HC108420R0008 0002.docx

HC108420R0008

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

The following have been added by full text:

PWS 19 AUG 20

PERFORMANCE WORK STATEMENT (PWS)

June 19, 2020

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Contract Title. ELECTRONICALLY STORED INFORMATION DISCOVERY SOLUTION (eDiscovery)

3. Background.

The Department of Defense - Office of General Counsel (OGC) and Defense Legal Services Agency (DLSA)(collectively “DoD”) is procuring eDiscovery software, capabilities and/or support (hereinafter the “Proposed Solution”) to support OGC’s, DLSA’s, and their subcomponents (to include the Office of Military Commissions) legal practice. This practice includes, but is not limited to, the management of electronically stored information (ESI) disclosure and discovery for electronic discovery in litigation (e-discovery), investigations, Freedom of Information Act (FOIA) requests, and Congressional requests. ESI management should be analyzed through the conceptual multi-step framework of the Electronic Discovery Reference Model (EDRM), which identifies stages to govern, identify, preserve, collect, process, review, analyze, produce and present ESI.

4. Objectives:

The objective is to provide OGC with a user-friendly Federal Risk and Authorization Management Program (FEDRAMP) approved software as a service (“SaaS”) solution at Impact Levels-5 and 6 that meets the requirements in this document and has the required security controls and data protection functions to comply with all Federal and Department of Defense (DoD) requirements. The IL 5 (UNCLASSIFIED) instance of the application must be fully operational within 120 days of contract award and the IL 6 (SECRET) instance of the application must be fully operational within one year of contract award.

5. Scope.

The contractor shall provide an e-Discovery SaaS solution including but not limited to initial system design, configuration, cyber security, upgrades, maintenance, storage, hosting, testing, program management, training as required, and implementation support. Support services also include support for functional users, technical support resolving system issues, system administration and transition

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 30% in any year.

6. Performance Requirements.

6.1 Task 1 – SaaS e-Discovery Solution

6.1.1 Subtask 1 - Complete end-to-end eDiscovery SaaS Solution. Provide a total e-Discovery solution delivering data on demand, on-time, scalable, with the application running on a cloud infrastructure. The complete solution will include program management, program status, control and reporting and support services. The solution shall include functional user support, verify and monitor activity of the applications, including software and software configurations; verify user activity; perform closeout tasks and procedures; run reports, set parameters and document activity as directed by the COR. The contractor shall respond by phone, email, or chat to requests for information, for troubleshooting assistance or issues; assist in testing, maintaining, monitoring, and troubleshooting end user telecommunications, software, and devices. Overall Service Availability of the CSP’s infrastructure environment shall be a minimum availability of 99.900%, Service Availability.

From the start time that a service is unavailable to the time the service becomes available, consumers shall not be charged by the Contractor for the use of that service. The contractor shall provide all upgrades, updated cloud versions timely during non-busy times.

6.1.2 Subtask 2 – Support Services. The contractor shall provide support services including initial system security, configuration, customization and installation as needed for unclassified and classified environments, software upgrades, training as required, and implementation support. Support services also include support for functional users, technical support resolving system issues, and system administration. The contractor shall provide technical assistance to the Government in resolving any trouble tickets/problems associated with the SaaS offering. These problems may include but are not limited to SaaS errors that would hinder users from continuing work, and support related to production. The contractor shall monitor activities and deliverables under this award and provide a Monthly Performance and Progress Report (MPPR) that describes project progress and usage status. Monthly reports should include, at a minimum, the number of cases in the system, the amount of data per each case, whether the case is actively being worked by government staff, and the number of personnel logged into the system over the past month.

6.1.3 Subtask 3 – Training. The contractor shall provide training for each module or functional area of the system at where OGC personnel are located for an estimated 200 users. The contractor shall provide all completed training courses, user manuals, materials, documentation, courseware, concept papers, functional and technical reports, demonstrations, briefings, and other documents and materials to the COR on the 15th of the month for all activities for the previous month.

6.2 Task 2. System Capabilities and Service Requirements

6.2.1 Subtask 1 - eDiscovery Capabilities. The Proposed Solution shall comply with the technical requirements detailed below and as described in Attachment 1, Technical Requirements.

