Attach_2_DRAFT_PWS_RMA.pdf

PERFORMANCE WORK STATEMENT (PWS)

Requirement Title: Electronic Records Management Application (RMA) Support Services

Customer: The First Responder Network Authority (FirstNet Authority), Office of the Chief Information Officer (OCIO)

PWS for RMA Support Services, Page 2 of 15

Post-Award Document Revision History

Mod.

No. Description of Changes Requested

By Approved

By Date

None Award Document N/A N/A TDB

PWS for RMA Support Services, Page 3 of 15

Table of Contents

1.0 General

2.0 Specific Requirements/Tasks

3.0 Deliverables

4.0 Travel

5.0 Government Furnished Property (GFP)/ Equipment (GFE)/ Information (GFI) 11

6.0 Special Instructions and Other Information

PWS for RMA Support Services, Page 4 of 15

1.0 General

1.1 Background

The mission of the FirstNet Authority is to oversee FirstNet, the nation’s communications network dedicated to emergency responders and the public safety community. The mission of the FirstNet Authority program is to deliver a robust, reliable, and advanced communications network that meets the unique needs of public safety personnel in all 56 states and territories. Specifically, the FirstNet Authority oversees the buildout, deployment, and operation of FirstNet, making sure it delivers what public safety needs from a network. FirstNet fulfills a fundamental need of the public safety community and evolved from a key recommendation of the 9/11 Commission report and is built through a private-public partnership with AT&T. The network’s initial five-year buildout was launched in 2018.

The President’s November 28, 2011, memorandum, Managing Government Records, emphasizes the importance of records management reform across federal agencies. It mandates that agency leadership prioritize compliance with records management requirements outlined in law, regulation, and the memorandum itself. Beginning with the 2010 federal budget, the Office of Management and Budget (OMB) has urged IT managers to adopt secure, reliable, and cost-effective enterprise electronic records management systems wherever feasible. OMB Circular A-130 and the Managing Government Records Directive (M-12-18) require all federal agencies to transition to electronic recordkeeping, ensuring compliance with government-wide requirements and enabling eventual transfer of permanent records to the National Archives and Records Administration (NARA) in electronic format.

In NARA Bulletin 2008-07, the Department of Defense (DoD) Electronic Records Management Software Applications Design Criteria Standard (DoD 5015.2-STD) was endorsed as the standard for electronic records management systems, referred to as RMAs. This standard aligns with NARA’s requirements for transferring permanent electronic records, and its endorsement remains in effect at the time of this PWS.

The purpose of this contract is to deliver a compliant RMA solution in accordance with OMB Circular A-130 and Directive M-12-18. This solution will enable the agency to efficiently transition to electronic records management, enhance compliance with federal standards, and support the preservation of permanent records for transfer to NARA. By implementing this solution, the agency seeks to achieve greater innovation, efficiency, and reliability in its records management practices.

1.2 Objective

The objective of this contract is to acquire and implement a Commercially available Off-the-Shelf (COTS) FedRAMP Authorized cloud-based RMA that ensures compliance with federal regulations and NARA standards. The solution should leverage advanced technologies, including automation and machine learning, to streamline records management processes while minimizing the impact on the FirstNet Authority’s productivity. The RMA should operate near-autonomously post-implementation, reducing the need for in-house maintenance and enabling staff to remain focused on their mission.

PWS for RMA Support Services, Page 5 of 15

This contract will support the FirstNet Authority’s mission by enhancing operational efficiency, ensuring regulatory compliance, and safeguarding organizational records for future access and transfer. By integrating a scalable, secure, and innovative RMA, the agency will strengthen its ability to manage critical information while maintaining focus on its core objectives of advancing public safety communications.

