COR will notify the contractor of acceptance or areas requiring discussion. The QCP shall be finalized IAW the discussions and submitted not more than 35 calendar days after contract award. The QCP shall be updated as changes occur. Each update shall be submitted to the COR and CO for review and acceptance.

The Contractor’s QCP shall demonstrate a prevention-based approach by meeting all PWS objectives throughout contract performance. Developed to define the Contractor's quality management and control responsibilities, the QCP shall, at a minimum, address:

· Continuous process improvement and trend analysis.

· Inspection protocols, including scheduling, execution, and documentation.

· Discrepancy management, outlining identification, corrective actions, and resolution of Government-identified non-conformances.

· Root Cause Analysis (RCA), detailing methodologies to isolate root causes and implement corrective actions to prevent recurrence.

· Customer feedback, establishing systems for capturing and addressing client complaints.

3.4 Transition Plan (CDRL A0014)

The Contractor shall develop and maintain a Transition Plan that includes an itemized list of program and project information critical to contract transition. The plan shall address, at minimum, objectives of the transitions, the contractor’s roles and responsibilities, planning and implementation, scheduling, and reporting as part of transition activities in order to ensure full performance is completed during all transitional activities. An initial transition plan shall be provided at time of proposal. The Transition Plan shall then be updated and delivered 10 days prior to the contract kick-off meeting (detailing the phase-in period), and then again 90 days before the end of the contract (detailing the phase-out period).

3.4.1 Phase-In Period

The phase-in period shall be completed 30 days after the contract start date. The Contractor shall have all Key Personnel available full time at contract start.

3.4.1.1 Kick-Off Meeting (CDRL A0015)

The contractor shall lead a contract kickoff meeting with the Government Program Management (GPM) Team within 5 business days of the contract start. The Kickoff Meeting Agenda is due at least 1 business day prior to the kick-off meeting, to the COR. To minimize any decreases in productivity and to prevent possible negative impact on additional services, the contractor shall have all key personnel available to perform at contract start.

3.4.2 Phase-Out Period

Prior to the completion of this contract, an observation period may occur, at which personnel of the incoming contractor may observe operations. This will allow for orderly turnover of information, facilities, equipment, and records and will help to ensure continuity of services. The outgoing contractor is ultimately responsible for performing full services IAW the contract during the phase-out period and shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding contractor. The outgoing contractor shall fully cooperate with the succeeding contractor and the government, as not to interfere with their work or duties.

The Contractor shall provide an approach to smoothly and orderly transfer of contract responsibility to the incoming contractor.

3.5 Performance Requirement Summary (PRS)

The Performance Requirements Summary (PRS) lists the critical tasks, performance standards, acceptable quality levels (AQL), and methods of surveillance that the Government will use to evaluate Contractor performance.

Performance Objective
Performance Standard
Acceptable Quality Level (AQL)
Dis-Incentive
Incentive
Method of Surveillance
Performance Deduction / Remedy
Surveillance Frequency
Program Management (3.1)
PM manages the contract effectively, meets all reporting deadlines, and conducts monthly status reviews.
100% of reports submitted on time. Monthly calls conducted as scheduled.
Document Past-Performance report card, paying attention to performance that failed to meet the standard.

Consideration to exercise option.

Document Past-Performance report card, paying attention to performance that exceeded the standard.

Reduced Government Surveillance.

100% Inspection of deliverables and review of meeting logs.
Re-performance of deficient reporting within 2 business days.
Weekly
Implementation, Operation, Maintenance, and Administration (2.1)
CMS remains accessible and operational for global GEOINT professionals, maintaining 99.9% uptime (excluding scheduled maintenance).
Uptime monthly. Zero unscheduled outages lasting hours.
Document Past-Performance report card, paying attention to performance that failed to meet the standard.

Consideration to exercise option.

Document Past-Performance report card, paying attention to performance that exceeded the standard.

Reduced Government Surveillance.

Automated system monitoring logs, candidate incident tickets.
Performance rating reduction; corrective action plan required for repeat failures.
Weekly
System and Data Configuration (2.2)
All software configurations, upgrades, and API changes are successfully validated in the Sandbox environment prior to production release.
100% of production deployments are successfully tested in the Sandbox with zero unplanned disruptions.
Document Past-Performance report card, paying attention to performance that failed to meet the standard.

Consideration to exercise option.

Document Past-Performance report card, paying attention to performance that exceeded the standard.

Reduced Government Surveillance.

