Attachment_1_-_Performance_Work_Statement.docx

Alternative Litigation Support System (ALSS) for Chief Counsel’s Office

ALSS Performance Work Statement (PWS)

Contents

1 Introduction The Office of the Comptroller of the Currency (OCC) is an independent, non-appropriated bureau within the Department of the Treasury. The OCC charters, regulates, and supervises all national banks and Federal savings associations as well as Federal branches and agencies of foreign banks. Headquartered in Washington, D.C., the OCC has district offices located in New York, Chicago, Dallas, and Denver. Bank supervision is the core activity of the agency.

The OCC’s Chief Counsel’s Office (CCO) centrally manages seven legal practice areas in the Law Department, including the Litigation and Enforcement & Compliance (E&C) divisions. The Litigation and E&C divisions, and occasionally bank examiners and attorneys practicing in other divisions, utilize eDiscovery systems and services to support legal matters routinely handled by the OCC, including responses to subpoenas and congressional requests, investigations, administrative proceedings, and litigation in Federal Courts. The OCC currently employs approximately 200 attorneys and legal support staff, including approximately 55 attorneys and staff in the Litigation and E&C divisions who routinely use eDiscovery systems and services in their daily work.

2 Background The OCC seeks a managed solution for a new, alternative litigation support system (ALSS) that provides software tools and managed services covering the Processing, Review, Analysis, and Production phases of the Electronic Discovery Reference Model (EDRM). Additionally, the OCC seeks an automated legal hold tracking tool and trial presentation services. The ALSS is intended to be used enterprise-wide, by attorneys and legal support staff in a variety of practice areas, including but not limited to, Enforcement & Compliance (E&C) and Litigation. The ALSS may also be utilized in support of legal and other work of the agency by non-legal (examination) staff. The document review platform must be able to support at least 75 concurrent users and a total of 200 named users.

The OCC currently has an on-premises litigation support system and associated software tools that cover the Processing, Review, Analysis and Production phases of the EDRM. The OCC utilizes eCapture for processing of data from external and internal sources, and, on occasion, to create small productions of data. The OCC utilizes an instance of Summation Pro 6.3 to support the Review, Analysis and Production phases of the EDRM. The OCC has approximately 100 active cases, consisting of approximately 15 TB of data (total) currently housed in the document review platform. In addition to the on-premise litigation support system that utilizes Summation Pro as a review platform, the OCC has contracted for a cloud-based eDiscovery solution utilizing Relativity and hosting approximately three (3) TB of data in connection with a single case (Project Specific Litigation Support Services, or PSLSS). All or some portion of the data from the OCC’s on-premise litigation support system and/or PSLSS will be migrated to the ALSS (the Contractor may assume that all data (15 TBs) will be migrated to the ALSS).

In addition to this requirement, the OCC’s long-term plan is to seek an additional solution to cover the Identification, Preservation, and Collection phases of the EDRM, potentially including automated collection tools to assist with internal collections of OCC data housed on network drives, cloud-based email/Microsoft Office 365, OCC proprietary applications, etc. The OCC tentatively plans to award a Contract for this second solution within calendar year 2020.

3 Scope of Work OCC requires a managed Software as a Service (SaaS) Cloud Service Provider solution for a litigation support system that addresses the EDRM as follows:

· Legal Hold Management (Optional): It is desired, but not required, that the ALSS include an automated tool to assist attorneys in reliably issuing, tracking and managing litigation holds.

· Processing and Hosting: The ALSS must provide personnel and tools sufficient to process and load externally and internally collected data for use in a cloud-based, eDiscovery review platform provided by the Contractor. All OCC data shall be hosted by the Contractor in a Federal Risk and Authorization Management Program (FedRAMP) Authorized cloud environment. The Contractor shall meet performance standards for time-to-process-and-load data that are specifically set forth by the OCC. The Contractor shall be required to host and support up to 15 terabytes of active case data across 50 cases simultaneously. The OCC expects the amount of case data to increase by 2-4 TB per year.

