Attachment 1 Performance Work Statement for HT9425-24-R-0047.pdf

Attachment 1: Performance Work Statement (PWS)

Agency/Activity: United States Army Medical Research and Development Command (USAMRDC) Office of the Staff Judge Advocate (OSJA)

Title: Intellectual Property (IP) and Technology Transfer (T2) Database and Related Services

1. General: Pursuant to the Federal Technology Transfer Act (FTTA), USAMRDC has a significant program in patenting and licensing inventions with commercial potential. USAMRDC is composed of various major subordinate commands each specializing in technologies associated with its mission. The USAMRDC laboratories and research and development centers work with diverse medically related technologies including biomedical and chemical research.

1.1. Background: The USAMRDC OSJA Intellectual Property Division (IP Division), works closely with the USAMRDC Office of Research and Technology Applications (ORTA). The ORTA assists the USAMRDC laboratories, Army Futures Command (AFC) and the Defense Health Agency (DHA) organizations in all areas of Technology Transfer, including, but not limited to, Cooperative Research and Development Agreements (CRADAs), nondisclosure agreements, technology assessments, marketing and licensing inventions, training and education, and professional development.

The USAMRDC moved from the Army to the DHA effective Fiscal Year 2023, per the National Defense Authorization Act (NDAA) 2019. This transition is still ongoing and, therefore, additional offices/groups may be identified during performance of the contract that require access to the database system and related services (primarily, customer support and training).

The USAMRDC OSJA IP Division is currently utilizing a commercial patent docketing and database system which resides on the local network. This system allows the USAMRDC OSJA to track all IP, T2 agreements, and to provide reports and metrics to the Department of Defense (DoD), the Office of the Secretary of Defense, and Congress. Patent docketing is one of the most crucial functions within any IP department.

1.2. Description of Requirement: The Government requires a commercial docketing and patent database software system along with associated customer support services, periodic software and system updates, and flexibility for configuration and customization. The docketing and patent database system (also referred to as IP and T2 database system within this PWS) shall provide tools for data capture, reporting, document generation, and establishing workflows, as further defined below under Sections 3 (“Minimum Essential Characteristics and Capabilities”) and 4 (“Functional Characteristics/Capabilities”). The IP and T2 database system will also assist the Government in tracking and meeting deadlines to maintain and protect DoD IP as missing deadlines can result in loss of the ability to obtain a patent and consequently, the loss of Government property.

First and foremost, the Government requires that all Offerors propose an “on-premises” solution that shall reside on a local server at Fort Detrick, Maryland under the management of USAMRDC Information Management / Information Technology (IM/IT) personnel. In addition to the required on-premises solution, the Government will entertain an additional solution of either a contractor-cloud hosted solution or a Government-cloud hosted solution which could result in a proposal strength. If proposing a contractor cloud-based solution, see Section 3 below (“Minimum Essential Characteristics and Capabilities”) regarding the requirements for a database system hosted by a Federal Risk and Authorization Management Program (FedRAMP) authorized managed cloud service provider (MCSP). Additionally, regardless of the solution selected by the Government under the resultant contract, the Contractor shall obtain all required approvals/authorizations for full operation and access by the end user (see paragraph 5.1. (Task 1) for further details) and shall comply with the DHA’s Risk Management Framework (RMF) requirements. The IP and T2 database system will be licensed as a subscription-based software model with annual license fees which includes customer support and software updates. Per user licenses (seat licenses) as well as licenses based upon volume of records are allowable. Additionally, the Government is seeking a central system shared across multiple labs.

In addition to the required database system, the Contractor shall provide support services as detailed within paragraph 5 of this Performance Work Statement. These required services include customer support services and training which will be required for all users within the IP Division, ORTA staff, and USAMRDC’s sub-commands.

In addition, the IP Division and ORTA may have a need for additional customized modules (if not included in the base system offering) to provide supplemental marketing tools and processes, online document and form submissions, workflow configuration for certain users, and generation of out-going invoices.

1.3. Period of Performance: The period of performance will include a 12-month base period and four 12-month option periods. The Government anticipates a start date on or before 30 September 2024.

