Final_RFP_-_STB_Case_Management_System.docx

693JK418R900001

STB Case Management System

PART I - THE SCHEDULE

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 GENERAL

B.1.1 This award is made to TBD.

B.1.2 The Contractor shall provide qualified personnel to obtain Cloud-based Dynamic Case Management (DCM) capabilities in support of the Surface Transportation Board (STB) and Statement of Work outlined in Section C.

B.1.3 Support services shall be provided under a Fixed Labor Hour Contract. The Contractor shall bill the fixed labor rates as negotiated at award and further outlined in Section B.2. The Contractor performance cannot exceed 1960 hours per person within each designated labor category without express written consent for the Contracting Officer.

The total negotiated amount of this contract is $TBD; this amount includes the base period and four option periods – if exercised.

a. The negotiated amount of the base period is $TBD. Funds in the amount of $TBD are being obligated at award.

b. The funding amount of $TBD shall cover the base performance period from TBD through TBD.

c. Upon exercise of an option period, yearly funding shall be added via modification to the contract.

B.2 PRICE SCHEDULE

This is a Hybrid Contract that consists of Firm Fixed Price for annual licensing and Fixed Labor Hour for the labor categories. The Contractor can propose additional labor category(s), as needed, labor rates and other associated costs as follows:

· Annual SaaS licensing costs.

· Annual Support and Maintenance Costs.

· Implementation/configuration of SaaS and development of interfaces with STB’s website, current Lotus Notes Case Management system (Labor, required tools)

· Labor categories proposed shall include labor category, number of estimated hours and fixed rate per hour. Labor categories may include but are is not limited to:

· Program Manager

· Solution Architect

· Application Developer

· Systems Information Analyst

· Test Analyst

· The Contractor’s proposal should include appropriate milestone payments based on a proposed performance schedule that incorporates the Deliverables listed in Section F3 below.

· Data Migration costs – the table below contains approximate storage and sizing information related to the Case data migration effort.

Pricing should be broken down by Base year and option years. For each of the Contract Line Item Number (CLIN), the contractor should propose the breakdown of licensing, materials and labor costs.

BASE YEAR

Labor Categories

Total Cost Base Year:

OPTION PERIOD 1

Labor Categories

Total Cost OY 1:

OPTION PERIOD 2

• Labor Categories

Total Cost OY2:

OPTION PERIOD 3

• Labor Categories

Total Cost OY3:

OPTION PERIOD 4

• Labor Categories

Total Cost OY4:

Deliverable /Payment Schedule:

The contractor shall propose for the following deliverables in percentage (%) in the column “payment schedule” the cost/price for each deliverable.

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

TBD

SECTION C DESCRIPTION, SPECIFICATIONS, WORK STATEMENT

STB CASE MANAGEMENT SYSTEM

C.1 PURPOSE

The purpose of this contract is to obtain Cloud-based Dynamic Case Management (DCM) capabilities as a component of a Software as a Service (SaaS) offering that will support the Board’s efforts to automate business processes, integrate life-cycle management of cases and documents, and provide management information reports that will significantly improve the operations of the STB.

C.2 INTRODUCTION, BACKGROUND AND CURRENT CAPABILITIES

The Surface Transportation Board (STB or Board) is an independent adjudicatory and economic-regulatory agency charged by Congress with resolving railroad rate and service disputes and reviewing proposed railroad mergers.

The agency has jurisdiction over railroad rate and service issues, rail restructuring transactions (mergers and line sales), and rail line construction and abandonments; certain trucking company, moving van, and non-contiguous ocean shipping company rate matters; certain intercity passenger bus company structure, financial, and operational matters; and rates and services of certain pipelines not regulated by the Federal Energy Regulatory Commission.

To support the Board’s mission, in a manner consistent with OMB’s Federal Cloud Strategy, the STB is transitioning its Information Technology (IT) enterprise from its legacy enterprise, which is government-owned and located in its office in Washington, D.C., to a cloud-based enterprise. The STB endeavors to leverage the many advantages of cloud-based technologies as described in the Federal Cloud Computing Strategy to provide state-of-the-art information management services to the STB staff and its stakeholders. The STB intends this migration to facilitate improved agency operations and meet Federal Continuity of Operations (COOP) requirements.

