Statement of Work.pdf

UNCLASSIFIED Attachment 1

2 | P a g e

UNCLASSIFIED

NATIONAL GEOSPATIAL INTELLIGENCE

AGENCY

MARITIME SAFETY OFFICE

QUALITY MANAGEMENT SYSTEM REGISTRATION

International Organization of Standardization 9001

ISO 9001 Audits

Statement of Work

4 March 2021

3 | P a g e

UNCLASSIFIED

Table of Contents

1.0 INTRODUCTION

2.0 SCOPE

3.0 PERIOD OF PERFORMANCE

4.0 AUDITING REQUIREMENT AND TASKS

4.1 MARITIME SAFETY OFFICE AUDITS

5.0 MARITIME SAFETY OFFICE PERFORMANCE SUMMARY

6.0 REPORTS

7.0 SECURITY

7.1 INSTRUCTIONS FOR MARITIME SAFETY OFFICE PERSONNEL

8.0 TRAVEL

APPENDIX A: REFERENCES

4 | P a g e

UNCLASSIFIED

1.0 INTRODUCTION

The National Geospatial-Intelligence Agency (NGA) delivers Geospatial Intelligence (GEOINT) and Maritime Safety Office (SFH) information that provides a decisive advantage to policymakers, warfighters, intelligence professionals, humanitarian efforts and first responders.

NGA supports the National System for Geospatial Intelligence, which supports our Department of Defense, Department of Homeland Security and the Intelligence Community. NGA is a unique combination of intelligence agency and combat support agency and leads the world in timely, relevant, accurate and actionable GEOINT.

2.0 SCOPE

SFH requires auditing services from an independent, primary audit firm (Contractor) that is recognized as a Certification Body (CB), to certify that NGA’s Maritime Safety Office, including all of its business activities, conform to ISO 9001:2015 standards. A Certification Body must be accredited by American National Standards Institute (ANSI) American Society of Quality (ASQ) National Accreditation Board (ANAB) or an equivalent U.S.-based Accreditation Body that is a signatory to the International Accreditation Forum (IAF) Multilateral Recognition Agreement (MLA) for Quality Management Systems (QMS) (ISO 9001) Management Systems.

A CB's scope of accreditation must include ISO 9001:2015 and the applicable code/s in order for a CB to issue an accredited certificate.

The primary service of the Certification Body, also referred to as “Registrar”, is to provide a team of certified auditors, including a certified lead auditor, to conduct assessments that determine the continued worthiness of the registered organization to maintain its registration.

Contractors providing this auditing function will be expected to comply with the standard found in ISO/IEC 17021-1:2015 (Conformity Assessment – Requirements for bodies providing audit and certification of management systems).

3.0 PERIOD OF PERFORMANCE

This contract is for a Base Year plus four (4) 12-month Option Years. Reference the contract for individual periods of performance.

4.0 AUDITING REQUIREMENT AND TASKS

The Contractor MUST be an independent, ISO 9001-licensed, certified Registrar, and primary audit firm.

Certification/Recertification Issuance

After successful completion of the assessment and completion of any corrective actions, the Registrar will provide evidence of conformance via signed certificates for each organization’s site. The Registrar shall provide the materials and services necessary and issue a “Certificate of

5 | P a g e

UNCLASSIFIED

Registration.” Registrar should also provide appropriate marketing tools to include banners, certificates, plaques, logo use, press releases, etc.

NGA’s Maritime Safety Office (SFH) has been registered with ISO 9001 since April 2008 and possesses a current Certificate of Conformance. The Quality Management System covers activities at the following sites:

National Geospatial-Intelligence Agency Maritime Safety Office (SFH) 7500 GEOINT Drive Springfield, VA 22150

SFH personnel (Government and Contractor): ~249 individuals

National Geospatial-Intelligence Agency Maritime Safety Office (SFH) 3200 South 2nd Street St. Louis, MO 63118

SFH personnel (Government and Contractor): ~100 individuals

During the Period of Performance of this effort, the Contractor shall perform the following tasks:

4.1. MARITIME SAFETY OFFICE AUDITS

4.1.1 Audit scheduling will be coordinated between the Contractor and NGA through the COR - at times or specified intervals for each assessment.

4.1.1.1 The NGA Maritime Safety Office has been registered to ISO

9001:2008 since April 2008.

4.1.1.2 A transfer of certification may be necessary during the base period. The NGA Maritime Safety Office is currently ISO

9001:2015-compliant.

4.1.1.3 Subsequent audit activities will be surveillance audits and conducted annually during the option periods.

4.1.2 Handling updates to the ISO standard.

4.1.2.1 When new versions of the ISO 9001 standard are released, NGA will take the required steps to realign to the requirements of the new version. This may include additional audit activities in order to retain the registration granted by the auditing agency.

