# ATTACHMENT C STATEMENT OF WORK

# C.1 BACKGROUND

**C.1.1** ODIN is intended to develop a long-term outsourcing
arrangement with the commercial sector which transfers to it the
responsibility and risk for providing and managing the vast majority of
NASA's desktop, server, and intra-Center communication assets and
services as the Agency downsizes and refocuses IT personnel to Agency
core missions. Additionally, this contract may be utilized by other
Agencies with external agency order placement and administration being
handled in accordance with the procedures specified by the GSA/FTS
organization. NASA considers its desktop, server, and intra-Center
communications assets vital to its success as the world leader in
aeronautics, space exploration, and scientific research. NASA personnel
use IT to support NASA's core business, scientific, research, and
computational activities. As NASA continues to downsize its civil
service workforce, the Agency strives to optimize the productivity of
its workforce through the efficient use of desktop computers, high
performance networks, and sophisticated applications. It is imperative
that the commercial sector deliver cost-effective ODIN services which
meet NASA mission and program needs while achieving a high level of
customer satisfaction.

**C.1.2** NASA is a highly decentralized organization consisting of its
Headquarters and nine field Centers: Ames Research Center (ARC), Dryden
Flight Research Center (DFRC), Goddard Space Flight Center (GSFC),
Johnson Space Center (JSC), Kennedy Space Center (KSC), Langley Research
Center (LaRC), Lewis Research Center (LeRC), Marshall Space Flight
Center (MSFC), and Stennis Space Center (SSC). For the purposes of this
SOW, HQ is referred to as a center. Each Center has a unique mission and
diversified capabilities, and may have satellite facilities which are
considered a part of the Center. ODIN services must be delivered
effectively and efficiently within this dispersed organizational
structure and ensure that Agency and Center IT architectural,
interoperability, and other functional requirements are met and
maintained as IT evolves and is added to the Agency's environment. In
addition to these ten centers, the Jet Propulsion Laboratory (JPL) is a
Government Owned, Contractor Operated (GOCO) facility currently operated
by the California Technology University. Services will not be provided
by the Contractor to JPL as JPL has a separate outsourcing contract.

# C.2 SCOPE

**C.2.1** The Contractor is required to deliver comprehensive,
end-to-end desktop, server, and intra-Center communications services,
including associated capital infrastructure improvements, as well as
maintenance and enhancements to that infrastructure, throughout the term
of the contract. ODIN is expected to provide the vast majority of
desktop, server, and intra-Center communications IT capability at most
NASA Centers and those external agencies choosing to use these
contracts.

**C.2.2** In general, desktop services are to be provided on a per
"seat" basis where all required service components are bundled. Several
different seat types are required to be provided, as described in the
Service Model, Attachment E. For all of the services, management of the
necessary LAN communications infrastructure is expected to be bundled
with each service offered. Server services provide capacity and
functionality which are not already specifically bundled with the
Desktop Services. A variety of intra-Center communication services are
to be provided, such as telephone services, facsimile services, etc.
These services are to be offered distinct from the bundled seat desktop
services and server services as well as from each other. For all of
these communications services, management of the necessary
infrastructure is expected to be bundled with each service offered.

**C.2.3** These services may be provided to Government civil servants,
Government (on-site or near-site) contractors, off-site contractors,
principal investigators, Universities through grants or cooperative
agreements, GOCO organizations, and other Government agencies.

**C.2.4** The Government reserves the right to add new seat types,
service levels, and technologies in order to reduce cost, increase
efficiency and performance, or any other reason found to be advantageous
to maintaining NASA's IT environment. It is expected that technology
which emerges during the term of contract and which support the above
services will be delivered to the Government through technology
refreshment and other provisions of the contract. The Government intends
for the services to conform, where possible, with those offered
commercially and to evolving standards.

# C.3 OBJECTIVES

**C.3.1** ODIN's objectives are to: optimize service delivery by
acquiring services from a single point of contact at each Center, to
include desktop, server, and intra-Center communications services;
transfer asset management responsibilities and risk to the commercial
sector; shift civil servant resources currently supporting these
services to research and development functions in support of NASA's core
missions; reduce the cost to NASA of delivering desktop, server, and
intra-Center communications services; and facilitate IT management
through the evolution of a more common computing and communications
environment thereby enhancing system and product interoperability.

**C.3.2** In addition, NASA has socio-economic obligations which need to
be accommodated by this initiative. These are described below.

**C.3.2.1** NASA has a strong commitment to utilize small, small
disadvantaged, and woman-owned small businesses in Agency programs.
Currently, NASA has an 8 percent Agency-wide goal for prime and
subcontract awards to small disadvantaged businesses, woman-owned small
businesses, and Historically Black Colleges and Universities and Other
Minority Institutions. Over the past few years, approximately 30 percent
or more of the Agency's IT dollars have been obligated to small business
concerns (which includes 8 percent small disadvantaged business,
woman-owned small business goal). This percentage has been growing in
recent years. In Government Fiscal Year 1996, this level of contracting
represented more than 350 new awards geographically distributed
throughout the United States. NASA desires to continue this level of
support and utilize high-performing small business concerns to the
greatest extent possible, consistent with efficient contract
performance, and minimize the potential negative impact on continued
participation of such groups in any outsourcing arrangement. Ideally,
continuing the commitment of obtaining cost-effective customer services
and maximizing small, small disadvantaged, and woman-owned small
business participation may be met through teaming arrangements, joint
ventures, and/or individual subcontracting plans containing aggressive
acquisition and mentoring objectives.

**C.3.2.2** Under the letter and spirit of the Stevenson-Wydler Act,
NASA supports local educational institutions by providing excess
computer equipment to elementary and secondary schools, universities,
and other non-profit institutions. It is important to NASA that this
outreach initiative is continued where cost effective, even though the
Agency no longer has or desires to have asset management
responsibilities.