Review of Sandbox test logs and deployment records.
Immediate rollback of unauthorized changes; Contractor-remedied at no additional cost.
Weekly
System Security and Information Assurance (2.3)
System complies with DoD Privacy, PII, and security requirements. Vulnerability scans (ACAS/STIG) performed and findings remediated.
Zero (0) critical security findings unresolved past standard mitigation windows. 100% secure handling of PII/CUI.
Document Past-Performance report card, paying attention to performance that failed to meet the standard.

Consideration to exercise option.

Document Past-Performance report card, paying attention to performance that exceeded the standard.

Security audit reviews, ACAS scan reports, and SSP inspections.
Immediate contract cure notice; escalation to Contracting Officer.
Weekly
Infrastructure and Disaster Recovery (2.4)
System outages or data integrity issues are resolved within the specified SLA timeframes.
of incidents resolved within SLA windows (72 hrs minor; 48 hrs major).
Document Past-Performance report card, paying attention to performance that failed to meet the standard.

Consideration to exercise option.

Document Past-Performance report card, paying attention to performance that exceeded the standard.

Reduced Government Surveillance.

CMS Incident Report tracking and user help desk tickets.
Corrective Action Plan required for any unmet SLA; potential negative performance feedback.
Weekly
Functional Enhancements (2.5)
Present all functional enhancement deliverables on time and in the proper format identified by the GPC PMO.
Government accepts no less than 95% of all deliverables with no more than one edit per deliverable.
Document Past-Performance report card, paying attention to performance that failed to meet the standard.

Consideration to exercise option.

Document Past-Performance report card, paying attention to performance that exceeded the standard.

Reduced Government Surveillance.

100% inspection of deliverables
Corrective Action Plan required for deliverables that do not meet standards; potential negative performance feedback.
As needed
Final Data Export
Complete, uncorrupted Comma-Separated Values (CSV) data export delivered to the Government at contract completion.
100% accurate, complete, and uncorrupted file delivered on schedule. Zero Contractor data retention.
Document Past-Performance report card, paying attention to performance that failed to meet the standard.

Consideration to exercise option.

Document Past-Performance report card, paying attention to performance that exceeded the standard.

Reduced Government Surveillance.

100% Inspection and Government validation of export database file.
Contractor shall re-export and validate data at no additional cost until accepted.
As needed

3.6 Place of Performance

Work shall be performed at the Contractor’s facility.

3.7 Key Personnel

The Contractor shall provide Key Personnel who possess the qualifications and expertise necessary to achieve the performance outcomes of this PWS. The individuals identified in Appendix B to fill two key roles are considered essential for the work performed and shall meet the mandatory qualifications. Any requests for changes to personnel in key positions must be submitted to the COR and include a detailed explanation of the circumstances necessitating the proposed change, a complete resume for the proposed substitute including details of how they meet the position description and qualifications. As determined by the CO, all proposed substitutions must have qualifications that meet or exceed the qualifications listed in Appendix B. The CO will evaluate the request and notify the Contractor, in writing, of approval or disapproval.

3.8 Government Furnished Property and Information

3.8.1 Government Furnished Property (GFP)

No Government-furnished property will be provided in support of this effort.

3.8.2 Government Furnished Information (GFI)

The Government will provide necessary GPC policies, business rules, standard operating procedures, and program documentation required for the Contractor to configure and operate the CMS

3.9 Security

Unclassified Work Performance Security Requirements Uncleared Contractor personnel are authorized to work on this contract at the Unclassified level only without the requirement of a security clearance.

Uncleared Personnel Security Requirements Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract. Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default.

Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.

Physical Security Requirements

Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.

Information Security Requirements NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. The Contractor shall not access, download, print, or further disseminate any unclassified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.

When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies for the proper marking, handling, processing, storing, and safeguarding of unclassified and CUI material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.

Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

NGA will assess and authorize Contractors to process unclassified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR with a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.

In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions. The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-furnished information upon contract termination or when no longer required for contract performance.

4.0 Deliverables

4.1 Deliverable Schedule

The Contractor shall provide the Government with the deliverables for this program as outlined in the Deliverables Schedule table below.

4.1.1 General Deliverable Requirements

· The Contractor shall provide deliverables by the dates specified by the Government. Any changes to the delivery date shall have approval (in writing) by the Government before the deliverable is due. The request for a revised schedule shall include the impact (cost and schedule) on related tasks.

· The Contractor shall submit all deliverables in a format approved by the Government. The Contractor may use a Contractor-defined format if there is no government standard format that applies and prior approval from the COR has been received.

· The Contractor shall provide all written deliverables in easily comprehended terms and language understood by non-technical personnel (e.g., laypersons without subject matter expertise).

