A041714 JAGC eDiscovery Software-as-a-Service Solution PWS.pdf

PDF 367 KB Posted Sep 17, 2024

Attached to: JAGC eDiscovery Software-as-a-Service Solution
Solicitation number: A04171
Issued by: Department of the Air Force Headquarters District Washington

About this file

Written by GovTribe AI · Sep 17, 2024

This document is a Performance Work Statement (PWS) for a cloud-based eDiscovery Software-as-a-Service (SaaS) solution for the Department of the Air Force (DAF) Judge Advocate General Corps at DoD Impact Level 5. The key requirements include providing an end-to-end eDiscovery solution with features such as data preservation, collection, processing, review, analysis, and production capabilities to support DAF legal requirements. The contractor must host the solution in a FedRAMP-approved cloud environment, provide 24/7 system availability and support, and ensure compliance with DoD cybersecurity requirements. The period of performance is a 12-month base period with four 12-month option periods. The contractor will provide initial training as well as ongoing software updates and maintenance support. The PWS outlines detailed functional, security, and performance requirements the contractor must meet.

View the file

Other files

File	Type	Posted
cost-estimation-gcp.pdf	PDF	Oct 10, 2024
cost-estimation-aws.pdf	PDF	Oct 10, 2024
A041714 JAGC Request for Information_eDiscovery Software -as-a- Service - Industry Day Notification .pdf	PDF	Oct 10, 2024
cost-estimation-oci.pdf	PDF	Oct 10, 2024
cost-estimation-azure.pdf	PDF	Oct 10, 2024
cloud-one-dod-compliant.pdf	PDF	Oct 10, 2024
A041714 JAGC eDiscovery Software-as-a-Service Solution.pdf	PDF	Sep 17, 2024

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Requirement A041714 : COA 17 September 2024

Requirement A041714; COA 17 September 2024

PERFORMANCE WORK STATEMENT

FOR

CLOUD-BASED EDISCOVERY SOFTWARE-AS-A-SERVICE SOLUTION

FOR

THE DEPARTMENT OF THE AIR FORCE

JUDGE ADVOCATE GENERAL CORPS (AF/JA)

DRAFT

https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary

Contents

1.0 DESCRIPTION OF SERVICES

1.1 OVERVIEW

1.2 SCOPE

2.0 SOFTWARE-AS-A-SERVICE (SAAS) REQUIREMENTS

3.0 TASK DESCRIPTIONS

3.1 TASK 1 – SAAS E-DISCOVERY SOLUTION

3.2 TASK 2 - IMPLEMENTATION AND SECURITY

3.3 TASK 3 - SOFTWARE MAINTENANCE

3.4 TASK 4 - CYBERSECURITY REQUIREMENTS

4.0 SECTION 508 ACCESSIBILITY

5.0 SERVICES SUMMARY

5.1 DELIVERABLES SCHEDULE

6.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, MATERIAL,

INFORMATION, OR SERVICES

7.0 GENERAL INFORMATION

8.0 TRANSITION-OUT/DATA EXTRACTION

1.0 DESCRIPTION OF SERVICES

The Department of the Air Force (DAF) and its legal offices (including but not limited to the

Judge Advocate General Corps, the Office of Special Trial Counsel, and the Office of Special

Investigations) are seeking to acquire cloud based (Cloud One or Gov/Mil Cloud) eDiscovery

Software-as-a-Service (SaaS).

1.1 OVERVIEW

The DAF defends its interests in federal courts, state courts, and administrative forums. The rules of these courts are modeled the Federal Rules of Civil Procedure (FRCP), which subjects the Air Force to significant sanctions for failure to comply. The eDiscovery Reference Model

(EDRM) is used by the entire legal industry, including the DAF, as a best practice framework on how to handle hard-copy and electronically stored information (ESI, aka, electronic data) to comply with the FRCP.

The EDRM tracks the life cycle of ESI through various phases: Identification, Preservation, Collection, Processing, Review, Analysis, Production, and Trial. This PWS requires a software solution to provide support for all phases of the EDRM to keep the DAF compliant with the

FRCP.

