Foundation Sustainment Support, Software and Integration (FS3i)

Form / Attachment / Pricing Sheet

This document is a Contract Data Requirements List (CDRL) A007, specifically a Government Furnished Property (GFP) / Material List. It details various IT equipment and their associated asset tags, manufacturers, models, serial numbers, and locations.

• Lists numerous IT assets including Core Routers, Encryptors, Printers, Thick Clients, Thin Clients, Monitors, KVMs, and IP Phones.
• Provides specific details for each asset such as Asset Tag, Manufacturer, Model, External Serial Number, Site, Building, Floor, Room/Cube, and Classification (e.g., SBU, TS/SCI, U).
• Includes summary tables of asset counts by type and classification.

This document is crucial for bidders to understand the scope and nature of Government Furnished Property (GFP) that will be provided as part of the contract. It helps in assessing the logistical and technical requirements associated with managing and utilizing this property. Bidders can use this information to plan for integration, maintenance, and accountability of the provided assets.

Other / Unclassified

This document is the Version Description Document (VDD) for the Aeronautical Application Suite (AAS) Version 1.2.170.3. It details the software components delivered for this version, including build artifacts for deployment, any known issues, and changes included in this software version. The AAS is a cloud-based upgrade that combines legacy aeronautical desktop applications into a modernized cloud-based web production system used to collect, update, store, maintain, and produce worldwide aeronautical data.

This document provides technical details about a specific version of the AAS software. It outlines the system overview, deployment environment (NGA Kubernetes Environment utilizing OpenShift, AWS RDS for databases), software components (including custom code, COTS, and open-source libraries), and installation instructions (via NGA CORE services GitLab CI/CD pipeline). It is relevant for bidders who may be involved in the sustainment, development, or integration of the AAS system, providing insight into its architecture, dependencies, and deployment strategy.

Other / Unclassified

This document outlines the National Geospatial-Intelligence Agency's (NGA) FS3i Incident Notification Process (IPF INC Notification Process). It details the procedures for managing and resolving incidents within the IPF systems.

This document is relevant to potential bidders as it describes the internal processes for incident reporting, tracking, and resolution. Understanding these processes can help vendors anticipate how their systems or services might interact with NGA's operational workflows, particularly concerning issue reporting and maintenance. Key aspects include:

• Incident Prioritization: Defines processes for Priority 1 (Critical) and Priority 2 (High) incidents.
• Notification Procedures: Outlines immediate notification requirements via email to stakeholders and regular update schedules.
• Resolution Process: Details the steps for troubleshooting and resolving incidents, including escalation to different support tiers (Tier 1, Tier 2, Tier 3).
• Root Cause Analysis (RCA) & Lessons Learned (LL): Describes the post-resolution process for analyzing incidents, identifying root causes, and implementing corrective actions or improvements.
• Templates: Provides templates for RCA/LL, which bidders might encounter or need to contribute to if their solutions are involved in incidents.

Form / Attachment / Pricing Sheet

This document establishes a standard for tagging EC2 and RDS resources within the IPF (Integrated Platform Framework) to facilitate predictable and uniform cost allocation and oversight. It defines mandatory and conditional tags, their objectives, and required value formats.

• FundingSource: Mandatory tag for the organization paying for the resource. Value format: Agency:Top Level Division:Office (e.g., NGA:S:SFN).
• BillingPOC: Mandatory tag for the group email of the organization paying for the resource. Value format: Email addresses separated by colons, starting with an organizational box (e.g., some-orgainization@nga.mil:somebody@nga.mil).
• Org: Mandatory tag for the organization owning the resource. Value format: Agency:Top Level Division:Office (e.g., NGA:S:SFN,NGA:S:SFG).
• Project: Mandatory tag for the project consuming the resource. Value format is defined and enforced by the organization.
• AdminTeam: Mandatory tag for the team administratively responsible for the resource. Value format: Email addresses separated by colons, starting with an organizational box (e.g., some-orgainization@nga.mil:somebody@nga.mil).
• Disposition: Conditional tag explaining the resource's state. Value format is defined and enforced by the organization.

Bidders responding to opportunities involving IPF EC2 and RDS resources must understand and adhere to these tagging standards. This document outlines the specific mandatory tags and their required formats that will likely need to be incorporated into proposals or implemented post-award for cost allocation and resource management purposes.

Solicitation / RFP / RFQ

This document is an overview presentation for the Foundation GEOINT Operation & Sustainment Support, Software, Hardware, and Integration (FS3i) Industry Day. The FS3i effort is the follow-on to FS2 and focuses on operations, sustainment, and integration for the Foundation GEOINT's Mapping, Charting, and Geodesy (MC&G) mission. It includes software development, engineering (cloud, architecture, cybersecurity, configuration), and procurement of COTS hardware and software. The goal is modernization and automation to improve performance and cost delivery over a 7-year performance period.

The FS3i scope includes:

• Software Development: Enhancing MC&G mission value.
• Integration: Integrating FS3i capabilities into MC&G and NGA enterprise architectures.
• Software Maintenance: Maintaining legacy codebases.
• Operations & Sustainment: Operating and sustaining FS3i capabilities.
• Foundation GEOINT IT Procurement: Acquiring select IT physical equipment.
• Foundation GEOINT COTS and Common Services Procurement: Acquiring select IT COTS software.

Improvements sought include faster technology deployment, better AI/ML integration, increased cost efficiencies, and improved system performance monitoring.

Specific task orders will address:

• COTS Software and Common Services

• Air (Aeronautical GEOINT)

• Sea (Maritime GEOINT)

• Science (Geodetic, Geophysical, Photogrammetric Sciences)

• Land (Topographic, Human Geography, Geographic Names)

• Dissemination

• Performance Period: 7 years.

• Estimated Timeline:

  • Draft RFP Release (Common Svcs & Air): January 5, 2026
  • Questions Due: January 23, 2026
  • Industry Day(s): February 2-3, 2026
  • Final RFP Release: June 2026 (TBR)
  • Proposals Due: August 2026 (TBR)
  • Contract Award Target: December 2026

Industry Day provides opportunities for Q&A and teaming. Key questions submitted by January 23, 2026, will be addressed. Responses to all questions will be posted via SAM.gov.

Not specified in this document.

This presentation was delivered on February 2-3, 2026. It outlines the program vision, organization, mission overview, FS3i background, scope, structure, and task orders. The industry day aims to provide understanding, gather feedback, gauge readiness, and facilitate teaming.

Form / Attachment / Pricing Sheet

This document is a Data Item Description (DID) for a Cost & Technical Data Report (CTDR). It serves as a guide for providing information technology (IT), software, and ground segment cost and cost-related data for programs, as defined in Intelligence Community Directive (ICD) 109, “Independent Cost Estimates". The CTDR is intended to accompany an MS Excel™™ file template (NGA-CTDR-Template-Final_(U)) for data submission.

• Data Use: Data is used for IC resource analysis, cost estimating tools/methods, Analysis of Alternatives (AoA), and life cycle cost estimates.
• Data Provider: The person or contractor completing the workbook.
• Submission Process: Data workbooks are submitted to NGA CAPE, with feedback provided within 30 business days.
• Data Collection Intervals: Typically annual, but may be requested after major software releases.
• Data Delivery Format: Electronic media compatible with Microsoft Excel™™ or Word™™, with potential for alternative submissions like Bill of Materials or Agile system exports.
• Data Content: Actual data values required, not estimates. Datasheets should be organized according to NGA CAPE Cost Element Structure (CES) or contractor's Work Breakdown Structure (WBS).
• Data Format: Cost data in current or then-year dollars; dates in MM/DD/YYYY format.
• Contact Information: Each sheet requires preparer's name, secure/non-secure phone numbers, organization, email, date provided, and 'as of' date.
• Color Coding: Differentiates title fields (dark blue), data entry cells (light blue), dropdown lists (orange), and calculated cells (peach).
• Program Information: Captures top-level data including Program Name and Functions.
• Contract Information: Details prime and sub-contracts, including company name, location, contract type, dates, value, subcontract percentage, and contract numbers.
• Work Breakdown Structure (WBS): Captures contractor cost/effort at the WBS level.
• COTS-GOTS: Captures hardware, Commercial Off-The-Shelf (COTS), and Government Off-The-Shelf (GOTS) data.
• Agile Measures & Agile Detail: Captures sizing and effort data for Agile software development.
• Code Counts: Measures program size by counting lines of code using the Unified Code Counter - Government (UCC-G).
• Data Management: Captures data management information, including migration and conditioning efforts.
• Database: Captures database data, including platform, tables, fields, and records.
• Discrepancy Reports (DR): Records changes from the existing baseline due to errors.
• Appendix: Includes an acronym list.

This document is crucial for bidders as it outlines the specific data requirements for cost and technical reporting. Understanding these requirements will help bidders prepare accurate and compliant proposals, particularly concerning cost estimation, technical data, and program performance metrics. It details the format, content, and submission process for critical program data, enabling bidders to align their project management and reporting strategies accordingly.

Other / Unclassified

This document is a Department of Defense Instruction (DoDI) 5000.87, titled "Operation of the Software Acquisition Pathway." It establishes policy, assigns responsibilities, and prescribes procedures for the efficient and effective acquisition, development, integration, and timely delivery of secure software.

While this document is a policy instruction and not a solicitation, it outlines the DoD's approach to acquiring software. Bidders involved in DoD software development contracts should understand this pathway, which emphasizes:

• Iterative and Agile Development: Focus on rapid, iterative development using modern methodologies (e.g., agile, DevSecOps).
• Two Pathways: Distinguishes between "applications" (running on commercial hardware/cloud) and "embedded software" (integrated into weapon systems).
• User Engagement: Stresses active collaboration with end-users throughout the lifecycle.
• Cybersecurity Integration: Mandates cybersecurity and program protection from inception.
• Streamlined Processes: Aims to bypass traditional JCIDS processes for faster delivery.
• Phased Approach: Outlines distinct Planning and Execution phases with specific activities and deliverables.

Understanding this instruction can help vendors align their proposals and development practices with DoD's current software acquisition strategy.

Instruction

This NGA Instruction (NGAI) 5401.1 establishes policy, assigns responsibilities, and provides procedures for complying with privacy and civil liberties responsibilities. It aims to protect Personally Identifiable Information (PII) entrusted to the National Geospatial-Intelligence Agency (NGA) and ensure that NGA effectively addresses privacy and civil liberties concerns in all its authorized missions and functions.

• Establishes a comprehensive framework for protecting PII.
• Assigns responsibilities for privacy and civil liberties compliance.
• Outlines procedures for handling PII, including collection, use, maintenance, and dissemination.
• Details policies for privacy impact assessments (PIAs), system of records notices (SORNs), and breach response.
• Rescinds previous NGA manuals and instructions related to privacy, PII handling, and breach response.

This document is an internal agency instruction and does not contain contract details relevant to external bidders.

Not applicable. This document outlines internal NGA policies and procedures.

Not applicable.

• Applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors.
• Emphasizes that NGA collects, uses, and disseminates PII only when legally authorized, directly relevant, and necessary.
• Outlines specific responsibilities for various NGA directorates and personnel, including the Director, CIO, and legal counsel.
• Details procedures for Privacy Threshold Analysis (PTA), PIA, SORN creation/modification, and Privacy Act Statements (PAS).
• Includes procedures for NGA Breach Response and Reporting.

Other / Unclassified

This document establishes the Information Platform Foundation (IPF) standards for managing Amazon Web Services (AWS) instance types, specifically focusing on EC2 instances, EBS volumes, and RDS instances. The primary goals are to ensure vendor currency and cost efficiency within IPF's AWS cloud environments by mandating the use of the newest generation of instance types and specific CPU architectures where applicable.

This standard dictates how IPF will manage its AWS resources, which may impact the types of services or configurations bidders need to support or propose. Key points for bidders include:

• Newest Generation Mandate: All EC2, EBS, and RDS instances must use the newest generation within their respective families for cost efficiency. Bidders should be aware of and capable of supporting these latest generations.
• CPU Architecture: While Intel and AMD (x86) are generally preferred for EC2 due to compatibility, IPF mandates the deployment of new RDS instances on AWS Graviton (ARM) instances for price-performance benefits. Bidders offering RDS solutions must be prepared to utilize Graviton or justify exceptions.
• Cost Efficiency: The standard emphasizes using cost-efficient instance types. Bidders should factor this into their pricing and solution design.
• Exception Process: If a technical limitation prevents adherence to the newest generation or Graviton mandate, a documented exception with the Program Manager is required, including specific tagging (instance_type_exception) and a description of the reason.
• EBS Volumes: The standard requires using the latest generation of General Purpose SSD (gp3) EBS volumes, migrating existing volumes if necessary.
• EC2 Graviton Restriction: IPF explicitly states not to utilize Graviton instance types for EC2 due to potential capability and compatibility issues, preferring the newest Intel or AMD generations instead.

Other / Unclassified

This guide provides high-level information on containerization service options within the NGA/AWS Cloud environments, aiming to help decision-makers select the best strategy based on cost, schedule, and performance constraints.

It details three primary options:

• CORE OpenShift (KubIC): A Platform-as-a-Service (PaaS) offering based on RedHat's OpenShift Container Platform (OCP). It's suitable for developers who want to containerize applications without managing AWS resources or needing an AWS account. KubIC acts as a Common Control Provider (CCP), potentially accelerating the Authorization to Operate (ATO) process through inherited security controls and an "ATO in a Day" (AiaD) program. It also aligns with NGA's Software Way and offers integrated CI/CD templates.

