Amd 0002 Revised Attachment J-1 SOW.pdf

Solicitation 9594CS26R0004 – Amendment 0002 Revised Attachment J-1: Section C - Statement of Work

Public Safety Data Analytics Platform & Support Services C.1 Introduction.

C.1.1 The Court Services and Offender Supervision Agency (CSOSA), a federal, executive branch agency, created by Congress in 1997 to perform the offender supervision function for the District of Columbia. It does so in coordination with the Superior Court of the District of Columbia and the U.S.

Parole Commission. CSOSA's mission is to increase public safety, prevent crime, reduce recidivism, and support the fair administration of justice in close collaboration with the community.

C.1.2 The Office of Information Technology is responsible for providing information technology services to support the mission requirements of CSOSA. Organizational functions include a wide range of information technology products and services including the Agency’s case management system, other supporting applications, networking and telecommunication, management of operational technologies, software engineering, web technology, helpdesk, desktop support and information assurance/security.

C.2 Project Objectives. The project objectives are to:

C.2.1 Eliminate stove pipe data and enabling the effective use of all available data sources by integrating internal Case Management data with external law enforcement feeds in near real time.

This will enhance and bring efficiency to the operations of the Office of Community Supervision & Intervention Services (OCIS) staff in their daily duties ensuring access to timely factual data to the CSOs that will enable them to make informed decisions.

C.2.2 Enhance management’s capabilities to assess and monitor all operational activities, agency support components, and resources to improve management’s capability to make fully informed decisions on responding to the dynamic changes that evolve in the public, which requires the public safety, law enforcement community to instantly respond, and take action. These events directly impact performance, location, and how the Agency takes action in any given situation. These dynamic occurrences of events, situations, circumstances now require that management in is equipped with instant access to all available data at an enterprise level at any given time.

C.3 Project Management Plan (PMP). The Contractor shall provide a PMP to the Contracting Officer’s Representative (COR) within 60 days from date of contract award. The PMP shall detail the milestones for each deliverable, including but not limited to all tasks for completing:

• Deployment of a platform that meets all requirements outlined in this Statement of Work;

• Security Controls and System Security Plan (SSP);

• Data integration, validation from identified sources;

• Training Plan; and

• Developing work flows, publishing any templated reports, maps, dashboard. develop workflows, maps (graphical rendering of information), dashboards, analytics, and reports for use by CSOSA.

C.4 System Security Plan (SSP). No later than 75 days from contract award, the Contractor shall provide its existing SSP that explicitly defines the Authorization Boundary for the provided platform.

This boundary must encompass all hardware, software, interconnected APIs (Application Programming Interfaces), and storage components used to process, store, or transmit Agency data.

9594CS26R0004 – Amendment 0002

Public Safety Data Analytics Platform

C.5 Public Safety Data Analytics Platform Requirements. The Contractor shall provide a public safety data analytics platform that meets the following requirements:

C.5.1 A Software as a Service (SaaS) solution;

C.5.2 Listed on the FedRAMP Marketplace as FedRAMP Moderate Authorized to Operate (ATO) (at minimum) for the duration of the contract;

C.5.3 Compliant with:

C.5.3.1 National Institute of Standards and Technology (NIST) SP 800-53 (Rev Moderate Baseline as defined in NIST SP 800-53B;

C.5.3.2 Criminal Justice Information Services (CJIS) Security Policy v5.9 (or later);

C.5.3.4 Section 508 of the Rehabilitation Act of 1973; and

C.5.4 Functional Requirements.

C.5.4.1 Has dynamic data modeling capabilities and can store correlate and present data in various forms to include data, pictures, graphs, interactive maps and data reports and dashboards.

C.5.4.2 Has universal search capabilities, i.e., aggregates data from multiple, disparate sources and displays it in a single, unified interface. Sources include, but not limited to CSOSA’s current case management system (Supervision & Management Automated Record Tracking (SMART 21)) and CSOSA’s SharePoint Data Library, and external (other public safety partners) i.e., external systems with local public safety law enforcement partners, such as Metropolitan Police Department of the District of Columbia (MPD), Prince George’s County Police Department (PGPD), Alexandria Police Department (APD), and Fairfax County Police Department (FCPD).

C.5.4.3 Has secure collaboration functionality with granular access control.

C.5.4.4 Has the capability to allow surfacing the data dynamically in different formats.

