A17 A1 Appendix C RTM 022223 Amd 01.xlsx

XLSX spreadsheet 36 KB Posted Feb 22, 2023

Attached to: FOIA Case Management System and Support Services Federal contract opportunity
Solicitation number: 63NLRB23Q0007
Issued by: National Labor Relations Board

About this file

Written by GovTribe AI · Dec 27, 2023

This document is an Appendix C Requirements Traceability Matrix for a FOIA Case Management System and Support Services solicitation issued by the National Labor Relations Board. The solicitation seeks a cloud-hosted, FedRAMP authorized FOIA case management solution to support end-to-end FOIA/PA request processing. The solution must integrate with Login.gov, Pay.gov, and other government systems. It must provide features such as automated workflow, redaction tools, analytics reporting, public portals for request submission and status tracking, and training and support services. The solution must meet extensive regulatory, technical, and security requirements for areas including records retention, disaster recovery, and 508 compliance.

View the file

Other files for this federal contract opportunity

Other files attached to FOIA Case Management System and Support Services, newest first.
File	Type	Posted
A17 RFQ QAs 022223.pdf	PDF	Feb 22, 2023
A17 A1 PWS - FOIA CMS 022223 Amd 01.docx	DOCX document	Feb 22, 2023
A17 RFQ_02223 Amd 01.pdf	PDF	Feb 22, 2023
A17 A1 Appendix C RTM Final.xlsx	XLSX spreadsheet	Feb 14, 2023
A17 A2 Past Performance Information.docx	DOCX document	Feb 14, 2023
A17 A1 PWS - FOIA CMS 021423.docx	DOCX document	Feb 14, 2023
A17 A1 Appendix A SLA Final.docx	DOCX document	Feb 14, 2023
A17 A1 Appendix B SSAA Final.docx	DOCX document	Feb 14, 2023
A17 RFQ_021423.pdf	PDF	Feb 14, 2023

