(U) NGA IT ADE_Rev F_Draft Accepted.pdf

UNCLASSIFIED

NGA ITADE, Rev F Draft

Total Pages: 61

National-Geospatial Intelligence Agency

INFORMATION TECHNOLOGY (IT)

ACQUISITION DESIGN ELEMENTS (ADEs)

FOR CONTRACTS

Revision F

Day Month 2024 ii

TABLE OF CONTENTS

1 EXECUTIVE SUMMARY

1.1 Configuration Control

2 PURPOSE

3 GOVERNANCE PROCESS

4 ITADE STATEMENTS

4.1 Architecture

4.2 Capacity & Mission Performance

4.3 Continuity & Resilience

4.3.1 Additional Information

4.4 CORE & The NGA Software Way

4.4.1 Additional Information

4.5 Cost Management

4.5.1 Additional Information

4.6 Data Architecture

4.6.1 Additional Information

4.7 Enterprise Management

4.7.1 Additional Information

4.8 GEOINT Data Standards

4.9 Infrastructure – NGA Cloud Service

4.10 IT Accessibility (Section 508)

4.10.1 Additional Information

4.11 IT Asset Management

4.11.1 Additional Information

4.12 Schedule Management

4.12.1 Additional Information

4.13 Security (Policy and Implementation)

4.14 Systems Engineering

APPENDIX 1: ACRONYMS

APPENDIX 2: DERIVATIVE SOURCE LINKS

iii iv

LIST OF FIGURES

Figure 1: ITADE Governance Process

LIST OF TABLES

Table 1: ITADE Applicable Attributes

Table 2: ITADE Category Descriptions

Table 3: Column Definitions

Table 4: Architecture ITADEs

Table 5: Capacity & Mission Performance ITADEs

Table 6: Continuity & Resilience ITADEs

Table 7: CORE & The NGA Software Way ITADEs

Table 8: Cost Management ITADEs

Table 9: Data Architecture ITADEs

Table 10: Enterprise Management ITADEs

Table 11: GEOINT Data Standards ITADEs

Table 12: Infrastructure NGA Cloud Services ITADEs

Table 13: IT Accessibility (Section 508) ITADEs

Table 14: IT Asset Management ITADEs

Table 15: Schedule Management ITADEs

Table 16: Security ITADEs

Table 17: Systems Engineering ITADEs v

CHANGE LOG

Title: (U) NGA Information Technology Acquisition Design Elements (ITADEs) for Contracts

SCN/REV DATE ITEMS AFFECTED

REMARKS/RFC

AUTHORITY

000 20 July 2018 All – Initial Issue RFC N01-0647

CCB 0035-18

dtd 31 July 2018

Rev A This Revision incorporates the following RFC:

001 6 Dec 2019 All – Revision A RFC N01-0673

CCB 0043-19

dtd 11 December

Rev A

CN-001

This Change Notice incorporates the following RFC:

002 28 Feb 2020 Change Log, Table 6, 4.3.1, 4.3.2, 4.3.3, 4.3.4

RFC N01-0676

CCB 0009-20

dtd 09 March 2020

Rev B This Revision incorporates the following RFC:

003 12 Aug 2020 All – Revision B RFC N01-0692

CCB 0030-20

dtd 20 August 2020

Rev C This Revision incorporates the following RFCs:

004 29 Sep 2021 All – Revision C RFC N01-0714

CCB 0082-21

dtd 01 October 2021

005 29 Sep 2021 Change Log, Table 13 – 9.04, 9.22, 9.24, 4.10.1-6, 4.10.1-20

RFC N01-0708J

CCB 0082-21

dtd 01 October 2021

Rev D This Revision incorporates the following RFC:

006 24 Aug 2022 All – Revision D RFC N01-0730

CCB 0199-22

dtd 8 September

Rev E This Revision incorporates the following RFC:

007 17 Jan 2024 All – Revision E RFC N01-0746

CCB 0364-23

dtd 29 January 2024

1 EXECUTIVE SUMMARY

Information Technology Acquisition Design Elements (ITADEs) are standardized statements derived from current governing policies, procedures, directives, instructions, and standards, tailored for NGA’s Information Technology (IT) environment. The ITADE statements in this document are to be incorporated into acquisition packages to drive technical and organizational operability, supporting NGA’s vision of providing continuous, interconnected, reliable Geospatial Intelligence (GEOINT) to the warfighter, first responder, and policymaker of tomorrow.

This document is reviewed, updated and published at a minimum, yearly, as NGAs requirements develop and as GEOINT and IT governing documents and standards are updated or implemented. As the use of ITADEs evolve, input to improve and refine this process will be ongoing.

ITADE offerings include this base document, which now includes an appendix featuring derivative sources and relevant links, and a Consolidated Compliance Table containing trigger criteria for each statement with sorting capabilities. Always refer to the ITADE Intellipedia Site for the latest updates and releases of these documents.

ITADE Revision F introduces several significant changes. These include the addition of sections IT Accessibility (Section 508) and IT Asset Management. Also, each statement identifier now includes the letter "F" to indicate the version it comes from. Furthermore, the sections have been reorganized in alphabetical order for easier navigation.