C.5.4.5 Has real time alerting functionality.

C.5.4.6 Has the capability to present data with auditable deduplication and merge data from various sources.

C.5.4.7 Possesses the capability to conduct automated searches and generate reports without altering the original data sources.

C.5.4.8 Has Multi-Factor Authentication (MFA) capability, i.e., mandatory integration with agency Identity Providers (IdP) using SAML 2.0 or OIDC, requiring phishing-resistant MFA (like PIV/CAC cards or hardware tokens).

C.5.4.9 Has capability to fully function on Government mobile devices, specifically iOS devices and Android devices. The Government mobile device management solution is Microsoft Intune.

Public Safety Data Analytics Platform

C.5.4.10 Has continuous system operation, monitoring, and availability defined as:

• 24x7x365 automated monitoring of the solution and data environment including:

o Vulnerability Management, i.e., monthly vulnerability scans and remediation of

"High" vulnerabilities within 30 days and "Moderate" within 90 days;

o Incident Response, i.e., notification to the Agency and US-CERT in the event of a suspected security breach per section H.1.11.2;

o Annual Assessment, i.e., participation in an annual security assessment by a Third Party Assessment Organization to maintain the FedRAMP status.

• An availability level of 99.9%, excluding scheduled maintenance windows provided in advance to the COR.

C.5.5 Third-Party Dependencies. Any third-party Software-as-a-Service (SaaS) or managed service utilized by the Contractor to support the delivery of this platform (including but not limited to logging, monitoring, data visualization, or ticketing systems) that touches Agency data or metadata must reside inside the Authorization Boundary or hold an independent FedRAMP Moderate (or higher) Authorization.

C.5.6 Data Residency and Personnel.

C.5.6.1 All data, including metadata and backups, must reside within the continental United States in a GovCloud or equivalent CJIS-compliant data center.

C.5.6.2 The Authorization Boundary, including all primary and failover data centers, must reside strictly within the geographic United States (e.g., AWS GovCloud or Azure Government).

C.5.6.3 In accordance with 22 CFR § 120.15, all personnel with physical or logical access to the Authorization Boundary (including administrators, database architects, and developers) must be U.S.

Persons as defined by 22 CFR § 120.15.

C.5.6.4 Any Contractor personnel with a CSOSA clearance must work within CONUS.

C.6 Boundary Integrity. The Contractor shall ensure that no Agency data, including Criminal Justice Information (CJI) or Personally Identifiable Information (PII), is transmitted to or stored in any corporate system (e.g., corporate email, Slack, or unencrypted storage) that sits outside the defined Authorization Boundary.

C.7 On-Site Full-Time Technical Analyst.

C.7.1 The Contractor shall provide one on-site full-time equivalent (FTE) technical analyst for the period of performance identified in section C.20 below (i.e., 36 months from date of award). The on-site technical analyst shall:

Public Safety Data Analytics Platform

C.7.1.1 Perform a minimum of 1,920 productive hours during each 12-month period of performance for the life of the purchase order. Productive hours are defined as hours spent performing actual work on-site at CSOSA and explicitly exclude vendor employee paid time off (PTO), sick leave, and corporate holidays.

C.7.1.2 Shall be on-site at CSOSA Monday through Friday, 8 hours a day, excluding federal holidays.

C.7.1.3 Shall have a minimum of three years of experience in Criminal Justice Data Modeling.

C.7.2 The on-site technical analyst shall, at a minimum:

C.7.2.1 Integrate CSOSA’s current case management system (SMART 21) and CSOSA’s SharePoint Data Library into the platform.

C.7.2.2 Connects Government mobile devices, specifically iOS devices and Android devices, to the platform so that CSOSA personnel can use the platform via assigned mobile devices.

C.7.2.3 Develop workflows, maps (graphical rendering of information), dashboards, analytics, and reports for use by CSOSA; and

C.7.2.4 Configure an automated process for real-time alerting that identifies critical "matches" across live data streams and immediately notifies relevant personnel.

C.7.2.5 Integrate two external data sources (to be identified by the COR) in the platform once implementation of the platform is completed.

C.8 Public Safety Data Analytics Platform Maintenance. The Contractor shall provide maintenance for the duration of the contract to include:

C.8.1 Preventative Maintenance: Routine updates, security patching, and database optimization.