1.4. Place of Performance: Day-to-day on-site support is not required at Fort Detrick, MD. Any proposed solution for an IP & T2 Database shall be accessible via internet browser.

Training sessions may occur on the Fort Detrick installation; however, the training sessions are anticipated to be primarily conducted virtually. It may also be necessary for certain Contractor team members to periodically travel to Fort Detrick for installation and troubleshooting of system. See below for guidance regarding travel requirements.

1.5. General Information:

1.5.1. Non-Personal Services: This requirement identifies services that are strictly non-personal in nature.

1.5.2. Severable / Non-Severable Services: This requirement identifies services that are severable in nature.

1.5.3. Inherently Governmental Functions: This requirement has been reviewed and contains no services that are inherently governmental functions.

1.5.4. Acquisition Functions Closely Associated with Inherently Governmental Functions: This requirement has been reviewed and contains no services that are closely associated inherently governmental functions.

1.5.5. Travel: Contractor may be expected to travel to Fort Detrick, as required, to accomplish the tasks included within this PWS. Travel must be approved by the Contracting Officer’s Representative (COR) prior to actual travel being performed. Travel Costs shall be incurred and billed in accordance with FAR Part 31. The Contractor is responsible to ensure cost savings are utilized when available (i.e. making reservations as soon as possible, utilizing compact cars when a rental vehicle is required, requesting government rates at hotels to stay within GSA lodging (per diem) rates, parking in economy parking, etc.). If the hotel is over the GSA lodging rate, the difference will not be paid unless there is a justification approved by the COR prior to travel being performed.

1.5.6. Recognized Holidays: The following provides information on recognized holidays for the purpose of the PWS. If submittal of any documentation (e.g., deliverables, submittals, etc.) deadlines fall on a holiday, the closest work day prior to the holiday will apply as the deadline for submittal. When a U.S. holiday occurs on a Saturday or a Sunday, the holiday is observed on the preceding Friday or following Monday, respectively.

New Year’s Day (January 1st) M. L. King Memorial Day (3rd Monday in Jan) Presidents Day (3rd Monday in February) Memorial Day (last Monday in May) Juneteenth (June 19th) Independence Day (July 4th) Labor Day (1st Monday in September) Columbus Day (2nd Monday in October) Veteran’s Day (November 11th) Thanksgiving Day (4th Thursday in November) Christmas Day (December 25th)

1.6. Security Requirements: Contractor employees required to perform within an Army-controlled installation, facility, or area shall comply with the requirements listed below.

1.6.1. Personnel must be U.S. citizens and capable of passing a National Agency Check with Inquiries (NACI) and IT-III to obtain a Common Access Card (CAC). This may be necessary to perform the tasks associated with the data audit and legacy data transfer to the new docketing and patent database system.

1.6.2. Access and general protection/security policy and procedures. This standard language is for Contractor employees with an area of performance within an Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.6.3. For Contractors that do not require CAC, but require access to a DoD facility or installation. Contractors and all associated sub-contractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation / facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

1.6.4. For contractors requiring Common Access Card (CAC)

1.6.4.1. For Contractor employees requiring a CAC, Contractor should provide a list of such employees and notify those employees that certain personal information must be provided to the government in order to obtain a CAC.

For example, full names, address, citizenship, and social security numbers must be provided immediately upon award (or once an individual is identified as requiring a CAC) to the OSJA IP Division so the approval process can be initiated. The approval process may be lengthy.

1.6.4.2. Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

1.6.3. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government info system must be registered in the ATCTS at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information system and then annually thereafter.

1.6.4. For contracts that require OPSEC Training. Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. The training is located through the Army Learning Management System (ALMS) website at https://www.lms.army.mil under the course name, Army OPSEC Level I (Newcomers and Refresher).

1.6.5. For information assurance (IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six (6) months of appointment to IA/IT functions. Information assurance (IA)/information technology (IT) training is located at https://cs.signal.army.mil.

1.6.6. Any hardware or software installations, configurations, or testing on U.S. government computer systems must be cleared through and conducted by certified U.S. Army Information Technology personnel.

