(U) Mercury_IDIQ_PWS_Draft_Final.pdf

UNCLASSIFIED

(U) National Geospatial Intelligence Agency (NGA)

Performance Work Statement (PWS)

For the

Mercury Contract

18 February 2026

Contract No. TBD

Table of Contents

1 (U) Introduction

1.1 (U) Background

2 (U) Scope

2.1 (U) Description of Services

2.2 (U) System Support Levels

3 (U) Technical Service Requirements

3.1 (U) Systems Engineering and Integration

3.2 (U) Software Development

3.3 (U) Software Maintenance

3.3.1 (U) Corrective Maintenance

3.3.2 (U) Adaptive Maintenance

3.3.3 (U) Preventive Maintenance

3.3.4 (U) Perfective Maintenance

3.4 (U) Operations Support

3.4.1 (U) System Administration

3.4.2 (U) Database Administration

3.4.3 (U) Content Administration

3.4.4 (U) Help Desk Support

3.5 (U) Technical Support Services

3.6 (U) Security Engineering

3.7 (U) Ad-hoc Engineering

4 (U) Applicable Documents

5 (U) Program Management

5.1 (U) Contractor Personnel Administration

5.2 (U) Key Personnel

6 (U) Government Furnished/Contractor Acquired Property Management

6.1 (U) Software Licenses/Cloud

7 (U) Place of Performance

8 (U) Travel

9 (U) Export Controls

10 (U) Security Management

10.1 (U) Classified Work Performance Security Requirements

10.1.1 (U) Unclassified Work Performance Security Requirements

10.1.2 (U) Information Handling

11 (U) Deliverables

11.1 (U) Quality Control Plan

11.2 (U) System Security Plan

11.3 (U) Staffing Plan

11.4 (U) Transition Plans

11.4.1 (U) Transition-In Plan

11.4.2 (U) Transition-Out Plan

11.4.3 (U) System Transition Plan

11.5 (U) Software Documentation

11.6 (U) Architecture Documentation

11.7 (U) Reporting and Reviews

11.8 (U) Contract Change Proposals

11.9 (U) Contract Data Requirements List

(U) Appendices

(U) APPENDIX A - Compliance Documents

(U) APPENDIX B - Reference Documents

(U) APPENDIX C - Acronyms

F

(U) REVISIONS

(U) This ‘Revisions’ table is unclassified in its entirety. The margin of this document is marked with a bar to indicate where changes from the previous issue were made.

REV DATE

SECTIONS

AFFECTED

REMARKS

1.0 02/18/2026 All Initial Draft

THIS TABLE IS UNCLASSIFIED IN ITS ENTIRETY

1 (U) Introduction

(U) The National Geospatial-Intelligence Agency (NGA) maintains a set of mission critical and mission essential software systems, applications, and databases constituting the analytic services and capabilities for the National System for Geospatial-Intelligence (NSG), hereafter referred to as analytic systems. This Performance Work Statement (PWS) describes the technical services required to provide support to existing and emerging analytic systems that support the successful execution of the Analysis mission at the NGA. Additional PWSs will be developed for subordinate

Task Orders to specify the systems supported and which services are required from this Indefinite

Delivery Indefinite Quantity (IDIQ) PWS.

1.1 (U) Background

(U) The mission of NGA is to provide timely, relevant, and accurate Geospatial Intelligence

(GEOINT) to policy makers, the Intelligence Community (IC), Department of War (DoW), and other federal agencies and partners in support of national security. The Program Executive Office

Advanced Analytics (PEOAA) brings together Maven and Analytic Technologies to deliver cutting-edge geospatial analytic capabilities that enhance decision advantage for the warfighter and intelligence community, ensuring rapid, integrated support for global operations. The Mercury contract is managed by the PEOAA – Analytic Technologies (PAT) office which supports the successful execution of the Analysis mission sets under its portfolio of programs and projects

(U) There is a wide variety of existing and emerging capabilities that support the execution of the

Analysis mission sets, and some of these capabilities do not always fall under a specific mission set of programs and projects in the PAT portfolio. The ongoing sustainment and modernization of capabilities throughout the lifecycle of the system is essential in ensuring GEOINT mission needs are satisfied. Mercury supports a rapid response to future requirements, critical system transitions, and emerging development efforts essential to empower warfighters and analysts.

2 (U) Scope

(U) The Mercury Contract provides the services needed for end-to-end operations and life cycle management of existing and emerging analytic systems that support the execution of the Analysis mission at the NGA, and in support of the Analytic Services Production Environment for the NSG

(ASPEN) major system acquisition. The scope of this PWS is broad and diverse in order to provide the full range of potential services that might be needed for a particular system. The applicable system-specific service categories will be identified in separate Task Orders and implemented per the direction of the Contracting Officer (CO) and/or Contracting Officer’s Representative (COR), with amplifying technical guidance given by the system’s Product Manager and/or Program

Manager, or their delegee.

2.1 (U) Description of Services

(U) This contract provides for the following service categories:

1. Systems Engineering and Integration: Lifecycle management to ensure the efficient and effective operations of the supported analytic systems.

