Appendix D Security Technical Functional PGEN - FINAL - 7-27-2017.pdf

RFB DOJ 2018-01

Probabilistic Genotyping Software Application

Bidder Response

APPENDIX D

BIDDER COMPLIANCE WITH SECURITY,

TECHNICAL, AND FUNCTIONAL REQUIREMENTS

1. This section specifies SECURITY, TECHNICAL AND FUNCTIONAL REQUIREMENTS for the desired procurement. Bidders must provide the applicable response code for each requirement using the response form (Appendix D2: Bidder's Response to Appendix D).

2. Conditions of the RFB that include the word “must” or “shall” describe a mandatory requirement. Failure to meet a mandatory requirement will disqualify your bid, unless determined by DOJ that no bidders are able to meet such requirement, in which case, the DOJ reserves the right to delete or modify said mandatory specification or condition.

3. Bidder agrees to comply with all requirements listed in this section, including the requirements in subsections therein. Indicate your compliance with each of the following sections by specifying a Response Code of either

"Yes" or "QY" for each requirement described below and listed in the Attachment D2 response form. Provide descriptions and/or explanations to demonstrate compliance and qualification to furnish the required software and services.

4. This RFB document, any amendments, attachments, addenda and the awarded bidder’s response as accepted by the DOJ, shall constitute part or all of the resulting contract.

Response Code

Yes Fully meets the requirement.

Describe/explain how your software and services meet the stated requirement and highlight additional or superior capabilities.

QY QUALIFIED YES

Bidder is able to meet the stated requirement but additional customization/modification may be required that may or may not incur additional cost to DOJ.

(1) Describe/explain how your software is qualified to meet the stated requirement

(2) Bid the cost for customization or modification, if any, and

(3) Indicate the level of effort and additional time (in effort hours and duration days) needed to complete all customization/modification.

1 General Requirements

1.1 The software must be fully developed and in production use in a form that satisfies all technical, security, and functional requirements stated in this RFB, with only minor customizations, configurations or modifications needed to achieve full satisfaction of the requirements. Include a narrative describing the availability and

“readiness for implementation and production” status of your software and how the functionalities of your software compare to the full requirements of the RFB.

Proposed software that requires significant development will not be considered.

1.2 Bidder must be able to show that its software has been validated in accordance with forensic testing accreditation standards and guidelines and is currently being utilized on Forensic DNA casework in a nationally accredited and recognized Crime Laboratory or Laboratory System in the United States of America.

INSTRUCTIONS:

Bidder Response

1.3 Hardware Specifications

The software must be capable now of supporting analysis of 2-4 person mixtures. In the future, it is DOJ’s intention to include analysis of 5 person mixtures. Confirm that this is possible and describe how your software is capable of meeting current and future needs as it relates to supporting analysis of 2 – 5 person mixtures.

• Provide detailed technical specifications of the hardware required to operate your software to meet DOJ’s current needs and support growth to meet the planned future need.

• Include specifications for processor, RAM, storage space, operating system and other relevant components.

• Indicate what changes, if any, might be required over time to meet projected future needs.

2 Technical and Security Requirements

2.1 The software can use Microsoft Active Directory credentials for authentication.

2.2 Remote access to the software, if enabled, supports multi-factor authentication (MFA).

2.3 Any and all network communications outside of the DOJ network must be encrypted in transit in compliance with

FIPS 140-2 standards.

2.4 System communications requiring certificates must permit signing by a certificate of DOJ’s choosing. DOJ will determine the appropriate signing source (external or internal authorities) for the communication.

2.5 The bidder supports patching of the software as needed on a timely basis in order to address security vulnerabilities as determined by the DOJ.

2.6 The bidder supports operation of the software on a system configured to meet the Defense Information Systems

Agency's Security Technical Implementation Guides (STIGs).

2.7 Cloud-based software that makes use of processing resources outside the DOJ network must provide methods to monitor application performance and reliability.

2.8 Cloud-based software that makes use of processing resources outside of the DOJ network must provide usage or issue logs in a format that can be read and processed by industry-leading Security Information and Event

Management (SIEM) tools.

2.9 The software must permit the use of security tools and software such as antivirus protections.

2.10 If the software uses a database it must be a currently supported version of an enterprise relational database such as Oracle or Microsoft SQL Server.

2.11 Any client software that is part of the proposed solution must run on either Windows 7 or Windows 10.

2.12 Bidder must commit to maintaining active support for all software components.

2.13 Any client software that is part of the proposed solution must support installation and usage in a Windows 7

Virtual Desktop environment.

2.14 The software must allow for backup of data by industry leading backup software. This may require installation of backup agents on servers or on clients if data is stored locally.