· Review and Analysis: The ALSS must provide an eDiscovery platform with a web-based, user-friendly interface that allows attorneys and other staff at the OCC to analyze, search and code records in a manner that promotes the efficient use of staff time and effort. The OCC requires sophisticated search, Technology Assisted Review (TAR), and data analytics capabilities, as well as email threading and other specific requirements. The OCC also requires that the ALSS Contractor provide technical and case-planning support to attorneys and other end users.

· Production: The ALSS must be capable of producing data hosted by the Contractor at the request of the OCC in accordance with the OCC’s performance standards. The ALSS Contractor must provide reliable quality control for production of OCC information to third parties, and the ALSS must be capable of providing productions of data in multiple formats currently typically utilized in the eDiscovery space, such as native and TIFF.

· Presentation: It is desired, but not required, that the ALSS provide Contractor support and a technological solution for attorneys presenting evidence at a trial or hearing, and that the presentation software be integrated with the platform the Contractor provides for review and analysis of Electronically Stored Information (ESI).

The ALSS Contractor shall also be responsible for transitioning of data and services from Summation Pro and the PSLSS into the ALSS application and environment.

4 Tasks This section defines the specific tasks required of the ALSS Contractor and presents other general requirements for successful and timely completion of these tasks.

In relation to the tasks set forth below, the OCC has developed a Requirements Traceability Matrix (RTM) documenting the solution’s technical and functional requirements and categorizing each of those requirements as “mandatory” or “optional.” The RTM is attached as Appendix 1. [As the Instructions to Offerors provided in the ALSS solicitation dictate, all Offerors must complete the RTM as a component of their proposal. The completed RTM must state whether the Offeror’s proposed solution “Fully Meets,” “Partially Meets,” or “Does Not Meet” each requirement.] Please consult Section 6 of this PWS for a summary list of the deliverables associated with each task and the delivery schedule for each work product.

4.1. Task 1: Planning and Management

4.1.1 Provision of Personnel for Planning and Management

(Required Task)

The Contractor shall provide a Project Manager to plan, control, and execute the work described in the PWS. The Project Manager will be the primary point of contact for this Contract.

The Contractor shall also provide Litigation Support personnel to perform end-to-end eDiscovery project management services for each case/project. These project management services include assisting in case planning; overseeing all aspects of the receipt and processing of OCC data; arranging for end-user support such as the formulation of search criteria, filters, and tags; creating redactions, privilege sets, and production sets; assisting in work scoping, tracking, and resource management; identifying opportunities to train staff; and identifying opportunities to limit data reviewed.

4.1.2 Project Planning, Scheduling and Status Reporting

(Required Task) The Contractor shall deliver an Integrated Master Schedule (IMS) that addresses all tasks and deliverables described in this PWS. The Contractor shall update the IMS weekly and provide it to the OCC’s Contracting Officer’s Representative (COR).

The Contractor shall produce a Weekly Status Update and deliver it to the COR. This Weekly Status Update shall document progress on outstanding project tasks and identify issues that require the OCC’s attention. The report shall include major risks and their associated mitigations, notable activities performed during the previous week, end-user reported issues and resolutions, plans for the upcoming week, and a description of any problems or issues requiring OCC resolution.

As determined by the OCC on a case-by-case basis, the Contractor shall develop and support the implementation of Litigation Support Schedules for OCC cases in the administrative hearing process or Federal Court, and more complex and demanding OCC investigations. The Contractor shall work with attorneys to develop Litigation Support Schedules, as needed, based on the particular features and needs of a case, including discovery and other case scheduling orders from a court. The IMS, required under this task, must integrate all Litigation Support Schedules. It is estimated that the Contractor shall manage on average 6-8 cases that require Litigation Support Schedules at any one time.