If there are any questions about the validity or applicability of information located in this document, please contact the ITADE team for assistance at ITADETeam@coe.ic.gov or ITADETeam@nga.mil, or by visiting the ITADE Intellipedia Site.

1.1 Configuration Control

This document is under the configuration control of the NGA Configuration Control Board (CCB).

Jeffrey T. Elder Director, Architecture and Engineering Group, CIO-T National Geospatial-Intelligence Agency https://intellipedia.intelink.ic.gov/wiki/Acquisition_Design_Elements https://intellipedia.intelink.ic.gov/wiki/Acquisition_Design_Elements mailto:ITADETeam@coe.ic.gov mailto:ITADETeam@nga.mil https://intellipedia.intelink.ic.gov/wiki/Acquisition_Design_Elements

2 PURPOSE

ITADEs support the development, implementation, maintenance, and evolution of NGA National System for Geospatial-Intelligence (NSG) architecture entities (e.g. system, segments, services, applications, apps) and provide direction to the program management office (PMO), developer and/or architecture entity to support consistent implementation. ITADEs are a menu of possible requirements to include in acquisition packages. The author of the acquisition document’s technical content must address the appropriate ITADEs based on the acquisition requirements. Acquisitions to which ITADEs are applicable to are listed in table below.

Table 1: ITADE Applicable Attributes

All ITADE statements are categorized as Mandatory (if applicable) or optional. If the statement is applicable to the current acquisition, then that statement is mandatory to use. For example, although all CORE and Software Way ITADE statements are marked as mandatory, if the acquisition doesn’t include any software development or purchases, then the PM would not use those statements. Applicable ITADE statements are essential to use within all acquisition packages containing IT to ensure standardization, which provides the basis for system interoperability and operational efficiency across the NSG.

ITADEs are a menu of possible requirements to include in acquisition packages.

Program Managers (PM) are encouraged to use their best discretion if an ITADE statement conflicts with another statement or the acquisition requirements. For further assistance, feel free to reach out to the ITADE team.

The ITADE categories and descriptions are listed in Table 2.

ITADEs ARE APPLICABLE TO: ITADEs ARE NOT APPLICABLE TO:

All programs that anticipate delivery of software and/or hardware, whether custom or off-the-shelf, for use in the NGA IT Enterprise.

Acquisition programs that do not deliver IT solutions such as grounds maintenance and janitorial services.

Different types of service providers, system development lifecycles, cloud, and non-cloud acquisitions.

Programs that provide only human resources to operate, integrate and/or maintain information systems such as system administrators and Systems Engineering (SE) support.

Table 2: ITADE Category Descriptions

ITADE CATEGORY DESCRIPTION

Architecture Requirements for architecture artifact development

Capacity and Mission Performance (Metrics)

Requirements for volumetric, timeline, and engineering data

Continuity and Resilience

Requirements for business continuity and IT contingency planning

Common Operations Release Environment (CORE) & The NGA Software Way

Requirements for building, purchasing and operating software

Cost Management Requirements for development contracts regarding cost and performance data

Data Architecture Requirements for data architecture artifact development

Enterprise Management Requirements for interfacing with the Enterprise Service Center (ESC) as well as requirements for providing compliance monitoring

GEOINT Data Standards

Requirements for the compliance of GEOINT data standards in accordance with the GEOINT Functional Manager Standards Assessment (GFMSA) Directive

Infrastructure – NGA Cloud Services

Requirements for building or migrating to NGA’s Cloud Services

IT Accessibility (Section 508)

Requirements to ensure that technology is accessible to employees and members of the public with disabilities to the extent it does not pose an “undue burden”

IT Asset Management Requirements to establishes, maintain, and improve control of the IT Operational baseline through implementation and integration of compliant IT Asset Management methods

Schedule Management Requirements to facilitate identification and creation of tasks, dependencies, milestones and/or deliverables

Security (Policy and Implementation)

Requirements for security processes, activities, deliverables, and participation in security related forums

Systems Engineering Requirements for operation and implementation of combined Scaled Agile Framework (SAFe) practices

3 GOVERNANCE PROCESS

The ITADE Governance Process is divided into two areas: creation and approval, and implementation, with each area comprising of four steps (Figure 1).

In the creation and approval phase, the ITADE information owner is identified and then provides the ITADE statements, the NGA governing document and link location reference, and the ITADE compliance table triggers with mandatory (if applicable) or optional recommendations. Next, the ITADE team incorporates this information into the next draft ITADE version for approval and submittal to the CCB. The CCB then reviews the updated ITADE document and approves or requests corrections or changes. Once final approval is received, the ITADE team then publishes the CCB-approved ITADE document for use.

In the first step of the implementation phase, the ITADE team integrates, changes, and updates the ITADE tool (in work) and Intellipedia pages. PMs then use the ITADE tool or documentation to assist in selecting the appropriate statement(s) for their acquisition requirement. Then, the ITADE statement(s) are incorporated into the initial acquisition package. During this process, the PM and the integration lead are encouraged to confer with the ITADE team and information owners to ensure that the technical content is rigorously defined and appropriately specific to assist acquisition management in their document preparation. Finally, the ITADEs are implemented and incorporated into the final contract.