As the first step in transforming IT capabilities, the STB migrated Lotus Notes based mail to Office 365 (O365) for email and collaboration in FY 2016. The next step in the transformation exercise is to replace the current Lotus Notes based collaboration and Case Management capabilities with an industry recognized Software as a Service (SaaS) and a support contract that provides highly innovative, creative, cost-effective capabilities. The ideal solution would be an integrated Cloud based low or no code solution that allows the STB to easily generate, manage and intuitively search for content in its Case Management files while automating and supporting changing and improved business processes.

The STB is authorized to employ more than 150 people in one facility, and the Board is supported by approximately 10 Contractor personnel. There are no regional or field offices. The STB is comprised of five STB Board Members offices (of which two are currently filled) and six business units. The business units are the Office of the General Counsel (GC); the Office of Economics (OE); the Office of Environmental Analysis (OEA); the Office of the Managing Director (OMD); the Office of Proceedings (OP); and the Office of Public Assistance, Governmental Affairs, and Compliance (OPAGAC).

The STB, which operates much like a court, maintains an electronic case management system that stores and tracks filings, correspondence and documentation associated with each proceeding. Staff in the Board's GC, OE, OEA, and OP regularly view the status of proceedings in the Board's Case Management System (Case). Occasionally, staff in OPAGAC participate on the formal side of a proceeding, but because of their outside communication with stakeholders and parties before the Board, they are under certain circumstances restricted from participating in open proceedings. Additional documents and content related to proceedings (primarily STB-generated), as well as non-case related content, is managed in other Lotus Notes applications, O365 and other software applications.

Most of the information stored within Case is associated with individual proceedings brought to the Board by railroads or shippers (or other parties) and information related to rulemaking proceedings. Proceedings are identified by docket numbers generated by Case, by title, and by case type. Information about participants before the Board and other interested parties is also stored in Case. When applicable, geographic information is maintained about sections of track that are relevant to a proceeding. Assignments within the Board are tracked as well as the due dates of those assignments. Information about Board decisions and votes on each of the decisions are recorded. Information about each pleading that is filed as part of the official record, and a digital copy of the pleading, are also maintained in Case, as well as information about what has been published in the Federal Register. A history of events in each case is maintained. Budget categories are assigned within the system in order to assist with the annual budget process.

Access to Case is limited to Board employees. However, some content stored in Case is made available to the public on the Board’s website. This public material primarily consists of the public versions of official filings submitted by parties and Board decisions in each proceeding. Material designated as ‘confidential’ by the parties or the Board is not made available to the public. Parties may submit filings and other documents electronically through the STB’s website. The public may also submit Freedom of Information Act requests and environmental comments through the Board’s website. The STB's dockets are currently web-accessible, and parties litigating matters before the STB usually submit their filings electronically.

Case is used to track approximately 300 new cases annually, which includes tracking the status of approximately 3,000 new filings and 400-800 decisions issued by the Board. It also tracks the status of hundreds of pieces of correspondence received by the Board each year and assigned for response. The total number of records in Case includes approximately 28,000 cases, 207,000 filings, 34,000 decisions, and 9,000 pieces of case-related correspondence. However, not all content related to cases is currently stored in the Lotus Notes based Case Management System. Some additional content is managed in other applications and services (e.g., approximately 28,000 pieces of environmental correspondence stored in OEA’s Environmental Correspondence database and three to four water tariff notifications are currently submitted to the Board daily via email). In addition, drafts of Board decisions and other deliberative documents are not stored in Case.

Other IT capabilities that support the Board’s mission include:

· O365 – email, Intranet and collaboration.

· Network and personal Shared drives – document storage and collaboration. As usage of O365 grows, this capability will be replaced, where possible, by OneDrive, Groups, SharePoint sites, other O365 and AWS capabilities that become available.

· Amazon Web Services – virtual machine instances, storage and data transport layer. AWS service components in support of O365, Okta, ExpressRoute, and Direct Connectivity to the STB data center.

· Website – WordPress is being setup to manage some content for the Website. Content managed in WordPress is different than the content that is currently stored in the Lotus Notes based Case Management System, some of which is made available on the website.

· Pay.gov will be utilized in the future for tracking fees and billing related to cases and other Board activities. Much of this work is currently being done manually.

· The Board is currently converting some older microfiche, microfilm and papers documents to electronic images to incorporate into the new DCM.