2. Software Development: Services to add new capabilities to existing analytic systems or create new systems with capabilities supporting the analysis mission.

3. Software Maintenance: Perform Corrective, Adaptive, Preventive, and Perfective maintenance of supported analytic systems.

4. Operations Support: Provide system administration, database administration, content administration and Help Desk Support.

5. Technical Support Services: Perform cross-functional and enterprise functions that enable the performance of the other service categories to include but not limited to subject matter expertise, configuration management, training, content management, user engagement, and program scheduling.

6. Security Engineering: Provide cybersecurity engineering and oversight to maintain optimum cyber-operations and compliance with all NGA Assessment and Authorization processes.

7. Ad-hoc Engineering: Provide one or more services above for a time-bounded duration.

The services provided may be unrelated to a specific program or system on the Task Order.

2.2 (U) System Support Levels

(U) Specific system level support requirements are identified in the applicable Task Order. Site closures for weather or pandemic restrictions are exempt unless personnel are considered mission-essential. Exceptions shall be approved by the CO or COR.

3 (U) Technical Service Requirements

(U) Contract deliverables and performance requirements associated with the services are defined and managed by Program Managers with mission input from the Product Owners. They are further stipulated within the Task Order PWS. Systems to be supported under this contract may exist in a wide variety of test/operational environments and security domains.

3.1 (U) Systems Engineering and Integration

(U) The Contractor shall provide system engineering services to ensure the complete lifecycle management of supported systems while maximizing the effectiveness and efficiency in meeting the functional and performance requirements of the mission. These services include the following:

• Leverage Agile methodologies and digital engineering techniques in the conduct of software development, maintenance, and system engineering work, to the maximum extent possible

• Ensure supported analytic systems are fully and properly integrated with NGA Enterprise

ISP

• Conduct requirements analysis, and management; Ensure adherence to Enterprise

Requirements, Processes, and Best Practices

• Provide system architecture views, models, CONOPS, and data flows (CDRL-A014)

• Adhere to requirements for API registration and source code repositories (CDRL-A008)

• Review Requests for Change (RFCs) affecting current systems and services for cost, schedule, and performance impacts. The Contractor shall use the Jira Labels field to identify all work originating from RFCs with the associated RFC number

• Ensure access to NGA and Mission Partner configuration management, tracking, and management systems

• Transition systems and capabilities onto or off the Mercury contract (CDRL-A006)

• Retire or Decommission analytic capabilities (CDRL-A006)

• Provide Agile Release Train (ART) and Backlog management for supported analytic systems

• Prepare and maintain system roadmaps (Milestone, Vision, Solution) (CDRL-A013)

• Coordinate with NGA resources external to PAT (e.g. Sensor, ISP, Compliance Offices) to ensure systems are fully integrated and compliant with NGA standards

• Prepare artifacts and support Readiness Reviews, program reviews, and other NGA forums

• Provide supported analytic system demonstrations and support enterprise/integration test events

• Collect and provide performance metrics

• Integrate system architectures into the enterprise and support enterprise services

• Perform user engagement to gather feedback about system performance, capabilities, future plans, and user needs

• Provide system design, innovative alternatives, and technology insertion that meet or exceed the system’s performance parameters and resilience.

• Perform Analysis of Alternatives or analyze system architectures and operations to develop recommendations to improve performance

(U) The Contractor shall incorporate services and requirements from other sections of this PWS, as applicable, to support the requirements listed in this section.

(U) The Contractor shall perform in this service category against performance standards prescribed in each Task Order.

3.2 (U) Software Development

(U) The Contractor shall provide software development services to ensure the definition, design, implementation, and testing of the software to meet the functional and performance of new or augmented mission requirements while maximizing the effectiveness and efficiency. These new capabilities might include new sensor data integration or a new capability transitioned at "Initial

Operational Capability (IOC)" that requires some development to reach "Full Operational

Capability (FOC)” capability maturity. These services include the following:

• Sprint/Release planning

• Software coding

• Software integration

• Software unit testing and reporting (CDRL-A009, CDRL-A010)

• Software deployment to operations (CDRL-A008)

• Software enterprise/user testing

(U) Software development services shall, to the maximum extent possible, follow the established

NGA Agile software development processes and procedures. This includes an Agile requirements management system using the current Scaled Agile Framework for all work performed, and the integration of Contractor development requirements (story and features) with the higher-level government requirements system (Program Epics and Solution Epics in USMS Jira on COE). The

Contractor shall maintain an USMS Jira project on COE as the authoritative source of truth for all system work, ensuring that Features reflect current information and status.

(U) Software testing data (plans, procedures, and reports) shall, to the maximum extent possible, utilize modern digital engineering tools. The Test Plan shall include test objectives with traceability to user acceptance criteria at the feature level. (CDRL-A009, CDRL-A010)

(U) The Contractor shall incorporate services and requirements from other sections of this PWS, as applicable, to support the requirements listed in this section.

(U) The Contractor shall perform in this service category against performance standards prescribed in each Task Order.

