SOW_GDTSIV_25 July 2024_OCS v1.1.docx

ATTACHMENT 1

National Geospatial-Intelligence Agency (NGA)

Statement of Work (SOW)

Geospatial-Intelligence (GEOINT) Data Transformation Service (GDTS)-IV

Contract No. XXXXXXXXXXXX

Prepared by:

NGA/IPD

REVISIONS

Document ready for OCS distribution

Table of Contents

1.0 (U) INTRODUCTION

1.1 (U) PURPOSE

(U) The purpose of GEOINT Data Transformation Service (GDTS) is to provide an ingest service for a variety of standard and nonstandard sources. GDTS extracts and remediates (correction, transformation, and validation) metadata fields, benefiting enterprise discoverability. GDTS provides this through a hybrid architecture consisting of both the cloud and on-premises (on-prem) hardware for file-based data, full-motion video (FMV), and moving target indicator (MTI). File-based data will be processed through the GDTS cloud presence. FMV and MTI streaming are processed on-prem.

(U) In addition, the GDTS FMV and GDTS Moving Target Indicator (MTI) capabilities allow FMV and MTI data to be transcoded where applicable and disseminated in near real-time (NRT) at multiple security levels. GDTS clips streaming FMV and MTI into segments, remediates where applicable, and disseminates, including use of Simple Storage Service (S3), to National System for Geospatial Intelligence (NSG) libraries for storage and access.

(U) The purpose of this Statement of Work (SOW) is the continued sustainment, development, integration, and modernization of the GDTS-IV hardware and software baseline, which is hosted in a hybrid architecture (cloud/data center model).

1.2 (U) BACKGROUND

(U) The GDTS system was developed under the legacy Information Dissemination Service—Direct Delivery (IDS-D) contract and started operations in June 2010. The GDTS software (Application Service Provider (ASP) component) was maintained as part of the IDS-D delivery order under the Total Application Services for Enterprise Requirements (TASER) contract from 2011 through 2015. The GDTS system (Infrastructure Service Provider (ISP) component) was operating under the Information Technology/Information Services (IT/IS) contract as part of the overall IDS-D effort from 2011 to 2017. Since 2017, the ISP and ASP were placed on the same contract (GDTS-II). The GDTS software was developed as internal web services with the capability to be installed in a virtualized environment. Figure 11 contains the operational overview of the capabilities and enhancements system in operations.

Figure is U Figure 11. (U) GDTS Operational Overview

1.3 (U) SCOPE

(U) The scope of this effort covers the baseline GDTS functionality for new and current data sources, and modernization efforts. The contractor shall provide all components required to meet GDTS functional and performance requirements for ASP and ISP functionality. The ASP component of the GDTS system consists of the operational streaming hardware and software, as well as the file-based cloud services in support of data ingest, conditioning, and dissemination as well as the contractor development/test environment. The ISP component of GDTS consists of site staff that can refresh, upgrade, integrate, and transition new capabilities into operations, which includes functional specialists such as system-engineering support, operational-issue investigation/resolution, enterprise-level site testing, media management, data migration, site-configuration support, and managing the critical 24x7x365 operations of GDTS. Modernization efforts will include, but are not limited to, additional GDTS services, consideration of Government-sponsored tools and platforms, Zero Trust, and migration of GDTS services into cloud and containerized environments.

(U) The contractor shall maintain the operational software baseline and incorporate new data sources as well as changes to existing data sources. The contractor shall provide support for all security Assessment and Authorization (A&A) efforts where applicable. The contractor is responsible for GDTS software testing and evaluation to include conformance to the applicable GEOINT standards cited in the StdV-1 using GEOINT Functional Manager Standards Assessment (GFMSA) methods and processes as well as intersegment and enterprise demos/tests. The contractor shall resolve operational issues with the system and provide new deliveries and software updates as required.

(U) The contractor shall continue to support the development, implementation, and integration of new and current GDTS capabilities and requirements to support the mesh catalog system on the emerging edge node architecture. This edge node architecture is intended to support GEOINT operations in a Denied, Disconnected, Intermittent, or Limited (D-DIL) scenario at primarily outside continental United States (OCONUS) locations. It is anticipated that GDTS Operations and Sustainment (O&S) support will be provided remotely, but mission requirements may necessitate an on-prem temporary or extended O&S support posture. Site surveys and other predeployment activities are also anticipated in support of this emerging requirement.

(U) The GDTS software must support multiple data sources and performance timelines and adapt to future changes related to ingest validation, remediation, transformation, and other data-conditioning efforts. In addition, GDTS must concurrently deliver data to NSG libraries, and other users while incorporating Scaled Agile principles to support the potential addition of other libraries/users and new data sources. Maintaining system/software availability and providing rapid updates to accommodate data changes is critical to the success of this program and the overall NSG mission.