1.2 SCOPE

This PWS requires the Contractor to provide the DAF with a FedRAMP-approved SAAS eDiscovery solution at DoD Impact Level-5 (IL-5) in a manner that meets the requirements in this document and has the required security controls, data protection functions, and associated documentation to comply with all federal, DoD and AF information technology and cybersecurity requirements, including the DoD Cloud Computing Security Resource Guide (CC

SRG) and obtaining and maintaining an Air Force authority-to-operate (ATO). The Contractor must also provide helpdesk support and operations and maintenance (O&M) support, including free access to all patches and updates, to ensure system availability and optimal performance throughout the duration of the contract. Additionally, this PWS includes requirements for related support and training services.

The period of performance for this contract will be a base period of twelve months and four option periods of twelve months each.

2.0 SOFTWARE-AS-A-SERVICE (SAAS) REQUIREMENTS

2.1 The contractor will provide a Service Level Agreement (SLA) and any other necessary licenses for, as well as access to, the IL5 eDiscovery SaaS solution. This eDiscovery SaaS solution will provide the capability of timely processing and handling millions of documents, multiple terabytes of data, and thousands of legal matters. This eDiscovery SaaS solution will enable DAF legal professionals world-wide to manage large volumes of data, conduct cloud-based collections, processing, culling, review, and highly customizable productions to support fast-paced, high-demand litigations, investigations, and administrative proceedings.

2.2. The Service Level Agreement (SLA)’s terms, as well as the terms of any other agreement, will be incorporated by attachment into the contract and will not conflict with Federal law or regulation.

Any applicable service provider terms and conditions will be incorporated into the contract by attachment. The Government will not be bound by any licensing terms or other restrictions on the use, modification, reproduction, release, performance, or disclosure of software not incorporated by attachment into the contract.

2.3. The contractor will provide the eDiscovery SaaS solution and related support in accordance with the SLA, and other applicable agreements. The eDiscovery SaaS solution must generally be available, reliable, and fit-for-purpose and ready for use always (24/7/365). Accordingly, the SLA will provide relevant key performance metrics for the provision of SaaS services, including at a minimum, system availability, system responsiveness, recovery point and recovery point time, technical support response times, and help desk response times. The SLA will set remedies that are consistent with customary commercial practices for missing key performance metrics. Where the

SLA fails to set required key performance metrics or appropriate remedies, the government may set key performance metrics or may seek an equitable price reduction or adequate consideration for missing key performance metrics in accordance with FAR 52.212-4(a). The overall service availability of the eDiscovery SaaS solution will be 99.9%, or the service availability level set forth in the SLA, whichever is higher. The Air Force will surveil key performance metrics and other key aspects of these agreements as identified in the Service Summary. The Air Force reserves the right to add additional metrics and aspects to surveil throughout the period of performance.

2.4 The eDiscovery SaaS solution will have the required security controls, data protection functions, and associated documentation to comply with all federal, DoD and AF information technology and cybersecurity requirements, including complying with the DoD Cloud

Computing Security Resource Guide (CC SRG), complying with applicable Security Technical

Implementation Guides (STIGs), and obtaining and maintaining an Air Force ATO. The contractor will promptly report to the COR any loss or suspension of a FedRAMP certification, ATO, or any inabilities to maintain compliance with the DoD CC SRG or STIGs. Applicable information technology and cybersecurity requirements are listed in this PWS paragraph 3.4.1.

3.0 TASK DESCRIPTIONS

The Contractor will coordinate and work with the COR and may require interaction with other stakeholders within the DAF in the execution of all required tasks.

The Contractor will complete the tasks described below.

3.1 TASK 1 – SAAS E-DISCOVERY SOLUTION

3.1.1 Subtask 1 - Complete End-to-End NIPR eDiscovery SAAS Solution

The contractor will provide an eDiscovery solution delivering data on demand, on-time, scalable, with the application running on a cloud infrastructure at the IL5 level. Acceptance will be upon delivering a working solution per the PWS. The complete solution will include program https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary management, program status, control and reporting and support services. The solution will include functional user support, verify, and monitor activity of the applications, including software and software configurations; verify user activity; perform closeout tasks and procedures; run reports, set parameters, and document activity as directed by the COR. The contractor will respond by phone, email, or chat to requests for information, for troubleshooting assistance or issues; assist in testing, maintaining, monitoring, and troubleshooting end user telecommunications, software, and devices. Overall Service Availability of the CSP’s infrastructure environments will be a minimum availability of 99.9% Service Availability.

