SS DRAFT - Attachment 3 - Draft PERFORMANCE WORK STATEMENT - OBJECTIVE 2_ Standardized Secure Endpoints.pdf

DRAFT DOCUMENT

PERFORMANCE WORK STATEMENT

Objective 2: Standardized & Secure Endpoints, Highly Available Computer Operations, and Efficient Business Administration

1.0 Background and Scope

The Contractor shall provide seamless technical services and system administration for all user endpoints across the GFDL campus. Distributed throughout GFDL are approximately 250 Linux-based desktop workstations and laptops, primarily located in scientists' offices and shared spaces. These endpoints are utilized for the data analysis and visualization of results from High-Performance Computing (HPC) experiments.

In addition, the Laboratory provides approximately 50 Windows desktops and laptops to scientific, information technology, administrative, and leadership staff. The scope of this PWS encompasses the complete lifecycle management, security hardening, and day-to-day technical support for this 300-device mixed-OS inventory.

The Contractor shall also sustain robust, continuous computer operations to minimize downtime and ensure the integrity of GFDL's computational research environment. The computing environment operates 24 hours a day, 365 days a year. System reliability, availability, and Contractor support are considered fundamental aspects of the High-Performance Computing Systems (HPCS) and are key requirements for any proposed HPCS changes or related procurements.

The scope of this PWS includes system administration of local and remote HPC assets, management of extreme-scale data storage, and the execution of high-volume data transfers across enterprise networks.

Lastly, the Contractor shall deliver seamless administrative services, including full-lifecycle travel coordination via the NOAA travel system (currently E2) and compliant with NOAA and FTR regulations, proactive coordination of personnel security processing (SAC, NACI, BI), facilitation of Foreign National Visitor and Guest processing, Human Resources support, and comprehensive personal and capital property management utilizing the Government's PPMS.

2.0 Standardized & Secure Endpoints (Technical Services

Requirements)

2.1 Scientific Endpoint Configuration and Administration

The Contractor shall administer and maintain a highly specialized, multi-OS (Linux and Windows) endpoint environment. DRAFT

1. Scientific Workstation Customization: The Contractor shall deploy and maintain special computing, storage, and graphics configurations necessary to support the manipulation and visualization of extraordinarily large datasets.

2. Software Provisioning: The Contractor shall ensure that all necessary scientific software, visualization tools, and compilers are properly installed, configured, and updated on local endpoints without disrupting active research workflows.

2.2 Security Compliance and Vulnerability Management

The Contractor shall maintain a rigorous, proactive defense posture for all endpoints, ensuring strict compliance with Department of Commerce (DOC) and NOAA IT security policies.

1. Continuous Patching and Scanning: The Contractor shall execute a continuous monthly cycle of vulnerability scanning, patch management, and system updates across the entire Linux and Windows inventory.

2. Federal Mandate Compliance: The Contractor shall ensure all devices comply with mandated federal security directives (e.g., CISA Emergency Directives, STIGs) within the required Government timeframes, aggressively remediating identified vulnerabilities.

2.3 Asset Lifecycle Management and Deployment

The Contractor shall manage the complete hardware lifecycle for the 300-device inventory, ensuring scientists and staff possess modern, reliable computing resources.

1. Annual Refresh Cycle: The Contractor shall build, image, and deploy new devices on an annual replacement cycle, accounting for approximately 20% of the total device inventory (roughly 60 of the 300 device inventory) annually.

2. Decommissioning: The Contractor shall securely wipe, sanitize, and process end-of-life hardware for disposal or surplus in accordance with Government property management regulations (PPMS) and IT security data destruction policies.

2.4 End-User Technical Services

The Contractor shall provide direct, responsive support to the GFDL user base for all endpoint-related issues.

1. VIP/Leadership Support: The Contractor shall provide expedited "white-glove" technical support for GFDL leadership and critical administrative staff utilizing the Windows-based systems.

2. Help Desk Integration: The Contractor shall utilize Government-furnished IT Service Management (ITSM) tools to track, manage, and resolve user requests related to local hardware, OS errors, software installations, and peripheral connectivity.

3. Help Desk Operational SLA Metrics: Acknowledge new requests within 1 hour of receipt during hours of operation. Document all work performed in the IT ticketing application. Monitor all open tickets, provide monthly status reports summarized by category, and escalate open tickets not edited in 2 weeks or completed within 4 weeks.

Ensure tickets requesting IT service are completed within 4 weeks absent an exception DRAFT approved in writing by the GFDL Senior IT Manager or designated alternate. Request customer feedback on quality of service.