  • Considerations: Onboarding can be complex, documentation may not always be up-to-date, costs need upfront estimation via a chargeback model, not all applications qualify for AiaD, and operational support is less robust than AWS.

• AWS Elastic Container Service (ECS): A fully managed container orchestration service designed for ease of deployment, management, and scaling. It's integrated with AWS tools and supports serverless options via Fargate. ECS is recommended for quick deployments or when simplicity is preferred over EKS.

  • Considerations: Offers less flexibility for fine-tuned control, is less suited for hybrid/multi-cloud strategies, has a longer ATO/cybersecurity review process compared to KubIC, but benefits from strong AWS ecosystem support and well-defined SLAs for operational support.

• AWS Elastic Kubernetes Service (EKS): A managed service that removes the need to operate a Kubernetes control plane. It's ideal for migrating existing Kubernetes workloads, building hybrid/multi-cloud environments, or when deeper control is needed. It also supports serverless options via Fargate.

  • Considerations: Higher operational overhead due to Kubernetes complexity, a steeper learning curve, potentially higher costs than ECS (including control plane charges), better suited for complex microservices architectures, and has a longer ATO/cybersecurity review process. Benefits from robust AWS and NGA operational support.

The document mandates that all new applications/microservices should first evaluate deployment into AWS containerization services (ECS or EKS, with or without Fargate). Justification is required for not developing in AWS Containers. EKS is for those comfortable with complexity, while ECS is for simplicity. Moving to OpenShift requires a meeting with the IPF Transition & Integration Team and written approval. Non-containerized development also requires approval. Migration of existing systems to container-based solutions is encouraged for long-term systems. This guide is crucial for bidders to understand the preferred containerization strategies and the associated decision-making process for developing or migrating applications within the NGA/AWS environment.

Other / Unclassified

This document, "(U) NGA IT ADE_Rev F_Draft," outlines the Information Technology Acquisition Design Elements (ITADEs) for contracts with the National-Geospatial Intelligence Agency (NGA). It serves as a standardized set of statements derived from governing policies, procedures, and standards, tailored for NGA's IT environment. The ITADEs are intended to be incorporated into acquisition packages to ensure technical and organizational operability, supporting NGA's mission of providing Geospatial Intelligence (GEOINT) to various stakeholders.

This Revision F introduces significant changes, including new sections on IT Accessibility (Section 508) and IT Asset Management. The document has also been reorganized alphabetically for easier navigation, and statement identifiers now include the letter 'F' to denote this version. It is reviewed and updated at least annually.

This document is crucial for potential bidders as it details the mandatory and optional requirements that will be incorporated into NGA IT acquisition packages. It provides specific guidance on various IT domains, including:

• Architecture: Requirements for developing and updating architecture artifacts.
• Capacity & Mission Performance: Needs for volumetric, timeline, and engineering data for performance assessments.
• Continuity & Resilience: Requirements for business continuity and IT contingency planning.
• CORE & The NGA Software Way: Standards for building, purchasing, and operating software.
• Cost Management: Government processes for acquiring cost and financial performance data.
• Data Architecture: Requirements for data architecture artifact development.
• Enterprise Management: Guidance on interfacing with the Enterprise Service Center (ESC) and compliance monitoring.
• GEOINT Data Standards: Responsibilities for GEOINT data and services standards selection and implementation.
• Infrastructure – NGA Cloud Service: Requirements related to NGA's cloud environment.
• IT Accessibility (Section 508): Mandates for ensuring Information and Communication Technology (ICT) is accessible.
• IT Asset Management: Methods for controlling the IT operational baseline and managing electronic waste.
• Schedule Management: Government processes for acquiring scheduled deliverables.
• Security (Policy and Implementation): Required security processes, activities, and deliverables.
• Systems Engineering: Guidance for development contractors on SE processes.

Bidders must review these ITADEs to understand the specific technical and programmatic requirements that will apply to any contract awarded under this framework. The document also provides contact information for questions regarding its validity or applicability.

Other / Unclassified

This document, "The NGA Software Way," outlines the National Geospatial-Intelligence Agency's (NGA) approach to developing, delivering, and operating software products. It details key metrics and elements that NGA and contractor teams must adhere to, aiming to improve software delivery speed, consistency, and user satisfaction.

This document is relevant to potential bidders as it defines the operational and development standards expected for software products used by or developed for NGA. Understanding these requirements is crucial for vendors to align their proposals, technical approaches, and team capabilities with NGA's expectations. Key areas include:

• Software Metrics: Focus on Availability, Lead Time for Changes, Deployment Frequency, and Product-Specific Metrics. Bidders should consider how their proposed solutions will meet or exceed these metrics.
• The NGA Software Way Elements: A 13-element framework covering:
  • Before Writing Code: Product management, understanding user needs, and prioritizing value.
  • Beginning and Throughout Development: Version control, work tracking, automated testing, and API documentation.
  • First Deliverable to a User: Support and feedback mechanisms, automated deployments, and automated monitoring.
  • As You Iterate: Automated alerting/incident response, data-driven decisions, and continuous iteration.
• Current NGA Tools: Lists specific tools and platforms (e.g., GitLab, Jenkins, Jira, Confluence) used by NGA for software development and operations. Bidders should be aware of these tools and their potential integration requirements.

Other / Unclassified

This document is the National Geospatial-Intelligence Agency (NGA) Manual NGAM 4160.1, "Accountability and Management of Property, Plant, Equipment, and Other Accountable Property." It outlines responsibilities and procedures for managing government property throughout its lifecycle, from acquisition to disposal. The manual details the use of the PeopleSoft Asset Management (PS-AM) system as the Accountable Property System of Record (APSR) and applies to NGA civilian employees, military service members, other government agency personnel assigned to NGA, and contractors.

While this document is a comprehensive manual on property management and does not directly solicit bids, it is highly relevant for contractors who will be managing or interacting with government property. Specifically, bidders should note the following:

• Contractor-Acquired Property (CAP) and Government-Furnished Property (GFP): Enclosure 11 details the accountability and responsibilities for CAP and GFP, including contractor requirements for reporting, inventory, and disposition.
• Property Management Systems: The manual emphasizes the use of PS-AM and other systems for tracking and managing assets, which contractors will likely need to interface with.
• Roles and Responsibilities: Understanding the roles of Property Administrators (PAs), Contracting Officers (COs), and Contracting Officer Representatives (CORs) in property management is crucial for contract compliance.
• Disposition of Assets: Enclosure 10 outlines procedures for the disposition of excess property, which may be relevant if a contract involves the return or disposal of government assets.
• Audits and Inventories: The manual details procedures for inventories and audits, which contractors may be subject to.

Contractors should familiarize themselves with these procedures to ensure compliance with NGA's property management requirements throughout the life of any contract.

Form / Attachment / Pricing Sheet

This document, "Annex C: CAMG Charter Version 5.0," dated September 30, 2016, outlines the charter for the Cloud Adoption Management Group (CAMG) within the National Geospatial-Intelligence Agency (NGA).

• Purpose of CAMG: To operate as a forum focusing on cloud adoption activities within the Intelligence Community (IC) ITE, Secret, and Unclassified environments, ensuring alignment with the NGA Cloud Strategy and federal guidance.
• Functions: Includes serving as the NGA organization for cloud adoption, communicating the cloud strategic vision, fostering collaboration, providing oversight of implementation tasks, and facilitating senior leadership decision-making.
• Responsibilities: Details the CAMG's role as NGA's oversight body for cloud adoption, its accountability for cloud-based operating model outcomes, and its function in orchestrating cross-cutting business management processes for cloud operations.
• Board Responsibilities: Outlines the governance board's role in addressing cloud implementation challenges, reconciling issues, making decisions, communicating actions, and providing recommendations.
• Chairperson Responsibilities: Defines duties related to documenting deliberations, coordinating actions, providing secretariat support, and approving meeting outcomes.
• Meetings: Specifies that the full CAMG board meets at least monthly, with the Chair having discretion for special sessions.
• Effective Date & Review: The charter is effective upon signature by the Director of the Office of the Chief Information Officer and IT (OCIO-T) and is subject to annual review.

This charter provides insight into the organizational structure and governance for cloud adoption within NGA. Understanding the CAMG's purpose, responsibilities, and functions can help bidders align their proposals and solutions with NGA's strategic cloud objectives and operational framework. It highlights the importance of cloud strategy, implementation oversight, and stakeholder coordination within the agency.

Other / Unclassified

This document is the Version Description Document (VDD) for the Geospatial Terminals Operations (GTO) Program-Aeronautical Automated Charting and Encoding (ACE) Software, version 1.0.28. It details the software components delivered with this version, including build artifacts for deployment, known issues, and changes included in the software version.

This document provides technical details about a specific software version (1.0.28) of the ACE system. It outlines:

• System Overview: ACE is a NGA-licensed, next-generation aeronautical chart management solution that automates chart production from various data sources, aiming for publication-quality charts with minimal user refinement and reduced maintenance costs.
• Deliverables: Includes NGA Production Source Code, GTO Production Chart Management, Microfocus Fortify scan files, Web Deployment Installation Notes, Release Notes, and an SSD Specification.
• Deployment Environment: Specifies the required server environment (Windows 2016 R2 or higher) and prerequisite software packages (e.g., PostgreSQL, Apache Web Server, Java Runtime Environment).
• Software Components: Lists the specific software versions and vendors for ACE and its dependencies.
• Installation Instructions: Provides guidance on installing ACE within NGA's COE environment, including its connection to external and internal databases.

This information is relevant for potential bidders who may need to understand the technical specifications, deployment requirements, and software architecture of the ACE system if it is part of a future procurement opportunity.

Amendment / Modification

This document is an addendum (Version 4) to the Foundation Sustainment Services (FS2) contract HM047621D0009, specifically for the Aero Task Order PWS concerning the ACE/GTO Sustainment and Modernization project.

• Purpose: To provide Operations & Sustainment (O&S) services for modernizing the Automated Charting and Encoding (ACE) software for aeronautical Geospatial Terminal Operations (GTO). It also covers assuming O&S of the existing legacy COE On-Prem system until the cloud-hosted system is complete.

• Scope: Services include migrating the refactored ACE/GTO capability to the NGA cloud environment, providing cybersecurity support for the current system, facilitating software approvals and installation, testing, leveraging NGA GEOINT Services, performing configuration management, ensuring compliance with Risk Management Framework and cybersecurity requirements, provisioning virtual infrastructure, providing Zero-Trust support, and decommissioning the legacy system.

• Current State: The ACE/GTO system is currently FOC on COE SPID 61036 in the UDS environment at NDW, with manual maintenance updates.

• Execution Phases: The project outlines a four-phase approach: On-premise Operations and Application Refactoring, Migrate Software to the Cloud, Maintain Software in the Cloud, and Transition Out Period.

• Contract Requirements: The contractor must comply with various NGA standards and provide Program Management and Operations Support services.

• CDRLs: This addendum utilizes the CDRL list from the Base IDIQ, with specific CDRLs noted in each WBS section.

• Appendixes: Includes ACE/GTO Workflow, Performance Metrics, and Quality Assurance details.

• The document details the scope of services, execution phases, and contract requirements related to the ACE/GTO Sustainment and Modernization project.

• This addendum defines the scope and requirements for the ACE/GTO modernization effort, impacting how bidders should approach proposal preparation and execution for this specific task order.

Other / Unclassified

This document is NGA Instruction 8040.2, dated October 21, 2020, titled "Records Management Program." It establishes policy and assigns responsibilities for the NGA Records Management Program. The instruction rescinds a previous version from March 2016 and applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors.

Key aspects include:

• Policy mandates managing agency records throughout their lifecycle, transitioning to a fully electronic environment, and ensuring efficient creation, identification, protection, preservation, and proper disposal of records in all media.
• It outlines responsibilities for various NGA roles, including the Director, Senior Agency Official for Records Management (SAORM), Agency Records Officer (ARO), Chief of the Records Management Program (C/RMP), Director of Chief Information Officer and Information Technology Services (D/CIO-T), Director of Strategic Operations (D/OSO), General Counsel, Directorate Heads, Agency Element Leads, Primary Information Officers (PIOs), Information Officers (IOs), and all personnel.
• The document references numerous statutes, regulations, and other NGA and DoD instructions related to records management, information policy, and electronic records.

This instruction is relevant to potential bidders as it defines the framework and responsibilities for managing NGA's records. Understanding these policies and the roles involved can be crucial for contractors who will be handling NGA data or systems, particularly concerning data lifecycle management, electronic records, and disposition requirements. It highlights the agency's commitment to a digital environment and compliance with federal records management standards.

Other / Unclassified

This document outlines the "Federal Cloud Computing Strategy," also known as "Cloud Smart," which is an update to the previous "Cloud First" strategy. It provides guidance for Federal agencies to accelerate their adoption of cloud-based solutions. The strategy is founded on three key pillars: security, procurement, and workforce.

While this document is a strategy and not a solicitation, it provides critical context for vendors seeking to do business with the Federal Government in the cloud computing space. It details the government's approach to:

• Security: Emphasizing data-level protections, modern virtualized technologies, and a multi-layer defense strategy. It also discusses Trusted Internet Connections (TICs), Continuous Data Protection and Awareness, and the Federal Risk and Authorization Management Program (FedRAMP).
• Procurement: Highlighting the importance of category management, Service Level Agreements (SLAs), and security requirements for contracts. It encourages agencies to avoid vendor lock-in and to consider business continuity and disaster recovery plans.
• Workforce: Addressing the need for agencies to identify and address skills gaps, reskill and retain current employees, and recruit new talent with cloud computing expertise. It also emphasizes communication and transition strategies for employees.

