Attachement 1 - Statement of Work.pdf

CUI//SP-PROCURE

Controlled by: United States Patent and Trademark Office, OCAO, RICPO, 571-272-9990

United States Patent and Trademark Office (USPTO) Artificial Intelligence (AI) Driven Image Search Tool

Software as a Service (SaaS) Draft Statement of Work (SOW)

Patents Only July 11, 2023

Contents

1. Patent

1.1 Patent Background

1.2 Patent Purpose

1.3 Scope of Project

1.4 Patent Product Requirements

1.4.1 AI-powered image search tool

1.4.2 Usage Pilot Requirements

1.4.3 Launch Requirements

1.5 Additional Requirements

1.5.1 Transition In Plan

1.5.2 Transition Out Plan

1.5.3 Privacy Requirements

2. Software as a Service Availability, Responsiveness, and Incident Service Level Agreements (SLAs) .12

3. Training Requirements

4. Metrics Requirements

5. Terms and Conditions on Privacy and Retention for Non-public Data Requirements

6. Vendor Point of Contact

7. Cybersecurity Requirements

8. FedRAMP and Authorization to Operate (ATO)

8.1 Lightweight Authorization to Operate (LATO)

8.2 Authority to Operate (ATO)

Revision Number Description

1. Patent

1.1 Patent Background

The United States Patent and Trademark Office (USPTO) is the Federal Agency for granting U.S. patents and registering trademarks. By granting patents, the USPTO fulfills the mandate of Article I, Section 8, Clause 8, of the Constitution that the legislative branch "promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries." The USPTO registers trademarks based on the commerce clause of the Constitution (Article I, Section 8, Clause 3). The USPTO carries out its mission by examining patent and trademark applications, issuing patents and registering trademarks, disseminating patent and trademark information to the public, and by encouraging a domestic and international climate in which intellectual property can flourish.

The USPTO is guided by the Code of Federal Regulations (e.g., 37 C.F.R. 1.104(a)) which sets forth the requirement that upon taking up an application for examination, patent examiners shall make a thorough study and a thorough investigation of the available prior art relating to the subject matter of the claimed invention. Section 1.104(a) of title 37, Code of Federal Regulations states an international type of search will be made in all national applications. The USPTO is tasked to provide patent examiners with resources to study and investigate available prior art and legal issues relating to the subject matter of the patent application.

“Design patent prosecution” refers to the series of interactions between inventors, practitioners, and Design Patent Examiners that can result in a design patent. When the Applicant submits their ornamental design for an article of manufacture, the USPTO assigns a Design Patent Examiner to review the application disclosure and claim to determine whether to grant a design patent. One of the most important tasks of the Design Patent Examiner is to substantively review what is disclosed in the application and compare it to the already existing references called prior art. "Prior art" is defined as all information that has been made available to the public in any form before a given date that might be relevant to a design patent application's claim of novelty and non-obviousness.

1.2 Patent Purpose

The USPTO has determined there is a need to acquire capabilities for examiners working on patent applications to search images in design databases by using images as a query (hereinafter referred to as image searching) using artificial intelligence (AI) technologies. The USPTO conducted market research to assess the maturity of AI technologies as they specifically relate to image searching during patent application prosecution and assess vendor capabilities. The USPTO is seeking access to the vendor’s AI-driven image searching tool to support the examiner search for patent applications. This tool will not replace any tools that USPTO currently provides to Patent Examiners.

The vendor shall aggregate Industrial Design collections with unlimited searches for Government use to support the USPTO’s requirements to examine patent applications. The Government will record the search journal and search results as permanent document within the file wrapper of patent applications.

Additionally, the vendor shall provide access to the Industrial Design collections with a tool that uses image(s) as a query. The vendor shall provide details on which capabilities of the tool are driven by AI.

Government Use includes use by USPTO employees, vendors, and anyone authorized by USPTO.

The vendor shall supply a Software as a Service (SaaS) tool that aids and enhances USPTO examiners’ image search capabilities.

1.3 Scope of Project

The vendor shall provide USPTO users a SaaS AI driven image search tool. The vendor shall provide usage data and metrics to the USPTO, develop, maintain, and operate IT infrastructure necessary to meet security, performance, and compliance, and provide documentation to support training of USPTO users as set forth herein.

The vendor must deliver a FedRAMP certified SaaS solution for an AI search tool. If the vendor is not yet FedRAMP certified, the vendor must do the following:

1. Obtain FedRAMP ready status for the software via a FedRAMP readiness assessment and provide a copy of the FedRAMP readiness report to the USPTO. This shall include a draft FedRAMP System Security and Privacy Plan and Customer Responsibility Matrix. The vendor shall host the software via a third party FedRAMP authorized service provider within the United States. It is required for the vendor to host the software via third party FedRAMP authorized service providers within the United States. These potential providers can be but are not limited to Amazon Web Services (AWS), Google Cloud Platform, or Microsoft Azure Cloud.

