Attachment_1_-_Statement_of_Work.docx

Project Specific Litigation Support System

US Department of the Treasury Office of the Comptroller of the Currency Chief Counsel's Office

Statement of Work (SOW) (September 4, 2018) Table of Contents

Source Selection Information—See FAR 2.101 and 3.104.

OCC Acquisitions Management ii September 4, 2018

Background The Office of the Comptroller of the Currency (OCC) is an independent, non-appropriated bureau within the Department of the Treasury. The OCC charters, regulates, and supervises all national banks and federal savings associations as well as federal branches and agencies of foreign banks. Headquartered in Washington, DC, the OCC has district offices located in New York, Chicago, Dallas, and Denver. Bank supervision is the core activity of the agency.

The OCC’s Chief Counsel’s Office (CCO) centrally manages seven legal practice areas in the Law Department, including the Litigation and Enforcement & Compliance (E&C) divisions. The Litigation and E&C divisions utilize eDiscovery systems and services to review, redact, and produce electronic documents in connection with legal matters (e.g., congressional requests, OCC investigations, administrative proceedings, and litigation in Federal Courts).

Objective The Contractor shall provide cloud-based, Federal Risk and Authorization Management Program (FedRAMP) compliant litigation support services. The Cloud Service Offering (CSO) must be FedRAMP Authorized. The Contractor shall be responsible for software or systems and services, and provide a hosted eDiscovery platform solution (“eDiscovery system”) to perform and support the following eDiscovery services: processing, loading, review, analysis, and production. The platform and related services will be used to support a single OCC case for a limited time.

The long term plan is for CCO to replace its current eDiscovery system, Summation Pro, with a commercially available eDiscovery system that will support the agency’s existing and future needs. This requirement will include transition services into the application and environment of the successful offeror of the future competitive solicitation to replace the OCC’s current litigation support services.

Scope The Contractor shall provide all resources necessary to accomplish the tasks and deliverables described in this Statement of Work (SOW). The Contractor shall also have in-depth knowledge of the Electronic Discovery Reference Model (EDRM).

The size of the case to be hosted is expected to be 3 terabytes. The OCC expects the Contractor to begin loading approximately 60 volumes of data within an agreed-upon timeframe after the setup of the eDiscovery system in production. The majority of the data (natives, TIFFs, text, and metadata with load files) is from outside the OCC and is currently stored on over 30 hard drives. The remainder is an estimated 500 gigabytes of Electronically Stored Information (ESI) that the OCC will collect from within the OCC. The Contractor shall process and load this additional data into the review system. The Contractor shall create, up to 10 productions from the case data, consisting of 1-2 volumes per production. The Contractor's services must include:

· providing a review platform containing standard eDiscovery system tools that support deduplication and near deduplication, email threading, data analytics, Technology Assisted Review (TAR), and predictive coding;

· receiving inbound productions from outside sources for loading into the review platform;

· processing, deduplication, deNISTing, TIFF creation, text and metadata extraction;

· providing technical support to attorneys on use of the eDiscovery system, including assistance with searching, coding, redacting, email threading, TAR, predictive coding, and data analytics; and,

· running high-speed productions for delivery on schedule, including necessary quality assurance/quality control.

Tasks Task 1: Planning & Management The Contractor shall provide a Project Manager to plan, control, and execute the work described in the SOW. The Project Manager will be the primary point of contact for this Purchase Order.

The Contractor shall provide a Litigation Support Manager to perform end-to-end eDiscovery project management services for the case (e.g. oversee all aspects of the receipt and processing of OCC data; arrange for end-user support such as the formulation of search criteria, filters, and tags; creating redactions, privilege sets, and production sets; assist in work scoping, tracking, resource management, identifying opportunities to train staff, and identifying opportunities to limit data reviewed).

Upon award of the Purchase Order, the Contractor shall produce a weekly status update and deliver it to the OCC’s Contracting Officer’s Representative (COR). This written report shall document progress on outstanding project tasks and identify issues that require the OCC’s attention. At a minimum, the report shall include major risks, schedule updates, notable activities performed during the previous week, end-user reported issues and resolutions, plans for the upcoming week, and a discussion of any problems or issues requiring OCC resolution.