# C.4 ODIN OPERATING MODEL

This section describes the model to be used to assure that ODIN
implementation, hardware and software refreshment, and application roll
out will occur consistent with Agency and Center interoperability and
functionality requirements. The model describes when the Contractor must
coordinate with NASA and the other ODIN contractors to ensure these
objectives are met.

## C.4.1 CIO OPERATING MODEL

### C.4.1.1 GWAC CIO OPERATING MODEL

The Operating Model for non NASA ordering agencies shall be similar to
the NASA model. Specific operating procedures will be established during
the DOSP.

### C.4.1.2 NASA CIO OPERATING MODEL {R1}

NASA is responsible for establishing and maintaining the Agency and
Center IT architectures and standards that define the minimum
interoperability and functionality requirements. This is accomplished
through the CIO Operating Model, described in NASA Procedural Guide
2800. Agency level IT architectures and standards are established and
maintained through an intra-Agency consensus based process as described
in the CIO Operating Model. The ODIN Contractors shall implement the
NASA IT architectures and standards which are published in NASA's IT
Technical Standards -- Directives. NASA's standards and architecture
have previously been established through the issuance of CIO Executive
Notices (EN\'s). Information regarding the IT Technical Standards -
Directives, as well as EN's that are relevant to ODIN, but are planned
to be incorporated into an IT Management or Records Management Directive
that is not yet published (e.g., NPG 2800) can be found at
\<http://stewmgr.gsfc.nasa.gov/itstandards.html\>. In addition to Agency
level architectures and standards, the individual Centers have their own
unique processes and documents through which Center level IT
architectures and standards are issued. NASA is shifting the
responsibility to select specific IT systems and products to meet NASA
IT requirements and implement all NASA established standards to the ODIN
Contractors. All ODIN Contractors are jointly and mutually responsible
for all system-level and product-level integration testing to ensure
interoperability and functionality, as well as compliance with Agency
and Center IT standards and architectures.

## C.4.2 COORDINATION AND INTEGRATION ROLES, RESPONSIBILITIES, AND PROCESSES

**C.4.2.1** The NASA CIO has delegated responsibility to GSFC to
implement ODIN. GSFC will use an intra-agency team consisting of a
Program Manager (PM) and staff, a Contracting Officer for the master
contracts, Delivery Order Contracting Officers (DOCO), and Delivery
Order Contracting Officer's Technical Representatives (DOCOTR). The PM
is responsible for ODIN Program Operations. The PM is directly
accountable to the NASA CIO and the NASA CIO Council for meeting ODIN
program and performance objectives. Included in this responsibility is:
ensuring contractor compliance with the terms and conditions of their
contracts, implementing and ensuring compliance with Agency
architectures and standards, assuring maintenance of interoperability
and compatibility across the Agency, and validating that contractor
offered systems and products are within the system and product
performance specifications, Attachment N, ODIN Performance
Specifications.

**C.4.2.2** Both NASA and the ODIN Contractors are encouraged to
recommend additions, modifications, and deletions to Agency and Center
IT policies, architectures, standards, and procedures. All proposed
changes will be reviewed before implementation at the appropriate level
(Agency or Center). It is the responsibility of the Contractor(s) to
raise adverse impacts to stability, cost, architecture,
interoperability, compatibility or service. The Contractor shall also
review with NASA any planned system implementations, including
hardware/software refreshment and application rollout, which could be
reasonably expected to have an adverse impact on the stability of the
existing IT environment.

**C.4.2.2.1** To assure maintenance of the NASA IT architectural
configuration, the process set forth in paragraph 2.2.1 of NPG 2800 will
be followed. The Contractor shall bring recommendations for changes to
the NASA IT architecture and standards to the attention of the ODIN PM,
who will be responsible for ensuring the review and approval process is
conducted in compliance with NPG 2800, and communicating results of that
process to the Contractor. When reviewing and approving recommendations
for changes affecting ODIN, the CIO Representatives Board will be
augmented by the ODIN Program Manager and the ODIN Contractor Program
Managers. To facilitate management of the ODIN Program and resolution of
program issues which cannot be resolved at a lower level, the CIO
Council, chaired by the NASA CIO, will be augmented as appropriate with
senior ODIN Contractor representatives.

**C.4.2.2.2** Each Center will establish a Center level Configuration
Control Board (CCCB), chaired by the Center CIO and membership made up
of at least the DOCOTR and the ODIN Contractor's representative.
Functions of the CCCB include approving proposed changes to local
architectures and standards, which assure changes in local architectures
and standards are consistent with Agency interoperability and
compatibility standards. The Centers may use an existing or alternative
mechanism that accomplishes the same results.

**C.4.2.3** Each Center will have a DOCOTR. The DOCOTR is responsible
for ODIN Center Operations, and is directly accountable to the ODIN
Program Manager for meeting ODIN program and performance objectives,
ensuring the Contractors' compliance with the terms and conditions of
their delivery orders, implementing and ensuring compliance with Agency
architectures and standards, and assuring maintenance of
interoperability, compatibility across the Agency, and managing the
local configuration. ODIN Contractors shall coordinate system, product,
and service roll outs with the DOCOTR to facilitate implementation to
minimize impact to end-users.

**C.4.3** The selection of systems, products, and services are the
responsibility of the Contractor(s). The Contractor shall meet the
requirements for interoperability and functionality and maintain
configuration control of their specific Center environment. The
configuration shall be current and available for NASA review and use,
upon request. The ODIN Contractors shall coordinate their system,
product and service roll outs with the other ODIN Contractors to assure
Agency or Center level interoperability or functionality requirement are
not compromised. Where the ODIN Contractors cannot agree among
themselves on matters affecting the interoperability or functionality of
ODIN systems, the ODIN Contractors shall establish and employ binding
conflict resolution techniques, at their expense. This process shall not
impact schedules, and the Government will not be a party to such
conflict resolution. The Contractor shall inform the PM as soon as
practicable of any issue requiring binding conflict resolution.