2. Work with the USPTO to obtain a USPTO Lightweight Authority to Operate in support of pilot goals, as outlined below. Lightweight Authority to Operate is required for production operation of a pilot and includes USPTO review of the FedRAMP ready package and a USPTO System Security and Privacy Plan that documents the controls for which the USPTO is responsible for according to the Customer Responsibility Matrix.

3. Achieve FedRAMP authorization within 365 calendar days of being FedRAMP Ready or within 365 calendar days of completed USPTO acquisition, whichever is earlier. This includes collaborating with the USPTO product team (System Owner and Information System Security Officer) and the FedRAMP Program Management Office (PMO) throughout the FedRAMP process.

4. Upon FedRAMP authorization, the vendor shall collaborate with the USPTO product team to complete the full USPTO System Security and Privacy Plan to obtain a USPTO Authority to Operate. Full Authority to Operate is required for USPTO to use enterprise licenses in production. See section 3 below for full Authority to Operate requirements.

1.4 Patent Product Requirements

The vendor shall provide access, search, and retrieval of information from databases and other electronic publications and make available through the vendor’s search interface. Access shall be controlled in accordance with USPTO policies and procedures. USPTO employees and USPTO contractors can search, retrieve, and save content provided by the AI-powered image search tool in accordance with USPTO procedures.

As a federal agency, it is important for the USPTO to be able to explain all patent prosecution decisions made. Because of this, solution capabilities must be transparent to the USPTO and as well as to the general public. The USPTO requires an AI solution that complies with Executive Order (EO) 13960 and deviations will not be accepted. The USPTO must be able to explain and generate a full and clear record to explain how prosecution decisions are made. Examination augmented by an automated decision process must therefore ensure full algorithmic transparency to ensure that any proposed algorithmic option is fully explainable, free of bias, and transparent to the public.

1.4.1 AI-powered image search tool

Single search interface (e.g. portal or gateway)

The vendor shall provide a single search interface (e.g. portal or gateway) to information resources in a wide array of formats via communications links to disparate information retrieval systems. The interface shall provide centralized access and federated searching of across aggregated collections, provided by the vendor, as set forth herein. The interface shall provide a common interface or command language for integrated searching across disparate information retrieval systems. The vendor shall combine content from across aggregated collections and provide the USPTO with a unified view of and access to that content. The vendor shall not change or modify the layout or functionality, expect for bug fixes, Operations & Maintenance, and routine Machine Learning Operations (MLOps) to sustain the AI models;

any such changes or modification shall be made only after written approval from the COR.

The vendor shall provide access, search, and retrieval of information from databases and other electronic publications and made available through the vendor’s search interface. Access shall be controlled through Internet Protocol (IP) addresses for single sign on for USPTO users by leveraging USPTO’s Identity Authentication and Authorization Management (IAAM) system. USPTO employees, USPTO contractor employees, and USPTO-authorized personnel can search and retrieve content on-demand, view content on their desktop, and download or print content in a variety of record formats.

1. Functional Requirements

a) The tool compares uploaded images, including images from unpublished design applications, with available databases and yields image results based on similarity and sortable by similarity.

2. Database Requirements/Functions

a) Available databases include access to design patents, registrations, trademarks, and industrial designs from global Intellectual Property offices including at least the following 64 countries/authorities: Albania, Argentina, ARIPO, Austria, Benelux, Bosnia and Herzegovina, Brazil, Brunei Darussalam, Bulgaria, Cambodia, Canada, Chile, China, Colombia, Costa Rica, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Europe (EUIPO), Finland, France, Georgia, Germany, Great Britain, Greece, Honduras, Hungary, Iceland, India, Ireland, Italy, Japan, Jordan, Laos, Latvia, Lithuania, Macedonia, Malta, Mexico, Moldova, Morocco, New Zealand, Norway, Peru, Philippines, Poland, Portugal, Romania, Russia, San Marino, Serbia, Slovakia, Slovenia, South Korea, Spain, Sweden, Switzerland, Tunisia, Turkey, United States, Uruguay, and World Intellectual Property Organization (WIPO). Acceptable in addition are; Australia, Macao, Hong Kong, Mongolia, and Taiwan.

b) The filing and publication dates associated with the image results must be reliable and accurate based on publication data from countries/authorities listed in available databases.

c) The available databases shall be updated with new documents at least once a week in alignment with the USPTO Patent publication cycle and become searchable with the image searching functionality.

d) The vendor shall notify the USPTO of any proposed changes to the available databases for approval. Any additional countries or authorities added to the available databases must comply with the requirements identified in this section.

3. Imaging Requirements

a) Access to a live link of original authoritative source of the image from the specific global Intellectual Property Office the document was made available by in order to obtain best possible quality of the image.

b) Upload multiple image views to the AI search tool with user-controlled weighting of visual features on user defined critical view. The tool must further provide:

• An enhance selection tool, or partial selection tool, of an image to identify specific visual features or region(s) within a source image to search. (i.e. lasso feature, automatic lasso based on input image outline).