The solution shall:

1. Address the following phases of the Electronic Discovery Reference Model (EDRM), a conceptual multi-step framework of the ESI management process, which includes: (1) Information Governance; (2) Identification; (3) Preservation (4) Collection; (5) Processing; (6) Review; (7) Analysis; and (8) Production of ESI as described in this PWS and Attachment 1.

1. Permit electronic files processing of any ESI from supporting internal agency hardware and software or provided by third parties pursuant to industry standards.

1. Import ESI and other data from supporting external eDiscovery databases, to include any attorney review (tagging, foldering, etc.) conducted on those databases.

1. Provide DoD the capability to govern its ESI in litigation pursuant to industry standards in a SaaS model.

1. Manage various types of ESI from one central point accessible by web browser.

1. Allow for the establishment of ESI databases for each case or cases as necessary.

1. Provide DoD attorneys, Access Professionals, and others that require access in different locations access to each case or cases as necessary.

1. Provide DoD attorneys, Access Professionals, and administrative support access to all databases established in the Proposed Solution.

1. Provide the capability to add and remove cases as necessary.

1. Provide required subject matter expert points of contact (POCs) to assist DoD personnel with addressing technical and functional issues as necessary.

1. Provide all necessary updates, maintenance, and support to ensure adequate performance of the Proposed Solution.

1. Provide customer support and maintenance so that troubleshooting and errors can be resolved expeditiouslywithin 48 hours..

1. Provide training for all stakeholders as discussed in more detail in Attachment 1.

1. Provide for governance and storage of ESI that is collected or copied from native locations in compliance with federal laws including but not limited to the E-Government Act and the Privacy Act.

1. Provide routine (e.g. daily) system backups and disaster recovery of all data stored in the Proposed Solution. Maintain 4-hour Recovery Time Objective (RTO) and 24-hour Recovery Point Objective (RPO).

1. Support a minimum of 200 Named users and 100 concurrent users at various DoD locations, including attorneys, paralegals, or Access Professionals (not including any technical required users).

6.2.2 Subtask 2 - EDRM Requirements

The Proposed Solution shall assist DoD in the following phases of the Electronic Discovery Reference Model (EDRM): (1) Information Governance; (2) Identification; (3) Preservation; (4) Collection; (5) Processing; (6) Review; (7) Analysis; and (8) Production as described in this PWS and Attachment 1. The EDRM is a conceptual framework of the ESI management process.

The Proposed Solution shall enable electronic file processing of any ESI provided pursuant to industry standards. The Proposed Solution (and any supporting hardware and software), shall also be capable of importing ESI databases and associated attorney review data (e.g. tagging, foldering, comments, redactions) via load file. All EDRM capabilities referenced in this document shall comply with industry standard best practices.

6.2.3 Subtask 3 - Information Governance

Information Governance involves ordering and managing data from initial creation of ESI through its final disposition.

· Central Access - Manages various types of ESI from one central collection, processing, review and presentation point.

· Simultaneous Access - Allow for the establishment of a case or cases by multiple DoD offices simultaneously. Cases are accessible by users in various physical locations. Counsel and administrative support shall have access to all cases within the solution and the capability to add and remove cases, as needed.

· Scalable Access - DoD estimates 200 named users, including attorneys, paralegals, and support staff. The Proposed Solution shall be scalable to accommodate additional users as necessary.

· Maintenance & Support - Full maintenance support for all version updates and upgrades to ensure optimal performance with minimal down time. All customer support, training and maintenance shall be provided by solution provider.

· Federally Compliant - Provides data governance for ESI storage and collection migration that is compliant to federal laws such as the E-Government Act and Privacy Act.

6.2.4 Subtask 4 - Enterprise Secure Data Repository

· User Friendly - The solution shall be presented to DoD users in an intuitive and easy-to-use form leveraging existing infrastructure to the maximum extent possible. Additionally, an intuitive web-based user interface that leverages existing or simplistic method for user interactions and exchange is strongly preferred.

· Restrictive Role Based Access Control - Leverages access control lists that provides DoD with the capability to restrict data access to only need-to-know users.

· High Availability - Acts as an enterprise service offering to DoD OGC users, thus requiring high availability through redundancy and effective service restoration capabilities.

· Solution Accounting and Reporting - Provides the capability to gather file access accounting and audit report information (user access date and time, user IDs, action taken such as add, modify, and delete files) as it relates to a file while it is in the Proposed Solution.