(U) A summary of applicable documents is listed in Appendix A of this SOW. Appendix A contains documents that shall be followed as compliance documents and other documents that are guidance documents. The Contract Data Requirements List (CDRL) details are contained throughout this document and summarized in Appendix D.

1.4 (U) OBJECTIVES

(U) The Government’s overall objective is to maintain an affordable, reliable, and flexible software baseline/service that incorporates new/future data sources expeditiously. Further program objectives include:

a) (U) Provide for the transformation, remediation, and movement of various data types, including, but not limited to file-based data and streaming services data, through the NSG, and edge node architecture at multiple security-classification levels. Investigate slow bandwidth and throughput failures through display monitoring and remediation actions. Support, and when necessary, lead investigation efforts by coordinating with other NSG entities to resolve operational issues.

b) (U) Interface with Mission Partners and NGA information management services that are provided by user- and dedicated or shared-communication networks.

c) (U) Employ Agile development and implementation methodologies to the greatest extent possible, to include participation the NGA Epic Pathway, enterprise demonstrations, modeling, test, and simulation environment for design, technology insertion, and development that minimizes impact to the operational environment.

d) (U) Apply capabilities-based acquisition and disciplined Program Management, Systems Engineering, Software Engineering, Security Management, and other processes, practices and resources to plan, direct, document, control and execute a totally integrated management effort for the GDTS.

e) (U) Maximize use of software services and the use of third-party software (non-proprietary and Free and Open-Source Software (FOSS)) technology and employ open architecture technology standards for Agile software-design methodologies. Minimize the use of custom code, to the greatest extent possible. Align and interoperate as part of Content Services within the enterprise architecture.

f) (U) Provide a GDTS-IV solution that enables the capability to transition from existing systems to cloud services. Maintain the capability to develop, deliver, manage, test, and execute Transition Plans that integrate enabling technologies necessary for migration, if required after contract award. This could possibly include full virtualization and migration into (an) enterprise cloud and Government-sponsored factory tools and platform service(s).

g) (U) Maintain and modify all GDTS architecture and engineering documentation leveraging NGA’s Digital Engineering and Architecture Platform(s).

h) (U) Develop capabilities to rapidly support increased volumetrics and new data types at the required or better level of cost and performance.

i) (U) Manage all aspects of Data Center operations, to include all hardware and software maintenance, and support the evolution of GDTS to better align with the NSG Architecture to help reduce duplicative programs, components, and functionality.

j) (U) Assess existing GDTS performance, availability, and reliability, providing recommendations for changes based on Government direction.

k) (U) Provide integration and test support into other programs and services as directed to enable efficiencies in the ingest and conditioning process where applicable. For example, integration with NGA’s Open Data Store (ODS) program to rapidly expand their capabilities.

2.0 (U) PROGRAM MANAGEMENT

(U) The contractor shall provide effective program management for all GDTS program activities in order to achieve the required cost, schedule, and technical performance in accordance with the contract and negotiated Engineering and Contract Change Proposals (ECPs/CCPs). The contractor shall provide all the products, services, resources, materials, labor, supplies, and services necessary to accomplish the program scope defined in this SOW.

2.1 (U) PROGRAM MANAGEMENT AND ORGANIZATION

(U) The contractor shall provide and implement a formal organizational structure for program execution that includes all management and technical tasks including coordination and control of contract activities. This scope includes managing the program’s cost, schedule, development and sustainment performance, risks, contracts, and subcontracts.

(U) The contractor shall designate a Program Manager (PM) to be the single management interface to the Government and has the experience level to:

a) (U) Meet or exceed the cost, schedule, and performance parameters of the contract;

b) (U) Staff the program with properly trained and qualified personnel; and,

c) (U) Ensure required material and data are available on schedule and in required quantities.

(U) The contractor program management team shall maintain all program processes and shall conduct Program Management Reviews (PMRs).

(U) The contractor shall provide a single subject matter expert (SME) to be the technical interface to the program management team.

(U) The contractor shall provide the skilled and qualified personnel necessary to direct and control an integrated technical and management effort.