From the time a service is unavailable to the time the service becomes available, the government will not be charged by the Contractor for use of that service.

The eDiscovery solution will provide the following minimum functional capabilities.

Req # Capability

2.1 Access: Web-based functionality to ensure user access from any geographical location

2.2 Access: Capable of DoD CAC Authentication

2.3 Access: Authentication of authorized users and multilevel security over case databases and permission sets

2.4 Access: Capability to limit/grant access to certain functionality by Role Based Access Controls

2.5 Access: Concurrent use by multiple users with protections against inadvertent overwriting

2.6 Preservation: Capability to connect directly to M365 to initiate litigation hold function to preserve custodial ESI in place

2.7 Preservation: Capability to manage litigation holds using templates, alerts, and notifications, reporting and audit features

2.8 Collection: Capability to connect directly to M365 (and other applications through APIs) to collect custodial ESI

2.9 Processing: Capability to extract embedded and attached files from compound files and create a separate record for each extracted file (e.g., email attachments, .rar, .zip)

2.10 Processing: Capability to extract metadata from each native file and load it into searchable fields during the data loading process without modifying the original file or changing metadata values

2.11 Processing: Capability to identify any files that could not be processed in exception reports or a log file during the data loading process with the reason why the file could not be processed (e.g., corrupted, password protected, encrypted, unsupported file type, path too long)

2.12 Processing: Imaging and OCR capabilities

2.13 Processing: Capability to de-crypt encrypted files when

passwords or encryption certificates are supplied https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary

2.14 Processing: Capability to generate multiple kinds of reports on items such as files processed, custodians processed, duplicates

2.15 Processing: Capability to de-duplicate by multiple methods and deNIST files using current NIST lists

2.16 Processing: Capability to identify all custodians on duplicate files and load the information into searchable fields during the data loading process

2.17 Review: Capability to organize ESI into folders or sub-sets

2.18 Review: Advanced searching capabilities such as Boolean, wildcard, proximity, stemming, and fuzziness; metadata searching capabilities including filtering and sorting files based on metadata information

2.19 Review: Capability to create, edit, copy, save, and delete searches, including both the query and results, and to further refine a search

2.20 Review: Capability to highlight search terms (in various colors) within a document, search by highlighted terms, and generate reports on search hits

2.21 Review: Capability to review files in their native format and in an image format (for files that can be imaged)

2.22 Review: Capability to create, edit, copy, save, and delete redactions and highlights including black box and customizable text box and capability to view a redacted file with and without redactions

2.23 Review: Capability to create, edit, copy, save, and delete fields and choices (tags) of various kinds (single choice; multi choice;

text)

2.24 Review: Analytics capabilities including email threading, near duplicate detection and comparison, language identification, conceptual searching, clustering, keyword expansion, and predictive coding

2.25 Review: Capability to create, edit, copy, save, and delete review batches and allow for batch assignment

2.26 Review: Capability to edit, copy, move, delete, image, replace, export, in mass and functions that allow for tallying and summing fields

2.27 Review: Sampling capability to generate a subset of files from a larger population and ability to save the sample to a search or list

2.28 Production: Capability to generate multiple kinds of reports on items such as files produced and withheld

2.29 Production: Capability to export files and corresponding annotations in standard load-ready format for loading into a litigation support software https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary

2.30 Production: Capability to create customizable branding such as bates stamps, either per page or per document in multiple locations (e.g., lower-right corner)

2.31 Production: Capability to apply redactions to files for the purpose of production

2.32 Production: Capability to review produced files in their own view within the same space as the native and image file views

2.33 Production: Capability to export a list of files and metadata or coded fields to an excel or csv format

2.34 Audit capabilities such as updates to files within the application, log of all search activity, search history by user, files reviewed or annotated by user

3.1.2 Subtask 2 – Support Services

The contractor will provide support services including initial system security, configuration, customization, and installation as needed for unclassified and classified environments, software upgrades, training as required, and implementation support. Support services also include support for functional users, technical support resolving system issues, and system administration. The contractor will provide technical assistance to the Government in resolving any trouble tickets/problems associated with the SAAS offering. These problems may include but are not limited to SAAS errors that would hinder users from continuing work, and support related to production.