· The other applications currently in use include SAS and Tableau for analytics and ArcGIS for mapping.

The draft diagram below provides an overview of the activities and roles that are related to a proceeding though all artifacts are not stored in the Case Management System. Primary stakeholders are the Board and its employees, the Public and the Regulated Industries. The diagram is also provided as a separate attachment (See Attachment F – Draft Community Model Diagram).

Figure 1 - Case Management System Community Model

The Contractor shall replace the Board’s current Case Management system and associated Lotus Notes based applications with a user-friendly, Cloud based, FedRAMP compliant SaaS and other integrated custom solutions (if needed) that will permit the Board to automate business processes, integrate life-cycle management of cases and documents, and provide information reports. The Contractor shall utilize an incremental, iterative (agile) approach to rollout and change management. The STB must be able to use and maintain current systems while the new system is being setup.

The Contractor shall initiate the new solution with a proof of concept that will function in parallel with the STB’s current systems. Once the proof of concept is approved, the Contractor shall begin migration of the data from the legacy applications to the new system. Publicly accessible case documentation filed, generated, and managed in the new solution shall be displayed on the Board’s website, along with content contained in the legacy Case Management System. The new solution must be able to maintain the separation between public information that will be accessible on the Board’s website and non-public confidential and internal deliberative documents.

A commissioned study conducted by an independent research firm on behalf of the STB recommended applications strong in runtime case management, which would provide STB with functionality complementary to MS SharePoint. Runtime case management is useful when processes are frequently different and change based on context. The platforms required to support this (runtime case management) must be more flexible. The study listed the following solutions that could support the Board’s mission: K2, Appian, Hyland, OpenText, and IBM Case Manager. However, this list is not comprehensive, and services utilized by Contractors do not need to be limited to these applications.

The solution proposed by the Contractor shall include updates to the website to consolidate and display information from both the current Lotus Notes based Case Management system and the new solution on the STB’s website. The STB Reference Architecture diagram below indicates a conceptual end state once the STB has implemented DCM capabilities and setup an Enterprise Data Warehouse which should provide reporting and data analytic capabilities. The solutions listed in the diagram are listed as examples only. Services proposed do not need to be limited to these solutions.

Figure 2- Conceptual End State

Attachment A provides a diagram illustrating the STB’s current network architecture.

C.3.2 KEY STB LIFE CYCLE ACTIVITIES AND OVERVIEW OF USER STORIES

The Contractor shall support the following key case management activities currently executed by the Board, including:

· Tracking filings, decisions, correspondence and cases filed with the Board.

· Tracking and calendaring the Board's business processes.

· Sharing of confidential STB-internal draft documents among its personnel, prior to the placement of the final version of these documents in the case management system, in a manner that maintains a clear separation between drafts and final documents.

· Providing management information reports.

Specifically, the Contractor shall support the following:

· A user must be able to capture all relevant field and document level data associated with a docket:

· Case initiation; i.e., the creation of a proceeding/docket that will include both filings from external users and decisions created by internal STB users.

· Event information (e.g., deadlines, milestones).

· Information Relationships between cases, parties, participants and general case information.

· Manage resource assignment to tasks with associated alerts and ticklers.

· Schedule and case management with associated alerts and ticklers.

· Case file archival and disposition.

· Document management.

· Electronic notification of decisions to parties and other interested persons.

· The solution must allow STB users to work on internal documents collaboratively, through a user-friendly interface, including tracking and maintaining version control over a document through the drafting stages, and allowing storage of final documents in the system or other designated databases. The solution must recognize the clear distinction between public filings/decisions and STB internal working drafts and ensure that these categories of documents are never commingled, either through the development of two different databases or the inclusion of strict controls/permissions that eliminate the risk of inadvertent disclosure of internal working documents.

· The solution must enable users to search and report on case information. Users must also be able to print search results.

· The solution must enable external users to search for and access non-confidential case information via the web.

· The solution must enable the Board to manage user access requirements based on roles to allow some case information to remain confidential, while other information is made public.

· The solution must provide Case Status Management and Reporting for internal STB users, while protecting non-public information from being disclosed improperly to external users. Internal STB users must have the option of viewing standard reports as well as creating ad hoc reports as needed. For example, demonstrate a search or report that shows the status of 40 -70 draft decisions, a list of all dockets that have been active for one year or more, and/or a list of the status of all active draft decisions associated with an individual user. The solution must support collection and manipulation of customer-supplied data, such as comments and correspondence from State/Local/Federal government and public.

