5 - Sources Sought Synopsis - Paper Storage.pdf

Sources Sought Synopsis 9523ZY-25-S-0001

Offsite Paper and E-Media Records Storage for the Commodity Futures Trading Commission (CFTC)

This is not a solicitation, but a survey to locate potential sources capable of performing the work described in this notice. The Commodity Futures Trading Commission (“CFTC” or “Commission”) is contemplating the procurement of services for the offsite storage, retrieval, and destruction of CFTC’s paper records and removable electronic media (collectively referred to as “records,” “CFTC information,” or “materials”), as discussed below.

CFTC is seeking to identify sources of vendors capable of providing services to store both paper records and electronic media. The contractor shall meet all requirements listed in Exhibit A – Work Requirements below.

Exhibit A – Work Requirements:

a. Phase-In Services The contractor shall provide Phase-In services that entail the storage of all records within the contractor’s facilities and a web-based application (see below) that is fully populated and available to CFTC within 45 days after contract award.

b. Storage and Compliance with NARA Regulations The contractor shall provide storage of unclassified records. The contractor shall maintain the ability to store records at facilities that are compliant with the National Archives and Records Administration (NARA) regulations for storage of federal records (see https://www.archives.gov/records-mgmt/storage-standards-toolkit?_ga=2.27328252.1993265957.1729880523-1600238582.1699028800). The retrieval and delivery requirements are described under section c, below.

The contractor shall protect CFTC information from authorized access, disclosure, and improper use and shall use industry standard administrative, technical, and physical security measures.

Such measures shall include, but not be limited to: restrictions on computer access to authorized individuals; required use of strong passwords by personnel; employee and contractor privacy and security training at least annually; regular review of security procedures and best practices to enhance security; and physical measures that effectively restrict building access to authorized individuals only.

c. Delivery Requirements Most of CFTC's retrieval and return requests originate in the Washington, DC office and are predominantly for records stored in the Washington, DC area. The Washington, DC office averaged (pre-pandemic) 30 deliveries/returns per year. The Chicago, New York, and Kansas City offices each averaged (pre-pandemic) seven (7) deliveries per year. Additionally, three times per year, the CFTC requests that records stored from one office be delivered to a different office. (e.g., records from Chicago are shipped to the Washington office).

https://www.archives.gov/records-mgmt/storage-standards-toolkit?_ga=2.27328252.1993265957.1729880523-1600238582.1699028800 https://www.archives.gov/records-mgmt/storage-standards-toolkit?_ga=2.27328252.1993265957.1729880523-1600238582.1699028800

Once requested by the Contracting Officer’s Representative (COR), the contractor shall retrieve and deliver containers from offsite storage to CFTC and pick up and return the retrieved containers to storage spaces. The Contractor shall deliver and pick up containers between the hours of 8:00 AM and 5:00 PM local time (i.e., CFTC facility time), Monday through Friday, except on government holidays, unless the COR makes special arrangements for delivery or pick up outside the stated times. For paper record storage, the storage facility shall be located within a four-hour drive of the CFTC facility they support to ensure prompt delivery of rush requests.

Delivery requirements for retrieval requests are provided below.

1. Standard delivery of paper records.

For same office records, (e.g., records stored in the Washington DC area delivered to the CFTC Washington DC office), CFTC requires the following delivery time frame: for retrieval requests placed before 2:00 PM local time on a business day, delivery shall be completed by 5:00 PM local time the next business day.

Requests for records of a different office, (e.g., records stored in Kansas City and delivered to the CFTC New York office), delivery for retrieval requests placed by 2:00 PM on a business day shall be completed within six business days.

2. Rush delivery of paper records.

CFTC estimates that it may have up to three “rush delivery” orders per year for all records storage locations.

For same office records, CFTC requires the following delivery time frame: for retrieval requests placed by 1:00 PM local time on a business day, delivery shall be completed within 4 hours of receipt of the retrieval request.

For requests for records of a different office, the delivery requirement shall be the same as for standard delivery. However, CFTC reserves the right to require faster delivery on a case-by-case basis.

3. Standard delivery of electronic media.

Retrieval and delivery timeframes shall be the same as those identified for paper records retrieval. For retrieval requests placed before 2:00 PM local time on a business day, delivery shall be completed by 5:00 PM local time the next business day.