Figure 1: ITADE Governance Process

4 ITADE STATEMENTS

ITADE statements are intended to ensure the creation of a complete technical portion of an acquisition package.

The identified work and resulting artifacts should be assessed against fit for use based on acquisition intent, scope, and funding levels. It is the responsibility of the PM to reconcile any differences in the deliverables and activities within all ITADEs.

Table 3: Column Definitions

COLUMN NAME DESCRIPTION/USE

ID # Unique identifier for each statement

ITADE Statement Brief statement derived from NGA Governing Documents

M/O M – Mandatory (if applicable)

O – Optional

Derivative Source The NGA Governing Document

4.1 Architecture

This ITADE table covers the development of architecture artifacts in support of the acquisition effort.

Table 4: Architecture ITADEs

ID # ITADE STATEMENT M/O

Derivative

Source

F1.01 The Contractor shall adhere to GEOINT Enterprise Architecture (GEA), which provides context of how each systems/service acquisition fits into NGA’s overall mission(s).

M OMB

Directive130A

GEA Policy

(COE)

F1.02 When building architecture content for NGA, the Contractor shall adhere to:

1. GEA Baseline Artifacts

2. NGA Service/Application Programming Interface (API) Governance Document

3. Intelligence Community Program Architecture Guide, currently v2.0

M CJCSI 5123.01

NGA SEP

IC CIO

ICPAG

GEA Directive

F1.03 As directed by the PMO, the Contractor shall update the architecture and provide documentation throughout the system engineering lifecycle as changes arise.

M Architecture Process

Resources

(COE)

F1.04 When provided by the PMO, the Contractor shall review the lightweight use cases and provide suggestions for changes, alternatives, and improvements.

M Architecture Process

Resources

(COE)

F1.05 Routinely, the Contractor shall maintain awareness of Government provided Architecture content provided on the GEA website, Cloud Information Portal references, and other references as provided Government Furnished Information (GFI) by the PMO.

M Architecture Process

Resources

ID # ITADE STATEMENT M/O

Derivative

Source

F1.06 The Contractor shall review GFI Architecture references to influence the contracted solution.

O Architecture Process

Resources

(COE)

F1.07 The Contractor shall apply the Government provided artifacts as inputs to their architecture.

M Architecture Process

Resources

(COE)

F1.08 The Contractor shall participate in the NGA processes and forums per the direction of the PMO.

M Architecture Process

Resources

F1.09

Per Program Management direction, the Contractor shall develop additional architecture view products.

M GEA Policy

F1.10

To support GEAs understanding of what each contract is building, the Contractor shall document:

1. Service Descriptions for any developed services with the Service Description Table in format consistent with the current NGA Configuration Management (CM) baselines products found on the GEA Policy website

2. Service Consumer Interactions consistent with the Service Consumer Table in formats consistent with the current NGA CM baselines products found on the GEA Policy website

M NGA SEP

F1.11

At an enterprise level, the Contractor shall document their architecture in compliance with the existing defined Digital Engineering meta-model defined in the GEA AV- 1 Architecture Overview Appendix A found on the current NGA CM baselines products located on the GEA Policy website.

M GEA Policy

F1.12 The Contractor shall participate in the formal and ad-hoc NGA processes (e.g., governance, SE, Design reviews, etc.), Release Planning Events (RPEs), Integrated Product Teams, working groups and forums as directed and approved by the Government lead.

M Architecture Process

ID # ITADE STATEMENT M/O

Derivative

Source

F1.13 The Contractor shall update their architecture and provide documentation throughout the SE lifecycle as changes arise.

M Architecture Process

4.2 Capacity & Mission Performance

This ITADE table describes the requirements for volumetric, timeline, and engineering data to define required capacity and mission performance and to support Contractor assessments during the development, test, and pre-transition timeframes. This ITADE table also describes the requirements for transaction data to support capacity and performance assessments as systems proceed through test/verification into an operational environment. Transaction data is critical to the successful development and implementation of NSG systems and services, provides the capability to generate and validate accurate performance requirements, provides the capability to ensure systems and services meet mission performance requirements, and provides capability to track capacity usage and project future needs.

Table 5: Capacity & Mission Performance ITADEs

ID # ITADE STATEMENT M/O

Derivative

Source

F2.01

To support capacity and performance assessments in the development, test, and pre-transition timeframes, the Contractor shall identify Product Quality Assurance test data and numeric metrics data to perform image quality assessments. Detailed description of these data and metrics shall be presented for Government approval, and any data or information required from the Government shall be specified with a need date.

M NGAI 5000.1

(SBU)

NGA

NSG/ASG

TEMP

https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf

ID # ITADE STATEMENT M/O

Derivative

Source

F2.02 To support capacity and performance assessments by the Contractor in the development, test, and pre-transition timeframes, the Contractor shall identify, and request examples of approved test data used for performance testing. Description and need date shall be identified to the Government.

