The file's text, extracted by GovTribe without its formatting.
Appendix 1 - OCC REQUIREMENTS TRACEABILITY MATRIX (RTM) Functional and Technical Requirements
| Req # |
| Requirement Category |
| Requirement |
| Optional/ |
Mandatory
Hold Notices
| 1. |
| Hold Notices |
| The system shall interface with the OCC’s O365 Outlook email system to send and record legal hold notifications and replies. |
| Mandatory |
| 2. |
| Hold Notices |
| The system shall interface with the OCC’s O365 Outlook email system to access employee information stored in the Active Directory, such as an employee’s organization and manager(s). |
| Mandatory |
| 3. |
| Hold Notices |
| For OCC custodians with an OCC email domain, the system shall send all legal hold notifications to and from an OCC email domain. Non-OCC custodians shall receive their notifications from an OCC email domain. |
| Mandatory |
| 4. |
| Hold Notices |
| The system shall enable end-users to send legal hold notifications to all individuals within a business unit and to all individuals sharing a position description or job title. |
| Optional |
| 5. |
| Hold Notices |
| The system shall send an automatic legal hold notification to an offboarding custodian to inform the custodian that data in their custody or control must be preserved. |
| Mandatory |
| 6. |
| Hold Notices |
| The system shall allow the end-user to label by category the individuals to whom legal hold notifications are sent, to include custodians, recipients, or other customizable label. |
| Mandatory |
| 7. |
| Hold Notices |
| The system shall allow the end-user to customize the list of individuals to whom legal hold notifications are sent by individual or by category, to include custodians and recipients. |
| Mandatory |
| 8. |
| Hold Notices |
| The system shall allow end-users to manually add individuals (internal and external to OCC) as custodians and recipients of legal hold notifications. |
| Mandatory |
| 9. |
| Hold Notices |
| The system shall allow end-users to send legal hold notifications to custodians informing them of their obligation to preserve documents. |
| Mandatory |
| 10. |
| Hold Notices |
| The system shall record the date and time a legal hold notification was sent to a custodian and recipient. |
| Mandatory |
| 11. |
| Hold Notices |
| The system shall determine whether a custodian and/or recipient has opened the legal hold notification and record the date and time it was opened. |
| Mandatory |
| 12. |
| Hold Notices |
| The system shall allow end-users to schedule automatic reminder legal hold notifications to be sent to custodians and/or recipients, after the initial legal hold notification has been sent, based on intervals customizable for each case. . |
| Mandatory |
| 13. |
| Hold Notices |
| The system shall notify the end-user before any automatic reminder legal hold notification is sent to custodians or recipients. The system shall require the end-user to affirmatively approve the issuance of any automatic reminder legal hold notification before it is sent. |
| Mandatory |
| 14. |
| Hold Notices |
| The system shall allow a custodian and recipient to directly reply to the end-user regarding the legal hold notification. |
| Mandatory |
| 15. |
| Hold Notices |
| The system shall allow an end-user (user A) to send legal hold notifications to custodians and recipients on behalf of another end-user (user B). The system shall allow user A to select which individual or individuals with an OCC domain email (whether user A, user B, some combination of users) will receive direct replies to legal hold notifications. |
| Optional |
| 16. |
| Hold Notices |
| The system shall record any replies to a legal hold notification(s), including the substance of a reply, name of custodian, date, and time of the reply. |
| Mandatory |
| 17. |
| Hold Notices |
| The system shall provide out-of-the-box templates for legal hold notifications, but also allow for customization. |
| Mandatory |
| 18. |
| Hold Notices |
| The system shall allow an end-user to send out a notification to terminate the legal hold to all custodians and recipients that received a legal hold notification. |
| Mandatory |
| 19. |
| Hold Notices |
| The system shall allow an end-user to to remove individual custodians from the applicable legal hold notification. |
| Mandatory |
| 20. |
| Hold Notices |
| The system shall allow an EDMS user to restrict end-user access by legal hold matter. |
| Mandatory |
| 21. |
| Hold Notices |
| The system shall allow the end-user to send customizable legal hold notifications to those custodians who have failed to acknowledge “receipt and understanding” at a time-frame specified by the end-user. |
| Mandatory |
| 22. |
| Hold Notices |
| The system shall automatically escalate legal hold notifications sent to custodians who have not acknowledged “receipt and understanding” to their manager identified in the active directory at a time-frame specified by the end-user. |
| Mandatory |
| 23. |
| Hold Notices |
| The system shall allow end-users to customize how custodians will reply to a legal hold notification to acknowledge “receipt and understanding.” |
| Mandatory |
| 24. |
| Hold Notices |
| The system will track responses from custodians to legal hold notifications acknowledging “receipt and understanding.” Tracked responses shall be viewable to the end-user. |
| Mandatory |
| 25. |
| Hold Notices |