(U) The contractor shall provide personnel that are cleared to the proper level for the entire period of performance. The contractor shall provide a labor mix with the technical expertise to support all contract requirements throughout the entire period of performance (PoP). The contractor shall employ cross-utilization and integration of expertise to the greatest extent possible. It is possible for one person to be qualified in more than one skill area. The following are GDTS critical skills:

a) (U) Program Management and System Engineering expertise.

b) (U) Site Management, Environmental Management Team (EMT), System Administration, Network Engineering, Cybersecurity, Hardware, Security Cross Domain, Database, Engineering, Test and Operations expertise.

c) (U) Thorough understanding of the following interfaces and formats (at a minimum): Data Source Description Document (DSDD), Mapping Systems Interface Control Document (MICD), MICD Addendum 1, National Imagery Transmission Format (NITF) as described in Joint Basic Image Interchange Format (BIIF) Profile v2024.1 Applicable MISB Standards, STDI-0001, STDI-0002, STDI-0005, STDI-0006, NATO Standard Agreement (STANAG) 4607/4676, and the National System for Geospatial-Intelligence Product Description Document (NSGPDD) (All Applicable Addendums and Appendices).

d) (U) Managing/Monitoring of the 24x7x365 mission-critical systems.

e) (U) Implementing after-hour support using on-call roster to monitor the system on behalf of the NSG.

f) (U) Integrate new data sources at multiple security domains while achieving availability specifications.

g) (U) Refreshing, upgrading, integrating, and transitioning new capabilities into operations.

h) (U) Compliance, integration, configuration, and visual review of enterprise tools such as, and not limited to, Host-Based Security System (HBSS), Assured Compliance Assessment Solution (ACAS), Application Visibility Management (AVM) and Carbon Black into the operational baseline.

i) (U) Engineering, submitting, and obtaining approval of enterprise Firewall Change Requests (FCRs).

j) (U) Practice in adhering to datacenter policies such as restricted access, media handling, equipment entry/exit and equipment disposition/sanitization.

k) (U) Performing and managing motion-imagery activations/deactivations including motion-imagery monitoring, stream restoration, and providing motion-imagery engineering services for the larger NSG.

l) (U) Troubleshooting, diagnosing, identifying, repairing, and replacing faulty hardware Field Replaceable Units (FRUs).

m) (U) Completing data-migration requests to multiple security domains in order to support NSG requirements.

n) (U) Integrating foreign commercial sources.

o) (U) Ingesting media (Hard drives, disk arrays, etc.) into GDTS when transmission is not possible.

p) (U) Ability to review Requests for Change (RFCs) and provide thorough Impact Assessments.

q) (U) Security A&A expertise, to include but not limited to, compliance with Interface Control Document (ICD) 503, Federal Information Security Management Act (FISMA), XACTA 360, National Industrial Security Program Operating Manual (NISPOM), Continuous Monitoring (CONMON) and National Institute of Standards and Technology (NIST) Publications.

r) (U) Site-embedded personnel to support program and NGA Test Organization (NTO) enterprise regression testing to include operational demonstrations.

s) (U) Rule-management, rule-installation, and life-cycle management of GDTS Cross Domain appliances also known as High-Speed Guards (HSG).

t) (U) Management and life-cycle support of security certifications allowing encrypted data transfers.

u) (U) Providing subject matter expert (SME) support to airborne-control element (ACE).

v) (U) Management of web-service tools such as GDTS-tracker and FMV web interface.

w) (U) Provide life-cycle support and management of database responsible for collecting and disseminating daily performance metrics.

(U) The contractor shall identify contract Key Personnel positions, in addition to the Program Manager and Technical Lead. Key Personnel positions consist of the roles for critical functions in performance of the SOW requirements (whether performed by the Offeror or an Offeror’s subcontractor(s)).

2.2 (U) APPLICATION SERVICE PROVIDER INFRASTRUCTURE AND PLACE OF PERFORMANCE

(U) The contractor shall provide facilities that are cleared for the level of security required to perform the requirements of this contract, as well as store and process classified information on the first day of contract performance. The Application Service Provider (ASP) work will be performed at the contractor’s facility.

(U) The contractor shall provide the infrastructure to support the following:

(U) The contractor shall provide, at a minimum, ASP development and test of capabilities with associated equipment, network, infrastructure, and cloud to support contract requirements.

2.3 (U) PROGRAM CONTROL AND MANAGEMENT FUNCTIONS

2.3.1 (U) Program Management Plan

(U) The contractor shall develop and maintain a Program Management Plan (PMP) (CDRL A001) for effective program management. The PMP shall be in the contractor’s format and delivered within 45 days of contract award. The contractor shall tailor the PMP to the contractor’s systems engineering and program management approach and the requirements of this contract. The PMP shall contain the integrated management framework for successful achievement of cost, schedule, and technical contract performance. The contractor shall describe and maintain in the PMP a narrative detailing an effective organization structure and management approach to be employed with clear lines of authority and responsibility identified. Based upon the integrated management framework, the PMP shall include the event-based plan of significant accomplishments, criteria, and narratives needed to successfully complete each major program event. These major program events will be defined, planned, and conducted in accordance with industry and Government best practices (e.g. NGA Systems Engineering Management Plan). The contractor’s PMP shall contain management and supporting process narratives that document the contractor’s total work effort and shall provide the Government insight into how the contractor will develop, implement, maintain, and complete the total contracted effort.