TEMP

(COE)

F2.03 To support capacity and performance assessments by the Contractor in the development, test, and pre-transition timeframes, the Contractor shall identify for approval and/or request definition of volumetric (files/bytes/etc. per day and peak period), timeline, and other content requirements from the Government as necessary to characterize required capacity and mission performance where additional detailed requirements are required to compliment Government provided acquisition-level requirements.

TEMP

(COE)

F2.04 To support capacity and performance assessments by the Contractor in the development, test, and pre-transition timeframes, the Contractor shall identify and request examples from the Government ‘day in the life scenarios’ for use in performance modeling and test activities. Description and need date shall be identified to the Government.

TEMP

(COE)

F2.05 To support capacity and performance compliance assessments by the Contractor, Government, and system engineering and Integration Contractors designated by the Government during site integration, enterprise test/demo, and the operations phases, a list of what transactions (including data dictionary reference and format of the data) will need to be logged and assessed and must be identified and agreed between Government and Contractor, or per stated requirement.

For input required from the Government, a description and need date shall be identified to the Government.

TEMP

(COE)

https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf

ID # ITADE STATEMENT M/O

Derivative

Source

F2.06 To support capacity and performance compliance assessments by the Contractor, during site integration, enterprise test/demos, and the operations phases, the planned retention duration for transaction log data shall be identified to, and per approval by the Government.

TEMP

(COE)

F2.07 To support capacity and performance compliance assessments by the Contractor, during site integration, enterprise test/demos, and the operations phases, the planned remote access/query capability to be provided for test/metric data shall be identified to, and subject to Government approval.

TEMP

(COE)

F2.08 To support capacity and performance compliance assessments by the Contractor, during site integration, enterprise test/demos, and the operations phases, the planned availability and access to input/output metrics, data and reports shall be identified to, and subject to Government approval.

TEMP

(COE)

F2.09 To support capacity and performance compliance assessments by the Contractor, during site integration, enterprise test/demos, and the operations phases, the metric and operations displays for use by the Operations and Support staff to support real-time capacity and mission performance assessment and diagnostics will be identified to, and subject to Government approval.

TEMP

(COE)

https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf

ID # ITADE STATEMENT M/O

Derivative

Source

F2.10 The Contractor shall integrate into the existing continuous monitoring, logging, and alerting for applications and services in the NGA Enterprise Development Security & Operations (DevSecOps) environment(s) on each of the available security domains.

TEMP

(COE)

F2.11 In response to new and emerging requirements, the Contractor shall perform analysis to identify Concept of Operations (CONOPS) and/or changes in capacities which are required to maintain performance and identify impacts on performance if capacity changes are not made.

TEMP

(COE)

F2.12 The Contractor shall participate and/or support the Government in NGA capacity and performance assessment working groups per the direction of the PMO. Examples include but are not limited to:

enterprise forums, enterprise working groups and Design Review events and governance activities such as RPEs, Go/No-Go Events, and Major Release Request For Changes.

TEMP

(COE)

F2.13 In response to new and emerging requirements, the Contractor shall update system monitoring and transactional logging capabilities to ensure comprehensive logging and monitoring capabilities are maintained throughout the lifecycle.

TEMP

(COE)

https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf

ID # ITADE STATEMENT M/O

Derivative

Source

F2.14 The Contractor shall provide capacity and performance assessments via combination of modeling, analysis, and/or test activities and provide documentation throughout the SE lifecycle as changes arise.

TEMP

(COE)

F2.15 The Contractor shall provide the capability to simulate external interfaces as required for supporting performance modeling and testing activities which may be required to assess compliance with mission performance requirements.

TEMP

(COE)

F2.16 The Contractor shall have simulation capabilities to include the ability to generate test narrowband data and corresponding simulated wideband data formatted in accordance with applicable interface documents as needed to adequately evaluate system performance in a test environment.

TEMP

(COE)

F2.17 The Contractor shall provide the capability to capture, store, query, and export transactional log data for all requirements identified by the Government (and any additional ones proposed by the Contractor) to support capacity and mission performance assessments.

TEMP

(COE)

https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf

ID # ITADE STATEMENT M/O

Derivative

Source

F2.18 The Contractor shall provide the capability to generate pre-defined and tailored reports based on the transactional log data and other data maintained by the Contractor.

O NGAI 5000.1

TEMP

F2.19

The Contractor shall deliver System View-7 Systems Measures Matrix and other architecture artifacts tailored to support capacity and performance assessments.

TEMP

F2.20

The Contractor shall deliver transactional log data on a routine, regular basis per agreements with the PMO.

Format shall be as specified by the Government in the transactional log data requirements described in the Content section.

TEMP

F2.21

The Contractor shall deliver Performance and Capacity assessment reports at design review events and governance activities.

TEMP

(COE)

https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf

ID # ITADE STATEMENT M/O

Derivative

F2.22

The Contractor shall deliver a CONOPS and procedures for System Performance and Capacity Monitoring.

TEMP

F2.23

The Contractor shall deliver Capacity Assessment and System Performance test procedures and reports for each applicable release cycle.

