3. Attachment A_Statement of Objectives.pdf

FDIC DATA HOSTING EDISCOVERY VENDOR 1

STATEMENT OF OBJECTIVES 2

Version – April 23, 2024 3

1.0 OVERVIEW 5

The overall objective of the Basic Ordering Agreement (“BOA” or “Agreement”) is to obtain 7 best-in-class legal support eDiscovery services. 8

Objectives include obtaining: 10

• cloud-based managed hosting and processing of host electronically stored information 11

(“ESI”) that may be part of investigations, inspections, examinations, and/or litigation. 12 The timing of this support may include from early case assessment/pre-processing 13 ingestion through trial utilizing state-of-the-art technology, including analytics and 14 technology assisted review (“TAR”), and employing e-discovery best practices to 15 preserve, collect, process, review, analyze, produce, and ESI for FDIC investigations, 16 inspections, examinations, and litigation; 17

• assistance with responding to information requests from many sources, including, for 18 example, Congressional requests for information, third-party subpoenas and audits, 19 FOIA requests, internal and external investigations; and 20

• assistance to Legal Division personnel and FDIC outside counsel and other legal support 21 providers and other professional staff members to collect, organize, review, analyze, 22 produce, and present evidence as part of unofficial or official discovery in a lawsuit or 23 investigation. 24

2.0 IN-SCOPE SERVICES 26

The BOA’s scope includes all of the following services — as well as tasks encompassed by, derived 28 from, or logically related to the following — in relation to any phase of the eDiscovery Reference 29 Model (EDRM)1: 30

2.1 Managed data hosting. Secure hosting of data for access by the FDIC (or others as 32 designated by the FDIC), including nearline and cold storage options; disaster recovery; 33 administration and support of web-based database/legal review applications, and discovery 34 platforms; documenting procedures; purchase, testing, and implementation of FDIC-required 35 software programs; and performing quality control. 36

2.2 Database creation. Creating databases or database load files (e.g., dat; csv; eDII); 38 document coding/data entry; documenting procedures; and performing quality control. 39

2.3 Paper document acquisition, preparation, and unitization. Organizing documents; 41 identification of document boundaries (inserting slip sheets); scanning, OCRing, and 42 numbering documents; creating box or file level indices; capturing document images (single-43

1 The eDiscovery reference model is an industry-standard approach to ESI that incorporates the following phases: information governance, identification, preservation, collection, processing, review, analysis, production, and presentation.

page TIFF format or PDF format); copying documents; preparing documents for production; 44 documenting procedures; and performing quality control. 45

2.4 Early data assessment, pre-processing, and processing. Extracting and converting data 47 files, including email files and other files in their native formats; optical character recognition 48 (“OCR”) of documents; rendering single page TIFF images (or other image formats), as 49 needed; automated and manual analysis of files to identify relevant or priority material utilizing 50 culling tools, analytics, and TAR; analyzing and reporting file type and other data metrics; 51 documenting procedures; and performing quality control. 52

2.5 Analytics and TAR. Use of analytics and TAR or similar tools; providing consulting 54 services and workflows for analytics and TAR to locate potentially relevant information 55 efficiently; and providing expert testimony, if necessary. 56

2.6 Managed review. Review of documents for, e.g., relevance, identification of legal 58 privileges, identification of Suspicious Activity Reports and/or Reports of Examination among 59 other categories; redaction; creation of privilege logs; documenting procedures; and 60 performing quality control. This may or may not include hosting data, depending on whether 61 the Contractor has received an Authority to Operate that permits hosting of FDIC Data. 62

2.7 [Optional Scope] Pre-trial and trial support, including courtroom services. Providing, 64 administering, operating and maintaining equipment and other resources in support of 65 litigation; exhibit preparation; courtroom presentation; remote depositions, sworn statements, 66 and interviews; other audio/visual services; and performing quality control. 67

2.8 Forensic services. Forensic data collection performed by forensics professionals with 69 proper local, state, or federal certifications as needed at sites throughout the United States, U.S. 70 Territories, and other countries and territories, as needed or requested; data analysis and 71 reporting; documenting procedures; decryption; and performing quality control. 72

2.9 [Optional Scope] Transcription/Translation. Automated language transcription and/or 74 translation services. These services are listed in rows 87-99 of the Pricing Workbook. Vendors 75 are invited, but not required, to propose for these optional services. 76

3.0 SECURITY REQUIREMENTS2 79

(All security-related requirements are at Contractor expense and all must be completed prior to any 81 Task Order awards.) 82 At all times for the duration of the BOA, all of the Contractor’s managed hosting and processing of 84 FDIC electronically stored information must be either: (1) performed by a solution that has a 85 Federal Risk and Authorization Management Program (FedRAMP) MODERATE Impact Level 86 authorization, or (2) performed entirely within a FedRAMP MODERATE Impact Level authorized 87 environment. 88