Understanding this strategy can help vendors align their offerings and proposals with the government's priorities and requirements for cloud services.

Other / Unclassified

This document is the Version Description Document (VDD) for Air WebDVOF Version 6.0.1. It details the software components, features, build artifacts for deployment, known issues, and changes included in this software version. The WebDVOF is a web-based application for the production and dissemination of aeronautical products containing vertical obstruction data. It allows users to download predefined files and products, or submit custom queries for real-time generation of files and products.

This document provides technical details about a specific version of the WebDVOF software. It outlines the system overview, deployment environment (NGA KUBIC, OpenShift platform), software functionality, and an inventory of software components including COTS and open-source code. It also details changes installed, installation instructions (via NGA CORE GitLab CI/CD pipeline), and any known problems or errors. This information is relevant for understanding the technical specifications and current state of the WebDVOF system, which may be part of a larger opportunity or contract.

Other / Unclassified

This document is an "Instruction" from the National Geospatial-Intelligence Agency (NGA) titled "Information Security" (NGAI 5200.1). It establishes policy, assigns responsibilities, and provides procedures for the protection of classified national security information (CNSI) and unclassified information, including controlled unclassified information (CUI), at NGA. It rescinds a previous instruction from May 2017.

This document outlines the NGA's policies and procedures for information security, including the handling, safeguarding, and protection of classified and unclassified information. While it does not directly solicit bids or describe specific services, it establishes the security environment and requirements that contractors and personnel working with NGA information must adhere to. Understanding these security protocols is crucial for any potential bidder to ensure compliance with NGA's operational standards and to assess the security implications of any potential contract.

Instruction

This NGA Instruction (Number 5205.6, dated 16 October 2018) establishes policy, assigns responsibilities, and provides procedures for the development and implementation of Geospatial Protection Plans (GPPs). It prescribes protection standards and methodologies for Critical Program Information (CPI) throughout the lifecycle of Geospatial Intelligence (GEOINT) activities, including Research, Development, and Acquisition (RDA), technology transfers, and operational programs. The instruction aims to protect CPI and maintain NGA's strategic advantage.

• Establishes policy for GPP development.
• Prescribes protection standards and methodologies for CPI.
• Defines strategies and processes for identifying and protecting NGA information, technologies, and systems.
• Requires evaluation of environmental factors influencing phenomenology for protection.
• Mandates mitigation of phenomenology, program, and project risk.
• Ensures identification and protection of organic and horizontal CPI.
• Requires robust risk management and assessment processes.
• Integrates comprehensive security and counterintelligence functions.
• Identifies and mitigates risks to NGA's supply chain from foreign intelligence threats.
• Requires annual geospatial protection reviews and reassessments.

This document is an instruction and does not contain contract details such as period of performance or estimated value. However, it outlines procurement-related responsibilities for the Senior Procurement Executive (SPE) to ensure GPP compliance in solicitations (RFIs, RFPs) and contract clauses.

Not applicable, as this is an internal NGA instruction, not a solicitation.

Not applicable.

• This instruction rescinds NGA Directive (NGAD) 3330 and NGA Manual (NGAM) 3330.1.
• It applies to NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors.
• Enclosures include References, Responsibilities, Procedures, Process Flow Diagrams, and a Glossary.

Directive

This directive establishes the National System for Geospatial Intelligence (NSG) GEOINT Functional Manager Standards Assessment (GFMSA) program. The GFMSA program defines and implements methods and processes to assess and assert conformance of Information Technology (IT) and National Security Systems (NSS) with GEOINT data and service standards. This conformance is critical for achieving Interoperability Certification, based on validated capability requirements defined in the Net Ready Key Performance Parameter (NR KPP).

This directive applies to:

• NSG elements responsible for the operation, acquisition, and/or development of systems and applications that collect, procure, produce, serve, exchange, or use GEOINT content.

• New Start and existing IT and NSS, including Urgent Need/Quick Reaction/Joint Urgent Operational Need (JUON) and Urgent Operational Need (UON) activities that handle GEOINT content, where specifications are defined by standards for imagery, imagery intelligence, and geospatial information.

• Existing systems undergoing Incremental Upgrades that involve new data, products, or services defined by GEOINT standards.

• Programs, systems, or acquisitions that are users/consumers of GEOINT.

• GEOINT Functional Manager (GEOINT FM): Promotes collaboration, oversees the GFMSA process, incorporates assessment results into reports, advises on GEOINT standards, and resolves conflicts.

• Heads of DoD and IC components: Manage and integrate GFMSA into development and acquisition cycles, ensure T&E of system conformance, and submit self-assessment documentation.

• GFMSA Manager(s): Evaluate and assess IC/DOD compliance, administer the GFMSA process, and develop/maintain GFMSA manuals.

• Standards Conformance: NSG members and partners must ensure data and data services are compliant with DoD, IC, and NSG policies.

• Self-Assessment: GFMSA self-assessment results are required for review and inform requirements and interoperability certification authorities.

• Reporting: GFMSA-specific assessment results are incorporated into the GEOINT FM's Annual Report.

• Manuals: GFMSA manuals will define authoritative and consistent methods and processes for assessing GEOINT standards conformance.

• The NGA Office of Geospatial Intelligence Management (OGM) is responsible for administration.

• This Directive is approved for public release.

Other / Unclassified

This document is the Version Description Document (VDD) for the Second Level Oversight (SLO) Version 1.0.3, related to Foundation Sustainment Services (FS2) under Contract Number HM047621F0076. It details the software components delivered with Aero SLO Version 1.0.3, including build artifacts for deployment, any known issues, and changes included in this version. The SLO tool is a web-based application that monitors and stores logs of changes to aeronautical data, ensuring data accuracy through a double-blind entry process and allowing data export.

This VDD provides a comprehensive list of software components, their versions, vendors, and control numbers for Aero SLO Version 1.0.3. It outlines the deployment environment (NGA Kubernetes Environment utilizing OpenShift and AWS RDS), software functionality, and installation instructions (via NGA CORE services GitLab CI/CD pipeline). This information is crucial for understanding the technical landscape of the SLO system, its dependencies, and how it is deployed and maintained, which is relevant for bidders involved in or considering opportunities related to this system.

Other / Unclassified

This document is a Memorandum from the Director of the Office of Management and Budget (OMB) to the Heads of Executive Departments and Agencies, dated November 8, 2016. It outlines policies for Federal Agency Public Websites and Digital Services. The memorandum rescinds and replaces OMB Memorandum M-05-04.

This document establishes policies and requirements for federal agencies regarding their public websites and digital services. While not a solicitation or SOW, it provides context on the operational environment and standards that government agencies are expected to adhere to when developing or managing digital platforms. Understanding these requirements can be beneficial for vendors seeking to contract with federal agencies for digital services, web development, or IT support, as it highlights the government's expectations for usability, accessibility, security, and data management. Key areas covered include:

• Digital Governance: Agencies must establish plans for governing digital services.
• User Analytics and Feedback: Agencies should use data and user feedback to manage services.
• Searchability and Discoverability: Information must be easily searchable.
• Open Data: Agencies must disseminate data in a discoverable and usable format.
• Multi-Device Access: Services must perform well on various devices.
• Privacy and Security: Agencies must protect PII and implement security controls, including HTTPS.
• Accessibility: Compliance with Section 508 for individuals with disabilities is required.
• Plain Writing and Multilingual Content: Information should be clear and accessible.
• Mandatory Content: Specific links and information must be posted on agency websites.
• Domain Usage: Agencies must use approved .gov or .mil domains.

This memorandum sets the stage for how federal agencies are expected to operate their online presence, which can inform a bidder's understanding of potential contract requirements and government priorities in the digital space.

Other / Unclassified

This document is the Version Description Document (VDD) for ASE NOTAMS Version 1.0.1. It details the software components delivered with this version of the Aeronautical Source Environment (ASE) Notice to Airmen (NOTAM) application. The ASE NOTAMS application is a web-based system that replaces legacy NOTAMS desktop tools, utilizing modern frameworks and a cloud-based deployment. It interacts with Federal Aviation Administration (FAA) servers to retrieve NOTAM data.

This document provides technical details about a specific software version, including:

• System Overview: Describes the ASE NOTAMS application's purpose and architecture.
• Version Description: Outlines updates and improvements, such as bug fixes (e.g., saved query delete cancel button) and new features (e.g., geoaxis logout, Matomo code).
• Deployment Environment: Details the hosting environment (UC2S operational environment, OpenShift, AWS RDS).
• Software Functionality: Explains how users can query FAA NOTAM services, create data exports, and manage access.
• Inventory of Software Components: Lists the software configuration, including server and web client components, and their dependencies.
• Software Deliverables: Specifies the types of custom software packages and build artifacts to be delivered.
• Software List: Provides a detailed list of custom code, Commercial Off-The-Shelf (COTS), and Open Source code used in Version 1.0.1.
• Changes Installed: Mentions that this is an initial release and changes from previous versions are not recorded, but defects found during testing were resolved.
• Installation Instructions: States that components will be installed via a GitLab CI/CD pipeline, with manual installation instructions to be determined if needed.

This information is relevant for bidders to understand the technical baseline and components of the ASE NOTAMS system, which may be part of a larger opportunity.

Other / Unclassified

This document is an NGA Instruction (NGAI) Number 8955.6, titled "NGA Web Property Standards and Guidelines," with an administrative update dated May 13, 2020. It establishes policy, assigns responsibilities, and designates authorities for NGA web property standards and guidelines on enterprise domains. It rescinds a previous NGA Instruction from 2009.

This document outlines the National Geospatial-Intelligence Agency's (NGA) policies and standards for its web properties. While not a solicitation or SOW, it provides critical context for any contractor or personnel working with or developing NGA web properties. Key areas covered include:

• Policy: Establishing standards for compliance, style, and content for NGA web properties.
• Applicability: Applies to NGA civilian employees, military service members, other government agency personnel assigned to NGA, and contractors.
• Responsibilities: Details the roles of various NGA offices and personnel (e.g., CIO, D/CIO-T, D/TF, Office of Corporate Communications, Information Developers and Designers) in managing web properties.
• Guidance: Covers workflow processes, web design style, writing in plain language, copyright protections, accessibility (Section 508 compliance), analytics, security, search and discovery, and records management for NGA web properties.
• Online Resources: References a centralized location for style guides, design elements, and best practices, including specific URLs for different network environments (JWICS, SIPRNet, SBU).

Understanding these standards is crucial for contractors involved in web development, information dissemination, or any work that results in an NGA web property, ensuring compliance with NGA's operational and technical requirements.

Other / Unclassified

This document is DoD Directive 8140.01, titled "Cyberspace Workforce Management," effective October 5, 2020. It establishes the Department of Defense's framework for managing its cyberspace workforce.

Key aspects include:

• Authorization of a DoD Cyberspace Workforce Management Board (CWMB) to govern cyberspace workforce requirements.
• Establishment of the DoD Cyberspace Workforce Framework (DCWF) as the authoritative reference for identifying, tracking, and reporting DoD cyberspace positions and developing workforce qualifications.
• Unification of the overall cyberspace workforce, defining specific elements (e.g., IT, cybersecurity, cyberspace effects, intelligence, enablers) to align management under the CWMB.
• Outlines responsibilities for various DoD components, including the DoD Chief Information Officer (CIO), Under Secretaries, Directors, and Component Heads, in managing the cyberspace workforce, establishing qualification standards, and ensuring compliance.

This directive is relevant to potential bidders as it defines the structure, standards, and management approach for the DoD's cyberspace workforce. Understanding these requirements is crucial for contractors who provide services or personnel related to IT, cybersecurity, and other cyberspace functions within the DoD. It informs the types of qualifications, training, and certifications that may be required for personnel performing these roles, particularly in contracts involving acquisition, research and development, and operational support within the cyberspace domain.

Instruction

This instruction establishes policy and assigns responsibilities for the planning, management, execution, exercise, and maintenance of the National Geospatial-Intelligence Agency's (NGA) Continuity of Operations (COOP) Program. It governs all activities related to planning and preparation for the survival, continuity, recovery, and reconstitution of NGA's mission essential functions (MEF). This instruction rescinds a previous version from May 2018.

Applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors.

• Assures the resilience of NGA's people, processes, technology, and facilities supporting its MEF (task, collect, process, exploit, analyze, and disseminate geospatial intelligence).
• Employs a risk-based, enterprise-wide approach for survival, continuity, recovery, and reconstitution of essential functions following disruptions.
• Maintains the capability to respond, recover, and reconstitute NGA's business processes, IT systems, and human resources following undesirable events (UDEs) through continuity plans, procedures, and technical measures.

Enclosure 2 details the responsibilities of various NGA leadership roles, including the Director, Deputy Director, Chief of Staff, Associate Directors, Mission Assurance Officer, and various office directors, in executing the COOP program. It outlines their roles in planning, budgeting, identifying alternate facilities, risk management, and coordinating continuity efforts.

• Updated referencing.
• Updated the establishment and use of acronyms.
• Updated Table of Contents and References.
• Changed Directorate Heads and Agency Element Leads to Component Heads and Directorates and Agency Elements to Components.
• Moved responsibility for overseeing the COOP Program Budget Line Item.
• Removed responsibilities for certain Associate Directors.
• Updated paragraph numbers.
• Updated responsibilities for the Director, Chief Information Officer and Information Technology Services regarding system status updates and authorized outages.
• Updated glossary terms and definitions.