4. Rush delivery of electronic media.

For “rush deliveries” to the same office and same storage location, orders placed by 1:00 PM local time on a business day shall have the delivery be completed within four (4) hours of receipt of the retrieval request. (However, CFTC does not anticipate any rush deliveries for electronic media.)

d. Third-party shipping tracking.

If at any time during the contract, the Contractor uses a third-party shipping carrier to transport records, the Contractor shall provide shipping documentation tracking information to the COR immediately upon availability. The Contractor shall remain responsible and liable to the CFTC for all actions taken by any third-party shipping Courier, including responsibility and liability for handling any incidents involving the loss, compromise, or unauthorized disclosure or access, real or potential CFTC information.

e. Destruction requirements.

For all destruction actions and approval of containers (paper and media) for destruction specified by the COR, the Contractor shall furnish a container level listing, including all associated descriptive information of all containers proposed for destruction within 10 business days of request from the COR. Destruction shall not occur unless authorized by the COR. The Contractor shall destroy the records within 30 business days after receiving approval from the COR. Within ten (10) business days after destruction occurs, the Contractor shall provide the COR a list of all containers that were destroyed and a certificate of destruction separate from the destruction invoice. All destruction shall be in accordance with industry standards and best practices in such a way that the records cannot be reassembled and information cannot be otherwise obtained from the records. All electronic media shall be destroyed in accordance with the guidelines set forth in NIST Special Publication 800-88.

f. Web-based application for records holdings information The Contractor shall furnish an auditable web-based application to enable CFTC to input, maintain, and modify information regarding all records, holdings, and off-site storage. The Contractor shall maintain industry standard security on the application, including access to the application through Secure Sockets Layer (SSL), Virtual Private Network (VPN), or other encrypted or similarly secure means. The application shall be 508-compliant with standard 36 CFR 1194.22., support Boolean searching, and enable the COR and other CFTC staff to generate reports about the holdings. Reports of the holdings shall include, at a minimum, destruction eligibility and forecasting, retrieval history, holding amounts, and cost projections. The Contractor shall provide Technical Support for the system to the COR or COR-authorized users including fielding technical questions about the system, assisting the COR in updating data in the system, and producing special reports from the system. Technical Support shall be provided by contractor staff located in the United States and familiar with Federal government storage and contracting regulations. The application shall allow CFTC to input and view the following information about each container in storage:

• Account number

• Organizational unit owning the container

• Container bar code number

• Records disposition schedule number

• Records title

• Records description

• Start date of records in the container

• End date of records in the container

• Date on which the electronic record is created

• Event date for purposes of calculating the records disposition period

• Identification of the records as permanent or whether the records retention period has not been defined

• Destruction date

• Long records description or open memo field to accommodate detailed descriptions

g. Damage to records or containers and rehousing

The Contractor shall rehouse CFTC materials if the container becomes damaged or unusable.

The Contractor shall contact the COR within 24 hours to notify CFTC of the need to rehouse the records or media. Should there be damage to any CFTC record material or media including, but not limited to, water damage or fracture from dropping, the Contractor shall contact the COR within 24 hours of the discovery of the incident.

For each incident within five business days after COR notification, the Contractor shall provide a report that, at a minimum, includes the container type, container number, a description of the damage resolution, and potential loss of record information.

h. Records security and protection

The Contractor shall ensure the confidentiality, protection, and integrity of records under its control. The Contractor shall also ensure that records under its control are not lost, accessed, released, or exposed without authorization from the CFTC.

i. Disaster recovery, incident response, and data breach

In the event of an incident involving the loss, compromise, or unauthorized disclosure or access, real or believed to have occurred, of CFTC information, whether in paper or held in electronic form under the control of the contractor:

1. The Contractor shall report any incident to the COR immediately but not later than one hour upon discovery of the incident to the COR. In the event the COR cannot be directly notified, the Contractor must notify the CFTC Alternate COR, or Records Management Officer at RecordsManagement@cftc.gov. To the extent possible, this initial report shall identify, but not be limited to, the information involved and circumstances surrounding the incident, including to whom, how, when, and where the CFTC information was placed at risk or compromised. Should an incident occur after normal business hours, the Contractor shall, at a minimum, send an e-mail and voicemail notice to the COR within one hour of the discovery of the incident. Further, the Contractor shall make every effort to contact the COR by telephone by the start of the next business day.