(U) The PMP shall be traceable to ensure the contractor’s technical approach is consistent with the schedule. The contractor shall manage the execution of the program using the PMP and associated Integrated Master Schedule (IMS) as day-to-day program management tools and to assess progress and forecasts in achieving program schedule milestones. The PMP shall be maintained and updated as necessary to reflect changes during program execution, subject to Government approval.

(U) The contractor shall report on program progress in accordance with the PMP at each PMR, at selected technical reviews, and as required by the Government.

(U) The contractor shall maintain a subcontractor management plan as part of the PMP if major subcontractor(s) are utilized (performing 20-percent of the estimated effort). The contractor shall describe in the PMP each major subcontractor; how major subcontractors are seamlessly integrated into the organization structure for effective program management and control; and, major subcontractor management responsibilities and authorities. The contractor shall describe in the PMP the approach to planning, monitoring, tracking, and assessing major subcontractor performance.

2.3.1.1 (U) Program Risk Management

(U) The contractor shall assess and document program cost, schedule, and performance risks throughout contract execution and shall recommend opportunities for program improvement and/or risk mitigations. The GDTS contractor’s risk management process shall be documented and updated in a Risk Management section of the PMP (CDRL A001). Risks shall be reported to the Government at program reviews, and as requested by the Government.

2.3.1.2 (U) Program Data and Configuration Management

(U) The contractor shall provide configuration management services in accordance with applicable contractor configuration management plans for the duration of the contract. The contractor shall develop and maintain a Configuration Management (CM) Section of the PMP (CDRL A001) and set of processes consistent with the NGA USGIS Configuration Management Plan (NCMP) and industry best practices.

(U) The contractor shall establish the configuration identification of the internal hardware, software, and documentation associated with the GDTS ASP through number assignment and descriptors, controlling the configuration via an engineering change process, tracking and reporting the configuration status, periodically auditing the configuration, and ensuring the timely delivery of documentation. Any commercial, proprietary or restricted item shall be documented separately.

(U) The contractor shall maintain CM control of all materials developed or utilized under this contract, until directed otherwise by the Government, to include, but not limited to:

a) (U) All operating systems, database software, development infrastructure components, licenses, and manuals (including third party items).

b) (U) The software and technical documentation baselines developed under this contract, including the source code, build files, and related software documentation.

c) (U) All hardware, software, and data provided by the Government (Government-Furnished Property (GFP)) until returned to the Government. This includes documenting and maintaining the contract GFP List (CDRL A002).

d) (U) Test plans and procedures, test tools and scripts, test documentation, test output logs and test results, and internally generated and externally provided test data.

e) (U) Training materials developed for this contract.

f) (U) Other deliverables and data developed as part of this contract for use in development and sustainment.

(U) For each GDTS capability release/delivery, the contractor shall be responsible for preparation of all required documentation (e.g. DD-250) and the transferring of any equipment and license ownership to the Government. The documentation shall outline all the components, for both the hardware (if applicable) and software, associated with a particular release/delivery.

2.3.1.3 (U) Data Management

(U) All documentation, source code, databases, and repository-based architecture models shall be available in softcopy to the Government, and delivered to the Government at the end of contract or when requested. Where necessary, the contractor shall provide the Government with project-specific tools and any project-specific tailoring of the tools. All documentation shall be readable using standard Commercial-Off-the-Shelf (COTS) office automation products. Documentation produced using specialized COTS tools (such as Project schedules and System Architecture models) shall have Portable Document Format (PDF) output representations created so the original licensed tool is not required for viewing. Data management processes shall be captured in the Data Management Section of the PMP.

2.3.1.4 (U) Inventory Management

(U) The contractor shall implement a comprehensive program to ensure accountable property is properly used and maintained. The contractor shall maintain and track software license inventories, maintenance agreements, and associated period of performance acquired via direct purchase, End-user License Agreement (ELA), or GFP means. The contractor shall maintain and manage property inventories in accordance with the NGA Instruction for Determining Property Management (NI 4160.1R3).

(U) The contractor shall maintain accountability, via the Total Asset Management (TAM), for all accountable GFP located at the contractor facility.

(U) The contractor shall maintain an equivalent inventory control system for Contractor Acquired Property (CAP) and Contractor Managed Government Owned (CMGO) property located at contractor facilities.

(U) The contractor shall ensure new GFP is inventoried and added to TAM within two (2) days of receipt. The contractor shall ensure NGA TAM barcode labels are affixed to all NGA GFP that is applicable to TAM.