3.3 (U) Software Maintenance

(U) The Contractor shall provide software maintenance services to maintain existing capabilities in optimal working order. (CDRL-A008)

(U) Software maintenance services shall, to the maximum extent possible, follow the established

NGA Agile software maintenance processes and procedures. Software documentation and testing data (plans, procedures, and results) shall utilize modern digital engineering tools as opposed to formal documents whenever possible. (CDRL-A009, CDRL-A010)

3.3.1 (U) Corrective Maintenance

(U) The Contractor shall provide software corrective maintenance services to correct deficiencies in the baseline. This includes:

• Fixing application bugs, including system restarts

• Reactive modification of software after deployment to correct discovered faults

• Investigation and correction of software faults or incidents

• Security patches and hot fixes

• Working with the ISP and other system administrators to resolve DRs causes by external factors that arise

3.3.2 (U) Adaptive Maintenance

(U) The Contractor shall provide software adaptive maintenance services to modify existing solutions to a change in the provisioned environment. This includes:

• Changes to infrastructure or middleware on which the capability is provisioned

• Changes in software dependencies or supporting software

• Refactoring and recompiling source code from deprecated languages

• Expanding existing features and capabilities to adapt to changing requirements

• Integrating AI/ML features, such as incorporating new algorithms or scaling models, to meet evolving and emergent requirements

• Managing updates to COTS dependencies or vendor-supported middleware to resolve compatibility issues with evolving environments

3.3.3 (U) Preventive Maintenance

(U) The Contractor shall provide software preventive maintenance services to proactively prevent future capability deficiencies and maintain optimum performance. This includes:

• Preparing for Operating System deprecations

• Removing obsolete functions from the capability baseline

• Removing unsupported dependencies that no longer have current vendor/developer maintenance

3.3.4 (U) Perfective Maintenance

(U) The Contractor shall provide perfective maintenance services to improve the installed baseline for optimal operations and performance, and to comply with relevant policies and directives. This includes:

• Optimizing software to improve user productivity

• Updating software to improve performance or prevent outages (improve error handling in the source code, memory management, etc.)

• Modifying systems to migrate into new or changed environments

(U) The Contractor shall incorporate services and requirements from other sections of this PWS, as applicable, to support the requirements listed in this section.

(U) The Contractor shall perform in this service category against performance standards prescribed in each Task Order.

3.4 (U) Operations Support

3.4.1 (U) System Administration

(U) The Contractor shall provide system administration services to maintain system availability and restore the systems and applications to operations should a system or application experience outages or mission interruption. These services may refer to either server-based architectures within an NGA Data Center, virtual resources within an NGA Cloud environment, client-based architectures residing in workstations, or hybrid architectures and include the following:

• Ensure functional availability, integrity, and performance

• Provide system and application baseline and patch management

• Install, configure, check out, and test application software changes

• Perform system, applications software, and database backup and restore

• Monitor and report mission application status

• Ensure the integrity of software and databases and continuity of operations

• System restoral and operational support per defined recovery timelines and operational requirements

3.4.2 (U) Database Administration

(U) The Contractor shall provide database administration services to manage and restore the database applications and catalog contents to operations should a system or application experience outages or mission interruption. These services include the following functions:

• Provide database application baseline and patch management

• Perform database schema changes

• Perform database backup and restore

• Monitor and report database application status

• Ensure the integrity of software and databases and continuity of operations

3.4.3 (U) Content Administration

(U) The Contractor shall provide content administration and data management services necessary to manage, transform, disseminate, and restore the system’s data. These services include:

• Establish and enforce data retention policies, data governance, data tagging, and data rule sets

• Establish and enforce data archival policies per Records Management requirements

• Assist users with data templates, data production, formatting, and data storage

• Provide and maintain data models

3.4.4 (U) Help Desk Support

(U) In most cases, Tier 1 support is provided by the NGA Enterprise Service Center (ESC). In order to facilitate the ESC’s Tier 1 support, the Contractor shall perform the following services:

• Create and maintain ESC data such as knowledge articles, POC lists, after-hours contacts, and system info

• Ensure supported systems provide users with information on who and when to contact for help

• Create and maintain groups and system-related data in the NGA Enterprise IT Service

Management solution (currently Service+)

(U) In instances where Tier 1 Support is provided directly by the Mercury Contractor, for example a new system not yet supported by the ESC or a prototype system, the Contractor shall provide services similar to the ESC, including Help Desk and incident tracking.

(U) The Contractor shall provide Tier 2 and Tier 3 support for Mercury systems to monitor and administer the operational baseline. This includes:

• Submitting and tracking incidents (INCs), Problem Incidents (PBI), and Discrepancy

Reports (DR) in accordance with NGA’s incident response process and response time

SLAs

• Performing root cause analysis investigations for repeating patterns of Priority 1 and 2

Incidents or emergency/urgent PBI/DRs

• Providing discrepancy investigation and evaluation for outages and degradations of any

Mercury managed services

• Providing initial issue response and support to Tier 1 ESC (Enterprise Service Center) and

Enterprise Management Office to resolve user generated questions, problems and operational incidents

• Coordinating with Mercury service consumers and NGA operational management forums external to the program to support operation status reporting and outage request management, for example coordinating outages through NGA operational outage boards

• Performing corrective maintenance actions to resolve operational incidents

• Developing response procedure materials for the Enterprise Service Center (CDRL-A012)

(U) The Contractor shall incorporate services and requirements from other sections of this PWS, as applicable, to support the requirements listed in this section.