· Link to or Interface with Pay.gov for management of payments associated with filings and other payments received at the Board.

Attachments B, C and D provide a listing of Actors, a Roadmap and high-level User Stories of capabilities that are required in the replacement Case Management System.

C.3.3 BUSINESS REQUIREMENTS

The Contractor shall meet each of the following key business requirements. Please describe how your new solution would do so.

· Basic workflow use cases such as auto-assignment, document routing, and routing of tasks to users.

· Reassignment of cases for workload balancing, Out of Office (OOO), etc.

· Automated alerts / reminders based on configurable Service Level Agreements (SLAs), milestones, status changes, etc.

· Electronic / automated notification of decisions to relevant parties.

· Support for scalable storage for diverse content, including documents, images, videos, maps, correspondence, and document metadata.

· Ability to provide centralized, secure access to case-related documents currently in disparate sources (Case, O365, Lotus Notes applications) while clearly maintaining the separation between internal STB documents (drafts, etc.) and documents available to external users (public filings and decisions).

· Ability to allow end user to work in a document without opening it in an editing tool.

· Support for version tracking and control of documents.

· Indexing and management of all documents, including but not limited to, classifications by Case / Docket Number / filing date / service date / decision status and date / geography, etc.

· Integrations with common office productivity tools (Google Cloud, Office 365).

· Ability of multiple users to work concurrently on the same documents.

· Allow users to attach files to records. Attachments may include Microsoft Office documents, PDF files or files in other formats, e.g., .kmz/.kml or shapefile formats.

· Ability of multiple users to interact with documents including view/read, comment/redline, highlight, update/change, append, merging, authoring, search, etc.

· Support for social tools (discussions, activity streams, commenting, markups/annotations).

· Support for enterprise tools such as wikis, discussions, expertise locators.

· Provision of FAQ, context sensitive help, or other in-built help capability.

· Ability of users to interact with external users.

· Ability of users to collaborate internally across offices / business lines.

· Ability to ensure that internal STB documents are not commingled with publicly available documents, either through maintenance in separate databases or through strict permissions/controls.

· Robust and rapid full text search and information retrieval and detection of content and case documents across archived and active files.

· Ability to search body of documents, not only document properties.

· Ability to retrieve all relevant documents and metadata related to a case or matter, including correspondence (which may include PDF files, other attachments, comments and metadata) as records.

· Ability to support sorting and filtering by different data attributes.

· Ability to create and view analytics dashboard or reports to monitor process performances (views of assignments, caseloads, and SLAs).

· Out of the box analytics dashboards focused on performance / case metrics Report scheduling. Support for flexible, ad-hoc querying of system data.

· Content analytics (text analytics), e.g., visualization of patterns, trends, relationships; automated categorization based on document content, etc.

· Configuration of workflows (e.g., are there pre-built case patterns and templates, accelerators, English-like rules editors, etc.). For example, what types of workflows can be designed by administrators versus end users? Are external participants allowed to be part of workflows or tasks?

· Ability to add / remove users, define / modify user permissions

· Modeling business rules for task assignments, form validation, routing logic, and reporting;

· Ability of external users to easily navigate the system, search for, select and view content, with appropriate user authentication / security controls. Configurability of User Interface (UI) to meet end-user personalized needs.

· Support for packaged UI templates for specific use case scenarios. If yes, how many?

· Please describe the tools and development approach for UI design across tools / repositories.

· Secure access to documents from mobile devices.

· Ability to edit / approve / route documents from mobile devices

· Ability to initiate and complete offline tasks.

C.3.4. SECURITY AND TECHNICAL REQUIREMENTS

The Contractor shall meet each of the following security and technical requirements. Please describe how your new solution would do so.

· Support for secure content. Please describe how content is secured.

· Access control lists. Please describe how users/groups are prevented or allowed to view / edit content. Please describe separation of duties and least privilege capabilities as they will apply to STB and non-STB users of the system. For example, members of one user group (the OPAGAC) are, under some circumstances, prohibited from participating in certain proceedings (cases) and should not have access to internal STB documents. External users (public) must be able to view case documents associated with proceedings (e.g., documents not deemed confidential) via the web. Internal STB documents (e.g., decision drafts) must not be commingled with public documents (e.g., final decisions) and publication of final documents must be controlled.