2 Note: This same information is also included in the Basic Ordering Agreement for ease of reference.

3.1 System Security Assessment and Authorization Requirements 89

3.1.1 Authority to Operate 90

The Contractor shall not input, store, process, output, and/or transmit FDIC data within a 91 Contractor IT system without an Authority to Operate (ATO) signed by the FDIC Authorizing 92 Official (AO) granted via the System Security Authorization (SSA) process. The FDIC process for 93 obtaining and maintaining ATO, is in accordance with NIST SP 800-37 Risk Management 94 Framework for Information Systems and Organizations. The Contractor shall adhere to current 95 FDIC policies, procedures, and guidance for the SSA process as defined below. 96 Complete the Security Authorization Process. The SSA process shall proceed according to the 98 NIST SP 800-37 Risk Management Framework for Information Systems and Organizations or any 99 successor publication including templates. 100

a. System Security Assessment and Authorization Process Documentation. 102 SSA documentation shall be developed by the Contractor using the FDIC provided 104 security documentation templates. SSA documentation consists of the following: 105 Security Categorization Worksheet, System Security Plan, Contingency Plan, 106 Contingency Plan Test Results, Configuration Management Plan, Security 107 Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. 108 Additional documents that may be required include a Plan(s) of Action and 109 Milestones and Interconnection Security Agreement(s). 110

b. Independent Assessment. 112 Contractor shall have, at its expense, an independent third party perform an 114 assessment of the FDIC-prescribed security and privacy controls as outlined in 115 NIST SP 800-53 to determine the extent to which the selected controls are 116 implemented correctly, operating as intended, and producing the desired outcome 117 with respect to meeting security and privacy requirements for the system and the 118 FDIC. Should the independent assessment find deficiencies, the Contractor must 119 follow the direction of the FDIC to create and track Plans of Action & Milestones 120 (POA&Ms) to be included in the final authorization package. FDIC has the 121 unilateral right to determine if the results and mitigation strategy are acceptable. In 122 the case of unacceptable results or mitigation strategy, or if the Contractor does not 123 remediate control weaknesses in a timely manner as established in POA&Ms, FDIC 124 may treat the failure as an event of default. 125

c. Support the Completion of the Privacy Compliance Documentation. 127

As part of the SSA process, the Contractor may be required to support the FDIC in 129 the completion of a Privacy Threshold Analysis (PTA). The requirement to 130 complete a PTA is triggered by the creation, use, modification, upgrade, or 131 disposition of a contractor IT system that will store, maintain and use personally 132 identifying information (PII), as defined by the Privacy Act, 5 U.S.C. § 552a. Upon 133 review of the PTA, the OCISO Privacy Section determines whether a Privacy 134 Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), 135 or modifications thereto, are required. The Contractor shall provide all support 136 necessary to assist the FDIC in completing the PIA in a timely manner and shall 137 ensure that project management plans and schedules include time for the 138 completion of the PTA, PIA, and SORN (to the extent required) as milestones. 139 Support in this context includes responding timely to requests for information from 140 the FDIC about the use, access, storage, and maintenance of PII on the Contractor’s 141 system, and providing timely review of relevant compliance documents for factual 142 accuracy. Information on the FDIC’s privacy compliance process, including PTAs, 143 PIAs, and SORNs, is accessible at www.fdic.gov/privacy. 144

d. Authorization to Operate. 146 Upon completion of the SSA documentation and independent assessment, the 148 Contractor shall submit a signed SSA package, validated by the independent third 149 party, to the Oversight Manager for acceptance by the FDIC AO, or designee, at 150 least thirty (30) days prior to the use of the system. The FDIC is the final authority 151 on the compliance of the SSA package and may limit the number of resubmissions 152 of a modified SSA package. Once the ATO has been granted by the FDIC AO the 153 Contracting Officer shall incorporate the ATO letter into the contract as a 154 compliance document. The FDIC’s issuance of the ATO does not alleviate the 155 Contractor’s responsibility to ensure the controls are implemented and operating 156 effectively. The SSA package must include the following: 157

Deliverables (30 Days Prior to System Use) Security and privacy plans Security and privacy assessment reports Plans of Action & Milestones Supporting assessment evidence or other documentation, as required.

e. Continuous Monitoring/Ongoing Assessment. 160

After an initial authorization, the Contractor shall have the security and privacy 162 controls assessed on an ongoing basis in accordance with NIST SP 800-37 and 163 based on the FDIC Control Assessment Frequency. Ongoing assessment of the 164 control effectiveness is part of the continuous monitoring activities of the FDIC. 165 Adherence to the terms and conditions specified by the AO as part of the 166 authorization decision are also monitored. Ongoing control assessment continues as 167 the information generated as part of continuous monitoring is correlated, analyzed, 168 and reported to the Oversight Manager for acceptance by the FDIC AO. The system 169 needs to undergo a Security Impact Assessment (SIA) whenever any 170 changes/modifications are made to the system. Should the independent assessment 171 find deficiencies, the Contractor must follow the direction of the FDIC to create and 172 track POA&Ms to be included in the final authorization package. FDIC has the 173 unilateral right to determine if the results and mitigation strategy are acceptable. In 174 the case of unacceptable results or mitigation strategy, or if the Contractor does not 175 remediate control weaknesses in a timely manner as established in POA&Ms, FDIC 176 may treat the failure as an event of default. 177 http://www.fdic.gov/privacy

