TO 9 - CY5 Info Sys Mgmt SOW Mod0 Rev1.pdf

ETIS III

Contract # 80GSFC19C0060

ETIS III Contract Year 5 Statement of Work

Task: Information Systems Management

Task Order: 9-5

Task Modification: 0

I. Summary of Changes in this Task Modification

MOD/0 Change Record:

1) Initial release.

II. Summary of Work

Informational Systems Management is to provide Information Technology (IT) services for Code 549 facilities and the operators using them. These tasks include maintaining the system and infrastructure security, documentation of the infrastructure and the support of projects as requested. The areas that will be supported under this SOW effort include but not limited to: Center Network Environment (CNE) Support, Special Management Attention (SMA) Flight Project Support and Space Testing Center (STC) Support.

III. Period of Performance

The period during which the work for this task shall be performed is between October 1, 2023 and September 30, 2024.

IV. Task Requirements

The contractor shall support Code 549 and ETIS III CNE users by maintaining their systems in operational condition, through help desk, desk side, or remote (this will cover teleworking) support. The contractor shall install, support, and maintain SW and HW as required to enable users to perform their jobs. The contractor shall work with the various GSFC and NASA IT organizations to resolve operational issues that prevent the users from accessing their data.

The contractor shall support the Special Management Attention (SMA) Flight Project by maintaining the Space Testing Center (STC) the system security plan and Authority To Operate (ATO) and providing the infrastructure necessary to support each flight project such as firewall rules, switches, security cameras, etc. A specific Memo Of Understanding (MOU) will be created to each SMA detailing the level of support that is required, the length of time required, and the service level agreements needed. This information will be added to the STC security documentation as part of maintaining the STC ATO.

The contractor shall support the STC by maintaining the STC ATO. The effort will include:

Maintaining the System Security Plan, and all associated documentation as required by NIST SP-800-53 Rev 5;

Providing and supporting infrastructure as requested by the STC function manager, supervisor, or government environmental engineer such as firewall rules, switches, cabling, etc.;

Maintain the various systems such as the data system servers, data support systems, test facility systems, backup systems, archival systems, STC specific network infrastructure, etc.

The contractor shall support Code 549 in supporting the NASA Mandate to move the STC Operational Technology (OT) systems into the IT System Boundary. This effort will include:

Integrating OT into the STC Configuration Management (CM) Process;

Moving the IT systems boundary to include Industrial Controls Systems such as PLCs, Voltmeters, etc.;

Help the test disciplines migrate to Ethernet based devices for speed and reliability;

Update the SSP using NIST overlays to include specific ICS control guidelines;

Ensure that security postures and systems are updated to include OT.

The contractor shall also support the STC in maintaining its Authority To Operate by performing the required Continuous Monitoring (CM) processes mandated by the approved Continuous Monitoring Plan (CMP) which is part of the overall STC approved System Security Plan. The CM processes include maintenance, license management for software (SW) used by Code 549 staff and testers, updates to Hardware (HW) / SW, and related devices, reporting and security controls testing.

Updates may include technology refresh to STC IT equipment / SW that is reaching end of life, and new technology that may improve the functionality / security of the

STC.

The contractor shall have the necessary skills to create and maintain GSFC specific test and operation applications written with various tools and languages including, but not limited to: Microsoft Visio/Project, Matlab, Python, LABVIEW, Agilent VEE, Pro-E, GE iFIX SCADA, Power Builder, MS SQL, Oracle SQL, C, Visual Basic, Modicon PLC, Intellution, iRMX, and Reliance Automax. Other languages and tools may be used as appropriate. The ETIS III team will develop and maintain applications to improve the efficiency of the STC. Applications may include, but not be limited to; Clean Room, Financial Reporting, TVDS Oracle, Tool Crib, etc.

The contractor shall develop, configure, and maintain a SharePoint Site for 549 and ETIS III use. SharePoint Online support shall include providing additional training to the ETIS software engineer that will eventually be fully responsible for maintaining the site. SharePoint Online sites will be iterative in nature, maturing new capabilities as 549 more fully uses the capabilities offered. Workflows such as Storm Code Waiver, Safety Evaluation Form, PEB Milestones, and others to improve the overall effectiveness to communications and efficiency of the 549 CS and contractors will be developed and maintained.

