Attachment_A_SOW.pdf

Attachment A

TECHNICAL CONTRACT SUPPORT

FOR

LASERFICHE ELECTRONIC RECORD MANAGEMENT SYSTEM SUPPORT

STATEMENT OF WORK (SOW)

July 27, 2018

1 BACKGROUND

The Damage Assessment, Remediation, and Restoration Program (DARRP), and the individual line offices of which it is comprised, have a legal obligation and a practical need to effectively manage electronic “Federal Records” generated electronically by geographically diverse employees and Contractors with differing information technology systems. The DARRP has invested in the development of a comprehensive, centralized electronic records management system (ERMS) using Laserfiche Rio to manage NOAA’s federal records associated with DARRP cases. The purposes of the ERMS are the following:

• Capture documents pertaining to NOAA DARRP Program Cases from multiple sources within NOAA or among the trustees and Contractors working on a particular case.

• Provide a review platform and workflow for General Counsel and program staff to support program responses to requests for documents.

• Maintain Federal Records and documents that may pertain to any DARRP Program case in a manner that is organized and can be located, searched, retrieved, read, tagged, redacted, converted or exported.

• Provide the DARRP Program with end to end Federal Records lifecycle support as required in DOD5015.21 and in compliance with the all records related law as stated in

NAO-205-1.2

2 OBJECTIVES AND SCOPE

The objectives of this Statement of Work (SOW) is to provide system administration and maintenance of the DARRP Laserfiche ERMS where it currently resides on NOAA Office of the Chief Information Officer (OCIO) servers. This Scope also includes efforts, in close and collaborative fashion with NOAA IT staff, to optimize the ERMS in both technical and cost to operate aspects to meet NOAA and ORR IT security requirements and functional goals.

1 http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/501502std.pdf 2 http://www.corporateservices.noaa.gov/ames/administrative_orders/chapter_205/205-1.pdf

2 | P a g e

3 TASKS

3.1 Task 1: Basic Technical Support for the DARRP Laserfiche ERMS A. The Contractor shall provide basic software support for a Laserfiche deployment of 55-

99 users, including unlimited Laserfiche servers, Records Management Edition, Workflow, WebAccess (including the SharePoint integration web parts and WebAccess Light), Advanced Audit Trail, Snapshot, and Email Plus for Publishing, Royalty-free distribution of published media, Import Agent for Rio, LF Forms 50-99 Users, LF Forms Portal, Quick Fields Complete for Rio, includes QF, Validation packages for Bar Code, RTL, Zone OCR, Doc Classification, Forms Alignment, Forms Identification, Forms Extractor, OMR, and Auto Stamp/Redaction/Bates Numbering, QF Agent for Rio, and Integrator's Toolkit for Rio

B. The Contractor shall work in coordination with NOAA OCIO on all server issues as they relate to the DARRP Laserfiche ERMS, including but not limited to ensuring functionality and accessibility of Laserfiche within the NOAA OCIO environment including installation of any needed patches, upgrades, or reconfigurations.

C. The Contractor shall serve as the primary point of contact with Laserfiche in the maintenance and troubleshooting of the DARRP Laserfiche ERMS.

D. The Contractor shall work in coordination with the DARRP Records Manager and Records Management Program (RMP) to support day-to-day system management including end user issues, access, permissions, connectivity, troubleshooting, and other related needs. Assist, as necessary, with the generation of business processes, workflows, forms, and other software features and capabilities. The Contractor shall also support high volume imports and exports of files into and out of the system.

E. The Contractor shall be responsible for maintenance of all system documentation.

This task will completed on a Firm-Fixed-Price basis. Approximately 100 hours of Laserfiche system development and maintenance are anticipated.

3.2 Task 2: Managed Professional Consulting of the DARRP Laserfiche ERMS.

A. The Contractor shall support, through consultation and development, the optimization of the DARRP Laserfiche ERMS.

B. The Contractor shall support the integration of Laserfiche into current systems such as Microsoft Sharepoint 2013 and integration with the Microsoft Office 2016 suite software.

3 | P a g e

C. The Contractor shall support the Program with the evaluation, and possible migration, of the ERMS from the current environment into a cloud-based server environment.

Factors that will need to be evaluated will include cost of migration (including meeting IT security requirements/accreditation), annual costs, and impacts on current IT security structure. OR&R currently has a cloud-based environment in AWS. However, other FedRamp3 authorized environments will be considered. Close coordination with OR&R’s Business Services Group and Information Technology Security Officer will be important.