4. Single Point of Contact (SPOC) & Ticket Triage: Operates as the SPOC for intake, ticket triage, routine account admin, and Tier I/II desktop and remote troubleshooting across multi-channel intake (phone, self-service portal, chat, email). Target First Contact Resolution (FCR) using approved SOPs and analyze ticket trends to identify underlying system issues.

5. Account Administration & Access Operations: Perform routine password resets, account unlocks, basic MFA re-registrations using identity verification protocols, and process distribution list updates. Troubleshoot complex SSO, conditional access, and account sync errors across hybrid directory environments (Active Directory / Entra ID).

6. Remote Diagnostics & Endpoint Troubleshooting: Conduct remote desktop sessions to resolve standard COTS software errors, basic browser configurations, localized VPN connectivity issues, and peripheral connectivity. Execute advanced diagnostic steps for OS corruptions, registry failures, line-of-business application crashes, and perform profile repairs without requiring full device re-imaging.

7. Knowledge Management & Process Enablement: Apply and maintain Knowledge Base (KB) articles during routine resolution workflows. Author, update, and publish technical KB articles for support staff and self-service articles for end users, while mentoring Level I technicians on new technologies and escalation paths.

2.5 Desktop Deployment & Endpoint Management

The Contractor shall govern physical device staging, OS imaging, software packaging, device policy management, and executive support.

1. Hardware Provisioning & Refresh Execution: Unbox, tag, stage, configure, and deploy standard desktop and laptop hardware; execute user data migrations; set up physical workstation peripherals (docks, dual monitors, cabling) for new hires and scheduled PC refreshes. Design and oversee PC refresh deployment schedules and refine automated user-data migration workflows.

2. Image Management & OS Deployment: Trigger automated OS deployments (PXE boot, USB media) using enterprise deployment tools; verify standard OS builds, domain joins, and baseline security agent installations. Build, test, and maintain enterprise OS deployment profiles and provisioning templates (e.g., Symantec ITMS, Red Hat Satellite) and manage driver packages across vendor models.

3. Application Packaging & Software Distribution: Push target application packages to individual endpoints via management consoles; troubleshoot local installation failures using standard runbooks; assist users with self-service app portal installations. Package, script (PowerShell), wrap (MSI/Win32), and test software applications for enterprise silent deployment.

4. Endpoint Configuration & Policy Enforcement: Triage non-compliant endpoints;

execute standard commands to force policy syncs (e.g., gpupdate /force, Intune syncs);

manage temporary local administrative access requests. Author, test, and enforce Configuration Profiles, Group Policy Objects (GPOs), compliance policies, BitLocker/FileVault encryption keys, and LAPS configurations. DRAFT

5. Loaner Pool & Foreign Travel Image Repository: Maintain ready-to-deploy pools of laptops for short-term loan to users. Maintain and manage a disk image network repository for foreign travel systems, creating clean images and re-imaging systems upon return.

2.6 Patch & Endpoint Security Operations

The Contractor shall execute monthly patch deployment rings, maintain EDR/AV agent health, and remediate endpoint vulnerabilities.

1. Patch Deployment & Lifecycle Management: Execute scheduled deployment rings for OS (Windows, Linux, macOS) and third-party software updates (e.g., Chrome, Adobe);

trigger manual update pushes on non-compliant endpoints; assist end users with update reboots and deferral requests. Package, stage, and schedule monthly patch releases using management consoles (Red Hat Satellite, Symantec ITMS, Microsoft Intune).

2. Vulnerability Assessment & Remediation: Run daily compliance queries to identify endpoints with outdated signatures or missing patches; execute script-based remediation for standard patch failures. Review vulnerability scan reports (Tenable, Qualys) to identify exposed software assets; prioritize and deploy zero-day or out-of-band security fixes.

3. Endpoint Detection & Security Response (EDR/AV): Monitor endpoint security dashboards for antivirus and EDR alerts; perform initial isolation of compromised endpoints following established Incident Playbooks; gather diagnostic logs for escalation.

Coordinate with the Security Operations Center (SOC) during active security incidents and execute file/system cleanup routines.

4. Agent Health & Policy Enforcement: Reinstall corrupted or missing security agents (EDR, DLP, VPN, Disk Encryption) on client hardware using approved deployment scripts;

verify agent connectivity during device staging. Manage endpoint security policies within central consoles and configure USB/removable media rules and host firewall settings.

5. Compliance Auditing & Reporting: Log all patch exceptions and endpoint remediation activities within the ITSM ticket system. Generate monthly patch compliance and vulnerability health reports for leadership, tracking SLAs for critical flaw remediation.

2.7 Illustrations and Graphical Support Services

The Contractor shall assist GFDL scientists and other staff with bringing their work to life through still and animated illustrations and graphical support needs. The result of this will go into publications, manuscripts, posters, and presentations, among other things, to be presented in various forms and forums.