1.6.7. AT Level I Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility, or area. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 60 calendar days after contract start date. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR, within 10 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil.

1.6.8. iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility, or area. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 60 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 10 calendar days after completion of training by all employees. The contractor and all associated contractors can access AT Awareness Information: https://www.mepcom.army.mil/Home/Contractors/, See Something, Say Something: https://www.dhs.gov/see-something-say-something and iSalute: https://www.inscom.army.mil/isalute/.

1.6.9. Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent. Training can be conducted in MS-Teams online or face-to-face in a classroom setting.

1.6.10. Controlled Unclassified Information (CUI). Per DoD Instruction 5200.48, Controlled Unclassified Information (CUI), all personnel within a DoD organization -- i.e., military members, DoD civilians, and on-site support contractors -- must complete CUI training initially within thirty (30) calendar days of reporting for duty and thereafter once every 365 calendar days. The training is located at https://securityhub.usalearning.gov/index.html.

1.7. Organizational Conflict of Interest (OCI) Category: USAMRDC has categorized all of its requirements into three broad categories, as defined below, for the purposes of identifying, avoiding, or mitigating against Organizational Conflicts of Interest (OCI) in accordance with FAR Subpart 9.5. These categories are defined as follows:

Category 1: USAMRDC Internal Support: Services which, by their very nature, give the Contractor access to potential requirements and extensive data about Category 2 and Category 3 contractors.

Category 2: Admin/Acquisition Support/IT: Services which assist USAMRDC in acquisition processes. This includes, for example: requirements analysis, acquisition support, budget planning and management, business process reengineering, program planning and execution support, independent technical management support, and IM/IT support. Contractor access to potential requirements and extensive data about Category 3 contractors.

Category 3: Product Support: Services or end items required to meet the mission requirements of USAMRDC activities and acquisition programs. This includes, for example: concept exploration and development; system design; system development and integration; Commercial Off-The-Shelf (COTS) procurement and integration;

internal development testing; deployment; installation; operations; and maintenance.

Contractor participation in more than one of these areas may give rise to an unfair competitive advantage resulting from access to advance acquisition planning, source selection sensitive or proprietary information. Furthermore, Contractor participation in more than one area may give rise to a real or apparent loss of Contractor impartiality and objectivity where its advisory or planning assistance in one area potentially affects its present or future participation in another area.

The purpose of this categorization is to accomplish the following three objectives: (1) to inform prospective Offerors that OSJA USAMRDC presumes that award of a contract or order in the subject category will give rise to real or apparent OCIs with respect to requirements in the other two categories; (2) to assist current Contractors and prospective Offerors in developing their own business strategies regarding participation in OSJA USAMRDC requirements and in identifying and, where possible, avoiding or mitigating against OCIs; and (3) to ensure that all current Contractors and prospective Offerors are afforded the maximum practicable opportunity to compete for all

OSJA USAMRDC requirements consistent with the restrictions required under FAR Subpart 9.5 and sound business practices.

The work called for under this contract requirement has been determined by OSJA USAMRDC to fall within the following OCI category: Category 3 - Product Support.

If any OCI arises during the Period of Performance, the Contractor shall notify the Contracting Officer (KO) in writing, within five (5) business days of the event, or the date that the Contractor becomes aware of the OCI.

Additionally, the Contractor shall provide a written, proposed means of preventing, avoiding or mitigating each OCI identified within 10 business days of initial KO notification. This written OCI proposal shall be submitted to the COR and KO (Deliverable #1).

1.8. Post Award “Kick-off” Meeting: The Contractor shall virtually attend any post award “Kick-off” meeting convened by the contracting activity (unless on-site attendance is mutually agreed upon). The KO, COR, and other Government personnel, as appropriate, may meet with the Contractor representatives to discuss performance expectations and general contract requirements. This meeting shall be at no additional cost to the Government.

1.9. Non-Disclosure Agreement - Deliverable #2: The Contractor shall ensure that the Non-Disclosure Agreement (Exhibit A) is signed by all staff assigned to or performing under this Contract before performing any work, including all subcontractors and consultants. The Non-Disclosure Agreement (NDA) shall be co-signed by a corporate official (Contract Manager or higher). The Contractor shall also ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. Assignment of personnel who have not executed this statement or failure to adhere to this statement may constitute default on the part of the Contractor.