C.8.2 Corrective Maintenance: Bug fixes and resolution of system errors discovered post-deployment.

C.8.3 Adaptive Maintenance: Minor configuration changes to accommodate browser updates or OS updates on mobile devices (Android/iOS).

C.9 Public Safety Data Analytics Platform Support.

C.9.1 The Contractor shall provide 24x7x365 technical support, issue triage, troubleshooting, and issue response and resolution. 24x7x365 support must be provided by U.S.-based personnel.

Support shall be provided in accordance with the Contractor’s defined service level agreement.

C.9.2 The Contractor shall provide the COR with a monthly Support and Uptime Report detailing all tickets opened, the resolution time for each, and the overall system availability for the period.

Public Safety Data Analytics Platform

C.10 Training.

C.10.1 The Contractor shall provide a training plan to the COR with 30 days from contract award for three tiers of users: Administrators, Power Users (Analytic staff), and End Users. Specific training dates to be determined by the COR.

C.10.2 The Contractor shall provide on-site and virtual training for each above identified user tier as follows:

C.10.2.1 Administrator Training. For each 12-month period of this contract, the Contractor shall provide:

• One virtual (live instructor; not on-demand) training class (total three classes over 36 months) for up to five CSOSA personnel per class; and

• One on-site in-person training class (total three classes over 36 months) for up to five CSOSA personnel per class. On-site training is at a CSOSA facility (as determined by the COR) located in Washington, DC.

C.10.2.2 Power User Training. For each 12-month period of the term of this contract, the Contractor shall provide:

• Nine virtual (live instructor; not on-demand) training classes (total 27 classes over 36 months) for up to 20 CSOSA personnel per class; and

• Nine on-site in-person training classes (total 27 classes over 36 months) for up to 20 CSOSA personnel per class. On-site training is at a CSOSA facility (as determined by the COR) located in Washington, DC.

C.10.2.3 End User Training. For each 12-month period of the term of this contract, the Contractor shall provide:

• 13 virtual (live instructor; not on-demand) training classes during the first 12 months of the contract performance period for up to 30 CSOSA personnel per class; and

• Three virtual (live instructor; not on-demand) training classes for each the second and third 12-month periods of the contract (total 6 classes over 24 months) for up to 30 CSOSA personnel per class.

C.11 Technical Documentation.

C.11.1 The Contractor shall provide the following technical documentation:

C.11.1.1 System Architecture Diagram. A high-level view showing data flow from ingestion points to storage and the end-user interface.

Public Safety Data Analytics Platform

C.11.1.2 Interface Control Document (ICD). Detailed specifications for every "secure connector."

It must define data mapping (e.g., how "CAD Event Type" maps to "Analytics Incident Category") and API protocols.

C.11.1.3 Data Dictionary: A comprehensive guide defining every data element, its source, and any transformations applied during ingestion.

C.11.1.4 Administrator Guide. Instructions for managing users, configuring Role-Based Access Control (RBAC), and setting up automated data purge/retention scripts.

C.11.2 All technical documentation must be updated and resubmitted to CSOSA for review annually, whenever a significant “version update” occurs and/or when the two external data sources required by C.7.2.5 above are implemented

C.11.3 Technical Documentation Review.

C.11.3.1 Upon receipt of the above identified technical documentation, the COR will review and provide comments as follows:

• 10 business days for architect diagram;

• 15 business days for ICD;

• 10 business days for final data dictionary; and

• 5 business days for admin guide.

C.11.3.2 Any comments to any technical documentation submitted shall be addressed by the Contractor within 3 business days. The COR will review re-submitted technical documentation within 3 business days. This same process will continue until the COR accepts the technical documentation submitted.

C.12 Data Sources, User Base, Mobile Device Count, Data Ingestion Volume, API Call Volume, Concurrent User Load, Data Producers, and Data Consumers.

C.12.1 CSOSA’s current Case Management System (SMART 21) and SharePoint Data Library which consists of:

• SMART 21: Azure SQL Database (~75–99 GB), containing:

o Approximately 96,000 archived files; and o Approximately 10,000 active.

• CSOSA SharePoint Data Library: 151 SharePoint sites and corresponding libraries, including:

o Approximately 260,000 documents; and o Approximately 40,000 photo files.