1.3 Scope of Work

The Contractor must provide all resources necessary to accomplish the tasks and deliverables outlined in this PWS. The Contractor must 1) provide automatic identification and classification of records; 2) provide role-based functionality with customizable levels of access; 3) enable record search, retrieval, and reporting; 4) identify and record metadata; 5) support record disposition; 6) execute all performance requirements within FirstNet Authority’s Microsoft G5 environment; 7) facilitate litigation holds; 8) provide RMA technical assistance and integration support; and 9) provide training support.

1.4 Period of Performance

The period of performance of this contract is one base period from the date of award, with three (3) option periods anticipated as follows:

Base Period: 06/10/2025 – 06/09/2026 Option Period One: 06/10/2026 – 06/09/2027 Option Period Two: 06/10/2027 – 06/09/2028 Option Period Three: 06/10/2028 – 06/09/2029 Option Period Four: 06/10/2029 – 06/09/2030

1.7 Place of Performance

The place of performance for this contract will be remote, with all work performed off-site at the Contractor’s location.

1.8. Applicable Documents

- PWS Attachment 1: Performance Requirements Summary

- PWS Attachment 2: Quality Assurance Surveillance Plan

- OMB Circular A-130

- Managing Government Records Directive (M-12-18)

- NARA Bulletin 2008-07

- DoD 5015.2-STD

- NARA Bulletin 2015-04

- NARA GRS 6.1

PWS for RMA Support Services, Page 6 of 15

- Department of Commerce (DoC) Supply Chain Risk Assessment Template

2.0 Specific Requirements/Tasks

The Contractor shall execute all task areas, task objectives and related performance objectives listed below.

2.1 TASK 1: Automatic Identification and Classification of Records

Task objective: To classify (categorize), store (keep in a secure location), retrieve, archive (store for long-term use), and dispose of FirstNet Authority electronic records.

• The RMA must accurately input and apply rules from the FirstNet Authority File Plan, NARA General Records Schedule (GRS), and FirstNet Authority NARA-Approved Records Schedule, ensuring all records management activities align with these guidelines.

• The RMA must classify records using the FirstNet Authority File Plan and automatically assign retention rules, including retention durations, to all identified records upon creation or capture.

• The RMA must classify records and assign retention durations in full compliance with the GRS and the FirstNet Authority NARA-Approved Records Schedule, ensuring consistent and accurate records management practices.

• The RMA must automatically identify records at the point of creation and assign appropriate retention characteristics without requiring additional user input or actions.

• The RMA must notify the Records Manager of records approaching their disposal date in a timely manner, ensuring compliance with retention and disposal schedules.

2.2 TASK 2: Role-Based Access

Task objective: To provide role-based functionality with customizable levels of access depending on user role.

• The RMA must provide Records Liaison Officers (RLOs) with role-based functionality that allows users from designated Mission Units (MUs) to monitor and administer records exclusively within their assigned areas of responsibility.

• The RMA must enable the Records Manager to monitor and administer all FirstNet Authority records across the organization, ensuring oversight and compliance with records management policies.

• The RMA must provide the System Administrator with the ability to monitor and administer all FirstNet Authority records, as well as configure and manage all aspects of the RMA system, ensuring full system operability and customizability.

2.3 TASK 3: Record Search, Retrieval, and Reporting

PWS for RMA Support Services, Page 7 of 15

Task objective: To enable users to search for records, retrieve stored records, and report on record data.

• The RMA must enable users to search for records with results limited by their assigned roles. Records Liaison Officers (RLOs) must only see results within their areas of responsibility, while Administrators, including the Records Manager, must have access to results from the entire collection of records.

• The RMA must provide retrieval capabilities aligned with user roles. RLOs must only retrieve records within their areas of responsibility, while Administrators, including the Records Manager, must retrieve records from the entire collection of records.

• The RMA must enable users to generate customizable reports detailing record storage, retention schedules, transfers to NARA, and deletions within a user-specified timeframe, presented in a structured and comprehensible format.

• The RMA must generate reports in a user-readable Portable Document Format (PDF) to support review and archival requirements.