# C.5 SERVICES REQUIRED

The Contractor shall provide the standard and optional services
described in the Service Model, Attachment E, as further described in
delivery orders issued under this contract. This includes any servers
(e.g., email, print, file, and similar end user and domain based
application servers) and/or "back office" products and services required
to deliver the functionality to the desktop seats and communication
services. In addition, the Contractor shall provide the following
additional services, as appropriate.

## C.5.1 END USER TRAINING

In addition to the training requirements specified in the Service Model,
the Contractor shall offer a broad range of training courses covering
the breadth of products and services, including ODIN-supported COTS
software, on a fixed price per person basis. These offerings shall be
made available through the Catalog of Services and Commercial
Components, Attachment G. Training facilities for both training types
shall be located in a convenient location to individuals supported by
ODIN. If an on-site training location is used, the facility can only be
used to train NASA, tenant Agency, or NASA contractor employees.

## C.5.2 END USER DOCUMENTATION

The Contractor shall provide unrestricted access to end user electronic
documentation on ODIN services for the use of any products delivered.
Hardcopy documentation shall be available in the CSCC, Attachment G.
Additionally, the Contractor shall provide a Center telephone directory
in accordance with the terms in DRD5.

## C.5.3 INTEGRATED CUSTOMER SUPPORT/HELP

For all ODIN provided services, the Contractor shall provide, the
following integrated customer support and help as specified in the
Service Model. At a minimum these services shall include:

(a) Appointing a Multiple Resource Single Point of Contact (MRSPOC) for
    all ODIN provided services.

(b) Providing a toll free phone number for service calls. The phone
    number shall be available 24 hours a day, 7 days a week with
    response consistent with the seat service level.

(c) Providing telephonic and/or electronic mechanisms for problem
    reporting, requests for service, and action status. These services
    shall be available 24 hours a day, 7 days a week with response
    consistent with the seat service level

(d) Minimizing the amount of time it takes for a customer to report
    problem to the representative.

(e) Routing of non-ODIN actions to the appropriate service provider
    within 15 minutes after acknowledgement receipt of the trouble
    ticket.

(f) Tracking of problems from initial call to problem resolution. This
    includes problems redirected to non-ODIN service providers. (Note:
    The ODIN return to service metric will be suspended during the
    period the non-ODIN service provider is resolving problem.)

(g) Notifying users of problem status and resolution.

(h) Monitoring systems to proactively determine, diagnose, and resolve
    problems. This includes notifying customers and all service
    providers of known problems and alerts.

(i) Providing access to ODIN service offerings, (e.g., Service Model,
    Attachment E; CSCC, Attachment G).

(j) Providing end user documentation for provided services.

(k) Provide consultation services for all Triage Level 1 software
    packages. For purposes of this requirement, consultation services
    includes assisting customers in the correct usage of the software,
    but does not include application development.

## C.5.4 SYSTEM ADMINISTRATION

The Contractor shall be responsible for administration of server and
desktop systems containing various data which has inherent security
requirements. The Contractor shall obtain security clearances, implement
non-disclosure agreements, and comply with Section C.8, IT Security
Requirements, to assure that data on ODIN systems is not compromised.
All ODIN system administrators shall be qualified and certified where
appropriate to administer ODIN systems. The Contractor shall be
responsible for the integrity and availability and as necessary,
confidentiality of all data on all ODIN servers. The Contractor shall
provide a backup and recovery capability for all ODIN servers. In the
event of a server system failure, the Contractor shall be able to
restore the latest backup copy of user data, up to the previous five
versions. In no event shall a user lose more than one day's work. The
Contractor shall provide the capability to restore server user data
consistent with Agency and Center standards. Depending on the system
administration level included in the seat/system functionality, the
Contractor may retain full administrative privileges to the system, (see
Attachment E for appropriate service levels). Where system privileges
are shared or the Government has exclusive rights, the Contractor shall
provide guidance as to the policies and procedures to ensure
interoperability and system integrity are adequately communicated to the
Government administrators. The Government will then assume
responsibility to ensure that security and interoperability requirements
are met.

## C.5.5 SUPPORT TRIAGE FOR ODIN AND NON-ODIN COMPONENTS 

The services provided by the Contractor shall accommodate the
installation, development, and execution of Government-provided and
user-developed hardware and software. This section describes the
Contractor's responsibility on ODIN-managed/provided seats/systems in
this environment.

### C.5.5.1 ODIN-SUPPORTED HARDWARE AND SOFTWARE (Triage Level 1)

For ODIN-supported hardware and software on ODIN-managed/provided
seats/systems, the Contractor shall provide the full scope of services
required by the Service Model and SOW, as a part of the seat/systems.
ODIN-supported hardware and software systems include: Agency and Center
standard COTS hardware and software loads; Center specific COTS hardware
and software loads; all ODIN Communication services; and items purchased
from the CSCC, Attachment G. See Attachment L for a list of software
Triage Level 1 products.

### C.5.5.2 NON-ODIN SUPPORTED HARDWARE AND SOFTWARE (Triage Level 2)

ODIN will provide support to Triage Level 2 supported hardware and
software on ODIN-managed/provided seats/systems as identified below. See
Attachment L for a list of software Triage Level 2 products.

**C.5.5.2.1** Non-ODIN supported hardware and software systems may
include any Agency and Center standard hardware and software loads
supported by the Government or through non-ODIN contracts. The non-ODIN
hardware and software also includes items purchased through the CSCC
with Triage level 2 support (see Attachment G). For each NASA Center,
the Government will identify a point of contact (POC) to the ODIN
Contractor for each hardware and software product in this category. For
Triage Level 2 items (included in the seat/system), the Contractor
shall:

(a) Facilitate resolution of problems and respond to user requests for
    information and configuration changes about this hardware and/or
    software by working, if necessary, with the Government identified
    POC.

(b) Install the non-ODIN supported hardware and software. If required
    the ODIN Contractor shall identify the location and make available
    the appropriate file space to store non-ODIN supported software.

(c) Ensure the availability of the baseline version of the non-ODIN
    supported hardware and software.