| The system shall be able to export to .csv file the tracked responses from custodians to legal hold notifications acknowledging “receipt and understanding.” |
| Mandatory |
| 26. |
| Hold Notices |
| The system shall allow the end-user to select whether custodians on a legal hold notification will be (1) able to view other custodians on the same legal hold notification or (2) not able to view other custodians on the same legal hold notification. Recipients shall always have the ability to view custodians on a legal hold notification. |
| Mandatory |
Identification
| 27. |
| Identification |
| The system shall interface with OKTA for Cloud-based solutions, to identify individuals to whom a legal hold notification should be sent. The system shall support searches of the OCC’s IAM system based on name, job title, and business unit. |
| Mandatory |
| 28. |
| Identification |
| The system shall categorize each legal hold as a separate matter with a customizable identifier. Each legal hold notification and legal hold notification reminder shall be associated with the relevant identifier. |
| Mandatory |
| 29. |
| Identification |
| The system shall utilize machine-learning capabilities to identify individuals to whom a legal hold notification should be sent, based on email traffic between a custodian and others with whom he/she has relevant email correspondence. |
| Optional |
| 30. |
| Identifications |
| The system shall interface with the OCC’s timekeeping system to enable end-users to identify custodians working on a matter during a specified time and to send legal hold notifications to those custodians. (The timekeeping system utilizes time codes to identify the matters to which users have charged their hours.) |
| Optional |
| 31. |
| Identification |
| The system shall interface with the OCC’s Appian-based onboarding/offboarding system, known as Personnel Administration and Security System (PASS), to notify the end-user that an identified custodian is scheduled to separate. |
| Mandatory |
| 32. |
| Identification |
| The system shall search HR data to identify the individual who held a specified position during the specified date range. |
| Optional |
| 33. |
| Identification |
| The system shall be capable of sending a custodian survey (“survey”) to the custodian. A custodian survey requests ESI from custodians about the custodian’s familiarity with the matter, the location of potentially relevant documents, or to request that the custodian identify additional custodians. |
| Mandatory |
| 34. |
| Identification |
| The survey shall be deliverable through the OCC’s O365 Outlook email system. |
| Mandatory |
| 35. |
| Identification |
| The system’s survey function shall be either a web-based survey compatible with Microsoft Edge, Internet Explorer, and Google Chrome, or a Microsoft SharePoint survey. |
| Mandatory |
| 36. |
| Identification |
| The system shall provide templates for custodian surveys, but also allow for customization of surveys by users. |
| Mandatory |
| 37. |
| Identification |
| To create customized custodian surveys, the system shall provide a drag-and-drop form builder. |
| Optional |
| 38. |
| Identification |
| The system shall provide the ability to customize a survey to include one or more free-form text box(es). |
| Mandatory |
| 39. |
| Identification |
| The system shall save the survey responses from custodians in a comma-delimited format. |
| Mandatory |
| 40. |
| Identification |
| The system shall save the survey responses from custodians in PDF format. |
| Optional |
| 41. |
| Identification |
| The system shall allow for the the ability to export survey responses in a CSV format. |
| Mandatory |
| 42. |
| Identification |
| The system shall allow for an end-user to filter and review survey responses by each individual survey questions. |
| Mandatory |
| 43. |
| Identification |
| In all matters where multiple surveys are sent, the system shall allow for an end-user to filter and review each field of a survey response across all surveys sent in a matter. |
| Optional |
| 44. |
| Identification |
| The system shall allow an end-user to filter and review survey responses from each custodian. |
| Mandatory |
| 45. |
| Identification |
| The system shall categorize each survey with the corresponding l customizable identifier described in #28 above. |
| Mandatory |
| 46. |
| Identification |
| The system shall allow end-users to send multiple surveys to custodians on each legal matter. |
| Mandatory |
| 47. |
| Identification |
| The system shall allow end-users an option to receive notifications when a custodian has completed a survey. |
| Optional |
| 48. |
| Identification |
| The system shall allow an end-user to mandate whether a response to certain survey questions is required before a survey can be submitted. |
| Mandatory |
In-Place Preservation
| 49. |
| In-Place Preservation |
| The system shall override the Agency’s automatic retention policies in the O365 Outlook email system by placing in-place preservation holds on custodian mailboxes. |
| Mandatory |
| 50. |
| In-Place Preservation |
| The system shall be capable of overriding the Agency’s automatic retention policies and placing in-place preservation holds on the ESI maintained in the OCC systems that have the capability to support preservation. |
| Optional |
| 51. |
| In-Place Preservation |
| The system shall be capable of overriding the Agency’s automatic retention policies and placing in-place preservation holds on ESI maintained on network shares. |
