A.02.12 eDiscovery Cloud SaaS.pdf

eDiscovery Software Solution

CORPS OF ENGINEERS AUTOMATED LEGAL SYSTEM (CEALS)

Supply Requirement

1. Overview:

The Corps of Engineers Automated Legal System (CEALS) is an AIS system that provides comprehensive tools that help attorneys organize, develop, and present evidence throughout the course of litigation, from pre-filing investigation, through complaint, discovery, and trial, through post-trial briefs and the appeals process.

The purpose of this contract is to acquire a Single Award Task Order Contract (SATOC) for a cloud-based eDiscovery Software as a Solution (SaaS) for a web-based eDiscovery platform that has the Defense Information Systems Agency (DISA) authorization to operate with IL4, IL5, and IL6 environments. The eDiscovery solution must be compatible with the Pinpoint Labs Harvester 1.0, EnCase Forensics Collection Examiner (EnCase), or have the capability to perform collections. Contractor will provide incidental administrative, logistical, professional, or technical support necessary to develop an environment, upon execution of a task order, that enables USACE to perform a review of electronic data gathered utilizing Harvester 1.0, EnCase, or similar document collection software. This eDiscovery SaaS solution will be a resource available to approximately 725 attorneys and non-attorneys enterprise-wide within USACE to assist in the review of Electronic Discovery (eDiscovery) and the handling of electronically stored information (ESI) in USACE litigation including federal court cases, Contract Dispute Act (CDA) cases before the Court of Federal Claims (COFC) and the Armed Services Board of Contract Appeals (ASBCA), Freedom of Information Act (FOIA), and administrative actions such as Merit Systems Protection Board/personnel/Equal Employment Opportunity matters, and GAO bid protests.

The Contractor shall provide licensing for each Task Order ensuring sufficient space is provided to support the technical requirements established under the Task Order. The proposed SaaS solution is subject to review by USACE IT for compatibility and authorization to operate within the CorpsNet boundary.

1.1 Period of Performance

The overall contract performance shall be 1 year from the date of contract award plus 4 option years.

1.2 Security Requirements

All personnel requiring access to the Army facilities and network shall complete AT Level 1 awareness training within 30 calendar days after the contract start date or effective date of incorporation of this requirement into the contract whichever is applicable.

All contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks or background investigation and to meet installation/facility access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any installation or facility change, the Government may require changes in contractor security matters or processes.

All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance or access privileges, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

The Contractor must pre-screen Candidates using the E-verify Program (http://www.uscis.gov/e-verify) website to meet the established employment eligibility requirements. The Vendor must ensure that the Candidate has two valid forms of Government issued identification prior to enrollment to ensure the correct information is entered into the E-verify system. An initial list of verified/eligible Candidates must be provided to the COR no later than 3 business days after the initial contract award.

All contractor employees who require physical access to government-controlled facilities or logical access to government information and or information systems are subject to a fitness determination and appropriate vetting. To assist in the vetting process, the contractor must submit a notice of visit form for each employee who will perform work on the contract, including at the minimum, the name, social security number and date of birth of each employee performing work on the contract that need physical and or logical access.

Contracts requiring handling or access to classified information: The prime Contractor shall have a Facility Clearance (FCL) at the appropriate level prior to performance on the contract; the RA will sponsor the prime contract company in obtaining the FCL. All cleared contract personnel shall comply with the FCL requirements, as well as applicable laws and regulations regarding contractor access to national security information. For classified contracts, the RA will generate the DD Form 254, which will be attached to the contract.

Documents containing personally identifiable information may only be submitted via encrypted email, by first class mail or it may be hand carried to the security office. Notice of visits must be submitted through the government contracting officer representative (COR) or technical representative who will deliver them to the security office. All notice of visits must be received three business days in advance of the contractor reporting for work. The contractor will work through the COR or technical representative for the contract who will serve as the liaison between the security office and the contractor. Contractor employees who are not sponsored by a government employee will not be granted access to any facilities under HECSA control nor will HECSA security approve logical access to information systems if a notice of visit containing either the DOD ID number or the social security number is not provided to the security office.

