Attachment_1___Performance_Work_Statement_(PWS).pdf

FINAL

LEGAL DOCUMENT MANAGEMENT AND CASE MANAGEMENT/DOCKETING

SYSTEM

PERFORMANCE WORK STATEMENT (PWS)

The Contractor shall provide a commercially available Legal Document Management and Case Management / Docketing System (“System”) similar to those in use by private legal practices.

The System would preferably contain automated rulesets to docket actions associated with the US Patent and Trademark Office and Federal litigation. The Contractor shall provide an enterprise-level system for use by approximately 200 concurrent users located at NASA’s Office of General Counsel (OGC) at NASA Headquarters in Washington, D.C., and at the Office of Chief Counsel at each of the following NASA Centers:

Ames Research Center (Mountainview, CA) Armstrong Flight Research Center (Moffett Field, CA) Glenn Research Center (Cleveland, OH) Goddard Space Flight Center (Greenbelt, MD) Johnson Space Center (Houston, TX) Kennedy Space Center (Cape Canaveral, FL) Langley Research Center (Hampton, VA) Marshall Space Flight Center (Huntsville, AL) NASA Management Office at the Jet Propulsion Laboratory (Pasadena, CA) NASA Shared Services Center (Kiln, MS) Stennis Space Center (Kiln, MS)

NASA legal is a dispersed legal counsel organization located across the NASA centers and locations listed above. Each location has a Chief Counsel Office that reports to the NASA General Counsel at NASA Headquarters. NASA currently has various siloed solutions in use supporting the OGC. Many locations are still paper-based using standard Microsoft Office products (i.e. Excel) to track matters and cases. Other NASA centers have automated tools that include Sharepoint solutions or custom Action-Tracking systems while others have an actual Case Management/Docketing and Document Management system. It is entirely possible that a system in its current form meets the business need of one center, but is not scalable across the NASA Legal Community and does not provide the robust agency-wide Knowledge Management requirements for the enterprise system that is the object of this solicitation. None of these current solutions is accessible from one NASA center to another and provides the functions that are detailed below. This solicitation aims to select a single enterprise commercial off the shelf (COTS) solution via a single award BPA that can be utilized across the disparate NASA centers for the purpose of providing a unified and consistent solution across the agency.

NASA will entertain different system implementations not limited to: on-premise solutions;

Hybrid; and Cloud solutions. Systems that employ ‘cloud’ technology including Hybrid solutions shall be FedRAMP Authorized for the vendor and product/service/solution aspects that rely on cloud technology. If vendors’ systems are not FedRAMP authorized by the date of award, then the vendor shall propose an on-premise solution. Vendors will have the ability to change the system at their and NASA’s discretion over the life of this BPA.

BPA Scope: The contractor shall provide a commercially available, enterprise-level Legal Document Management and Case Management system that has the ability to integrate with docketing rulesets such as third-party options and/or the US Patent and Trademark Office (USPTO). The contractor shall also provide conversion costs, professional technical consultant services, and maintenance or enhancements for implementation as needed.

Period of Performance:

This resultant BPA will cover a Base Period of one (1) year, and four (4) one-year option periods, commencing on date of award, 2019. If all options are exercised, then the final date of performance would be on or about July 14, 2024.

Base Period On or about July 15, 2019 to On or about July 14,2020 Option Period 1 On or about July 15, 2020 to On or about July 14, 2021 Option Period 2 On or about July 15, 2021 to On or about July 14, 2022 Option Period 3 On or about July 15, 2022 to On or about July 14, 2023 Option Period 4 On or about July 15, 2023 to On or about July 14, 2024

Initial BPA Call Tasks:

1.0 Document Management

1.1 The system shall provide a means for profiling and searching documents across

NASA legal offices. The system should provide common search capabilities such as searching by full text, title, date, or category. The system should be capable of working with common electronic file formats such as Microsoft office products, .pdf, e-mails.

1.2 The system shall provide a means for storing documents in a secure environment with access controls and document governance features. These features should include the capacity to track and edit metadata, limit access to specific users and groups across NASA legal offices, track document versions, and apply retention policies.