(U) The Contractor shall perform in this service category against performance standards prescribed in each Task Order.

3.5 (U) Technical Support Services

(U) The Contractor shall provide various technical services required for the success of the other services in this PWS. This category incorporates the ancillary support functions necessary in every software development and engineering contract. These services include:

• Configuration Management in accordance with the NGA Configuration Management Plan, NGA guidance, and industry best practices (CDRL-A007)

• Technical Writing to produce and deliver documentation and online content

• Training Development either as separate online media, instructor-based materials, or embedded within a supported analytic system

• Development of Training Materials, including User Documentation and User

Guides/Materials (CDRL-A011)

• Provide user engagement services to identify current impediments and potential enablers to user adoption of supported analytic systems

• Provide domain expertise to assist supported system users

• Subject Matter Expertise services to assist or improve the integration of new and existing technology and tools

• System Website/Content Maintenance to keep informational webpages current (i.e.

Intellipedia, NGA Globe)

• Program Scheduling to plan and document contract service delivery. Contract schedules shall be integrated with NGA schedules and identify dependencies on NGA milestones

(U) The Contractor shall incorporate services and requirements from other sections of this PWS, as applicable, to support the requirements listed in this section.

(U) The Contractor shall perform in this service category against performance standards prescribed in each Task Order.

3.6 (U) Security Engineering

(U) The Contractor shall provide cybersecurity engineering and operations services in compliance with NGA Standards, processes, and guidance and as described in the System Security Plan

(CDRL-A002). These services include:

• Ensure compliance with ICD 503, NGA DAO, and CIO-T system assessment and authorization lifecycles and requirements

• Provide and integrate cross-domain data flows via either assigned DTO or CDSE tools

• Ensure proper IDAM and enterprise audit maintenance

• Ensure all COTS/OSS/Custom SW is approved for usage

• Implement continuous monitoring services

(U) The Contractor shall incorporate services and requirements from other sections of this PWS, as applicable, to support the requirements listed in this section.

(U) The Contractor shall perform in this service category against performance standards prescribed in each Task Order.

3.7 (U) Ad-hoc Engineering

(U) The Contractor shall provide the ability to perform the system and software engineering functions described in Sections 3.1 – 3.6 on an ad-hoc basis. The specific tasks to be performed will be determined per the direction of the Contracting Officer (CO) and/or Contracting Officer’s

Representative (COR) with amplifying technical guidance provided by an NGA Government

Point-of-Contact (GPOC).

(U) Ad-hoc Engineering is defined as a temporary effort to provide a solution for a specific purpose, problem, or task rather than a generalized approach applicable to systems and software.

Typically, each ad-hoc task will require a task description, a labor hour estimate, and funding prior to initiation. The Contractor shall not proceed with ad-hoc engineering efforts nor incur any costs without written authorization from the CO or COR.

4 (U) Applicable Documents

(U) The Contractor shall be responsible for complying with all NGA and DoD policies and other referenced material contained in this Mercury IDIQ PWS that are applicable to the Contractor in the performance of work under the contract. Many of the documents are revised periodically. Dates associated with the documents reflect the current versions as of the writing of this Mercury IDIQ

PWS. The Contactor shall monitor changes to these documents and work with the latest applicable versions.

(U) Provided in Appendix A and Appendix B are high level compliance and reference documents that will apply to all work under Mercury. These lists may be augmented by additional compliance and reference documents specific to a particular task order and will be included in the task order description.

5 (U) Program Management

(U) The Contractor shall provide Program Management services responsible for the overall contract performance. These responsibilities include:

• Resource Management/Staffing

• Subcontract/Small Business Management

• Government Furnished Property/Asset Procurement and Management

• Process Management- Continuous Improvement

• Quality Assurance and Management (CDRL-A001)

• Financial Reporting, Tracking, and Planning (CDRL-A015)

• Travel Planning and Execution (CDRL-A020)

• Risk and Opportunity Management

• Issues, Corrective Actions, Action Items

• Security Management (Physical/Facility, Personnel, Information)

• Cost/Effort Estimating (CDRL-A023)

• Contract Deliverables, Reporting, and Reviews (CDRL-A016, CDRL-A017)

• Business-related Quantitative and Qualitative Metric Collection (cost/schedule)

• Ensure services meet or exceed required performance goals and objectives

Table 5. (U) Agile Program Management Requirements, Evidence, & Deliverables

Performance Requirement Performance Standards Deliverables

Maintain reporting and information flow to stakeholders

• Agile development metrics

• PMRs/BMRs

• Funds status reporting

• Technical exchange meetings

• System demos

CDRL-A015

CDRL-A016

CDRL-A017

Track progress toward fulfillment of requirements

• Maintain vision that describes the future state of the Task

Order solutions

• Maintain roadmap of solution, PI and current PI planned events and milestones over the Task Order planning horizon to achieve the vision