TEMP

F2.24

The Contractor shall deliver Design Artifacts and use cases, or comparable documentation, providing CONOPS, architecture, and performance information sufficient to support enterprise-level modeling and closure assessments by the Government or designated Contractors.

TEMP

F2.25

The Contractor shall deliver Data Dictionaries, DIV-3 physical data model, and other artifacts providing details for transactional log data. The DIV-3 shall be in the GFI format.

TEMP

4.3 Continuity & Resilience

This ITADE table describes requirements for business continuity and IT contingency planning capabilities for mission and IT system resilience to support NGA’s Continuity of Operations program.

Table 6: Continuity & Resilience ITADEs

ID # ITADE STATEMENT M/O

Derivative

Source

F3.01 The Contractor shall follow applicable National Institute of Standards and Technology (NIST) Special Publications 800-53r4 and 800-34r1, Classified National Security Systems Instruction (CNSSI) 1253 and Intelligence Community Directive (ICD)-503 for the Contingency Planning (CP) family of security controls.

M NIST 800-53r4

NIST 800-34r1

CNSSI 1253

ICD 503

F3.02 The Contractor shall draft and maintain a comprehensive Information System Contingency Plan (ISCP) before an Authorization to Operate is granted.

M NGAI 3020.26

CPT

F3.03 The Contractor shall create a comprehensive, technical, step by step System Recovery Plan (SRP) when the system(s) is integrated such that it is realistically tested prior to fielding to formally verify the Recovery Time Capability (RTC). The SRP, written in consonance with a provided Minimum Content Template, and Essential Records that support Recovery, must be posted in the Continuity Planning Tool (CPT) along with the ISCP.

M NGAI 3020.26

(SBU)

F3.04 The Contractor shall register the system in development with the Department of Defense (DoD) Chief Information Officer, using the eMASS system in accordance with DoD Instruction 8580.1, “Information Assurance in the Defense Acquisition System” and DoD Instruction 5000.02T “Operation of the Defense Acquisition System” if it meets one of two definitions that follow:

1. Definition of Mission Critical System (MCS): A system that meets the definitions of "information

M DoDI 8580.1

DoDI 5000.02T https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/archive/2015-01-22 https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final https://www.cnss.gov/CNSS/openDoc.cfm?idFKAcJ3PHLXb+IVIOGAHw== https://web.intranet.nga.mil/org/d/DX/Office_of_Strategic_Operations_Docs/Pertinent%20References%20and%20Policies/ICD_503.pdf#search=icd%20503 https://web.intranet.nga.mil/org/d/DX/Office_of_Strategic_Operations_Docs/Pertinent%20References%20and%20Policies/ICD_503.pdf#search=icd%20503 https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%203020.26.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%203020.26.pdf https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/858001p.pdf https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/500002p.pdf?ver=0vzZVR1UG7nRmZKeGnSkHg%3d%3d

ID # ITADE STATEMENT M/O

Derivative

Source system" and "national security system" in reference (a), the loss of which would cause the stoppage of warfighter operations or direct mission support of warfighter operations.

2. Definition of Mission Essential System (MES): A system that meets the definition of "information system" in reference (a), that the acquiring Component Head or designee determines is basic and necessary for the accomplishment of the organizational mission.

F3.05 The Contractor shall participate and comply with the continuity readiness and preparedness activities that includes the following:

1. Complete annual Business Continuity computer-based training via the NGA College

2. Conduct Annual continuity exercises for ISCPs/SRPs

3. Continuity exercises-internal to Chief Information Office & Technology (CIO-T) and external with other components

F3.06 The Contractor shall conduct backup testing to support contingency operations, test backup information to verify media reliability and information integrity. This shall include how often data backups are performed, where they are stored, and how often they are tested. For MCS and MES systems, sampling backed up data is acceptable.

M CPT

F3.07 The Contractor shall perform annual testing of fail-over capabilities.

F3.08 The Contractor shall, in coordination with IT Asset Management and Business Continuity Division and other stakeholders determine Recovery Time Objectives and RTC established for each ISCP.

F3.09 If the system is designated critical, either an MCS or MES, and has its primary operations location in the

M CPT

(COE)

https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%203020.26.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%203020.26.pdf

ID # ITADE STATEMENT M/O

Derivative

Source

National Capital Region (NCR), the Government shall notify the Information System Owner (ISO) of Continuity of Government Readiness Condition (COGCON) change and the Contractor shall be prepared to move the system to alternate operation locations at least 50 miles outside the NCR, according to COGCON levels and timing set by NGA leadership.

F3.10 The Contractor shall be prepared to move the system and conduct operations at a viable alternate operating location in a different geographical area than the primary location to support the System Support Center, backup operations of a destroyed user site, or perhaps movement of operations outside the NCR caused by a COGCON change.

F3.11 The Contractor shall identify, post, and update all Essential Records supporting system recovery in the CPT to include, but not be limited to, the SRP, alert roster listings for all Recovery Team members and necessary consultants for all aspects of recovery, and a copy of the formal agreement covering use of Alternate Operation Locations (AOL).