On GovTribe

Work with this file on GovTribe

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Sheet1

Appendix C Requirements Traceability Matrix
Updated AMD 01, 02/22/2023
No.	Sub-Category	PWS Req. Ref.	Required/Preferred	Regulatory Requirement	Contractor Response	Comments or Notes from Contractor (Optional)	Fully Meets
1	Regulatory	4.6.2	Required	Software-as-a-Service Cloud Hosted			Does not Meet
2	Regulatory	4.7.5	Required	GSA FedRAMP Authorized
3	Regulatory	4.9.5	Required	Integrated with Login.Gov
4	Regulatory	4.9.4	Required	Integrated with Pay.Gov
5	Regulatory	3.3	Required	Includes integrated e-Discovery solution
6	Regulatory	4.9.3	Required	Integrated with Foia.Gov
No.	Sub-Category			Functional Requirement	Contractor Response	Comments or Notes from Contractor (Optional)
1	Objectives	3.2	Required	Meets NLRB Objectives
2	Objectives	3.1	Required	Constitutes full, stand-alone FOIA processing tool
3	Base	3.4	Preferred	e-Discovery capabilities support legal business processes
4	Base	3.5	Required	e-Discovery capabilities support FOIA/PA business processes
5	Base	3.6	Required	e-Discovery tool interfaces with marketplace applications/add-ons
6	Base	3.7	Required	Supports all FOIA & PA needs, rules, regulations, guidance, and requirements
7	Base	3.8	Required	Requests from nlrb.gov and foia.gov
8	Base	3.9	Required	Support FOIA, PA, and hybrid requests
9	Base	3.10	Required	Initial requests and appeals
10	Base	3.11	Required	Separate case files for FOIA branch and OIG
11	Base	3.12	Required	Separate case files for appeal records
12	Base	3.13	Preferred	Guide public through process of request submission
13	Base	3.14	Required	Notification of request submissions
14	Base	3.15	Required	Automatic assignment of tracking numbers
15	Base	3.16	Partially Required	Data Validation and previous disclosure identification
16	Base	3.17	Required	Manual request submission & submission editing
17	Base	3.99	Required	Web-based processing interface
18	Base	3.19	Required	Workflow for FOIA/PA requests
19	Base	3.66	Required	Image-enabled Redaction tool
20	Base	3.56	Required	Drag-and-drop support
21	Base	3.37	Required	Interfaces with outlook/secure smtp email
22	Base	3.60	Required	Storage Capacity Flexibility; Cloud Security
23	Base	3.20	Required	Identify request by NLRB portal or foia.gov
24	Base	3.21	Preferred	identify request by requester/NLRB
25	Base	3.18	Required	Customization of Workflow-Ability to change workflow without the developer
26	Base	3.34	Required	Requests-multi track capability
27	Base	3.44	Preferred	Licensing model-flexibility with the quantity of licenses (not required to purchase a license for each user).
28	Base	3.80.9	Required	Reporting functionality/Auto-generate a FOIA log
29	Base	3.35	Required	Ability to create user roles and permissions
30	Base	3.22	Required	Use of Administrative Record
31	Base	3.87	Required	Upload templates to the system
32	Base	3.33	Required	Workflow Automation-assign tasks
33	Base	3.37	Required	Generate emails to requester...with a .gov suffix
34	Base	3.78	Required	Delinquent payment requester tracking
36	Base	4.6.6	Preferred	Customization of workflows-audit trails, ability to change configurations without the developer
37	Base	4.6.5.8	Required	Ability to customize metrics reports
38	Base	3.23	Required	Manual additions to end-to-end request tracking
39	Base	3.5.10	Required	Administrative Appeal Process- tracks and relates appeals to the original request
40	Base	3.42	Required	Expedited Processing/Fee waiver Processing Capability
41	Base	3.27	Required	Identify frequent requests automatically
42	Base	3.28	Required	End-to-end tracking of request
43	Base	3.39	Required	Secure, encrypted delivery of responses
44	Base	3.52	Required	Search requests & redactions by various fields, data, metadata
45	Integration	4.5.1	Required	Migration of all data from FOIAonline
46	Integration	3.79	Required	Generates Annual FOIA DOJ reports
47	Base	3.36	Required	Auto generate receipt of request emails/letters
48	Integration	4.9.4	Required	Accept Electronic Payments and integrates with Pay.gov
49	Integration	3.47	Required	Dashboard reporting
50	Integration	3.41	Required	Assignment of Processing Categories
51	Integration	4.9.1	Required	Integrate with Agency's Power BI
52	Processing	3.5	Required	FOIA/PA processing features
53	Processing	3.42	Required	Assigns response deadlines by request and task type
54	Processing	3.46	Required	Allows for request tolling (pausing the clock)
55	Processing	3.49	Required	Tracks deadlines w/reminders
56	Processing	3.105	Preferred	Automatic Notification of Duplicate Incoming Requests
57	Processing	3.32	Required	Artificial Intelligence redaction tool
58	Processing	3.71	Required	De-duplication-removes duplicate records (perhaps integrated within Redaction Tool)
59	Processing	3.40	Required	Customizable & flexible routing/workflow
60	Processing	3.38	Required	Send final Disclosure Determination and responsive records to requester from the processing platform
61	Processing	3.54	Required	Ingest, store, and search various file types
62	Processing	3.74	Required	Auto-calculate fees and generate invoices
63	Processing	4.16.2	Required	Redaction tool produces records that are 508 compliant
64	Processing	4.13.1	Required	Retention schedules-configurable
65	Processing	3.61	Required	Full search of prior response records
66	Processing	3.31	Required	AI smart searches for similar prior requests
67	Processing	3.29	Required	Integrated Redaction Tool-Edit redactions within the same document