Instruction

This document, NGA Instruction 8040.2, establishes policy and assigns responsibilities for the National Geospatial-Intelligence Agency (NGA) Records Management Program (RMP). It aims to transition NGA away from paper-based processes to a fully electronic environment for managing agency records throughout their entire lifecycle. The instruction rescinds a previous version from March 2016.

This instruction applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors.

• All personnel must manage agency records throughout their information lifecycle.
• Emphasis on transitioning to a fully electronic environment.
• Efficient and effective creation, identification, protection, preservation, and proper disposal of NGA records in all media.

The document details responsibilities for various NGA roles, including:

• Director, NGA
• Senior Agency Official for Records Management (SAORM)
• Agency Records Officer (ARO)
• Chief, Records Management Program (C/RMP)
• Director, Chief Information Officer and Information Technology Services (D/CIO-T)
• Director, Office of Strategic Operations (D/OSO)
• General Counsel
• Directorate Heads and Agency Element Leads
• Primary Information Officers (PIOs)
• Information Officers (IOs)
• All Personnel

The instruction is effective as of the date of signature, October 21, 2020.

Other / Unclassified

This document is the Version Description Document (VDD) for the Terminal Approach Production System (TAPS) Version 1.0.0. It details the software components, features, build artifacts for deployment, and any known issues associated with this version of the TAPS software. The document outlines the system overview, deployment environment (hosted on UC2S and AWS RDS), and software functionality. It also provides a comprehensive inventory of software components, including custom code, Commercial Off-The-Shelf (COTS), and Open Source code, along with their versions and vendors.

This document provides technical details about the TAPS software, Version 1.0.0. While it does not appear to be a solicitation or SOW, it describes the system's architecture, functionality, and the specific software components used. This information could be relevant for potential bidders seeking to understand the technical landscape of the TAPS system, its dependencies, and its deployment environment, which may inform their proposal development or technical approach if this system is part of a larger opportunity.

Other / Unclassified

This document is the "Aeronautical Production System (APS) Concept of Operations (CONOPS), Version 1.0," dated August 26, 2020. It outlines the mission and functional operations of the National Geospatial-Intelligence Agency's (NGA) Aeronautical Navigation Office (SF) and the APS.

• Office Mission: The SF produces timely, relevant, and accurate aeronautical Geospatial Intelligence (GEOINT) for flight safety and national security.
• System Functional Mission: The APS serves as a central repository for NGA digital aeronautical products, enabling users to access, retrieve, and generate graphical and textual data. It supports the production of worldwide aeronautical data for military, civilian, and foreign customers.
• Products Produced: The system supports the creation of various products including Flight Information Publications (FLIP), Digital Aeronautical Flight Information File (DAFIF), Automated Air Facilities Information File (AAFIF), Digital Vertical Obstruction File (DVOF), and Airfield Foundation Data (AFD).
• Concept of Operations: Details how Aeronautical Analysts and Imagery/Feature Analysts maintain databases using specific software (Aeronautical Application Suite, Aeronautical Obstruction Environment) and hardware. It highlights the storage and maintenance of over 70 million records of airfield data, crucial for the Safety of Navigation mission, with updates potentially occurring every 28 days.
• System Architecture: Includes a diagram illustrating the system's architecture, showing components hosted in the C2S Amazon Cloud and on-premises at NCE (St. Louis, MO) and NDC West (Arnold, MO), with connections for thick client workstations and thin clients.

Other / Unclassified

This document is an NGA Instruction (NI 8010.2R7) concerning Information System Security and Training, approved on December 24, 2008. It supersedes a previous version (NI 8010.2R6) and establishes an information assurance security program for all NGA information systems (IS) to ensure confidentiality, integrity, availability, and accountability.

This instruction outlines the policies, procedures, and responsibilities for information assurance (IA) and security training within the NGA. Key aspects relevant to potential bidders include:

• Responsibilities: Defines roles for the Chief Information Officer (CIO), Chief Information Security Officer (CISO), and the Director of the Acquisition Directorate (D/A) in ensuring IA program development, implementation, and security engineering activities for ISs.
• Contracting Requirements: Directorate contracting officers are responsible for ensuring contracts for IA services include training and certification clauses. Contracting officer representatives (CORs) must ensure contractor personnel performing IA functions are certified.
• Training Mandates: Details mandatory initial and annual Information Assurance Awareness (IAA) training for all personnel, as well as specialized training and certification requirements for IA professionals (IAOs, ISSRs, etc.) in accordance with DoD 8570.01-M.
• Security Engineering: Outlines the security engineering process, including activities like architecture design, risk analysis, system development, testing, and certification/accreditation, involving Program Managers and Information System Security Engineers.
• Appendices: Provides detailed information on:
  • Appendix 1: Information System Security Program Training, including curriculum for various roles (approving authority, system administrator, general user).
  • Appendix 2: Information System Security Engineering processes and roles.
  • Appendix 3: IA Training, Training Certification, and Workforce Management, detailing requirements for both general network users and IA professionals.

Amendment / Modification

This document is an administrative update to NGA Instruction 8010.14, "Password Management." The update, dated 28 July 2020, includes the following changes:

• Added password information from reference (k).

• Updated references.

• Added "and this instruction" to item 8.

• Removed a section clarifying password storage, which was moved to pages 1 and 2.

• Pages 1, 2, 4, 6, and 7 are affected by these changes.

This administrative update does not appear to modify proposal deadlines or submission requirements for any associated opportunity. It clarifies and updates existing policy on password management.

Form / Attachment / Pricing Sheet

This document appears to be a template or a structured data collection tool, likely intended for use in program management, contract tracking, or reporting. It contains various sheets detailing program information, contract specifics, Work Breakdown Structure (WBS), COTS/GOTS software and hardware, agile metrics, code counts, data management, and database information.

• Program Info: Details about the program's function, users, and milestones.
• Contract Info: Information on prime and sub-contractors, contract types, dates, and values.
• WBS (Work Breakdown Structure): A detailed breakdown of tasks, including SEITPM (System Engineering, Integration, Test, and Program Management), Training, Custom Software/Hardware, COTS/GOTS, Help Desk, System Admin, R&D, Data Management, Facilities, Communication Lines, Vehicles, Certification, and Overhead costs.
• COTS/GOTS/FOSS: Lists commercial, government, and free/open-source software and hardware, including their environment, pricing, and maintenance.
• Agile Measures & Detail: Tracks agile development progress, including epics, features, stories, sprints, and development hours.
• Code Counts: Provides metrics on new, unmodified, modified, and deleted code, including programming languages and development strategies.
• Data Management: Outlines efforts for data conditioning and migration.
• Database: Details database names, platforms, sizes, and structures.
• Discrepancy Reports: Information on software baselines and tracking of reported discrepancies.

This document provides a detailed framework for how a program's work is structured and costed. Bidders can use this to understand the potential scope of work, the types of activities involved (e.g., custom development, COTS integration, agile processes), and the level of detail expected in reporting. It serves as a template that may inform proposal development, especially regarding WBS alignment and cost estimation for similar programs.

Amendment / Modification

This document is an addendum (Version 1.0, dated 28 APR 21) to the Foundation Sustainment Services (FS2) Aeronautical Safety of Navigation (SoN) Task Order. It provides system-specific information and constraints related to the Aeronautical Production System (APS).

• Background: Details the APS environment, including COTS, GOTS, FOSS, and custom software/applications, and its use of various databases across NGA networks (high side, C2S, and planned UC2S).
• Work Requirements: Outlines the overall scope including Program Management, Operations Support, and Software Maintenance for APS. It notes the ongoing technology overhaul of the APS production system and the need for process changes to enable future capabilities, requiring compliance with ISO 9001:2015, DO-200B/FAA AC-153B, and SFA FAA/CNS/ATM TYPE 1 Data Provider LOA.
• Personnel and Skills Requirements: Specifies the need for cleared personnel at NGA West Campus and contractor facilities, including Database Administrators, a DevOps Engineer, and a Software Engineer. It emphasizes required expertise in restoring NGA Mission Critical Aero SoN APS capabilities and experience with APS operations.
• APS Specific Constraints / System Information: Details requirements for the contractor to provision and maintain development, integration, testing, and operation environments for APS.
• Software Support Services Specific Constraints (WBS 4.0): Defines adaptive maintenance activities, ranging from small tasks to extensive changes requiring modification of the APS system, components, or design.
• Operations Support Services Specific Constraints (WBS 5.0): Outlines Agile operations with 2-week sprints and 4-week releases, detailing APS Output Production schedules for various data types (e.g., DAFIF, AAFIF, MIDB, AFD, Vertical Obstructions) with specified frequencies.

This addendum does not appear to modify proposal deadlines or submission requirements but provides critical details on the APS system, its environment, and operational constraints that bidders must understand for accurate proposal development.

Other / Unclassified

This document is a National Geospatial-Intelligence Agency (NGA) Instruction (NGAI) Number 8120.1, dated 1 September 2020, concerning Electronic Waste (E-Waste) Management. It establishes policy, assigns responsibilities, delegates authorities, and provides procedures for the management of E-Waste. This instruction rescinds a previous NGA Directive 8120 from May 2017.

This instruction applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors. It outlines the policy for decommissioning, sanitizing, disposing of, and destroying E-Waste in accordance with various references. It also emphasizes providing training and guidance for personnel involved in E-Waste management and promoting the reuse of E-Waste.

The document details responsibilities for various NGA roles, including the Director, CIO, CISO, E-Waste Mission Manager (EMM), Director of Security and Installations (D/SI), and Program Managers (PMs)/Information System Owners (ISOs). It also outlines procedures for identifying and requesting removal of excess or unwanted IT equipment, and references detailed sanitization and disposition procedures found in other NGA documents.

For potential bidders, this document establishes the framework and requirements for E-Waste management within NGA, which may be relevant for any contracting opportunities related to IT asset disposition, sanitization, or disposal services.

Other / Unclassified

This document is an Instruction (NGAI 8550.1) from the National Geospatial-Intelligence Agency (NGA) dated November 2, 2020, concerning the "Health and Performance Monitoring of Information Systems and Applications." It establishes policy and assigns responsibilities for monitoring the health and performance of NGA's Information Systems and Applications (IS&As).

This document is relevant to potential bidders as it outlines the NGA's policy and requirements for monitoring the health and performance of its information systems. It details the responsibilities of various roles within NGA, including the Chief Information Officer (CIO), Director of CIO and Information Technology Services (D/CIO-T), Director of Secure Operations Group (D/TO), Director of Operations Control Office (D/TOC), Directorate Heads, Agency Element Leads, Program Managers (PMs), and Information System Owners (ISOs).

The instruction specifies timelines for integrating and adopting IT health and performance monitoring tools, including deadlines for existing and new IS&As with different Recovery Time Objectives (RTOs). It also mentions the development and maintenance of Service-Level Agreements (SLAs) and the use of tools like the Enterprise Service Center (ESC) Manager of Managers (MoM) and the Service+ tool. Understanding these requirements and responsibilities is crucial for any contractor involved in providing or supporting IT systems and applications for the NGA.

Form / Attachment / Pricing Sheet

This document is a listing of various forms and documents related to the DoD Cloud Computing Security (DCCS) program. It appears to be a library of resources for entities involved with cloud security within the Department of Defense.

• Cloud Change Request Form: For submitting requests to change cloud environments.
• Cloud Change Request Whitelist Form: Likely for pre-approved changes.
• Cloud Computing SRG: Security Requirements Guide for cloud computing.
• Cloud Extension Request Form: For requesting extensions related to cloud services.
• DoD Cloud Authorization Process - June 2024: Documentation outlining the authorization process.
• DoD Cloud Authorization Process Diagram: A visual representation of the authorization process.
• DoD Rev 5 SSP Addendum Controls_v1.2: Controls related to the Security Services Plan (SSP).
• IATT Authorization Request Form: Request form for Interim Authority to Test (IATT).

Bidders involved in DoD cloud computing opportunities should review these documents to understand the required processes, security guidelines, and forms necessary for compliance and authorization. Specifically, forms related to change requests, authorization processes, and security controls are critical for understanding the operational and security requirements of DoD cloud environments.

Other / Unclassified

This document is an NGA Instruction (NGAI 8040.1) dated November 21, 2018, concerning Configuration Management (CM) for Information Technology (IT). It establishes policy and assigns responsibilities for NGA's IT CM processes, rescinding a previous instruction from 2006. The instruction applies to all NGA personnel, including civilian employees, military service members, other government agency personnel assigned to NGA, and contractors.

Key aspects covered include:

• Purpose: To establish policy and assign responsibilities for IT CM.
• Applicability: Applies to all NGA personnel.
• Policy: Mandates managing and controlling information systems and identifying/controlling configuration items (CIs) throughout their lifecycle.
• Responsibilities: Details roles and duties for the Chief Information Officer, Co-chairs of the Configuration Control Board (CCB), specific Directorate leads (D/TA, D/TI, D/TO), the Security Configuration Management (SecCM) Program Manager, and Directorate Heads/Agency Element Leads.
• References: Lists relevant DoD Directives, NIST publications, and NGA directives, manuals, and plans.
• Glossary: Defines key terms such as Configuration Baseline, Configuration Control Authority (CCA), Configuration Control Board (CCB), Configuration Item (CI), Configuration Management (CM), Request for Change (RFC), and Security Configuration Management (SecCM).

This instruction is relevant to bidders as it outlines the framework and responsibilities for managing IT configurations within the NGA. Understanding these policies and responsibilities is crucial for contractors involved in IT systems development, maintenance, or operations, as it defines the processes and controls they must adhere to. Specifically, it highlights the importance of the Configuration Control Board (CCB) and the procedures for managing changes to baselines, which directly impacts how IT projects are managed and executed within NGA.

