Request for Information (RFI) - Systems and Software Assurance Services 2 (SAS 2)

The National Aeronautics and Space Administration (NASA) /Goddard Space Flight Center (GSFC)/ Independent Verification and Validation (IV&V) Program is hereby soliciting capability statements from all interested parties, including Small, Small Disadvantaged (SDB), 8(a), Woman-owned (WOSB), Veteran Owned (VOSB), Service Disabled Veteran Owned (SD-VOSB), Historically Underutilized Business Zone (HUBZone) businesses, and Historically Black Colleges and Universities (HBCU)/Minority Institutions (MI) for the purposes of determining the appropriate level of competition and/or small business subcontracting goals for the - Systems and Software Assurance Services 2 (SAS 2) requirement. The Government reserves the right to consider a Small, 8(a), Woman-owned (WOSB), Service Disabled Veteran (SD-VOSB), or HUBZone business set-aside based on responses hereto. A draft Statement of Work (SOW) is provided for information purposes only. This synopsis is for information and planning purposes and is not to be construed as a commitment by the Government nor will the Government pay for information solicited. Respondents will not be notified of the results of the evaluation. Respondents deemed fully qualified will be considered in any resultant solicitation for the requirement. SECTION 1 - BACKGROUND 1.1 BACKGROUND INFORMATION The NASA IV&V Program provides assurance to its customers that their safety and mission-critical software will operate reliably and safely. The IV&V Program strives to improve software safety, reliability, security, and quality of NASA programs and missions through effective applications of systems and software IV&V methods, practices, and techniques. The NASA IV&V Program applies software engineering best practices to evaluate the correctness and quality of critical and complex software systems throughout the System Development Life Cycle (SDLC). The NASA IV&V Program's analytical approaches enable efficient, cost effective system and software IV&V, safety and mission assurance services through the usage of broad-based expertise, adaptive software engineering best practices, and tools that are in place at the NASA IV&V Program. The analytical paradigm utilized by the NASA IV&V Program requires a multi-disciplinary team, and a qualitative software risk and criticality assessment capability coupled with extensive multiphase, phase-independent analytical processes for the performance of IV&V as well as safety and mission assurance services. The NASA IV&V Program provides Mission Protection Services across the mission lifecycle from an end to end Mission approach. Risk assessments on Mission Control Centers, Science Control centers, network system, antenna system and ground to space and space to space communication systems. IV&V has been demonstrated to be an effective technique on large, complex software systems to provide assurance that the software being delivered meets requirements and is safe, within cost, and on schedule. When performed in parallel with the SDLC, IV&V provides for the early detection and identification of risk elements. The NASA IV&V Program is then able to provide this information to the development organization, allowing them to take action to mitigate these risks early in the SDLC. Additionally, Information Assurance (IA) and other systems & software assurance activities such as reliability analysis, safety analysis, hazard analysis, independent testing and quality assurance generate additional technical evidence that a system and/or its software are ready for deployment and operation in a real-world environment. The scope of work under consideration for purposes of this Request for Information (RFI) includes the performance of systems and software assurance services, including IV&V and safety and mission assurance analysis on selected systems and software being developed by or for NASA and other Federal, State and local government agencies and other entities. The current contract providing these services is NNG17SA26C which expires May 10, 2022. SECTION 2 - SCOPE OVERVIEW The following information is included as a description of the current KNOWN requirement scope: Provide the personnel, materials, and facilities necessary to perform IV&V, safety and mission assurance services. The IV&V services include, but may not be limited to: Verification and Validation of selected NASA software systems, system/software safety analysis, software reliability analysis, system/software hazard analysis, system/software quality assurance and software independent testing. The WBS tasks applicable to this scope are documented in the NASA IV&V System Level Procedure 9-1, Independent Verification and Validation and in IVV 09-9, Safety and Mission Assurance. You can read these on the public facing website: https://www.nasa.gov/centers/ivv/ims/slps/index.html SECTION 3 - RESPONSES TO RFI 3.1 TECHNICAL CAPABILITIES In response to this RFI, interested offerors shall address the following requirements. Respond to each item below (identify by number) by describing your ability to fully perform each activity. Document your demonstrated experience for each activity by providing objective evidence of that experience (specific but brief examples, clearly indicate if the demonstrated experience was in a software development, Verification and Validation (V&V) and/or Independent Verification and Validation (IV&V) environment). If you are unable to fully perform an activity, identify such is the case and address how you may accommodate the area(s) that you cannot currently perform. For each response, please