· Definable Data Owner - Provides the ability to assign a data owner to each file to provide accountability and to provide users, administrators, and PII event responders with a point of contact that is ultimately responsible for an identified file.

· Group Based Encryption Authorization & Authentication - Provides the ability to store and share encrypted files that can be accessed by a group of users without sharing a password once encryption keys are added to the Proposed Solution. Bulk decryption capability within the Proposed Solution is desired.

· Logging - The solution shall record and store detailed system, security and application logs to report system and data availability, integrity, and confidentiality.

· Encrypted Data - All data stored on the Proposed Solution shall be encrypted in accordance with FIPS 140–2.

· Forensic Integrity - Provides forensic level integrity options for files moved into, out of, and stored by the solution. Forensic level integrity means metadata content is maintained for files moved into and out of the solution (e.g., date of file creation, date of last file access, user ID associated with last access, user assigned metadata tags, etc.).

6.2.5 Subtask 5 - Litigation Hold

Litigation holds involve notification of a preservation obligation and tracking of preservation compliance.

· Litigation Hold – Proposed Solution may allow OGC to create, issue, manage, and track litigation hold notices.

6.2.6 Subtask 6 - Preservation

Preservation involves ensuring that ESI is protected against inappropriate alteration or destruction.

· Metadata Preservation - Ensures that ESI is protected against inappropriate alteration or destruction to preserve attribution of source data. This includes preservation of evidentiary ESI metadata without loss or impact to source metadata throughout the entire ESIDD process, including any supporting methods of collecting, reviewing and producing documents that may affect metadata related to ESI that could result in the loss of evidence.

· Data Preservation - Allow ESI to be preserved in its application location is possible, protecting the ESI from deletion by any other source, as an intermediate step before a determination to copy/collect the ESI. If preservation at the source is not possible, the solution shall permit the ESI to be collected.

· Migration Preservation - Compatible and capable of identifying, preserving and collecting ESI after any data migration OGC intends to make in email or other applications, including movement to agency cloud service providers.

6.2.7 Subtask 7 - Collection

Collection involves gathering ESI for further use in the ESI management process (processing, review, etc.).

· OGC Collection - Capable of importing ESI and integrating with commonly used applications in OGC pursuant to the requirements in Attachment 1.

· Open Connectivity - Can connect and/or synchronize to external applications identified during the ESI management process.

· File Ingestion - Can also migrate and convert various types of documents, including but not limited to .adx files or text messages from various applications into the Proposed Solution.

· Multimedia Ingestion - Imports scanned image documents and other media, including CD, DVD, hard drive, or backup tape (with appropriate security protocols).

6.2.8 Subtask 8 - Processing

Processing involves reducing the volume of ESI and converting it, if necessary, to forms more suitable for review & analysis.

· Legacy Restoration - Converts legacy file formats and provides capabilities for restoration of data backups that map to source data point of origin.

· Compression & Conversion - Extracts compressed .zip files and embedded files and can convert various formats into industry standard file types including but not limited to tagged image file format (TIFF) or portable document format (PDF) files.

· Identification Options - During processing, users can easily identify the ESI needed for the matter. Upon identification, users are then provided options to convert native formats into more appropriate ones for later EDRM phases, including Optical Character Recognition (OCR) of image files.

· Data De-Duplication - Provides the capability to remove data duplicates via “de-duplication” of ESI across varied data types (e.g. an email saved natively vs. an email saved in Adobe). The solution shall allow for “near de-duplication,” which is the elimination of documents that are not exact duplicates, but are sufficiently similar.

· Auto-Coding Configurability - Provides both manual and auto-coding of documents.

When third parties, such as other Government agencies or opposing counsel, produce documents using electronic files, the solution shall receive and process those files and all associated metadata for user review.

· Internal Bates Stamps - Numbers documents using computer-generated sequential number labels for internal tracking purposes (also known as “Internal Bates Stamps”). The stamps shall be virtually affixed to the digital version of the document and/or referenced and tracked within the solution itself. The Internal Bates Stamps shall not affect the source metadata of a document; the original document shall always be retrievable in its original state.

· Auditability & Attribution - All processing work, and other alterations throughout the solution shall be traceable and reportable for chain of custody issues.