4.2. Task 2: Security Assessment & Authorization (SA&A) and Continuous Monitoring (Required Task) The Contractor shall provide supporting activities and artifacts necessary to receive an Authority to Operate (ATO), conduct continuous monitoring efforts, and maintain that ATO throughout the life of the contract. This will include responding to the OCC’s questions and providing additional documentation related to any aspect of the risk management lifecycle, specifically Security Assessment and Authorization (SA&A) material, including security control assessments, security continuous monitoring efforts, Plan of Action & Milestone management, vulnerability remediation, threats and incident management. SA&A material will also include the Contractor’s delivery to the OCC of a matrix of security controls identified as “Customer Responsible” (i.e., controls that the OCC will need to implement as a part of the contractor’s solution). After Contract Award, the OCC will perform a review of the FedRAMP Authorization package, and the Contractor must receive an ATO from the OCC prior to migration of OCC data under Task 3. The Contractor shall provide regular reports pertaining to its Information System Continuous Monitoring Plan (ICSM Report/Package) and respond to the OCC’s questions regarding security continuous monitoring activities the contractor has performed.

4.3. Task 3: Data Migration Planning and Implementation

(Required Task) The OCC anticipates providing legacy data to the Contractor in fully decomposed format (metadata, images, natives, and text associated with each record). The Contractor shall import all data received into its document review platform (approximately 15TB). The legacy data in the Summation Pro 6.3 system, in the aggregate, involves approximately 100 active cases, 6.5 million records, and 52.5 million images (12 TB). The legacy data in PSLSS involves 1 case with approximately 1.44 million records and 8.46 million images. (1.5-3.0 TB). As part of the migration of a case from OCC's current Summation Pro 6.3 and PSLSS systems into the ALSS review platform, attorney coding (metadata) associated with legacy Summation Pro 6.3 cases and the PSLSS must be preserved and accessible in the new cloud-based eDiscovery review platform required by Task 4.3. Attorney coding from Summation Pro 6.3 and PSLSS must be accurately overlaid onto the records with which they are associated.

[As the Instructions to Offerors provided in the ALSS solicitation dictate, all Offerors must describe, as a component of their proposal, their Data Migration Approach based on a hypothetical scenario provided in the Instructions in the Request for Proposals (RFP).] After Contract award, the Contractor shall deliver a Data Migration Plan (DMP), which will document how both the actual legacy Summation and the PSLSS data will be migrated into the new solution, including specific processes and procedures for doing so.

4.4. Task 4: eDiscovery Services

The Contractor shall provide the following services for the duration of the performance period.

The Contractor shall provide a legal hold-management tool that provides customizable templates for the communications to custodians of legal hold material and generates automatic legal hold reminder notices at a customizable time setting. The legal hold-management tool must allow OCC attorneys to place and remove legal holds, as well as allow custodians subject to legal holds to view the legal holds that apply to them, and the status of those legal holds. The legal hold-management tool must be capable of producing reports regarding legal holds for OCC use. The Contractor shall provide installation and ongoing maintenance (patches, upgrades, etc.) of any software, as well as training and troubleshooting services for IT personnel and end-users, including attorneys and legal support staff.

Task 4.2 Data Processing and Loading (Required Task) The Contractor shall provide personnel and tools sufficient to process and load externally and internally collected data for use in a cloud-based, eDiscovery review platform provided by the Contractor. The Contractor shall perform all steps associated with processing of such internal and external data, including culling, de-duplication, imaging, OCRing, and remediating data anomalies. All OCC data shall be hosted in a FedRAMP cloud environment. In consultation with OCC staff, the Contractor shall develop a master processing template or set of business rules for managing the processing, culling, and loading of data. The Contractor’s services and support personnel for processing and loading of internal and external data for the OCC shall be available for consultation with OCC staff between 7:00 a.m. and 7:00 p.m. Eastern on all weekdays, excluding Federal holidays (except for Presidents’ Day, Columbus Day and Veteran’s Day). The Contractor’s services and support personnel for processing and loading of internal and external data for the OCC shall also be available in the form of after-hours support (7:00 p.m. Eastern to 7:00 a.m., Eastern, Monday through Friday) and on weekend days (as required). The OCC shall provide 48 hours-notice when weekend support will be required. The Contractor shall be required to initially host and support up to 15 TB of data in cases that exist on the OCC's current, on-premise eDiscovery platform and in the PSLSS, with the ability to scale up as needed. The data footprint is anticipated to grow at a rate of approximately 2-4 TB per year during the Contract period of performance. As part of the Weekly Status Update required under Task 1, the Contractor shall provide the COR metrics regarding data processed for each week, including, the volume and sources of data processed and loaded in each active case; the number of records for different file types processed and loaded into each active case; time to process-and-load from the receipt of data from the OCC; and any exceptions/errors in the data, with a summary of the efforts to remediate such exceptions/errors.