CDRL
Title
PWS Reference
Description
Distribution
Delivery Format

CDRL A0001

PWS p. 4

CMS Implementation, Operation, Maintenance, and Administration
2.1
Implement, operate, maintain, and sustain an established CMS (to support the full end-to-end lifecycle of GPC candidates and credentialed GEOINT professionals.
Submit to GPC PMO
Re-occurring

Format: CMS

CDRL A0002

PWS p. 5

System and Data Configuration Services
2.2
Perform system configuration, database upkeep, and integration maintenance to adapt the COTS-based CMS platform to evolving GPC program requirements.
Submit to GPC PMO
Re-occurring

Format: CMS

CDRL A0003

PWS p. 5

Functional Enhancement Report
2.2.1

2.5 Annual recommendations on potential functional enhancements that support the long-term maintainability of the CMS through the continuous review of custom stored procedures for possible conversion into configurable core platform capabilities, while producing recommendations and product features for reducing customizations and improving upgradability.

Submit to COR and GPC Program Management Office
Annually

Format: PDF

CDRL A0004

PWS p. 6

System Security and Information Assurance
2.3
Protect candidate data, personal information, and infrastructure in compliance with federal and DoD cybersecurity mandates
Submit to GPC PMO
Re-occurring

Format: CMS

CDRL A0005

PWS p. 6

Authority to Operate (ATO)
2.3.1
Maintain the Authority to Operate (ATO) from NGA Security.
Deliver to NGA Security
Annually

Format: Provided by NGA Security

CDRL A0006

PWS p.7

Infrastructure and Disaster Recovery
2.4
Maintain hosting infrastructure that ensures system performance, wide accessibility, and robust data protection.
Submit to GPC PMO
Re-occurring

Format: CMS

CDRL A0007

PWS p. 7

Functional Enhancements
2.5
Provide support for functional enhancements which will be within the general scope of this PWS and include ad hoc activities and tasks, both of which will be funded as they arise
Submit to GPC PMO
As-Needed

Format: CMS

CDRL A0008

PWS pg. 8

Weekly Resource Meeting
3.1.1.1

A weekly resource meeting to discuss various topics, such as changes in personnel, emerging issues, and the Contractor’s plan of action.

Weekly resource meetings shall only include topics pertinent to GPC Program Management Office.

Deliver to COR and GPC Program Management Office
Weekly

Format: Virtual

CDRL A0009

PWS pg. 8

Weekly Resource Meeting Minutes
3.1.1.1
Meeting Minutes from weekly resource meeting discussing various topics related to program deliverables. The Contractor shall also include any “Action Items” that were captured during the meeting.
Deliver to COR and GPC Program Management Office
Weekly

Within 2 business days of the meeting.

Format: MS Word

CDRL A0010

Quarterly Program Management Review (PMR)
3.1.1.2
Quarterly meeting to deliver updates to the Government on program status and performance outcomes. The materials presented accurately depict the current status of performance against contract requirements (section 2.0 Requirements) and relevant financial information.
Deliver to CO, COR and GPC Program Management Office
Quarterly

Format: virtual

CDRL A0011

Quarterly PMR Meeting Minutes
3.1.1.1

Meeting Minutes from quarterly PMR discussing various topics related to program deliverables. The Contractor shall also include any “Action Items” that were captured during the meeting.

Deliver to CO, COR and GPC Program Management Office
Quarterly

Within 2 business days of the meeting.

Format: MS Word

CDRL A0012

PWS p. 9

Invoices
3.1.2.2
Submit all invoices in accordance with NGA provided invoice guidelines located in NARI 5X52.232-9003.
Submit to CO, COR, and FMFO (via IPP)
Monthly

NLT the end of the following month in which the services were performed (e.g. Invoice for services performed 01-31 October would be submitted NLT 30 November)

Format: IPP

CDRL A0013 PWS p. 9
Quality Control Plan
3.3
Establish and maintain a QCP to ensure the requirements of this contract are provided as specified by describing the inspection system for the requested services listed in this PWS.
Submit to COR and CO
Initial: Due within 35 calendar days after contract award.

Updated as needed.

Format: MS Word

CDRL A0014 PWS p. 9
Transition Plan
3.4
Develop and maintain a Transition Plan that includes an itemized list of program and project information critical to contract transition.
Submit to COR and CO
Initial: Submitted at time of proposal.

Updated 10-days prior to contract start.