4.1.3 Audit Activities

4.1.3.1 Base Year

4.1.3.1.1 Initial Assessment or Transfer of Certification (St. Louis, MO and Springfield, VA): The Maritime Safety Office’s

Quality Management System will be assessed for conformance to the ISO 9001:2015 Standard by the

6 | P a g e

UNCLASSIFIED

auditing agency. This assessment will occur in June or

July 2021.

4.1.3.1.2 A second onsite visit may be required to constitute a completed audit, depending on the results of the initial assessment. The NGA COR will notify the Contractor if a second onsite visit is required.

4.1.3.1.3 Assessments should be scheduled to review both sites at the same time.

4.1.3.1.4 Submit a date for the next Surveillance Assessment no later than 14 days after the successful completion.

4.1.3.1.5 Submit audit schedule and plan to the COR a minimum of two (2) weeks prior to each assessment date.

4.1.3.1.6 Upon completion of the assessment activity, the

auditor will provide an audit report and a new certificate of registration. Proof of these deliverables will be given to the COR to demonstrate completed tasks prior to payment. The Certification Body will issue accredited mark and certificate following the completion of the annual audit activity.

4.1.3.2 Option Year/s

4.1.3.2.1 A Surveillance/Re-registration Assessment (St. Louis, MO and Springfield, VA) shall be conducted on an annual basis to assess the Maritime Safety Office’s

Quality Management System for continued conformance to ISO 9001:2015 standards. This assessment will take place approximately February or

March of each option year to keep the surveillance schedule intact.

4.1.3.2.2 Submit a date for the next Surveillance Assessment no later than 14 days after the successful completion of the Surveillance Assessment.

4.1.3.2.3 Submit audit schedule and plan to the COR a minimum of two (2) weeks prior to each assessment date.

4.1.3.2.4 Upon completion of the Surveillance Audit, the auditor shall provide an audit report and a new certificate of registration. Proof of these deliverables will be given to the COR to demonstrate completed tasks prior to payment. The Certification Body will issue accredited mark and certificate following the completion of the annual audit activity.

4.1.4 Auditor Qualifications

7 | P a g e

UNCLASSIFIED

4.1.4.1 The Certification Body (Audit Firm) must have credentials recognized by the ANSI-ASQ National Accreditation Board (ANAB) or an equivalent U.S. based Accreditation Body that is a signatory to the International Accreditation Forum (IAF) Multilateral

Cooperative Arrangement (MLA) for QMS (ISO 9001:2015)

Management Systems.

4.1.4.2 The Certification Body must possess experience with Professional, Scientific, and Technical Services: Surveying and Mapping (except

Geospatial Services).

4.1.4.3 The Certification Body must have a process to determine competence of its auditors. ISO 17021 Annex lays out the knowledge and skill sets for specific functions. Of particular interest is Annex A, Para A.2.6 “Knowledge of client products, processes, and organization.” The Maritime Safety Office has a unique mission of providing worldwide maritime data to a wide-ranging community of users. The requirement is that the auditors possess a basis of maritime knowledge and data management, which the NAICS Codes delineates.

4.1.4.4 The Contractor shall assign a certified lead auditor to lead all audit activities accompanied by certified audit team members (as needed). As described in Paragraph 2.2 in this document, the auditor is to have experience in the use or generation of defense related maritime data.

4.1.4.5 The Lead Auditor shall have a minimum of three years of experience as a certified lead auditor and be identified by name in the proposal.

4.1.4.6 Each audit team member assigned to this contract shall have a minimum of one year of experience as a certified auditor. Because of the complexity of products and services provided by the

Maritime Safety Office, it is in the best interest of Government to have the contractor provide continuity and consistency of audit personnel in order to maintain process familiarity.

4.1.4.7 Any proposed change of key personnel and the reasons for the change must be coordinated with the Contracting Officer prior to execution of all audits. Changes to the audit team must be coordinated with the COR at least 21 calendar days prior to all audits.

4.1.5 Dates and type (surveillance, recertification, etc.) of the last assessments for each of the sites:

4.1.5.1 St. Louis, MO surveillance audit 12 June 2019.

4.1.5.2 St. Louis, MO and Springfield, VA virtual (via Webex) surveillance audit 16 July 2020 – 19 July 2020.

8 | P a g e

UNCLASSIFIED

4.1.5.3 The Maritime Safety Office has copies of the previous three (3) years of audit reports and their respective corrective action records.