• Images uploaded for query can be automatically lassoed to focus on the image outline and the lasso can be adjusted by the user. Areas outside of the lasso are not included in the query.

• Ability to rotate images in a result set and in a query.

• Ability to deploy photo-to-line conversion to create line drawing images for use in an image search.

• Ability to quickly deselect an image in order to maintain efficiency by eliminating the creation of a separate, user-entered query and providing rapid re-ranking (re-sorting) of results.

• Acceptable image formats for uploading should include but are not limited to jpeg, gif, png, bmp, tif, or pdf.

• A range of 1 to 7 images can be uploaded into the tool to simultaneously search. When multiple images are uploaded, user has ability to select or deselect the 1 to 7 images utilized to execute a search query. The user must be able to add additional images to the search query after initial images have been selected and uploaded, without having to reload the initial images.

c) The tool provides image quality and resolution that matches source image data from each IP office in the available databases.

4. User Interface Requirements

a) UI Layout

• The tool has a top banner with at least new search and profile dropdown with search, account, user guide, terms of use, help, and logout.

• The tool must save layout preferences as set by user so that upon return to product, preferences such as views, image size, etc. need not be changed each time

b) UI Functional Requirements

• The tool includes an ability to collapse all documents within a patent family through related patent/registration documents into a single copy in a query result set.

• The tool includes an ability to collapse all documents through the same inventor or owner and an exact image match into a single copy in a query result set.

• Ability to increase or decrease the size of the thumbnail views in the search results window.

• User ability to select view of images in search results. These views include thumbnail, detailed list, and list image which displays all figures in document.

• The most comprehensive image representative from the source document should be displayed in the thumbnail view, i.e. the image most relevant to the uploaded images searched.

• The tool provides an ability to set personal viewing preferences and allowing the results to be viewed in a variety of sizes.

• When selected, thumbnail view has ability to enlarge or shrink the image within the view with a slider tool bar or equivalent.

• Ability to utilize magnifying glass feature to at least 2x and 4x ability.

• When zooming in or out (enlarging, magnifying, shrinking, etc.) on the image, the image quality and resolution of the image shall not be degraded.

5. Search Requirements

a) The interface includes advanced options such as filters for text, datasets, databases, owner, file date range, classification code, application number, patent number, and registration status. These features are used to enhance and refine the search at the time of image upload. However, it is not mandatory that these fields be filled for the search to occur.

b) The tool allows users to see additional data from the source document when user hovers or clicks mouse pointer over the thumbnail in the results view. This information includes application number, patent number, registration number, design description, status, file date, publication date, agent, owner, and classification and create a larger view to quickly analyze design characteristics without clicking to open the individual image file.

c) Results of query should be tagged (with symbol and color) to indicate match type (i.e. exact, similar, other, or the refined indicator).

d) Search results must be able to select and change views (i.e. detailed view, thumbnail view, and multiple figure view for an individual application view) of the search results.

e) The tool shall provide options to filter search results at least by classification, text, publication date, drawing view, country, and source.

f) The tool shall provide the ability to provide the United States Patent Classification (USPC) design specific designation, Locarno, Derwent and suggested Cooperative Patent Classification (CPC) based on images. The rollover text shows classification information and definitions in various classification systems (USPC, Locarno, CPC and Derwent).

g) The search results screen must be able to further refine or expand the search by selecting or deselecting images, add another image, text search, Locarno classification drop down, suggested Locarno/USPC codes with definitions, advanced options feature, and projects feature.

h) Support internal collaboration tools for Patent Examiners such as it enhances ability to share searches and search histories between users as well as modify and categorize data (set by the user) for the purpose of sharing. The tool includes a web-based user interface with a project feature to save searches locally after search results are generated.

6. Project features include:

a) On projects tab under profile, ability to sort projects by date and alphabetically as well as a search button to search all projects (personal and company).

b) The projects can only be modified by the creator or management.

c) The projects can be identified by the image and textual description used for the query.

d) The user has the ability to not share one of their personal projects to the company tab.

e) The company tab name shall be set to the United States Patent and Trademark Office, TC 2900.

f) On search history tab under profile, ability to sort projects by date, alphabetically, etc. as well as a search button to search all projects (personal and company).

g) The search history can only be modified by the individual user or USPTO management.

h) Projects and Search history magnifying glass is available to quickly generate the saved search.