3.1.3 Subtask 3 – Training

The contractor will provide training to administrators, IT personnel, and users. The training will include initial in-person training, periodic virtual training, and online tutorials for the software.

Initial training will be provided within thirty (30) days of contract award either in-person or video tutorial. Training will cover proper use of software (step-by-step) and technical trouble shooting for common issues. If substantive changes are made to the software, suitable training will be created and delivered either in-person or by video tutorial. Training will cover the substantive changes made, their impacts to existing functionality, and provide proper use of software (step-by-step) as necessary to satisfactorily communicate changes.

The contractor will provide all completed training courses, user manuals, materials, documentation, courseware, concept papers, functional and technical reports, demonstrations, briefings, and other documents and materials to the COR on the 15th of the month for all activities for the previous month.

3.2 TASK 2 - IMPLEMENTATION AND SECURITY

3.2.1 Subtask 1 – Hosting and Installation

The contractor will provide all required DoD RMF Security Control Artifacts necessary to achieve an Air Force ATO, to include follow-on continuous monitoring activities. The eDiscovery solution will be hosted in a cloud environment FedRAMP (HIGH) supporting unclassified at an IL5.

Each solution will comply with the following requirements:

• Provide all required integrated implementation environments for all applications included in the SAAS solution and ensure that all environments can be promoted to one another (development to test and test to production). The Contractor will not host any portion of the environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

• Meet DOD and DAF PII and Privacy data protection requirements per DOD’s Cloud

Computing Security Requirements Guide, CNSSI 1253, Appendix F, Attachment 6, “Privacy Overlay,” NIST SP 800–122 and OMB M–07–16.

• Comply with all current and future SRG/STIG version requirements.

http://iasecontent.disa.mil/cloud/Downloads/Cloud_Computing_SRG_v1r3.pdf

(Minimum Level 5).

• Support AF/JA with installation planning, installation preparation, installation, and quality assurance checks of the software.

3.2.2 Subtask 2 - System Security

The contractor will support security certification and accreditation (C&A) requirements on new and existing components. C&A requirements may include but are not limited to security, test, and evaluation deficiencies; Risk Management Framework (RMF) compliance as detailed in Attachment 3, Risk Management Framework by Acquisition Phase, and as applicable;

platform certification reviews; Computer Emergency Readiness Team (CERT) Taskings and

Advisories; and migration related issues. The contractor will participate in Information

Assurance (IA) activities (e.g., investigation of incidents of unauthorized access/disclosure and security adjustments) and will provide documentation, as necessary, to complete the remediation process. The contractor will produce documentation in the system authorization process, as directed by the COR. The contractor will develop, or change provided products to be compliant with all appropriate Security Technical Information Guides (STIGs). The contractor will ensure the rigorous application of information security/information assurance policies, principles, and practices.

3.2.3 Subtask 3 - Tuning and Configuration Management

After initial deployment, the Contractor will provide technical assistance for overall configuration and fine tuning of the solution software. This should include additional operating system and software updates, appropriate configuration of services based on best practices for the solution, installation of tools and utilities for the monitoring and management of the solution and any other key components. The configuration and tuning of the solution should be in line with the preferred configuration based on solution recommendations and following the existing https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary policies and procedures of AF/JA and any pertinent regulatory or industry requirements. Other components would include Database and file-based configurations.

3.3 TASK 3 - SOFTWARE MAINTENANCE

The Contractor will provide software maintenance for the SAAS solution and any customization that may be required to meet DoD’s requirements. Software maintenance will include, but is not limited to, the following:

3.3.1 Subtask 1 - Technical Support

The Contractor will maintain technical support personnel knowledgeable and experienced in the operation and use of the software product. The Contractor will be able to perform technical and operational support onsite or remotely. The Contractor will provide tools and processes for responding to system and application outages with troubleshooting activities designed to identify and mitigate operational issues.

3.3.2 Subtask 2 - Help Desk Support

The Contractor will provide technical Help Desk support to users, administrators, and IT personnel. Available support will include system administration, maintenance, and operational user assistance and direction to resolve real or perceived software problems. Support will include access to include phone, email, and chat capabilities at the appropriate security levels. Support will be available during normal business hours of 8 am – 4 pm Eastern Time. Support experts will provide and have sufficient technical expertise to provide step-by-step guidance for loading

(including updates), navigating the software and repairing software malfunctions.