The following standards apply to intaking and loading files:

a) The Contractor shall handle all data in a forensically sound manner.

b) The size of a file is based on decompressed input gigabyte. So, for example, a removable hard drive might carry files totaling 6.44 gigabytes, including not only document and data files, but also zipped files, system files, program files, email containers such as PSTs, etc. After decompressing the zipped files and other compressed files, including the PST containers, the volume might turn out to be 25.2 gigabytes; the Contractor would bill for 25.2 units. The Government will typically ask for this volume information as well as a list of file types and custodian lists prior to actually instructing the contractor to proceed with the processing. This decompression step is not separately billable.

c) The Government expects most material to come in on removable hard drives or by secure file transfer protocol.

d) The Contractor must utilize appropriate physical and data security procedures through the life cycle of the project, beginning when the Contractor takes possession of the data and any physical media. The Contractor must be able to sign a declaration or affidavit, and/or provide oral testimony that describes and supports efforts by the Contractor to preserve data integrity in the processing of electronic files, if and when required by the COR and by the Court.

e) Many of the media to be processed will first need to be reviewed and inventoried by the contractor to identify the number of files, file sizes, file extensions/formats, etc. This is in addition to the file decompression that the contractor shall perform in order to provide the Government with volume information (gigabytes) prior to processing. The Government may decide to process the entire media or only certain files or file types from a particular source. The following is included in file processing:

i. Creation of a file inventory, which should include individual files contained in compressed, “zipped” files on the original medium, as well as accounting for individual emails and attachments in email container files.

ii. Filtering, on the basis of file type or extension, for the purpose of identifying files to include or exclude from processing, as required by the OCC. Filtering may also be performed on the basis of file date, or files custodian.

iii. De-duplication, near de-duplication, and email threading as described in the RTM. The Contractor shall be required to create and maintain a log or database, depending on volume, of files determined by a contractor to be duplicates. The Contractor shall be required to track and demonstrate why files were flagged as a duplicate and either removed or retained for processing.

iv. The identification and extraction of embedded files, such as an Excel spreadsheet file embedded in a PowerPoint presentation slide.

v. Identification of files which are candidates for conversion to color documents. The OCC will determine which, if any, files must be converted to color documents.

vi. Identification of any files that the Contractor has difficulty converting, and troubleshooting to determine if the files can be processed. The OCC will determine the reasonable number of attempts required to troubleshoot such files after consultation with the contractor.

f) After initial processing of the files, the Contractor shall be required to provide output reports listing all files in the batch including extensions and file size; all files processed; all files not processed; and the reason files were not or could not be processed, such as infection with computer viruses or other malicious code, encryption or password-protection, file corruption.

g) The Contractor shall ensure that all files designated for processing are in fact processed and that an orderly flow of the files through the electronic process is maintained. The Contractor shall ensure that all physical media and file collections are kept secure at all times. The Contractor must have sufficient system capacity to hold and manipulate interim data during the processing of work performed.

h) The Contractor shall provide all pickup and delivery services associated with performing the imaging and related services. The Contractor shall return OCC original source materials (media) back to the OCC once the data has been copied onto the system. Proper chain of custody must be maintained and communicated back to the OCC with the return of the source materials. The Contractor may provide options for the safe and quick return of source media that includes creating a forensic image of the source materials and only working from the forensic copy. Pickup and delivery services are not separately billable.