6.2.9 Subtask 9 - Review

Review involves evaluating ESI for relevance & privilege.

· Privilege Logs - Permits OGC attorneys and support staff to conduct searches of ESI and perform review for responsiveness and privilege. It also allows users to create Privilege Logs with information on any documents withheld for privilege.

· Annotation & Redaction - Provides capabilities to tag, code, redact and annotate documents, as necessary. Can convert ESI to appropriate formats for redaction while preserving those native formats and underlying metadata.

· Advanced Batching – Provides capability for Lead attorneys to assign “batches” of documents for review to other attorneys. The solution shall provide capabilities for advanced document analysis, including relevance ranking (determining how well a document matches a search), clustering (identifying like documents), discussion threading (e.g. assisting with determining related email threads), and filtering (searching documents by metadata to narrow ranges, such as dates and file types).

· Technology Assisted Review (TAR) – Proposed solution shall have robust TAR capabilities and provide the user the ability to set recall, precision, and F1.

· Portal for Non-OGC Users – Proposed Solution allows DoD users to grant access to non-DoD users to access the Proposed Solution via web-based portal for limited review of data on both the NIPR and SIPR platforms. Proposed Solution shall further allow DoD users to tailor role-based access for each non-DoD user to limit the cases available, functionality of the Proposed Solution for the non-DoD user (e.g., limiting the ability to print documents from the Proposed Solution), and to create reports for what the non-DoD user has done while logged into the Proposed Solution.

6.2.10 Subtask 10 - Analysis

Analysis involves evaluating ESI for content & context, including key patterns, topics, people & discussion.

· Content & Context -The solution’s search analysis functions and dashboard can cross evaluate and correlate ESI via content and context, including key patterns, topics, people, and their communications.

· Advanced Search Functions - Offers configurable functions for advanced keyword search, concept-based search, and linguistic pattern recognition capabilities.

· Analytics - Proposed solution shall allow user to leverage out of the box analytics to analyze documents and data sets.

6.2.11 Subtask 11 - Production

Production involves delivering ESI to others in appropriate forms and using appropriate delivery mechanisms.

· Exchange Formats - Permits the production of documents in their native format, near native format, image format, or as load files. Load files enable parties to easily exchange ESI across ESIDD platforms, including production of image, full text, metadata, and native files, as appropriate. Users can determine which type of metadata to include within productions.

· External Bates Stamps - The solution shall identify, process and create electronically numbered external identifiers (also known as “Internal Bates Stamps”).

· Secure Exchange Portal Protocol - the solution shall assist OGC stakeholders and end-users in establishing a protocol to provide outside parties with hard drive productions or alternative means of producing documents within a reasonable timeframe. The solution offers a private file transfer site to external parties with appropriate security protocols such as Secure File Transfer Protocol (SFTP).

6.2.12 Subtask 12 - Presentation

Presentation involves displaying ESI to elicit further information, validate existing facts or positions, or persuade an audience.

· Deposition Display - Assists attorneys with displaying ESI - especially in native and near-native forms - before audiences at depositions, hearings, trials, etc.

· Early Case Assessments - Assists attorneys with organizing and preparing exhibits for depositions and hearings using early case assessment (ECA) best practices.

6.3 – Task 3. Interface Requirements

6.3.1 Subtask 1 - The solution shall comply with the following requirements:

· Ability to export system, security and application logs to enable external reporting and security correlation.

· Ability to import ESIDD databases and associated attorney review data (e.g. tagging, foldering, comments, and redactions) conducted on those ESIDD databases to review ESI and other data.

· Ability to receive data from external databases in a manner preserves all original ESI content and any additional attorney work performed on those databases, to include:

· Redactions

· Productions received and made

· Foldering/organization performed in review and analysis.

6.4 –Task 4. Hosting Requirements and Security

6.4.1 Subtask 1 - Hosting Requirements

The contractor shall provide all required DoD RMF Security Control Artifacts necessary to achieve an Authorization to Operate (ATO), to include follow-on continuous monitoring activities. The e-Discovery solution shall be hosted in a cloud environment FedRAMP (HIGH) supporting unclassified at an Impact Level 5 and a classified Impact Level 6.