• The RMA must generate reports in machine-readable formats, including Microsoft Excel (XLSX) and comma-delimited (CSV), to support data analysis and integration with other systems.

2.4 TASK 4: Record Metadata

Task objective: To identify metadata within permanent records.

• The RMA must automatically identify and associate metadata with permanent records in compliance with the seven NARA required metadata elements as outlined in NARA Bulletin 2015-04.

2.5 TASK 5: Record Disposition

Task objective: To support record disposition per record classification.

• The RMA must ensure that temporary records are permanently disposed of in accordance with their assigned retention schedules at the end of their retention periods.

• The RMA must facilitate the transfer of permanent records to NARA in compliance with their assigned retention schedules at the end of their retention periods.

• The RMA must ensure that all records transferred to NARA are formatted in the required Portable Document Format (PDF) to meet

NARA standards.

2.6 TASK 6: Record Environment

PWS for RMA Support Services, Page 8 of 15

Task objective: To execute all performance requirements within FirstNet Authority’s Microsoft G5 environment.

• The RMA must manage records within the FirstNet Authority’s Microsoft SharePoint environment in compliance with all applicable performance requirements.

• The RMA must manage emails generated by Capstone Officials in Microsoft Outlook in accordance with all applicable performance requirements.

• The RMA must recognize, and process file formats created by Microsoft productivity software (e.g., Word, Excel, PowerPoint) in compliance with all applicable performance requirements.

• The RMA must recognize and process PDF documents in compliance with all applicable performance requirements.

• The Contractor must provide a detailed license report or Government-accessible console listing the number of licenses in use, the number purchased, and the dates of coverage.

• The Contractor must provide a comprehensive Security Authorization Package that includes the following components: Secure

Software Attestation Memo; FedRAMP Readiness Assessment*; FedRAMP Full Security Assessment*; System Security Plan (SSP); Security Assessment Report (SAR); Plan of Action and Milestones (POAMs); Security Technical Implementation Guides (STIG) Compliance Scans; All SP 800-53 Rev 5 Artifacts in accordance with FedRAMP/NIST standards; Compliance with DOC Enterprise Cybersecurity Policy section 2.8; Control Implementation Summary (CIS); Customer Responsibility Matrix (CRM).

* Documents must be available upon request starting at Date of Award.

• The Contractor must provide a complete and thorough Supply Chain Risk Assessment in compliance with DoC requirements.

• The Contractor must provide the FirstNet Authority’s Authority to Operate (ATO) listing on FedRAMP. This documentation will be supplied by the Information Systems Security Officer (ISSO) once the contract is awarded to grant the FirstNet Authority permanent access to FedRAMP documentation.

• The Contractor must provide a Unique Identification Number or Support Identification Number for all applicable systems and services.

• The Contractor must provide configuration information that includes, but is not limited to, the following elements: How to access the RMA solution; how to administer data storage within the RMA solution; how to administer the RMA solution within the FirstNet Authority network environment; how to define access control within the RMA solution; how to incorporate FirstNet Authority File Plans within the RMA solution; how to add records to the RMA solution; how to set Retention Policies within the RMA solution;

how to delete records within the RMA solution; how to set up notifications for the Records Manager within the RMA solution; and how to transfer records to NARA from the RMA solution.

PWS for RMA Support Services, Page 9 of 15

2.7 TASK 7: Litigation Hold

Task objective: To facilitate litigation holds upon records on demand.

• The RMA must temporarily override standard record retention rules upon initiation of a Litigation Hold command, ensuring affected records are preserved.

• The RMA must allow authorized users to manually enter specific time frames for the duration of a Litigation Hold.

• The RMA must automatically reapply standard retention rules to records once a Litigation Hold is removed, ensuring compliance with established retention policies.

• The RMA must provide access to records under Litigation Hold exclusively to the Records Manager and the designated RLO from the FirstNet

Authority’s Office of Chief Counsel.