3.0 Highly Available Computer Operations

3.1 High-Performance Computing (HPC) Systems Monitoring

The Contractor shall provide systems monitoring for NOAA's Research and Development High-Performance Computing (RDHPCS) program assets utilized by GFDL. For details about the RDHPCS computing and data storage resources located at GFDL, please refer to Attachment A, NOAA Geophysical Fluid Dynamics Laboratory (GFDL) Computing and Data Storage Resources. DRAFT

1. Local and Remote Production Systems: As a part of its system monitoring requirement, the Contractor shall coordinate with the National Climate-Computing Research Center (NCRC) at the Department of Energy's Oak Ridge National Laboratory (ORNL) in Oak Ridge, Tennessee, the NOAA's Environmental Security Computing Center (NESCC) in Fairmont, West Virginia, and local HPC administrators for equipment at GFDL in Princeton, New Jersey. These systems are the lifeblood of GFDL's scientific computing. Gaea is located at ORNL, it consists of HPE-Cray EX 3000 systems, which feature dual-socket nodes with 64-core and 96-core AMD EPYC processors, and 75 Petabyte file systems. The NESCC hosts Hera, Ursa (an 8.3-petaflop AI-optimized system deployed in 2025), and Rhea (anticipated production date of late 2027), along with a data archive of more than 500 petabytes. Post processing and analysis (PPAN) consists of 164 individual nodes of Dell systems. All of these are as detailed in Attachment A.

2. Software Maintenance: The Contractor shall ensure various programming languages and parallel code development software are updated, patched, and available on all systems.

3.2 Hierarchical Storage Management System (HSMS) Operations

The Contractor shall monitor the environment that supports RDHPCS’s Hierarchical Storage Management System (HSMS) at GFDL.

1. Capacity Management: The Contractor shall monitor the environment for the HSMS at GFDL, which houses over half an Exabyte (and growing) of archived data to meet the data generation rates of the production computing systems and the intensive demands of local post-processing servers.

2. Site Integrity: The Contractor shall ensure the site is under constant surveillance to prevent data corruption or loss.

3.3 High-Volume Data Transfer and Network Support

The Contractor shall utilize specialized software and networking tools to manage continuous, massive data pipelines as well as local network administration.

1. Local Network Administration: The Contractor shall support GFDL's local wired and wireless network infrastructure.

2. Enterprise Network Integration: The Contractor shall support operations across the NOAA N-wave Enterprise Network, which connects remote production nodes to local post-processing nodes, the HSMS, and user workstations.

3. Massive Data Transfers: The Contractor shall utilize a highly specialized set of tools to satisfy the extremely demanding requirement for the reliable transfer of up to 80 Terabytes (TB) per day of data from remote production sites (e.g., ORNL) to the storage and analysis systems at GFDL.

3.4 Continuous Operations and Help Desk Monitoring

The Contractor shall maintain 24/7/365 monitoring and responsive help desk monitoring. DRAFT

1. User Support: The Contractor shall provide tiered technical support for approximately 250 internal users at GFDL and approximately 150 other collaborators worldwide who share these computing resources.

2. Infrastructure Monitoring: The Contractor shall proactively and continuously monitor the physical security, infrastructure health, network reliability, supercomputing operations environment (e.g., data center temperature/power alerts), and coordinate immediately with Facilities Management staff in the event of an anomaly. The Contractor shall continuously monitor enterprise dashboards (e.g., ManageEngine OpManager, Grafana) for server, storage, and network alerts, logging events and executing initial diagnostic commands (ping, traceroute, service restarts) to identify system issues and notify the appropriate party.

3. Batch Processing & Scheduled Jobs: Monitor automated workload scheduling platforms (e.g., Slurm); execute standardized commands for routine failed jobs. Analyze complex batch job dependency failures, adjust job parameters or hold queues during outages, and manage data restoration workflows.

4. Facility & Hardware Oversight: Perform scheduled physical walk-throughs to inspect server status LEDs, environmental sensors, and HVAC/UPS indicators; escort third-party vendors within secure data center spaces. Coordinate hardware vendor dispatches (Dell, HPE, Cisco) for failed drives/motherboard replacements, oversee structured cabling, and manage facility maintenance windows.

5. Major Incident & Bridge Management: Open high-priority incident tickets upon critical threshold breaches; assemble call bridges and broadcast notifications to key technical leads. Act as initial Incident Facilitator during off-hours outages, execute automated Disaster Recovery (DR) failover scripts, and maintain detailed timelines for post-incident reviews (PIRs).