The entire 549 I&T complex is undergoing a continuous modernization process to both Hardware and Software to improve security, automation, responsiveness, accuracy, capability, resiliency, and flexibility. Multiple departments have identified needs and have opportunities to improve their work processes. The ETIS-III Team will continue to support 549 efforts across all disciplines with at least one SW engineer with LabVIEW certifications. The ETIS-III Team will continue to work with all disciplines to help define their requirements for incorporating new capabilities and SW as needed. The ETIS-III Team will continue to help all disciplines design an infrastructure and architecture that best incorporates the disciplines requirements and then will lead the programming effort to create the applications and programs needed to ensure the successful implementation of the modernization effort.

V. Deliverable Items and Schedules

The contractor shall provide regular task schedules to the Task Order Monitor and to the appropriate 549 group leads/monitors for the specific tasks being performed.

The schedules should be provided monthly as a minimum or more frequently as requested to manage task work versus facility usage.

VI. Management Approach

The contractor shall provide a management staff and structure to efficiently implement the requirements of this SOW. Management requirements are defined in 80GSFC19C0060, Section J, Attachment A. Statement of Work, Section 1.4.

a. Staff Allocation, Expertise, and Skill Mix

The contractor shall staff this work item with the appropriate skill mix and staffing level for the work. At the very least, the contractor support will include an Information Systems Security Officer (ISSO)/IT Manager, Network Administrator, System Administrator, Security Analyst/Security Engineer, Software Engineer, and Jr System Administrator. Some of the necessary skills includes, but are not limited to:

Documentation: STC Security Plan, all associated Systems Security Artifacts, etc.

Application Management: Splunk, Symantec, Nessus, Foundstone, MS Office and associated apps, Honeywell EBI, etc.

Hardware Management: Switches, Servers, Routers, Firewalls, Desktop Systems, etc.

Software Management: Develop SW requirements for new programs to support operations and management. Maintain and upgrade applications currently in use. Build and maintain a library of all SW programs developed to support ETIS and 549.

Operating Systems: Windows 10+, Windows Server, Apple OS

Systems integration, imaging, disposal, configuration, backup, etc.

b. Configuration Management

The contractor shall manage schedule, cost, and technical risk through monitoring and reporting of progress and performance metrics, identifying issues well in advance of negative consequences, recommending corrective action to the TM, and implementing corrective actions with the compliance of the TM.

The contractor shall, with support of the Government TM and the Code 540 Security Manager, convene a Configuration Control Board (CCB) prior to making any changes to the STC environment. The contractor shall present the proposed changes and impacts. Once approval has been given, then the contractor shall document the results and implement the changes. The SSP, or related documentation shall be updated as well.

c. Facilities

The contractor will be provided with facilities (Bldg. 7, Room 022) to securely house the servers necessary to support operation in the ETD complex (B7/10/15/29 and Area 300).

d. Risk Management and Best Practices

The contractor shall manage schedule, cost, and technical risk through monitoring and reporting of progress and performance metrics, identifying issues well in advance of negative consequences, recommending corrective action to the TM, and implementing corrective actions with the compliance of the TM.

e. Performance Metrics

The work performed for this task will be evaluated by the Technical Monitor based on the technical merit. The TM shall develop detailed performance metrics that shall reflect the contractor’s performance in meeting research analysis, specific mission requirements, deliverables and delivery schedule, and the contractor’s cost. Technical evaluation of the task performance is a subjective combination of performance metrics, technical quality of deliverables, cost control, significant events, innovations, and meeting requirements set forth in the SOW.

f. Government Furnished Facilities, Equipment, Software and Other Resources

The Government will provide accounts and passwords to government-furnished workstations where existing versions of various relevant software packages shall be maintained. It shall be the contractor’s responsibility to complete any GSFC required security-related training courses.

VII. Work Location

This work shall be performed primarily on-site at the Goddard Space Flight Center, but the contractor may be required to perform some work off-site on a case-by-case basis.

VIII. ODCs

Software: Maintain the annual renewals of existing software.

Hardware: Laptops to replace malfunctioning ones and to transition personnel that can telework to machines that can support their duties. Network gear, servers, printers, and cameras to support I&T operations.

IX. Reporting Requirements

See Section V.

X. Security Requirements

The contractor Network Admin should be required to obtain and maintain at least a SECRET level clearance to support classified projects. The contractor ISSO should have a SECRET level clearance.

XI. References

a. 80GSFC19C0060, Section J, Attachment A. Statement of Work, Section 1.3.7

b. CD-9999-M-GSF-3304, Security and System Administration Roles, Responsibilities and Assignments for the Spacecraft Testing Complex (STC) System; Rev. (2019.1); August 1st, 2019