Contractor personnel who do not require a common access card may be granted physical access based on favorable results of an NCIC III records check. HECSA Security will initiate all NACI investigations. Contractors who require access to classified information must be performing work on a classified contract and the contract company is responsible for initiating all required investigations for the appropriate security clearance. If an employee has been the subject of a previous favorably adjudicated investigation, it may be reciprocally accepted if there has not been a two year break in service and there is no presence of new and potentially unfavorable information that casts doubt about the subject’s suitability. When a background check is reciprocally accepted but is more than 5 years old, the security office may initiate an NCIC III check to ensure no new unfavorable information exists.

1.3 Privacy Act

Work under this contract may require personnel to have access to Privacy Information.

Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

1.4 Disclosure of Information

Information made available to the contractor by the Government for the performance or administration of this contract shall be used only for those purposes and shall not be used in any other way without the written agreement of the Contracting Officer (CO). The contractor shall assume responsibility for protecting the confidentiality of Government records, which are not public information.

2. E-Discovery Software as a Solution Requirements:

a. CEALS requires an eDiscovery SaaS that has DISA Risk Management Executive (RME) cybersecurity accreditation and Authorization to Operate (ATO) on NIPRNet at FedRAMP IL4, on an authorized “.mil” website, at the time of award.

b. CEALS requires an eDiscovery SaaS that has DISA Risk Management Executive (RME) cybersecurity accreditation and Authorization to Operate (ATO) on NIPRNet at FedRAMP IL5, on an authorized “.mil” website, at the time of award.

c. CEALS requires an eDiscovery SaaS that has DISA Risk Management Executive (RME) cybersecurity accreditation and Authorization to Operate (ATO) on SIPRNet at FedRAMP IL6, on an authorized “.scloud” or “.smil.mil” website, at the time of award.

d. CEALS requires that the eDiscovery SaaS be able to share unclassified data generated from its IL4 eDiscovery SaaS on a secure “.com” website or portal that is accessible by non-DoD users that exist outside of the CorpsNet (e.g., granting access to U.S.

Department of Justice).

e. CEALS requires that the eDiscovery SaaS be able to share unclassified data generated from its IL5 eDiscovery SaaS on a secure “.com” website or portal that is accessible by non-DoD users that exist outside of the CorpsNet (e.g., granting access to U.S.

Department of Justice).

f. The eDiscovery SaaS shall include a desktop client capable of supporting cyber forensics in the collection of data in a forensically sound manner. The desktop client must preserve metadata integrity, maintain chain of custody, and enable secure, auditable collections without altering the source data.

g. The eDiscovery SaaS shall be capable of conducting electronic bate-stamping, filtering, extracting metadata, creating full text, adding watermarks, and perform optical character recognition (OCR).

h. The eDiscovery SaaS shall have the ability to process text, metadata, images, and binary data.

i. The eDiscovery SaaS supports integration with a matter management system, case management system or litigation case management system via Application Programming Interfaces (APIs). This functionality allows administrators to programmatically track matters, access cases for review, coordination, and production. API use will facilitate automated tracking and management improving workflow and time management.

j. The eDiscovery SaaS supports integration with an API, middleware, or plug-in redaction tool to perform advanced redaction of audio or video.

k. The eDiscovery SaaS shall have the capability to extract data from hard drives, flash memory, smartphones, file shares, Lotus Notes, Microsoft Exchange, Microsoft SharePoint and common forensic images and common programs such as Microsoft Office products, Corel WordPerfect Office Suite and similar commonly used programs.

l. The eDiscovery SaaS shall have the capability to import load files following standard practice formats like images, native, Tag Image File Format (TIFF), Portable Document Format (PDF) or text, along with the metadata load files such DAT, CSV, TXT, OPT (Opticon), L01, or Load File Page (LFP).

m. The eDiscovery SaaS shall have the capability to create load files for exporting products following standard practice formats like images, native, Tag Image File Format (TIFF), Portable Document Format (PDF) or text, along with the metadata load files such DAT, CSV, TXT, OPT (Opticon), L01, or Load File Page (LFP).

