06_Attachment 1 - Requirements Traceability Matrix.xlsx
XLSX spreadsheet 27 KB Posted
- Attached to
- FOIA/Privacy Act System & Services Federal contract opportunity
- Solicitation number
- 16PBGC23Q0004
- Issued by
- Pension Benefit Guaranty Corporation
About this file
This document contains a requirements traceability matrix and statement of objectives for a federal solicitation seeking a Freedom of Information Act online system replacement solution. Key requirements for the cloud-hosted software-as-a-service solution include mandatory compliance with FedRAMP authorization, integration with Login.gov for user authentication, and operational security at NIST SP 800-53 Revision 4 impact level of moderate. The solution must provide functionality for electronic FOIA and Privacy Act request intake and processing, redaction and records management tools, public-facing reading room capabilities, and integration with other federal systems. The procuring agency is the Pension Benefit Guaranty Corporation.
View the file
Other files for this federal contract opportunity
| File | Type | Posted |
|---|---|---|
| 06_16PBGC23Q0004_FOIA.pdf | ||
| 06_Attachment 4 - Pricing Breakout.24 Oct 2022.docx | DOCX document | |
| 06_Attachment 3 - IT Solutions Life Cycle Management Handbook.pdf | ||
| 06_Attachment 2 - IT Solutions Life Cycle Management Framework.pdf |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Requirements
| No. | Sub-Category | Mandatory/Regulatory Requirement | Vendor Response | Comments or Notes from Vendor (Optional) |
| 1 | Min Req | Software-as-a-Service Cloud Hosted | ||
| 2 | Min Req | GSA FedRamp Authorized | ||
| 3 | Min Req | Integrated with Login.Gov | ||
| No. | Sub-Category | Functional Requirement | Vendor Response | Comments or Notes from Vendor (Optional) |
| 1 | Base | Web-based processing interface | ||
| 2 | Base | Workflow for FOIA/PA requests | ||
| 3 | Base | Image-enabled Redaction tool | ||
| 4 | Base | Repository/storage | ||
| 5 | Base | Interfaces with email (incoming/outgoing) | ||
| 6 | Base | Storage Capacity Flexibility /Cloud Security | ||
| 7 | Base | Product Training Plan- Electronic Training and User Manuals, Ease and Length of Onboarding, Implementation Plan, which allows users to understand, use, administer, and support the FOIA solution | ||
| 8 | Base | Help Desk support that will assist with functional and technical difficulties | ||
| 9 | Base | Customization of Workflow-Ability to change workflow without the developer | ||
| 10 | Base | Requests-multi track capability | ||
| 11 | Base | Licensing model-flexibility with the quantity of licenses (not required to purchase a license for each user) | ||
| 12 | Base | Reporting functionality/Auto-generate a FOIA log | ||
| 13 | Base | Ability to create user roles and permissions | ||
| 14 | Base | User friendly capability | ||
| 15 | Base | Upload templates to the system | ||
| 16 | Base | Workflow Automation-assign tasks | ||
| 17 | Base | Generate emails to requester...with a .gov suffix | ||
| 18 | Base | Delinquent payment requester tracking | ||
| 19 | Base | All upgrades and required training included in the initial licensing | ||
| 20 | Base | Customization of workflows-audit trails, ability to change configurations without the developer | ||
| 21 | Base | Ability to customize metrics reports | ||
| 22 | Base | Support for manual intake of requests | ||
| 23 | Base | Administrative Appeal Process- tracks and relates appeals to the original request | ||
| 24 | Base | Expedited Processing/Fee waiver Processing Capability | ||
| 25 | Base | Records migration--allow for the integration of documents with a hash value created by FOIAonline | ||
| 26 | Base | Search requests by subject matter | ||
| 27 | Base | Flexibility/costs for configurations or modifications after initial development | ||
| 28 | Base | Search requests by keyword, disposition, exemptions, requester name, requester organization | ||
| 29 | Integration | Migration of all data from FOIAonline | ||
| 30 | Integration | Generates Annual FOIA DOJ reports | ||
| 31 | Integration | Integate with SharePoint | ||
| 32 | Integration | Accept Electronic Payments and integrates with Pay.gov | ||
| 33 | Integration | Dashboard reporting | ||
| 34 | Integration | E-discovery capabilities- search record custodians records; search record custodians SharePoint | ||
| 35 | Integration | Integrate with Agency's Power BI | ||
| 36 | Integration | Cross integration with relativity | ||
| 37 | Processing | FOIA/PA processing features | ||
| 38 | Processing | Assigns response deadlines by request and task type | ||
| 39 | Processing | Allows for request tolling (pausing the clock) | ||
| 40 | Processing | Tracks deadlines w/reminders | ||
| 41 | Processing | Automatic Notification of Duplicate Incoming Requests | ||
| 42 | Processing | Artificial Intelligence redaction tool | ||
| 43 | Processing | De-duplication-removes duplicate records (perhaps integrated within Redaction Tool) | ||
| 44 | Processing | Data and records image enabled for redaction | ||
| 45 | Processing | Send final Disclosure Determination and responsive records to requester from the processing platform | ||
| 46 | Processing | Ingest various file types: audio, video, non-text files, TIF, pdf, csv, OCR, pst, docx, jpg | ||
| 47 | Processing | Auto-calculate fees and generate invoices | ||
| 48 | Processing | Redaction tool produces records that are 508 compliant | ||
| 49 | Processing | Retention schedules-configurable retention schedule, is it an auto-delete | ||
| 50 | Processing | Data limits, cloud storage, file size maximum volume | ||
| 51 | Processing | Redaction tool produce an excel spreadsheet output | ||
| 52 | Processing | Integrated Redaction Tool-Edit redactions within the same document | ||