D. The Contractor shall support the development and implementation of a publicly available repository to house DARRP Administrative Records. These records shall mirror the DARRP Administrative Records, as defined in the NOAA Records Schedule 1605-094, that are retained and managed by the ERMS but be read-only and potentially redacted to protect against the release of personally identifiable or confidential business information. Public access will be through Laserfiche Weblink surfacing within one of OR&R’s existing websites5 using Liferay Portal6, Drupal7, or OpenLayers8, that reside in FedRAMP compliant Amazon Web Services, in NOAA OR&R’s system boundary 6702 and will need to be formatted to be complementary to existing site styles.

E. As needed, the Contractor shall work to ensure that all OR&R and NOS Information Technology security requirements are fulfilled. This will include preparing or modifying a System Security Plan (SSP) as per NIST standards for a moderate system and satisfying security and documentation requirements for FedRamp PATO status.

Close coordination with OR&R’s Business Services Group and Information Technology Security Officer is important. The Contractor shall manage development tasks using project management software that is accessible to the project team and leadership team.

This task will completed on a Time and Materials basis. Approximately 400 hours of Laserfiche optimization support are anticipated.

3.3 Task 3: Continuation of NOAA Laserfiche Software License

A. The Contractor shall ensure continuity of the NOAA Laserfiche software license during the duration of this contract.

This task will completed on a Firm-Fixed-Price basis.

3 FedRAMP: Federal Risk and Authorization Management Program: https://www.fedramp.gov/ 4 http://www.corporateservices.noaa.gov/audit/records_management/schedules/chapter-1600-ocean-programs.pdf 5 https://www.darrp.noaa.gov/ 6 Liferay portal open source tools: http://www.liferay.com/ 7 Drupal: Content Management System: https://www.drupal.com/ 8 OpenLayers: https://openlayers.org/ http://www.liferay.com/ https://www.drupal.com/

4 | P a g e

4 DELIVERABLES AND DEADLINES

All deliverables or deliverable notifications, which include data updates and website updates shall be communicated electronically to the Project Manager (PM) or PM-designated representative and/or posted to secure SFTP locations.

The Project Managers (PM) for this Purchase Order are:

(To be provided at time of award)

WORK MILESTONES

DELIVERY SCHEDULE

DELIVERABLE

TYPE

ELECTRONIC

Facilitate and manage quarterly reports to NOAA documenting system changes and issues

Quarterly, from beginning of Quarter following award

Word or PDF document

Facilitate and manage monthly meetings with DARRP RMP

Beginning of each full month following award

Word or PDF document

Implement Laserfiche integration 3 month post award Summary and integration into Sharepoint and Microsoft Office Suite

Development of System Security Plan As needed based on IT Security Word or PDF document

5 ADDITIONAL INFORMATION

The nature of the work under this Purchase Order includes maintenance and development of an application which involves addressing IT security requirements. These requirements involve iterative work with OR&R, NOS and the Department of Commerce, which can vary in duration and complexity. Additionally, IT security requirements and standards are evolving, which may necessitate increased levels of effort. The Contractor shall supply all necessary personnel, supervision, services, materials, and other items as required by this SOW.

6 PLACE OF PERFORMANCE

The Purchase Order shall be performed at the Contractor’s facility or at site/meeting locations as necessary for completion of the Purchase Order.

7 SPECIAL MATERIAL REQUIREMENTS

5 | P a g e

There are no special material requirements.

8 OTHER UNIQUE REQUIREMENTS

The Contractor shall have experience with the technical aspects of the Laserfiche Rio enterprise content management software. The Contractor shall have experience with user authentication and authorization including implementation of the RSA SecurID identity and access management software, and integration of single-sign on technology for personal identity verification (PIV) smart cards. The Contractor shall also be able to meet all NOAA Information Technology Security requirements and prepare documentation pursuant to internet security guidelines.

To access the current deployment of the ERMS, the Contractor will be required to obtain a NOAA-issued Common Access Card (CAC) and utilized a NOAA issued computer. Issuance of a CAC will require a fingerprinted background check conducted by the NOAA Office of Security.

9 TRAVEL

It is anticipated that carrying out the above tasks may require the Contractor to travel as directed by NOAA. The purpose of the travel may include, but is not limited to, collaboration with records management team members, coordination with case teams, training, and communication events. Travel locations for collaboration, coordination and training include Silver Spring, MD or Saint Petersburg, FL. A total of two meetings spanning four days (including travel) coordination/planning meetings per year are anticipated.

Travel expenses shall be authorized in advance and must be associated with the performance of the Purchase Order.

10 GOVERNMENT-FURNISHED PROPERTY

Any/all Government Furnished Equipment (GFE) to be provided to the Contractor shall be used and maintained by the Contractor in accordance with NOAA OR&R IT Security protocols. The Contractor may be tasked to acquire equipment for the Government’s use. Upon completion or termination of the contract, all property acquired/used/provided shall be returned to the Government.