· Support for role-based access and how access is managed.

· Support for secure authentication (multi-factor) to the application.

· Please describe who manages changes to these configurations (e.g., STB sys admins, Contractor, etc.).

· Are unauthorized access attempts logged? If yes, please describe.

· Support for a secure path for end-to-end processing of confidential records and information, starting with intake, through triage, then review, and finally approval.

· Support for an access-controlled interface to enable 3rd parties’ ability to load / view / retrieve docs.

· Are encryption capabilities supported?

· The tools and/or services you provide to support content migration for upgrades or from another ECM solution, file folders, and email systems?

· Approach for migrating existing case data and content from legacy applications to a centralized content repository, based on STB legacy environment (Case, O365, Lotus Notes, file servers).

· Do you have "intelligent" migration tools?

· Please describe the most complex migration you have undertaken (source systems migrated, number of documents, volume of data, time to complete, etc.)

· Please describe how you ensure appropriate technology resources to enable the data migration (e.g., Lotus Notes developer)

· Features and tools provided to help the solution scale to meet high document and transaction volumes and concurrent user loads.

· Tools, features, and analytics that enable system admins to monitor application performance.

· Please describe the attributes of your largest customer installation (number of documents, processes, users, instances, etc.)?

· Interoperability with other ECM or STB legacy archives / repositories (Lotus Notes, O365, SharePoint), web content management (currently WordPress), portals, or other applications.

· Support for APIs or software development kits (SDKs), including mobile if relevant? Is Content Management Interoperability Services (CMIS) supported?

· Packaged integrations with office productivity or other enterprise applications. Please specify.

· Please describe how your solution will integrate seamlessly with the STB website to enable: a) public access to information that is generated and managed in the new solution; b) public access to information that is today available in legacy case management applications.

· Have you previously integrated your application with Pay.gov? Please describe how this was accomplished from an integration and security perspective.

· Please describe your strategy and approach for sharing and integration.

· Does your application integrate natively with O365 or does it require a plug-in? Please include details on the features supported / not supported and if customization is required.

· Does your solution run on a private cloud or otherwise FedRAMP certified government cloud environment?

· What are the steps for provisioning a new instance in the environment?

· What is the process of moving an application between environments? Is application re-coding required?

C.3.5 IMPLEMENTATION REQUIREMENTS

The Contractor shall meet each of the following implementation and services requirements. Please describe how your new solution would do so.

· Do you have a services team that can support implementation, or do you have to request support from partners?

· What is the size of the services organization (Systems Integrator (SI), internal or other) dedicated to implementation of this solution?

· How many SIs / firms are certified to implement the solution?

· What Service Level Agreements (SLAs) are you able to maintain for the activities described above?

· What reporting are you able to provide STB regarding adherence to agreed-upon SLAs?

· Describe your process for measuring satisfaction of your user base, including your IT client counterparts as well as end-users.

· Please describe how you typically define incentives and penalties for failure to meet SLAs or customer satisfaction requirements.

· Online and/or instructor led training provided prior to or immediately after solution is deployed to production environment.

· Online and/or instructor led training on any new solution features and versions.

C.3.6 CONTRACTOR REQUIREMENTS

Please respond to the following Contractor information questions with as much detail as possible.

· What is your commitment to continuous development of preconfigured templates, accelerators, and frameworks relevant to case management in the government sector?

· What is your forward-looking roadmap around product features? Do you have plans to enhance core processes and content capabilities, as well as improving core design around rules, process, data, and UI generation?

· What is your revenue for your core enterprise content management solution?

· What is this as a share of your total solution revenue (including case management, BPM, analytics, and other components)?

· How many existing customers are currently in production with your core enterprise content management solution?

· How many US government clients are currently in production with your core enterprise content management solution?

· Describe as many projects and/or clients you have worked with that are similar to the one described in this request for proposal. What were the challenges on these types of projects and how were they resolved?

· Which most accurately describes the regularity with which you undertake the following implementation activities on your clients' behalf: i. all the time, ii. typically, iii. on occasion (provide details to support your assessment):

· Set up development and testing environments

· Migrate complex data and old data from a legacy solution

Location and resources you will use to support the implementation (end-to-end).