(d) De-install and re-install any non-ODIN supported hardware and
    software to another location consistent with the move, add, and
    change provisions for a system (see Attachment E.3.1.8 Moves, Adds,
    Changes)

(e) Return the configuration to the baseline operable installation when
    it is determined that the non-ODIN supported hardware and/or
    software implementation affects the stability or operability of the
    ODIN configuration.

**C.5.5.2.2** If the Contractor has added non-ODIN supported hardware or
software component(s) to the existing base configuration and the updated
configuration is stable and interoperable; the updated configuration
will be established as the new baseline for that system. If the
Contractor subsequently modifies the baseline configuration as part of a
normal ODIN process, and that configuration becomes unstable due to the
non-ODIN supported hardware and/or software implementation, the
customer\'s need to accomplish the NASA mission must supersede the new
configuration modification and the Contractor shall return the
configuration to the established baseline. If this inability to update
the baseline configuration results in the Contractor being unable to
achieve a contract performance metric, then the DOCOTR should be
contacted for resolution.

### C.5.5.3 other HARDWARE AND SOFTWARE (Triage Level 3)

Triage Level 3 hardware and software is any item not covered by Triage
Levels 1 and 2. On any ODIN managed/provided seat/system with
maintenance or technology refreshment, the Contractor is responsible for
the following:

(a) For seats SE1 through SE3 individual baseline seat configurations
    may have to be jointly defined by the end user and the Contractor to
    ensure continuity of the NASA mission and the ODIN performance. If a
    customer installs other hardware or software component(s) on the
    existing seat configuration and the Contractor and the end user
    jointly agree that the updated seat configuration is stable and
    interoperable; the updated seat configuration shall be established
    as the new seat configuration for that end user. In those cases
    where a mutual agreement regarding the seat configuration cannot be
    reached, a decision will be rendered by the DOCOTR.

(b) For any seat where an end user has implemented a change to the
    established baseline configuration and the Contractor subsequently
    modifies the seat configuration, and that configuration becomes
    unstable or ceases to be interoperable due to end-user effected
    change, the Contractor shall return the configuration to the
    previous established baseline if the customer\'s need to accomplish
    the NASA mission supersedes the need of the ODIN configuration
    modification. The DOCOTR will decide the priority of needs and
    resolution of performance metrics in this instance. The Contractor
    shall charge for this service according to A.1.15; see also C.5.9.7.

(c) In addition to the above, for any seat where it is determined that a
    hardware or software Triage Level 3 change has affected the
    stability, operability, or performance metrics for the seat or any
    ODIN service, the Contractor shall return the configuration to the
    baseline operable configuration. A joint decision will be made
    between the Contractor, end user and DOCOTR on how to proceed. The
    Contractor shall charge for this service according to A.1.15; see
    also C.5.9.7.

## C.5.6 ASSET REQUIREMENTS

### C.5.6.1 ASSET/RESOURCE TRACKING

The Contractor shall use an asset management system to identify, track,
and report all ODIN managed assets at the hardware, software and
communication component (i.e., hardware and software product) and system
levels. This includes Government-owned assets, as well as the
infrastructure. The Contractor shall provide asset/resource information
covering the seat or system configuration which includes selected
service level options and catalog selections, customer profile, asset in
service date, projected refresh date, and current special status levels
(e.g., mission critical uplift, security uplift, mission freeze).

### C.5.6.2 PROPERTY MANAGEMENT TRACKING SYSTEMS

The Contractor shall update information in the Government's property
management tracking system databases for Government-owned, ODIN-managed
resources. This requirement shall be performed until the disposal of
Government-owned assets managed by the Contractor takes place. The
Government will be responsible for disposing of Government-owned assets.

### C.5.6.3 CONFIGURATION CONTROL

The Contractor shall maintain configuration control for the
ODIN-managed/provided environment. The Contractor shall be able to
identify, track, and report on all ODIN managed assets. System
configuration information to be tracked includes current hardware
configuration, software versions, software license utilization, network
identification information, and communication system configuration.
System architectures, "as-built" diagrams, and communication system
configurations shall be available for Government review and use upon
request.

### C.5.6.4 ASSET REPORTING REQUIREMENTS

The Contractor shall provide periodic reports as required by DRD 1.
(This includes reporting requirements stated in C.5.6.1 and C.5.6.3).
The Contractor shall allow, to the Center ODIN customer base on an
ongoing basis, electronic access and SQL query capability to the asset
databases.

## C.5.7 CATALOG SERVICES

**C.5.7.1** The Contractor shall provide a catalog of
commercially-available products and services, or CSCC, which augments
the bundled products and services described in the Service Model,
Attachment E. These items are to be provided and priced individually
(i.e., not bundled within the seat or service). Orders from this catalog
shall not affect the price of the basic seat or system.

**C.5.7.2** Catalog items shall be offered and priced in three
categories for the master contract. At DOSP, centers will identify the
category under which each product will be available. Complete
descriptions for each of the categories are detailed in Attachment G.

**C.5.7.3** Additional items may be added to the catalog at the
discretion of the Contractor, or as requested by the Government. The
Government reserves the right to remove items from the catalog.

## C.5.8 INTEGRATION AND TESTING

**C.5.8.1** During the course of this contract, the Contractor shall
periodically modify the user\'s existing configuration, (i.e., by
applying maintenance or technology refreshment enhancements). In
effecting these enhancements, the Contractor shall:

(a) Minimize the time involved to complete the configuration
    modification to achieve the updated baseline.

(b) Coordinate system, product, and service roll outs with the DOCOTR to
    facilitate implementation to minimize impact to end-users.

(c) Maintain interoperability amongst the various seat configurations. A
    modification to any existing baseline configuration which was
    interoperable prior to the modification shall maintain that
    interoperability after the modification is fully integrated.

**C.5.8.2** At the Government\'s discretion, modifications to the
baseline (i.e., at a minimum, changes to the Standards and Architecture)
and the integration of those modifications may be required to be
demonstrated to the Government prior to implementation. This
demonstration should minimize Government travel and the impact to ODIN
customers.