11 SECURITY

The Government shall provide the Contractor with access to Government facilities, as appropriate.

6 | P a g e

12 IT SECURITY REQUIREMENTS

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The contractor is required to meet the DOC IT Security Program Policy (ITSPP) and Commerce Information Technology Requirements (CITRs) (available at:

https://connection.commerce.gov/policy/20140528/it-security-program-policy-and-commerce-information-technology-requirements). DOC has issued Commerce Information Technology Requirements (CITRs) as policy enhancements to the DOC IT Security Program Policy and carries the same authority as the DOC ITSPP. The contractor is required to meet the NOAA IT Security Manual [NOAA policy] (available at: https://www.csp.noaa.gov/policies/manual/212- 1301-V5-6-final.pdf). The DOC and NOAA policies identified above are sensitive documents and will be provide after contract award.

It is a mandatory requirement for every NOAA IT user (government, contractor, associate, or temporary personnel) to complete the NOAA Information Technology Security Awareness Course every year. Temporary personnel include visitors, guest workers, etc. who plan to work at a NOAA site, access NOAA information and/or use NOAA IT resources. Both new and temporary employees must take the course within three days after initial issuance of NOAA IT equipment and annually.

The government will provide the necessary computer equipment and information to perform this contract. All work must be performed upon government furnished equipment and if additional hardware and/or software is/are needed, the contractor must request the additional requirements from the Contracting Officer Representative (COR). The Contractor is responsible to ensure GFE has the appropriate assigned Internet Protocol (IP) Address at all time. The Contractor may be changing some of the GFE to static IP Address and must ensure the GFE has internet access or network access. The Contractor is required to ensure the GFE is connected to either NOS internal networks or the Internet, at a minimum of once a week with user-keyboard interaction for approximately 4 hours while connected to allow the Government to perform the necessary configuration management and vulnerability management of the GFE.

The Contractor is required to assist the Government in maintaining the GFE at the organization’s determined secure state by ensuring the GFE obtains timely system/security updates and undergoes vulnerability and compliance scans at least monthly. Any changes (install/remove/modify) operating system, software or application must undergo the appropriate approval process.

https://connection.commerce.gov/policy/20140528/it-security-program-policy-and-commerce-information-technology-requirements https://connection.commerce.gov/policy/20140528/it-security-program-policy-and-commerce-information-technology-requirements

7 | P a g e

If the vendor proposes the use of cloud services, NOS requires an integrated technical solution which meets the security requirements below. For any cloud services being used by the contractor to support this acquisition, the following conditions must be met:

a. Comply with DOC and NOAA Information Technology Security Policies;

b. Must use Cloud Services that are covered under the Federal Risk Authorization

Management Program (FedRAMP; www.fedramp.gov); the vendor should utilize NOAA cloud hosting resources for any such implementation, in coordination with the appropriate NOAA organizations, such as the Office of Response and Restoration (OR&R) and/or the Office of the Chief Information Officer (OCIO);

c. NOS IT Security Program and Program Office Information System Security Officer (ISSO) must review appropriate FedRAMP package(s) and conduct a risk assessment of the appropriate FedRAMP package(s) and associated cloud services prior to using any cloud service(s);

d. The use of the cloud services must have either received an NOS or NOAA Authorization to Operate (ATO) or have a NOAA or NOS approved risk acceptance for the pending

ATO,

e. The contractor must provide the necessary information to support the documentation of the security posture (NIST Special Publications 800-53 Security and Privacy Controls for Federal Information Systems and Organizations) covering the contractor’s solution (the solution can consist of [mobile/web] application/ database/ network operating systems (aka, virtual machines));

f. The contractor must ensure all NOAA information and contractor solutions reside within the United States;

g. Integrate into DOC, NOAA and NOS enterprise solutions for systems management and incident management systems. Systems management and incident management examples include Enterprise Continuous Monitoring Operations (IBM Bigfix), enterprise logging/analysis (Arcsight), enterprise incident management, enterprise vulnerability management (Tenable Security Center), enterprise systems management (Microsoft Systems Center Configuration Manager/Redhat Satellite/JAMF Software Casper Suite), and enterprise endpoint anti-virus/anti-malware management (Intel McAfee ePolicy Orchestrator). If integration is not possible, vendor working with the government-identified Information System Security Officer must obtain a risk acceptance from Authorizing Official and Co-Authorizing Official; and

h. Provide Federal Government with full administrative control to the master account, subscription administrator or its equivalent. A master account, subscription administrator is defined as a highest (or root) privileged level access mechanism that has control over the information technology resources residing within the cloud subscription/boundary assigned to this contract. The Contractor will ensure that only the activities supporting this contract reside within the master account, subscription administrator or its equivalent.