6. Shift Handoffs & Operational Logging: Record daily shift logs detailing open alerts, vendor visits, and active maintenance; conduct formal verbal and written handoffs between shifts. Review shift logs for trends and update Data Center Operations SOPs and runbooks.

7. Physical Security System Administration: The Contractor shall provide troubleshooting and administration for the C-Cure 9000 physical access control system and Genetec video surveillance system, ensuring the ongoing operational integrity of the Laboratory's physical security infrastructure.

3.5 Printer & Peripheral Infrastructure Support

The Contractor shall manage networked multi-function devices (MFDs), print server queues, driver repositories, and peripheral hardware.

1. Consumables, Hardware Maintenance & Break/Fix: Perform routine physical inspections of shared MFDs; replace consumables (toner, drums, waste boxes); resolve paper jams; clean optics, rollers, and paper paths. Diagnose recurring hardware mechanical failures, replace internal Field Replaceable Units (FRUs), manage on-site spare parts inventory, and process defective component returns (RMA).

2. Print Server & Network Queue Management: Map network printers to client endpoints;

assist end users with clearing local spooler queues, adjusting print preferences, and DRAFT setting up specialized local peripherals (scanners, label printers, drawing pads). Build, configure, and maintain central print servers and spooler services; manage print queues, network ports, and security permissions; push printer assignments automatically via GPO or Intune policies.

3. Driver Management & Fleet Deployment: Verify standard driver installations on client machines; resolve endpoint driver conflict tickets; stage new desktop peripheral hardware for deployment.

4. Vendor SLA & Fleet Management: Place vendor service calls for hardware issues;

escort third-party technicians in secure facilities; log device downtime and vendor resolution details into the ITSM tool. Track vendor SLA performance against contractual response and repair windows, audit monthly meter reads for billing accuracy, and analyze volume usage to optimize device placement.

5. Peripheral Support & Printing Controls: Provision, test, and troubleshoot workstation peripherals (docking stations, dual monitors, webcams, headsets); assist with printing, scanning, copier, and fax issues.

3.6 Multimedia & Audiovisual Support

The Contractor shall provide full audiovisual and multimedia support across GFDL conference rooms and event spaces.

1. Audiovisual (AV) Support: Provide audiovisual support in GFDL conference rooms, assisting customers with configuration and use of IT-managed equipment.

2. AV equipment troubleshooting: Troubleshoot and resolve problems with conference room AV equipment.

3. Meeting Software: Configure approved software for online meetings, webcasts, live GFDL webinars, and hybrid meetings.

4. Conferencing and Presentation Desktop System Administration: Administer shared conferencing and presentation desktop systems.

5. Conference Room and Equipment Calendar and Reservation System: Maintain an online calendar and ticketing for room and equipment reservations.

4.0 Efficient Business Administration (Administrative Support Services Requirements) The Contractor shall deliver seamless administrative services, including full-lifecycle travel coordination via the E2 system and compliant with NOAA and FTR regulations, proactive coordination of personnel security processing (SAC, NACI, BI), facilitation of Foreign National Visitor processing, Human Resources support, and comprehensive property management utilizing the Government's PPMS.

4.1 Foreign National Visitor Processing

The contractor shall facilitate GFDL's vibrant and robust interactions with collaborators from around the world who visit GFDL or other OAR facilities for periods of 1 -14 days within a twelve-month period. DRAFT

1. Foreign National Building Access: Assist hosts/supervisors and Foreign National (FN) visitors in NOAA's Foreign National Visitor and Guest Process to obtain GFDL building access.

2. Coordinate the Processing of FN Visit Requests: Receive email of visitor's contact information from federal sponsor

3. Secure Document Collection and Submission: Contact FN visitor to request documents via secure file Kiteworks email, prepare the visit request draft in FNRS system for federal sponsor to review and submit to Office of Security (OSY) for processing. Visit requests must be submitted to the OSY for clearance at least 48 hours before each visit.

4. FN Visitor Log Maintenance and Update: Maintain an electronic spreadsheet or database log of all Foreign National Visitors and Guests to GFDL including their name, country of origin, host, and beginning and ending dates, FNRS ID Number and date OSY clearance received.

5. FN Visitor Access Approval Notification: Notify Operations of approved FN visitors and forward the security clearance email. Notify the visitor and sponsor once building clearance is received and provide instructions on how to contact Operations upon arrival for visitor badge processing.

6. Policy and Procedure Update: Remain current in DOC, NOAA, and OAR requirements regarding Foreign National Visitor and Guest Policies, Regulations, and Procedures and recommend to GFDL management updates to GFDL's written procedures as necessary.

7. FN Visitor POC: Primary point of contact for any requests for information regarding Foreign National visitors. Respond to queries by due date as requested via email, smartsheets, google sheets, templates or as directed by the requester.