Updated 90 days before end of contract

Format: MS Word

CDRL A0015

p. 10

Kick-Off Meeting
3.4.1.1
Lead a contract kickoff meeting with the Government Program Management (GPM) Team.
Deliver to Government Program Team
Within 5 days of contract start.

Virtually

UNCLASSIFIED

Appendix A: Solution Approach Categories

Approach Category
Description

Configuration (only)

PWS Section 2.3 The Contractor utilizes the CMS interface and existing functionality to configure the solution.

A configuration (only) approach carries the lowest risk for ongoing maintenance; a configuration is covered by the platform’s forward compatibility commitment of upgrades.

Configuration with Engineering Support

PWS Section 2.3 The Contractor utilizes the CMS interface and existing functionality to configure the solution but requires one-time assistance from their Engineering Support to complete the task. Common Engineering Support includes bulk data cleanup to align and transition the existing data to the new configuration.

This type of configuration is also covered by the platform’s forward compatibility commitment of upgrades.

Customization

PWS Section 2.3 and Section 2.6 When NGA has a unique business need that cannot be achieved by Configuration alone, the Contractor pursues a custom solution.

Engineering Support designs a custom stored procedure, which adds complexity to the existing CMS functionality. Once the custom stored procedure is available, the Contractor utilizes the CMS interface to configure the custom solution.

Customizations require more time to implement due to the additional upfront effort to design, validate, and configure the custom stored procedure.

Customizations are not covered by the platform’s forward compatibility commitment. At minimum, every CMS upgrade requires additional effort for each Customization, to verify forward compatibility. If that additional effort surfaces any gaps, the effort required to close those gaps may extend into Section 2.6, depending on the level of effort required.

Product Innovation

PWS Section 2.6 When NGA has a unique business need that cannot be achieved by a Configuration or Customization approach, the Contractor pursues a Product Innovation, to introduce changes to the core CMS platform. Product Innovation carries the highest level of effort and requires the longest implementation timeline. However, it produces an outcome that is more stable than a Customization solution and carries a lower ongoing risk.

Product Innovations are covered by the platform’s forward compatibility commitment.

Appendix B: Key Personnel List

Position
Description
Required Qualifications
Program Manager (PM)
Serves as the primary point of contact for the Government and oversee contract execution.
Minimum five years of relevant program management experience, with a proven track record of managing projects of similar scope and complexity.
Technical Account Manager (TAM)
Oversees system configurations, platform stability, and the implementation of functional rules within the CMS.
Minimum two years of direct experience administering or configuring a professional credentialing/candidate management system.

and

Minimum two years of experience with computer programming, code writing, and low-code COTS workflow engine configuration.

Appendix C: Acronym List

ACASAssured Compliance Assessment Solution
APIApplication Programming Interface
AQLAcceptable Quality Level
ATOAuthority to Operate
CDRLContract Data Requirements List
CMSCandidate Management System
COContracting Officer
ConMonContinuous Monitoring
CONOPSConcept of Operations
CORContracting Officer’s Representative
COTSCommercial Off-the-Shelf
CSRComponent Service Representative
CSVComma-Separated Values
CUIControlled Unclassified Information
DFARSDefense Federal Acquisition Regulation Supplement
DNIDirector of National Intelligence
DoDDepartment of Defense
DoDIDepartment of Defense Instruction
DoDMDepartment of Defense Manual
FARFederal Acquisition Regulation
GFIGovernment Furnished Information
GFPGovernment Furnished Property
GPCGEOINT Professional Certification
GPC-FGPC Fundamentals
GPMGovernment Program Management
HDHuman Development
HTTPSHypertext Transfer Protocol Secure
IDSIntrusion Detection Systems
NATNetwork Address Translation
NCCANational Commission for Certifying Agencies
NDANondisclosure Agreements
NGANational Geospatial-Intelligence Agency
NISTNational Institute of Standards and Technology
NSGNational System for Geospatial-Intelligence
PDUProfessional Development Unit
PIIPersonally Identifiable Information
PL-IIProfessional Level II
PMProgram Manager
PMOProgram Management Office
PMRProgram Management Review
PRSPerformance Requirement Summary
PWSPerformance Work Statement
QASPQuality Assurance Surveillance Plan
QCPQuality Control Plan
SCTMSecurity Control Traceability Matrix
SLAService Level Agreement
SSPSystem Security Plan
STIGSecurity Technical Implementation Guide
STPSecurity Test Plan
TAMTechnical Account Manager
USD(I&S)Undersecretary of Defense for Intelligence and Security
WAFWeb Application Firewalls
xAPIExperience API

image1.png

File details come from the government source that posted it. Updated .