Task 2: Security Assessment & Authorization (SA&A) and Continuous Monitoring After award of the Purchase Order, the OCC will perform a review of the FedRAMP Authorization package, including a risk analysis and a security control assessment on controls identified as “Customer Responsible.” The Contractor must receive an Authority to Operate (ATO) from the OCC prior to transfer of OCC data under Task 3. The Contractor shall respond to OCC questions regarding the FedRAMP Authorization package (e.g., information system security & privacy plan, security & privacy control assessment, and plans of action and milestones report). The Contractor’s CSO must maintain a FedRAMP Authorization for the duration of the Purchase Order.

The Contractor shall be prepared to answer questions and provide additional documentation related to their continuous monitoring efforts to maintain ongoing awareness of information security, vulnerabilities, threats, and incidents management. Any open ‘critical’ severity POAMS or vulnerabilities will negatively impact the issuance of the ATO and/or continued use of the CSO.

Task 3: Configured Production Solution Within 5 business days of issuance of the ATO, the Contractor shall set up the eDiscovery system production environment, reflecting the requirements identified in this SOW and ready to ingest OCC-provided data. At a minimum, the Contactor shall set up multifactor authentication at this time. If feasible, the authentication should be PIV enabled. The solution should provide the ability for the OCC to add Security Assertion Markup Language (SAML) based authentication at a later point in time.

Task 4: Training The Contractor shall provide end-user training for approximately 20 OCC employees. The OCC may require more in-depth/comprehensive training on some aspects of the system. The Contractor shall recommend additional training for advanced eDiscovery topics, such as technology assisted review and advanced analytics.

Task 5: eDiscovery Services The Contractor shall perform the following mandatory services:

· Database Creation. Development of vocabulary control and other indexing tools; Optical Character Recognition (OCR) processing of documents; developing indices; loading, updating and maintaining databases; information analysis and database design; setting up and implementing databases; developing seed sets for concept clustering; developing and documenting data definition, formatting, validation, extraction, and reporting procedures; preparing database design, and document coding documentation; preparing and processing geographical information; and performing quality control.

· Database Utilization. Producing reports; training and assisting OCC users by providing help desk support and initial user training; providing end-user manuals; creating tools to assist end-users; maintaining databases and ensuring proper data integrity, security, and recovery processes are in place; and performing quality control.

· Electronic data acquisition and production. Extracting and converting data and data files; receiving (via media delivered to the Contractor by Contractor’s courier, unless another method is specified by the OCC), analyzing, and processing of electronic files, including email files and other files in their native formats, digital image files, load-ready data and image files; digitizing audio and video tapes (if applicable, there are currently no audio or video tapes in the data collection); analyzing and reporting from a wide variety of data and formats received as a result of production from the OCC and non-OCC sources, including opposing parties in litigation; assisting in the production of electronic data to opposing counsel and other entities; and performing quality control. Upon request, the Contractor may be required to provide bulk printed productions in paper format to be delivered via courier and/or provide productions in different formats including native, TIFF, text, metadata, and PDF format, to be delivered via courier on encrypted removable media provided by the OCC.

In order to provide this support, the Contractor shall be required to perform the following:

1) Assess services and information requirements

2) Design resource and staffing plans to meet these requirements

3) Develop procedures for all aspects of Purchase Order work performance

4) Implement plans and monitor performance

5) Report on status including financial status, resolve problems and redirect resources as needed

6) Meet objectives and deadlines

7) Evaluate project upon completion by summarizing the quality of objectives achieved for deliverables and services, evaluating adherence to budget and schedule requirements, and reporting on lessons learned Task 6: Post Production Support (e.g., upgrades, patching, technical support) The Contractor shall provide technical support to keep the system running in production and fully functioning without major defects. The solution shall be kept up-to-date with the latest software per the OCC’s n-1 architectural principle (vendor will ensure that solution is no more than one major or minor update behind the most current version).

Technical support shall include telephone support to end-users and troubleshooting. The Contractor shall provide telephone support from 8:00 a.m. to 5:00 p.m. Eastern Time, Monday through Friday, Federal holidays excluded. The Contractor shall log support calls and provide a summary of calls upon request.