Other / Unclassified

This document is a National Geospatial-Intelligence Agency (NGA) Directive (NGAD) 8010, titled "Information Systems Risk Management Framework (RMF)." It establishes policy and assigns responsibilities for the Information Systems RMF and the assessment and authorization (A&A) of NGA Information Technology (IT) systems. It rescinds a previous NGA Instruction (8010.3) from 2007.

This directive applies to all NGA civilian employees, military service members, other government agency personnel assigned to NGA, and NGA contract support personnel involved in the design, build, procurement, testing, operation, maintenance, and disposal of NGA information systems. It outlines NGA policy for determining information system security levels, integrating security controls into the System Development Lifecycle (SDLC) and Acquisition Lifecycle, and ensuring IT systems undergo A&A using the RMF process. It also details continuous monitoring of information systems and the provision of enterprise security services. The document includes sections on Applicability, Definitions, Policy, Responsibilities (detailed in Enclosure 2), and Effective Date. It references numerous other NGA, NIST, and DoD documents for detailed guidance.

Key responsibilities are assigned to:

• Director, NGA (D/NGA)
• Open IT Portfolio Manager Chief Information Officer
• Authorizing Official (AO) / Chief Information Security Officer
• Delegated Authorizing Official (DAO)
• Director, Information Technology Services and Chief Information Officer (D/T-CIO)
• Director, Human Development
• Chief, NGA Operations Center–Mission Assurance
• Director, Security and Installations
• Program Managers (PMs) / Information System Owners (ISO)
• Chair, Information Technology Executive Council (Risk Executive Function)

This directive is crucial for any contractor supporting NGA's IT systems, as it defines the framework and responsibilities for ensuring the security and authorization of those systems.

Guidance Document

This document provides guidance on the Department of Defense's (DOD) use and development of Open Source Software (OSS). It outlines the department's strategy for leveraging OSS to accelerate software modernization while managing associated risks.

• Adopt, Buy, Create Approach: The DOD should prioritize adopting existing government or OSS solutions before purchasing proprietary software, and only create new software when no off-the-shelf options are adequate.

• Consideration of OSS: OSS should be given equal consideration to commercial software and considered to the maximum extent practical to avoid restricting competition.

• Risk Management: Program managers are responsible for assessing and managing risks associated with using OSS, including supply chain risks, trusted sources, dependencies, component security, component integrity, and potential foreign government influence.

• Software Development: The guidance encourages an open source, collaborative approach for software development that is not critical technology, emphasizing reuse and minimizing costs. It also outlines requirements for releasing custom-developed software as OSS.

• Contribution to OSS Projects: Government employees and contractors may contribute to existing OSS projects when it aligns with government interests and is authorized.

• Market Research: Agencies must conduct market research considering factors specific to OSS, such as reliability, security, adaptability, cost advantages, and community support.

• Licensing: Government use and distribution of OSS must conform to the terms of the OSS license.

• Support and Sustainment: OSS components require product support and sustainment planning, including considerations for the balance between contractor support and community support.

• Critical Technology: Software implementing critical technology should generally not be distributed as OSS and must be closely protected.

Not applicable, as this is a guidance document, not a solicitation.

Not applicable.

• Attachment 2 provides detailed guidance. Additional information is available via a provided FAQ link.
• The document references numerous federal laws, regulations, and other DOD policies related to software acquisition and open source software.

Other / Unclassified

This document is a National Geospatial-Intelligence Agency (NGA) Instruction (NGAI) numbered 8400.4, concerning the "Implementation of Electronic and Information Technology Accessibility/Section 508 Program." It establishes policy, assigns responsibilities, and provides procedures for the implementation and governance of the Electronic and Information Technology (EIT) Accessibility Program, also known as the Section 508 Program. This instruction rescinds a previous version from May 2013 and was administratively updated on January 24, 2020.

While this document is an internal NGA policy, it is highly relevant to potential bidders. It outlines the agency's commitment to Section 508 compliance for all Electronic and Information Technology (EIT) that is developed, procured, maintained, or used by NGA. Bidders should be aware that NGA requires EIT to be accessible to people with disabilities. The document details:

• Policy: NGA policy ensures all EIT is accessible and compliant with Section 508.
• Applicability: This instruction applies to all NGA personnel, including contractors.
• Responsibilities: It clearly defines the roles and responsibilities of various NGA officials and offices (e.g., CIO-T, Component Acquisition Executive, Office of Contract Services, Section 508 Coordinator) in ensuring EIT accessibility throughout the acquisition, development, and maintenance lifecycle.
• Procedures: Enclosures detail procedures for developing, procuring, and maintaining accessible EIT, including requirements for accessibility in contracts, testing, and vendor submissions (e.g., Voluntary Product Accessibility Template - VPAT).
• Exemptions: It outlines conditions under which EIT acquisitions may be exempt from accessibility requirements, including "undue burden" justifications.
• Training and Complaints: Procedures for developing accessibility training and for initiating administrative complaints related to accessibility are also covered.

Bidders should review this document to understand NGA's specific requirements and expectations regarding EIT accessibility, which will likely be incorporated into future solicitations and contracts.

Instruction / Policy

This document, NGAI 8010.1, establishes the policy and assigns responsibilities for the National Geospatial-Intelligence Agency's (NGA) Information Systems (IS) Risk Management Framework (RMF). It rescinds previous directives and manuals related to the RMF. The instruction applies to all NGA civilian employees, military service members, other government agency personnel assigned to NGA, and contractors.

• NGA will use the RMF as a holistic and strategic process for managing IS risks, employing common standards and risk assessment processes.

• The Information Assurance Requirements Catalog (IARC) is the authoritative source for NGA's security control baselines and parameters.

• Common Control Providers (CCPs) and Enterprise Security Services (ESSs) will be used to support the RMF.

• The Director, NGA, appoints Authorizing Officials (AOs) including the CIO, Associate CIO, CISO, and Deputy CISO.

• The CISO serves as the Agency Senior Accountable Official for Risk Management.

• Authorizing Officials (AOs) are responsible for authorizing ISs into operation, documenting and tracking assessment and authorization activities, and ensuring ISs are categorized and operated at an acceptable risk level.

• Delegated Authorizing Officials (DAOs) authorize moderate or low-impact ISs.

• Program Managers (PMs) and Information System Owners (ISOs) are responsible for obtaining authorizations, managing security deficiencies, and developing authorization packages.

An administrative update on March 15, 2022, included changes to directorate and agency element titles, updated the Table of Contents and references, removed a specific responsibility, and adjusted a definition.

Instruction

This instruction establishes policy, assigns responsibilities, and provides procedures for the procurement and management of all National Geospatial-Intelligence Agency (NGA) software. It aims to improve and streamline software lifecycle processes (selection, allocation, consolidation, delivery, operations and maintenance, and disposition) and to gain efficiencies while meeting user requirements. It also establishes standards of conduct for software procurement, copying, transfer, and use.

This instruction applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors who procure and manage software on behalf of NGA. It also applies to all NGA systems, networks, and devices, and to Government off-the-shelf (GOTS), commercial off-the-shelf (COTS), and externally developed software procured by or on behalf of NGA.

• All software procurement and management must adhere to established procedures and standards.

• Software deployments must comply with contractual terms and conditions.

• Personnel cannot use unauthorized software on NGA systems, networks, and devices.

• NGA-procured software cannot be used on unauthorized systems, networks, and devices, except as approved for telework.

• Personnel cannot make unauthorized copies of NGA-procured software.

• Software must be maintained at the latest version and patch level approved on NGA's Software Whitelist Assurance Process (SWAP).

• The Chief Information Officer (CIO) designates the Software Asset Management Office (TCS) as the agency's single focal point for software approval and management.

• The Director, IT Services (D/IT) maintains and manages the SWAP, which contains approved applications for use within NGA's Operational Enterprise.

• The Director, Software Asset Management (D/TCS) manages software life cycle processes and ensures procured software is on the SWAP.

• Procedures for pre-procurement requests, software procurement, software provisioning, licensing compliance, software audits, and software asset disposition are detailed in the enclosures.

This document has undergone several administrative updates, with the latest noted as "Administrative Update 4: 12 July 2019". The change log indicates updates related to the merger of "Software Approval Process (SWAP)" and "Software Whitelist" into the "Software Whitelist Assurance Process (SWAP)", added references, responsibilities, and procedures, and clarifications regarding foreign ownership, control, and influence (FOCI).

Other / Unclassified

This document is a system architecture diagram illustrating the "UNCLASSIFIED" Global Enterprise Airfield Information System (GEAIS). It depicts various systems, applications, data repositories, and roles involved in processing and managing airfield data.

This diagram provides a high-level overview of the systems and data flows related to airfield information. For bidders, it can help in understanding the existing technical landscape, potential integration points, and the types of data being managed (e.g., Airdrome Data, Enroute Data, NOTAM Data, Vertical Obstruction Data). This context is crucial for understanding the scope and technical environment of any related opportunities.

Other / Unclassified

This document, titled "N01-0757 APS Description Document," describes the capabilities of the Aeronautical Production System (APS). The APS is a cloud-based data management solution designed for various data types including En Route data, Terminals data, Airfield Foundation Data, and Vertical Obstruction data. It utilizes the NGA's Common Operating Release Environment (CORE) for development and deployment, providing Platform as a Service (PaaS), DevSecOps, and orchestration of container-based web services.

This document provides background information on the Aeronautical Production System (APS). Key dates related to its review and approval process are noted:

• Originator: Eric Vehige
• Status: Out for TRB Review
• Change Logs Due: 13 November 2024
• Final TRB Approval: 18 November 2024
• Scheduled CCB Date: 11 December 2024

This information may be relevant for bidders seeking to understand the system's architecture and development lifecycle.

Other / Unclassified

This document, NGA Instruction NI 5200.4R1, establishes policies and procedures for the National Geospatial-Intelligence Agency's (NGA) Operations Security (OPSEC) program. Its purpose is to protect sensitive, but unclassified, critical information from adversaries.

This instruction outlines the NGA's approach to OPSEC, including:

• Policy: Maintaining protection of unclassified activities and information that could reveal NGA capabilities and intentions.
• Scope: Applies to all NGA personnel, organizations, and activities.
• Responsibilities: Defines roles for the Security and Installations Operations Directorate (SI), the OPSEC manager, the Counterintelligence Office (SIC), and Directorates/Offices.
• Procedures: Details a five-step OPSEC process (identify critical information, analyze threats, analyze vulnerabilities, assess risk and countermeasures, implement countermeasures) and outlines how designated officers manage OPSEC for projects.
• Training: Mandates annual awareness training for all NGA personnel and provides specialized training for OPSEC officers.
• Evaluation: Describes program evaluation methods, including assessments, surveys, inspections, and pop quizzes.
• Reporting: Outlines annual reporting requirements for Directorates and Offices, and an annual program review.

Other / Unclassified

This document establishes a standard for encrypting Elastic Block Store (EBS) volumes within the IPF program to enhance data security. It mandates that all new EC2 instances and EBS volumes must be configured with encryption. For existing unencrypted EBS volumes, a specific procedure involving stopping the instance, creating an encrypted snapshot, creating a new encrypted volume from the snapshot, and replacing the original volume is outlined.

While not a solicitation or SOW, this standard is crucial for potential bidders to understand the security requirements for cloud environments within the IPF program. Bidders should be aware that any infrastructure or services they propose must adhere to these EBS encryption standards, utilizing either default AWS KMS keys or customer-managed KMS keys (preferred for flexibility). This may impact the technical approach, cost, and implementation details of any proposed solution.

Other / Unclassified

This document establishes the Information Platform (IPF) standard for S3 Intelligent Tiering and a Standard Lifecycle Rule for all S3 buckets. Its purpose is to define a global baseline configuration for managing object storage classes in S3 buckets to potentially reduce object storage costs.

This document outlines mandatory configurations for S3 buckets, including:

• S3 Intelligent Tiering: All S3 buckets must have S3 Intelligent Tiering applied. Objects are automatically managed across Frequent Access, Infrequent Access (after 30 days), and Archive Instant Access (after 90 days) tiers. Accessing an object resets these timers.
• Archive/Deep Archive Access: Mission owners may designate the use of Archive Access and Deep Archive Access for data not planned for access.
• Alternative Lifecycle Rules: For transitions to Glacier Instant Retrieval (GIR), Glacier Flexible Retrieval (GFR), or Glacier Deep Archive (GDA) sooner than 90 days, an alternative Lifecycle Rule can be implemented instead of S3 Intelligent Tiering. If used on a subset of a bucket, S3 Intelligent Tiering must be applied to the remainder.
• Mandatory Lifecycle Rule Configuration: A lifecycle rule named 'S3-IT_0-Day_and_Maintenance' must be applied to all objects in the bucket. This rule includes:
  • Transitioning current object versions to Intelligent-Tiering immediately (0 days after creation).
  • Deleting expired object delete markers.
  • Deleting incomplete multipart uploads within 7 days (this period can be reduced with concurrence).

These are minimum requirements, and deviations require approval. Bidders should understand these storage management standards as they may impact data handling and costs associated with cloud storage for any services requiring S3 bucket usage.

Other / Unclassified

This document establishes the "IPF Standard" for purchasing and utilizing Amazon Web Services (AWS) Savings Plans (SP) and Reserved Instances (RI). It outlines the definitions, purpose, and considerations for using these cost-saving mechanisms across different AWS environments (Unclassified and Classified).