68	Processing	3.55	Partially Required	Redaction tool-ability to redact multimedia files, i.e. sound, video
69	Processing	3.30	Preferred	Redact content across a document set--allow changes of case file during the reviewing stage
70	Processing	3.57	Required	Ability to upload records for processing
71	Processing	3.1	Required	End to end request processing capability
72	Processing	3.32	Required	AI smart redaction and deduplication
73	Processing	3.70	Preferred	Bates numbering with redaction tool
74	Processing	3.24	Preferred	Generate Vaughn Index
75	Processing	3.44	Preferred	Program offices/recordholders ability to upload responsive records to system
76	Processing	3.43	Required	Extend the workflow to end-users, ability to interact with recordholders from the system, search request emails, reminder emails
77	Processing	3.101	Required	File size reduction capability, automatically compress file size for delivery to the requester for voluminous requests
78	Processing	3.53	Required	Identify 1st vs 3rd party requests
79	Processing	3.103	Required	Ability to sort responsive records, records management, smart records capability
80	Processing	4.6.5.9	Required	Artificial Intelligence/Predictive tool- Ability to program and/or control
81	Processing	3.102	Preferred	Redaction tool--can perform a side-by-side comparison (of past disclosure determination)
82	Processing	4.6.6	Preferred	Control of Artificial Intelligence functions (ability to configure without developer)
83	Processing	3.38	Required	Record encryption
84	Processing	3.104	Required	A document should be hosted by each file, even if it is a duplicate record
85	Processing	3.80	Required	Accepts/Tracks/Reports metadata
86	Public Portal	3.8	Required	Public-facing portal for request initiation…
87	Public Portal	4.9.1	Required	API capability to FOIA.gov
88	Public Portal	3.47	Required	Allows public to track status
89	Public Portal	3.26	Required	Allows for publication of final disclosure determinations and responsive documents via platform
90	Public Portal	4.8.1	Required	Requester Digital Certification of Identity capability from public portal
91	Public Portal	3.94	Required	Requester’s ability to keyword search across all FOIA requests
92	Public Portal	3.25	Required	Self-contained public reading room
93	Public Portal	3.26	Required	Automatic uploads to the reading room
94	Base	3.45	Preferred	Automatic reminder emails for pending requests to NLRB staff
95	Base	3.48	Required	Tracking status of pre-disclosure notices
96	Base	3.50	Required	Identification and re-use of relevant prior response packages
97	Base	3.51	Required	Leverage prior work product for potentially responsive records
98	Base	3.58	Required	Retain native file formats and redacted versions
99	Base	3.59	Required	Capability to export responses
100	Base	3.62	Preferred	Support for tags/terms
101	Base	3.63	Required	Support for searching non-ocr’d PDF
102	Base	3.64	Partially Required	Proper, secure redaction; review of redactions; support irregular items
103	Base	3.65	Required	Identification of redaction actions
104	Base	3.67	Required	Disclosure reviews serially or in parallel
105	Base	3.68	Required	Multiple reviews tracked and viewable separately
106	Base	3.69	Required	Search and redact PII
107	Base	3.72	Required	De-duplication and consolidation of email threads
108	Base	3.73	Required	Organization and Identification of most inclusive/responsive emails
109	Base	3.75	Required	Time and cost tracking
110	Base	3.76	Required	Waive & modify fees
111	Base	3.77	Required	Import/export invoice data
112	Base	3.81	Required	Support Annual FOIA Reports
113	Base	3.82	Preferred	Filing of Annual FOIA Reports through foia.gov
114	Base	3.83	Required	Track final disclosures and exemptions
115	Base	3.84	Required	Tracking Glomar responses
116	Base	3.85	Required	Support Chief FOIA Officer’s report
117	Base	3.86	Required	Report final disposition of each request
118	Base	3.87	Partially Required	Support creation of Letters/Templates
119	Base	3.88	Required	Generation of letters throughout processing cycle
120	Base	3.89	Required	Search correspondence
121	Base	3.90	Required	Templates utilize fields to fill in relevant data
122	Base	3.91	Required	Support move, copy, delete, amend case files
123	Base	3.92	Required	Track or identify frequently requested records
124	Base	3.93	Required	Search across various fields
125	Base	3.95	Required	Support custom fields
126	Base	3.96	Required	Identity proofing
127	Base	3.97	Required	Payments tracking
128	Base	3.98	Required	Secure solution that is cost efficient and effective
129	Base	3.100	Required	Perfection tracking
130	Base	3.80	Partially Required	Standard and Ad-hoc reports
No.	Sub-Category			Security/IT Requirement	Contractor Response	Comments or Notes from Contractor (Optional)
1	Security	4.6.2, 4.7.5	Required	System must be a cloud system (meeting all five cloud characteristics as defined in NIST SP 800-145) offering cloud services on the FedRAMP site with a status of "Ready" (with no agency sponsorship by NLRB required). (see Min Req 1 above)
2	Security	4.7.3	Required	Support and provide materials to achieve Authorization to Operate (ATO).
3	Security	4.7.9	Required	As a FedRAMP system, Contractor should provide at least a monthly ConMon meeting (continuous monitoring control implementation and PO&AM status review), either for NLRB or for all of its agency users.
4	Security	4.7.12	Required	Attain an ATO before data migration
5	Security	4.7.13	Required	Attain an ATO before user account provisioning and production usage begins