• Use of PI, fixed-date and learning milestones based on evaluation of working system

CDRL-A013

CDRL-A014

5.1 (U) Contractor Personnel Administration

(U) The Contractor shall provide qualified, capable personnel as described in the Staffing Plan

(CDRL-A003) and maintain a stable workforce while minimizing turnover and maintaining expertise levels. The Contractor shall ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that there is no negative impact to the Government mission schedule. Once the Contractor knows an employee is leaving and will no longer support the program, the Contractor shall provide written documentation to the COR within one (1) business day of the employee advising the Contractor of their intent to leave. In the case of a no-notice departure, the Contractor shall immediately inform the COR. This written notification shall include the date and time the position will be vacant, anticipated replacement date (no later than thirty days), and management action, if needed, to ensure task mission remains on schedule toward completion.

(U) Training of Contractor personnel is the sole responsibility of the Contractor unless otherwise approved by the COR. The Contractor shall employ fully qualified employees; however, if the need for NGA-unique training of Contractor employees arises and is necessary for employees to function in their assigned work role, the Contractor shall seek prior approval for the required training from the COR.

5.2 (U) Key Personnel

(U) Key Personnel are identified in each Task Order. The Contractor shall provide qualified personnel, in terms of skills, knowledge and experience, commensurate with the responsibilities and requirements listed in each task order. All Key Personnel are required to have an active TS/SCI with CI polygraph.

(U) Substitutions of the Key Personnel listed shall be made in accordance with the following procedures.

(U) The Contractor agrees that during the first 180-days of contract performance, no Key Personnel substitutions shall be made unless necessitated by an individual's sudden illness, death, or termination of employment. In any of these events, the Contractor shall promptly notify the CO and COR.

(U) After the initial 180 day period, the Contractor must provide notification of the substitution of

Key Personnel prior to removing any Key Personnel from performance. All proposed changes must be submitted in writing, to the CO and COR at least14 business days prior to the proposed date of substitution in accordance with the above.

6 (U) Government Furnished/Contractor Acquired Property

Management

(U) The Contractor shall account for and maintain all the Government-provided materials, property and equipment IAW FAR Clause 52.245-1 (JAN 2017), Government Property and NARI Clause

5X52.45.102-9000 (Mar 2023). The Contractor shall maintain a Material List (CDRL-A019) that lists all the Government Furnished Property (GFP), Government Furnished Information (GFI), and

Contractor Acquired Property (CAP).

6.1 (U) Software Licenses/Cloud

(U) Software licenses for COTS products whether used in Development, Test, or Operational environments may be either procured by the Government and furnished to the Contractor or procured by the Contractor. When required, the Contractor shall procure, install, configure, and checkout software. Software licenses shall be procured on behalf of the Government in accordance with Software Asset Management guidance and shall be transferred to the Government. These requirements also apply to software license renewals and maintenance agreements. (CDRL-A020)

(U) Cloud environments, whether used for Development, Test, or Operations, may be furnished by the Government or procured by the Contractor. In both cases, the Contractor shall maintain, operate, and manage the Cloud infrastructure services. When required, the Contractor shall procure and manage Cloud accounts to include cost expenses. (CDRL-A020)

7 (U) Place of Performance

(U) The primary place of performance is at the Contractor’s facilities within the United States. The

Contractor shall provide facilities with the infrastructure needed to support contract requirements including security and communications and that are cleared in accordance with the National

Industrial Security Program. The Contractor shall have their primary place of performance available at contract award.

(U) If NGA on-site work is required, temporary access to NGA sites may be granted in the

Washington, DC and St. Louis, MO areas or other areas as required by the Government.

(U) Unless otherwise noted, the Contractor will not be provided Government allocated office space or equipment for the execution of this contract. Temporary access to Government owned and operated equipment will be made available onsite on an as-needed basis to fulfill contractual obligations.

(U) The Contractor shall gain and maintain access to accounts on NGANet/Common Operating

Environment (COE), SECNet, as well as the unclassified Government networks (SBU) as required to provide services

8 (U) Travel

(U) Travel is anticipated in the performance of this contract. Travel will predominantly entail travel to NGA facilities. All travel requires COR approval and authorization prior to departure. (CDRL-

A020)

(U) The Contractor will not be reimbursed for any local travel. Local travel is defined as travel conducted on official business within a 30-mile radius of official duty station.

9 (U) Export Controls

(U) The Contractor is solely responsible for ensuring that any exports of Contractor’s goods or services conducted under this contract comply with all applicable export control laws and regulations and for asserting any exemptions or exceptions to licensing requirements applicable thereto.

10 (U) Security Management

(U) The Contractor shall conduct a security program to ensure all security requirements of the contract are satisfied, and comply with NGA, IC, and DoD security/cybersecurity policies and regulations.