4.0 CONTRACTOR RESOURCES 180

The Contractor will be responsible for providing contract and corporate level resources, 182 including a dedicated FDIC Project Manager, for performing all work ordered under the BOA. 183 The Contractor shall provide all management, staffing, planning, scheduling, procuring, pickups 185 and deliveries for all items/services required under the BOA. This includes, but is not limited to: 186

• Providing a single Program Manager/Point of Contact for the FDIC to engage regarding 188 the BOA. 189

• Screening prospective contractor staff for conflicts of interest, and ensuring employees 191 used under this BOA meet personnel hiring and employment security approval 192 requirements, and coordinating with FDIC, and other government personnel if directed by 193 the FDIC, as needed to complete the required clearances. Contractor must retain all 194 personnel security files for all individuals who perform work under the BOA for the life 195 of the Agreement. 196

• Ensuring facilities and computer networks and equipment used for the 198 Contractor’s performance of this Agreement meet all security requirements of the 199 Agreement, and coordinating with FDIC staff as needed. 200

• Completing and providing Background check and Confidentiality agreements 202 upon FDIC request. 203

• Conducting all activities associated with management and handling of interim and 205 deliverable pipeline products, such as media containing electronic data. For example, the 206 Contractor must forward, monitor, and track each “container” of documents, from receipt, 207 through data processing, delivery, recovery, and destruction. 208

The Contractor shall train its own staff so as to ensure that all personnel are able to perform their 210 duties under the Agreement satisfactorily. For example, the Contractor shall provide staff trained 211 and experienced in litigation processes and terminology, as well as specific software packages, 212 including database and processing software and/or other similar platforms used as early data 213 assessment/review applications. 214

5.0 ORDERING PERIOD 216

The ordering period of the BOA is five (5) years from award. Task Orders properly awarded 218 within the Ordering Period may extend to their natural conclusion, for a maximum of up to 12 219 months beyond the end of the BOA-level Ordering Period. 220

6.0 ORDERING PROCEDURES 222

The BOA is not a contract. It is a written instrument of understanding between the FDIC and the 224 Contractor for future delivery of unspecified quantities of goods or services. A BOA becomes a 225 binding contract when a Task Order is issued and for the period of the Task Order. The FDIC is 226 not obligated to place any Task Orders under the BOA. Each order becomes a binding 227 commitment upon acceptance of the Task Order. 228 At any time during the Period of Performance, the FDIC may send to Contractor, and any other 230 Contractors awarded a BOA, a Request for Task Order Proposal (RFTOP) describing the nature of 231 one or more specific tasks, the structure for Contractor’s task-level proposal, the evaluation 232 factors, and any other information relating to the task. Task Orders under the BOA may be 233 awarded either competitively or non-competitively (i.e., Direct Award): 234

• Competitive Award: The FDIC may solicit two or more Contractors holding a BOA for 236 the purpose of evaluating proposals and awarding a Task Order. Evaluation factor(s) for 237 the selection decision will be provided in the Request. 238

• Direct Award: The FDIC reserves the right to issue a Task Order directly, outside of any 240 competition, if the FDIC determines a direct award is in the FDIC’s interest. Reasons for 241 the use of a Direct Award may include: 242

• A need to rotate awards in order to keep a Vendor’s “production line warm” so 243 that all BOA holders are well positioned to support FDIC requirements in the case 244 of surge requirements; 245

• Low value Task Orders, typically less than $5,000, where a direct award is the 246 most cost effective approach; or 247

• Only one source is feasible for fulfilling the FDIC’s need under the circumstances 248 (for example, exigent circumstances, technical uniqueness, case-relatedness, or 249 follow-on engagements which would require cost to onboard or scale a new 250 vendor to an existing project). 251

If Contractor wishes to be considered for a Task Order award, it must comply with any 253 instructions in the RFTOP. Based on the task order proposals received, the FDIC may select one 254 or more Contractors to perform the tasks, or none at all. The Task Order must be executed by 255 authorized representatives of the Contractor and the FDIC after which there will be a binding 256 obligation between Contractor, and the FDIC under the terms of the BOA and the Task Order for 257 delivery of the goods or services described therein. Only the individual specified in the Task 258 Order as having authority to bind the FDIC will be authorized to execute the BOA on behalf of 259 the FDIC. 260