indicate if the effort was major or minor. Describe or provide evidence where you performed technical assessment and effort scoping of a typical aerospace mission for a full lifecycle IV&V project. Describe or provide evidence where you performed analysis, cost planning and management for a full lifecycle V&V or IV&V project. Describe or provide evidence of systems knowledge and experience in performing technical analysis of development projects across a wide range of development lifecycle philosophies (e.g. Waterfall, Spiral, Agile, etc.). Describe or provide evidence of processes and approaches to providing Cybersecurity services and information assurance services (specifically as it applies to space systems and protecting space and ground assets - end to end) with particular interest in using the NIST Risk Management Framework on Moderate or High system categorizations as well as: a) performing vulnerability assessments; b) penetration testing; c) Threat and Risk Assessments; and d) confirming software is free of security vulnerabilities. Describe or provide evidence where you performed Project Management on large scale contracts that involve 200+ employees and multiple subcontractors for Government or commercial entities, managing scope, cost, schedule, technical performance, risk, changes/baselines and quality control. Describe or provide evidence where you defined, documented, improved and executed process and product management of software assurance activities (Software Quality Assurance (SQA), Software Safety, Security, Software Reliability, Verification and Validation (V&V), hazard analysis) within a software development, V&V or SMA organization at both a system and software level. Describe or provide evidence of research & development in areas of software assurance (IV&V, SQA, Software Safety, Security, Software Reliability and V&V) that led to advancing the state of practice and demonstrated institutionalization of such research & development results, including cost savings or efficiency gains within a software development, V&V or IV&V organization. Describe or provide evidence of the ability to plan, scope and implement a successful system and/or software test program. Describe or provide evidence where you performed surveillance of active IV&V Project with respect to ensuring technical quality is maintained and advanced to include the development and maintenance of IV&V technical quality process assets. Describe or provide evidence where you performed the integration, application and advancement of software analysis tools in support of an IV&V analysis workflow. Describe or provide evidence where you performed significant domain knowledge of aerospace flight and ground systems and software (both human and non-human rated) as well as end to end Mission Systems (Mission Operations Centers, Science operations centers, network systems, ground antenna systems, and space communication systems) Describe or provide evidence of relevant experience with NASA standards for software development, software safety, security, systems engineering, program management as well as similar experience with industry standards in the same areas. 3.2 RESPONSE INSTRUCTIONS All written documents shall be in Microsoft Word and shall be no more than 10 pages (8.5" x 11", using not smaller than 12 point Arial font) in length. Responses must include the following: name and address of firm, size of business; average annual revenue for past 3 years and number of employees; ownership; number of years in business; affiliate information: parent company, joint venture partners, potential teaming partners, prime contractor (if potential sub) or subcontractors (if potential prime); list of GWAC and/or other government contracts contractor has been awarded under which this requirement could potentially be obtained; list of customers covering the past five years (highlight relevant work performed, contract numbers, contract type, dollar value of each procurement; and point of contact - address and phone number). Please advise if the requirement is considered to be a commercial or commercialtype product. A commercial item is defined in FAR 2.101. Interested organizations may submit their capabilities, and qualifications to perform the effort and the above information in writing via electronic mail to: Lisa.R.Stanley@nasa.gov, not later than the above response date. 3.3 ADDITIONAL INFORMATION Please reference 80GSFC20SS0034 in any response. Respondents will not be notified of the results. To the full extent that it is protected pursuant to the Freedom of Information Act and other laws and regulations, information identified by a respondent as "Proprietary or Confidential will be kept confidential. It is emphasized that this RFI is for planning and information purposes only, it is not to be construed as a commitment by the Government to enter into a contractual agreement; nor will the Government pay for information solicited. An ombudsman has been appointed. The Center Ombudsman for this acquisition can be found at https://prod.nais.nasa.gov/pub/pub_library/Omb.html. No solicitation exists; therefore, do not request a copy of the solicitation. If a solicitation is released it will be synopsized in Contract Opportunities and on the NASA Acquisition Internet Service. It is the potential offeror's responsibility to monitor these sites for the release of any solicitation or synopsis. These documents will reside on a World Wide Web (WWW) server, which may be accessed using a WWW browser application. The Internet site, or URL, for the NASA/GSFC Business Opportunities home page is https://elibrary.gsfc.nasa.gov/