| Optional |
Collection
| 52. |
| Collection |
| The system shall store forensic copies of source files in native format in a FedRAMP-authorized cloud environment. |
| Mandatory |
| 53. |
| Collection |
| The system shall search and collect ESI sources maintained on all OCC systems, where technologically feasible. |
| Mandatory |
| 54. |
| Collection |
| After data collection, the system shall feature the ability to create an import-ready Relativity package: the source data and a load file in Relativity format. |
| Optional |
| 55. |
| Collection |
| The system shall provide de-duping capabilities, eliminating exact copies of the same document collected from multiple sources. |
| Optional |
| 56. |
| Collection |
| The system shall provide near de-duping capabilities, eliminating or omitting the collection of copies within a specified percentage of similarity. The system shall create a log of all copies that were not collected. |
| Optional |
| 57. |
| Collection |
| The system shall support file-type searches (i.e., restricting the search of potential ESI sources by file type). |
| Mandatory |
| 58. |
| Collection |
| The system shall support date-range searches (i.e., restricting the search of potential ESI sources by date range of “Create Date” and “Last Modified Date”). |
| Mandatory |
| 59. |
| Collection |
| The System shall support custodian searches (i.e. restricting the search of potential ESI by custodian). |
| Mandatory |
| 60. |
| Collection |
| The system shall support searches of at least 20 delimiters simultaneously across all custodians. |
| Mandatory |
| 61. |
| Collection |
| The system shall support keyword searches. |
| Mandatory |
| 62. |
| Collection |
| The system shall support proximity searches (e.g., “find all documents that contain the string “abc” within 20 characters of the string “xyz”). |
| Optional |
| 63. |
| Collection |
| The system shall support phrase-based searches. |
| Mandatory |
| 64. |
| Collection |
| The system shall support regular-expression searches. |
| Optional |
| 65. |
| Collection |
| The system shall support DeNISTing. The system shall create a log of all files excluded by DeNISTing |
| Mandatory |
| 66. |
| Collection |
| The system shall provide data assessment capabilities to identify, and collect as needed, non-searchable/encrypted archives. The system shall create a log of the non-searchable/encrypted data to determine whether they should be collected. |
| Mandatory |
| 67. |
| Collection |
| The system shall collect custodian data in a secure location that ensures the integrity of forensic copies. |
| Mandatory |
| 68. |
| Collection |
| The system shall detect “open files” or files currently in use by an application or process so that they can be reported as incomplete. |
| Mandatory |
| 69. |
| Collection |
| The system shall have the ability to connect to SQL Server via an ODBC, JDBC or another standard database connectivity API in order to collect structured data. |
| Mandatory |
| 70. |
| Collection |
| The system shall feature the ability to perform two-step searches to collect unstructured data associated with an OCC system: Step 1, search against a metadata-to-file-location SQL Server database view to identify the unstructured data that matches the search criteria, Step 2, collect the files using the file path locations in the search result set. |
| Mandatory |
| 71. |
| Collection |
| The system shall feature the ability to search against the COTS product OpenText eDocs using keyword and phrase searches against document metadata and file content, leveraging the OpenText search API |
| Mandatory |
| 72. |
| Collection |
| The system shall feature the ability to search against the COTS product Office 365 using keyword and/or metadata searches, leveraging the COTS product search API |
| Mandatory |
| 73. |
| Collection |
| The system shall allow end-users to view the results of searches and applications of filters prior to collection. |
| Mandatory |
| 74. |
| Collection |
| The system shall allow an end-user to pause and restart search and collection jobs. |
| Mandatory |
| 75. |
| Collection |
| The system shall allow a remote end-user to conduct search and collection jobs on OCC PCs, workstations, tablets, iPads, and laptops anywhere in the nation provided they are connected to the OCC network via a physical network connection or a VPN connection. |
| Mandatory |
| 76. |
| Collection |
| If a PC, workstation, tablet, iPad, or laptop reboots during a remote collection from its hard drive (or other applicable drive), the collection should resume automatically once the computer restarts and is reconnected to the network. |
| Mandatory |
| 77. |
| Collection |
| Where search and collection jobs have been interrupted, the system shall resume the job at the point of interruption. |
| Mandatory |
| 78. |
| Collection |
| The system shall generate a log that documents the starting and stopping of search and collection jobs. |
| Mandatory |
| 79. |
| Collection |
| The system shall be capable of early case assessment. |
| Optional |
| 80. |
| Collection |
| The system shall be capable of searching and collecting ESI from the following OCC-issued device types: |
· laptops (Windows 10 and Windows 7 operating systems);
· tablets (Windows 10 and Windows 7 operating systems);
· workstations (Windows 10 and Windows 7 operating systems);
· Macintosh Computers;
· iPads;
· iPhones.