Task 4.3 eDiscovery Review Platform and Support (Required Task) The Contractor shall provide an eDiscovery review platform with a web-based interface that allows attorneys and other staff at the OCC to analyze, search, and code records in a manner that promotes the efficient use of staff time and effort. The OCC requires advanced search capabilities including Boolean, proximity and regular expression search, TAR and data analytics capabilities, as well as email threading and other specific requirements. The Contractor shall provide technical and case planning support to attorneys and other end users, including, assistance in formulating searches and review sets; assistance in tagging records, including “bulk coding”; and assistance in the optimal use and application of analytical tools available in the platform to increase efficiency of attorney review and analysis of data.

The Contractor shall provide technical support to maintain all systems delivered under this Contract running in production and fully functioning without major defects[footnoteRef:1] or unplanned outages. The solution shall be kept up-to-date with the latest software per the OCC’s n-1 architectural principle (i.e., the Contractor shall ensure that the solution is no more than one major update behind the most current commercially available version). The Contractor shall ensure that all eDiscovery review platforms are fully patched with operating system and third-party software patches within 30 days of commercial issuance of the patch. For zero-day exploits the Contractor shall remediate the vulnerability within 48 hours. For other high-priority out-of-cycle patches released by the third-party vendor or the Operating System manufacturer, patch application timeframes shall be dictated by the severity of the potential exploit. All plans and activities undertaken by the Contractor pursuant to this task shall be reflected in the Weekly Status Update. [1: A “major defect” is one that negatively impacts system functionality such that the user is prevented from loading, analyzing, searching, and/or coding data in a manner that results in an accurate, repeatable outcome. ]

Task 4.4 Production Services (Required Task) The Contractor shall produce data hosted by the Contractor at the request of the OCC. The Contractor and its eDiscovery tools must be capable of providing productions of data in multiple formats typically utilized in the eDiscovery space, such as native, TIFF and PDF. The Contractor shall deliver data productions to the OCC via encrypted media (delivered by courier or via a secure file transfer mechanism provided either by the Contractor or by the OCC). The Contractor shall provide reliable quality control for production of OCC information to third parties, as required as part of Task 7 of this PWS. The Contractor shall design a process and an intake form (Production Request) for use by OCC staff requesting data production services from the Contractor. The Contractor shall design and complete with each production a record denoting receipt of the production by the OCC attorney or third party (Production Receipt). Production Requests and Production Receipts shall be available upon request of the COR for invoice validation purposes. Additionally, all documentation of Quality Control processes and procedures applied to the production phase by the Contractor shall be made available to the OCC upon request of the COR. See Section 4.7 (Task 7) of this PWS.

Task 4.5 Trial Presentation Services (Optional) (Optional Task) The Contractor shall provide support for attorneys presenting evidence at a trial or hearing. The Contractor shall attend any hearings or trials as requested by the OCC. Such hearings or trials could occur in any location within the United States. The Contractor shall provide technological support on trial day, including laptops, monitors, trial presentation software, and other hardware and software as needed. Trial presentation services will be integrated into Litigation Support Schedule required under Task 1 of any given case. Ideally, the presentation software will be integrated with the eDiscovery review platform the Contractor provides for the OCC’s review and analysis of ESI under Task 4.3.

4.5. Task 5: Training for OCC Users

(Required Task) The Contractor shall design and implement training for OCC attorneys and staff for all solutions provided to the OCC under the contract. The Contractor shall provide two types of training: (1) end-user training; and (2) super-user/administrator training. The Contractor shall provide formal, classroom-based (live) end-user training for no more than 100 OCC employees per year that covers topics including: (1) how to use the Legal Hold Tracking system, if provided under the Contract per Task 4.1; and (2) how to use the eDiscovery review platform required under Task 4.3. The OCC may require more in-depth/comprehensive training on some aspects of the ALSS. After award, once the Contractor understands the OCC’s training needs, it shall recommend additional training for advanced eDiscovery topics, such as technology assisted review and advanced analytics. Any such super-user training, or any administrative user training, shall adhere to a train-the-trainer model so that there is an internal capability to train OCC staff. The Contractor shall provide access to on-demand training for “how to” topics for the eDiscovery review platform required under Task 4.3 and the Legal Hold Tracking tool provided under Task 4.1 (if this task is awarded by the OCC). In addition to the initial training provided to OCC users, the Contractor shall offer annual refresher training sessions to OCC staff.

