SOW_HM157525R0009_Attachment_0002.pdf

Attachment 2 UNCLASSIFIED HM157525R0009

UNCLASSIFIED

(U) NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY (NGA)

(U) Timely Imagery Content Dissemination (TICD) with Cubic Digital Intelligence (CDI)

(U) IDIQ STATEMENT OF WORK (SOW)

(U) May 14, 2025

(U) THIS PAGE INTENTIONALLY LEFT BLANK

Table Of Contents

1 Introduction

2 Background

3 Objective And Scope

4 Software and related Hardware, and Services

5 Persons/Entities Authorized To Place Orders

6 Travel and other miscellaneous items

7 Government Furnished Equipment/Information (GFE/GFI)

8 Security

9 Appendix A …………………………………………………………………………………….………………………………………….10

10 Appendix B ……………………………………………………………………………………………………..……..……………….…11

11 Appendix C ……………………………………………………………………………………………..…………………………………12

1 INTRODUCTION

This Statement of Work (SOW) defines Cubic Digital Intelligence Corporation’s (herein referred to as CDI) support under this Indefinite Delivery/Indefinite Quantity (IDIQ) contract to the National Geospatial

Intelligence Agency (NGA) and NGA’S GEOINT mission partners (i.e., US Government entities who have a current GEOINT support agreement with NGA).

CDI products manage, process, store, visualize and disseminate, and/or analyze various forms of data from a variety of sources, including Government furnished data, open-source data, and data provided by third parties. The government intends to order the CDI software and related services as required in accordance with the attached price list via Task Orders (TO) and Delivery Orders (DO) issued by any authorized US Government Contracting Officer (CO) (see GEOINT Mission Partners definition above).

2 BACKGROUND

NGA is responsible for the rapid acquisition, advancement, and integration of GEOINT capabilities in support of urgent user requirements. The ability to integrate and migrate critical GEOINT data and tools to the National System for Geospatial Intelligence (NSG) is essential for operational mission support success.

3 OBJECTIVE AND SCOPE

The objective of this contract is to provide a streamlined method for NGA and its GEOINT Mission

Partners to acquire CDI software and related hardware and services to maintain and integrate various

GEOINT data archives; and to support the Government on integration, implementation, and maintenance of CDI software products.

4 SOFTWARE AND RELATED HARDWARE, AND SERVICES

Under this contract, the Government may require the following.

4.1 SOFTWARE

Under this contract, the government may order Software as required for mission execution. The software that may be purchased through this IDIQ contract is identified in “Appendix A – Software”

4.2 SERVICES

Under this contract, the government may place orders for CDI to provide fully burdened labor rates to support Hardware and Software products as required for mission execution. The services that may be purchased through this IDIQ contract is identified in “Appendix B – Services”

4.3 HARDWARE

Under this contract, the government may order Hardware as required to meet mission needs. The list of

Hardware that may be purchased through this IDIQ contract is identified in “Appendix C – Hardware”

5 PERSONS/ENTITIES AUTHORIZED TO PLACE ORDERS

U.S. Government contracting officers who are representing an organization that has a GEOINT support agreement with the NGA are authorized to place orders under this IDIQ. The contractor is required to verify that contracting officers have the authority to place orders with either the NGA Contracting

Officer or NGA Contracting Officer’s Representative.

6 TRAVEL AND OTHER MISCELLANEOUS ITEMS.

NGA may require contractor travel and other reimbursable supplies or equipment. The items will be agreed upon as specified in individual task orders, prior to execution. And the contractor shall bill the government at the pre-negotiated and agreed upon price.

7 GOVERNMENT FURNISHED EQUIPMENT/INFORMATION (GFE/GFI)

The government will specify any government furnished equipment and materials in each TO or DO.

8 SECURITY

A. Classified Work Performance Security Requirements

Contractors must abide by the DD Form 254 - Contract Security Classification Specification (referred to as DD254 hereafter), the National Industrial Security Program Operating Manual (NISPOM 32 CFR Part 117), and all other applicable security policies and regulations including operational security (OPSEC) requirements.

Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Agency (CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances. As such, Security Executive Agent Directive (SEAD) 3 reporting should continue to be provided to the Contractor’s Facility Security Officer (FSO) for reporting to DCSA via Defense Information Security System (DISS).

DCSA will also dictate mandatory security training as the CSA for the collateral cleared community.