F3.12 Upon notification of an Undesirable Event (UDE) or an agency-declared Reconstitution effort, the Contractor shall alert the Point of Contacts associated with the system ISCP and SRP, review all associated Essential Records, and standby for notification of the return to agency facilities to recover the system.

F3.13 The Contractor shall respond to alerts/notifications sent by the Government via the Computer Emergency Notification System.

M CPT

(COE)

F3.14 Upon notification, Contractor personnel designated as Mission Critical shall be fully operational at the alternate site within 12 hours of activation or less, depending on the COGCON level.

F3.15 The Contractor shall report status of Critical Systems in accordance with guidance from the Government, by ISCP/Security Plan Identification.

ID # ITADE STATEMENT M/O

Derivative

Source

F3.16 The Contractor shall work with the CIO-T Business Continuity Disaster Recovery Branch regarding IT Contingency Planning and Disaster Recovery Procedures.

F3.17 The Contractor shall comply with Federal Continuity Directives 1 and 2, NGA Instruction (NGAI) 3020.26.

4.3.1 Additional Information

Continuity and Resilience provides NGA capabilities to continue operations when a UDE occurs. Continuity planning, management, execution, exercise and maintenance assures the resilience of its people, processes, technology, and facilities that support NGA’s Mission Essential Function: task, collect, process, exploit, analyze, and disseminate timely, relevant, and accurate geospatial intelligence, consisting of imagery, imagery intelligence, and geospatial information for use by the Armed Forces, Departments or Agencies of the US Government, and foreign partners.

4.4 CORE & The NGA Software Way

This ITADE table describes requirements for NGA CORE & The NGA Software Way with the intent to deliver software products that are designed and built with users, can be automatically updated in production, and use product-specific metrics to make decisions.

Table 7: CORE & The NGA Software Way ITADEs

ID # ITADE STATEMENT M/O

Derivative

Source

F4.01 The Contractor shall use NGA’s Enterprise-managed work tracking tools (e.g. Jira, Confluence).

M The Software Way

(SBU)

F4.02 The Contractor shall store all software code in NGA's Enterprise-managed version control (e.g. GitLab).

M The Software Way

(SBU)

https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%203020.26.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%203020.26.pdf https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw

ID # ITADE STATEMENT M/O

Derivative

Source

F4.03 The Contractor shall provide all service, application, software source code (new, modified, or sustained), and metadata in an NGA approved format.

M The Software Way

(SBU)

F4.04 The Contractor shall automatically test and build all service, application, software code, and metadata in an NGA approved format to ensure consistency, reduce human-related failures, and improve deployment cadence.

M The Software Way

(SBU)

F4.05 The Contractor shall document APIs using machine-readable documentation, and document related API metadata in an NGA approved format. This data shall be justified and documented in NGA's Enterprise-managed Registry (e.g. Kong).

M The Software Way

F4.06 The Contractor shall document code changes and product decisions. This data shall be stored in NGA's Enterprise-managed work tracking tools, and structure work in a consistent actionable format. Product decisions are justified and documented within NGA’s Enterprise-managed collaboration and work tracking tools (e.g. Confluence, Jira).

M The Software

F4.07 The Contractor shall register API endpoints, not to include private APIs that are specific to operations within the team, and this data shall be stored in NGA's Enterprise-managed API gateway (e.g. Kong).

M The Software Way

(SBU)

F4.08 The Contractor shall deploy their application(s) to the desired environment(s), using NGA's Enterprise-managed Platform-as-a-Service (e.g. OpenShift).

M The Software Way

(SBU)

F4.09 The Contractor shall utilize NGA's Enterprise-managed continuous monitoring service to monitor their status across environments unless otherwise noted. The data shared includes:

1. Services to monitor their Product-specific availability metrics (percentage service-level indicator)

2. Services to monitor their Product-specific availability status (i.e. up/down indication)

3. Product-specific lead time for changes and deployment frequency in production environments

M The Software Way

(SBU)

https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw

ID # ITADE STATEMENT M/O

Derivative

Source

F4.010 The Contractor shall utilize NGA's Enterprise-managed workflow orchestration (e.g. Argo) to automate task, workflow, and job creation, as well as binding workflows to event sensors to trigger workflows based on asynchronous message traffic or ad-hoc API calls.

M The Software Way

(SBU)

F4.11 The Contractor shall utilize NGA's Enterprise-managed messaging (e.g. Pulsar) to asynchronously communicate between services and facilitate producers to publish messages to a queue and one or more consumers to subscribe to message traffic on the queue.

M The Software Way

(SBU)

F4.12 The Contractor shall engage with real and/or expected users to identify and understand users’ underlying needs, as well as learn how the software product or service will fit into users’ work. That information shall be recorded in NGA's Enterprise-managed collaboration and work tracking tools (e.g. Confluence, Jira).

M The Software Way

(SBU)

F4.13 The Contractor shall ensure that the software product has a documented product vision within NGA’s Enterprise-managed collaboration tools (e.g.

Confluence).