6	Security	4.7.4	Required	NIST SP 800-53 Rev. 5
7	Security	4.7.4	Required	The system must be FedRAMP authorized at the Moderate impact security level baseline.
8	Security	4.7.1	Required	The system Integrates with Federated Services that use SAML 2.0 (such as Azure AD) for Authentication for NLRB internal users.
9	Security	4.7.5	Required	Attain ATO from NLRB CIO
10	Privacy	4.8.1	Required	Identity proofing and authentication of all FOIA/PA requesters which meets the requirements of OMB memo M-21-04 (with a service such as, for example, Login.gov)
11	Privacy/	4.7.14	Required	Support an Identity Assurance Level (IAL) of IAL2
	Security
12	Privacy/	4.10.3		Support an Authenticator Assurance Level (AAL) of AAL2
	Security		Required
13	Privacy/	4.10.5	Required	Support a Federation Assurance Level (FAL) of FAL2
	Security
14	Privacy	4.8.2	Required	Language on the citizen-facing web page(s) of the solution which meets the labeling requirements of OMB memo M-21-04 Appendix I, including proper Privacy Act notice(s) and consent forms when relevant.
15	Privacy	App. B 1.c	Required	Materials provided by the Contractor as needed to help update and publish relevant SORNs (System of Record Notice(s)) for the system.
16	508	4.16	Required	508 compliant
17	IT	1.3	Required	Implementation Plan
18	Privacy/Security	3.64	Required	Secure redactions
19	Security	4.7.6	Required	Maintain ATO
20	Security	4.7.7	Required	Address findings from security assessment(s)
21	Security	4.7.8	Required	POA&Ms
22	Security	4.7.10	Required	Attestation letters
23	Security	4.7.11	Required	Participation in Vulnerability Disclosure Program
24	Security	4.7.15	Required	Secure communications
25	Security	4.7.16	Required	Data encrypted at rest
No.	Sub-Category			Training & Support Requirements	Contractor Response	Comments or Notes from Contractor (Optional)
1	Training	2.7	Required	Virtual Training
2	Support	1.2	Required	Help Desk support
3	Training	4.15.2	Required	Product Training Plan
4	Training	4.15.8	Required	User Manuals
5	Support	4.15.6	Preferred	Chat feature provided for support
6	Training	4.15.7	Required	Training provided
7	Support	4.15.5	Required	Help Desk support that will assist with functional and technical difficulties
8	Training	4.15.1	Required	Instructor-led training
9	Training	4.15.3	Required	Training materials
10	Training	4.15.4	Preferred	Self-paced training
11	Training	4.15.9	Required	Training environment provided
12	Support	4.15.10	Required	Maintenance and support provided
13	Support	4.15.11	Required	Support for trouble tickets
14	Support	4.15.12	Required	Responses to trouble tickets
15	Support	4.15.13	Required	Support for help requests
16	Support	4.15.14	Required	Licenses
17	Support	4.15.15	Required	SLA maintained
18	Support	4.15.16	Required	Integration and Interfaces
19	Support	4.15.17	Required	Means of reporting issues
20	Support	4.15.18	Required	Resolution of incidents/defects
21	Support	4.15.19	Required	Roadmap
22	Support	4.15.20	Required	Testing
23	Support	4.15.21	Required	Notice of downtime
No.	Sub-Category			Transition Requirements	Contractor Response	Comments or Notes from Contractor (Optional)
1	Transition	4.5.1	Required	Phase-in
2	Transition	4.5.2	Required	Phase-out
No.	Sub-Category			Technical Requirements	Contractor Response	Comments or Notes from Contractor (Optional)
1	Technical	4.6.1	Required	Compatible with NLRB’s technical environment
2	Technical	4.6.3	Required	Support access control & auditing
3	Technical	4.6.4	Required	Contractor assistance with technical configuration changes
4	Technical	4.6.5	Required	Ongoing assistance with business configuration changes
5	Technical	4.6.7	Required	Performance tuning
6	Technical	4.6.8	Required	NLRB usage expectations
7	Technical	4.6.15	Required	Licensing model
8	Technical	4.6.9	Required	Contractor responsible for obtaining and maintaining licenses
9	Technical	4.6.10	Required	Supply chain risk management
10	Technical	4.6.11	Required	Vulnerability mitigation
11	Technical	4.6.12	Preferred	Solution is browser agnostic/compatible
12	Technical	4.6.13	Required	Minimal browser support
13	Technical	4.6.14	Required	Compliance with EO 14028
14	Interface	4.9.1	Required	API(s) provided
15	Interface	4.9.2	Required	Integration with NLRB and other systems
16	Auth	4.10.1	Required	Use SSO
17	Auth	4.10.2	Required	Allow public accounts
18	Auth	4.10.1.1	Required	SSO architecture
19	Auth	4.10.4	Required	FedRAMP authentication and directory service protocols
20	Audit	4.11.1	Required	Solution audits events
21	Scale	4.12.1	Required	Solution scales to accommodate growth
22	Retention	4.13.1	Required	Complies with Retention schedules
23	Retention	4.13.2	Required	Retention schedule-based notifications
24	Retention	4.13.3	Required	No automatic deletions based on retention schedules
25	Retention	4.13.4	Required	Preservation of retired/transferred/off-boarded employee records
26	Retention	4.13.5	Required	6 Year retention schedule
27	Retention	4.13.6	Required	Compliance with regulations, policies, laws
28	Retention	4.13.7	Required	Maintain records in accordance with laws, regulations, policies, etc.
29	Retention	4.13.8	Required	Prevention of record destruction
30	Disaster Recovery	4.14.1	Required	Provide disaster recovery plan
31	Disaster Recovery	4.14.2	Required	Provide results of disaster recovery plan testing
32	Technical	4.16.1	Required	508 Compliance of website(s)
33	Technical	4.16.2	Required	508 Compliance of records/documents

Sheet2

File details come from the government source that posted it. Updated Feb 22, 2023.