This document is crucial for understanding the cost management strategy related to AWS services within the IPF. Bidders should note the specific requirements for purchasing AWS Compute Savings Plans (CSP) for Unclassified environments and Reserved Instances (RI) for Classified environments. Key aspects include:

• Cost Analysis: Mandates cost analysis for all AWS IPF deployments to identify savings opportunities.
• Purchasing Process: Details the required use of specific Excel forms (IPF_AWS_CSP_Purchase_request, IPF_AWS_RI_Purchase_request, IPF_AWS_RI_RDS_Purchase_request), mandatory fields, target coverage percentages (90% for CSP), and the approval process involving specific government reviewers.
• AWS Tools: Emphasizes the use of AWS Cost Optimization Hub, AWS Billing Conductor, and AWS Cost Explorer for analysis and data gathering.
• Commitment Terms: Specifies 1-year terms and "All Upfront" payment options for all SP and RI purchases.
• Classified Environments: Notes that only RI purchases are available for classified AWS environments.
• RDS SP: Details specific requirements for Amazon RDS Reserved Instances, including size flexibility for certain database engines.

Understanding these standards will help bidders propose solutions that align with the government's cost-saving objectives and procurement procedures for AWS services.

Other / Unclassified

This document provides guidance on selecting the appropriate development environment for NGA Information Processing Facility (IPF) projects. It outlines three primary environment options: eXternal Cloud (XC), Commercial Cloud Services (C2S) via Amazon Web Services, and the Blue Factory Environment (BFE). The choice of environment depends on the project's data requirements and the clearance level of the development team.

Potential bidders should understand these development environment options as they may impact project execution, data handling, and security compliance. The document details:

• eXternal Cloud (XC): For workloads outside the DoD network, suitable for unclassified data. Requires approval for developers without a Common Access Card (CAC).
• Commercial Cloud Services (C2S): Leveraged for reliable, scalable cloud computing across multiple security domains (UC, SC, TC). Supports NGA's toolchain and CI/CD practices.
• Blue Factory Environment (BFE): Supplements other environments, particularly for large data or compute needs. UC BFE is limited to UNCLASSIFIED/FOUO by default, with approval needed for LIMDIS data. Software must be SWAP Whitelisted.

A table is provided to help select the environment based on developer clearance and data type (Unclassified, U/FOUO/LIMDIS, IL6, TC). The summary notes that XC is generally preferred unless LIMDIS data is involved, in which case BFE is recommended. Onboarding to BFE for LIMDIS data requires justification, dissemination control plans, and ISO/ISSO approval. Development costs in BFE may be covered by DDI-Ops up to $500/month.

Other / Unclassified

This document, titled "IPF Standard - EC2 Snapshot (2025-08-20)", outlines the standard procedures for managing Amazon Elastic Block Store (EBS) snapshots for Amazon Elastic Compute Cloud (EC2) instances within the IPF (likely an internal project or platform). It details the retention periods for snapshots and utilizes AWS Lifecycle Manager to automate this process.

Key aspects include:

• Standard Retention: All EBS volumes will have automated daily backups retained for 14 days using AWS Lifecycle Manager.
• Extended Retention: Snapshots needed beyond 14 days require manual creation and must be tagged with beyond_14_snapshot. These extended retention snapshots need to be reviewed every 60 days for potential deletion.
• Process Guidance: The document provides step-by-step instructions for configuring the default EBS snapshot lifecycle policy and for manually creating extended retention snapshots.

This document is relevant to potential bidders if the opportunity involves managing or utilizing AWS EC2 instances and EBS volumes. It specifies the expected standard for data backup and retention, which may impact how bidders are required to handle data, perform backups, or integrate with existing AWS infrastructure. Understanding these retention policies is crucial for bidders to accurately scope their technical approach and ensure compliance with data management requirements.

Other / Unclassified

This document establishes a standard for Amazon Elastic Block Store (EBS) provisioned IOPS and throughput within the IPF (Infrastructure Provisioning Framework). It aims to reduce unnecessary spending by setting default configurations to minimums and requiring justification for higher performance settings.

For potential bidders, this document outlines the expected standards for cloud storage performance. It indicates that the default configuration for EBS volumes will be gp3 (or gp2 if gp3 is unavailable) with baseline performance (3000 IOPS and 125 MiB/s throughput). Any requirement for higher performance (greater than baseline IOPS or throughput for gp3, or the use of io1 volumes) will require explicit approval from the IPF Supervisory Project Manager, supported by metrics demonstrating the need. Additionally, specific tagging is required for volumes with increased performance configurations. This information is crucial for bidders to understand the cost implications and technical requirements related to storage performance when developing their proposals.

Other / Unclassified

This document establishes a standard for managing orphaned Elastic Block Store (EBS) volumes within AWS accounts in the IPF (Integrated Platform Framework). It aims to prevent recurring issues of unattached EBS volumes that incur charges despite not being used by any EC2 instance.

• Termination of EC2 Instances: Upon termination of an EC2 instance, all attached EBS volumes must also be terminated, unless a documented exception is approved.

• DeleteOnTermination Attribute: This attribute for EBS volumes should be set to True by default.

• Prohibition of Unattached Volumes: No unattached EBS volumes should exist, except for those with an approved and documented exception.

• Exceptions require approval from the IPF Supervisory Project Manager.

• For volumes intended for retention, the DeleteOnTermination attribute must be set to False.

• A specific tag (TagName: Disposition) must be applied to retained volumes, including the reason for retention and the last review date.

This standard outlines operational procedures and requirements related to AWS resource management, specifically EBS volumes. While not a direct solicitation for services, it indicates the environment's operational constraints and compliance standards that may be relevant for vendors proposing solutions involving AWS infrastructure or services within the IPF.

Form / Attachment / Pricing Sheet

This document provides the standard configuration for the CloudWatch Agent on EC2 instances within the IPF (Infrastructure as a Platform) environment. It specifies a minimum set of metrics to be collected and outlines best practices for configuration management.

• Namespace: All CloudWatch Agent metrics should be sent to the default "CWAgent" namespace.
• Metrics to Collect: A baseline set including "Mem_Used_Percent" (Percent of Memory in use) and "Disk_Used_Percent" (Percent of disk space used) for all mounted disks/partitions (excluding those where metrics are not needed).
• Collection Interval: Metrics should be collected every 300 seconds.
• Configuration Storage: CloudWatch Agent configurations must be stored in the Systems Manager Parameter Store, not local files. Suggested naming conventions include OS type and version (e.g., CWAgent_Base_Linux_2023-01-01).
• Additional Metrics: Separate, purpose-driven configurations can be created using the append option for additional metrics, ensuring the baseline configuration remains uniform.
• Baseline Configuration JSON: Provides specific JSON configurations for both Windows and Linux environments detailing the metrics, namespace, interval, and resources to be collected.

Bidders should understand these standards if the opportunity involves managing or deploying EC2 instances within the IPF environment. This document dictates the required monitoring configuration, which may impact system design, deployment, and operational responsibilities. Familiarity with these CloudWatch Agent configurations is necessary for compliance with the IPF's monitoring standards.

Other / Unclassified

This document is Security Executive Agent Directive 4, titled "National Security Adjudicative Guidelines." It establishes a single, common set of adjudicative criteria for individuals requiring initial or continued eligibility for access to classified information or eligibility to hold a sensitive position. The directive outlines the authority, purpose, applicability, definitions, and policy related to these guidelines. It details the adjudicative process, including various guidelines (e.g., Allegiance, Foreign Influence, Personal Conduct, Financial Considerations, Criminal Conduct) and conditions that may raise security concerns or be disqualifying, as well as mitigating factors.

This document is relevant to bidders as it defines the standards and criteria used for determining an individual's eligibility for access to classified information or to hold a sensitive position. Companies bidding on opportunities that require personnel to hold security clearances or sensitive positions will need to ensure their employees and potential hires meet these national security adjudicative guidelines. Understanding these requirements is crucial for workforce planning and ensuring compliance with government security standards.

Other / Unclassified

This document is the National Geospatial-Intelligence Agency (NGA) Technology Strategy, titled "Mission Today, Mission Tomorrow," dated May 2020. It outlines NGA's vision, principles, current state, and future initiatives for technology development and adoption.

This document provides insight into NGA's strategic direction and priorities regarding technology. Potential bidders can use this information to understand:

• NGA's Vision and Principles: How NGA views the role of technology in achieving its mission and the guiding principles for its technology strategy.
• Current State and Findings: Areas where NGA identifies challenges and opportunities in its current technology landscape, such as productivity, customer perspective, data leverage, modernization efforts, product focus, industry engagement, and return on investment.
• Key Initiatives (The Way Ahead): Five strategic initiatives NGA plans to pursue:
  • Empower Builders and Makers
  • Transform Digital Workspaces
  • Build With Customers
  • Treat Data as a Strategic Asset
  • Bring AI, Cloud & HPC Into GEOINT Mainstream
• Industry-Leading Practices: Appendix A details near-term and long-term industry practices that NGA considers relevant, covering areas like DevOps, AI Developer Toolkits, API Marketplaces, Desktop as a Service, Geospatial Platforms, Augmented Analytics, and Quantum Computing.

Understanding these strategic priorities and technological focus areas can help vendors align their offerings and proposals with NGA's future needs and investments.

Other / Unclassified

This document is a "Foundation GEOINT Modernization (FG Mod) Program Overview" from June 2022, presented by the National Geospatial-Intelligence Agency (NGA). It outlines the program's objectives, which include supporting the Foundation GEOINT Group Mission with timely, relevant, and accurate data, utilizing Agile development methodologies, and leveraging Commercial Off-The-Shelf (COTS) technology for modernization. The document details various NGA offices and their roles within the Foundation GEOINT Group, such as the Maritime Safety Office, Office of Geography, Office of Geomatics, and others. It also describes the "Scaled Agile Development – Mission Focused Scrum Teams" approach, illustrating how different mission areas (e.g., Maritime, Boundaries, Topography, Imagery, Data Analytics, Human Geography, Requirements Management, Publications, GeoNames, Vector Tiles) are organized.

Key capabilities and systems discussed include:

• Cloud Architecture: Producing and sharing data across security networks (C2S, SC2S, UC2S, NC2S).
• Foundation GEOINT Enterprise GIS: An integrated, interoperable, and extensible system.
• Capabilities Status: A detailed breakdown of targeted and operational capabilities across various offices.
• Specific Office Functions: Overviews of the Maritime Safety Office, Office of Geography, Office of Geomatics, and their respective data production and dissemination capabilities (e.g., Digital Nautical Charts, Standard Nautical Charts, Electronic Navigational Charts, Tactical Ocean Data, Anti-Shipping Activity Messages, Mobile Offshore Drilling Units, Additional Military Layers, Sailing Directions, World Port Index, Radio Navigational Aids, International Boundaries and Limits, Topography, Cartography, Human Geography, Geographic Names, State of the Data, GeoAI, Georeferenced Map Archive, Precise Imagery, World Imagery Wayback, FGM GRTools, Requirements Management, and Data Discoverability).
• Road Ahead: A timeline outlining incremental releases and continuous improvements for FY20, FY21, and FY22, detailing the planned modernization of various GEOINT capabilities.

This document provides a high-level overview of NGA's Foundation GEOINT Modernization program. For potential bidders, it offers insight into the agency's strategic direction, technological focus (e.g., cloud, Agile, AI), and the types of geospatial data and services being developed and managed. Understanding these areas can help vendors identify potential opportunities to align their capabilities with NGA's future needs and ongoing modernization efforts.

Other / Unclassified

This document outlines the National Geospatial-Intelligence Agency's (NGA) Cybersecurity Strategy for 2023. It details the agency's approach to securing its GEOINT (Geospatial Intelligence) advantage against evolving cyber threats.

This strategy is relevant to potential bidders as it defines NGA's cybersecurity priorities and goals. Understanding these objectives can help vendors align their offerings and proposals to meet NGA's future needs in areas such as:

• Access Management: Enhancing Federal Identity, Credential, and Access Management (FICAM) and Cross-Domain Services (CDS).
• Secure Enterprise: Implementing secure enterprise architecture, Risk Management Framework (RMF), and Zero-Trust Architecture.
• Data Security: Utilizing data as a strategic asset, employing AI, ML, and CV for cybersecurity, and implementing Continuous Authorization to Operate (cATO).
• Workforce Development: Strengthening people-driven cybersecurity through training and collaboration.
• Culture Evolution: Fostering an agency-wide understanding that cybersecurity is a shared responsibility.

Bidders should consider how their products and services can support these strategic goals to better position themselves for future opportunities with NGA.

Other / Unclassified

This document, "AWS Prescriptive Guidance: Secure Cloud Computing Architecture on AWS for the US Department of Defense," provides detailed guidance on building an IL4-compliant or IL5-compliant cloud infrastructure on AWS. It outlines the Defense Information Systems Agency (DISA) Secure Cloud Computing Architecture (SCCA) and how to implement it using the AWS Landing Zone Accelerator (LZA).

This document is highly relevant for potential bidders who are involved in or considering opportunities related to cloud computing for the US Department of Defense. It details:

• SCCA Components: Explains the core components of the SCCA, including Cloud Access Point (CAP), Virtual Data Center Security Stack (VDSS), Virtual Data Center Managed Services (VDMS), and Trusted Cloud Credential Manager (TCCM).
• LZA Implementation: Describes how the AWS Landing Zone Accelerator (LZA) can be used to deploy a foundational set of capabilities aligned with AWS best practices and compliance frameworks to meet SCCA requirements.
• Security and Compliance: Details specific security requirements and how AWS services can be leveraged to meet them, including networking, encryption, monitoring, and credential management.
• Guidance and Resources: Provides links to additional resources, implementation guides, and architecture diagrams to assist in building a compliant cloud environment.