M The Software Way

(SBU)

F4.14 The Contractor shall ensure User personas are known and defined within NGA’s Enterprise-managed collaboration tools (e.g. Confluence).

M The Software Way

(SBU)

F4.15 The Contractor shall publish an understandable and discoverable roadmap to NGA’s Enterprise-managed work tracking or collaboration tools (e.g. Jira, Confluence).

M The Software Way

(SBU)

F4.16 The Contractor shall define and share a minimum viable product (MVP) in NGA's Enterprise-managed collaboration and work tracking tools.

M The Software Way

(SBU)

F4.17 The Contractor shall break down the MVP into actionable work items that are easily understood by the entire team.

M The Software Way

(SBU)

F4.18 The Contractor shall gather feedback from users as early as possible using mockups or interactive prototypes.

M The Software Way

(SBU)

https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw

ID # ITADE STATEMENT M/O

Derivative

Source

F4.19 The Contractor shall provide ways to respond to user reports. Support issues shall be tracked and follow a tiered model, making it back to the development team for further assessment and prioritization by the product manager in the backlog.

M The Software Way

(SBU)

F4.20 The Contractor shall utilize NGA ESC Tier 0 and Tier 1 Capabilities tiered model to respond to user reports. Tier 2 and Tier 3 support issues should be tracked and referred to the development team for further assessment and prioritization by the product manager in the backlog.

M The Software Way

(SBU)

F4.21 The Contractor shall ensure defect or issue status in the team’s work tracker is available to other NGA teams, users, and customers for transparency.

M The Software Way

(SBU)

F4.22 The Contractor shall grant visibility into how a product is working through application performance monitoring. White-box (internal telemetry — metrics, logs, traces) and black-box (external behavior) monitoring shall be automated and continuously running.

M The Software Way

(SBU)

F4.23 The Contractor shall have automatic alerts to notify an on-call engineer and Enterprise Service Center when there are outages or anomalies, as well as integrate with NGA's Enterprise monitoring tools.

M The Software Way

(SBU)

F4.24 The Contractor shall incorporate tools and continuous ways to measure how a product is performing for users and meeting their mission needs (e.g. NGA’s Enterprise-managed feedback collection tool and analytics platform).

M The Software Way

(SBU)

F4.25 The Contractor shall document and respond to changes in user needs, technology, or government policy throughout the lifetime of the product in order to make substantial improvements within the term limit of the contract.

M The Software Way

(SBU)

https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw

ID # ITADE STATEMENT M/O

Derivative

F4.26

The Contractor shall provide metrics for each of the software products they maintain that are delivered to users. Said metrics shall include Availability, Lead Time for Changes, Deployment Frequency, and Product Specific Metrics as defined in the NGA Software Way and shall be delivered in the formats specified in the NGA Software Way Metrics Data Item Description

(DID).

M The Software

NGA Software Way Document

(SBU)

F4.27 The Contractor shall provide Interface documentation in accordance with the Contract Data Requirements List (CDRL) and DID.

M The Software Way

F4.28

The Contractor shall automatically track deployment frequency and lead time for changes in lieu of reproducing/reformatting information by maximizing the use of NGA’s Enterprise-managed automated Continuous Integration/Continuous Deployment (CI/CD) service.

M The Software

NGA Software

(SBU)

F4.29 The Contractor shall use NGA’s Enterprise-managed automated CI/CD service (e.g. Gitlab Continuous Integration (CI))-SonarQube, Fortify, Threadfix, Open Web Application Security Project (OWASP)).

M The Software Way

(SBU)

F4.30 The Contractor shall add technical documentation using OpenAPI standards via NGA recommended software (i.e Swagger) for easy and standardized documentation and for standardized data access methods.

M The Software Way

(SBU)

F4.31 The Contractor API documentation should be made available on all domains where the API is available to provide a consistent place for finding and using APIs.

M The Software Way

(SBU)

F4.32 The Contractor shall document the most current version architecture designs of all operational, development and test systems along with all of the data sources that are used within the systems.

M The Software Way

(SBU)

F4.33 The Contractor shall document all technical decisions (i.e., the implementation of releasability, math models in image translation, etc.). All of this documentation shall be stored in NGA’s identified work tracking or version control systems, and must be easily and more discoverable.

M The Software Way

(SBU)

https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw

ID # ITADE STATEMENT M/O

Derivative

Source

F4.34 The Contractor shall ensure all documentation must live in NGA’s work tracking or version control systems, not Contractor factories, and must be easily and consistently discoverable.

M The Software Way

(SBU)

F4.35 The Contractor shall provide explicit API documentation for system-to-system interfaces.

M The Software Way

(SBU)

F4.36 The Contractor shall register all development, test and operational machine learning models, to include the data that models are trained on for traceability, consistency, expected behavior, and unintended biases.

M The Software Way

(SBU)

F4.37 The Contractor shall have one Product Owner and a Scrum master for each Scrum team.

M The Software Way

(SBU)

F4.38 The Contractor shall deliver all capabilities using the CORE as determined by the Government and where appropriate using Government approved techniques or methodologies (e.g. SAFe).