B. Personnel Security Requirements

Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to TS/SCI facilities, when performing duties within TS/SCI environments, and for access to TS/SCI computer systems for the performance of this contract. Contractors are subject to a Counterintelligence-Scope Polygraph examination, as requested by NGA. As a condition of employment and assignment, contractors who have not successfully completed polygraph testing within the last five years must immediately schedule a polygraph examination and must complete the process, in no more than three test sessions, within 90 days.

All Contractor personnel shall possess a current Top Secret Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access. The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel in accordance with (IAW) SEAD 7: “Reciprocity of Background Investigations and National Security Adjudications”. If needed, NGA will sponsor SCI accesses at its sole discretion. NGA will provide badges, Common Access Cards (CAC) and other items (e.g. parking hangtags) when applicable, for required Contractor personnel.

Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI) Continuous Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW SEAD 6: “Continuous Evaluation”. Cleared Contractor personnel must self-report security issues, foreign contacts, and other applicable information IAW SEAD 3: “Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position” and NGA Instruction 5205.3, “Security Reporting Requirements”. In addition, cleared Contractors will be required to submit electronic fingerprints and be enrolled into NGA’s Report of Arrest and Prosecution Background (RAPBack) program, which supports CES.

Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in NGA’s annual Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20 November 2020 memorandum titled “Designation of NGA Personnel Required to Participate in the Security Financial Disclosure Program”.

The Contractor shall inform NGA as soon as practicable when its employees will no longer support the contract (see DD254). NGA desires notification prior to the day the individual no longer supports the contract but requires notification no later than the day that contract support ends. If Contractor personnel will no longer be supporting NGA via an NGA contract, NGA shall take all appropriate action, up to and including debriefing the contractor from SCI access and terminating logical and physical access to NGA IT systems and facilities.

Upon notifying NGA that a Contractor will no longer support the contract, the Contractor must return all NGA Badges, CAC, hangtag, and any other government furnished property. These items can be returned to the NGA Workforce Support Center, NGA Site Security Office, or the Contracting Officer Representative (COR) as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

When Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the responsibility of the Contractor’s FSO to collect the items from the individual and return them to NGA as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

If the FSO debriefs their employee, the FSO shall provide a copy of the debriefing statement, plus all applicable Government-furnished items (e.g. NGA Badge, CAC, Courier Card, parking hangtags, etc.) to the NGA Site Security Office or the NGA Workforce Support Center as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

C. Physical Security Requirements

All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at contractor sites must be performed in either an NGA accredited SCIF, Other Government Agency (OGA) SCIF, or an approved secure collateral space that has either a Memorandum of Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this contract. SCIF or secure facility accreditation shall be at least the level commensurate with the level of safeguarding required by the contract DD254.

Pursuant to “IC Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities Version 1.5.1; IC Tech Specs for ICD/ICS 705”, the NGA accrediting official, or designee, shall conduct periodic security inspections/reviews to ensure the efficiency of NGA accredited SCIF operations, identify deficiencies, and document corrective actions taken. Inspections/reviews of NGA accredited SCIFs shall be conducted based on threat, facility modifications, sensitivity of programs, past security performance, or at least every five years. Technical Surveillance Countermeasures (TSCM) activities in NGA accredited SCIFs will only be conducted by NGA TSCM teams consisting of NGA military, civilian, or contractor personnel who have successfully completed approved TSCM training. Authorized inspectors shall be admitted to a SCIF without delay or hindrance when inspection personnel are properly certified to have the appropriate level of security clearance and SCI indoctrination for the security level of the SCIF.

Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.

D. Unclassified Work Performance Security Requirements

If applicable, and after discussion with the COR, and the COR has provided written approval, uncleared Contractor personnel are authorized to work on this contract at the Unclassified level, with access up to DoD Controlled Unclassified Information (CUI) at the Contractor site without the requirement of a security clearance.

E. Uncleared Personnel Security Requirements If applicable, and after discussion with the COR, and the COR has provided written approval, any Contractor personnel working with CUI information must receive a favorable HSPD-12 and/or HSPD-12 Tier 1 adjudication prior to accessing CUI information. Contractor personnel who require access to CUI for 60 days or less must receive a favorable HSPD-12 adjudication. Contractor personnel who require CUI access for more than 60 days must receive a favorable HSPD-12 Tier 1 adjudication. NGA will sponsor the HSPD-12 and HSPD-12 Tier 1 background investigation for Contractor personnel as needed.

Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract.

Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default.

Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.

F. Information Security Requirements

NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. Access to classified information will be pursuant to the security requirements established in the DD254. The Contractor shall not access, download, print, or further disseminate any classified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.

When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies (including the Consolidated NGA (CoNGA) Security Classification Guide) for the proper marking, handling, processing, storing, and safeguarding of classified and unclassified material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.

Access to CUI will be pursuant to DFARS clause 252.204.7012. The prime contractor shall include this clause, including paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for Subcontractor performance retains its identity as covered defense information and will require protection under this clause. Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

NGA will assess and authorize Contractors to process classified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.

In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions.

The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-furnished information upon contract termination or when no longer required for contract performance.

In situations when electronic transmission is not practicable, Cleared Contractor personnel may hand-carry contract-related classified information when authorized by the COR in writing. Approved Contractor personnel must obtain NGA courier authorization prior to hand-carrying of classified contract-related information. Only classified information related to the performance of this contract may be hand-carried. Contractor personnel will be limited to hand-carrying classified information between approved Contractor facilities and US Government facilities unless the COR approves other circumstances in writing, when applicable, on a case-by-case basis.

G. Cybersecurity Requirements

The Contractor must, at a minimum, implement 10 U.S.C. Sections 391 and 393 along with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” requirements.

If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/).

In the event that the Contractor discovers a cyber incident that affects a covered Contractor information system or covered defense information residing therein, or that affects the Contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall—

1. Notify the DoD Cyber Crime Center (DC3) and the COR in writing within 72 hours of incident discovery

2. Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support.

In the event the Contractor discovers and isolates malicious software in connection with a reported cyber incident, the Contractor shall submit the malicious software to DC3 in accordance with instructions provided by the COR. The Contractor should NOT send the malicious software to the COR.

H. Insider Threat Requirements

Contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O.

13587 “Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing https://www.fedramp.gov/resources/documents/ and Safeguarding of Classified Information” and Presidential Memorandum “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs.” As soon as practicable, Contractor shall report to the COR events that may have an effect on the status of the entity's or an employee's eligibility for access to classified information; report events that indicate an insider threat to classified information or to employees with access to classified information; report events that affect proper safeguarding of classified information; and report events that indicate classified information has been, or is suspected to be, lost or compromised.

9 APPENDIX A – SOFTWARE

• HiPER STARE®: CDI’s commercial software product to ingest, index, catalog and disseminate large volumes of Wide Area Motion Imagery (WAMI) and other persistent data form airborne and spaceborne platforms utilizing a service-oriented architecture. HiPER STARE can be deployed on premises with existing infrastructures in traditional data centers or in cloud environments, such as Amazon Web

Services (AWS) or Microsoft Azure, and has proven scalability beyond tens of Petabytes of WAMI data.

This product allows remote users and AI/ML engines to access WAMI data at high frame rate for playback or training via OGC-compliant services.

• HiPER LOOK® (Enterprise Version): CDI’s commercial software product to manage and disseminate large volumes of foundation data, including maps, imagery, terrain, and point clouds. This data access solution allows users to catalog, organize and share large quantities of geospatial data. HiPER LOOK can be deployed on premises with existing infrastructures in traditional data centers or in dynamic cloud environments, such as Amazon Web Services (AWS) or Microsoft Azure. HiPER LOOK can scale to of data and provides rapid, standards-based access to requested data in both high and low bandwidth network environments.

• KiOSK®: CDI’s commercial software product to rapidly generate mobile geospatial data servers, also known as HiPER DRIVE®. This content management solution allows users to select and move content onto portable storage devices, allowing users to carry large volumes of easily accessible geospatial content with them into the field.

• HiPER DRIVE®: CDI’s commercial software product to provide disconnected users with portable access to large quantities of geospatial content such as digital maps and imagery. HiPER DRIVE contains a lightweight and powerful geospatial data server that will launch on any Windows® device. This provides instant access to large volumes of geospatial data via a browser-based viewer or a multitude of OGC® standard-enabled third-party applications.

• HiPER CLOUD™: CDI’s commercial product to enable the rapid search, discovery and visualization of imagery and other geospatial data via a web-based client or robust services to third party applications.