· Please provide a detailed implementation plan that details roles and responsibilities of Contractor and client, risks, and mitigation approaches.

· Please describe your average implementation time and the full range of implementation times, from execution of SOW to production.

· Please describe your ability to mitigate unexpected resource losses, including whether you're able to guarantee a transition period in case of the aforementioned.

· How you support defect management including communication, typical turnaround time, activities, roles and responsibilities.

· How you support customizations (client-requested customizations to features/functions and/or integration with additional data sources): does the Contractor typically perform the development work for feature/function customizations?

· Your approach for planned enhancements, including support, integration, rollout, and training. Does your solution ensure access during enhancement upgrades? If not, what are typical outage times / schedules? How will you communicate with STB regarding innovations and upgrades? Do you solicit innovation feedback from your clients and incorporate in your innovation and enhancement strategy?

C.3.7 OTHER REQUIREMENTS

The new solution must meet the following requirements:

MANAGEMENT, CUSTOMER SUPPORT, AND TRANSITION TERMS:

The Contractor must:

· Develop an implementation and migration strategy and provide migration services to securely transition the existing STB applications, data, services, and interfaces to the cloud infrastructure in an optimal manner. The STB has a test environment in AWS, and a staging environment in the STB data center for the website but no other development and testing environments. If needed, the Contractor shall setup the necessary development and/or test labs in an approved environment.

· Provide a seamless transition from the current case management application to the new services with minimal disruption to business operations while ensuring data integrity.

· Provide Troubleshooting services and support during core duty hours of 8:00am through 5:30pm during the weekdays.

· The Contractor shall provide a trouble ticket submission process for submitting support requests and questions from users. The Contractor shall provide timely updates on issue resolution.

· The Contractor shall work with the STB to minimize the downtime related to software updates. This covers cutover to major release upgrades, implementation of Enhancement Packages and installation of Support Package Stacks. Most outage windows shall be limited to a cutover weekend. Frequent outage windows may be scheduled throughout the year to meet a two-day cutover plan.

· At the time the new solution is delivered to the STB and as part of that solution, provide sufficient documentation and an executable exit strategy that would allow the STB to transition to a new service provider at the conclusion of the period of performance. Both throughout the period of performance and after its conclusion, STB must own the content migrated to and produced through the system created by this contract. In addition, should the STB choose a new provider at the end of the period of performance, the Contractor must work with the STB and any new service provider to migrate to the new provider’s system.

PERFORMANCE REPORTING AND STATUS REPORTING

The Contractor shall:

· Provide monitoring of the system and troubleshooting incidents associated with the hosting environment to ensure SLAs are met. This may include:

· 24 hours per day, seven days a week, and 365 days per year proactive monitoring and support for resolution of all outages for SaaS. Other monitoring should be during the hours of 8:00 am and 5:30 pm, Monday to Friday. Proactive notification should be provided for any scheduled down time during system upgrades.

· Provide automatic monitoring of resource utilization and other events such as failure of service, degraded service, etc. including service dashboard or other electronic means.

· Provide Automated reporting mechanisms to provide transparency into each of the Acceptable Quality Level metrics enumerated below, and into every metered service upon which billing is based or which may affect performance. The STB shall have continuous and unrestricted access to such reporting mechanisms, without need for intervention by the service provider.

CONTINGENCY RESPONSE

The Contractor shall:

· Ensure that the service include effective contingency planning including backup/restoration, disaster recovery and continuity of operations processes and will guarantee the disaster response acceptable quality level.

SERVICE LEVEL AGREEMENTS (SLAS)

The Contractor shall structure and manage its underlying assets so as to guarantee satisfaction of the Acceptable Quality Levels described below. Failure to meet one or more of the acceptable quality levels in any month shall cause the service provider to incur forfeiture of a percentage of the scheduled billed amount in the next billing cycle. The Contractor shall provide a financially-backed penalty schedule for not meeting each of the SLA targets.

ACCEPTABLE QUALITY LEVELS

· Availability: The percentage of time that the provided infrastructure services supporting STB shall be functioning and available to the end users on a 24-hours-per-day/seven-days-per week basis, excluding agreed-upon maintenance periods, shall not fall below 99.5% (measured over one month). Availability will be evaluated on a monthly basis for determining compliance with the contract. Availability metrics shall be reported in the monthly status report.