4.1.6 Operating Shifts at each location:

4.1.6.1 Two (2) shifts (1st and 2nd shifts) operate at St. Louis, MO

4.1.6.2 Two (2) shifts (1st and 2nd shifts) operate at Springfield, VA

5.0 MARITIME SAFETY OFFICE PERFORMANCE SUMMARY

Tasks Performance Standard Deliverables

Ref. Section

4.2.1 Base

Year Period

Initial Assessment or Transfer of Certification, meeting timeframes and providing associated services. (May require two (2) onsite visits by the auditor)

For each audit activity:

a) Schedule assessment date

b) Audit schedule

c) Audit plan

d) Audit

e) Audit report

f) Certification/Re-registration Assessment:

ANSI-ASQ National Accreditation Board (ANAB) or an equivalent U.S. based Accreditation Body that is a signatory to the IAF MLA for QMS (ISO 9001) Management Systems accreditation mark and certificate.

Ref. Section

4.2.2 Option

Year 1

Annual Surveillance Audit meeting timeframes and providing associated services.

For each audit activity:

a) Schedule assessment date

b) Audit schedule

c) Audit plan

d) Audit

e) Audit report

f) Certification of Registration:

ANSI-ASQ National Accreditation Board (ANAB) or an equivalent U.S. based Accreditation Body that is a signatory to the IAF MLA for QMS (ISO 9001) Management Systems accreditation mark and certificate.

9 | P a g e

UNCLASSIFIED

Ref. Section

4.2.3 Option

Year 2

Annual Surveillance Audit meeting timeframes and providing associated services.

For each audit activity:

a) Schedule assessment date

b) Audit schedule

c) Audit plan

d) Audit

e) Audit report

f) Certification of Registration:

ANSI-ASQ National Accreditation Board (ANAB) or an equivalent U.S. based Accreditation Body that is a signatory to the IAF MLA for QMS (ISO 9001) Management Systems accreditation mark and certificate.

Ref. Section

4.2.4 Option

Year 3

Full Re-registration Audit, meeting timeframes and providing associated services. (May require two (2) onsite visits by the auditor)

For each audit activity:

a) Schedule assessment date

b) Audit schedule

c) Audit plan

d) Audit

e) Audit report

f) Certification/Re-registration Assessment:

ANSI-ASQ National Accreditation Board (ANAB) or an equivalent U.S. based Accreditation Body that is a signatory to the IAF MLA for QMS (ISO 9001) Management Systems accreditation mark and certificate.

Ref. Section

4.2.5 Option

Year 4

Annual Surveillance Audit meeting timeframes and providing associated services.

For each audit activity:

a) Schedule assessment date

b) Audit schedule

c) Audit plan

d) Audit

e) Audit report

f) Certification of Registration:

ANSI-ASQ National Accreditation Board (ANAB) or an equivalent U.S. based Accreditation Body that is a signatory to the IAF MLA for QMS (ISO 9001) Management Systems accreditation mark and certificate.

10 | P a g e

UNCLASSIFIED

Ref. Section

4.3 Assign

Key Personnel

If Auditors are replaced, experience level must be maintained. Auditors shall not be replaced more than twice during the period of performance.

For each audit activity listed in 4.2.1, 4.2.2, 4.2.3, provide Lead Auditor and Audit Team.

6.0 REPORTING

The Contractor shall submit an audit plan to the COR prior to audit activities.

As specified in ISO 19001:2011, within 30 days after successful completion of an audit, a report of the audit findings shall be sent to the COR.

After successful completion of the audit activities for any given year, an ANSI –ASQ; ANSI-ASQ ANAB or an equivalent U.S.-based Accreditation Body that is a signatory to the IAF MLA for QMS (ISO 9001) Management Systems accreditation mark and certificate shall be issued to

NGA.

7.0 SECURITY

All work efforts associated with this contract are UNCLASSIFIED//FOUO at the highest level.

The Contractor shall appropriately portion-mark all material.

Only United States personnel (foreign nationals are prohibited from working on this contract) are authorized to perform work on this contract.

Maritime Safety Office will provide an Agency owned laptop for use by the Contractor while on NGA premises. (Note: This laptop will not have Wi-Fi or other network connectivity activated.)

Maritime Safety Office personnel will arrange to transfer any media files onto or off of the laptop and will transmit requested/authorized information via unclassified e-mail to the Contractor. This transfer can be performed in the presence of the Contractor, if requested.

Auditors may receive information or materials of a sensitive nature. Contractor employees shall sign NGA Form 5210-18, Nondisclosure Agreement upon audit scheduling. All information presented to Contractor employees shall be protected and safeguarded through this nondisclosure agreement.

All Contractor visits to Government facilities for onsite audits must be coordinated in advance with the COR, unscheduled site visits are prohibited. Work hours will be subject to the availability of escorts and will be scheduled to allow sanitation of classified material from the appropriate areas prior to the auditor’s arrival.

11 | P a g e

UNCLASSIFIED

The Contractor shall inform the Government when their employees no longer support the contract on the same day. If the contract personnel will no longer be supporting NGA, via an NGA contract, all government-issued items shall be returned to NGA.