HiPER CLOUD combines the features of a web-based imagery catalog with a rapid visualization capability for streaming large volumes of imagery over areas of interest as an image flipbook. HiPER CLOUD enables users to quickly scan through hundreds of images, compare overlapping imagery for change detection and stream data into third party applications.

• TAKTICS™: CDI’s commercial software that provides a web-based hub for viewing and downloading tactical data sets. TAKTICS is a joint capability hosted by NGA and the TAK Program Office to deliver users with the ability to rapidly search, discover, view and stream or download imagery, elevation data and 3D content from commercial and tactical sensors directly to WinTAK and ATAK devices. TAKTICS provides superior situational awareness, mission planning, rehearsal and precision targeting GEOINT data. Hosted on the unclassified Gov Cloud outside of NGA firewalls and accessible through a thin-client web browser, TAKTICS is easily accessible, providing critical GEOINT to the Warfighter and supporting a

GEOINT sharing initiative between SOF Digital Applications, the TAK Product Center and the NGA.

• GEOINT Synchronization Service: Data Synchronization Service is an add-on capability for HiPER LOOK, HiPER CLOUD and TAKTICS. The service allows system admin to create sync jobs between Cubic software deployed on multiple nodes. The synchronization service works by allowing Systems Administrators to create sharing relationships between a parent node and multiple child nodes.

• Unified Video: Unified Video is a metadata-rich full-motion video (FMV) processing, storage, dissemination and visualization platform that enables real-time access to FMV and MTI in strategic and tactical environments.

• Spotlight: CDI’s commercial video and audio redaction software. Spotlight provides automated solution for blurring faces, license plates and other personally identifiable information (PII). Spotlight is compatible with both digital and analog video from any source.

• Forensic: CDI’s commercial video enhancement software that provides algorithms for supporting super-resolution and enhancement filters to reveal critical details from low-quality video quickly and efficiently.

• Tethys: Tethys is a data management platform that delivers AI/ML-driven intelligence across complex and dynamic operational environments. As the pace and complexity of mission demands grow, operators and analysts are inundated with volumes of unstructured data. Tethys simplifies and accelerates the data-to-decision timeline by intelligently ingesting, processing, and distributing information, empowering mission-critical decisions at scale.

10 APPENDIX B – SERVICES

• (U) Software Engineer - A software engineer designs, develops, tests, and maintains software applications, systems, or platforms. They apply engineering principles to create solutions that meet specific user needs, often working within a team and following a defined development process.

• (U) System Engineer - A system engineer focuses on the design, development, and integration of complex systems, ensuring they function as a unified whole. They analyze, design, and manage systems, often involving hardware, software, and human interaction, to meet specific organizational needs.

• (U) ISR Geospatial SME - An ISR Geospatial SME is a Subject Matter Expert (SME) who specializes in the application of Geospatial Intelligence (GEOINT) to Intelligence, Surveillance, and Reconnaissance (ISR) operations.

• (U) Program Manager - A program manager oversees and coordinates multiple, related projects to achieve broader organizational goals. Unlike project managers who focus on individual projects, program managers take a holistic view, ensuring projects align with the overall program strategy and contribute to the organization's mission.

• (U) Security Solutions Engineer - A Security Solutions Engineer designs, implements, and manages security systems and solutions to protect an organization's digital assets. They are responsible for developing and deploying security technologies, responding to security incidents, and ensuring the overall security posture of the organization.

• (U) Data Manager - A software platform or a role focused on managing and organizing data. It can encompass various applications, including assessment data management, energy market data management, PV system monitoring, or customer data management in advertising platforms.

11 APPENDIX C – HARDWARE

• KiOSK licenses include a preset number of drives that are included based on the User and Coverage tier. Additional licenses must be purchased separately, up to the maximum number of drives per system.

KiOSK-Tactical-Region Includes 2 HiPER DRIVEs KiOSK-Tactical-AOR Includes 4 HiPER DRIVEs KiOSK-Tactical-Global Includes 7 HiPER DRIVEs KiOSK-Edge-Region Includes 2 HiPER DRIVEs KiOSK-Edge-AOR Includes 8 HiPER DRIVEs KiOSK-Edge-Global Includes 10 HiPER DRIVEs KiOSK-Operational-AOR Includes 12 HiPER DRIVEs KiOSK-Operational-Global Includes 18 HiPER DRIVEs KiOSK-Strategic-Global Includes 20 HiPER DRIVEs