· Mean Time to Recovery (MTTR) – the period from the time an error condition is discovered until it is resolved - for all system outages attributable to infrastructure failure shall not exceed the reliability aligned with the 99.5% availability. Error conditions shall be reported within 2 hours upon discovery. MTTR will be evaluated on a monthly basis for determining compliance with the contract. System outages and resolution shall be reported in the monthly status report.

LOCATION

The hosting/ service provider shall not store any portion of the STB’s data in facilities outside the contiguous United States, Alaska, Hawaii, or other U.S. Territories.

SOFTWARE LICENSE

Contractor shall provide and maintain licensing for the software applicable to the proposed solution.

NETWORK REQUIREMENTS

The infrastructure configured by the Contractor must support two-factor authentication to make access to the instances more secure.

TRUSTED INTERNET CONNECTION (TIC) COMPLIANCE

Ensure that all network traffic will go through a Trusted Internet Connection (TIC).

The proposed solution must adhere to Trusted Internet Connection (TIC) 2.0 standards per OMB Memorandum M 08-05 because the cloud-hosted solution deals with restricted data.

The STB will be ensuring TIC compliance by using Trusted Internet Connections Compliance Validation (TCV) assessment method. In particular, the infrastructure shall allow for either dedicated network circuits or Virtual Private Network (VPN) connections between the cloud and the STB internal network(s).

NETWORK TRANSPORT

User access to the application/system shall utilize a secure transport by complying with FIPS 140-2 guidelines for connecting to HTTPS.

QUALITY CONTROL

All software products purchased from or developed for the STB by a Contractor must be certified by the provider to be free of malicious code. The Contractor agrees to be liable for any damage or loss of business as a direct result of malware or malicious code embedded within software licensed to or developed for STB under the authority of the purchase/work order.

C.3.8 ADDITIONAL SECURITY REQUIREMENTS

C.3.8.1 CONFIDENTIALITY, SECURITY AND PRIVACY

· The Contractor shall provide a SaaS with the Confidentiality, Security and Privacy levels and controls that are required by statute and regulation and consistent with best professional practices.

· The Contractor shall provide a service with a high degree of reliability and availability.

· The SaaS shall be FedRAMP certified with a FedRAMP provisional or Agency ATO or should be hosted in a FEDRAMP certified environment. The Contractor, using an independent assessor approved by the STB Authorizing Official (AO), will perform the FISMA Compliant Security Assessment and Authorization activity (SA&A – formerly referred to as Certification and Accreditation (C&A) of the information system developed or maintained prior to going into production). STB will accept the solution while the Contractor continues to pursue FEDRAMP Provisional Authority to Operate (P-ATO) by the JAB with the understanding that final approval will be obtained by the end of CY2018.

· The services provided shall comply with the provisions of the Privacy Act of 1974, especially regarding the handling and protection of Personally Identifiable Information (PII). The Contractor shall cooperate in the conduct of periodic Privacy Impact Assessments (PIA), as required by Section 208 of the e-Government Act of 2002.

· The Contractor shall provide a service that supports the requirements of the Board’s Controlled Unclassified Information (CUI) program.

C.3.8.2 SECURITY AUTHORIZATION BOUNDARY

The Contractor shall work with the STB to ensure all aspects of the project meet the FISMA security requirements including but not limited to determining the system security authorization boundary (to be illustrated in the Contractor-provided architectural diagram) and providing support to receive the Authorization to Operate (ATO) for the system.

C.3.8.3 SECURITY CLASSIFICATION

The SaaS offering is to be a FISMA Moderate system per its FIPS 199 classification.

For hostings which are classified as internal access only and FISMA moderate, in addition to meeting the security requirements for the overall cloud hosting contract, all hosting environments must be physically and logically separated from other non-Government cloud hostings.

C.3.8.4 FISMA COMPLIANCE

At all times, the Contractor shall comply with the FISMA and OMB Circular A-130.

The Contractor shall agree to assist the STB in its compliance with the requirements set forth in FISMA, by successfully completing the SA&A provided for in FISMA for all computer systems provided by the Contractor.

The Contractor shall complete the Security Assessment and Authorization (SA&A) process on or before providing Service Ready Notice.

If during the term of this contract there are changes to the data protection and privacy laws and regulations, including FISMA, or if there are new US Federal Government requirements applicable to the STB, the Contractor and the STB will address these changes in a mutually agreed upon Change Management Process.