The solution shall comply with the following requirements:

· The Contractor shall provide all required integrated implementation environments for all applications included in the SaaS solution and ensure that all environments can be promoted to one another (development to test and test to production).The Contractor shall not host any portion of the environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

· Meet DOD and OGC PII and Privacy data protection requirements per DOD’s Cloud Computing Security Requirements Guide, CNSSI 1253, Appendix F, Attachment 6, “Privacy Overlay,” NIST SP 800–122 and OMB M–07–16.

http://iasecontent.disa.mil/cloud/Downloads/Cloud_Computing_SRG_v1r3.pdf (Minimum Level 5). Must comply with all current and future SRG/STIG version requirements.

6.4.2 Subtask 2 - System Security

The contractor shall support security certification and accreditation (C&A) requirements on new and existing components. C&A requirements may include but are not limited to: security, test and evaluation deficiencies; Risk Management Framework (RMF) compliance as detailed in Attachment 3, Risk Management Framework by Acquisition Phase, and as applicable; platform certification reviews; Computer Emergency Readiness Team (CERT) Tasking’s and Advisories; and migration related issues. The contractor shall participate in Information Assurance (IA) activities (e.g. investigation of incidents of unauthorized access/disclosure and security adjustments) and shall provide documentation, as necessary, to complete the remediation process. The contractor shall produce documentation in the system authorization process, as directed by the COR. The contractor shall develop or change provided products to be compliant with all appropriate Security Technical Information Guides (STIGs). The contractor shall ensure the rigorous application of information security/information assurance policies, principles and practices.

6.5 –Task. Cybersecurity Requirements

6.5.1 Subtask 1 - Cybersecurity

The following documents are mandatory for use. The Contractor shall provide Cybersecurity (CS) in accordance with all current policies, procedures, and statutes, to include (but not restricted to) the following as applicable to this contract:

· 44 U.S.C. § 3542, January 2012

· Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems, March 27, 2014, as amended (including Appendix F, Attachment 6, “Privacy Overlay”)

· Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004 Federal Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

· Federal Information Security Management Act of 2014 (P.L. 113-283, Title III), December 18, 2014.

· Department of Defense Instruction 5000.02, Operation of the Adaptive Acquisition Framework, January 23, 2020

· Department of Defense Instruction 5200.39, Critical Program Information (CPI) Identification and Protection within the Research, Development, Test, and Evaluation (RDT&E), Change 2 dated October 15, 2018

· Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems & Networks, Change 3 dated October 15, 2018

· Department of Defense Directive 8140.01, Cyberspace Workforce Management, Change 1 dated July 31, 2017

· Department of Defense Instruction 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS), Change 2 dated December 11, 2019

· Department of Defense Instruction, Cybersecurity, Change 1dated October 7, 2019

· Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology, Change 2 dated July 28, 2017

· Department of Defense 8570.01-M, Information Assurance Workforce Improvement Program, Change 4 dated October 11, 2015

· Department of Defense Instruction 8580.1, Information Assurance (IA) in the Defense Acquisition System, July 9, 2004

· DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle

· Defense Acquisition Guidebook (DAG)

· Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs)

· National Institute of Standards and Technology Special Publication 800-30 Rev 1, Guide for Conducting Risk Assessments, September 2012

· National Institute of Standards and Technology Special Publication 800-37, Revision 2, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, December 2018

· National Institute of Standards and Technology Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View, March 2011

· National Institute of Standards and Technology Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 2015

6.5.2 Subtask 2 - Cybersecurity Strength Requirements

· The contractor shall adhere to all existing authorities and policies of the Director of National Intelligence regarding the protection of classified information as directed by Executive Order 12333 and other laws and DoD regulations. Requirements governing classified are detailed in Attachment 2.

· The contractor shall satisfy the RMF requirements of the Federal Information Security Management Act (FISMA) Act of 2014

· The contractor shall enable OGC to meet or exceed the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.

· FIPS 199 / CNSSI 1253 Security Categorization: The contractor shall in coordination with the prescribed System Owner (SO) and Authorizing Official (AO) support security categorization IAW FIPS 199 and CNSSI 1253 of the information system and document the results of the security categorization in the security plan. The contractor shall participate in categorization discussions with OGC, SO / User Representative and the ISSM as requested to support security categorization.