## C.5.9 SPECIALIZED REQUIREMENTS

### C.5.9.1 MISSION CRITICAL REQUIREMENTS

The Contractor shall uplift any seat to Mission Critical Status in
accordance with the procedures and pricing described in Section A.1.15.

### C.5.9.2 MISSION FREEZE

Due to mission operations, there will be times when contractor access to
specific systems and areas will be restricted. These restrictions may
prevent the Contractor from performing routine services, (e.g.,
preventative maintenance, conducting outages, implementing software
and/or hardware configuration changes); however, services levels shall
be maintained and corrective maintenance performed as required. These
restrictions, regardless of duration and frequency, will not entitle the
Contractor to any price adjustment. The Contractor shall coordinate
access, when necessary (i.e., corrective maintenance), to the affected
systems and areas with the DOCOTR. The Government will notify the
Contractor no less than three working days prior to the freeze or as
negotiated at DOSP.

### C.5.9.3 TEMPORARY SYSTEMS 

For well defined but short periods of time, usually three months or
less, ODIN seats are required on a temporary basis. The standard
configuration for each seat offered by the Contractor shall be
available, with the ability to customize the seat with any selectable
optional services.

### C.5.9.4 PRIORITY SERVICE 

**C.5.9.4.1** The Contractor shall allow for up to one (1) percent of
all seats at any time to receive priority service. Once the trouble
ticket has been issued, response to the problem shall be no greater than
30 minutes. Return to service or a workaround shall be no greater than 2
hours. The cost of providing this priority service shall be bundled in
and distributed across all seats provided. The DOCOTRs will deliver to
the Contractor and maintain current a list of those seats requiring
priority service.

**C.5.9.4.2** Additionally, the Contractor shall provide priority
service for up to one (1) percent of all problems exclusive of those
covered above. Once the trouble ticket has been issued, response to the
problem shall be no greater than 30 minutes. Return to service or a
workaround shall be no greater than 2 hours. The cost of providing this
priority service shall be bundled in and distributed across all seats
provided. The procedure for escalating a problem which requires priority
service will be established during the DOSP.

### C.5.9.5 TELECOMMUTERS, TRAVELERS, & OFF-SITE PERSONNEL 

For ODIN seats used by telecommuters, travelers, and other off-site
personnel, remote diagnostics and troubleshooting will be performed to
the extent possible in an attempt to resolve problems remotely. The
Contractor is not required to provide services at the remote location.
For problems and services that cannot be resolved or provided remotely,
the ODIN seats will be returned to the NASA Center of origin or an ODIN
Contractor facility, whichever is more convenient to the Government.
Return to service and performance metrics will apply once the seat is at
a supported location and the specific location is acknowledged by the
Contractor.

### C.5.9.6 SECURITY UPLIFT

The Contractor shall uplift any seat to a classified (secure) level (see
Section C.8) in accordance with the procedures and pricing described in
Clause A.1.15.

### C.5.9.7 RETURN TO SERVICE

The Contractor shall restore the baseline configuration in accordance
with Section C.5.5.3 and the procedures and pricing described in Clause
A.1.15.

### C.5.9.8 NETWORK RESEARCH REQUIREMENTS 

The Contractor shall change any seat or service to Network Research
Status in accordance with the procedures and pricing described in Clause
A.1.15. This seat change shall only be accomplished by notification from
the DOCOTR. Network research activities may prevent the Contractor from
performing preventative maintenance, scheduled outages, software and
hardware configuration changes. However, necessary communication
services shall be maintained and corrective maintenance performed. The
Contractor shall coordinate with the DOCOTR when access to the affected
systems is necessary. The Government will notify the Contractor no less
than three working days prior to the freeze. Due to network research by
a Center, there will be times when contractor access to specific
systems, services, or areas will be restricted. During these periods of
increased service risk (e.g. higher possibility of unstable networks,
performance impacts, service instability) to support network research
requirements, there will be times when the required service level(s) and
metrics may not be met. These restrictions will not entitle the
Contractor to any price adjustment. During these periods the Contractor
will not be held accountable to meet the metrics. Further, the credit
for outage clause in the contract shall not apply.

### C.5.9.9 Excess celluLar phone usage

The Contractor shall charge for cellular use in excess of 500 minutes
pursuant to the pricing established in the CSCC.

## C.5.10 SOFTWARE RIGHT TO USE

The Contractor shall offer to the Government the right to use ODIN
provided software at different locations and non-concurrent use on
multiple platforms (e.g., allow a second copy to be utilized on a home
computer), to the extent the Contractor is able to obtain this right
from the software publishers.

## C.5.11 Local Area Network Support

The Contractor shall provide for the management, operation, and
maintenance of a Center's local area network, as defined in the Service
Model, Attachment E, subject to A.1.10, Allowable Cable Plant Delivery
Order Changes.

# C.6 PERFORMANCE METRICS

The Contractor shall report performance metrics in accordance with DRD
2. The Contractor shall provide, maintain, and execute the tool(s)
required to capture all metrics. However, the Government requires the
right to access the tools upon request. The monthly electronic reporting
shall be retained (electronically in a consistent format) and available
upon request until 180 days after contract completion.

# C.7 TECHNOLOGY REFRESHMENT PROCESS 

The Contractor shall routinely refresh technology as required by the
Service Model or other provisions of this contract. Technology
refreshment shall be accomplished and proposals for technology infusion
submitted in accordance with Sections A.1.18, Technology Refreshment
Proposals and C.4, ODIN Operating Model. The Government reserves the
right to verify SOW performance requirements.

## C.7.1 PERIODIC/ROUTINE TECHNOLOGY REFRESHMENT

**C.7.1.1** ODIN Desktop seats have fixed technology refreshment periods
included as a service level component. The Contractor shall periodically
assess the offerings for each seat and update the seat configuration
based on the best value to the Government for each seat functionality
and price. The Contractor shall, at a minimum, refresh 1/n of the seats
with an n year refreshment cycle each year where n is the refresh
period. Desktop performance will be measured using the methodology
defined in Attachment N, ODIN Performance Specifications, and shall meet
or exceed the performance measures identified in Attachment R,
Technology Refreshment Baseline.