(U) The contractor shall ensure NGA-owned property is guarded against loss, damage, and destruction. The contractor shall identify equipment no longer needed and take appropriate steps to properly dispose of and remove associated records from the TAM and contractor inventory control systems.

(U) At minimum, the contractor shall conduct a full inventory once a year (365 days); classified or sensitive property shall be inventoried at least twice a year (180 days).

(U) Inventory management processes shall be captured in the Inventory Management Section of the PMP (CDRL A001).

2.3.1.5 (U) Program Quality Control

(U) The contractor shall prepare, implement, and maintain a Quality Control (QC) Section of the PMP consistent with industry standard quality requirements, best practices, and contractor policies. The QC section shall ensure that quality processes are documented and executable by the contractor team. The QC Section shall also address how third-party software updates are monitored, integrated, and tested to ensure the GDTS baseline is not adversely impacted.

(U) The contractor shall provide QC personnel to independently monitor, inspect, review, analyze, and report on all facets of the factory hardware and software development/test/GEOINT standards conformance activities for the GDTS program. In addition, the contractor shall include in the QC Section the inspection and review process for all CDRL items noted in this SOW. QC status along with identified areas of concern and non-compliance shall be reported during PMRs. Corrective and preventative actions shall be implemented when necessary.

2.3.1.6 (U) Program Training

(U) The contractor shall develop and maintain a Training Section of the PMP consistent with industry standard quality requirements, best practices, and contractor policies. The training section shall provide guidance for the development of Training Materials associated with each software release in accordance with section 3.5.

2.3.2 (U) Schedule Management

(U) The contractor shall develop and maintain an IMS for release planning and major milestones. The IMS shall include all activities, events, milestones, and accomplishments required to complete the effort including both prime and subcontractor efforts. The IMS should identify external dependencies. Additionally, the contractor's schedule risks and opportunities shall be explained.

(U) The contractor shall identify and provide appropriate program activities and milestones from the IMS for inclusion in the NGA Master Schedule (NMS) and Enterprise Scheduling System Visualization and Reporting Tool (ESS-VRT), consistent with the NGA USIGS Configuration Management Plan (NCMP). The contractor shall provide an explanation for any change in scope or schedule for these controlled activities as well as a cause and corrective action plan for schedule recovery.

(U) The contractor shall provide inputs and updates to the Government for incorporation into any RFC adding or impacting IMS/ESS-VRT activities/milestones in the NMS. This includes submission of inputs and updates to support RFC preparation and coordination, as required.

2.3.3 (U) Project Reporting The contractor shall report project data as applicable to this contract.

2.3.4 (U) Changes to the Performance Measurement Baseline

(U) The contractor shall provide advance notification to the Contracting Officer (CO) of any significant change to the Performance Measurement Baseline (PMB) prior to implementing that change. A significant change will be defined by mutual agreement of the parties, exclusive of approved contract modifications. This notification shall include, but is not limited to, written notification describing the scope, purpose, timing, and impacts of the change to the overall program. Further, the contractor shall address in the notification to the CO, any changes or impacts to cost and schedule, and compile variances that may result from the proposed PMB change.

(U) When indicated by contract performance, the contractor shall submit a request for approval to initiate an over-target baseline and/or over-target schedule to the CO. The request shall include a top-level projection of cost and/or schedule growth, a determination of whether or not performance variances will be retained, and a schedule of implementation for the updated baseline. The Government will acknowledge receipt of the request in a timely manner (generally within 10 calendar days). The CO will provide written approval, with any directed changes, of the submitted over-target baseline and/or over target schedule within 30 calendar days of receipt.

2.3.5 (U) NGA Cost Database Update

(U) The contractor shall support the Government program office in collecting cost, schedule, technical, performance, and programmatic data to update the NGA cost database. It is anticipated that updates to the data collection will be done at the end of major deliveries and increments, as appropriate. The contractor shall work with the Government to identify specific reporting parameters and define the data format.

2.4 (U) PROGRAM REVIEWS AND MEETINGS

(U) The contractor shall conduct PMRs, formal Readiness Reviews, and shall attend and participate in recurring and ad hoc technical and management meetings relevant to GDTS and other interfacing programs. The contractor shall provide the resources necessary to support and participate in technical and management meetings (including secure teleconference communications).

2.4.1 (U) Program Management Reviews

(U) The contractor shall conduct PMRs at a venue appropriate to the required level of information exchange. Attendance will include, but not be limited to, Government, Federally Funded Research and Development Center (FFRDC), Systems Engineering and Technical Assistance (SETA), System Integrator (SI), ASP and/or ISP contractor and subcontractor personnel, as required. All Program Management Review Briefing Charts (CDRL A007) shall be submitted to the Government at least two (2) working days prior to the review.