C.3.8.5 SECURITY CONTROLS

The Contractor, in conjunction with the Cloud Service Provider (CSP), shall, with the knowledge and concurrence of the STB system owner, be responsible for IT security for all non-government-owned systems used in the development of and systems intended for eventual delivery to the Board in fulfillment of contract requirements. This includes hardware, software, databases, networks, and telecommunications systems and those operated by its subcontractors.

The Contractor shall be required to ensure compliance with the security control requirements of NIST SP 800-53 and the Federal Information Processing Standard (FIPS) 200 that are appropriate to the sensitivity and criticality of the data or system. FIPS 199 and the NIST 800-60 will be used to determine sensitivity and criticality.

All security controls should follow the requirements defined for FedRAMP and the SA&A for Information Systems. The Cloud hosting environment must meet or exceed all security requirements identified for a FISMA Moderate system.

Solution should support Personal Identity Verification (PIV) authentication via Single Sign On using Active Directory domain credentials. Additionally, solution should be capable of integration with Okta to manage access to 0365.

C.3.8.6 SECURITY ASSESSMENT & AUTHORIZATION (SA&A)

· Applications must undergo FISMA Compliant Security Assessment and Authorization (SA&A) and obtain an Authority To Operate (ATO) prior to going into production and undergo Continuous Monitoring as described in the next section.

· Applications must undergo FISMA Compliant Security Assessment and Authorization (SA&A) and obtain an Interim Authority to Operate (IATO) prior to the processing of any STB data in the test environment. The Contractor must follow NIST SP 800-37, 800-34, 800-18, 800-30, 800-60, 800-53, 800-53A, Federal Information Processing Standard (FIPS) 199 and 200, the associated STB guides/templates, and Privacy Impact Assessment.

· The Contractor shall work with STB to define a clearly demarcated security authorization boundary for the deployed environments.

· The Contractor shall provide supporting documentation to STB as necessary in support of the SA&A process.

· The Contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, to verify compliance with the requirements for an Information Technology security program.

· The STB reserves the right to conduct on-site inspections. The Contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

· The Contractor shall take appropriate and timely action to correct or mitigate any weaknesses discovered during such testing.

C.3.8.7 CONTINUOUS MONITORING AND VULNERABILITY ANALYSIS

The CSP is required to conduct continuous monitoring of the solution in a manner that enables enterprise-wide visibility into the security posture and effectiveness of controls. The Contractor shall be required to monitor the security state of the system on an ongoing basis with a frequency sufficient to enable the STB AO to make ongoing risk-based decisions on whether to continue to utilize the system. The Contractor/application shall undergo annual security testing in alignment with STB’s Continuous Monitoring Program.

CONTINUOUS MONITORING PLAN

The Contractor shall submit a continuous monitoring plan as part of the SaaS offering that supports the STB AO’s ongoing authorization process. The plan must conform to the NIST SP 800-137 and be formally approved by the STB AO. The Contractor shall submit monthly continuous monitoring reports to the applicable STB System Owner and Authorizing Official.

SCANS

· The Contractor Provider shall scan all systems monthly with a vulnerability analysis tool that is acceptable to STB. All “safe” or “non-destructive” checks must be turned on.

· The STB will reserve the right to conduct unannounced and prearranged independent vulnerability scans using Government personnel or another contactor.

· The Contractor shall take appropriate and timely action as agreed upon between the Contractor and the STB to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

· The Contractor shall provide an electronic copy of each report and session data as a part of the FEDRAMP Package.

AUDIT LOGGING

The Contractor must comply with audit logging standards per STB policy. The audit records must contain sufficient information to, at a minimum, establish what type of event occurred, when (date and time) the event occurred, where the event occurred, the source of the event, the outcome (success or failure) of the event, and the identity of any user/subject associated with the event.

SYSTEM MANAGEMENT

The Contractor must provide the following in alignment with STB’s continuous monitoring strategy:

· Patch management

· Antivirus

· Malware detection

· Event management

· Configuration management

· License management

· Incident management

C.3.8.8 SECURITY INCIDENT REPORTING

Upon becoming aware of any unlawful access to any STB Data stored on Contractor equipment or in Contractor facilities, or unauthorized access to such facilities or equipment…