1.3 The system shall provide a means for organizing documents by an Agency-determined taxonomy or taxonomies, such as by case type or case identifier.

1.4 The System shall record and track, at a minimum, the following document metadata:

document origin date, document origin (NASA center), all subsequent authors of the document, document file type (e.g. .doc, .pdf) as well as allow the addition of custom metadata fields.

2.0 Case Management/Docketing

2.1 The System shall have the ability to create and track various legal actions with regularly updated and pre-populated rulesets to automatically calculate due dates.

2.2 The System shall have the ability to create and track custom user actions (e.g.

internal agreement/contract reviews with specified deadlines).

2.3 The System shall have the capacity to generate custom reports on tracked legal and custom user actions based on fields such as due date and action assignee.

3.0 System, Access and Security

3.1 At minimum, the System shall support Windows and MAC OS, and browser configuration requirements for NASA approved Desktop Operating Systems as referenced in NASA-STD-2804 (Note: NASA-STD-2804 Spring 2018 is available per request via email to Joseph R. Tynes, Contract Specialist, at joseph.r.tynes@nasa.gov but is otherwise not available in the public domain).

3.2 The System shall integrate with NASA electronic authentication (eAuth) due to management of International Traffic in Arms Regulations (ITAR), Sensitive But Unclassified (SBU), Personally Identifiable Information (PII), Export Control, and sensitive proprietary content and data. To meet this requirement, the system solution must support third-party Single Sign On (SSO) without enforcing local application login or Lightweight Directory Access Protocol (LDAP) authentication (username + password).

3.3 The System shall capture non-modifiable audit logging for all pertinent actions, including system access, record access, data export, data import, and record modification. Audit data shall be provided to a NASA approved Security Information and Event Management (SIEM) solution (e.g. encrypted syslog) and capture user and application access including but not limited to success or failure, date/time, and source per NIST 800-53 AU controls.

3.4 If the System is web enabled, then it shall utilize Hyper Text Transfer Protocol Secure (HTTPS) with Secure Sockets Layer / Transport Layer Security (SSL/TLS) certificates and Internet Protocol version 6 (IPv6) addresses for any data in transit (data moving between networks, e.g. between a browser and websites).

3.5 The System shall integrate with leading office productivity software including at a minimum Microsoft Office 365.

3.6 The System shall integrate with NASA’s Access Management solution using SAML 2.0 consistent with the FICAM Web SSO Profile (https://www.idmanagement.gov/wp-content/uploads/sites/1171/uploads/SAML20_Web_SSO_Profile.pdf .). As part of this integration, the system shall support AES-256 encryption of the SAML response (e.g. attribute, assertion, and name_id), a SAML configuration method for updating certificates between the identity and service providers without a manual key exchange, and SHA-2 certificates for any related function (e.g. SAML signing and SSL). The System shall also support session synchronization between the client software solution (agents / SAML) and the authentication source to facilitate single sign on sessions

3.7 The System shall be compliant with DHS Binding Operational Directive 18-01

(HSTS).

3.8 The System shall implement multifactor authentication, using approved NASA Smartcards, for network, local and remote access to privileged and non-privileged accounts.

3.9 All cryptographic modules implemented or relied upon by or within the system shall be compliant with evaluation and approval requirements outlined in FIPS140-2. The System shall encrypt Controlled Unclassified Information (CUI), which encompasses PII data, as “data-at-rest” for data stored in databases, data warehouses, data on a hard drive, USB drives, spreadsheets/documents, archives, tapes, off-site backups, mobile devices, etc. “Data-in-transit” shall also be encrypted per FIPS 140-2.

Additionally, NIST 800-122 addresses confidentiality of PII data.

3.10 System shall be able to operate in a manner complicit with security controls specified in NIST 800-53r4 for a FISMA Moderate rated system.

3.11 The System shall be available at all times with the exception of scheduled system maintenance and patching activities. Core hours are 6:30 am Eastern to 6:30 pm Pacific with downtime less than 1% (<= 4 days/year total). In the event of an unscheduled outage, the system shall support a restore capability with minimal data loss (less than 4 hours) and a return to service after unexpected failure of 8 hours.