(U) At a minimum, PMRs shall address the following areas on a quarterly basis:

a) (U) Project status review (Scope/cost/schedule components of project performance and/or financial tracking data) (The Government does not require Earned Value Management for GDTS-IV).

b) (U) Upcoming major events and milestones within a six (6)-month window.

c) (U) RFCs, requirements and in-scope change status, to include any draft RFC writing efforts.

d) (U) Time-phased staffing profile and personnel changes.

e) (U) Action item status.

f) (U) Status and issues with GFP and all licenses.

g) (U) Risk management and mitigation/opportunity details.

h) (U) Special interest items.

i) (U) Software development, test, architectural artifact updates, and release status, to include but not limited to, any open issues.

j) (U) Schedule Progress (IMS section of the FASR).

k) (U) Security A&A status.

(U) In addition, PMRs shall cover, at a minimum, the following additional areas on a quarterly basis:

a) (U) Operational system performance metrics and timelines (actual versus objective and threshold), to include ingest, delivery, and peak volumetrics. Identification and analysis of any anomalies shall also be included.

b) (U) Development/Sustainment status (requirements/design progress, software, test, etc.).

c) (U) Discrepancy Report (DR) status and Technical Investigation (TI) info for higher priority DRs.

d) (U) Requirements awaiting formal documentation updates.

e) (U) Logistics status/issues.

f) (U) Test and transition status.

g) (U) Detailed status on GFP, licenses, maintenance agreements, third-party items (e.g. COTS, GOTS, FOSS).

h) (U) List of any proprietary items for use on this contract, to include but not limited to, software, hardware, firmware, or documents.

i) (U) Status on end of life/end of service issues.

j) (U) QC activities updates.

k) (U) Reliability, Maintainability, and Availability (RMA) analysis information.

2.4.2 (U) Readiness Reviews

(U) The contractor shall prepare Readiness Review Charts and Readiness Checklists (CDRL A008) and conduct formal reviews consistent with the Tier 2 NGA Enterprise Readiness (ER) Process & Procedures and the NGA Systems Engineering Management Plan (SEMP) for each software release. The Government is the approval authority for each formal review allowing the contractor to proceed to the next phase of the development life cycle. At each formal review, the contractor shall address all applicable elements of the corresponding readiness review checklist, tailored to the level of complexity and content of the release.

(U) The following reviews, at a minimum, shall be required for each release, unless waived by the Government to support the contractor’s agile development methodologies:

1. (U) Critical Design Review (CDR) or equivalent.

1. (U) Test Readiness Review (TRR) for Factory Acceptance Test (FAT).

1. (U) Pre-Ship Review (PSR).

1. (U) TRR for Independent Verification and Validation (IV&V).

1. (U) Operational Readiness Review (ORR).

(U) Additional reviews (e.g. Initial Requirements Review (IRR), Preliminary Design Review (PDR), Deactivation and Disposal Review (DDR), etc.) or substituted Agile methodologies shall be required based upon the contents and complexity of the changes (including recap deliveries). During planning for a specific change, the Government and contractor will jointly determine if any additional reviews are required for that change. As appropriate, reviews may be combined for efficiency or separated for multiple capabilities in the same release.

(U) At the Government’s direction, the contractor shall provide support to additional enterprise, programmatic, and project reviews (e.g. TRR, Transition Readiness Reviews, Operational Acceptance Reviews, Deployment Readiness Reviews, etc.), for other systems where GDTS exists as an interfacing segment.

2.4.3 (U) Contract Kickoff Meeting

(U) The contractor shall attend and participate in a post-award conference, conducted by the Government in accordance with Federal Acquisition Regulation Subpart 42.5. The contractor shall arrange and host a kickoff meeting to be held within 60 calendar days from date of award. Contractor participation shall, at minimum, include all personnel occupying Key Personnel positions and Contract Administration. At the kickoff, the contractor shall review contract and program administration, deliverables and schedule of upcoming events, the contractor’s software development processes and Agile Framework (if applicable) as well as other topics proposed by the contractor and Government. The contractor shall provide its recommendations for the kickoff agenda five (5) working days prior to the meeting.

2.4.4 (U) Integrated Baseline Reviews

(U) An Integrated Baseline Review (IBRs) may be held, at direction from the Government, following the exercise of a contract option(s), incorporation of major modifications, after significant program re-planning activities, or after the implementation of corrective actions. The contractor shall engage jointly with the Government PM and staff during IBRs to evaluate the risks and opportunities inherent in the contract’s PMB. Each IBR shall demonstrate that the contractor’s PMB is achievable and includes the entire contract scope of work, is consistent with contract schedule requirements, and has adequate resources assigned. Each IBR shall present management process risk related to the contractor’s capabilities to implement an effective management system.