| 53 | Processing | Redaction tool-ability to redact multimedia files, i.e. sound, video | ||
| 54 | Processing | Redact content across a document set--allow changes of case file during the reviewing stage | ||
| 55 | Processing | Ability to upload records for processing | ||
| 56 | Processing | End to end request processing capability | ||
| 57 | Processing | Identification of duplicate records | ||
| 58 | Processing | Bates numbering with redaction tool | ||
| 59 | Processing | Generate Vaughn Index | ||
| 60 | Processing | Program offices/recordholders ability to upload responsive records to system | ||
| 61 | Processing | Extend the workflow to end-users, ability to interact with recordholders from the system, search request emails, reminder emails | ||
| 62 | Processing | File size reduction capability, automatically compress file size for delivery to the requester for voluminous requests | ||
| 63 | Processing | Search by metadata for redactions | ||
| 64 | Processing | Ability to sort responsive records, records management, smart records capability | ||
| 65 | Processing | Artificial Intelligence/Predictive tool- Ability to program and/or control | ||
| 66 | Processing | Redaction tool--can perform a side-by-side comparison (of past disclosure determination) | ||
| 67 | Processing | Control of Artificial Intelligence functions (ability to configure without developer) | ||
| 68 | Processing | Quality Assurance Artificial Intelligence--Audit | ||
| 69 | Processing | Record encryption | ||
| 70 | Processing | A document should be hosted by each file, even if it is a duplicate record | ||
| 71 | Processing | Accepts/Tracks/Reports metadata | ||
| 72 | Public Portal | Public-facing portal for request initiation… | ||
| 73 | Public Portal | API capability to FOIA.gov | ||
| 74 | Public Portal | Allows public to track status | ||
| 75 | Public Portal | Allows for publication of final disclosure determinations and responsive documents via platform | ||
| 76 | Public Portal | Requester Digital Certification of Identity capability from public portal | ||
| 77 | Public Portal | Requesters ability to keyword search across all FOIA requests | ||
| 78 | Public Portal | Self-contained public reading room | ||
| 79 | Public Portal | Automatic uploads to the reading room | ||
| No. | Sub-Category | Security/IT Requirement | Vendor Response | Comments or Notes from Vendor (Optional) |
| 1 | Security | System must be a cloud system (meeting all five cloud characteristics as defined in NIST SP 800-145) offering cloud services on the FedRAMP site with a status of "Ready" (with no agency sponsorship by PBGC required). (see Min Req 3 above) | ||
| 2 | Security | Materials should be available on the FedRAMP repository on OMB MAX for the ISSPO team to add the new system to the relevant PBGC system boundary and achieve Authorization to Operate (ATO). | ||
| 3 | Security | As a FedRAMP system, vendor should provide at least a monthly ConMon meeting (continuous monitoring control implementation and PO&AM status review), either for PBGC or for all of its agency users. | ||
| 4 | Security | Procured system must be able to attain an ATO within a PBGC system boundary (projected to be OGCFedRAMP) before data migration activities can begin, as per the FISMA (Federal Information Security Modernization Act of 2014). (The ATO required for migration may be limited/specific to migration activities if the ECD so recommends and approves.) | ||
| 5 | Security | Procured system Should Have a full and unqualified ATO within a PBGC system boundary before user account provisioning and production usage begins, as per FISMA 2014. | ||
| 6 | Security | The system should be operating and evaluated at NIST SP 800-53 Rev. 4 at a minimum with a clear plan to Rev. 5 when it has been released. | ||
| 7 | Security | The system must be FedRAMP authorized at the Moderate impact security level baseline. | ||
| 8 | Security | The system must support iCAM processes by providing active user/role lists as emailed electronic files at least weekly. | ||
| 9 | Security | The system must support iCAM processes by providing automated active user/role lists as emailed electronic files at least weekly. |
10 Security The system Integrates with Federated Services that use SAML (such as ADFS) for Authentication for PBGC internal users.
11 Security The system must support ingestion of audit logs into PBGC's Splunk system.
| 12 | Privacy | Identity proofing and authentication of all FOIA/PA requesters which meets the requirements of OMB memo M-21-04 (with a service such as, for example, Login.gov) | |
| 13 | Privacy/ | ||
| Security | System must support an Identity Assurance Level (IAL) of IAL2 (per NIST SP 800-63a) for requestors using the citizen-facing portal to submit PA requests. (Other non-portal methods can also be used for request submission and for requestor identity validation by PBGC.) | ||
| 14 | Privacy/ | ||
| Security | System must support an Authenticator Assurance Level (AAL) of AAL2 (multi-factor authentication). | ||
| 15 | Privacy/ | ||
| Security | System must support a Federation Assurance Level (FAL) of FAL2 (encryption using approved cryptography) for all communcations to and within the solution. | ||
| 16 | Privacy | Language on the citizen-facing web page(s) of the solution which meets the labeling requirements of OMB memo M-21-04 Appendix I, including proper Privacy Act notice(s) and consent forms when relevant. | |
| 17 | Privacy | Materials provided by the vendor as needed to help update and publish relevant SORNs (System of Record Notice(s)) for the system. | |
| 18 | 508 | 508 compliant | |
| 19 | IT | Solution is used by 5 Federal Agencies |
File details come from the government source that posted it. Updated .