7. Web-based User Interfaces Export Requirements: In order to provide a complete, accurate, and uniform record of what has been searched and considered by the examiner for each application, the USPTO has established procedures for recording search data in the application file. Such a record is of importance to anyone evaluating the strength and validity of a patent, particularly if the patent is involved in litigation (MPEP 719.05). The following functionality will enable the USPTO to appropriately capture search history (“Search History”):

a) Ability for user to maintain report feature to create a customized exportable search report with options of selected results, displayed results, or top 2,000 results). The report must have export options of printing, pdf creation, or spreadsheet creation.

b) capture and export search history documents with publicly available sufficient detail for providing the public with a full disclosure of completed search.

c) When the examiner initiates export of the search results, the UI must first give a warning message that if the images uploaded are part of an unpublished or redacted application, other than the application for which the current search is conducted, or come under trade secret or other confidential information as explained in MPEP 724, the information must be redacted and request the user to proceed accordingly.

• The UI must further prompt the user to identify specific input images that fall under this confidential information. Once the user selects these images, the UI must redact such images from the search history report. Warning messages need to be incorporated as necessary to implement this feature. This feature must be specifically demonstrated to and approved by the COR.

• If the examiner does not have redactions, the input images must be included in the search history report export.

d) The export must contain information including text inputs, classification filters, and results returned to user.

e) The information must be selectable so that proprietary information may be removed from the export by including:

• The ability to select various thumbnail results and report and export (Excel, PDF, Word, Etc.)

out of these selected items together versus having to produce a report for everyone.

• Ability to group multiple different, but similar, designs and perform a “batch search” and categorize results specific to the individual designs.

• Being able to categorize results in a folder system in order to keep tabs on results for multiple applications searched.

1.4.2 Usage Pilot Requirements

USPTO requires up to twenty (20) Pilot SaaS licenses after the approval of a Lightweight Authority to Operate (LATO) for usage pilot. Initiation of this usage pilot requires a FedRAMP cloud servicer prior to commencing. In this pilot program it is expected that the licenses provided to USPTO to be fully functioning to the specifications laid out in the “Patent Product Requirements” section. In addition, the data used during this phase will be limited to public patent data. No unpublished patent data will be use prior to FedRAMP and Full ATO approval. The usage pilot shall extend until vendor achieves the following requirements:

• Full Authority to Operate (ATO); and

• Demonstrated compliance with Service Level Agreements (SLAs) as set forth in section

“Software as a Service Availability and Responsiveness and Service Level Agreements” and “Support Requirements” herein during the full month immediately preceding attainment of Full Authority to Operate.

• Implementation of refinements to metrics requirements set by the COR as described in Section 3 below.

• Provides updates to user interface of the tool as requested by USPTO during the pilot to improve user experience.

While the pilot is being conducted, the vendor is expected to provide monthly usage metrics on user findings as set forth in the “Metrics Requirements” section herein and one (1) status meetings per month, subject to change.

1.4.3 Launch Requirements

USPTO is looking to release this tool to the examiners after FedRAMP and ATO approval.

If we are still in the pilot phase, then the vendor will immediately provide up to three hundred - eighty

(380) user licenses once they receive authorization from the CO. The vendor shall have 30 calendar days to perform this transition.

1.5 Additional Requirements

1.5.1 Transition In Plan

The vendor shall provide a Transition In plan at least five business days before the kick-off meeting, which will be reviewed and updated by the COR.

The updated plan shall be finalized at the kick-off meeting and this SOW shall incorporate the finalized Transition In plan.

The vendor shall follow the procedure outlined in the Transition In plan as part of the service launch and obtain COR written approval prior to and after conclusion of the Transition In.

1.5.2 Transition Out Plan

The vendor shall provide a Transition Out plan at least five business days before the kick-off meeting, which will be reviewed and updated by the COR.

The updated plan shall be finalized at the kick-off meeting and this SOW shall incorporate the finalized Transition Out plan.

The vendor shall follow the procedure outlined in the Transition Out plan with written approvals from the COR prior to and after conclusion of the Transition Out phase of the service termination.

1.5.3 Privacy Requirements

• Restricting PII when Search History reports (defined in Section 1.5.1, item 7 above) are originated from USPTO

• All vendor employees, including sub-vendors and 3rd party partners, that have access to USPTO data must be US. Citizens. No data received by the vendor from the USPTO may be used without USPTO Contracting Officer’s (CO) written consent identifying the specific information that will be used. Work by green card holders shall only be performed in the CONUS.

• PTO-4 REPRODUCTION AND DISCLOSURE OF CONFIDENTIAL DATA – Secrecy and use of Patent Information

• The cloud service provider must host the tool within the United States.

• Personal Identifiable Information (PII), Business Identifiable Information (BII), and other confidential data, including patent application information, belonging to USPTO must not be exported/transferred and/or used outside continental U.S.

2. Software as a Service Availability, Responsiveness, and Incident Service Level Agreements (SLAs)

The vendor’s provided system shall be accessed, and search results delivered via the Internet/Web. The system shall allow for all USPTO licenses to access simultaneously. The system shall be available 24 hours a day, 7 days a week except for allowed pre-scheduled maintenance performed between the period beginning Sunday 12:01 AM to 5:00 AM Eastern Standard Time or as approved by the USPTO COR. There shall be no downtime during the “quiet period” of elevated USPTO activities, defined as September 1 through October 1.