3.3.3 Subtask 3 - Updates and Patches

The Contractor will be responsible for all software updates, including software upgrades, new versions, service packs, and patches, within ten (10) days of the release of such update.

In addition to maintenance of the SAAS solution, the Contractor will provide software maintenance for any system modifications.

3.3.4 Subtask 4 - Testing and Acceptance

Each requirement must be testable and documented before deployment to the product environment. The Contractor will assist AF/JA in developing test cases and perform independent activities necessary to assure that all software functionality required under this PWS is defect free.

The Contractor will meet, at a minimum, the following acceptance criteria:

• All users have logon accounts, can logon, and are granted the correct permissions.

• External connectivity is confirmed and working as designed.

• Review can be completed both internally and externally.

3.4 TASK 4 - CYBERSECURITY REQUIREMENTS

3.4.1 Subtask 1 – Cybersecurity

The following documents are mandatory for use. The Contractor will provide Cybersecurity

(CS) in accordance with all current policies, procedures, and statutes, to include (but not restricted to) the following as applicable to this contract:

• 44 U.S.C. § 3542, January 2012

• Committee on National Security Systems Instruction 1253, Security Categorization and

Control Selection for National Security Systems, March 27, 2014, as amended

(including Appendix F, Attachment 6, “Privacy Overlay”)

• Federal Information Processing Standards Publication 199, Standards for Security

Categorization of Federal Information and Information Systems, February 2004 Federal

Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

• Federal Information Security Management Act of 2014 (P.L. 113-283, Title III), December 18, 2014.

• Department of Defense Instruction 5000.02, Operation of the Adaptive Acquisition

Framework, January 23, 2020

• Department of Defense Instruction 5200.39, Critical Program Information (CPI)

Identification and Protection within the Research, Development, Test, and Evaluation

(RDT&E), Change 2 dated October 15, 2018

• Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to

Achieve Trusted Systems & Networks, Change 3 dated October 15, 2018

• Department of Defense Directive 8140.01, Cyberspace Workforce Management, Change 1 dated July 31, 2017

• Department of Defense Instruction 8330.01, Interoperability of Information

Technology (IT), Including National Security Systems (NSS), Change 2 dated

December 11, 2019

• Department of Defense Instruction, Cybersecurity, Change 1dated October 7, 2019

• Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for

DoD Information Technology, Change 2 dated July 28, 2017

• Department of Defense 8570.01-M, Information Assurance Workforce Improvement

Program, Change 4 dated October 11, 2015

• Department of Defense Instruction 8580.1, Information Assurance (IA) in the Defense

Acquisition System, July 9, 2004

• DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk

Management Framework (RMF) into the System Acquisition Lifecycle

• Defense Acquisition Guidebook (DAG)

• Defense Information Systems Agency (DISA) Secure Technical Implementation

Guides (STIGs)

• National Institute of Standards and Technology Special Publication 800-30 Rev 1, Guide for Conducting Risk Assessments, September 2012 https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary

• National Institute of Standards and Technology Special Publication 800-37, Revision 2, Guide for Applying the Risk Management Framework to Federal Information Systems:

A Security Life Cycle Approach, December 2018

• National Institute of Standards and Technology Special Publication 800-39, Managing

Information Security Risk: Organization, Mission, and Information System View, March 2011

• National Institute of Standards and Technology Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 2015

3.4.2 Subtask 2 – Cybersecurity Strength Requirements

The contractor will adhere to all existing authorities and policies of the Director of National

Intelligence regarding the protection of classified information as directed by Executive Order

12333 and other laws and DoD regulations. Requirements governing classified are detailed in

Attachment 2.

The contractor will satisfy the RMF requirements of the Federal Information Security

Management Act (FISMA) Act of 2014.

The contractor will enable DAF to meet or exceed the standards required by the Office of

Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and 40

U.S.C. 11331.

The contractor will in coordination with the prescribed System Owner (SO) and Authorizing

Official (AO) support security categorization IAW FIPS 199 and CNSSI 1253 of each information system and document the results of the security categorization in the security plan.

The contractor will participate in categorization discussions with DAF, SO / User Representative and the ISSM as requested to support security categorization.