1.10. Other Direct Costs (ODCs): ODCs are anticipated during the performance of this contract to include travel, on a cost reimbursable basis. See Exhibit E for the “Not to Exceed (NTE)” amounts to cover anticipated ODCs / Travel.

2. Government Furnished Property, Equipment, and Services: For performance of this effort, the Government may furnish property, materials, supplies, equipment, information, and facilities. If Government Furnished Property (GFP) / Government Furnished Equipment (GFE) is provided, the Contractor shall assume responsibility for and maintain a detailed property management system for GFP /GFE or Contractor-Acquired-Government Owned Property (CAP). The inventory accounting system must specify, as a minimum: product description (make, model), Government tag number, date of receipt, name of recipient, location of receipt, current location, purchase cost (if CAP), and contract number under which the equipment is being used. The Contractor shall make its inventory listing available for Government review within one (1) business day of COR request.

A listing of the anticipated GFP for this contract is provided as Attachment #3.

2.1. Utilities: The Government will provide all utilities necessary for the contractor to perform their duties under this contract. This includes electrical power, phone, water, etc. The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities.

2.2. Equipment: Government may supply up to three (3) laptop computers connected to the network to support performance of this contract. Contractor shall not modify or load software to computer equipment without prior approval by the Government.

3. Minimum Essential Characteristics and Capabilities: The Minimum Essential Characteristics and Capabilities of the docketing and patent database system are comprised of Operating Characteristics and Performance Characteristics. The Contractor shall deliver to the Government the required software licenses meeting (or exceeding) all of the following Minimum Essential Characteristics and Capabilities.

The Government has established three (3) “go, no-go” subfactors as part of the Technical Approach evaluation factor for this solicitation. The Offeror’s proposal shall clearly demonstrate and will be evaluated to ensure that the proposed solution conforms to the following required Operating and Performance Characteristics:

Go, No-go #1 (Mandatory to All Proposed Solutions): Ability to propose an “on premises” solution that shall reside on a local server under the management of USAMRDC IM/IT personnel. Regardless of any additional solution proposed (i.e. Contractor and/or Government cloud hosted) an on-premises solution is mandatory for all vendor proposals.

Go, No-go #2 (Applicable only if proposing a contractor Hosted Cloud Solution): The system shall be hosted by a Federal Risk and Authorization Management Program (FedRAMP) authorized managed cloud service provider (MCSP) that will allow for reciprocity approvals via Defense Health Agency (DHA). The Offeror shall possess (at a minimum) FedRAMP approval at moderate baseline for the proposed software.

See PWS Section 3.1.1.(a) below.

Go, No-go #3 (Mandatory to All Proposed Solution(s)): Applicable to all solutions: System shall provide for unique and single sign-on capability for users. System shall integrate with server host authentication procedures (use of DoD Common Access Card). See PWS Section 3.2.(a) below.

The Offeror’s proposal shall demonstrate that the proposed solution meets these go, no-go subfactors at time of proposal submission. Failure to demonstrate these subfactors will result in a non-responsive proposal and will be deemed deficient.

3.1. Operating Characteristics: All proposed solutions shall comply with and demonstrate the ability to adhere to the following Minimum Operating Characteristics:

(a) The system shall be accessible through a web-based browser specifically Microsoft Edge version

122.0.2365.52 (Official Build) (64bit) 11 or newer.

(b) The system shall run on or in conjunction with the following operating systems and software applications:

i. Microsoft Windows Server 2019 Operating System

ii. Microsoft SQL Server 2019 Any software application hosted on-premises shall comply with the above minimum standards. Software may run on newer versions, but the Offeror shall demonstrate in the proposed Technical Approach that this solution is capable of running on the Government’s minimum standards without requiring an upgrade to the aforementioned operating system.

(c) If the proposed system includes or depends upon third-party software (with the exception of those identified under 3.1.(a) and 3.1.(b)) to provide required functionality, the version of third-party software used/supported must be actively maintained by the third party with security patches being made available at no additional cost.