Task 7: Transition Services (Optional Line Item) Upon Purchase Order completion or termination, the Contractor may be required to transfer OCC data to another service provider. The Contractor shall meet with the OCC and the successful awardee to establish a Transition Plan. During the transition, the Contractor shall maintain services in accordance with their respective Purchase Order requirements until formal transition is complete. The transition process will be dictated in part by the successful awardee’s transition period as well as transition guidance provided by the OCC. Transition services will occur over a two (2) week period.

Task 8: Optional Services (Optional Line Item)

The Contractor may be required to perform the following optional services at the discretion of the OCC:

· Providing forensic consultation services upon request.

· Pre-trial and trial support, including exhibit preparation, courtroom presentation assistance, courtroom/interview audio/visual services, PC support, graphics support, etc.; trial site support, including setting up trial site support facilities; providing courtroom presentation support, including equipment for in-courtroom presentation, staff for assisting the trial attorneys in developing graphics and scripting their presentations, and in-courtroom staff for operating presentation equipment; and performing quality control.

· Document acquisition, including electronic data, files, and records (locally and in the field); organizing documents, numbering documents, creating box or file level indices, capturing document images, copying documents, preparing documents for production, developing and documenting procedures, and performing quality control.

· Additional data storage beyond the estimated 3 TB.

· Emergency services outside of core hours and expedited services during all hours.

Work Products and Schedule Submission of Work Products For purposes of formal delivery, all work products will be provided on OCC-provided, encrypted media to the Contracting Officer’s Representative (COR) or the Point of Contact (POC) as identified by the COR. All deliverables will be subject to inspection and acceptance.

Within 4 business days of completing the processing and loading of documents provided to the Contractor for inclusion in the database, the Contractor shall physically return, via courier, all original copies of the documents and physical media to the COR or the POC as identified by the COR.

Upon award of this Purchase Order, the COR and the Contractor will negotiate and document the delivery dates for individual work products. Table 1 provides a list of the representative deliverables that will be required to support Tasks 1 – 7. All additional deliverables will have their delivery dates mutually agreed by the Contractor and the COR, with both draft versions and final versions created. The COR is responsible for providing the Contractor with written comments on draft deliverables within 5 business days of receiving the draft. The Contractor shall incorporate the COR’s feedback and submit a final version of the deliverable within 5 business days of receiving the COR’s comments.

Table 1 Deliverables Required

Critical (10 days) High (30 days) Medium (60 days) Low[footnoteRef:2] (364 days) [2: As defined by the Common Vulnerability Scoring System.]

Requirements The eDiscovery system is expected to support attorneys in performing standard legal document management activities including searching, coding, tagging, redacting, privilege review, and creating production sets.

The Contractor shall implement the following core standards so that the cloud solution architecture contains comprehensive measures to secure OCC cloud-based information systems and services and protect OCC data:

· The OCC shall maintain ownership of all data deployed in the cloud solution.

· FedRAMP shall be leveraged for solution assessment and authorization, and ensure that appropriate security controls are in place to protect our data. This includes controls to protect data at rest and in transit to and from cloud computing environments.

· Technical, management, and contractual controls shall be consistent and comprehensive across all prime and subcontractor relationships to ensure that OCC data ownership and data protection is preserved across the chain of custody.

· Role-appropriate training as needed (e.g., system owners, information owners, data custodians, information system security officers (ISSOs), and end users) to raise awareness and address risks associated with managing OCC data in the cloud solution.

· The cloud solution shall address data confidentiality, integrity, and availability (CIA), along with other risk areas including standards-based or open-source cloud solutions and abstracted business processes, to reduce the risk of vendor lock-in.

The OCC expects the eDiscovery system and Contractor to:

· Maintain data access reliability (i.e. documents can be viewed in the eDiscovery system and are available for multiple users).

· Handle multiple system processes at the same time (e.g. bulk coding, printing, loading, review, and production etc.).

· Provide near instant view speed when transitioning between images within a document and between documents.

· Render document images within 1 second of command, even under maximum end user load, i.e. 20 concurrent users.

· Load 100 GB external load file within 24 hours of receipt with no loss of end-user functionality while loading is in progress.