The Contractor will have access to UNCLASSIFIED//FOUO while on this contract. In the performance of this Contractor will have access to and be exposed to DoD Controlled Unclassified Information (CUI). The Contractor shall not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the Contracting Officer has given prior written approval or in performance of a project that has been scoped and negotiated by NGA with the Contractor. Release and disclosure guidance provided to subcontractors shall be “all release and disclosure request shall be submitted through the prime contractor to NGA”.

Government-furnished information (GFI) includes all UNCLASSIFIED//FOUO and Critical Unclassified Information (CUI) materials and information the Contractor received from NGA or itself created during the performance of this contract. Upon termination of the contract or when GFI is no longer required in the performance of the contract, the Contractor shall either destroy the GFI or return it to NGA.

Contractors with a favorable HSPD-12 Tier 1 adjudication are eligible to receive a T-9 visitor badge that does not require an escort in unclassified areas of the facility, however they must be escorted in classified areas of the facility. Contractor personnel who are not favorably HSPD-12 Tier 1 adjudicated will receive a red visitor badge (escort required) for visits to NGA facilities and will be escorted at all times while in NGA facilities. The visitor badge must be returned at the end of each visit day.

NGA will sponsor the HSPD-12 Tier 1 background investigation for required program personnel.

Contractor employees shall comply with all applicable rules and regulations while on NGA premises and handling NGA information/material, which includes but not limited to, providing proper identification for entrance and vehicle passes; obeying posted signs; displaying the issued badge; and observing smoking restrictions. Contractor personnel are prohibited from bringing any computer-related equipment or accessories of any kind onto federal facilities, including but not limited to cameras, two-way pagers, laptops, CDs, DVDs, flash drives, or any other kind of removable media, without prior approval and approval paperwork from NGA. A full list of prohibited items will be provided to the Contractor upon award.

7.1. INSTRUCTIONS FOR MARITIME SAFETY OFFICE PERSONNEL

The following instructions are for NGA Maritime Safety Office personnel that will be assisting with this effort. NGA will not hold the Contractor accountable for these items;

they are presented here for situational awareness:

12 | P a g e

UNCLASSIFIED

While Contractor employees will be provided viewing access to controlled workstations for document and Quality Management System component viewing, it is the responsibility of Maritime Safety Office personnel to ensure that only the appropriate documents are displayed (no document that is classified higher than UNCLASSIFIED//FOUO). Documents may be printed for auditor reference, but review of any document will include assurance that no classified portion is made available to anyone without the proper clearance and need to know. The capability of saving documents will not be permitted.

Appropriate area security sanitization is the responsibility of the NGA offices, to include walk paths and areas where the Contractor will be working.

Maritime Safety Office personnel will arrange to transfer any media files onto or off of the laptop and will transmit requested/authorized information via unclassified e-mail to the Contractor after ensuring that the material is authorized to be transferred and is the appropriate classification to be received by the Contractor. This transfer can be performed in the presence of the Contractor, if requested.

8.0 TRAVEL

All travel required to perform audits shall be coordinated with the COR prior to scheduling.

Travel expenses should be detailed in the proposal to address audits at the various locations cited above. Audits of the two locations should be coordinated as much as possible to enable travel economies (e.g., conduct audits of the organizations consecutively to reduce travel). All travel will be priced on a cost reimbursable Not-to-Exceed (NTE) basis (no profit/fee). NGA may require any and all audits to be conducted virtually via Webex if travel is not permitted at NGA facilities.

8.1. Travel in the Base Year and Option Year 3

The agency will authorize up to two round trips per location (Springfield, VA and St. Louis, MO) for two auditors for the Base Year and for Option Year 3. Each trip will be for a length of four (4) days in Springfield, VA and three (3) days in St. Louis, MO per traveler. The travel must occur during the Base Year or Option Year 3 period of performance, as applicable.

8.2. Travel in Option Years 1, 2, and 4

The agency will authorize up to one round trip per location (Springfield, VA and St. Louis, MO) for one auditor for Option Year 1, Option Year 4, and Option Year 5. Each trip will be for a length of four (4) days in Springfield, VA and three (3) days in St. Louis, MO. The travel must occur during the Option Year 1 period of performance.

UNCLASSIFIED APPENDIX A

13 | P a g e

UNCLASSIFIED

APPENDIX A: REFERENCES

• Current ISO 9001:2015 Certificate of Conformance

• ISO 9001:2015 – Quality Management System (Requirements)

• ISO 19011:2011 – Guidelines for Quality and/or Environmental Management Systems

Auditing

• ISO 17021-1:2015 – Conformity Assessment (Requirements for bodies providing audit and certification of management systems)

• NGA Form 5210-18 NONDISCLOSURE AGREEMENT

• NGA Form 5212-39 AIS Equipment/Media Entry/Exit Pass

• FAR 52.204-2 Security Requirements