(d) If third-party software is required that is not part of the basic system or is needed to implement optional modules or customization, the Contractor will identify such software.

(e) The system shall have or shall be capable of receiving Authority to Operate (ATO) and comply with all applicable DoD and DHA IT requirements (such as those listed below) to include the Risk Management Framework (RMF). The contractor shall comply with the requirements of DoDi 8510.01 RMF for DoD IT. During performance of the contract, the successful Offeror shall obtain all necessary authorizations for Operation and Access by the End User (as further specified in Task 5.1. of the PWS) within 4 months after contract award.

(f) The successful Offeror shall not access/manage the local server either directly (onsite) or remotely without the appropriate network access, security and data use agreements as expressly stipulated in the contract.

(g) The successful Offeror shall comply with the requirements of Army Regulation 25-2, Information Assurance, and any other DoD and DHA requirements in providing account management services to manage the approval, creation, modification, and deletion of user accounts.

(h) The successful Offeror shall comply with Cyber Security policy and remediate any reported vulnerability in the software to include any third-party software (with the exception of those identified under 3.1.(a) and 3.1.(b)) through patching, hot fixes, or other means.

(i) Applicable Only to Cloud hosted (Contractor/DHA hosted) system: meet all operating characteristics provided under 3.1.1.

(j) Any proposed solution shall comply with the requirement set forth in the following reference documents, as applicable (based on the proposed solution, i.e., cloud hosted or on-premises solution):

Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of

Federal Information and Information Systems (February 2004) Department of Defense Instruction (DODI) 8510.01, Risk Management Framework (RMF) for DoD

Information Technology (Incorporating Change 3, December 29, 2020) DoDI 8530.01, Cybersecurity Activities Support to DoD Information Network Operations, (Change

I, July 25, 2017) DoDI 8582.01, Security of Unclassified DoD Info1mation on Non-DoD Information Systems, (June

6, 2012) DoD CIO Memo: Department of Defense Cybersecurity Activities Performed for Cloud Service

Offerings, (November 2017) DoD Cloud Computing Security Requirements Guide (SRG) v1r4 (January 2022) DFARS (Subpart 204.73) Safeguarding Covered Defense Information and Cyber Incident Reporting, https://www.acq.osd.mil/dpap/dars/dfars/html/current/204_73.htm DoD Cloud Authorization Services: https://disa.deps.mil/org/RMED/cas Committee on National Security Systems Instruction (CNSSI) 1253, Security Categorization and

Control Selection for National Security Systems (March 2014) National Institute of Standards and Technology (NIST) Standard Publication (SP) 800-145, The

NIST Definition of Cloud Computing (September 2011) NIST 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations

(December 2018) DHA RMF Portal, https://info.health.mil/dadio/InfoSec/assessor/dharmf/SitePages/ Home.aspx DHA Agency Instruction (AI) 77, Security Categorization (SC) and Control Selection for

Information Technology (IT), https://info.health.mil/dadio/InfoSec/assessor/dharmf/DHA%20RMF%20Templates/DHA%20AI%2 077%20Security%20Categorization%20Control%20Selection%20for%20Information%20Technolo gy.pdf

DHA RMF Assessment and Authorization (A&A) Process Interactive Workflow:

https://info.health.mil/dadio/InfoSec/assessor/dharmf/SitePages/RMFWorkflow.aspx

DHA Information System Security Manager (ISSM) SOP, https://info.health.mil/dadio/InfoSec/assessor/dharmf/DHA%20RMF%20Templates/ DHA%20ISSM%20SOP.pdf

DHA Risk Assessment Guide, https://info.health.mil/dadio/InfoSec/assessor/dharmf/DHA%20RMF%20Templates/DHA%20Risk %20Assessment%20Guide.pdf

DHA Cloud Evaluation and Authorization Process Guide v 2.0 FedRAMP Marketplace, https://marketplace.fedramp.gov/#!/products?sort=productName DODI 8500.01, Cybersecurity (Incorporating Change 1, Effective October 7, 2019) DODI 8582.01, Security of Non-DoD Information Systems Processing Unclassified Non-Public DoD