8. Information Dissemination: Provide interns and incoming visitors with local housing information, on-site logistics details, and instructions.

4.2 Foreign National Guest Processing (as necessary)

The contractor shall facilitate GFDL's vibrant and robust interactions with collaborators from around the world who visit GFDL or other OAR facilities for periods ranging from 15 days to twelve months.

1. FN Program Management POC: Serve as the Lab’s FN program manager and coordinate processing of FN Guest Requests with the federal sponsors.

2. Secure Document Collection and Submission: Contact the FN guest to request documents via secure file Kiteworks email, prepare the visit request draft in the FNRS system for the federal sponsor to review and submit to Office of Security (OSY) for processing. Guest requests must be submitted to the OSY for clearance at least 90 days before the proposed start date.

3. Visitor and Guest Log Maintenance and Update: Maintain an electronic spreadsheet or database log of all Foreign National Visitors and Guests to GFDL, including their name, country of origin, host, and beginning and ending dates, FNRS ID Number, and date OSY clearance received. DRAFT

4. FN Guest Access Approval Notification: Notify Operations of approved FN guests and forward the security clearance email. Notify the guest and sponsor once building clearance is received and provide instructions on how to contact Operations upon arrival for visitor badge processing.

5. FN Guest Building and Computer Access: Request computer and building access via the help desk.

6. Policy and Procedure Update: Remain current in DOC, NOAA, and OAR requirements regarding Foreign National Visitor and Guest Policies, Regulations, and Procedures and recommend updates to GFDL's written procedures to GFDL management as necessary.

7. Security / Suitability Processing: Gather documents, such as fingerprints, passport, OF 306 and visa, for the SAC or tier 1 packet

8. Security / Suitability Approval Notification: After approval is received, email the FN guest the approval, including the expiration date of the current renewal and attach the Attachment 2 form.

9. Form Processing: Once the Attachment 2 form is signed by the FN guest, work with the sponsor to facilitate their upload of the form to the request system.

10.FN Guest POC: Primary point of contact for any requests for information regarding Foreign National guests. Respond to queries by due date as requested via email, smartsheets, google sheets, templates or as directed by the requester.

4.3 Front Desk Reception, Building Access & Security Operations The Contractor shall act as the first line of defense and assistance for the facility, managing visitor processing, access control, and reception operations.

1. Visitor Access Control & Verification: Monitor both entrances, one at the Main Building front entrance and the other at the Computer Building loading dock pedestrian entrance.

Each is equipped with a request-to-enter call station with an integrated video intercom.

There are two receiving stations with a display screen and door-lock release. Upon receiving notification via the security system: greet visitors, verify identity via photo ID over video feed, require statement of purpose and POC, notify appropriate internal personnel, and grant access once visit is confirmed with no threat posed.

2. Visitor Processing & Badge Management: Process visitor check-ins, including fingerprinting (if required) and creating temporary building identification cards/photos.

Require that badges are displayed at all times, maintain/update digital visitor logs, and ensure personnel meet visitors in the Reception Area.

3. CCTV Monitoring: Monitor CCTV feeds for unusual activity. Report suspicious activity immediately or take independent action in life threatening situations (i.e., call 9-1-1).

4. Deliveries & Logistics Reception: Notify designated personnel upon arrival of deliveries and coordinate facility access.

5. Administrative Policy & Safety Compliance: Adhere to appropriate administrative policies regarding safety and procedural requirements. Receive, sort, and distribute mail and packages in a safe, neat, and organized manner.

6. Mail & Shipping Logistics: Check mailroom daily, meter outgoing mail, organize and distribute incoming/outgoing mail and packages (USPS, UPS, FedEx), and coordinate with government POC to ensure mail supplies are available. DRAFT

7. Communications & Reception Support: Answer and route calls from the front desk receptionist line, maintain call logs, and record/transmit messages.

8. Lobby & Event Preparation: Prepare lobby and conference areas for visitors, training, or events, including stocking supplies and managing food/beverage setup.

4.4 Travel Services

The contractor shall provide guidance in accordance with Federal Travel Regulations and NOAA and OAR specific policies and procedures to GFDL or other OAR Federal staff seeking to travel both domestically and internationally for official business in support of Laboratory activities.

Additionally, the contractor shall prepare the necessary travel documents and packages, make necessary arrangements, prepare travel gift and bequest packages for advanced approval where appropriate, and process vouchers, as follows:

1. Travel Coordination: Make contacts, as required, with Laboratory travelers; OAR headquarters administrative staff; NOAA Travel Branch staff; CWT Sato; airline, railroad, hotel, and motel reservationists; and personnel of various foreign governments. Obtains passports and visas for staff traveling outside of the United States.