(U) Cyber issues related to personnel misconduct or any security related incidents must be reported immediately to the COR. A detailed written report of the incident that includes personnel involved, date, time, and other information relevant to the incident is due to the COR within 3 business days of the incident.

10.1 (U) Classified Work Performance Security Requirements

(U) Contractor personnel performing classified work on the Mercury contract are required to have active Top Secret/Sensitive Compartmented Information (TS/SCI) clearances for access to NGA classified facilities, when performing duties within classified environments, for access to classified

NGA computer systems, and to perform classified work under this contract. Contractor personnel are subject to counterintelligence polygraph examinations as requested by the Government. NGA will sponsor security clearances, NGA badges, Common Access Cards (CAC), and/or other required items (Example: hangtag) for required program personnel.

(U) Contractors must abide by the DD Form 254 - Contract Security Classification Specification, and applicable security policies and regulations.

(U) Contractor personnel shall follow all applicable NGA, IC, and DoD information security and operational security policies and guidance during performance of contract requirements.

(U) The Contractor shall inform the Government when their employees no longer support the contract (see DD254). The Government desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day support ends. If

Contractor personnel will no longer be supporting NGA via an NGA contract, any debriefing paperwork, notifications, and/or requests for further direction from the COR or Industrial Security shall be turned into the NGA Workforce Support Center, NGA Site Security Office, or the COR.

If Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the Contractor’s security office’s responsibility to collect the items from the individual. If the Contractor debriefs the employee, the Contractor shall send a copy of the debriefing statement, plus any Government items (e.g. NGA Badge, CAC, Courier Card, parking hangtags, etc.) within four (4) business days (timeline may be extended with authorized documented exceptions by NGA Security) to an NGA Site Security Office or the NGA

Workforce Support Center.

(U) All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at collaborator sites must be performed in either an NGA accredited

SCIF or an Other Government Agency (OGA) SCIF that has either a Memorandum of Agreement

(MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with

NGA for this contract.

(U) Cleared Contractor personnel may hand-carry contract-related classified information as authorized by the COR. Contractor personnel will obtain NGA courier authorization prior to hand-carrying of contract-related classified information. Contractor personnel will be limited to hand-carrying classified information between the Contractor facilities and NGA facilities only.

(U) Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI)

Continuous Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW

SEAD 6: “Continuous Evaluation”. Cleared Contractor personnel must self-report security issues, foreign contacts, and other reporting requirements in accordance with SEAD 3: “Reporting

Requirements for Personnel With Access to Classified Information or Who Hold a Sensitive

Position” and NGA Instruction 5205.3, “Security Reporting Requirements”. In addition, cleared

Contractors will be required to submit electronic fingerprints and will be enrolled into NGA’s

Report of Arrest and Prosecution Background (RAPBack) program, which supports CES.

(U) Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in NGA’s annual Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20 November 2020 memorandum titled “Designation of NGA Personnel Required to

Participate in the Security Financial Disclosure Program.

10.1.1 (U) Unclassified Work Performance Security Requirements

(U) Uncleared Contractor personnel are authorized to work on this contract up to the Unclassified level, with access to DoD Controlled Unclassified Information (CUI) at the Contractor site without the requirement of a security clearance.

(U) Any Contractor personnel working with CUI information must receive a favorable HSPD-12 and/or HSPD-12 Tier 1 adjudication prior to accessing CUI information. Contractor personnel who require access to CUI for 60 days or less, must receive a favorable HSPD-12 adjudication.

Contractor personnel who require CUI access for greater than 60 days must receive a favorable

HSPD-12 Tier 1 adjudication.

(U) NGA will sponsor the HSPD-12 and HSPD-12 Tier 1 background investigation for required program personnel. NOTE: Contractor personnel submitted for SCI access cannot be submitted for a HSPD-12 or HSPD-12 Tier 1 adjudication while waiting for their SCI approval.

(U) Contractor personnel shall not release any unclassified information, regardless of medium (e.g.

film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

(U) Contractor personnel are forbidden from bringing in prohibited, unauthorized, and/or Portable

Electronic Devices (PEDs) items into any NGA installation or any secure office/working location covered under this agreement. A list of PEDs includes but is not limited to cell phones, cameras, two-way pagers, laptops, recorders (e.g. digital, tape, etc.), flash drives, or any other kind of removable media, without prior approval and approval paperwork from NGA. See NGA instructions/regulations/policy for a full list of prohibited and unauthorized items. Security violation repercussions will be determined on the severity of the violation.

10.1.2 (U) Information Handling

(U) Contractor personnel will comply with the NGA, DoD, and IC policies and regulations (to include, but not limited to, the Consolidated NGA (CoNGA) Security Classification Guide) to properly mark (to include portion marking) classified and unclassified documentation, media, etc.

(U) Document markings will be in accordance with the lowest security classification possible to ensure the confidentiality and integrity for the greatest release to partners in accordance with NGA and mission partner marking guides for classified information.

(U) All Government-furnished information released to the Contractor or created in the performance of this contract will be destroyed or returned by the Contractor to NGA upon contract termination or when no longer required for contract performance. The determination to destroy or return will be at the direction of the NGA CO or COR.