Public Safety Data Analytics Platform

C.12.2 Data ingestion volume. Total growth per year is 42 GB for both CSOSA’s current case management (SMART) and for CSOSA’s data library combined.

C.12.3 User Base.

C.12.3.1 Users for this platform are as follows:

• Administrators – 2;

• Power Users – 25;

• End Users – 300;

• Data Producers – 1 (CSOSA’s current case management system); and

• Data Consumers – 300.

C.12.3.2 Concurrent user load is 225 users.

C.12.3 Mobile Device Count. Mobile device use is 300.

C.13 Data Rights and Ownership.

C.13.1 Agency Data Ownership.

C.13.1.1 All data provided by the Agency to the Contractor (“Agency Data”), and all customer-specific outputs created solely through the processing of Agency Data (including dashboards, reports, and data exports), shall remain the sole and exclusive property of the Agency.

The Contractor receives only a limited, non-exclusive license to use Agency Data strictly for the purpose of performing under this award.

C.13.1.2 Upon expiration, termination, or non-renewal of this contract, the Contractor shall provide the Agency with a complete export of Agency Data and customer-specific outputs in a machine-readable format and shall certify permanent deletion of Agency Data from Contractor systems.

C.13.2 Derived Data.

C.13.2.1 For the purposes of this award, “Derived Data” shall mean customer-specific outputs that are generated exclusively from Agency Data and are uniquely associated with Agency use (e.g., dashboards, reports, analytics visualizations). The Agency retains ownership of Derived Data.

C.13.2.2 Derived Data does not include platform-level analytics, system logic, machine learning models, algorithmic structures, software code, configuration templates of general applicability, platform know-how, usage telemetry, or aggregated and/or de-identified operational data that cannot identify CSOSA, Agency Data, or individuals.

Public Safety Data Analytics Platform

C.13.3 Contractor Intellectual Property.

C.13.3.1 The Contractor retains all rights, title, and interest in and to its pre-existing and independently developed:

• Software, platform, and service infrastructure;

• Algorithms, models, and model logic;

• Configurations of general applicability;

• Usage telemetry and operational metrics unrelated to Agency-specific data;

• De-identified, anonymized, or aggregated operational information that cannot identify

CSOSA, individuals, or Agency data.

C.13.3.2 Nothing in this section shall be construed to transfer or encumber the Contractor’s intellectual property rights, consistent with FAR Part 12.212 and customary commercial computer software licensing practices.

C.13.4 Restrictions on Use. The Contractor shall not use Agency Data or Derived Data to train external machine learning models, develop products for other customers, or for any purpose not expressly required to fulfill this award.

C.14 Restrictions on De-identification, Anonymization, and Aggregation.

C.14.1 The Contractor shall not de-identify, anonymize, or aggregate Agency Data or Derived Data for any purpose outside the scope of this award unless expressly authorized in writing by the Agency.

C.14.2 Any de-identified, anonymized, or aggregated data created from Agency Data or Derived Data shall be deemed Derived Data and shall remain the sole and exclusive property of the Agency.

C.14.3 The Contractor is strictly prohibited from selling, sharing, licensing, or commercializing any de-identified, anonymized, or aggregated data derived from Agency Data or Derived Data.

C.14.4 Any platform-level automated processes that utilize Agency Data or Derived Data for system-wide “product improvement,” machine learning, analytics optimization, or other Contractor purposes must be disabled by default and may only be activated upon the Agency’s express written election.

C.15 Right to Audit and Compliance Verification.

C.15.1 CSOSA, or its designated representative, reserves the right to conduct an audit of the Contractor’s data management practices, cloud environments, and internal processes to ensure compliance with data ownership and sovereignty requirements.

C.15.1.1 Audits may include reviews of data logs, deletion certificates, sub-processor agreements, and independent third-party audit reports (e.g., SOC 2, FedRAMP).

C.15.1.2 Audits may be conducted annually or upon 'for cause' suspicion of data mishandling.

The Contractor shall provide requested documentation within 10 business days of the audit request.

Public Safety Data Analytics Platform

C.15.1.3 If an audit reveals unauthorized data retention or usage, or storage outside of CONUS, the Contractor shall be liable for the costs of the audit and must immediately purge the unauthorized data, providing a notarized Statement of Destruction.

C.15.2 The Contractor shall ensure that all Agency data, including backups and metadata, resides exclusively on servers located within the Continental United States (CONUS).