(U) During the IBR, the contractor, at a minimum, shall demonstrate and ensure that:

a) (U) The technical content, work packages, and control accounts are consistent with the entire contract scope of work.

b) (U) There is a logical sequence of effort planned consistent with contract scheduling, including critical path analysis.

c) (U) The validity of the planned work is assessed, both in terms of total resources, and time phasing.

2.4.5 (U) Working Relationships

(U) The contractor shall establish effective working relationships and cooperate with other NSG contractors and NGA personnel. Upon CO/Contracting Officer’s Representative (COR) approval, this includes obtaining, sharing, and providing items (e.g. all draft and final products, software, and algorithms) to other NSG contractors and supporting Enterprise testing and joint discrepancy/problem report resolution upon Government approval.

2.5 (U) CONTRACT TRANSITION

(U) The contractor shall lead, organize, and facilitate a seamless transition of the GDTS software development and O&S from the current GDTS contractor. The contractor shall provide a contract transition plan as part of the proposed effort. The contract transition plan shall describe, at a minimum, the methodology, processes, work effort, schedule, tools, and qualified resources required to execute a full and seamless contract transition. The plan shall also identify potential transition conflict areas and develop and implement a mitigation strategy to preclude mission-impacting, cross-contract, and inter-contract conflicts. The contractor shall complete a full transition within 90 days of the contract start date. (U) The contractor shall include the Government in all transition activities to include, but not limited to, Technical Exchange Meetings (TEMs) and internal planning meetings. At contract conclusion, the contractor shall execute transition/decommissioning activities, as required by the Government. The contractor shall also effectively and efficiently provide transfer of responsibility for the services from this contract to a follow-on contractor(s) in a coordinated way at the end of this contract in a manner that minimized mission disruptions.

2.6 (U) DATA AND LICENSE RIGHTS

(U) The contractor shall clearly specify any proprietary software, hardware, firmware, or documents that are part of this contract and maintain the list for presentation at PMRs. Any additional proprietary items that are part of a hardware/software change shall be clearly documented.

2.7 (U) COST ESTIMATES AND DATA EVALUATION

(U) Given the flexibility of the GDTS architecture and the requirement to incorporate new data sources expeditiously, the contractor shall provide technical assessments, evaluation of sample data, and cost estimates. This includes, but is not limited to evaluating potential changes to the existing baseline and obsolescence concerns. All RFC estimates shall be in the form of an Impact Assessment (CDRL A017) in accordance with section 3.1.8 and shall be included in the baseline scope and be provided as requested by the Government.

For OY 1, no new impact assessments will be addressed after 5/31/2026.

For OY 2, 50-percent of nominal impact assessments will be addressed (up to 20 per year).

For OY 3, 50-percent of nominal impact assessments will be addressed (up to 20 per year).

For OY 4, 50-percent of nominal impact assessments will be addressed (up to 20 per year).

2.8 (U) PROGRAM TRAVEL

(U) The contractor shall conduct the necessary travel to accomplish the overall objectives of the program. The contractor may be required to travel from their primary work location to other contractor facilities, other NGA locations, or other US Government locations, as well as NGA partner sites worldwide in support of NGA activities. All travel shall receive prior approval by the Government, and shall be in accordance with the Joint Travel Regulations (JTR) and the limitation of funds specified in this contract.

2.9 (U) CLASSIFICATION

(U) All documentation and data produced under this contract shall be developed, classified, and marked for release in accordance with the Consolidated NGA (CoNGA) Security Classification Guide (SCG).

2.10 (U) PROGRAM SECURITY

(U) Throughout the duration of this contract, the contractor shall provide, as required, program security, personnel security, cybersecurity, and physical security support. Program Security will provide a Contractor Program Security Officer (CPSO) that will serve as the main Security POC for the program. At a minimum the CPSO duties will include staff meetings, PMRs, and gate reviews. The CPSO will be responsible for the Security Awareness, Training and Education (SATE) Program. Program security will provide indoctrination briefings for newly briefed employees as well as annual security re-indoctrination briefings for all employees. Additionally, program security will support debriefings, coordination with program security offices, security arrangements for project meetings, project security plans and coordination of special courier support.

(U) The Personnel Security program will be in place to support the processing of all steps in the clearance process. The contractor shall use the procedures in NGA’s eNomination (eNom) security clearance/access approval process to establish initial and crossover security clearances/access for contractor personnel.