The Contractor must relinquish all administrative control and/or access to resources residing within the cloud subscription/boundary assigned to this contract. The Government may grant access to the Contractor as needed.

8 | P a g e

The contractor must consider IT Security controls throughout the lifecycle of this contract as outlined in NIST Special Publication 800-64 (http://csrc.nist.gov/publications/nistpubs/800-64- Rev2/SP800-64-Revision2.pdf).

The contractor is required to comply with the Department of Commerce’s Commerce Acquisition Manual’s (CAM) 1337.70 Personnel Security Requirements (http://oam.eas.commerce.gov/docs/CAM1337.70%28Security%29.pdf) for working on a moderate-impact Federal Information Security Management ACT (FISMA) system.

The contractor includes the necessary product support and supporting documentation for the hardware and/or software that allows the sanitization (following NIST Special Publications 800-88 Guidelines for Media Sanitization, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) of the hardware and/or software upon the disposal of the product.

The contractor shall guarantee strict confidentiality of the sensitive information/data when the Government identifies Government Furnished Information/data and/or information/data generated during the performance of the task order is of a sensitive nature.

Disclosure of the information/data, in whole or in part, by the contractor can only be made after the contractor receives prior written approval from the Contracting Officer. Whenever the contractor is uncertain with regard to the proper handling of information/data under the contract, the contractor shall obtain a written determination from the Contracting Officer.

All electronic information provided by the contractor must undergo malicious software scanning using a commercial anti-virus and anti-spyware software to ensure the information is free of known malicious software. The contractor must work with the COR prior to sending the information to establish a secure method for transfer. One option could be a file encrypted with a password or passphrase using a product like WinZip or using DOC Secure File Transfer solution. The contractor must encrypt any sensitive information that will be sent electronically (i.e., email), sensitive information includes but not limited to:

• All information describing the implementation, configuration, settings, etc. for solution being developed (including Information Technology (IT) configuration, IT management, IT security, IT administration, IT architecture and/or information obtained while performing privileged access roles),

• The source code and database schema,

• The vulnerability scanning, secure baselines scanning, mitigation results,

• The secure baseline deviations,

• Internet Protocol, subnet mask and similar identification,

• System or component inventory information (hostname, IP address, MAC address, location, operating system, etc.),

• Personally identifiable information (PII) and/or Business-identifiable information (BII).

http://oam.eas.commerce.gov/docs/CAM1337.70%28Security%29.pdf

9 | P a g e

The Contractor must protect sensitive information and/or non-public information from unauthorized disclosure or modification. The Contractor working with the ISSO to determine the applicable sensitive security requirements that must be addressed. Sensitive information includes personally identifiable information (PII), Business-identifiable information (BII), Information Technology (IT) configuration, IT management, IT security, IT administration, IT architecture and/or information obtained while performing privileged access roles.

13 INVOICES AND PROGRESS REPORTING

All invoices shall be submitted monthly after the effective date of this Purchase Order (no later than the first of each month), and monthly thereafter during the period of performance. In addition to the invoice, the Contractor shall submit, to the Government, a progress report advising of the work completed during the performance period, the work forecast for the following period, and the names, titles and number of hours expended for each of the Contractor’s professional personnel assigned to the Purchase Order, including officials of the Contractor. The report shall also include any additional information – including findings and recommendations that may assist the Government in evaluating progress under this Purchase Order. The first report shall include a detailed work outline of the project by reporting period.

This report shall be submitted electronically in MS Word 2007, or other compatible version, to the Contracting Officer Representative (COR), and Project Managers (PM).

The progress report shall include a spreadsheet addendum which tracks funding obligations and expenditures against the Purchase Order. This progress report addendum shall be presented in a format that the COR and PM can easily identify funds obligated and expended during the current and cumulative performance periods. At a minimum, columns shall be included that have amount obligated, amount expended this period and amount remaining.

Original invoices shall be submitted to the OR&R Acquisition and Grants Liaison ARD’s (AGL) with copies provided to the PM, COR and Contract Specialist as required by NAM 1330-242.70, Submittal of Invoices.

14 CONFLICT OF INTEREST ASSESSMENT

This contract deals with data management systems used in Natural Resource Damage Assessments (NRDA). In order to identify possible conflicts of interest, the Contractor shall disclose to NOAA any ties or responsibilities to the Responsible Party for ongoing NRDA cases that involve NOAA.