Information (December 2019) DFARS SUBPART 239.76, Cloud Computing DFARS 252.239-7009, Representation of Use of Cloud Computing DFARS 252.239-7010, Cloud Computing Services DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, the deviation clause (DEVIATION 2024-O0013) is incorporated into this solicitation by full text NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and

Organizations (September 2020) NIST 800-171r1, Protecting Controlled Unclassified Information in Nonfederal Systems and

Organizations (December 2016)

OMB Circular A-130, Managing Information as a Strategic Resource, https://www.federalregister.gov/documents/2016/07/28/2016-17872/revision-of-ombcircular-no-a- 130-managing-information-as-a-strategic-resource

DoD CIO memorandum, Updated Guidance on the Acquisition and Use of Commercial Cloud Computing (December 2014)

3.1.1. Operating Characteristics Applicable Only to Cloud hosted (Contractor/DHA hosted) system: If proposing a cloud solution:

(a) The system shall be hosted by a FedRAMP authorized MCSP that will allow for reciprocity approvals via DHA. The Offeror shall possess (at a minimum) FedRAMP approval at moderate baseline for the proposed software. FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This operating characteristic is a “go, no-go” subfactor.

(b) The successful Offeror shall work with the Information System Security Manager (ISSM) to ensure that the system will be added to the DHA approved product list as a Certified Software Product by the DHA Authorizing Official (AO).

(c) The successful Offeror shall comply with the appropriate network access, security and data use agreements as expressly stipulated in the contract.

3.2. Performance Characteristics: All proposed solutions shall comply with and demonstrate the ability to adhere to (or exceed) the following Minimum Performance Characteristics:

(a) System shall provide for unique and single sign-on capability for users. System shall integrate with server host authentication procedures (use of DoD Common Access Card). This performance characteristic is a “go, no-go” subfactor.

(b) System shall allow for a variety of configurable user types and user level permissions.

(c) System shall provide for patent case family groupings. System shall display case family relationships for related inventions, patent applications, and related technology transfer agreements (e.g., CRADAs and licenses).

(d) Legacy Data. System shall be capable of receiving and storing legacy data in various formats. See Task 3 within this PWS for the requirements related to data audit, review, and evaluation of the Government’s existing legacy electronic data for identification and correction of data errors or mobility issues.

(e) Privacy Act Notice and DoD Warning Banner. System shall be capable of displaying a (Government-provided) pop-up message upon each sign-on. This message shall be displayed until the user acknowledges the pop-up banner.

(f) Full System Requirements:

i. Data provisioning for third party data reporting integration. System shall be capable of providing automatic periodic data dumps in delimited or SQL formats. System shall be capable of receiving data from third party annuity payment services, for example.

ii. System shall be capable of automatic periodic data importation from multiple subordinate laboratory database systems, for example, Microsoft Excel or Access systems.

iii. System shall have the ability to create and store document templates for each module.

iv. System shall have the ability to link all related records across all modules.

v. System shall allow for all reporting to be downloaded in a format that will allow for

USAMRDC personnel to manipulate the data. It is anticipated that the Contractor will remove the formatting and other fields that USAMRDC deems unnecessary.

4. Functional Characteristics/Capabilities: To the greatest extent possible, all proposed solutions should adhere to the following Functional Characteristics/Capabilities:

4.1. E-mail Communication: System should permit storage of e-mail addresses for auto and user generated e-mail messages. System should also permit “e-mailing in” data for inclusion in records and also attachment of specified e-mails into record. E-mail messages can be generated from rule-based, automatic alerts and manually configured data triggers and sent to specified individuals or addresses.

4.2. Document Uploads: Permits users to upload documents such as office actions, assignments, agreements, e-mails, written correspondence, etc. for others to view within the database.

4.3. Permission Controls: Permits USAMRDC administrators to customize permission settings. For example, settings can be configured to designate read-only user types or limit access to records by laboratory or organization.

4.4. Automated Office Actions: Permits setting of notifications and alerts for critical dates as well as automated e-mail reminders. This includes e-mail notification of the assigned/identified attorney that there is an action/document (e.g., publication, Research Disclosure Form, etc.) for review.