Mandatory
| 81. |
| Collection |
| The system shall be capable of identifying, searching, and collecting .wav files for voicemails stored in the O365 Outlook email system. |
| Optional |
| 82. |
| Collection |
| The system shall be capable of collecting call log data from the OCC Cisco telephone systems. |
| Optional |
| 83. |
| Collection (add to preservation/archiving) |
| The system shall be capable of searching and collecting ESI from the PC Backup servers and storage devices for files that have been deleted from workstations and laptops. |
| Mandatory |
| 84. |
| Collection |
| The system shall search and collect data from OCC shared drives. |
| Mandatory |
| 85. |
| Collection |
| The system shall search and collect data from OCC custodians’ O365 Outlook email system accounts, including email, saved Skype conversations, and calendar items. |
| Mandatory |
| 86. |
| Collection |
| The system shall allow the end-user to set the following parameters (filters) for the collection of O365 Outlook data: |
· Sender
· Recipient
· Name(s) in the c.c. or b.c.c. field
· Date sent or received (exact date or range)
· Word or phrase in the email body
· Combination of words or phrases in the Subject field
· Combination of words or phrases in the email body Whether or not there are attachments to an email or calendar invitation.
Mandatory
| 87. |
| Collection |
| The system shall be capable of performing text searches on O365 Outlook email attachments that contain OCR text. |
| Mandatory |
| 88. |
| Collection |
| The system shall be capable of converting data in O365 Outlook attachments that do not contain OCR text so that they may be searchable. |
| Mandatory |
| 89. |
| Collection |
| The system shall be capable of searching draft emails. |
| Optional |
| 90. |
| Collection |
| The system shall be capable of distinguishing sent items from draft items when conducting a search. |
| Mandatory |
| 91. |
| Collection |
| The system shall be capable of distinguishing indexed ESI from non-indexed ESI when conducting a search. |
| Mandatory |
| 92. |
| Collection |
| The system shall search and collect ESI from OCC SharePoint sites. |
| Mandatory |
| 93. |
| Collection |
| The system shall allow end-users to search OpenText/eDocs documents. |
| Mandatory |
| 94. |
| Collection |
| The system shall be able to retrieve the source OpenText/eDocs document referenced by a .DRF OpenText shortcut attached to an e-mail (the system shall retrieve the source OpenText eDocs document using the OpenText eDocs DOC ID specified in the e-mail attachment .DRF file) |
| Optional |
| 95. |
| Collection |
| The system must capture the metadata fields associated with an OpenText/eDocs document. |
| Optional |
| 96. |
| Collection |
| The system shall have the ability to connect to a Web Service in order to collect structured data. |
| Optional |
| 97. |
| Collection |
| The system shall have the ability to connect to a Web Service in order to collect unstructured data. |
| Optional |
| 98. |
| Collection |
| DELETED (Duplicate of Requirement #68) |
| Optional |
| 99. |
| Collection |
| The system shall have the ability for an EDMS User to leverage Structured Query Language (SQL) to interrogate a SQL Server database and return structured data. |
| Optional |
| 100. |
| Collection |
| The system shall have the ability for a EDMS User to leverage Structured Query Language (SQL) to interrogate a SQL Server database and return unstructured data. |
| Optional |
| 101. |
| Collection |
| The system shall be capable of transcribing audio .wav files into text. |
| Mandatory |
| 102. |
| Collection |
| When transcribing audio .wav files as described in #100, the system shall be able to distinguish and note in the transcription when different individuals are speaking. |
| Optional |
| 103. |
| Collection |
| The system shall allow an end-user to run a report that provides custodians’ PC names, any ancillary devices, hard drives, shared drives, and SharePoint sites BEFORE collection. |
| Mandatory |
| 104. |
| Collection |
| The system shall allow an end-user to run reports that show all collections related to a specific matter that identify: |
· Total amount of data, by byte, collected per custodian;
· Total amount of data, by byte, collected across all custodians;
· Total amount of data, by byte, determined to be relevant to each keyword, segregated by custodian
Mandatory
Administration - Search & Collection
| 105. |
| System Administration - Search & Collection |
| The system shall allow an EDMS-User to schedule collection jobs for any OCC source at a specific date and time. |
| Mandatory |
| 106. |
| System Administration - Search & Collection |
| The system shall allow an EDMS-User to monitor collection progress from a central administration location. |
| Mandatory |
| 107. |
| System Administration - Search & Collection |
| The system shall allow an EDMS-User to view failed or errored-out jobs. |
| Mandatory |
| 108. |
| System Administration - Search & Collection |