The vendor shall provide written reports regarding the vendor’s compliance with the service level agreement (SLA) specified for this system availability requirement. System Availability Service Levels and System Responsiveness Service Levels include the set of SLAs related to customer support provided by the vendor. The following minimum service levels are required. The Contractor shall meet or exceed the following service support SLAs:

Service Level System Availability Service Level

Description Percentage of time which the vendors tool and portal/site is available with full/ally functionality as specified within the SOW and normal business operations can be carried out with no data loss, minimal downtime, or performance degradation.

Availability is defined as the time during which the vendor tool and portal/site is available with full/ally functionality as specified below and normal business operations can be carried out with no data loss, minimal downtime, or performance degradation.

Pre-scheduled downtime requirements

All pre-scheduled maintenance shall be performed between the period beginning Sunday 12:01 AM to 5:00 AM Eastern Standard Time, or as determined by COR with a written approval notice.

Downtime due to planned maintenance should be limited to less than eight (8) hours per year.

There shall be no downtime during the “quiet period” of elevated USPTO activities, defined as September 1 through October 1.

Formula [(Actual Uptime plus Excusable Downtime during the Measurement Interval) divided by (Scheduled Hours during the Measurement Interval)] multiplied by 100 %] = [percentage of Availability of the Contractor Portal or Database]

Target Performance The quality of service, consistent with an average of 99.9% up-time per year, with the 0.1% down-time including scheduled maintenance and repairs performed at a time to minimize inconvenience to the Subscriber and its Authorized Users, and to restore service as soon as possible in the event of an interruption or suspension of service.

Performance Requirement

99.9%

Measurement Interval Monthly

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System (CPARS) report. Additionally, failure to meet the Acceptable

Quality Levels may result in adjustments made to the payment and/or recuperation of fees.

Service Level System Responsiveness Service Level

The system shall meet the following SLA performance requirements for all simultaneous users.

Open home page of system

Required load time <= 1 second.

Search query execution and display of results in selected view

Required load time <= 6 seconds.

Load of next page of search results upon scroll

Required load time <= 1 second.

Display of document upon selection from results view

Required load time <= 2 seconds.

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System (CPARS) report. Additionally, failure to meet the Acceptable Quality Levels may result in adjustments made to the payment and/or recuperation of fees.

The vendor shall provide a customer service telephone number and a customer service email address in order to field questions about the tool functionality from users and technical issues such as availability or performance reported from users. The vendor shall maintain an incident report noting the date and time of the question or reported issue, detail about the question or reported issue, and date and time of the question response or issue resolution. The vendor shall provide written reports regarding the vendor’s compliance with the service level agreement (SLA) specified for this service support. Service Support Service Levels include the set of SLAs related to customer support provided by the vendor. The following minimum service levels are required. The Contractor shall meet or exceed the following service support SLAs:

Service Level Incident Response and Resolution Service Level – Tool Accessibility

Description Tool accessibility issues are incidents that impact the ability of users to access the system including connectivity and system availability. The elapsed time from when the incident is alarmed or escalated from the Service Desk to the COR to the time the critical incident is responded to by the Contractor.

Formula [(Actual Uptime plus Excusable Downtime during the Measurement Interval)

Service Level Incident Response and Resolution Service Level – Tool Accessibility divided by (Scheduled Hours during the Measurement Interval)] multiplied by 100 %] = [percentage of Availability of the Contractor Portal or Database]

Target Performance 100% of customer support and technical assistance is provided in a timely and professional manner. Customer receives regular communication regarding progress to incident response.

Performance Requirement

99.9%: The Contractor shall provide immediate verbal notification of issues, and then in writing to the COR within 1 hour after the identification of the problem. The resolution to the problem/issue shall be 2 hours, unless longer deadline is agreed to in writing by the COR.

Measurement Interval Monthly

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System (CPARS) report. Additionally, failure to meet the Acceptable Quality Levels may result in adjustments made to the payment and/or recuperation of fees.

Service Level Incident Response and Resolution Service Level – Interface Issues

Description Interface issues are incidents that impact the user experience or functionality of the system. The elapsed time from when the incident is alarmed or escalated from the to the COR to the time the major incident is responded to by the Contractor.

Formula Number of instances within Performance Target ÷ Total number of instances during Measurement Interval Multiplied by 100% = “Percent (%) Attained”

Target Performance 100% of customer support and technical assistance is provided in a timely and professional manner. Customer receives regular communication regarding progress to incident response.

Performance Requirement

98.00%: Resolution to problem/issue shall be within 12 hours, unless longer deadline is agreed to in writing by the COR.

Measurement Interval Monthly

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System (CPARS) report. Additionally, failure to meet the Acceptable Quality Levels may result in adjustments made to the payment and/or recuperation of fees.