2. For each incident within five business days after COR notification, the Contractor shall provide a plan that documents the process and/or set of procedures it would use to recover and protect CFTC's records.

3. The Contractor shall cooperate with CFTC personnel in handling any investigation of the incident, notifying affected individuals in writing, and coordinating with any law enforcement authorities responsible for investigation and prosecution of any possible criminal law violations associated with any such incident. The Contractor shall further cooperate in mitigating risks of similar future incidents.

mailto:RecordsManagement@cftc.gov

4. The Contractor shall use its best efforts to further undertake the following actions: (i) As soon as possible after the incident, engage an independent company and/or independent group at the contractor to conduct a risk analysis, which the CFTC will participate in, if required, of the incident to determine the level of risk associated with the incident for the potential misuse of any CFTC information; (ii) Promptly upon the conclusion of such risk analysis, provide detailed findings of such independent company to the CFTC; (iii) If the CFTC determines, based upon the findings of the risk analysis, that a reasonable risk exists for the potential misuse of CFTC personally identifiable information involved in the incident, provide credit protection services for the affected individuals.

j. Transition of records and data to a successor contractor (phase out)

At the end of the contract and within two weeks of the COR request, the incumbent Contractor shall provide all documentation describing the CFTC’s electronic and paper holdings data in possession of and stored by the contractor in a format compatible for the successor contractor’s systems. The documentation shall be sufficient to enable the CFTC to electronically transition data about the CFTC’s holdings from the Contractor’s information system to a successor contractor’s information system. The Contractor shall work with the CFTC and/or the successor contractor to transfer the holdings data to the new contractor’s system. The Contractor shall certify in writing to CFTC that the holdings data transferred to the CFTC and and/or the successor Contractor is accurate and complete, and that it includes a description of the steps taken to ensure that the data was accurate and complete. After the holdings data has been successfully transferred to the successor contractor’s system, the Contractor shall delete CFTC’s holdings data from its systems and certify in writing the deletion and the steps taken to accomplish the deletion.

CFTC anticipates that the transition to a successor contractor will take not more than 150 days.

During this period, the Contractor shall transition data as described above and deliver the physical CFTC records as directed by the COR. Physical records transfers to a successor contractor shall be via contractor controlled and operated vehicles. The Contractor shall not use third-party shippers. All records shall be transferred by the incumbent Contractor and shall remain in incumbent Contractor control until the records are accepted by the successor contractor.

(End of Exhibit A)

(Rest of Page Intentionally Left Blank)

Information provided should demonstrate experience and capabilities relevant to the proposed requirements listed in Exhibit A, and should include:

1. A description of the vendor’s available services, including the extent to which it meets or exceeds the draft requirements in Exhibit A above.

2. A description of any experience providing similar services to federal government entities.

3. Identifying the extent to which your services are available in full on the GSA Federal

Supply Schedules (FSS) and other Governmentwide Acquisition Contracts (GWAC), such as NASA SEWP. (CFTC has a strong preference to conduct the subsequent procurement through the GSA FSS or a GWAC if possible.)

4. The approximate cost of the services (e.g., unit pricing) as well as ongoing services over a 5-year period.

CFTC encourages sources that can meet the requirements identified above to respond to this notice. Information furnished should include responses elaborating on the vendor’s services relevant to each applicable task in Exhibit A and a response of “not applicable” for requirements/capabilities that cannot be met by the vendor’s services.

This synopsis is for information and planning purposes, and responses should be no longer than 10 pages in length. The Government will not pay or otherwise reimburse respondents for information submitted. Based upon responses received, the Government reserves the right to set aside any and all procurements that may result hereunder for small businesses or the small business socioeconomic contracting programs (i.e., 8(a), HUBZone, SDVOSB, or WOSB programs). All responses are due by December 12, 2024 at 1:00 p.m. local (Washington, DC) time, and shall be submitted via email with a Subject Line stating “Response to Sources Sought 9523ZY-25-S-0001 Offsite Paper and E-Media Records Storage” to the Contracting Officer, Christine Han at chan@cftc.gov.

mailto:chan@cftc.gov