11 (U) Deliverables

(U) Contractor Deliverables and frequency of delivery are identified in each Task Order. If the deliverable cannot be provided within the scheduled time frame, the Contractor shall notify the

COR in writing with a reason for the delay and the proposed revised schedule. The revised schedule must include the impact (cost and schedule) on related tasks and the overall project.

Contract terms and conditions will determine penalties, costs, and other actions based on the facts related to the revised schedule.

(U) The Contractor shall utilize modern tools and technology for the delivery of contract data requirements in order to ensure the most current data and information is readily available to the

Government. The types of modern tools and technology may include Confluence pages, dashboards, and data visualizations.

(U) For deliverable documents, unless noted below, the format and content are: 1) Contractor defined and Government approved, 2) in softcopy, 3) a single copy, and 4) compatible with Adobe

Acrobat or Microsoft Office applications. All CDRLs shall be delivered to the COR as a minimum.

Delivered CDRLs are subject to Government approval. Disapproved CDRLs shall be corrected by the Contractor and resubmitted to the Government for approval. Classified deliverables shall be portion marked in accordance with the Consolidated NGA Security Classification Guide.

(U) All preliminary and final deliverables (as well as all working papers and other material associated with specific CDRLs or artifacts of particular concern to the Government) generated by the Contractor during performance of the contract are the property of the Government. The

Contractor shall submit all documentation to the COR (or designee) at the conclusion of the effort for evaluation, classification, and disposition.

(U) The following sub-sections describe each of the Contract Data Requirements List (CDRL) documents required in support of the Mercury IDIQ contract.

11.1 (U) Quality Control Plan

(U) The Contractor shall implement and perform a Quality Control function to ensure that all activities performed and products delivered under the Mercury Contract meet or exceed the standards in the Quality Assurance Surveillance Plan (QASP). The Quality Control function shall be documented in a Quality Control Plan (QCP) (CDRL-A001). The plan shall identify Contractor responsibilities and activities required to implement a comprehensive Quality Control program.

The plan shall identify staffing and procedures for self-inspecting the quality, timeliness, responsiveness, customer satisfaction, and other performance requirements. The plan shall describe the organization responsible for implementing the QCP. The QCP shall describe the processes and procedures used to ensure a robust execution of the plan.

11.2 (U) System Security Plan

(U) The System Security Plan (CDRL-A002) shall describe the Contractor’s system security program and their interactions with NGA Security organizations and tools. The Security Plan shall document how vulnerability tests and scans will assess the security posture of supported systems and demonstrate how the Contractor plans to effectively and efficiently achieve and maintain the

Approval To Operate (ATO) for each system.

11.3 (U) Staffing Plan

(U) The Contractor shall maintain processes and procedures for identifying, recruiting, hiring, screening, and retaining sufficient numbers of qualified personnel to meet staffing requirements.

The Contractor shall document their staffing effort in a Staffing Plan (CDRL-A003). The Staffing

Plan shall describe the techniques, processes, and procedures used to identify, recruit, hire, screen, and retain sufficient staff, and to ensure efficient and effective use of personnel, as well as, any training and/or certification programs the offeror uses to maintain proficiency and verify qualifications. The plan shall describe the relationship between the various management levels and the number of individuals required for each function. The plan shall identify any special skills required (e.g., scientific specialties) and how those skills will be provided when needed. The

Contractor shall revise the Staffing Plan as necessary to incorporate transitioning on of additional applications or systems.

11.4 (U) Transition Plans

11.4.1 (U) Transition-In Plan

(U) The Contractor shall prepare and deliver a contract transition-in plan (CDRL-A004) detailing the process to capture and transition analytic systems supported under Mercury from their legacy contracts. The plan should provide for receipt of all GFE and GFI (to include but not limited to software, documentation, data, test software) for the system or application being transitioned;

establishing of procedures to safeguard against data corruption and unintended system performance degradation.

11.4.2 (U) Transition-Out Plan

(U) The Contractor shall prepare and deliver a contract transition-out plan (CDRL-A005) to support transition to another Contractor as directed by the Government. The Contractor shall turn over responsibilities for all sustainment activities for any Mercury applications and services that are selected to move to another contract vehicle during the course of the Mercury effort. The

Contractor shall turn over all development and sustainment Mercury applications and service responsibilities at the end of the Mercury effort. The Contractor shall provide at a minimum the following items by the end of the contract in accordance with Government direction:

• (U) Hardware and software development documentation that provides a comprehensive detailed description of the current operational baseline for each security domain. The documentation will at a minimum, contain the following: systems architecture, Configuration Management (CM), software configuration, COTS integration, and capture of the hardware and software architectures.

• (U) Operating system and application software with annotated source code for each security domain, including software under current development or test that is yet to be deployed. The Contractor shall provide the software in an industry standard format.

• (U) Operational system data and database information, both current and historical, including user account data, metadata catalogs, stored imagery and products, system diagrams, and knowledge bases.