Service Level Incident Response and Resolution Service Level – Vendor Identified

Description The elapsed time from when the incident is alarmed or escalated from the Contractor to the COR. The Contractor is required to notify the COR upon discovery of any service level incidents impacting system functionality.

Formula Number of instances within Performance Target ÷ Total number of instances during Measurement Interval Multiplied by 100% = “Percent (%) Attained”

Target Performance 100% of reported technical assistance is provided in a timely and professional manner. Customer receives regular communication regarding progress to incident response.

Performance Requirement

98.00%: Resolution to problem/issue shall be within 12 hours, unless longer deadline is agreed to in writing by the COR.

Measurement Interval Monthly Effective Date Upon first use Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System (CPARS) report. Additionally, failure to meet the Acceptable Quality Levels may result in adjustments made to the payment and/or recuperation of fees.

3. Training Requirements

Patent Training Requirements:

The vendor shall provide training in the use of the system, including in-person (which may by video conference in order to support USPTO teleworking programs and nationwide workforce) and computer-based training as requested by the COR. The vendor shall provide an initial training course for up to fifty

(50) seats where training materials will be provided for Government usage. This training shall encompass everything a trainer will need to know to provide internal training.

If required by USPTO, training shall be tailored to address specific user needs. USPTO will collaborate with the vendor and provide guidance on the presentation and content of the training. The training shall include initial sessions for 1 hour to explain functionality of the image search tool and follow up sessions at later dates for 1 hour each to answer user questions. The training sessions will be scheduled by the USPTO to enable users multiple options for each of the sessions and include enough to support the total number of licenses. The initial training can be between 1-2 hours while the follow up shall be 1 hour only.

The vendor shall provide electronic manuals, quick reference guides, and other help files for specific USPTO needs. Paper copies of electronic manuals and other materials shall be provided, as requested by the Contracting Officer's Representative or the Technical PoC. All electronic manuals and materials shall be Section 508 compliant.

4. Metrics Requirements

In order to allow USPTO to analyze patterns in their usage, the vendor shall provide the Contracting Officer's Representative (COR) with electronic data about USPTO’s use of their products/services monthly or upon request from the CO or COR. The vendor shall update this usage data on at least a monthly basis. The usage data will be provided for both pilot and for launch and will at minimum shall include at least:

• Number of unique users;

• Number of sessions for each user;

• Length of each session;

• Number of queries for each user;

• Number of total search exports;

• Number of search exports per user with similarity and Cooperative Patent Classification (CPC) class/subclass indicators;

• Number of image imports;

• Number of image imports per user;

• Number and type of further refined searches for each image import;

• Number of documents exposed to each user in preview;

• Criteria used by users to fine-tune the search results;

• List of documents by patent number or registration number selected by each user for viewing. For each document selected, the data shall contain similarity indicator of “exact”, “similar”, and “other”;

• List of documents by patent number or registration number selected by each user for exporting.

For each document selected, the data shall contain similarity indicator of “exact”, “similar”, and “other”;

• Response rate for each query to load results; and

• Metrics for class/subclass, CPC, databases selected, and Locarno for each user and user base as a whole.

Details of formatting and data file of the report are to be agreed upon by the Vendor and the Contracting Officer's Representative (COR) at time of kick off meeting and subject to refinement at the conclusion of the pilot by the COR. The Vendor shall provide other ad-hoc reports as requested by the Contracting Officer's Representative or the Knowledge Management Point of Contact (KM PoC).

5. Terms and Conditions on Privacy and Retention for Non-public Data Requirements

Terms and Conditions on data privacy for non-public (35 U.S.C. § 122) data: Images uploaded for query are removed from systems upon completion of a user session (i.e. sign out, close browser, etc.). Any Government data, including 35 U.S.C. § 122 patent data, shall only be used for the stated purposes of this SOW as explicitly stated in the Order. Any Government data shall not be used in any way for current or future research, materials or work products.

6. Vendor Point of Contact

The vendor shall provide the COR in writing a primary single point of contact (POC) who shall serve as the USPTO contact for all claims, inquiries, and issue resolution within fourteen (14) business days after contract award. The vendor is required to provide a back-up point of contact in the event of the primary single point of contact's unavailability.

The vendor shall assign a customer service representative within fourteen (14) business days after contract award that works specifically with the USPTO account on a daily/on-demand basis and provide a toll-free number and an e-mail address for the assigned customer service representative.