2.8 TASK 8: Implementation Support

Task objective: To provide technical assistance to the FirstNet Authority’s OCIO team in order to set up the RMA and integrate it within the FirstNet Authority’s environment.

• The Contractor must deliver comprehensive artifacts to the FirstNet Authority’s OCIO Operations and IT Security Divisions, including detailed descriptions of the RMA’s network architecture, system architecture, and security authorization package.

• The Contractor must collaborate with the FirstNet Authority’s OCIO team to successfully install and configure the RMA within the FirstNet Authority’s environment.

2.9 TASK 9: Training Support

Task objective: To provide hands-on training and training materials for all roles related to administration and use of the RMA.

• The Contractor must provide instructor-led training tailored to the Administrator, Records Manager, and RLO roles, confirming participants can use and manage the RMA within the FirstNet Authority environment.

• The Contractor must deliver detailed reference artifacts, including user guides and operational manuals, outlining proper usage of the RMA. These materials must remain accessible to the FirstNet Authority for the duration of the contract and include user Guides;

training Sessions; training guides; FAQs; software manuals; and any quick-reference guides for each role: RLO, RM, and Users (if User role exists).

3.0 Deliverables

PWS for RMA Support Services, Page 10 of 15

Submission of Deliverables

All project deliverables shall be submitted to the Contracting Officer’s Representative (COR) for formal delivery. The COR will review each deliverable and provide written comments regarding any necessary changes. The Contractor shall incorporate these changes into the final version. If extensive changes require a revised due date, the Contractor must negotiate this with the COR. The COR, acting under authority delegated by the Contracting Officer (CO), is responsible for reviewing and accepting all contract deliverables.

Review Times

Deliverables shall be reviewed and approved by the COR within ten (10) business days of receipt. The COR will discuss specific tasks with the Contractor to ensure objectives are clear and corrections are addressed within five (5) business days of notification.

Final drafts of deliverables shall be submitted electronically to the COR in the format specified upon award.

Deliverables

Notice to Contractors: All information and data related to this project that the Contractor gathers or obtains will be both protected from unauthorized release and considered the property of the government. The contracting officer will be the sole authorized official to release verbally or in writing any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract.

Press releases, marketing material, or any other printed or electronic documentation related to this project must not be publicized without the written approval of the contracting officer.]

Deliverable PWS Reference Format Submit to Due Date RMA Software licensing

2.6 Electronic COR Within sixty (60) days of

award

Security Authorization Package 2.6 Electronic COR Within sixty (60) days of award

DoC Supply Chain Risk Assessment

2.6 Electronic COR Within ninety (90) days

of award

FirstNet Authority’s FedRAMP ATO Listing

2.6 Electronic COR Within thirty (30) days

of FNA providing internal ATO

PWS for RMA Support Services, Page 11 of 15

RMA support identification number or unique identification number w/ software publisher and SaaS provider

2.6 Electronic COR Within sixty (60) days of

award

Configuration information 2.6 Electronic COR Within ninety (90) days of award

Network architecture diagram, system architecture diagram & dataflow diagram of all system data

2.8 .pdf COR Within sixty (60) days of award

Training Materials 2.9 .pdf COR Within one hundred and eighty (180) days of award

4.0 Travel

Travel is not anticipated during the performance of this contract.

5.0 Government Furnished Property (GFP)/ Equipment (GFE)

The Government will not provide GFP/ GFE during the performance of this contract.

6.0 Special Instructions and Other Information

6.1 Functional Requirements: The RMA solution shall support the following elements. Additional features may be provided but are not mandatory.

6.1.1 NARA Universal Electronic Records Management (ERM) Requirements (Partial):

The RMA must support the critical NARA Universal ERM Requirements as stated in the most recent spreadsheet available at the time of solicitation from https://www.archives.gov/records-mgmt/policy/universalermrequirements and is an attachment to this solicitation (nara-universal-erm-requirements-version3.xlsx). All Lifecycle and Transfer Format requirements stated as Must Have in this spreadsheet must be met by the RMA. All other requirements specified in the NARA ERM Requirements spreadsheet are non-mandatory.