4.5. Research Disclosure Management:

(a) Allow for user specified reference naming conventions.

(b) Allow for submission of Research Disclosure Forms via Web Portal for USAMRDC Labs.

(c) Schedule a 6-month task for attorney’s review if the Research Disclosure Form is not moved to the

Invention Disclosure stage.

(d) Link the Research Disclosure form and Invention Disclosure Form, as required.

A Research Disclosure form is a one-page form and allows for a more streamlined process for inventors to propose possible inventions for patent attorney review.

4.6. Invention Management:

(a) Permit capturing, editing and reviewing of information associated with new and existing invention disclosures, including identity and location of inventors, key dates, abstracts, originating organization, reference numbers, sponsors, agreements, and potential licensees. System should provide for electronic submission of all documents, and the configuration of the workflow to be determined during implementation stage.

(b) Docketing Integration. Seamlessly integrates invention disclosures with the patent docketing system and relates inventions with corresponding patent applications/patents, related technology transfer agreements, and all other relevant records.

(c) Workflow Automation. Allows lab users to review and finalize documentation/forms; once finalized, the system will notify the docketing administrator.

(d) Input Automation. Permits sequential new distinct case/docket/matter numbers and input of all necessary baseline invention disclosure information for both the user and the attorney (e.g., invention title, inventor names, date of invention, brief description of invention, organizational information, technology field, etc.).

The system should send users an email confirmation of the invention disclosure submission with the automated docket number included. System should maintain USAMRDC reference numbers for all existing and newly created records.

(e) Responsible Organization. Permits drop-down menus of organizational codes to facilitate the identification of the responsible organization for the invention. Drop down menus should be fully configurable by the system administrator.

(f) Export Control Laws. The invention disclosure system should meet all U.S. Export Control Laws and is limited to U.S. Persons as defined in the U.S. Export Control Laws.

(g) Status Checks. System permits each user to view the status of their own invention disclosures. Designated laboratory personnel will also have the ability to view the status of all the inventors/inventions affiliated with their organization.

(h) Searchable Records. System permits searches of invention disclosures by a variety of parameters to include docket number, application number(s), publication number(s), titles, key words, inventors, etc. The search function should also have the ability to read flat PDF documents stored within invention disclosure system and return these documents as a search result.

(i) Date Stamps. System provides that each file submission gets an automatic date/time stamp. This ensures that multiple inventors uploading files to the same invention disclosure can distinguish between files having the same name. Each upload will also attach the name of the person uploading the invention disclosure and/or additional invention disclosure information.

(j) Custom Forms. Invention disclosure forms should be customizable by the system administrator.

(k) System permits upload of peer reviews, inventor questionnaires, and Invention Evaluation Committee documents associated with USAMRDC reference number. Uploads are expected to be designated format provided by USAMRDC.

Invention disclosure forms are a more formalized method for inventors to submit an invention for official review.

4.7. Docketing:

(a) System should provide lifecycle management for invention disclosures, patents, trademarks, copyright, patent licenses and technology transfer and other agreements, including, for example, Cooperative Research and Development Agreements (CRADAs), Material Transfer Agreements (MTAs), Clinical Trial Agreements (CTAs), Non-Disclosure Agreements (NDAs), Biological Materials License Agreements (BMLAs) and other similar agreements. System will permit capturing, editing and reviewing of information associated with invention disclosures, patent applications/patents, maintenance fees and annuity payments, collaborative partners, agreement data, and parties responsible for patent prosecution.

(b) System permits fields for identifying the Department of Defense or other command that is the custodian of the case, the USAMRDC attorney responsible for the case, the assigned contract law firm, and employer of each inventor. For example, invention disclosure may name as inventors Army employees, other Government employees, contractor personnel, students, and others.

(c) Reports. Permits generation of comprehensive narrative and graphical reports and dashboards. System provides for creation of templates for documents to be automatically generated from record information.

Mass-mailing letter forms capability is also provided. Results from searches can be stored for later use.