**C.7.1.2** As ODIN Communications Services and Server Seats as defined
in Attachment E, ODIN Service Model, do not have a predefined technology
refresh period, the Contractor may propose suitable technology
refreshments at any time.

## C.7.2 TECHNOLOGY INFUSION

The Contractor shall continually assess the state of technology and
NASA's IT requirements and infrastructure and propose new technology and
services for NASA's consideration. This shall include recommendations to
change Agency and Center architectures, standards, products, systems,
and services. Assessments of new technological security threats should
be included in the ODIN technology infusion. These proposals shall be
submitted under the value engineering and other provisions of the
contract.

# C.8 INFORMATION TECHNOLOGY SECURITY REQUIREMENTS {R3}

## C.8.1 COMPUTER SECURITY REQUIREMENTS {R1}

The requirements stated in NASA Policy Directive (NPD) 2810, \"Assuring
the Security of Information Technology\" and NASA Procedures Guidance
(NPG) 2810.1, \"NASA Information Technology Security Guidelines\" apply
to all IT systems and networks under NASA\'s purview operated by or on
behalf of the Federal Government, whether located in Federal, contractor
or subcontractor installations. This includes all workstations, servers
and portable computers (e.g. laptops and notebooks) used by NASA
employees and NASA contractors to remotely access NASA computing and
networking resources regardless of location. Remote access is defined as
logging into a NASA computer system through a network or a modem to
execute a command on the NASA computer system from a remote location, or
to manipulate data stored on a NASA computer system from a remote
location. Compliance with these requirements will be monitored by
periodic computer security audits performed by or on behalf of NASA. All
information processed, stored, or transmitted by contractor equipment
belongs to the Government, even though the Contractor may own the
equipment. By having the responsibility to maintain the equipment, the
Contractor does not acquire access rights to the information or rights
to redistribute the information. The Contractor understands that civil,
criminal, or administrative penalties may apply for failure to protect
information appropriately.

## C.8.2 CLASSIFIED (DoD) INFORMATION SUPPORT

The highest classification level of information required in connection
with this procurement is TOP SECRET.

In accordance with the National Industrial Security Program Operating
Manual, DoD 5220.M, the Contractor must possess or be able to possess a
Facility Security Clearance equal to the highest level of classified
information necessary to perform the tasks or services required on this
contract. Security requirements relating to the handling and
safeguarding of classified information will be identified in the
Contract Security Classification Specification (DD Form 254) issued as
Attachment J to the contract. Contractor personnel, whose duties require
access to systems processing classified information, must possess a
security clearance at least equal to the highest degree of
classification involved and have a validated need-to-know prior to
beginning work on the classified system. The sponsoring agency\'s
security requirements for classified systems must be met by all
contractor personnel accessing classified information or systems
processing classified information. The Contractor shall provide the
capability to support any seat type at a \'DoD Classified\' security
level. It is expected that less than 50 of all seats supported by the
Contractor will have a \'DoD Classified\' security requirement. The
price for providing this support shall not be included in the NTE seat
price, but shall be ordered as a surcharge on a per seat basis as
specified in Attachment K

## C.8.3 SENSITIVE INFORMATION SUPPORT (UNCLASSIFIED)

Under current Federal guidelines, all officially held information is
considered sensitive to some degree and must be appropriately protected
by the Contractor as specified in applicable IT Security Plans. Types of
sensitive information that will be found on NASA systems that the
Contractor will have include, but are not limited to: Privacy Act
information; information that is proprietary to companies or contractors
other than the subject contractor; resources protected by International
Traffic in Arms Regulation (ITAR); technology restricted from foreign
dissemination for competitive reasons; NASA administrative
communications, including those of senior Government officials;
procurement or budget data; information on pending cases by Equal
Employment Opportunity (EEO); labor relations; legal actions;
disciplinary actions; complaints; IT security pending cases; civil and
criminal investigations; information not releasable under the Freedom of
Information Act (FOIA) (e.g. payroll, personnel, and medical data).

Performance under this contract will involve access to and/or generation
of sensitive information or systems. The Contractor shall perform an
assessment to determine position sensitivity and management controls to
prevent the individuals in these positions from bypassing controls and
processes such as individual accountability requirements, separation of
duties, access controls, and limitations on processing privileges. These
position sensitivity assessments will be forwarded to the DOCO and
DOCOTR, the NASA system owner, and the NASA information owners for a
determination of personnel suitability requirements for individuals
assigned to the positions in accordance with DRD3. Ongoing
re-evaluations of the positions and suitability requirements will be
necessary during the life of the contract as positions and assignments
change.

The Contractor shall conduct initial risk assessments, document the
results, develop and maintain IT Security Plans in accordance with the
IT security requirements in effect at the Center at which the system is
operated. This plan shall describe how the integrity, availability,
confidentiality of the information and IT resources will be protected,
including protection (disclosure) from the subject contractor.

A decision to accept any residual risk will be the responsibility of the
NASA system owner and the NASA information owners. The Contractors risk
assessments and IT Security Plans shall be updated at least every three
years or upon significant change to the functionality of the assets,
network connectivity, or mission of the system, whichever comes first.
If new or unanticipated threats or hazards are discovered by the
Contractor, or if existing safeguards have ceased to function
effectively, the Contractor shall update the risk assessments and IT
Security Plans (within 30 working days) and shall make appropriate risk
reduction recommendations to the NASA system owner and the NASA
information owners (within 5 working days).

## C.8.4 PRIVACY AND SECURITY SAFEGUARDS {R1}

The Contractor shall not publish or disclose in any manner, without the
data owner and NASA Center IT Security Manager written consent, the
details of any security safeguards designed, developed, or implemented
by the Contractor under this contract or existing at any NASA Center.