This document serves as a technical reference for understanding the security and architectural requirements for DoD cloud environments on AWS, which would be critical for any vendor proposing solutions in this space.

Other / Unclassified

This document, NIST Special Publication 500-317 (DRAFT), titled "Cloud Computing and Accessibility Considerations," was prepared by the National Institute of Standards and Technology (NIST) and describes technical research related to the NIST Cloud Computing Program. It explores the opportunities and challenges of cloud computing concerning accessibility.

This document is relevant to bidders as it details:

• User Experiences of Inaccessibility: Provides several use cases and personas illustrating how individuals with disabilities encounter accessibility barriers in cloud computing environments. This can inform bidders about potential user needs and challenges.
• Barrier Categories: Identifies specific barrier categories unique to cloud computing, such as version control, reliance on browsers, platform quandaries, thin clients, and rich data visualizations.
• Applications Categories and Accessibility Guidance: Categorizes common cloud computing applications and discusses how they can cause or prevent accessibility barriers.
• New Cloud-Based Accessibility Opportunities: Highlights promising initiatives like the Global Public Inclusive Infrastructure (GPII) and Accessibility Application Programming Interfaces (AAPIs) that can enhance accessibility.
• Role of Information Resources: Discusses the importance of accessible information resources and provides examples like the FCC's Accessibility Clearinghouse.
• Cloud Computing Accessibility Taxonomy: Explores the development of a taxonomy to categorize accessibility features and products for various stakeholders.
• Guidance for Cloud Computing Accessibility: Offers general guidelines and specific recommendations for different types of cloud computing applications.
• Standards: References relevant accessibility standards such as WCAG 2.0, Section 508, and ISO standards.

Other / Unclassified

This document is the National Geospatial-Intelligence Agency (NGA) Systems Engineering Plan (SEP), Revision B, dated September 23, 2021. It outlines the agency's approach to systems engineering, providing a framework for managing and controlling systems engineering aspects across NGA's activities, including acquisition programs, projects, and studies.

While not a solicitation, this document provides insight into NGA's internal processes and methodologies for systems engineering, acquisition lifecycles, and technical development. Understanding these processes can help potential bidders align their proposals and technical approaches with NGA's expectations and standards. Key areas covered include:

• NGA Acquisition Lifecycle: Details the phases from technology development to operations and sustainment, including milestones and readiness reviews.
• Engineering Elements and Processes: Covers Enterprise Release Management (ERM), Digital Engineering (DE), Architecture Engineering, Configuration Management (CM), Risk Management, Schedule Management, and Security Engineering.
• Agile and DevSecOps: Highlights NGA's adoption of agile methodologies and the DevSecOps development approach.
• Applicable Documents and Tools: Lists key directives, guidance documents, and engineering tools used by NGA.
• Roles and Responsibilities: Defines the systems engineering roles within NGA, including the Chief Engineer, Enterprise Engineering Office, and Program Offices.

This SEP serves as a foundational document for understanding how NGA approaches the development and management of its systems and capabilities.

Other / Unclassified

This document, "Annex G: Cloud Data Guidance, Version 5.2," dated 30 June 2018, provides comprehensive guidance on managing data within cloud environments, specifically focusing on the National Geospatial-Intelligence Agency's (NGA) OpenDataStore (ODS). It details data migration strategies, metadata management, data access policies, and security considerations for cloud-based data. The annex establishes a common terminology and outlines best practices for programs adopting cloud services, aligning with NGA's Unified Data Strategy.

Key areas covered include:

• OpenDataStore (ODS): An architectural evolution for data management, encompassing persistent storage and data services for end-users and analysis.
• Data Guidance: Policies for managing data in accordance with NGA's data management, retention, and records management policies, including encryption for data at rest and in transit.
• Data Migration: Processes and strategies for moving data to the cloud, including phased approaches and specific guidance for file/object-based data and databases.
• Metadata Management: Standards and procedures for tagging, cataloging, and discovering data, emphasizing the use of NGA's Metadata Catalog and adherence to IC standards like EDH and TDF.
• Data Access: Vision and current state of automated data access, focusing on attribute-based access control (ABAC) and role-based access control (RBAC).

This document is highly relevant for bidders proposing solutions that involve data management, storage, migration, or access within NGA's cloud environment. It outlines the technical standards, policies, and architectural approaches NGA employs, which potential bidders must understand and align with. Specifically, it details requirements for data conditioning, metadata tagging, security protocols, and data access mechanisms that will govern how data is handled, stored, and accessed within NGA's cloud infrastructure. Understanding these guidelines is crucial for developing compliant and effective proposals.

Other / Unclassified

This document, "Program Level Agile Process Version 4.4," outlines the National Geospatial-Intelligence Agency's (NGA) three-tiered hierarchical framework for Agile Engineering: Portfolio, Program, and Team levels. It details the roles, responsibilities, process steps, and artifacts required for implementing Agile Engineering specifically at the Program level. Key areas covered include Vision, Design Artifacts, Nonfunctional Requirements, Features, Roadmap, Agile Release Train, Testing, and Metrics.

This document provides potential bidders with insight into NGA's established agile development methodologies and processes. Understanding this framework is crucial for vendors who will be expected to align their project execution, team structures, and deliverables with NGA's agile practices. It highlights the importance of specific roles (e.g., Product Manager, System Architect, DBT Teams), artifacts (e.g., Features, User Stories, Roadmaps), and governance processes (e.g., Configuration Management, Operations Readiness) that are integral to NGA's IT development lifecycle. Familiarity with this document can help bidders tailor their proposals to demonstrate alignment with NGA's operational environment and agile requirements.

Other / Unclassified

This document, "Annex K: Cloud Business Guidance, Version 5.2," provides guidance on business practices for supporting cloud-native development and transition activities. It details various business topics related to cloud operations, including:

• Cloud Budgeting Practices: Outlines NGA's methods for operating and managing cloud-based IT, focusing on increasing analytic performance and reducing infrastructure costs.
• Cloud Financial Planning: Identifies financial components and tools for cost estimation for cloud-based programs.
• Enterprise Service Authorization: Describes how services fit within the enterprise and the process for their identification and authorization.
• Cloud Environment Provisioning: Details the necessary actions for provisioning a Virtual Private Cloud (VPC) for activities.
• Cloud Billing and Monitoring: Explains the cloud billing cycle, stakeholder roles, and financial monitoring.
• Activity Optimization: Provides guidance on cloud activity performance and cost optimization.
• Cloud Software Lifecycle and Licensing: Offers guidance on software assets, including approved versions, licensing, deployment, and availability in the cloud.

This document is highly relevant for bidders as it outlines the business and financial framework within which cloud services are procured, managed, and operated by the NGA. Understanding these guidelines is crucial for vendors proposing cloud-based solutions or services, as it details NGA's expectations regarding budgeting, financial management, service authorization, provisioning, billing, optimization, and software licensing within their cloud environment. It provides insight into NGA's operational processes and requirements for cloud adoption.

Other / Unclassified

This document, "Annex E: Lifecycle Guidance Version 5.0," dated September 30, 2016, provides guidance on the National Geospatial-Intelligence Agency's (NGA) cloud-enabled transformational changes to its Information Technology (IT) lifecycle. It outlines principles, processes, governance, and policies to enable NGA to transform into a more open and agile enterprise.

This document is relevant to potential bidders as it details NGA's evolving IT lifecycle, operational model (CIO-T Operating Model), and its adoption of frameworks like the Scaled Agile Framework (SAFe) and DevOps. Understanding these frameworks and processes can help bidders align their offerings and approaches with NGA's strategic direction and operational requirements. Key areas covered include:

• IT Transformation: NGA's initiatives towards an open, agile enterprise, including cloud migration and new contract constructs.
• CIO-T Operating Model: A framework for delivering capabilities, encompassing Integrated Strategic Planning, Integrated Solution Planning, Integrated Execution, and Integrated Support to Operations.
• Integrating Framework (SAFe): NGA's adoption of the Scaled Agile Framework (SAFe) 4.0 for aligning its operating model, DevOps, and other changes.
• DevOps: The implementation strategy and operational principles for DevOps across Program, Agency, and Community levels, emphasizing continuous delivery, automation, and collaboration.
• Exploration and Experimentation: NGA's approach to fostering experimentation and risk-taking in a cloud environment, moving away from traditional waterfall development.

Bidders can use this information to understand NGA's preferred methodologies, development practices, and how they integrate services and capabilities, which can inform their proposal strategies and technical solutions.

Form / Attachment / Pricing Sheet

This document, "(U) Annex I: Cloud Security Guidance Version 5.2," provides comprehensive security guidance for National Geospatial-Intelligence Agency (NGA) cloud environments across Top Secret, Secret, and Unclassified domains. It outlines security requirements, best practices, and recommended procedures for cloud development, deployment, and operations.

• Introduction: Defines the scope and purpose of the guidance, emphasizing embedding security into development activities, automating processes, and governing security changes.
• Guidance: Details general security policies, including adherence to NGA/IC applicable security policies and leveraging AWS security best practices.
• Securing Cloud Environments: Covers specific guidance for Virtual Private Cloud (VPC) environments, Elastic Compute Cloud (EC2) instances, AWS Auto Scaling, AWS Trusted Advisor, and securing cloud data.
• Cloud Security Services: Addresses integration with IC ITE Common Service Providers and NGA's approach to deploying consistent security services.
• Data Encryption: Outlines requirements for encrypting data in transit and at rest, including key management solutions.
• Identity and Access Management (IAM): Details integration with GEOAxIS for authentication and authorization, including PKI and multi-factor authentication.
• Infrastructure Security: Covers the use of automated tools like Chef and Puppet for configuration management and security.
• DevOps Security: Provides guidance on integrating security into the DevOps pipeline, including various security testing methodologies (SAST, DAST, IAST).
• Assessment & Authorization (A&A): Outlines the process for system authorization, including Risk Management Framework (RMF), Information Impact Level determination, and the REvAMP process.

This document is critical for any bidder proposing solutions that will operate within NGA's cloud environments. It establishes the security standards, controls, and processes that must be adhered to, impacting system design, implementation, and ongoing operations. Understanding these requirements is essential for developing compliant and secure solutions.

Manual

This manual outlines the GEOINT Functional Manager Standards Assessment (GFMSA) Program, established to promote a GEOINT standards-based, interoperable working environment across the National System for Geospatial Intelligence (NSG). It provides processes for program managers to assess and assert conformance to GEOINT standards, ensuring interoperable capabilities are delivered.

• Purpose: To mature the consistent and conforming application of GEOINT standards for interoperable operations within the NSG.

• Scope: Applies to elements of the Intelligence Community (IC), Department of Defense (DoD), non-DoD/IC Federal agency members of the NSG, international partners, state/local municipalities, and Native American tribal organizations responsible for the operation, acquisition, and/or development of systems and applications that collect, procure, produce, serve, exchange, or use GEOINT data.

• Key Processes: The GFMSA program involves self-assessments, verification of data/services conformance to standards, validation of performance, and submission of evidence to the GEOINT Functional Manager (FM) for endorsement.

• Resources: The manual references numerous documents and provides links to GFMSA Resource Sites for further information and self-assessment tools.

• Points of Contact: Contact information for the GFMSA Team is provided for technical assistance.

• Document Title: GEOINT Functional Manager Standards Assessment (GFMSA) Program Manual

• Originating Office: National Geospatial-Intelligence Agency, Chief Information Officer and Information Technology Services

• Key Dates: Original document dated 9 June 2016, with Administrative Change 1 dated 7 December 2018.

Other / Unclassified

This document is an "Instruction" from the National Geospatial-Intelligence Agency (NGA) titled "NGA Acquisition Regulation Implementation (NARI)". It establishes policy, assigns responsibilities, and provides procedures to supplement or implement guidance from the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS). It applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors, and to all contracts issued under Department of Defense authority.

This document outlines NGA's policy for acquisition planning, procurements, contract administration, and contract closeout. It details responsibilities, procedures, and references relevant regulations. While not a solicitation or SOW, it provides the foundational regulatory framework and internal procedures that govern NGA's contracting activities. Bidders may find it relevant for understanding the context and compliance requirements of NGA procurements, particularly regarding internal policies and procedures that supplement FAR and DFARS.

Other / Unclassified

This document is the National System for Geospatial Intelligence (NSG) Enterprise Test and Evaluation Master Plan (TEMP), Revision D. It outlines the independent, enterprise-level testing strategy for the NSG and Allied System for Geospatial-Intelligence (ASG) prior to operational deployment.

This plan details the National Geospatial-Intelligence Agency's (NGA) approach to testing, including methodologies, roles and responsibilities of various organizations (e.g., NGA Test Organization (NTO), NGA Image Quality and Utility (NIQU)), test environments, and processes. It covers developmental testing (DT&E) and operational testing (OT&E), as well as agile and DevOps methodologies. For bidders, this document provides insight into the rigorous testing and quality assurance processes that NGA systems undergo, which may inform their own development and quality control practices if they are developing systems for NGA. It also highlights the importance of interoperability, security, and performance testing within the NSG/ASG enterprise.

Other / Unclassified

This document, "As-Is Process Model Suite: Foundation GEOINT (FG) Information Technology (IT) Governance Processes," dated November 8, 2024, details the current state of the FG IT governance process. It outlines the existing processes, identifies pain points, and suggests "to-be" notes for future improvements. The document was developed by the Foundation GEOINT Group Corporate Operations and Technology Office (SFC) to formally document the business processes governing the assessment and implementation of IT capabilities supporting the Source Foundation GEOINT Group (SF) mission.