· The contractor shall ensure that a written subsection of the security plan covers FIPS 199 / CNSSI 1253 Security Categorization and Threat Assessment. OGC and or the SO will provide a C-I-A concurrence memorandum from the SO’s respective AO agreeing with their determination of controls (Confidentiality, Integrity, and Availability with any overlays and tailoring).

6.5.3 Subtask 3 - Cybersecurity Assurance Requirements

· The Contractor shall design, develop, and integrate Cyber Security (CS) solutions supporting the Department of Defense and all other applicable Government agencies. This will be achieved through abiding by all applicable CS regulations and directives to ensure a favorable Assessment and Authorization (A&A) decision (an Authority to Operate (ATO)), as well as obtaining an Authority to Connect (ATC) to all requisite Government networks as required per specific task requirements. The contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the OGC Authorizing Official.

· Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

· All information systems shall be considered to be high-high-high moderate-moderate-low(Confidentiality-Integrity-Availability) for the System Security Plan (SSP) unless otherwise notified in writing. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations.”

6.5.4 Subtask 4 - System Network Requirements

All network components and applications shall be FEDRAMP+ compliant.

· Heartbeat Signals - The contractor shall identify heartbeat signals or protocols and recommend whether any should be included in network monitoring. The contractor shall provide packet definitions of the heartbeat signals and examples of the heartbeat traffic if the signals are included in the network monitoring.

· Disabling, Removing, or Modifying Well-Known or Guest Accounts - The Contractor shall recommend which accounts need to be active and those that can be disabled, removed, or modified. The OGC Contracting Officer (CO), Program Manager (PM), or Contracting Officer’s Technical Representative (COTR) shall approve in writing the contractor’s recommendation. The Contractor shall disable, remove, or modify all the accounts pursuant to the approved recommendation. The contractor shall disable or remove all default and guest accounts prior to the functional acceptance testing (FAT). Once changed, new accounts will not be published except that new account information and passwords will be provided by the contractor via protected media. At delivery, the contractor shall disable, remove, or modify all contractor-owned accounts or negotiate account ownership with the OGC KO, PM and COTR. Contractor updates shall not re-enable or re-install any of these accounts.

· Session Management - The contractor shall not permit user credentials to be transmitted in clear text. Encryption shall at a minimum meet AES 256 and comply with FIPS 140-2. If this is not technically feasible, the contractor shall provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The contractor shall not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins. The contractor shall provide user account-based logout and timeout settings.

· Password/Authentication Policy and Management. The Contractor shall implement two-factor authentication using DoD Common Access Card where technically feasible. The Contractor shall not store passwords electronically or in Contractor-supplied hardcopy documentation in clear text unless the media is physically protected.

· End Devices. The Contractor shall provide physical and cyber security features for end devices (i.e. the source or destination of network traffic) including, but not limited to, authentication, encryption, access control, event and communication logging, monitoring, and alarming to protect the device and configuration computer from unauthorized modification or use. The Contractor shall clearly identify the physical and cyber security features and provide the methodology (ies) for maintaining the features including the methods to change settings from the Contractor-configured or manufacturer default conditions. The Contractor shall verify that the addition of security features does not adversely affect connectivity, latency, bandwidth, response time, and throughput. The Contractor shall remove or disable all software components that are not required for the operation and maintenance of the SaaS. The Contractor shall provide, within a pre-negotiated period, appropriate software and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of system security.

7. Performance Standards.

Calculation:

Outages reported

8. Incentives.

None

9. Place of Performance.

The place of performance is at the contractor’s site.

10. Period of Performance.

The PoP is a base year from date of award and four one-year options. The POP is estimated to begin September 2020.

11. Security Requirements.

The contractor shall comply with all applicable security regulations. The contractor shall not disclose and shall safeguard procurement sensitive information, computer systems and data, Privacy Act data, and Government work products that are obtained or generated in the performance of this contract. This includes dissemination of protocols and papers not generally available through the public literature.

Contractor personnel shall abide by DOD security policies and procedures as part of the daily interface with the Program Management Office and applications. The contractor shall not divulge any information about files, data, processing activities or functions, user IDs, passwords, or other knowledge that may be gained, to anyone who is not authorized access to such information. The contractor shall adhere to cybersecurity policies and procedures as defined in DOD directives, instructions, and regulations. The contractor shall sign a nondisclosure agreement furnished by the COR immediately following contract award.