2. Travel Authorization Preparation: Prepare travel authorizations and related documents for travel on a worldwide basis.

3. Maintenance and Update of Outside Seminar List: Maintain and update the GFDL "Outside Seminar" list routinely as travel authorizations are prepared.

4. Travel Voucher Preparation: Prepare and submit travel vouchers for travel reimbursement. Provide controls, guidance, and oversight to ensure that all travel services at GFDL are provided in a timely manner and are in accordance with current guidelines regarding travel.

5. Travel Guidance and Information Upkeep and Dissemination: Prepare travel information and guidance to scientists visiting GFDL; these scientists hail from locations throughout the world.

6. Individual and Group Travel Approval Request Documentation Preparation and Submission: Prepare and submit all travel pre approval forms prior to preparing any travel arrangements, including but not limited to mission critical political approval, group travel request.

7. Travel System (E2) Processing: Oversee the E2 travel system and serve as a travel arranger for all GFDL travelers and all GFDL invitational travelers.

8. International Travel Processing and Log Maintenance and Update: Oversee the OAR International Engagements Spreadsheet. Work with each traveler to facilitate the political approval of all international engagements. Guide travelers through the submittal process and the follow up with HQ.

9. Group Travel Spreadsheet Monitoring: Monitor the OAR Group Travel Date call spreadsheet and process approval of all GFDL travelers to queried events.

10.Travel Budget Tracking: Monitor the Laboratory's fiscal year travel budget to ensure that overall travel costs do not exceed budget by maintaining the GFDL travel database to track completed and planned travel activities. DRAFT

11.Division/Group Travel Allocation Monitoring and Reporting: Track and monitor Group travel allocations and provide Group Leaders and Laboratory Management with reports as needed. Provide suggestions and alternatives to travel plans to reduce overall costs.

12.Travel Gift and Bequest Processing (Form CD-210): Collect and maintain a log of funds received from non-U.S. Government sources for travel reimbursements as maintained in a reimbursable account. Must be proactive and follow up on receiving approval decisions in advance of travel from headquarters, reimbursement checks from travelers immediately following their return from official travel, obtaining clearance for the checks from OAR Headquarters, and entering the checks with NOAA Accounting Operations Eastern Operations Branch.

13.Electronic Systems Processing: Develop and work with databases and spreadsheets;

provide expertise in Microsoft PowerPoint, Word, Excel, Google Slides, Docs, and Sheets, and other types of briefings products.

14.Travel POC: Primary point of contact for any requests for information regarding travel.

Respond to queries by due date as requested via email, smartsheets, google sheets, templates or as directed by the requester.

4.5 Suitability Check Coordination

Coordinate background investigations (SAC, NACI, BI) for physical and logical access to GFDL and NOAA's HPC systems. Maintain an electronic database tracking all access request statuses.

1. Prospective New Arrival Intake: Receive request of a new US citizen collaborator/contractor/associate/visiting researcher/interns/ volunteer applicant through the Visiting Science Committee or directly from the federal sponsor or COR

2. Position Designation Coordination: Coordinate with the federal host/supervisor, for the appropriate level of suitability check (SAC for fewer than 180 days, NACI TIER 1 for user level physical or logical access, and BI TIER 2 for system administrator level access or physical access to restricted areas),

3. Secure Document Collection and Submission: Work with the applicant to submit necessary background check forms and collect documents using secure file email.

Review forms and advise the applicant of any corrections. Forward security paperwork to the GFDL Administrative Officer for signature.

4. Security / Suitability Check Coordination: Send the SAC investigation to the Office of Security for processing. For investigation levels of Tier 1 and higher, send the signed security paperwork to the GFDL NBIS coordinator to invite the applicant to submit the online questionnaire. Work with the NBIS coordinator as needed to gather any additional information requested by the security office from the applicant.

5. Access Request Coordination: Review the applicant's GFDL access requests for physical access and/or computer account access to GFDL accounts and NOAA's Research and Development High Performance Computing platforms; submit a Service Desk Ticket for account setup in preparation for the applicant's arrival.

6. Security / Suitability Approval Notification:Communicate suitability check results to the federal manager and/or COR along with the appropriate GFDL listserv. DRAFT

7. Onboarding Coordination: Work with the sponsor/COR to establish the individual's start date, and coordinate office spacing and workstation setup.

8. Access Request Log Maintenance and Update: Maintain an electronic spreadsheet or database log of all access requests, including dates and current status, in Google drive as a spreadsheet or S drive database as appropriate.

9. CAC / PIV-I Assistance: Assist the applicant with submission for a CAC or PIV-I card upon arrival

10.Security / Suitability POC: Primary point of contact for any requests for information regarding US suitability and US visiting guests, assists with access policy enforcement where necessary. Respond to queries by the due date.

11.Electronic Systems Processing: Utilize email, google sheets, S drive files and templates as necessary for communication with the requester and other GFDL administrative personnel.

12.RDHPCS AIM Processing: Review requests for access to NOAA's Research and Development High Performance Computing System Program in the Account Information Management System (AIM). Contact the corresponding Lab to verify the suitability check and security clearance were granted before giving the HR approval for project requests.

13.Outprocessing Initiation: Initiate out processing documents for departing non federal personnel.

4.6 Property Custodial, Disaster Recovery, IT Purchasing, and RDHPC Program Documentation Support

4.6.1 Property Contact Duties: Serve as designated Property Contact working through IT to support the Property Custodian in physical custody, annual inventory tracking, and processing accountable personal property within the Personal Property Management System PPMS.

Obtain and maintain Property Contact certification. Acquire hand receipts from all users as property users/locations change. Manage warranty exchanges of property.

1. Inventory & Tagging: Update inventory spreadsheets and databases, tag incoming property upon receipt, assist in physical inventory audits, and assist with surplus property disposal according to agency policy.

2. Excess & Decommissioning: Process retired systems for excess by erasing/removing disk drives and optical media, removing systems from DNS/Node databases, and maintaining designated pools for excess hardware. Prepare required documentation for capital and accountable property disposals.

3. Conduct physical inventories: Update and maintain the PPMS with less than a 2% variance standard. Ensure signed hand-receipts are submitted within five (5) business days of completion. Acquire hand receipts from all users annually during the inventory period.

4. Report Lost, Missing, Stolen, Damaged, or Destroyed (LMSDD) property: Report LMSDD equipment using Form CD-52 within three (3) business days. Prepare SBOR/BOR packages for LMSDD equipment if needed. DRAFT

5. Property Pass Issuance and Renewal: Prepare, issue, and monitor Optional Form 7 (Property Pass) issuance and renewal.

6. New Asset Processing: Enter new property into the Sunflower PPMS and Service Desk Systems.

7. Property System Updating: Update the Sunflower PPMS and Service Desk with property changes. Ensure multiple inventory databases are synchronized.

8. Manage Warrant Exchanges: Manage the warranty exchange / replacement process to ensure exchanged equipment is property re-tagged and all exchange documents are received and in order per agency requirements.

4.6.2 Disaster Recovery Assistance

Maintain and coordinate the deployment of GFDL's three Disaster Recovery Boxes (DRP) with the archival storage facility. Review invoices related to the delivery of DRP boxes and their storage.

4.6.3 IT Purchasing Support

1. Assist with invoice verification for both the RDHPCS and GFDL environments.

2. Prepare all documentation for IT purchase requisitions. Ensure all annual recurring maintenance, subscriptions and licenses are processed before expiration date.

3. Monitor receipts of items purchased to ensure items purchased are received.

4. Manage the IT purchasing spreadsheets for the IT budget.

4.6.4 RDHPCS Program and Contract Assistance

1. Assist RDHPCS with invoice reviews, spreadsheets and logs.

2. Assist with maintenance of contract folders.

3. Assist with supporting procurement documentation preparation and organization (i.e., 508 checklist, IGCE preparation).

5.0 Performance Standards and Quality Assurance

5.1 Quality Control Plan (QCP)

The Contractor is solely responsible for controlling the quality of all services provided under this PWS. The Contractor shall develop, implement, and maintain a Quality Control Plan (QCP) that establishes standardized procedures to monitor, inspect, and document performance across all functional areas (Standardized & Secure Endpoints, Computer Operations, and Business Administration).

1. Submission: The Contractor shall submit a final QCP to the Contracting Officer (CO) and Contracting Officer’s Representative (COR) for approval within fourteen (14) calendar days after contract award.

2. Updates: Any subsequent updates or revisions to the QCP during the period of performance are subject to prior written approval by the COR.

3. Core Elements: The QCP shall incorporate: DRAFT

a. Automated and manual inspection/audit procedures covering routine operations and high-priority support services.

b. Discrepancy identification, root cause analysis, and corrective/preventive action procedures to prevent recurrence.

c. Trend analysis tracking and customer feedback/complaint resolution mechanisms.

5.2 Quality Assurance

The Government shall evaluate the Contractor’s performance under this contract in accordance with the Government's Quality Assurance Surveillance Plan (QASP). The QASP is a Government-administered evaluation framework designed to verify that the Contractor satisfies all contractual requirements and metrics. Government inspection and surveillance do not relieve the Contractor of responsibility for maintaining effective quality control.