While this document does not contain a solicitation or specific requirements for a bid, it provides critical context about the operational environment and decision-making processes within the Foundation GEOINT (FG) IT governance framework. Understanding this "as-is" state, including the identified pain points and proposed improvements, can help potential bidders understand:

• The existing IT governance structure: This includes the roles of the Foundation GEOINT Information Technology Requirements Board (FIRB), the Technical Review Board (TRB), and the Risk/Opportunities Management Board (ROMB).
• The process for IT capability identification, assessment, and prioritization: This helps bidders understand how IT needs are identified, vetted, and moved forward.
• Key stakeholders and their involvement: Understanding who is involved in decision-making (e.g., Mission Owner, SF IT Governance Team, Technical Executives) is crucial for effective engagement.
• Areas for potential improvement: The "Pain Points" and "To-Be Notes" sections highlight challenges and opportunities within the current process, which may indicate future areas of focus or investment for the government.

Other / Unclassified

This document is the "IPMR Implementation Guide" dated February 5, 2016. It provides guidance on the Integrated Program Management Report (IPMR) Data Item Description (DID), DI-MGMT-81861A. The IPMR is the primary method for communicating program cost and schedule performance between the prime contractor and the Department of Defense (DoD).

The guide details:

• The application of the IPMR DID and its seven formats based on contract value.
• How to tailor the IPMR DID within the Contract Data Requirements List (CDRL), DD 1423-1.
• Clarifications on the intent of various IPMR DID sections, including:
  • XML level of reporting
  • Application of MIL-STD-881
  • Contractual changes and the use of Authorized Unpriced Work (AUW) and Undistributed Budget (UB)
  • Allocation and use of Management Reserve (MR)
  • Definition of "significant" changes for Format 3
  • Variance analysis selection and reporting for Format 5
  • Tailoring of Format 6 (Integrated Master Schedule - IMS)
  • Schedule Risk Assessment (SRA) tailoring
  • Baseline dates and constraints
  • Schedule margin
  • Reporting levels for Format 7

This document is crucial for bidders who will be required to submit Integrated Program Management Reports (IPMRs) as part of their contract. It outlines the specific formats, data requirements, tailoring options, and reporting expectations for cost and schedule performance. Understanding this guide will help bidders prepare accurate and compliant IPMR submissions, which are essential for program management and decision-making by the Government. It clarifies how contractors should report performance, manage variances, and integrate schedule information, directly impacting proposal preparation and contract execution.

Form / Attachment / Pricing Sheet

This document, "Annex F: Cloud Design Guidance, Version 5.2," provides guidance on software architecture patterns and reference architectures for developing, running, and managing applications within cloud environments. It aims to optimize application design for various cloud characteristics and workload types.

• Reference Model: A model embodying basic goals or ideas, used as a reference. This annex focuses on IaaS and PaaS service models.
• Reference Architecture: A high-level functional blueprint for a service or offering, also referred to as an "architecture pattern."
• Reference Implementation: An actual architecture implementation serving as an exemplar.
• Cloud Service Models: Discusses Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and the evolution from traditional development to cloud-based models.
• Architecture Patterns: Details IaaS, PaaS, and NDAAS (NSG Data Analytic Architecture Service) patterns, outlining their scenarios, guidance, and provided resources.
• Pivotal Cloud Foundry (PCF): Describes PCF as a structured platform for running cloud-native applications.

This document is crucial for bidders proposing cloud-based solutions. It outlines the expected architectural approaches, service models (IaaS, PaaS), and specific patterns (IaaS, PaaS, NDAAS) that the government intends to utilize or align with. Understanding these design principles and reference architectures will help bidders tailor their proposals to meet the government's cloud strategy and technical requirements, ensuring compatibility and alignment with the desired cloud environment.

Amendment / Modification

This addendum (Version 9) to the Foundation Sustainment Services (FS2) Base IDIQ and Aeronautical Task Order PWS for the Web Digital Vertical Obstruction File (WebDVOF) project defines requirements for software maintenance, program management, and operations support services. It establishes the acquisition framework for delivering these services to the NGA Source Operations & Management Directorate's Foundation GEOINT Group (SF) and Aeronautical Safety Office (SFA).

Key objectives include designing and executing an agile support construct to refactor the WebDVOF solution for improved user and system performance, addressing security, sustainability, and compatibility issues. The refactored solution must maintain existing capabilities unless directed otherwise and cover SCI, Collateral, and Unclassified domains.

• Purpose: Defines expectations and requirements for Program Management, Software Maintenance, and Operations Support services for the WebDVOF project.
• Background: Describes the current Digital Vertical Obstruction File (DVOF) and its two capability blocks, highlighting dated infrastructure and sustainability issues requiring remediation.
• Scope: Details services for WebDVOF modernization, including corrective and adaptive maintenance, migration to cloud provisioning, test support, DevSecOps utilization, security issue resolution, cloud migration, Operations and Sustainment (O&S) support, legacy retirement, and data loading services.
• Contract Requirements and Constraints: Outlines governance framework, development phases (Conceptual Design, Preliminary Design, Critical Design, Final Demonstration and Test, Transition to Operations and Sustainment), and adherence to NGA standards.
• Services: Details Program Management Support (WBS 1.0), Software Maintenance Services (WBS 4.0) covering demo, test, corrective, adaptive, preventive, perfective, and requirements analysis, and Operations Support Services (WBS 5.0) including system performance optimization, automation, DevSecOps management, help desk, incident tracking, and cyber security.
• List of Applicable Documents: References relevant specifications for Vector Product Format, Vertical Obstruction Data, and NGA Product Specifications.
• List of CDRLs: Outlines Contract Data Requirements List items for various reports and plans.
• List of Appendixes: Includes references to WebDVOF-specific appendices (Architecture, Performance Metrics, Quality Assurance, Existing Functionality, Data Loader Workflow) and appendices from the Aeronautical Safety of Navigation Task Order PWS.

This addendum supersedes requirements in the Aeronautical Safety of Navigation Task Order PWS where they overlap. Contractors are not required to deliver services from the Task Order PWS that are not specifically called for in this addendum. The addendum details a phased approach to modernization with specific deliverables and reviews at each phase.

Other / Unclassified

This document is a Department of Defense (DoD) Instruction (DoDI) numbered 8510.01, titled "Risk Management Framework (RMF) for DoD Information Technology (IT)". It was originally issued on March 12, 2014, and incorporates Change 3 dated December 29, 2020. The instruction reissues and renames a previous instruction, implements the RMF for DoD IT, establishes associated cybersecurity policy, and assigns responsibilities for executing and maintaining the RMF. It replaces the DoD Information Assurance Certification and Accreditation Process (DIACAP) and manages lifecycle cybersecurity risk to DoD IT.

This document outlines the DoD's framework and policy for managing cybersecurity risks for its information technology systems. While it does not directly solicit proposals or define specific services to be procured, it establishes the mandatory cybersecurity requirements and processes that any IT systems or services intended for use by the DoD must adhere to. Bidders offering IT products, services, or solutions to the DoD should be aware of this RMF framework, as it dictates the security standards, assessment procedures, and authorization processes that their offerings will be subject to. Understanding these requirements is crucial for developing compliant solutions and successfully navigating the DoD's acquisition and security authorization processes.

Form / Attachment / Pricing Sheet

This document, Annex A: IC ITE Services and Providers (Version 5.2, dated 30 June 2018), identifies the Intelligence Community (IC) Information Technology Enterprise (ITE) services available to support the development of National Geospatial-Intelligence Agency (NGA) systems and services. It aims to inform geospatial service providers and their developers about available IC ITE service offerings.

• Service Providers: Lists organizations designated to provide specific IT capabilities for the Community, including:
  • Data Services Architecture (DSA)
  • IC Applications Mall (AppsMall)
  • IC Cloud (C2S & IC GovCloud)
  • IC Desktop Environment (IC DTE)
  • IC Enterprise Management (IC EMT)
  • IC Security Coordination Center (IC SCC)
  • Identification, Authentication and Authorization (IAA)
  • Information Transport Service (ITS)
  • Network Requirements and Engineering (NRE)
• Resources: Provides a link to find more information about these common IC ITE services: https://intelshare.intelink.ic.gov/sites/odni/cio/Pages/Services-and-Projects.aspx
• Additional Services: Mentions Application Development Services (ADV) for open-source tools and the IC Marketplace for subscribing to AWS-billable C2S commercial software. It also highlights GEOINT Services for geospatial-centric mission, developer, and DevOps tools.

This annex helps bidders understand the existing IT infrastructure, services, and tools available within the Intelligence Community. It encourages the use of these common services to avoid duplicative efforts, improve resource allocation, and enhance enterprise management. Familiarity with these offerings is crucial for developing systems and services that align with IC ITE capabilities.

Other / Unclassified

This document, "NGA Cloud Guidance: Introduction Version 5.2," dated June 21, 2018, outlines the National Geospatial-Intelligence Agency's (NGA) strategy and guidance for adopting cloud-based operations. It is not a contractual document but provides guidance for program managers, developers, engineers, and organizational managers regarding actions, constraints, and expectations for cloud environments.

The document emphasizes NGA's commitment to the Intelligence Community's Information Technology Enterprise (IC ITE) initiative to enhance mission integration and efficiency. It details NGA's cloud strategy, which focuses on modernizing, automating, and enabling anticipatory analysis to support the GEOINT 2022 CONOPS. The strategy prioritizes new mission-focused capabilities over legacy systems, advocating for a Tier 1 approach that aligns with cloud-native principles and leverages Platform-as-a-Service (PaaS) and DevOps.

Key guidance points include:

• Establishing a cloud plan for the agency.
• Standardizing tools, methods, and templates for cloud development and operations.
• Registering "gold" data and establishing dates for retiring legacy activities.
• Following security, DevOps, and design guidance.
• Maximizing the use of enterprise services and durable cloud resources.
• Requiring unlimited data rights in contracts.
• Prioritizing adoption of existing capabilities/services from industry or other agencies before developing new ones.

This document is relevant to potential bidders as it establishes the foundational principles and strategic direction for NGA's cloud adoption. It signals NGA's intent to leverage cloud technologies for future GEOINT capabilities and services. Understanding this guidance will help bidders align their offerings with NGA's strategic goals, technical standards, and operational priorities, particularly concerning cloud-native development, DevOps practices, and the prioritization of new mission-focused capabilities. The document also highlights the importance of understanding NGA's cloud architecture, security requirements, and business models, which will be detailed in subsequent annexes and referenced in future solicitations.

Questions & Answers / Clarifications

This document contains questions submitted by potential bidders and the government's responses, clarifying various aspects of the solicitation for the FS3i (Foundation Sustainment Support, Software and Integration) opportunity.

• Proposal Submission: Questions regarding proposal page limits, the use of 11x17 pages, and the inclusion of acronym lists as appendices have been addressed, with specific guidance provided for each.
• Small Business Goals: Clarification has been provided on the application of small business goals (31% for IDIQ, with specific socio-economic category goals) and the requirement for SBA certification for certain categories.
• Technical Requirements: Several questions sought clarification on specific WBS references, PWS sections, and the applicability of certain services (e.g., Help Desk, Integration Services, Release Management), with the government confirming typos and indicating corrections in the final RFP.
• Contract Details: The government confirmed that the contract will be a single-award IDIQ, not a MAC-IDIQ. Transition periods for task orders are anticipated to be 60-90 days and will be clarified in the final RFP.
• Key Personnel & Security: Guidance was provided on key personnel requirements, including the need for a designated Program Manager for the Air Task Order and the requirement for an active TS/SCI with CI polygraph for key personnel, with polygraph eligibility within 90 days of start.
• Documentation & Attachments: The government confirmed that missing attachments and Bidder's Library artifacts will be provided soon and that all referenced documents will be posted in the Bidder's Library.

Numerous clarifications address potential ambiguities in the draft RFP, including corrections to typos, confirmation of requirements, and guidance on proposal preparation. Bidders should review these Q&As carefully as they will inform the final RFP package and proposal submissions.

Form / Attachment / Pricing Sheet

This document, "Annex D: Cloud Enterprise Services Guidance Version 5.2," dated 31 May 2018, provides guidance on the National Geospatial-Intelligence Agency's (NGA) cloud enterprise services. It outlines available services and tools to enhance cloud operations, including host-based security, software configuration management, and audit and logging.

• Introduction: Describes the NGA's use of Commercial Cloud Services (C2S) and the benefits of consolidating services.
• Enterprise Services Catalog: Details various service categories available to users, including:
  • Base Services (e.g., Cloud Access Portal, AMIs, configuration management)
  • Data Services (e.g., OpenDataStore, data transfer services)
  • GEOAxIS Services (authentication services)
  • Enterprise Management Services (end-to-end service delivery and performance)
  • AWS services (data transfer, computation, storage)
  • Platform Services (application employment tools)
  • API Management Services
  • DEVOPS Services (lifecycle development and testing)
  • Security Protection Services
  • Transport Services
  • IC GovCloud Services (government CSP services)
  • Additional Services (supplemental capabilities)
  • AWS UC Services (commercial cloud environment services)
• Guidance: Specifies requirements for "Certified" funding for C2S services and the process for ordering services using the Cloud Adoption Template (CAT) or AWS Management Console. It also references the NGA Cloud Information Portal for detailed procedures and workflows.

This annex is crucial for potential bidders as it defines the NGA's cloud environment, the types of services offered and mandated, and the procedures for engaging with these services. Understanding these enterprise services, their catalog, and the ordering process is essential for developing compliant and effective proposals related to NGA's cloud operations.