3.12 The System should provide the capability to disable immediately accounts of users posing a significant risk in coordination with NASA policies and directives or after sixty (60) days of inactivity.

4.0 System Support Services

The Contractor shall provide the following System Support Services:

4.1 Training –

4.1.1 Year 1 – The Contractor shall provide one web-based training class of at least 4 hours to teach how to use the System for all members of the NASA legal community and supporting IT community. The legal community consists of Attorneys, paralegals, and administrative personnel that will utilize the System. The supporting IT community includes, but is not limited to, system administrators, security/audit personnel, and system analysts.

4.1.2 Years 2, 3, 4, and 5 Optional Training – As ordered by NASA, the

Contractor shall provide 1 web-based, role-specific training of at least 4 hours for up to 30 users for the NASA legal community and supporting IT community. As ordered by NASA, the Contractor shall provide Year 1 training for any new users per PWS 4.1.1.

4.2 Installation, Maintenance, Patches and Vendor Upgrades - Contractor shall provide initial installation support as well as ongoing maintenance and security patches and vendor upgrades to maintain the currency, security and interoperability of the System as necessary.

Optional Tasks:

4.3 Conversion and Migration Support - As ordered by NASA, Contractor shall provide the following conversion and migration services:

4.3.1 Contractor shall migrate all electronic documents from all existing systems used at each NASA legal office (Sharepoint, PerfectLaw, Oracle-based system operated by Entellitrak, shared drive document storage, personal desktops drive) and load into Contractor’s System according to a taxonomy/structure that NASA provides.

4.3.2 Contractor shall convert and migrate all existing actions and associated fields from all existing systems used at each NASA legal office (PerfectLaw, Sharepoint, Custom software built on Cold Fusion with SQL server database) and load into Contractor’s System according to a taxonomy/structure that NASA provides.

4.4 The government is requesting software solutions with the following additional capabilities.

4.4.1 In addition to the ability to track deadlines as described in 2.1, the ability to either (1) provide rulesets integral to a single system or (2) have a demonstrated integration with a third party product that provides such a service. A preferred solution would provide pre-populated rulesets to automatically calculate due dates from actions associated with U.S. Patent & Trademark Office (USPTO) deadlines (e.g. deadlines to file a response to an Office Action from the U.S. Patent & Trademark Office), and Federal litigation matters. The desired solution would preferably provide rulesets that are off-the-shelf, not managed by NASA, and promptly updated by the vendor in accordance with any changes in U.S.

law/regulations.

4.4.2 The System shall automatically import XML data from the USPTO's Private Patent Application Information Retrieval (PAIR) System to automatically trigger creation of docketing a due date based on a deadline associated with a U.S. Patent or patent application.

APPLICABLE DIRECTIVES

Federal Government NASA requirements to be complied with, as applicable, include but not limited to:

Federal Enterprise Architecture.

Privacy act of 1974.

NIST Special Publication 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems (May, 2004).

Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) for system accessibility requirements, www.section508.gov

Federal Information Processing Standard (FIPS) 140-2

National Institute of Standards and Technology (NIST) 800-122

National Institute of Standards and Technology (NIST) 800-53

National Institute of Standards and Technology (NIST) 800-53r4

Department of Homeland Security (DHS) Binding Operational Directive (BOD) 18-01

NASA-STD-2804 – This is a NASA restricted document. Access is granted by request to joseph.r.tynes@nasa.gov

TECHNOLOGY REFRESHMENT CLAUSE

After the BPA award and throughout the BPA life, the selected contractor shall recommend new and/or enhanced technologically, advanced products/services or system upgrades throughout the period of performance of the contract. NASA may also determine appropriate new and/or enhanced technologically, advanced products/services or system upgrades throughout the period of performance of the contract.

These technology refreshment products/services may be considered as either in-scope modifications or new task orders issued via BPA calls amongst one of the aforementioned Task Areas, accepted at the discretion of the NASA Technical Point of Contact and IT Management and implemented in collaboration with the vendor and other technical teams at the Office of the

CIO.