The contractor will ensure that a written subsection of the security plan covers FIPS 199 / CNSSI

1253 Security Categorization and Threat Assessment. DAF and or the SO will provide a

Confidentiality, Integrity, and Availability (C-I-A) concurrence memorandum from the SO’s respective AO agreeing with their determination of controls and any overlays or tailoring.

3.4.3 Subtask 3 – Cybersecurity Assurance Requirements

The Contractor will design, develop, and integrate Cybersecurity (CS) solutions supporting the

Department of Defense and all other applicable Government agencies. This will be achieved through abiding by all applicable CS regulations and directives to ensure a favorable Assessment and Authorization (A&A) decision (grant of an Air Force ATO), as well as obtaining an

Authority to Connect (ATC) to all requisite Government networks as required per specific task requirements. The contractor will mitigate risk identified through the RMF authorization process down to a level acceptable to the DAF Authorizing Official.

The Contractor will provide documentation of development practices and standards applied to

Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

All information systems will have their C-I-A rated at high-high-high for the System Security

Plan (SSP) unless otherwise notified in writing. The solution will comply with the security control requirements documented in National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information

Systems and Organizations.”

3.4.4 Subtask 4 - System Network Requirements

All network components and applications will be FEDRAMP+ compliant.

• Heartbeat Signals - The contractor will identify heartbeat signals or protocols and recommend whether any should be included in network monitoring. The contractor will provide packet definitions of the heartbeat signals and examples of the heartbeat traffic if the signals are included in the network monitoring.

• Disabling, Removing, or Modifying Well-Known or Guest Accounts - The Contractor will recommend which accounts need to be active and those that can be disabled, removed, or modified. The Contracting Officer (CO), Program Manager (PM), or

Contracting Officer’s Representative (COR) will approve in writing the contractor’s recommendation. The Contractor will disable, remove, or modify all the accounts pursuant to the approved recommendation. The contractor will disable or remove all default and guest accounts prior to the functional acceptance testing (FAT). Once changed, new accounts will not be published except that new account information and passwords will be provided by the contractor via protected media. At delivery, the contractor will disable, remove, or modify all contractor-owned accounts or negotiate account ownership with the CO, PM, and COR. Contractor updates will not re-enable or re-install any of these accounts.

• Session Management - The contractor will not permit user credentials to be transmitted in clear text. Encryption will at a minimum meet AES 256 and comply with FIPS 140-

2. If this is not technically feasible, the contractor will provide the strongest encryption method commensurate with the technology platform and response time constraints and document the encryption used. The contractor will not allow multiple concurrent logins, applications to retain login information between sessions, provide any auto-fill functionality during login, or allow anonymous logins. The contractor will provide user account-based logout and timeout settings.

• Password/Authentication Policy and Management. The Contractor will implement two-factor authentication using DoD Common Access Card where technically feasible.

The Contractor will not store passwords electronically or in Contractor-supplied hardcopy documentation in clear text unless the media is physically protected.

• End Devices. The Contractor will provide physical and cyber security features for end devices (i.e., the source or destination of network traffic) including, but not limited to, authentication, encryption, access control, event and communication logging, monitoring, and alarming to protect the device and configuration computer from unauthorized modification or use. The Contractor will clearly identify the physical and cyber security features and provide the methodology for maintaining the features including the methods to change settings from the Contractor-configured or manufacturer default conditions. The Contractor will verify that the addition of security features does not adversely affect connectivity, latency, bandwidth, response time, and throughput. The Contractor will remove or disable all software components that are not required for the operation and maintenance of the SAAS. The Contractor will provide, within a pre-negotiated period, appropriate software and service updates and/or workarounds to mitigate all vulnerabilities associated with the product and to maintain the established level of system security.

4.0 SECTION 508 ACCESSIBILITY

The following Section 508 Accessibility Standard(s) (Technical Standards and Functional

Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards

1194.21 - Software Applications and Operating Systems

1194.22 - Web Based Intranet and Internet Information and Applications

1194.23 - Telecommunications Products

1194.24 - Video and Multimedia Products

1194.25 - Self-Contained, Closed Products

1194.26 - Desktop and Portable Computers

1194.41 - Information, Documentation and Support

The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the Offerors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

5.0 SERVICES SUMMARY

Performance

Objective

PWS Section Performance Threshold Method &

Remedies

SS-1

SaaS Solution

Initialization

3.1.1 SaaS solution operational

with ATO at IL5 for DAF within 30 days of contract award date.