6.1.2 DoD 5015.2-STD Compliance (Partial):

PWS for RMA Support Services, Page 12 of 15

The RMA must meet the mandatory requirements stated in DoD 5015.2-STD version 3:

CHAPTER 2 - MANDATORY REQUIREMENTS

CHAPTER 5 - TRANSFERS

All other requirements specified in DoD 5015.2-STD are non-mandatory. The standard is available at https://jitc.fhu.disa.mil/projects/rma/stdtesting.aspx and is an attachment to this solicitation (p50152stdapr07.pdf).

6.2 Non-Functional Requirements: The RMA solution must possess the following characteristics. Additional characteristics may be provided but are not mandatory.

6.2.1 Cloud-based FedRAMP Authorized SaaS:

The RMA must be provided as a cloud-based solution that has obtained and maintains a current FedRAMP Authorization. Solutions with a FedRAMP marketplace designation other than FedRAMP Authorized will not be considered.

6.2.2 FedRAMP Moderate Impact Level:

The RMA must be FedRAMP Authorized at a Moderate or higher impact level.

6.2.3 FedRAMP SaaS Service Model:

The RMA must be FedRAMP Authorized using a SaaS service model.

6.2.4 FedRAMP Authorization to Operate (ATO):

The RMA’s FedRAMP ATO must be active and maintained.

6.2.5 FedRAMP Artificial Intelligence (AI) Features and Services:

Any AI features or services associated with the SaaS must be part of the RMA’s FedRAMP Authorization.

6.2.6 FedRAMP End-to-End

If any associated software (e.g., Mobile App, Connectors, Client Management Utility, etc.) is not part of the RMA’s FedRAMP package, it must be vetted to meet FirstNet Authority IT Security standards in order touch FirstNet Authority data.

The FirstNet Authority vetting process consists of:

PWS for RMA Support Services, Page 13 of 15

• Software security scan and analysis by the FirstNet Authority Information Systems Security Officer (ISSO).

• Analysis and confirmation of Security Technical Implementation Guides (STIG) compliance by the ISSO and FirstNet Authority

Systems Operations team.

• An integrity check by the ISSO.

If any test failures or deficiencies are uncovered during the vetting process, the FirstNet Authority will work with the Contractor to provide remediation/Plan of Action and Milestones (POAM) and may request a waiver for the Authorizing Official (AO) to accept the risk. To identify the AO the Contractor will coordinate with the COR.

6.3 Availability: The RMA must support a minimum of four 9’s (99.99%) availability (52.60 minutes of downtime per year; 4.38 minutes per month).

6.3.1 Availability – Maintenance

Planned maintenance of the RMA may not affect the availability of services during FirstNet Authority normal business hours of 07:00 – 18:00 Eastern Standard Time, US.

6.4 Continuous Support: The RMA must include software updates, patches, maintenance, and any other support required to keep the RMA up-to-date and maintain its FedRAMP Authorized designation.

6.4.1 Continuous Support – Update Coordination

The FirstNet Authority’s OCIO must be made aware of upcoming updates via the COR and or TPOC. Updates impacting the FirstNet Authority’s data must go through the FirstNet Authority OCIO change control process prior to being applied.

6.4.2 Continuous Support – Vulnerability Management

The FirstNet Authority’s COR and or TPOC must be notified regarding any software changes in service of vulnerability management prior to implementation.

6.4.3 Continuous Support – Technical Support

The Contractor shall provide technical support and maintenance services that include monitoring of reported issues; classification of issues;

triaging of issues; request and problem tracking through to resolution; and general help desk assistance for the life of the contract.

PWS for RMA Support Services, Page 14 of 15

6.5 Logging and Monitoring: The RMA must provide the ability for the FirstNet Authority’s OCIO personnel to pull audit logs. The FirstNet Authority security management solutions – currently Splunk and Zscaler – must be able to perform their tasks.