3 Functional Requirements

3.1 Modeling

3.1.1 The software must utilize fully continuous mathematical modeling of a DNA profile to determine the optimal genotypes present by giving weight to each of the results. These weights are determined by performing simulations of the data using the Markov Chain Monte Carlo (MCMC) method.

3.1.2 The software program must utilize likelihood ratio’s that are calculated relative to an unknown contributor or contributors, thus allowing for different propositions/hypotheses to be made. The program cannot calculate likelihood ratios relative to coincidence.

3.1.3 The software must allow the WSCLB analysts to alter the likelihood ratio calculation defaults.

3.1.4 The software must model allelic specific stutter rates and locus specific stutter rates.

3.2 Sensitivity

3.2.1 The software must automatically allow for the assessment of degradation and differential degradation into the process. Specifically, the program must allow individual degradation rates for individual contributors.

3.2.2 The software program must allow DNA analysts to review the laboratory generated data and remove non-allelic peaks (commonly referred to as artifacts) prior to input into the software. The software must not consider non-allelic peaks as possible contributor alleles.

Bidder Response

3.2.3 The software must not have a default defined/convenience threshold Relative Fluorescent Unit (RFU) value.

The WSCLB will determine any threshold based on the WSCLB validations and/or manuals.

3.3 Biological Parameters

3.3.1 The software must allow the use of laboratory specific parameters based on the WSCLB DNA Analysis Unit’s own validation and/or manuals. Parameters include: analytical thresholds, allele frequency databases, theta values, probability of drop-in, saturation limits and peak variability.

3.3.2 While the software program will allow alternate settings or configuration to be applied to the biological modeling parameters based on the WSCLB DNA Analysis Unit’s own validation data for the units’ amplification chemistries, the software must also allow flexibility so that any new kit types, allele frequency calculation and subpopulations can be added without updates.

3.4 Source Coding and Testimony

3.4.1 The continuous probabilistic genotyping software must have all exact source code formulas provided for and available for analysts (specifically, without the need of a court order). This source code must be publically available and must be published within peer reviewed publications.

3.4.2 Software must be able to be represented in court by WSCLB DNA analysts. The WSCLB must be able to evaluate and testify to the source code if asked during subsequent admissibility or Daubert hearings without the need for a probabilistic genotyping company representative (which incurs additional costs due to witness fees).

3.5 Software Authorization

3.5.1 Software must support role-based secure access by authorized staff, with varying levels of access depending on role.

3.5.2 Software must support controlled access to cases by roles.

3.5.3 Software must allow entry and editing of data only by authorized users.

3.5.4 Software must maintain an audit trail of data changes including previous and new values, date of change, and information of person making the change to the user accounts.

3.5.5 Software must allow authorized users to create new service and pre-service programs.

3.6 Software, Reports and Software Support

3.6.1 Software must have the ability to store known mixture profiles, and must provide WSCLB with the ability to search mixture profiles against knowns for more robust contamination detection.

3.6.2 The software’s raw data must be generated and owned by the WSCLB analysts and must be able to be printed out and applied to the WSCLB case jackets immediately upon analysis. The output file types must be either: .txt, .pdf, or similar DOJ accepted data files. These files will be held electronically by the DOJ.

3.6.3 The software’s input file types must be able to be generated from 3500xl instrumentation and must be .csv files or a similar format. Manual entry cannot be the only option for input into the software.

3.6.4 The software must have an audit trail that is accessible immediately in real time by the WSCLB DNA analysts.

3.6.5 The software report of results upon calculations must be clear, immediately accessible and easily readable. The

WSCLB DNA analysts must be able to testify to those reported results. The results reports generated at the time of the software’s analysis must include the following if applicable: Likelihood ratios, genotypic weights, diagnostics, and results.

3.6.6 The bidder must provide software support and must train the WSCLB to enter scientific and technical ticket submission. There must be availability 24 hours a day, 7 days a week to initiate documentation of a ticket. For critical issues, there must be access to a representative for the WSCLB during core business hours Monday-

Friday (7:45am-4:30pm CT).

3.7 Efficiency

3.7.1 The software program must be able to handle 2-5 person mixtures.

3.7.2 The software must be able to display computation times as follows: less than or equal to 1 hour for a two person mixture, less or equal to 3 hours for a three or four person mixture, less than or equal to 4 hours for a greater than four person mixture. The software must be able to handle five person mixtures. These calculations must be able to be completed within the software.

3.7.3 The bidder must provide at least three (3) examples in which a Forensic Casework discipline in a nationally accredited and recognized Crime Laboratory or Laboratory System in the United States of America adopted the software successfully and maintained a reasonable timeline for installation, training and implementation.