n. The capability to allow the user to download production to a location identified by the end user, e.g., external hard drive, local desktop, or ZIP file format.

o. The eDiscovery SaaS shall have the capability to create customizable tags, folders, data fields for organizing document review, analysis, and production.

p. The eDiscovery SaaS shall have the capability to create customizable workflows to allow users to tailor the data ingestion, review, analysis, and production processes to fit specific organizational needs, e.g., FOIA or Administrative Records (Administrative Procedures Act).

q. The eDiscovery SaaS shall have the capability to group related documents and commonly used phrases.

r. The eDiscovery SaaS shall have the capability to predicatively and automatically classify, and tag records based on statistical analysis.

s. The eDiscovery SaaS shall have the capability to highlight or color code terms such keywords, search criteria, or names.

t. The eDiscovery SaaS shall include a native, built-in deduplication capability that supports custodian-level deduplication (within individual custodian) and global deduplication (across all custodians).

u. The eDiscovery SaaS shall support near-duplicate detection using content similarity algorithms to identify records with minor variations in formatting, metadata, or wording that may not be exact duplicates but are substantially similar.

v. The eDiscovery SaaS shall have Technology-Assisted Review 1.0 (TAR 1.0) capability, which is a supervised machine learning that uses a training or batch set of documents coded by attorneys or paraprofessionals to create a predictive text model. This model is then applied to the larger set of documents for categorizing them as responsive or not.

w. The eDiscovery SaaS shall also have Technology-Assisted Review 2.0 (TAR 2.0) capability, which relies on continuous active learning where the model is updated on a continuous basis.

x. The eDiscovery SaaS shall have the capability to perform email thread analysis and allow for reconstruct email conversations from multiple sources so USACE can review the email thread in the order sent between individuals.

y. The eDiscovery SaaS shall allow users to create custom saved searches and reuse the criteria on a different case or matter.

z. The eDiscovery SaaS shall have the following capability:

i. Proximity visualization – shows how keywords appear in relation to surrounding words or phrases.

ii. Contextual previews – allows users to see expanded text windows without opening the full document.

iii. Conceptual and relational clustering – Groups documents with similar contextual patterns, enhancing efficient document prioritization.

aa. The eDiscovery SaaS shall have the capability to perform concept-based searches in addition to keyword searches. The concept searching must allow users to identify documents that are contextually similar to a search term or phrase, even if the exact keywords are not present.

bb. The eDiscovery SaaS capability to have 350 concurrent users logged into the SaaS environment.

cc. The eDiscovery SaaS shall have the capability to manage, issue, and track litigation holds issued to record custodians within the USACE domain (@usace.army.mil), or outside of the USACE domain, e.g., navy.mil, gmail.com, or yahoo.com, etc.

dd. The eDiscovery SaaS shall provide the capability to automatically detect and exclude predefined text blocks, phrases, or patterns from the indexing process based on configurable exclusion rules, e.g., signature block.

ee. The eDiscovery SaaS shall have the persistent highlighting capability where specific keywords, phrases, or patterns are automatically highlighted throughout the document review process. These highlights remain visible across the entire dataset unless the user turns them off.

ff. The eDiscovery SaaS shall have the capability to ingest and play audio files, such as:

.WAV, MP3, or MP4.

gg. The eDiscovery SaaS shall support configurable access controls that allow case-specific access to be granted at both the individual user and user group levels.

hh. The eDiscovery SaaS shall include a variety of reports and system-generated logs that document each phase of the eDiscovery process, including collection, processing, review, and production. These reports and logs must support the defensibility by providing detailed tracking of actions taken, user activity, exceptions, chain of custody, deduplication determinations, privilege logs, and production outputs. The software solution must allow for the creation of audit-ready documentation demonstrating the integrity and reliability of the eDiscovery process.

ii. The eDiscovery SaaS shall support native file redaction or workflows that preserve native functionality, e.g., MS Excel.

jj. The eDiscovery SaaS shall address inlined images:

i. Capability to view images originally intended to be viewed inline such as logos found in a signature block will be displayed inlined in PDFs or TIFFs;

ii. Capability to inline all images in emails;

iii. Capability to extract all images found in emails.

kk. Online training:

i. Database and case administrator module training

ii. Reviewer module training

iii. Litigation/Legal Hold module

3. Performance Tasks

3.1 E-Discovery Software Solution Technical Support

The Contractor shall provide a hot line technical support number for the purpose of providing user assistance and guidance in the implementation of the e-Discovery software solution. The technical support number should be available from 9:00 a.m. ET to 9:00 p.m. ET.