(U) The Contractor shall conduct an organized transfer of Government-furnished equipment

(GFE), Government-furnished property (GFP), and Government-furnished information (GFI), to include manufacturer maintenance agreements and software licenses as directed by the CO. The

Contractor shall generate a report containing the final disposition of all NGA property.

(U) The Contractor shall support the decommissioning and disposal of all Information Technology

(IT) systems as directed by the Government. The Contractor shall be responsible for retiring

Mercury applications and services that the Government has selected for decommissioning. The

Contractor shall follow NGA’s Decommissioning Disposal Review (DDR) process that is specific for hardware and software. The Contractor shall follow all processes in the DDR checklist for hardware and software, including maintenance of a Property Book to keep hand receipts, review signatures, and other acceptance criteria.

11.4.3 (U) System Transition Plan

(U) The Contractor shall prepare and deliver a standard system transition plan (CDRL-A006) detailing the process to add and remove a system onto and off the contract. The removal of a system includes both the transition of a system to another support team and the retirement system retirement. For each system transition, the Contractor shall coordinate any tailoring or unique requirements with the System PM.

11.5 (U) Software Documentation

(U) The Contractor shall develop and maintain a software Configuration Management Plan

(CDRL-A007). The Contractor shall implement the plan for all software developed, modified, and maintained under the Mercury Contract. The plan shall establish the Contractor CM organization, responsibilities, and items under control, baselines and change authority within the Mercury

Contract. The plan shall also identify methods and tools to accomplish these tasks.

(U) The Contractor shall deliver executable code and source code for all software releases into a

Government-defined software repository. The Contractor shall deliver a Software Delivery

Summary (CDRL-A008) which lists each application and service software delivery and updates including at least the Program Name, Version, Major Changes, Resolved Issue Identifiers, Repository Info, planned/actual dates for Upload, Delivery, Initial Operational Capability (IOC), and/or Full Operational Capability (FOC). (Upload refers to the date when the software is uploaded to the NGA Software Repository; Delivery refers to the date when a release is provided to a test, ISP, or another organization, IOC refers to the first successful installation, checkout, and operations; and FOC refers to the full deployment in operations).

11.6 (U) Architecture Documentation

(U) The Contractor shall provide the Architecture Documentation (CDRL-A014) for views and formats specified in the Task Order PWS.

11.7 (U) Reporting and Reviews

(U) The Contractor shall provide a Contract Funds Status Report (CFSR) (CDRL-A015). The report shall provide the cost and funding necessary for the Government to make timely and effective management decisions. The Government may direct the format of the CFSR in order to automate its integration into Government systems.

(U) The Contractor shall conduct a Program Management Review (PMR) chaired by the

Contracting Officer (CO) and Government Program Manager addressing contract status. The PMR shall focus on contract achievements since the last review, plans for the coming period, cost and schedule performance, staffing, contract changes, funding status, progress of risk management activities, quality control activities and findings, GFE property status, open issues, action item tracking and problems. PMRs will be held at a mutually agreed upon location and may include video-teleconferencing. The Contractor shall set up the video-teleconferencing and dial-ins for the

PMRs. The Contractor shall deliver a PMR Presentation Package in advance of the scheduled review (CDRL-A016). The Contractor shall record and distribute PMR Meeting Minutes and

Action Items after the review (CDRL-A017).

(U) The Contractor shall develop and maintain a current Staff List (CDRL-A018). The Staff List shall contain staff information (i.e. name, job title, contact info, assignments, employer, site/seat location, planned start/departure date) for all Contractor and Subcontractor personnel assigned to the contract whether charging direct or indirect.

(U) The Contractor shall provide a Material List (CDRL-A019) that lists all the GFP, GFI, and

Contractor Acquired Property (CAP). The Material List shall contain all GFP and GFI possessed by the Contractor. Any material provided by the Government or purchased by the Contractor with

Government funds shall be added to the Material List.

(U) The Contractor shall submit an Other Direct Costs (ODC) Plan (CDRL-A020) detailing the planned (known and estimated) Travel, Material, Software Licenses, and Cloud requirements.

This plan enables the Mercury COR to review and approve these expenses in totality and also ensures the Government understands funding needs. ODC requirements should be divided between support to O&M and RDT&E CLINs.

(U) The ODC Travel section shall contain the following information in their request for approval to travel:

1. (U) Task Order

2. (U) Purpose of trip

3. (U) Trip Priority (an identifier to indicate which travel is more important)

4. (U) Estimated dates of trip

5. (U) Number of persons traveling per trip

6. (U) Trip Length

7. (U) Trip Locations (e.g. St Louis, MO to Denver, CO)

8. (U) Total projected trip costs

9. (U) Summary of costs

(U) The Material, Software Licenses, and Cloud requirements should include a requirements summary with estimated need dates. The Contractor shall include all known and estimated requirements regardless of the CLIN value. If requirements exceed CLIN value, the CO and COR will determine whether to reduce requirements or to initiate an ECP.

(U) The Contractor shall provide a Payment Report (CDRL-A021) which details the monthly invoice charges to the individual software…