The Contractor, in cooperation with an individual (or individuals) designated by the OCC, shall develop a Training Plan that describes the nature of the training to be provided and a proposed training schedule. The Training Plan must be specific to the needs of the OCC, not a generic training plan that does not take the unique OCC workflow into account. The Contractor shall provide training materials to the OCC, as well as reference materials/user manuals, for all technological tools provided under the contract. The Contractor shall provide the OCC with self-guided computer-based training (online training materials that OCC staff can refer to for refresher training as required). The online training shall include all of the material that is a part of the formal classroom training.

4.6. Task 6: Technical Support Help Desk and Ticketing System (Required Task) The Contractor shall provide a litigation help support desk to provide support from 7:00 AM Eastern to 7:00 PM Eastern on weekdays, excluding Federal holidays (except for Presidents’ Day, Columbus Day and Veteran’s Day). The Contractor shall also provide support during these hours for technical issues related to any eDiscovery tool utilized by the OCC under this Contract (e.g., Litigation Hold Tracking Tool, eDiscovery Review platform, and any analytical tools separate from the review platform). The OCC utilizes ServiceNow as its incident-management system for all systems utilized by its users. The ALSS Contractor shall be provided licenses for the OCC’s ServiceNow implementation, and one or more ticketing queues will be designated for the Contractor’s personnel to access tickets for the purposes of providing Tier-2/Tier-3 support. (Tier-1 support is provided via the OCC’s existing service-desk contract.)[footnoteRef:2] As part of the Weekly Status Updates to the COR as required under Task 1, the Contractor shall summarize each ticket received and the resolution of those tickets. In addition, the Contractor shall summarize each ticket received and the resolution of those tickets on a monthly basis in a report (Monthly Ticket Resolution Report) included with the submission of each invoice to the COR. [2: Tier-1 staff will be responsible for escalating tickets submitted by OCC personnel to the appropriate Contractor Tier-2/Tier-3 ticketing queue(s).]

4.7. Task 7: Quality Control Procedure Development and Implementation (Required Task) The Contractor shall develop Quality Control (QC) procedures for all tasks described in Part 4 of this PWS. The Contractor must develop a single QC Plan that describes all the QC processes (including any audits) for every step of the EDRM for which the Contractor provides support under the contract. For example, during the production step, the Contractor shall provide a standardized QC process to allow the attorney, the COR, and/or Contractor to validate that the data was produced in conformance with the Production Request received from OCC attorneys. Such processes do not alleviate the Contractor from monitoring their performance against their QC Plan.

4.8. Task 8: Export of OCC Data Upon Case Closure

(Required Task) Closed case data residing in the Contractor’s cloud environment shall to be returned to the OCC in a format that is suitable for archiving on OCC archival systems. Data will be exported from the cloud based platform in raw format (natives, text, metadata, images and load files). Return of case data will be on encrypted media provided by the Contractor. The OCC will inform the Contractor when a case is closed and request that the case be archived and subsequently lead to being completely removed from the Contractor’s system including destruction of any copies, backups and forensic images. Upon providing the archive-ready data to the OCC, the Contractor shall provide a Certification of Data Return and Destruction, certifying that it has removed and destroyed all OCC data pertaining to the given case.

4.9. Task 9: Transition Services (Optional)

(Optional Task) Upon Contract completion or termination, the Contractor shall be required to transfer OCC data to another service provider. The Contractor shall meet with the OCC and the successful awardee to establish a Transition Plan. During the transition, the Contractor shall maintain services in accordance with Contract requirements until formal transition is complete. The transition process will be dictated in part by the successful awardee’s transition period as well as transition guidance provided by the OCC. All data must be provided to the OCC in a fully delimited format that can be imported into the successful awardee’s document review platform (assuming successful awardee is using an industry standard document review platform). Transition services shall occur over a period of two (2) months.