6.6 Internet Protocol Version 6 (IPv6) Compatibility: The FirstNet Authority is transitioning from a blended Internet Protocol Version 4 (IPv4) and IPv6 environment to a full IPv6-only environment. The RMA must be IPv6 compatible with an IPv6-only source.

6.7 Data Ownership: The FirstNet Authority retains ownership of all data touched by the RMA. The FirstNet Authority data may not be used for anything outside the scope of the FirstNet Authority records management. Prohibited use-cases include but are not limited to: Demonstration to other clients/consumers of the RMA software; Training of Artificial Intelligence (AI).

Upon termination of this contract and at any time during this contract with five (5) days' notice to the awardee, all data will be transferred to a FirstNet Authority-specified system in a format that is acceptable to the FirstNet Authority specified in the Data Export section below. Upon final data transfer, after verification and validation of data integrity, all data residing on the RMA systems shall be deleted. Confirmation of deletion will be provided to the FirstNet Authority upon request.

6.8 Data Export: The RMA must support the ability to export all FirstNet Authority data into a recognized open data format within sixty (60) calendar days of request from the Government

6.9 Data Location: The FirstNet Authority data may not travel outside of the continental United States, Alaska, Hawaii, and U.S. Territories.

6.10 The FirstNet Authority Environment: The FirstNet Authority's federal record collection resides primarily on the authority's Microsoft O365 for Government SharePoint repository space. Email – both clear and encrypted/secured – has been the main method of record transmission internally and externally. While FirstNet Authority's records also reside on government furnished computer hardware, mobile devices, Microsoft OneDrive, CRM Dynamics, Box cloud content management, and the Microsoft Azure cloud; managing records in SharePoint and email will be the principal task of the RMA solution.

6.10.1 The FirstNet Authority Environment – Records Volume

The FirstNet Authority maintains a total data storage capacity of approximately 12 terabytes (TB), of which 9.3 TB are utilized at the time of this solicitation. The volume of data created and transmitted monthly is approximately 0.2 TB. A small percentage of this data is information that will require non-duplication, categorization, review, time-based retention, and possible transfer to NARA over the next four years. Not all documents within that dataset will qualify as records. There are currently less than one (1) million individual records.

6.10.2 The FirstNet Authority Environment – Records Classification

The FirstNet Authority currently creates and maintains over 150 types of records (record series).

PWS for RMA Support Services, Page 15 of 15

6.10.3 The FirstNet Authority Environment – Email and Communications

The FirstNet Authority electronic messaging (email) infrastructure is hosted in the cloud on Microsoft O365 for Government's Outlook enterprise email application. FirstNet Authority also utilizes Microsoft Teams for electronic chat, bulletin boards, wiki, and instant messaging.

6.10.4 The FirstNet Authority Environment – Current State of Records at FirstNet Authority

FirstNet Authority has an approved agency Records Control Schedule from NARA and utilizes the General Records Schedule. The current state of records at FirstNet Authority is as follows:

• File records are mixed with non-records in the same folders on SharePoint and Microsoft Teams.

• There are no universally applied naming conventions for files or folders across any FirstNet Authority file storage system.

• Records are still being identified for each record's series based on the approved records schedules.

• There are no content types, metadata, or taxonomies defined or applied.

• Documents stored on SharePoint may have incorrect dates due to migration from other file storage systems. As such, document dates are not a reliable source for determining a record's retention period.

• Records in texts, social media, and blogs are not currently managed by software.

The FirstNet Authority has dedicated one full-time resource to Records Management with all other roles intended to be adjunct to primary duties.

6.10.5 The FirstNet Authority Environment – Capstone Officials (CapO)

The FirstNet Authority has designated CapOs whose email communications must be managed per NARA GRS 6.1, Email and Other Electronic Messages Managed under a Capstone Approach. To identify the (CapO(s)) the Contractor will coordinate with the COR.