M The Software Way

(SBU)

F4.39 The Contractor shall obtain access to interface reuse candidate widgets, scripts, apps, applications, APIs, and services.

M API

Governance Document

(SBU)

F4.40 The Contractor shall acquire and maintain an enterprise API Management registration on the Developer Portal (i.e. the API Registry).

M API

Governance Document

(SBU)

F4.41 The Contractor shall provide Interface documentation in accordance with the CDRL format(s). CDRLs related to interfaces and APIs may include, but are not limited to:

Swagger File, Service Descriptions, Interface Control Documents, Service Specifications, Web Service Descriptions Language, eXtensible Markup Language Schema Definition, Test Acceptance Criteria, Test Results, Test Plans and Scripts, Technical Operating Procedures, Discovery & Retrieval updates, Service Dictionary.

M API

Governance Document

(SBU)

https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://usms.nga.mil/confluence/x/mmLhBw https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html

ID # ITADE STATEMENT M/O

Derivative

Source

F4.42 The Contractor shall deliver all capabilities using the NGA Enterprise DevSecOps environment(s) as determined by the Government and where appropriate using Government approved techniques or methodologies such as the SAFe, API first or adaptive maintenance.

M API

Governance Document

(SBU)

F4.43 The Contractor shall ensure that developed APIs are routed through NGA’s Enterprise API Management Platform (AMP) and registered in the Enterprise API Registry which resides within the AMP.

M API

Governance Document

(SBU)

F4.44 The Contractor shall ensure that progress is tied to the completion of features and not the completion of time boxed events such as sprints for a given reporting period.

M NGA Software Way Document

(SBU)

F4.45 The Contractor shall establish the level of effort that occurs in their system and consistently update the estimated effort to complete each feature based on progress.

M NGA Software Way Document

(SBU)

F4.46 The Contractor shall seek approval from the PM and/or product manager for removal or addition of any feature-level or higher item from or to the backlog.

M NGA Software

4.4.1 Additional Information

NGA expects software product teams to have a trained government product manager who has completed the agency’s product management training. If there isn’t one, contractors are encouraged to request one.

4.5 Cost Management

This ITADE table describes the Government’s process in acquiring cost and financial performance data from the Contractor to enable NGA direction/oversight of Contractor activities and long-term planning. The Contractor currently provides the Government cost information with formal CDRLs (e.g., Contractor Performance Report Formats 1-5, Cost & Technical Data Report (CTDR)) and informal deliverables (e.g., monthly Program Management Reviews & Business Management Reviews, and other cost/technical information as required in support of their cognizant Government https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://devcorps.pages.gs.mil/Documentation/standards/api_guidance.html https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf https://www.nga.mil/assets/files/The_NGA_Software_Way.pdf

Program office). Program offices tailor developer/Contractor cost and productivity reporting requirements to meet the needs of the individual programs. This ITADE does not prescribe new or additional CDRLs to NGA Contractors; rather, it articulates, at a macro level, the current process and emphasizes the need for the Government to tailor cost monitoring/management requirements to the needs of individual programs, NGA Integrated Programs Offices, and Enterprise Cost Management, as required.

Table 8: Cost Management ITADEs

Derivative

Source

F5.01 The Contractor shall provide cost management documentation, including cost, funding and hours status report, cost risks, and cost performance assumptions to the Government.

F5.02 The Contractor shall provide cost CDRLs as required, in accordance with the contract.

M NGAI 5000.1

(SBU)

F5.03 The Contractor shall update cost documentation throughout the program lifecycle as changes arise in accordance with the contract, in the manner outlined in the most current publication of the NGA Data Strategy, which includes GEOINT and Corporate Mission Data.

NGA Data_ Strategy

4.5.1 Additional Information

1. The CTDR CDRL in the Request For Proposal reduces the cost to collect data throughout the contract and provides better data quality. If ODNI is going to request the data during contract execution at extra cost, it is better for NGA to have it in advance for Agency Cost Position development (Reference: The Intelligence Community Standard (109-03) - Information Technology and Software Data Collection).

2. The Office of Cost Assessment and Program Evaluation (D/CAPE) shall coordinate with program management offices to place data collection requirements on contract and validate resulting data. (Reference: NGAI 7530.1; 9.g).

3. The CTDR CDRL is currently optional for all NGA Development or Systems Acquisitions contracts, including those greater than $50M This Year (TY). The CTDR CDRL template is an acquisition best practice and is consistent with NRO/CAAG CTDR (N42.1171) as well as DoDI 5000.02 and 5000.73 which require Contractor https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf https://web.intranet.nga.mil/org/d/DX/DXC/DXCI/Policy%20Library/NGAI%205000.1.pdf https://home.nga.mil/assets/files/NGA_Data_Strategy_Digital__PR_APPROVED_21-873_093021.pdf#search=Data%20Quality https://home.nga.mil/assets/files/NGA_Data_Strategy_Digital__PR_APPROVED_21-873_093021.pdf#search=Data%20Quality

Cost Data Reports on all contracts greater than $50M (TY). (Reference: NGA

CTDR).

4.6…