The Contractor shall develop procedures and implementation plans to
ensure that IT resources leaving the control of the assigned user (such
as being reassigned, removed for repair, replaced, or upgraded) is
cleared of all NASA data and sensitive application software by a
technique approved by the Center IT Security Manager (currently
overwriting at least three times). For IT resources leaving NASA use,
applications acquired via a \"site-license\" or \"server license\" shall
be removed. Damaged IT storage media will be degaussed or destroyed.

{R1}To the extent required to carry out a program of inspection and
audit to safeguard against threats and hazards to the confidentiality,
integrity, and availability of government data, the Contractor shall
afford NASA access to the Contractor\'s facilities, installations,
technical capabilities, operations, documentation, records, databases,
and personnel.

## C.8.5 SECURITY INCIDENT REPORTING {R1}

The Contractor shall promptly report to the Center Information
Technology Security Manager any suspected computer or network security
incidents occurring on any systems. If it is validated that there is an
incident, the Contractor shall provide all necessary assistance and
access to the affected systems so that a detailed investigation can be
conducted and lessons learned documented. Security logs and audit
information shall be handled according to evidence preservation
procedures.

## C.8.6 IT SECURITY TRACKING {R3}

The Contractor shall, at a minimum, implement a management program to
identify, track, and report on the current status of assignments of
responsibility for IT security, establishment of IT security plans,
review of

security controls, and authorizations to process. The Contractor shall
identify, track, and report the number of incident occurrences on an
ODIN supported system, receiving regular or enhanced system
administration. Incidents to be tracked include: unauthorized access of
an ODIN supported system wherein a valid account is used without
authorization and successfully gains access to the system; a valid
account is used in excess of authorized access and successfully gains
access to unauthorized information; a weakness in the system is
successfully exploited and successfully used to gain access to
unauthorized information; resources are stolen which provide access to
password files, protected or restricted data (proprietary or export
controlled), licensed applications or software, restricted applications,
software or code; or, an authorized account is used in violation of
Federal, NASA or Center policies regarding proper use of computer
resources. The contractor shall track the number of each incident
occurrences resulting in a user\'s loss of data integrity, denial of
service, loss of confidentiality or renders the user or users
unproductive for a period of time. The contractor shall also track and
report these instances as identified by

users or system administrators of other systems.

# C.9 INTERFACE REQUIREMENTS

The Contractor shall establish appropriate interface agreements with
other Agency and/or Center contractors as required.

## C.9.1 ODIN Wide Area Telecommunications and Network Interface Requirements

The Contractor shall interface with the NASA Integrated Services Network
(NISN). NISN provides both wide area telecommunications and networking
in direct support of space operations and general programmatic and
administrative communications requirements of the Agency. NISN services
will be provided to NASA by the Consolidated Space Operations Contract
(CSOC) as identified in C.9.1.1.1.1, Table 1, Intercenter Service
Provider Evolution. Both NISN and CSOC are managed by the Space
Operations Management Office (SOMO). The CSOC participating Centers are
currently JSC, MSFC, KSC, JPL, and GSFC.

### C.9.1.1 NISN Wide Area Communications Background 

**C.9.1.1.1** NISN is the consolidation of NASA's various
telecommunication networks under the management of a single project
office. NISN services include:

> Long Distance Switched Voice Service
>
> Facsimile (FAX) Service
>
> Voice Teleconferencing Service (VoTS) and Mission Voice Service
>
> Video Teleconferencing Service (ViTS)
>
> Low Bandwidth Video (LBV) Service
>
> Internet Protocol (IP) Services
>
> High Rate Data and Video (HRDV) Services (Mission)
>
> Dedicated Transmission Services
>
> International Services

Reference the NISN Network Services Document for complete and current
descriptions. The data communications services include the physical
network resources and supporting infrastructure of the former PSCN,
Nascom, NSI, EBnet, and Aeronet.

**C.9.1.1.1.1** Each of these legacy networks will undergo significant
changes in services and transmission architectures in the near term.
NISN is in the process of redefining routed data services, based largely
on the Internet Protocol (IP), in lieu of the project-based networks of
the past. These router based service offerings are classified as
"Standard, Premium, and Mission Critical" as specified in the "NISN
Network Services Document" (included in the ODIN Offeror's library). For
quick reference, these categories are summarized below.

> Standard - normal, commercially available service
>
> Premium - predictable level of network performance
>
> Mission Critical-superior reliability, availability, and performance

The table below is representative of the typical user base and
associated user requirements within NASA and the evolution of service
providers for those services over time. Today's Service Provider
represents the environment at the time that the ODIN RFP is released.
The Near Term Service Provider represents changes currently being
implemented in NISN by Program Information Systems Mission Services
(PrISMS) contract, with the Long Term Service Provider, CSOC, beginning
to be implemented in FY98.

Table C.9.1.1.1.1 \-\--Intercenter Service Provider Evolution

+-------------+-------------+-------------+-------------+-------------+
| **Typical   | **WAN       | **Today's   | **Near Term | **Long Term |
| User Base** | Service     | Service     | Service     | Service     |
|             | Level       | Provider**  | Provider**  | Provider**  |
|             | Re          |             |             |             |
|             | quirement** |             |             |             |
+=============+=============+=============+=============+=============+
| Adm         | *           | **PSCNI**   | **NISN      | **NISN      |
| inistrative | *Standard** |             | (PrISMS)**  | (CSOC)**    |
| and         |             | **NSI**     |             |             |
| In          |             |             |             |             |
| stitutional |             |             |             |             |
+-------------+-------------+-------------+-------------+-------------+
| Laboratory, | **Premium** | **PSCNI**   | **NISN      | **NISN      |
| E           |             |             | (PrISMS)**  | (CSOC)**    |
| ngineering, |             | **Aeronet** |             |             |
| Science     |             |             |             |             |
|             |             | **NSI**     |             |             |
+-------------+-------------+-------------+-------------+-------------+
| Space       | **Mission   | **NASCOM**  | **NISN      | **NISN      |
| Operations  | Critical**  |             | (PrISMS)**  | (CSOC)**    |
|             |             | **EBNET**   |             |             |
+-------------+-------------+-------------+-------------+-------------+
| New         | **Advanced  | **NREN**    | **WAN R&D,  | **WAN R&D   |
| Technology  | T           |             | (i.e.       | (ARC)**     |
|             | echnology** |             | NREN)**     |             |
+-------------+-------------+-------------+-------------+-------------+

**C.9.1.1.1.2** The CSOC Contractor also provides local area networking
for Space Operations activities. These local area networks will be
linked directly to wide area communications services by CSOC.
Additionally there exists a need to interface these local area networks
to the ODIN provided local area networks.