5 Key Personnel The Project Manager and Litigation Support Lead required under this PWS are critical to the success of the Contract and the ability of OCC staff to successfully utilize its ALSS. Therefore, the Project Manager and one of the Litigation Support staff (the Litigation Support Lead) required under the Contract are key personnel, and the OCC requires the following expertise and experience:

Project Manager

· A minimum of three (3) years of project management experience;

· A minimum of five (5) years of professional experience using eDiscovery solutions in an operational environment and/or providing technical and consulting support for eDiscovery solutions.; and

· A minimum of three (3) years of professional experience using the specific eDiscovery tools proposed as part of the OCC solution

Litigation Support Lead

· A minimum of four (4) years of professional experience in eDiscovery related employment, contracting or projects; and

· A minimum of two (2) years of professional experience using the specific eDiscovery tools proposed as part of the OCC solution 6 Deliverables and the Associated Delivery Schedule Table 1 Deliverables Required

Implementation) ONLY

The Contractor must receive an Authority to Operate (ATO) from the OCC prior to receiving OCC data. OCC will review the SA&A support materials to decide if granting an ATO. The Contractor shall be responsible for all costs and related resource allocations required in case ATO is not granted.

Quarterly (Semi-annually for applicable quarters, include Account Reviews) If deemed necessary by OCC, these may be required monthly.

Specific due dates to be agreed upon after award.

5 business days after award.

Zero-Day (48 hours) Critical (5 calendar days) High (30 calendar days) Medium (60 calendar days) Low[footnoteRef:3] (90 calendar days) [3: As defined by the Common Vulnerability Scoring System.]

· development testing

· UAT

· Production release The dates associated with each milestone shall be included in the plan.

· the eDiscovery review platform

· the Legal Hold Management Tool software, if purchased under the Contract

Online Administrative User Manuals

7 Security Requirements Contractor and all of its respective subcontractors shall follow and remain compliant at all times with all Federal Information Security Management Act of 2002 (Public Law 107-347) (FISMA), Office of Management and Budget (OMB) Circulars, Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the development, operations, and protection of information systems and sensitive information and data. Additionally, the Contractor and all of its respective subcontractors shall follow and remain compliant at all times with OCC and Federal Information Technology (IT) Security standards, policies, and reporting requirements.

The Contractor shall provide Federal Risk and Authorization Management Program (FedRAMP) authorized solution, including maintaining a FedRAMP security authorization and adhering to FedRAMP Continuous Monitoring requirements throughout the life of the contract. If the contractor is responsible for only Software as a Service (SaaS) and has outsourced Infrastructure as a Service (IaaS), and or Platform as a Service (PaaS), they must also provide Continuous Monitoring deliverables for all “as a Service (aaS)” services they have outsourced. The Contractor and systems supporting these services shall follow and remain compliant at all times with the security and privacy requirements for a FISMA MODERATE and FedRAMP MODERATE impact system, including those specified in the current version of NIST SP 800-53 which requires that all systems undergo a formal security authorization (i.e., Security Assessment and Authorization (SA&A)) and continuous monitoring of security controls. The Contractor’s continuous monitoring plan must be developed in accordance with the current version of NIST SP 800-137. The Contractor must meet these security requirements for any system, application, or environment being operated on behalf of OCC or being used to process any OCC information, including services that are either fully or partially provided, such as other agency hosted, outsourced, and cloud computing solutions.

(Data Ownership and Use) The OCC shall maintain ownership of all government data, including data deployed in a cloud or offsite solution, and retains unrestricted rights to that government data. The government data may not be co-located with non-Government data; the Contractor shall isolate the Government data into a separate environment for clear demarcation of ownership. All data produced, stored, and processed under this Contract are the property of the U.S. Government and cannot be reproduced, released, disclosed, or retained by the Contractor for any reason upon termination of services. The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this Contract. Any authorized access to, use, or disclosure of Government data shall only be for purposes specified in this contract. The OCC reserves the right to conduct on-site inspections and the Contractor shall provide access to the OCC when requested.