3.2 Software Installation

The Contractor shall provide USACE IT with the support to install the e-discovery software solution within a cloud environment.

3.3 Software Licensing

The Contractor will provide a perpetual license that supports 125 concurrent users or a total of 600 individual licenses.

3.4 Software Maintenance

The Contractor will provide all updates for the licensed software that it releases during the term of this contract to the licensee. Such updates shall not, however, include any new releases of the licensed software that substantially changes the format or functionality of the licensed software.

The Contractor shall correct the software to the extent necessary to correct bug/defects attributable to the software which materially affects the use of the Software. Upon receipt of written notice of the problem, the Contractor shall use its best efforts to correct the bug/defect, or provide the licensee with a way to temporarily work around the bug/defect problem if able to do so.

The Contractor shall use reasonable efforts on a time available basis to correct non-critical problems, but the correction of problems that are non-critical may await the release of updates.

The Contractor shall provide telephone support during business hours of 9:00 a.m. ET to 9:00 p.m. ET for the reporting of problems and for handling customer questions relating to the operation of the licensed software.

3.5 Training

The Contractor will provide eDiscovery online webinars focusing on database management, reviewer-based training, and litigation/legal hold training.

4. System Requirements

a. Contractor will coordinate with USACE G-6 System Engineer.

5. Government Furnished Equipment

Not Applicable

5.1 Travel

6. Security Requirements – Required Clauses

Information Assurance (IA)/Information Technology (IT) requirements: All contract personnel performing IA/IT services must comply with DoD training and certification requirements specified in DoD 8570.01-M, Information Assurance Workforce Improvement Program, and maintain required background investigations specified in RA policy. Contract personnel shall provide the Government representative with documentation of certification(s) prior to performing on the contract. In accordance with applicable DoD, Army, and USACE regulations, the Contractor shall ensure that all information systems (IS) and platform information technology (PIT) systems developed and/or supported under this contract comply with cybersecurity and architectural requirements, including, but not limited to: security technical implementation guides (STIG)(e.g., the current version of the Application Security and Development STIG, and the internet access point (IAP) demilitarized zone (DMZ) STIG), and the use of security controls developed under the risk management framework documentation for the system or platform. The Contractor shall address questions regarding these provisions to the Government representative, who will coordinate between the Contractor and the USACE Chief Information Officer (CIO).

Contracts requiring handling or access to classified information: The prime Contractor shall have a Facility Clearance (FCL) at the appropriate level prior to performance on the contract; the RA will sponsor the prime contract company in obtaining the FCL. All cleared contract personnel shall comply with the FCL requirements, as well as applicable laws and regulations regarding contractor access to national security information. For classified contracts, the RA will generate the DD Form 254, which will be attached to the contract.

7. Contractor Manpower Reporting Application (CMRA) Requirement

This contract has not been reported in CMRA, because it is Civil Works funded and is exempt from CMRA reporting.

7. Contractor Data Requirements List (CDRL) and Data Item Description (DID)

8. Place of Performance

The place of delivery of this software solution package will either be at the U.S. Army Corps of Engineers Headquarters, 441 G Street NW, Washington, DC 20314, or other location identified by USACE to include the Contractor’s place of business.

9. Technical Point of Contact

LSCoP Technical POC:

William G. Pumyea CEALS Program Manager Office of the Chief Counsel Headquarters, U.S. Army Corps of Engineers 696 Virginia Road Concord, MA 01742

(978) 318-8450 william.g.pumyea@usace.army.mil

USACE-IT Technical POC:

TBD