The table below is representative of the typical user base and
associated user requirements within NASA and the evolution of service
providers over time.

Table C.9.1.1.1.2\--LAN Service Provider Evolution

  ------------------------------------------------------------------------------
  **Typical User    **Typical       **Today's      **Near Term    **Long Term
  Base**            Service Level   Service        Service        Service
                    Requirement**   Provider**     Provider**     Provider**
  ----------------- --------------- -------------- -------------- --------------
  Administrative,   **Campus,       **See ODIN     **See ODIN     **ODIN**
  Institutional,    Organization,   Offerors       Offerors       
  Laboratory,       or Lab LAN**    Library at     Library at     
  Engineering,                      each Center**  each Center**  
  Science                                                         

  Space Operations  **Mission       **See CSOC     **See CSOC     **CSOC**
                    Critical**      Offerors       Offerors       
                                    Library (e.g.  Library (e.g.  
                                    SFOC, CNMOS)** SFOC, CNMOS)** 

  KSC Launch        **Mission       **See ODIN     **See ODIN     **TBD**
                    Critical and    Offerors       Offerors       
                    Campus**        Library (e.g.  Library (e.g.  
                                    SFOC, JBOSC)** SFOC, JBOSC)** 
  ------------------------------------------------------------------------------

### C.9.1.2 ODIN Communications Interface Requirements

#### C.9.1.2.1 Local Area Networking and other Wide Area Communication Networks

The Contractor shall interface the local area network and other
communication services to wide area service providers. NISN is the
primary wide area service provider for NASA. The Contractor shall be
responsible for the physical, operational, security and performance
characteristics of the interface and ensure that the interface is not
the limiting factor in the end-to-end performance. The Contractor shall
coordinate problem resolution with the NISN Help Desk. For an
explanation of NISN systems and interfaces, refer to:

-   NISN Network Services Document

-   Transition Plan for NASA Routed Data Network Consolidation

-   PrISMS Data Requirement DR6.7, PSCN Network Description Document

#### C.9.1.2.2 Other Local Area Data Networks {#c.9.1.2.2-other-local-area-data-networks .unnumbered}

The Contractor shall interface the ODIN local area network to the other
on-site Local Area Network(s) (e.g., CSOC). The Contractor shall be
responsible for the physical, operational, security and performance
characteristics of the interface and ensure that the interface is not
the limiting factor in the end-to-end performance.

#### C.9.1.2.3 Other Local Communications Services {#c.9.1.2.3-other-local-communications-services .unnumbered}

The Contractor shall be required to interface with CSOC and other local
service providers for managed communications systems, (e.g. voice
telecommunications, video telecommunications, FAX).

## C.9.2 INTEGRATED FINANCIAL MANAGEMENT PROject (IFMP) {#c.9.2-integrated-financial-management-project-ifmp .unnumbered}

Through the IFMP contract, NASA will acquire, implement, and support
Integrated Financial Management (IFM) systems as defined by the Joint
Financial Management Improvement Program, a joint cooperative of Office
of Management and Budget (OMB), General Accounting Office (GAO), the
Department of the Treasury, and the Office of Personnel Management
(OPM). These systems will be implemented on an Agencywide basis,
including NASA's Headquarters and nine Centers, and shall support all
facilities, organizations, programs, projects, and personnel. The IFM
systems are expected to employ new and emerging computing and
communication technologies which take advantage of open, heterogeneous,
distributed architectures. For the end-user desktop systems, the IFMP
Contractor is responsible for acquiring and delivering any special
end-user workstation hardware and/or software required to successfully
execute the IFMP software that is not included in the ODIN
managed/provided seat configuration. The ODIN Contractor is required to
provide support consistent with the requirements described in C.5.5.2,
Non-ODIN Supported Hardware and Software (Triage Level 2). This includes
the installation on ODIN managed systems of any IFMP-delivered client
hardware and/or software, as well as ensuring the continued successful
operation of the IFMP hardware and/or software as ODIN system changes
are implemented. For IFMP servers, the IFMP Contractor will have full
responsibility for acquiring, delivering, and installing all hardware
and any specialized networking required between the IFMP system
components; and acquiring, delivering, installing, and maintaining all
IFMP systems and application software. The ODIN Contractor shall only be
responsible to maintain an end-user desktop environment that ensures
continued successful access to IFMP servers.

## C.9.3 CENTER-SPECIFIC INTERFACES  {#c.9.3-center-specific-interfaces .unnumbered}

In addition to the Agency-wide interface requirements described above,
the Contractor shall establish interface agreements/MOU's with other
contractors and/or Government project offices as identified by each
Center during the DOSP. A list of existing major contracts/projects at
each Center for which the Contractor is expected to establish an
interface is provided in Attachment M. Additional and more specific
information will be provided when the Center initiates the DOSP. These
interface agreements shall be configuration controlled in accordance
with the CCCB process as described in Section C.4, ODIN Operating Model.

# C.10 EMERGENCY PREPAREDNESS PLAN {#c.10-emergency-preparedness-plan .unnumbered}

The Contractor shall develop procedures and implementation plans to
ensure that IT resources are protected and that acts of nature have been
considered. Details are provided in DRD 4. Center specifics will be
provided at DOSP.

**\[End of Attachment C\]**