(Data Retention and Sanitation) The Contractor shall provide the means by which the Contractor shall return data to OCC, terminate storage, and delete government data from the Contractor system, as determined by OCC. When no longer required, this data and/or equipment will be returned to OCC control, destroyed in a manner that is irreversible (e.g., via Cryptographic erasure), or held until otherwise directed within time frames decided by OCC. The Contractor shall certify and attest that all OCC data has been sanitized from any Contractor-owned system. The Contractor shall provide OCC logical and physical access to the Contractor’s facilities, installations, technical capabilities, operations, records, and databases pertinent to this Contract within seven (7) calendar days upon request to verify the Contractor’s certification for the return or removal of government data.

(Authentication) The Contractor shall support secure, multi-factor authentication for all privileged accounts. For Federal workers, facilities, and IT systems, the Contractor must support HSPD-12 compliant two factor solutions. For non-Federal workers, facilities, and systems the Contractor must support OCC approved multifactor architecture. OCC onsite (i.e., systems hosted in house on OCC infrastructure) solutions must support MS Windows authentication and Kerberos. For hosted or cloud computing services, both user-to-service and service-to-service authentication must support claims-based authentication (i.e., SAML, Open ID, OAUTH 2.0) protocols and be compliant and integrated with OCC’s identity provider infrastructure.

(Security Incident Response) The Contractor is required to report all computer security incidents to the United States Computer Emergency Readiness Team (US-CERT) in accordance with the current version of NIST SP 800-61 to include that any incident that involves compromised Personally Identifiable Information (PII) must be reported to US-CERT within 1-hour of detection regardless of the incident category reporting timeframe. Additionally, the Contractor must report all information security incidents to the OCC Cyber Defense Center (CDC) within 1-hour, after becoming aware of the incident, at Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time. The Contractor shall indemnify Federal agencies if a PII breach or security incident should occur and the Contractor is required to provide adequate capital and/or insurance to support their indemnity.

(Cryptography) Cryptographic modules used to protect OCC information must be compliant with the current FIPS 140-2, “Security Requirements for Cryptographic Modules". All government data across systems and devices (e.g., USB flash drives, external hard drives, laptops, SD cards) must be protected by encryption when in transit (i.e. transmitting data between systems) and when at rest (e.g. in storage on drives, SAN, tapes).

(Auditing) The Contractor shall provide the means by which the Contractor shall return routine audit reports and automated audit triggers, for critical auditing issues to OCC, as determined by OCC. For example the Contractor should provide a routine audit trail of all user and particularly administrator activities. However an example of trigger event would be the unauthorized creation of multiple administrator accounts.

(Secure Configurations and Vulnerability Remediation) The Contractor must apply due diligence at all times to ensure that the required level of security is always in place to protect OCC systems and information. The Contractor shall use the following approved Secure Configuration Baselines as defined by United States Government Configuration Baseline (USGCB) and NIST’s National Checklist Program Repository (at http://web.nvd.nist.gov/view/ncp/repository). The Contractor shall only makes changes to the environment on pre-agreed upon terms and conditions; or as required by the OCC to defend against an actual or potential incident. In addition to using secure baselines, the vendor must conduct ongoing vulnerability scanning and remediation that align with the timeframes defined by the Common Vulnerability Scoring System (at https://www.first.org/cvss/).

8 Place of Performance The Contractor’s place of performance will typically be at the Contractor’s facilities. When providing training under Task 5, the Contractor may be required to perform work at OCC facilities in Washington, D.C.; Chicago, Illinois; and/or Dallas, Texas. If/when the Contractor installs a configured solution under Task 4.1, the place of performance may be, in part, at the OCC’s headquarters in Washington, D.C. If the Contractor provides trial presentation services under Task 4.5; the Contractor’s place of performance may be at any location within the United States as directed by the OCC, in addition to the Contractor’s own facilities.

9 Period of Performance The period of performance for this Contract is for a base period of one year with three, one-year option periods from the date of award.

10 OCC Government Representatives The OCC’s Contracting Officer (CO), Contract Administrator, (CA) and COR will be identified prior to award. Their contact information will be provided at time of award.