C.16 Technical Requirements for Data Portability. The Contractor shall:

C.16.1 Utilize exclusively non-proprietary, industry-standard data schemas. The Contractor is prohibited from using proprietary formats or "data wrapping" techniques that prevent CSOSA from migrating data to a different platform, internal database, or successor service provider.

C.16.2 Provide full, unrestricted Application Programming Interface (API) access to allow CSOSA to pull both raw ingested data and processed analytical outputs in real-time.

C.16.3 CSOSA has reserves the right to download its data at any time during the contract term without additional “retrieval fees.”

C.16.4 Data must be exportable in machine-readable, non-proprietary formats (e.g., CSV, JSON, XML, and Apache Parquet) to ensure it can be migrated to any entity CSOSA determines appropriate (Government or private sector source).

C.16.5 Provide API Availability as follows:

C.16.5.1 Provide comprehensive, up-to-date API documentation (e.g., OpenAPI/Swagger specifications) and a Data Dictionary defining all exported fields and relationships.

C.16.5.2 Ensure the API supports high-volume, bulk data requests to allow for full system backups or migrations without performance degradation.

C.16.5.3 Utilize secure, industry-standard protocols (e.g., REST, HTTPS, OAuth 2.0) for all programmatic access.

C.16.5.4 Maintain API availability at a rate of no less than 99.9%, consistent with the primary platform's Service Level Agreement (SLA).

C.16.5.5 Provide at least 180 days' notice before making "breaking changes" to the API to ensure CSOSA's internal integrations do not fail.

C.17 Delivery of Data at End of Contract.

C.17.1 The Contractor shall ensure the orderly and secure transfer of all Agency data to CSOSA or its designated successor upon the expiration, termination, or non-renewal of this award.

C.17.2 Final Data Export. No later than 10 business days after the end of the period of performance, or termination, or non-renewal of this award, the Contractor shall deliver a complete and final export of all Agency data.

Public Safety Data Analytics Platform

C.17.2.1 The delivery shall include all Original Data, Derived Data, and Metadata in machine-readable, non-proprietary formats (e.g., CSV, JSON, and Apache Parquet).

C.17.2.2 The export must include all historical records, audit logs, and system-generated insights created during the life of the contract.

C.17.2.3 This final delivery shall be performed at no additional cost to the Government.

C.17.3 Data Integrity and Validation. To ensure the data is usable after transfer, no later than 10 business days after the end of period of performance, or termination, or non-renewal of this award the Contractor shall also provide:

• Checksums. Cryptographic hashes (e.g., SHA-256) for every file delivered to verify that no data was corrupted during the transfer; and

• Schema Map. A final, updated Data Dictionary that explains the relationships between all tables and fields within the export.

C.17.4 Verification Period. CSOSA shall have 15 calendar days to inspect and validate the data. If the data is found to be incomplete or corrupted, the Contractor shall rectify the delivery within 5 business days at no additional cost.

C.17.5 Certified Destruction (Sanitization).

C.17.5.1 Within 5 business days of written confirmation from the COR that the final data export has been successfully received and validated, the Contractor shall permanently delete all Agency data from all primary systems, backups, and staging environments.

C.17.5.2 Destruction must be performed in accordance with NIST SP 800-88 Revision 1, "Guidelines for Media Sanitization."

C.17.5.3 Within 10 calendar days of the purge, the Contractor shall provide the COR a notarized Certificate of Destruction signed by the Contractor’s Chief Information Security Officer (CISO).

C.18 Monthly Performance and Analytics Report. The Contractor shall provide a Monthly Performance Report to the COR no later than the 5th business day of each month. The report shall include, at a minimum:

• System Availability: Total system uptime percentage for the preceding month, including a log of any scheduled or unscheduled downtime.

• API Performance: Statistics on API availability, average response times, and a summary of any bulk data extractions performed by the Agency.

• Support Ticket Summary: A table of all support tickets opened during the month, categorized by Severity Level (1, 2, or 3), including time-to-triage and time-to-resolution.

• Data Residency Affirmation: A statement confirming that all data remained within the

Public Safety Data Analytics Platform approved CONUS authorization boundary and was accessed only by authorized U.S. Persons.

• Data Integrity Check: Results of automated monthly checksum validations to ensure no data corruption has occurred within the database.