· Process/load 100 GB of OCC-internally collected documents within 48 hours of receipt

· Produce 250 GB of materials selected for production within 24 hours of request, including natives, images, metadata and text (or a subset) in standard load-ready format.

· Respond to an “Enter,” button push or other action command with visible acknowledgement of the command in less than one second.

· Complete a page update within 2 seconds of a command to view a document image.

· Returns results of a Boolean search within 5 seconds

· Respond to help desk calls within 1 hour during business hours.

· Resolve 90% of help desk calls within 24 hours.

Security Requirements The Contractor’s proposed system shall, at a minimum, include the security controls identified in the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4 “Security and Privacy Controls for Federal Information Systems and Organizations” for a moderate impact system. http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf. The Contractor shall meet all requirements of FedRAMP. http://cloud.cio.gov/fedramp.

The COR and the OCC Cyber Security Office have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this Purchase Order. Should the COR determine that the Contractor is not complying with the security requirements of this Purchase Order, the COR shall inform the Contractor of the proper action to be taken in order to effect compliance with such requirements.

Place of Performance Contractor personnel will work offsite, with required meetings and briefings held at OCC Headquarters, located at 400 7th Street S.W., Washington, D.C.

All physical deliveries of media shall be made from or to OCC Headquarters. The COR shall designate the POC eligible to make or receive delivery, and the OCC reserves the right to modify the list of eligible persons at any time.

Period of Performance The period of performance for this Purchase Order is for a base period of one-year with four (4), six-month, option periods from the date of award.

Business Hours and Coverage The eDiscovery system shall be available 24 hours per day, 7 days per week, 365 days per year, except for predetermined/scheduled maintenance windows agreed to by the COR. Services under this Purchase Order shall be performed during the core business hours: 8:00 a.m. to 5:00 p.m. Eastern Time, Monday through Friday, Federal holidays excluded. At times, performance outside of core business hours may be required. The Contractor shall provide contact information for its staff if performance of work outside of core hours is necessary.

OCC Government Representatives The OCC Contracting Officer (CO) is ______________. He/She can be reached at (202) 649-_____ or via email at ______________________________.

The OCC Contract Administrator (CA) and COR will be identified prior to award. Their contact information will be provided at time of award. The COR may identify a Technical Point of Contact (POC).

Travel Requirements There are no travel requirements for this Purchase Order.

Section 508 The Contractor shall provide and maintain Information Communications Technology (ICT) that meets applicable standards of Section 508 of the Rehabilitation Act of 1973, as amended. This applies to all software user-interfaces, web-based user-interfaces, and documents such as reports, job aids, guides, and plans. Resources for further details on these standards can be found at:

· Section 508 - https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

· Web Content Accessibility Guidelines (WCAG) - http://www.w3.org/TR/WCAG20/

Conformance to all 508 standards shall be met unless exception is authorized by the OCC Information Technology Accessibility Program Office.

Electronic Content delivered under this work statement shall meet the following standards codified in 36 CFR 1194:

· E205 – Electronic Content

· 602 – Support Documentation

· 603 – Support Services

· WCAG 2.0 level A and AA success criteria – applies to all Web-based deliverables and electronic content

· Exception authorized: Non-Web documents are not required to meet the following WCAG 2.0 criteria: 2.4.1 Bypass Blocks, 2.4.5 Multi-ways, 3.2.3 Consistent Navigation, and 3.2.4 Consistent ID

Software developed, acquired, delivered for OCC usage, or maintained under this work statement shall meet the following standards:

· E205 – Electronic Content

· E207 – Software

· 302 – Functional Performance Criteria

· 502 – Interoperable with AT

· 503 – Applications

· 602 – Support Documentation

· 603 – Support Services

· WCAG 2.0 level A and AA success criteria – applies to all software related to Web-based access.

Exception authorized: Non-Web software that resides on a PC or Server are not required to meet the following WCAG 2.0 criteria: 2.4.1 Bypass Blocks, 2.4.5 Multi-ways, 3.2.3 Consistent Navigation, and 3.2.4 Consistent ID.

Source Selection Information—See FAR 2.101 and 3.104.

OCC Chief Counsel's Office 9 September 4, 2018 image1.jpeg