The vendor shall notify the COR and CO immediately of all problems that impact or potentially impact the performance of this contract including any ordering, or invoicing. The Technical POC shall also be notified of any service issues. Such notifications shall be made verbally to the COR (or the Technical PoC if appropriate) as soon as possible, and then in writing within twenty-four (24) hours after the identification of the problem. Resolution to service issues shall be within twenty-four (24) hours, unless longer deadline is agreed to in writing by the COR (or the Technical PoC if appropriate)

7. Cybersecurity Requirements

1. Vendors (including sub-vendors) entering into an agreement for services to the U.S. Patent and Trademark Office (USPTO) and/or its Federal customers shall be contractually subject to all USPTO and Federal IT Security standards, policies, and reporting requirements. The vendor shall meet and comply with all applicable Federal, Department of Commerce (DOC), and USPTO laws, regulations, standards, policies, and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

2. The vendor shall comply with all applicable Federal Information Processing Standards (FIPS).

National Institute of Standards and Technology (NIST) Special Publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

3. The Vendor is hereby made to be aware that, all Information systems supporting USPTO must meet the minimum security and privacy requirements using security controls in accordance with NIST Special Publication 800-53, (Current Revision), “Security and Privacy Controls for Federal Information Systems and Organizations.”

4. The Vendor shall use USPTO technical guidelines, NIST guidelines, or industry best practice guidelines in hardening their systems.

5. All USPTO systems and Vendor systems used in the execution of the awarded contract and corresponding Task Orders must receive a full Authorization to Operate (ATO) from the USPTO Co-Authorizing Officials. The system must be re-authorized on an annual basis based on the completion of annual assessments and continuous monitoring activities. Any changes to the system after it have been authorized, must be assessed and documented in accordance with OMB Memo 10-15 and 12-20.

6. The Vendor shall appropriately address NIST SP 800-53 (Current Revision) controls, assisting

USPTO Cybersecurity Division, as necessary, to ensure security and privacy controls are in place and operating as intended.

7. The Vendor shall comply with security assessment and authorization (A&A) of all systems developed for support of the contract/task order in conformance with the standards set forth by the FISMA and NIST SP 800-37 (Current Revision), Risk Management Framework for Information Systems and Organizations.

8. Vendors for external contractor systems shall coordinate with an independent third-party assessment organization to perform initial and annual assessments to obtain and maintain their system authorization consistent with NIST SP 800-53/53A, NIST SP 800-30, and DOC and USPTO policies. An independent assessor is any individual or a team capable of conducting an impartial assessment of security and privacy controls employed within or inherited by an information system. Impartiality implies that security control assessors and privacy control assessors are free from any perceived or actual conflicts of interest with respect to the development, operation, and/or management of the information system or the determination of security or privacy control effectiveness.

9. Identified gaps between required NIST 800-53 controls and the vendor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document.

10. USPTO systems shall maintain a System Security and Privacy Plan (SSPP). SSPP updates will be made as material changes occur to the system operated and or maintained by the contractor with updates occurring no more than 7 calendar days from the time when changes are made to the system. The system must also have a contingency plan and must regularly perform contingency tests to ensure the proper actions are taken in the event that the system fails.

11. The Vendor shall work with Cybersecurity Division after award to gain further details, ensure each stage maintains the proper level of security, and track any future enhancements.

12. A Security Impact Analysis (SIA) and/or risk assessment shall be performed whenever there is a change (major or minor) to a system.

13. The vendor shall notify the responsible ISSO, CISO and USPTO Computer Incident Response

Team (CIRT) of any suspected incidents in a timely manner according to DOC/USPTO established guidelines and assist in the investigation of incidents as necessary.

14. As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104, if the system involves the design, development, or operation of a system of records on individuals, the vendor shall implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.”

15. The vendor shall follow secure coding best practice requirements, as directed by the United States

Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP) that will limit system software vulnerability exploits.

16. Plan and perform the security aspects of configuration management. The vendor shall ensure that computer software developed on behalf of USPTO or tailored from an open-source product, is fully functional and operates correctly on systems configured in accordance with government policy and federal configuration standards. The contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the USPTO environment. No sensitive data shall be used during software testing.

17. The vendor shall protect information that is deemed sensitive from unauthorized disclosure to persons, organizations or subcontractors who do not have a need to know the information.

Information which, either alone or when compared with other reasonably available information, is deemed sensitive or proprietary by USPTO shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all sub-vendors that are performing under this awarded contract.

8. FedRAMP and Authorization to Operate (ATO)

The following link provides details on the certification process to achieve FedRAMP:

https://www.fedramp.gov/

8.1 Lightweight Authorization to Operate (LATO)

Requirement for USPTO Lightweight Authorization to Operate (LATO):

1. The USPTO Lightweight Authorization to Operate (LATO) Process may be used to obtain an initial Authorization to Operate (ATO) for 365 calendar days based on the results of assessments (e.g., vulnerability and compliance scans, assessment of applicable controls, and penetration testing for public-facing systems). Refer to the Lightweight Authorization to Operate (LATO) https://www.fedramp.gov/ https://usptogov.sharepoint.com/sites/f20aa580/Documents/Forms/AllItems.aspx?id=%2Fsites%2Ff20aa580%2FDocuments%2FGuides%2FAssessment%20and%20Authorization%2FLATO%20Process%20Guide%20v1%2E5%2Epdf&parent=%2Fsites%2Ff20aa580%2FDocuments%2FGuides%2FAssessment%20and%20Authorization

Process Guide v1.5 for more details on the USPTO Lightweight Authorization to Operate (LATO) requirements.