| The system shall allow an EDMS-User to initiate a job from a central administration console. |
| Mandatory |
| 109. |
| System Administration - Search & Collection |
| The system shall allow an EDMS-User to create new cases. |
| Mandatory |
| 110. |
| System Administration - Search & Collection |
| The system shall allow an EDMS-User to remotely schedule and launch a stealth collection. |
| Optional |
Audit & Reporting
| 111. |
| Audit & Reporting |
| The system shall be capable of recording the date, time, activity, and individual performing that activity for any back-end and front-end functions. |
| Mandatory |
| 112. |
| Audit & Reporting |
| The system shall have the capability to create a customizable audit-log documenting any of the system activity described in the above requirement (No. 111.). |
| Mandatory |
| 113. |
| Audit & Reporting |
| The audit history shall be exportable in PDF, CSV, and any other Office 365 compatible format. |
| Mandatory |
Archive
| 114. |
| Archive |
| The system shall archive all ESI and attachments in native format in a FedRAMP-certified cloud environment. |
| Mandatory |
| 115. |
| Archive |
| The system shall archive all other source files in native format in a FedRAMP-certified cloud environment. |
| Mandatory |
| 116. |
| Archive |
| The system archiving shall be automatic at the system level and based on configurable criteria set at the system level. |
| Mandatory |
| 117. |
| Archive |
| The system shall allow the ability to retrieve archived data and make it readable. |
| Mandatory |
System Administration
| 118. |
| System Administration |
| The Super-User shall manage permissions and access for all end -users |
Optional
Task XX - Security Assessment & Authorization (SA&A) and Continuous Monitoring The Contractor shall provide supporting activities and artifacts necessary to receive an Authority to Operate (ATO), conduct continuous monitoring efforts, and maintain that ATO throughout the life of the contract. This will include responding to questions and providing additional documentation related to any aspect of the risk management lifecycle to include but not limited to security control assessments, security continuous monitoring efforts, Plan of Action & Milestone management, vulnerability remediation, threats and incident management. The contractor must provide the OCC with a matrix of security controls identified as “Customer Responsible” (i.e., controls that the OCC will need to implement as a part of the contractor’s solution). After Contract Award, the OCC will perform a review of the FedRAMP Authorization package and the Contractor must receive an ATO from the OCC prior to migration of OCC data under Task 3. The contractor shall provide regular reports and respond to questions regarding security continuous monitoring activities the contractor has performed.
Deliverables The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval in writing from the OCC CO
| No. |
| Deliverable Name |
| Due Date |
| Comments |
| 1 |
| Security Assessment and Authorization (SA&A) support material, to include contractor’s Systems Security Plan (SSP), Security Assessment Report (SAR), Plan of Action & Milestones (POA&M), Contingency Plan, Contingency Plan Test Report, ATO memorandum, Information System Continuous Monitoring (ISCM) Plan, Customer Responsibility Matrix (CRM) outlining OCC security control responsibilities, and most recent ISCM Package. |
| 5 business days after award and annually thereafter. |
| See Deliverable #2 for further details on ISCM Package. |
The Contractor must receive an Authority to Operate (ATO) from the OCC prior to receiving OCC data. OCC will review the SA&A support materials to decide if granting an ATO. The Contractor shall be responsible for all costs and related resource allocations required in case ATO is not granted.
| 2 |
| ISCM Report/Package, to include monthly audit log review evidence, latest Plan of Action & Milestones (POA&M) report & evidence of management, monthly compliance & vulnerability scans reports and evidence of remediation, and risk acceptances. On a semi-annual basis, include User Account Review evidence within that month’s ISCM Package. |
| Quarterly |
(Semi-annually for applicable quarters, include Account Reviews) If deemed necessary by OCC, these may be required monthly.
| 3 |
| For systems containing Sensitive PII, provide applicable Interconnection Service Agreements (ISA); Service Level Agreements (SLA) with external organizations; and Service Organization Controls (SOC) 2, Type 2 Reports for all applicable Data Center(s). |
| 5 business days after award and annually thereafter. |
| 4 |
| For systems containing Sensitive PII, provide applicable Change Management Process that includes the solution system’s inventory management. |
| 5 business days after award. |
| 5 |
| System-specific data to support Federal Reporting Requirements (e.g. DHS, OMB, IG) data calls. |
| Quarterly and ad hoc, as needed |