Contractor personnel shall abide by applicable office rules, procedures, and standards of conduct. All contractor personnel shall have a satisfactory background investigation completed before they are allowed to access the networks on which applications reside. The contractor shall initiate all requests for background investigations when requested by the COR.

In performance of this contract, the Contractor may have access to DoD information. The Contractor agrees (a) to use and protect such information from unauthorized disclosure IAW DoD Instruction 8582.01: Security of Unclassified DoD Information on Non-DoD Information Systems; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal, commercial or other purpose; (c) to comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, proprietary, critical program information (CPI), personally identifiable information, export controlled); (d) to obtain permission of the government Requiring Activity before disclosing/discussing such information with a third party; (e) to return and /or electronically purge, upon government request, any DoD information no longer required for Contractor performance; and (f) to advise the Contracting Officer and/or Contracting Officer’s Representative of any unauthorized release of such information.

12. Delivery Schedule

13. Other Pertinent Information or Special Considerations.

a. Identification of Potential Conflicts of Interest (COI). Identify any situation that may influence which contractor should be awarded the contract/TO. Organizational COI is a situation where because of other relationships or activities a person (company) is unable or potentially unable to render impartial assistance or advice to the Government or cannot objectively perform contract work or has an unfair competitive advantage. FAR 9.502 states that “an organization COI may result when factors create an actual or potential conflict of interest on an instant contract, or when the nature of the work to be performed on the instant contract creates an actual or potential COI on a future acquisition.” An organizational COI exists when the nature of the work to be performed may, without some restriction on future activities, (1) result in an unfair competitive advantage to the contractor on other contracts or (2) impair the contractor’s objectivity in performing the contract work.

b. Identification of Non-Disclosure Requirements.

(All Contractors must execute a provided contractor non-disclosure agreement (NDA) for all services contracts regardless of award amount. The NDA must be signed within one week of contract/TO award. The DISA contractor is responsible for obtaining and maintaining NDAs for each contractor employee assigned to the contract/TO. The NDA will be attached to the PWS. Attached is a copy of the NDA for your convenience. The NDA is inserted here so it won’t get missed, but recommend it be included as an attachment to the PWS.)

Deliverables: Monthly Status Report (The contractor is responsible for identifying that all personnel, to include any new personnel on the contract, have executed the NDA and the NDA is current as of the date of the monthly status report. Monthly status reports shall be sent to the KOs and CORs.)

c. Packaging, Packing and Shipping Instructions. None

d. Inspection and Acceptance Criteria. The contractor shall provide a SaaS offering and Acceptance will be upon delivering a working solution per the PWS.

e. Property Accountability. None

f. Supply Chain Risk Management

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of theFY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.

The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract.

Control Number

*Not required if there will be no procurement of hardware, firmware, or software systems.

DELIVERABLES:

SUPPLY CHAIN RISK MANAGEMENT PLAN UPDATE: The contractor shall provide an updated SCRM Plan to the COR and Program Manager within five (5) business days whenever there is a change that affects one or more security controls as described in the Committee on National Security Systems Instructions (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)). At a minimum, the following events will require a SCRM Update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and Information and Communications Technology (ICT) supply chain compromises.

14. Section 508 Accessibility Standards. The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards

|_| 1194.21 - Software Applications and Operating Systems |X| 1194.22 - Web Based Intranet and Internet Information and Applications |_| 1194.23 - Telecommunications Products |_| 1194.24 - Video and Multimedia Products |_| 1194.25 - Self-Contained, Closed Products |_| 1194.26 - Desktop and Portable Computers |_| 1194.41 - Information, Documentation and Support

The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the Offerors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

Functional Performance Criteria

|_| 1194.31 - Functional Performance Criteria

Attachment 1 – eDiscovery Technical Requirements

Attachment 2 – Executive Order 12333

Attachment 3 – Risk Management Framework by Acquisition Phase

52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (AUG 2020)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in the provision at 52.204-26, Covered Telecommunications Equipment or Services--Representation, or in paragraph (v) of the provision at 52.212-3, Offeror Representations and Certifications-Commercial Items.

(a) Definitions. As used in this provision-

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services."

(d) Representations. The Offeror represents that--

(1) It [ ] will, [ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that--

It [ ] does, [ ] does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

(e) Disclosures.

(1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded "does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment…