STATEMENT OF WORK

Title: SRD License Key System

I. BACKGROUND

The Material Data Division (MDD) within the Material Measurement Laboratory (MML) provides leadership for NIST in the areas of data management and informatics, ensuring that NIST data is findable, accessible, interoperable, and reusable. NIST distributes Standard Reference Data (SRD) across three tiers: Tier 1 ($100K+ annual sales), Tier 2 (low-volume/revenue), and Tier 3 (free products requiring geographic control). Currently, NIST lacks post-delivery control over these products, leading to unauthorized distribution and access from restricted regions.

II. PURPOSE

This acquisition is for a software license key system to secure the tiers, enforce single-usage licenses, and track distributor sales. The system will ensure NIST intellectual property is protected while maintaining compliance with geographic distribution restrictions. The implementation of this system is critical to modernizing NIST’s data distribution infrastructure and ensuring accurate reporting of global SRD sales. This purchase is in direct support of the Material Data Division’s goal to streamline the delivery of high-quality measurement data to the scientific community. By implementing a secure licensing framework, the division ensures the integrity of the data provided to the public and prevents unauthorized access to sensitive or restricted software products. This acquisition enables NIST to provide unique licenses for each customer, allowing for improved security and the ability to offer modular data products based on specific customer needs.

III. SCOPE

The Contractor shall meet all technical specifications identified below.

Description: SRD License Key System (Base Year) Quantity: 1 System Technical Specifications:

1. The Contractor shall be responsible for the full integration of the system with SalesForce via Application Programming Interface (API), utilizing a NIST-provided Sandbox environment for initial testing.

2. The system shall generate and provide unique license keys for multiple formats, including Windows executables, Apple executables, zip files, websites, and databases.

3. The system shall utilize encryption standards in accordance with NIST Special Publication (SP) 800-52.

4. The system shall allow for modular access, providing keys that unlock either an entire product or specific database portions.

5. The system shall support "add-on" purchases to unlock additional software parts; The Contractor may implement this via existing keys or new keys at their discretion.

6. The system shall provide an API mechanism for NIST to issue license keys to third-party distributors and track their sales.

7. The license keys provided to third-party distributors shall allow the distributor to embed NIST software into their product and activate without manual intervention.

8. The system shall include a secure API that allows third-party systems to request data and trigger internal processes.

9. The system shall include geographic fencing to block license key activation and usage from specified prohibited regions, applicable to all tiers including free Tier 3 products.

10. The system shall support flexible workflows for Tier 3 products, allowing for processing via SalesForce or through separate request workflows.

11. License Activation Heartbeat: The system shall require a network-based activation check-in at a regular interval of at least every six months. The software shall not require network access for every instance of use.

12. Administrative Security: All NIST-side backend configuration and management tasks shall integrate directly with NIST-managed Active Directory/Single Sign On using PIV (Personal Identity Verification) authentication.

13. The Contractor shall provide all software updates, security patches (within 30 days of critical discovery), and bug fixes during the period of performance.

14. The system shall allow for limiting the number of queries that can be performed on a database.

15. The system shall not store identifying information about the customers.

16. The proposed IT solution shall have either one of the following:

1. A Federal Risk and Authorization Management Program (FedRAMP) authorization at the moderate impact level (Proof of evidence must be shown through a FedRAMP Authority to Operate (ATO) letter); or

2. An Assessment and Authorization (A&A) at the moderate impact level as it relates to the security requirements set forth in FISMA, resulting in a Federal Agency ATO (Proof of evidence must be shown through an ATO signed by the issuing Federal Agency)

1. The Contractor must be able to produce a complete assessment package that NIST can review; the Contractor must confirm that the issuing Federal Agency has given permission to allow NIST to review the assessment package. If the Contractor is using subcontractors, each party that will store, process, transmit, or have any type of access to the Government information shall have the above stated authorization at the moderate impact level.

17. The Contractor shall provide dedicated IT support for system assistance throughout the contract.

Options: Continuation of all requirements identified in the base year.

Line Item 0002.

Description: Option Year 1 (FY27) Usage and Support PoP : 12 Months

Line Item 0003.

Description: Option Year 2 (FY28) Usage and Support PoP: 12 Months

Line Item 0004.

Description: Option Year 3 (FY29) Usage and Support PoP: 12 Months

Line Item 0005.

Description: Option Year 4 (FY30) Usage and Support PoP: 12 Months

IV. PERIOD OF PERFORMANCE

Base period of performance shall be 12 months from the date of award.

Four (4) optional years , each 12 months in length,.

V. DELIVERY

The Contractor shall pack and mark the shipment in conformance with carrier's requirements, deliver the shipment in good order and condition to the point of delivery specified in the purchase order, be responsible for any loss of or damage to the goods occurring before receipt and acceptance of the shipment by the NIST consignee at the delivery point specified in the purchase order; and pay all charges to the specified point of delivery. The Contractor shall coordinate this with the NIST contract officer representative (COR) prior to shipping. As this is a software/cloud delivery, The Contractor shall provide all access credentials, API documentation, and administrative manuals electronically to the COR.

VI. INSTALLATION

The Contractor shall perform the remote installation and configuration of the license key system, including the SalesForce API and Active Directory/SSO integration. Installation is considered complete when the system is fully functional in the production environment and has passed NIST security verification. The Contractor shall coordinate this with the NIST COR.

VII. TRAINING

The Contractor shall conduct a technical training session for up to 20 persons prior to the solution being deployed in a production environment. The training shall cover backend administration, license generation, SalesForce integration management, and troubleshooting. Training may be provided as on-site, remote, or a hybrid of the two at the Contractor’s preference.

VIII. INSPECTION & ACCEPTANCE

Upon delivery, a visual inspection will be performed by the NIST COR to identify defects, damage, or nonconformity. Acceptance will be determined after the Contractor has successfully integrated the system and completed the training. NIST will conduct functional testing for a period of 1 week to ensure compliance with the "heartbeat" and geographic fencing requirements. Confirmation of acceptance will be provided by the NIST COR.

IX. WARRANTY

The Contractor shall provide its standard commercial warranty for all products/services provided under this contract. Warranty will commence upon government acceptance.

X. NIST SITE ACCESS

If on-site training is selected, NIST site access is required.

Security: NIST is a restricted campus. A site access badge is required for campus and building access and must always be visible. Contractor personnel must comply with NIST identification and access requirements. At a minimum, each Contractor personnel must provide a government ID (active, unexpired, REAL ID Act compliant) to get a site access badge. The Contractor shall coordinate site access with the NIST COR at least one (1) week prior to arrival.

Safety: Contractor personnel are responsible for knowing and complying with all applicable safety regulations. The Contractor shall coordinate this with the NIST COR.

Vehicle Registration: All vehicles entering the site must be registered with the NIST Security Office. A valid driver's license (REAL ID compliant), active proof of insurance, and current registration must be presented for a vehicle pass.