2. The USPTO LATO Process can be used for systems which meet one of the following criteria:

• Moderate impact cloud services for Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS) that have a FedRAMP Designation (Ready, In- Process, or Authorized);

• Low impact cloud services for Infrastructure as a Service (IaaS) or Platform as a Service (PaaS) that has a FedRAMP Designation (Ready, In-Process, or Authorized);

• Low Impact SaaS (Li-SaaS) cloud services that are FedRAMP Authorized (Joint

Authorization Board (JAB) Provisional or Agency);

• Li-SaaS cloud services that are not currently FedRAMP Authorized and are seeking a FedRAMP JAB or Agency authorization as a Li-SaaS. In accordance with the FedRAMP Tailored Policy, to be categorized as a Li-SaaS, the cloud service provider (CSP) must be able to answer YES to all of the following:

- Does the service operate in a cloud environment?

- Is the cloud service fully operational?

- Is the cloud service a Software as a Service (SaaS), as defined by NIST SP 800-145, The

NIST Definition of Cloud Computing?

- The cloud service does not contain personally identifiable information (PII), except as needed to provide a login capability (username, password and email address);

- Is the cloud service low impact, as defined by FIPS PUB 199, Standards for Security

Categorization of Federal Information and Information Systems?

- Is the cloud service hosted within a FedRAMP-authorized Platform as a Service (PaaS) or Infrastructure as a Service (IaaS), or is the CSP providing the underlying cloud infrastructure?

3. Additionally, the system needs to meet all the following criteria:

• Must NOT be subject to Financial Statement Audits or A-123 Audits;

• Must NOT have High Value Asset (HVA) designation;

• Must NOT contain Sensitive Personally Identifiable Information (SPII);

• Must NOT contain Business Identifiable Information (BII);

https://usptogov.sharepoint.com/sites/f20aa580/Documents/Forms/AllItems.aspx?id=%2Fsites%2Ff20aa580%2FDocuments%2FGuides%2FAssessment%20and%20Authorization%2FLATO%20Process%20Guide%20v1%2E5%2Epdf&parent=%2Fsites%2Ff20aa580%2FDocuments%2FGuides%2FAssessment%20and%20Authorization https://www.fedramp.gov/baselines/ https://www.fedramp.gov/baselines/ https://csrc.nist.gov/publications/detail/sp/800-145/final https://csrc.nist.gov/publications/detail/sp/800-145/final https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf

• Must NOT have FIPS 199 high impact categorization.

4. Systems with any of the below designations or data types are not eligible for authorization through the USPTO LATO process and must be authorized through the normal A&A process for a full USPTO ATO. USPTO will not grant a full ATO to cloud services that are not designated as FedRAMP Authorized.

5. For Low and Moderate-Impact cloud services (other than cloud services which meet the criteria for Li-SaaS), the cloud service must have a FedRAMP Ready designation, at a minimum. In addition, CSP must provide a written commitment (a signed memorandum from a CSP executive authorized to make the commitment) to USPTO system owner that they will schedule and undergo a full assessment by the FedRAMP-certified third-party assessment organization and attain a FedRAMP JAB or Agency ATO within 365 calendar days of the FedRAMP Ready designation date on the FedRAMP Marketplace.

6. For Li-SaaS cloud services that do not have a current FedRAMP JAB or Agency ATO designation, CSP must provide a written commitment (a signed memorandum from a CSP executive authorized to make the commitment) to USPTO system owner that the CSP will schedule and undergo a full assessment by a FedRAMP-certified third-party assessment organization and attain a FedRAMP JAB or Agency ATO within six months of the USPTO acquisition for Li-SaaS offerings.

8.2 Authority to Operate (ATO)

The USPTO is licensing this software as a Software as a Service (SaaS). This system, in line with the requirements above, will need to go through the Assessment and Authorization by the USTPO and achieve an Authority to Operate (ATO).

A FedRAMP readiness assessment needs to be conducted by a Third-Party Assessment Organization (3PAO) for the vendor’s SaaS to be marked as FedRAMP “Ready” on the FedRAMP Marketplace. The vendor is solely responsible for undertaking the FedRAMP readiness assessment. Once FedRAMP “Ready” status is achieved, the vendor shall work with the Cloud Service Provider (CSP) (I.E., Amazon Web Services (AWS), Google Cloud Platform, or Microsoft Azure Cloud) to form a customer responsibility matrix. This will establish the controls that the SaaS is responsible for the controls the SaaS will inherit from the CSP.

After achieving a FedRAMP Marketplace designation of “Ready” and achieving an intent to be the initial partnering agency from the USPTO’s…