(U) As delineated in the Department of Defense (DOD) Contract Security Classification Specification (DD Form 254), contractor cybersecurity team will perform the A&A activities for all work performed under this contract in five categories:

1. (U) Security Engineering and Coordination

2. (U) Security Documentation

3. (U) Prepare Bodies of Evidence (BOE)

4. (U) CONMON

5. (U) Security/Information Assurance Vulnerability Management (IAVM) patching and STIG remediation These must be done in order to keep all GDTS Security Plan Identification (SPIDs) in state of “constant readiness” for Cyber Operation Readiness Assessment or FISMA data call.

(U) Present and perform security coordination technical exchange briefing, support NGA TESR registration meetings, and brief security stakeholder on A&A activities during weekly/monthly security status meeting.

(U) Cybersecurity activities include the following activities:

· (U) Perform A&A activities in security testing, witnessed accreditation, pre- & post- Authority to Operate (ATO) documentations and achieve and maintain three-year ATO.

· (U) Creation and maintenance of the Risk Assessment Report (RAR).

· (U) Produce the Security Control Traceability Matrix (SCTM).

· (U) Tailor security controls and identify security control inheritance in accordance with the NGA Information Assurance Requirements Catalog (IARC).

· (U) Support and/or accomplish the Security Assessment Report (SAR) for an ATO.

· (U) Conducting audits of each Information System (IS) CONMON Plan.

· (U) Incident Inquires, Containment, and Reporting.

· (U) IAVM & Security Technical Implementation Guide (STIG) Assessment.

· (U) Continuous Monitoring and associated documentation.

· (U) Conduct vulnerability scans, analyze, prioritize and disseminate findings, recommend actions to address findings to ASP/ISP, support measure required to close IAVM/STIG findings, validate that vulnerabilities/STIG findings are resolved/addressed and documented, update POA&Ms as required.

· (U) Install and maintain Fortify configuration, update rule packs to align with Software assurance, obtain release Software Assessment Process (SWAP) approvals, obtain Service+ change request approvals for each SWAP request

· (U) Investigate and verify that “yellow” or “red” showing on any of the NGA Enterprise Cybersecurity Analytics & Monitoring (ECAM) tool dashboards are not a false positive, track down issues alongside NGA. Utilize ACAS/CB/ENS/ArcSight/AD/Flexera to verify that GDTS hosts are being read by NGA Enterprise Security Services, track “Rogue” or “EOL” assets – work discrepancies with Cyber Data Analytics, create and maintain Galaxy Exceptions (for CDS SPIDs).

· (U) IS Security documentation.

· (U) Document updates to the security design and posture of systems in XACTA 36.0

· (U) Commercial Off-The-Shelf (COTS)/Government Off-The-Shelf (GOTS)/Open Source Software (OSS)/Foreign Ownership, Control, or Influence (FOCI) and custom code SWAP requests.

· (U) Submit custom code SWAP request through Service+ as change request with ISO and Delegated Authorizing Official (DAO) for approval.

· (U) User categorization.

· (U) Internal and external system interfaces.

· (U) Equipment groups and inventory in Service+ Configuration Management Database (CMDB).

· (U) Software inventory.

· (U) Security test plans and procedures.

· (U) Participate in program level operations reviews, program reviews, etc.

· (U) Conducting annual internal IS Security Review.

· (U) Review audit logs and verify that audit logs are archived.

· (U) Retrieve sample of audit logs quarterly to test log integrity.

· (U) Privileged and general user management.

· (U) Lead FISMA audit response activities.

· (U) Plan of PO&AM management.

· (U) Assessment readiness checklist.

· (U) Security test plan results.

· (U) Vulnerability scans.

· (U) STIG compliance checklist.

· (U) SWAP approval spreadsheet.

· (U) Update internal processes/policies at least annually.

(U) The contractor shall perform system integration, FAT, and support to Site Acceptance Testing (SAT) using TS/SCI-cleared personnel in an SCI environment.

(U) The contractor shall take all steps necessary to ensure that all Government computer and network accounts assigned to contractor personnel are deleted upon completion or termination of the contract (or when personnel are removed from the program) in accordance with NGA A&A guidance and direction.

2.10.1 (U) Classified Work Performance Security Requirements

(U) Contractor personnel performing classified work on this contract are required to have active TS/SCI clearances for access to NGA facilities, when performing duties within classified environments, and for access to classified NGA computer systems. Contractor personnel are subject to a Counterintelligence (CI) Polygraph as requested by the Government. NGA will sponsor security clearances, NGA Badge, Common Access Cards (CAC) and other items (parking hangtags) for required program personnel.

(U) The contractors must abide by the DD Form 254—Contract Security Classification Specification and applicable security policies and regulations.

(U) The contractor shall follow all applicable NGA, IC, and DOD information security and operational security policies and guidance when accessing and transmitting data over networks during performance of contractual requirements. The Contractor may be exposed to classified foreign government information (FGI) in the performance of these requirements.