C.19 Period of Performance. The total contract period of performance is 36 months from date of contract award. Specific due dates for deliverables and services are identified in section C.20 below.

C.20 Deliverables.

C.20.1 Table 1 below summarizes deliverables required by this Statement of Work.

C.20.2 Established due dates for deliverables shall be included in the Contractor's Project Management Plan. Any changes to the established due dates for any deliverables identified in Table 1 below shall be documented via a modification to the contract.

C.20.3 All deliverables are to be approved by the COR before any invoice for the deliverable is submitted.

Table 1: Deliverables Table Days listed in the table below are calendar days unless otherwise stated.

SOW

Section Deliverable Due Formats C.3 Project Management Plan (PMP) 60 days from contract award MS Project or

Excel C.4 System Security Plan 75 days from contract award PDF C.5 Public Safety Data Analytics Platform w/ all capabilities identified in C.5 Per due date identified by the COR/as included in the PMP

Web-based

C.7.2.1 Integrate CSOSA’s case management system (SMART

21) and CSOSA’s SharePoint Data Library into the platform; to be performed by the On-Site Full-Time Analyst required by section C.7

Per due date identified by the COR/as included in the PMP

Web-based

C.7.2.2 Connect Government mobile devices, specifically iOS devices and Android devices, to the platform so that CSOSA personnel can use the platform via assigned mobile devices; to be performed by the On-Site Full-Time Analyst required by section C.7

Per due date identified by the COR/as included in the PMP

C.7.2.3 Develop workflows, maps (graphical rendering of information), dashboards, analytics, and reports for use by CSOSA; to be performed by the On-Site Full-Time Analyst required by section C.7

Per due dates identified by the COR/as included in the PMP

Web-based or other format as determined by the COR

C.7.2.4 Configure real-time alerting; to be performed by the On- Site Full-Time Analyst required by section C.7

Per due date identified by the COR/as included in the PMP

Web-based

C.7.2.5 On-Site Full-Time Analyst to integrate of Two External Data Sources

Per due dates identified by the

COR

Web-based

C.8 Public Safety Data Analytics Platform Maintenance Upon platform activation cont’d thru end of contract.

Web-based

Public Safety Data Analytics Platform

C.9.1 Public Safety Data Analytics Platform Support Upon platform activation cont’d thru end of contract.

On-line and via phone

C.9.2 Monthly Support and Uptime Report Monthly Electronically C.10 Training for Administrators, Power Users (Analytic staff), and End Users Per due dates identified by the

COR.

Electronic training documentation

C.11.1.1 Technical Documentation: System Architecture Diagram At completion of integration of first data source and prior to platform implementation

PDF

C.11.1.2 Technical Documentation: Interface Control Document

(ICD)

At completion of integration of first data source

PDF

C.11.1.3 Technical Documentation: Data Dictionary At completion of integration of first data source and prior to platform implementation

PDF

C.11.1.4 Technical Documentation: Administrator Guide At completion of integration of first data source

PDF

C.11.2 Resubmission of technical documentation As required by C.11.2 PDF C.17.2 & C.17.3

Final Data Transition Package Within 10 business days of the end of contract

Encrypted Electronic Delivery

(CSV/JSON/P

arquet)

C.17.5 Certificate of Data Destruction Within 10 calendar days of the Contractor Agency date purge

Signed/ Notarized PDF

C.18 Monthly Performance Report 5th of every month thru contract period of performance identified in section C.19

Electronic (PDF or Dashboard Export)

C.21 Review, Approval, and Revision Process. All deliverables are subject to review and approval by the COR. The following review process applies unless otherwise agreed in writing by the COR:

C.21.1 The Contractor shall submit a draft of each deliverable to the COR by the due date identified in the PMP unless otherwise agreed to by the COR.

C.21.2. The COR shall provide the Contractor written comments within 7 business days of receipt of the draft deliverable.

C.21.3 The Contractor shall incorporate any received comments and submit a revised draft deliverable to the COR within 5 business days of receipt of any comments (or sooner if requested by the COR).

C.21.4 The COR shall provide the Contractor final approval/acceptance or additional comments within 7 business days of the revised draft. If additional comments are provided, the Contractor shall incorporate the comments and submit another revised draft deliverable to the COR within 5 business days of receipt of any comments (or sooner if requested by the COR). This process will be repeated until the COR provides final approval of the deliverable.