5.3 Performance Requirements Summary (PRS)

The Contractor's performance under this PWS will be measured against the standards in this Performance Requirements Summary (PRS). Failure to meet the Acceptable Quality Level (AQL) may result in rework, CPARS rating deduction, or reduced payment per FAR 52.246-4.

Required Service Performance Standard Acceptable Quality Level (AQL)

2.1 Scientific

Configuration Management

Linux endpoints maintain special computing, storage, and graphics configurations to support large data sets.

Less than 5% of help desk tickets require rework due to improper initial workstation configuration.

2.2 Endpoint & Patch

Management and Security Compliance

Ensure all systems are rigorously patched, scanned, and compliant with federal security mandates on a continuous monthly cycle across 300 endpoints.

100% of endpoints receive critical security patches within 14 days of release; zero overdue CISA directive remediations.

2.3 Asset Lifecycle

Deployment & Refresh Execution

Build and deploy new devices on an annual replacement cycle (accounting for approximately 20% of the inventory).

100% of scheduled lifecycle replacements completed annually without workflow disruption or data loss.

2.4 Help Desk

Responsiveness

Resolve end-user technical issues rapidly to minimize downtime for leadership, scientists, and administrative staff.

Acknowledge user tickets within 1 hour during operational hours. Complete requests within 4 weeks. Escalate stale tickets (>2 weeks unedited).

95% of standard endpoint tickets resolved within established Service Level Agreement (SLA) timeframes.

2.7 Illustrations and

Graphical Support Services

Create high quality illustrations and graphics to bring scientific and other work to life and otherwise to promote the work of the Laboratory

Less than 5% of finished work products require rework or are not completed within two weeks (10 business days) DRAFT

Required Service Performance Standard Acceptable Quality Level (AQL)

3.1 - 3.2 High-Performance Computing and Data Storage Operations

Continuously monitor local and remote RDHPCS operations, HSMS storage environment and local post-processing infrastructure and alert appropriate parties to resolve operational issues.

99.9% environmental uptime (excluding scheduled Government-approved maintenance windows).

3.3 High-Volume Data

Transfer and Network Support

Reliable transfer of data from remote production sites to GFDL.

Minimum 98% daily success rate of scheduled 80 TB/day data transfers.

3.4 Continuous

Operations

The computing environment operates 24 hours a day, 365 days a year.

100% shift coverage. No gaps in critical monitoring or data center oversight.

4.1 & 4.2 Foreign National (FN) Visitor & Guest Processing

Collect, draft, and submit FN Visit requests at least 48 hours in advance, and FN Guest requests at least 90 days in advance to OSY via FNRS/Kiteworks.

100% compliant and complete packet submissions to OSY within required lead-time windows; zero unverified physical/logical facility access incidents.

4.3 Front Desk

Reception, Building Access & Security Operations

Visitors greeted, verified via ID, processed strictly per security protocols. CCTV monitored continuously.

1 valid complaint per month or less

4.4 Travel

Coordination

Process travel pre-approvals, authorizations, E2 processing, international clearances, and travel vouchers compliant with NOAA, OAR, and FTR rules.

98% error-free processing of travel authorizations and vouchers; travel pre-approvals submitted within mandated deadline windows.

4.5 Suitability Check

Coordination

Intake new arrivals, coordinate position designations (SAC, NACI, BI), send paperwork to NBIS/OSY, and maintain tracking logs.

95% of background investigation packets reviewed and submitted error-free within 5 business days of intake.

4.6 Property Custodial, Disaster Recovery, IT Purchasing, and RDHPC Program Documentation Support

Conduct physical inventories (PPMS) and report Lost, Missing, Stolen, Damaged, or Destroyed (LMSDD) property. Provide purchasing and documentation support.

1 valid complaint per month or less

5.4 Contract Discrepancy Reporting & Resolution Meetings

1. Issuance of CDR: The Government may issue a written Contract Discrepancy Report (CDR) whenever the Contractor's performance is determined to be unacceptable or fails to satisfy established AQLs. DRAFT

2. Meeting Notification: The COR will notify the Contractor's Program Manager within two

(2) business days of identifying a performance discrepancy to convene a contract discrepancy meeting.

3. Response Timeline: Within three (3) business days of receiving a written CDR, the Contractor shall submit a written response to the CO and COR detailing:

a. Root cause analysis explaining why the discrepancy occurred.

b. Specific corrective actions taken or planned to resolve the discrepancy.

c. Preventive measures instituted to ensure non-recurrence.

4. Remediation Execution: Corrective actions specified in the response plan shall be executed within two (2) business days following written acceptance by the COR and Contracting Officer.

DRAFT