Possible Remedies -

Reperformance, CPARS, Exercise

Option, Monetary

Deduction, Etc.

SS-2

SaaS Coverage

2.0 Software services and

licenses will allow all DAF legal professions world-wide to access and use the full functionalities of the solution.

Continued

Surveillance, User

Feedback

Possible Remedies -

Reperformance, CPARS, Exercise

Option, Monetary

Deduction, Etc.

SS-3

SaaS Upgrades/New

Versions

3.3.3 The license will promptly

implement 100% of the updates/new versions that are released during the contract term as they become available to other DoD IL5

Users. Additionally, existing features will not be eliminated or degraded.

Continued Surveillance

CPARS, Exercise

Option, Monetary

Deduction, Etc.

SS-4

System Availability

2.3 The solution is available

24/7/365 in accordance with the system availability metrics defined by the SLA, or 99.900% whichever is higher

Continued

CPARS, Exercise

Option, Monetary

Deduction, Etc.

SS-5

System

Responsiveness

2.3 System Responsiveness is

within the metrics defined by the SLA.

Continued

Option, Monetary

Deduction, Etc.

SS-6

Recovery Point and

Recovery Time

2.3 Recovery Point and

Recovery Time Objectives within the metrics defined by the SLA.

Option, Monetary

Deduction, Etc.

SS-7

Technical Support

Response Times

2.3 Incident Response Times are

within the metrics defined by the SLA.

Periodic Surveillance

CPARS, Exercise https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary

Option, Monetary

SS-9

Helpdesk Support

Response Times

2.3 Helpdesk Response Times

are within the metrics defined by the SLA

Periodic Surveillance

CPARS, Exercise

Option, Monetary

Deduction, Etc.

SS-8

Uninterrupted maintenance of the

FedRAMP

Certification and

DoD ATO, and DoD

CC SRG

Compliance

2.4 The cloud services will

maintain without interruption a FedRAMP Certification, a

DoD ATO, and compliance with the DoD CC SRG and applicable STIGs.

CPARS, Exercise

Option, Monetary

5.1 DELIVERABLES SCHEDULE

PWS Section Deliverable Due Date Delivery

Non-Disclosure

Agreement

Prior to start of relevant work

By email to the COR in

PDF format

7.3 Kick Off Meeting Agenda NLT 3 days after

contract award

By email to the COR in

PDF format

7.2.2 Quality Control Plan Submitted at Kickoff

Meeting and annual revisions submitted 15 days after OY award.

By email to the COR in

PDF format

3.1.3 Training and

Documentation

NLT 3 days after contract award then

15th calendar day of each month

Coordinated with the

COR

8.0 Transition-Out/Data-

Extraction Plan

Upon Request By email to the COR in

PDF format

6.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, MATERIAL,

INFORMATION, OR SERVICES

6.1 Government Furnished Property, Equipment, Material, Information, or Services

The Government will not furnish property or services for this requirement.

6.2 Contractor Acquired Property

The contractor will not be required to acquire any property.

7.0 GENERAL INFORMATION

7.1 Period of Performance

The Period of Performance consists of one 12-month base year and four 12-month option years.

The first 12-month period of performance will include a solution set-up phase (two weeks or less for initial set up) and continuing O&M support and solution or tool upgrades as needed. Four

12-month option periods will be added to cover ongoing and further solution or tool upgrades.

Base/Option Year Period-of-Performance Base Year February 1, 2025, through January 31, 2026 Option Year One February 1, 2026, through January 31, 2027 Option Year Two February 1, 2027, through January 31, 2028 Option Year Three February 1, 2028, through January 31, 2029 Option Year Four February 1, 2029, through January 31, 2030

7.2 Quality Control

7.2.1 Quality Assurance. The Government will rely on the Contractor’s existing quality assurance system as the method to ensure that the requirements of the contract and performance thresholds are met; however, the Government reserves the right to monitor and evaluate the quality of services provided and compliance with the contract terms and conditions at any time.

7.2.2 Quality Control Plan (QCP). The Contractor will develop and maintain an effective quality control program to ensure that the product and services are performed IAW this PWS, applicable laws and regulations, and best commercial practices. The Contractor will develop and implement procedures to identify, prevent, and ensure non-recurrence of defective product and services with special emphasis placed on those product/services listed in this PWS. The Contractor’s quality control program is how it assures itself that the work complies with the requirement of the contract.

7.3 Kickoff Meeting and Agenda

The Contractor will coordinate, schedule, participate in, and document the kick-off Meeting NLT

5 calendar days after contract award at a location within the continental United States approved by the Government. The meeting will provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting will provide the opportunity to discuss technical, management, and logistic issues.

The Contractor will provide a draft copy of the agenda NLT 3 days after contract award for review and approval by the COR prior to finalizing. The Government will provide the Contractor https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary with the number of participants for the kick-off meeting and the Contractor will provide sufficient copies of the presentation for all present.

7.4 Privacy Act

Work on this contract may require that personnel have access to information protected by the

Privacy Act. Contractor personnel will adhere to the Privacy Act, 5 U.S.C. 552a and applicable agency rules and regulations when handling such information.

7.5 Information Assurance (IA) Training, Certifications, and Background Investigations

Contractor employees who have access to controls, monitoring, or administration functions (e.g., system administration, database administration) for DoD systems are required to have IA training, certification(s), and background investigations. The Contractor will ensure that personnel accessing information systems have the proper and current IA training, certification(s), and background investigations to perform information assurance functions in accordance with

DoD 8570.01-M, Information Assurance Workforce Improvement Program, and other DoD requirements. Upon request, the contractor will furnish proof of compliance with this provision.

7.5.1 Safety Concerns. The Contractor is solely responsible for compliance with OSHA standards for the protection of their employees. The Government is not responsible for ensuring that Contractors comply with “personal” safety requirements that do not present the potential to damage Government resources.

7.5.2 Inherently Governmental Functions. The Contractor will not perform inherently

Governmental functions as defined in the Federal Acquisition Regulation (FAR) Subpart

7.5 in relation to this PWS.

7.5.3 Ethics. The Contractor will not employ any person who is an employee of the U.S.

Government if employing that person would create a conflict of interest. Additionally, the Contractor will not employ any person who is an employee of the Department of the

Air Force, either military or civilian, unless such person seeks and receives approval according to DoD 5500.7-R, the Joint Ethics Regulation.

7.5.4 Professional Appearance of Workspace. In the event the Contractor is given

Government workspace, the Contractor will keep workspace areas neat and orderly and avoid conditions leading to safety violations.

7.5.5 Non-Personal Services. The Government will not supervise or task Contractor employees in any manner that generates actions of the nature of personal services, or that creates the perception of personal services. It is the responsibility of the Contractor to manage its employees directly and to guard against any actions that are of the nature of personal services, or give the perception of personal services, to the Government or to

Government personnel. If the Contractor feels that any actions constitute, or are perceived to constitute personal services, it is the Contractor’s responsibility to notify the https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary https://conit.cce.af.mil/suite/sites/procurement-personnel-home/page/home/record/lYBNS8-f6ETGDot5nur7aAeUZPDl7WGaor6FKvWMxc8AJyg7_VHdWDO4aGG0TQt66Pzp3q-xzSCQrWb1cDIui9q9mr-RTK6c-hPRMKSv79yj9AauMlmwA/view/summary

CO immediately. Non-personal Contractor services will not be used to perform work of a policy/decision making or management nature.

8.0 TRANSITION-OUT/DATA EXTRACTION

The Contractor agrees and warrants that at, or reasonably before, the completion or termination of this contract, unless an appropriate follow-on contract is in place, all Government data and

Government-related data (as defined in DFARS 252.239-7010) will be promptly returned to the

Government in a useful form with the metadata and data context preserved to the maximum extent practicable. The Contractor will reasonably cooperate with any transition to a new vendor supporting some or all DAF applications. The Contractor will maintain an appropriate transition-out and data extraction plan. Additionally, within 30 days of completion or termination, unless an appropriate follow-on contract is in place, the Contractor will dispose of any Government data and Government-related data as directed by the Government. This provision supersedes any conflicting terms in any licensing agreement and survives termination or completion of the contract.

File details come from the government source that posted it. Updated Sep 17, 2024.