System provides for a query builder. Users should be able to generate integrated docket reports to include actions due from all modules. The system should allow for reporting based upon custodial organization, e.g., labs and country of filing.

(d) Automated Docketing. System provides automated docketing based on country laws and provides real time updates of these laws including United States Patent and Trademark Office (USPTO) rules, the Madrid Protocol, and other international laws. Distinct numbers are generated sequentially for the upload of invention disclosures. The related patent, parent and children patent applications, and trademark records should correspond with the USAMRDC reference number assigned. Permits automation of alerts for critical dates, information requests, impending actions, follow-up, and other events.

(e) Date Rules. System provides automated calculation of dates for standard actions and deadlines, and reminders specific to country law. System provides for calculation of deadlines based on filing, prosecution, and grant dates for each application for patent, patent, jurisdiction, and type of filing. The system should be pre-programmed with required deadlines for all countries. System also provides for creation of automated deadlines and reminders. The system allows for the calculation of Patent Term Adjustment.

(f) Docket Reports. Permits attorneys and support staff to generate integrated docket reports that include actions due from all modules. The system provides for generation of automated email reminders with new actions and sends them to responsible attorneys and support staff. The system also generates and sends emails to inventors, supervisors and other designated personnel. The system should permit for the report to be generated by specific relevant parties.

(g) Workflow Configuration. System permits workflow configuration for internal processes for handling invention disclosures, patent prosecution and agreements. System provides for the creation of notes or memorandums associated with records.

(h) Inventor Awards. System permits tracking and event processing of inventor awards with autogenerated tasks and tracking. It is preferred that the system can be configured to autogenerate award memorandum and associated tasks.

(i) USPTO Connection. System integrates with USPTO databases (Patent Center) either directly or through the use of an approved third-party application/system/software to electronically retrieve and download USPTO correspondence/documents. Due to DoD IT security constraints, USAMRDC IT personnel may be involved in establishing a process for acceptance of the download. Direct download of USPTO data into the database system is not permitted. USPTO data will need to be downloaded into a temporary location so USAMRDC IT can scan for vulnerabilities and provide approval, and then transmit into the database system.

(j) Agreement Linking. Permits linking of agreements with associated patents, trademarks or other agreements.

4.8. Financial Management and Maintenance of Patents and Applications:

(a) System provides for both customizable and automatic reminders, the scheduling of invoices, payments due, and renewal fees. System provides capability for calculation of royalty distributions, patent cost reimbursement and for forecasting of spending.

(b) Notices and Reminders. System provides for docketing notices and reminders to appear directly in the patent or trademark records.

(c) Payment Input. System permits instructions for payments and confirmation of payments are sent through automated emails.

(d) Reports and Searching. System permits searching for payment reminders, confirmation of payments, and due dates and inclusion in reports.

(e) Exportable Financial Data. Payments and other report information should have the capability to be exported to Microsoft Excel file types.

(f) Data Integrity. System provides for validation of information, including application number, jurisdiction, annuity year, due date, renewal fee, and amounts paid.

(g) System is capable of generating out-going invoices. System provides for a bill routing process with review, approval, or rejection actions.

(h) It is anticipated that the module will allow for configuration for USAMRDC necessary workflow.

4.9. Agreements:

(a) System permits administrative tracking of multiple agreement types, including but not limited to licenses, CRADAs, Memorandum of Understanding (MOUs), Memorandum of Agreement (MOAs), Inter- Institutional Agreements (IIAs), and Non-Disclosure Agreements (NDAs). System provides for field additions and customizations.

(b) Permits electronic submission of agreement requests and agreements workflow for review and approval.

System provides for tracking and managing interactions with collaborators, companies and persons and relates this information to corresponding IP.

(c) Permits mapping of technologies with IP assets, products, and related agreements.

(d) Permits management of payments, terms, reimbursed expenses, invoices, and payments received regarding patents, licenses and other agreements.

(e) Permits automated royalty distribution reports and notification for license revenues related to agreements.

(f) Permits generation of graphic and customizable agreement reports on a variety agreement driven metrics.

(g) Agreement reports must include and be filterable by:

i. Parties to the agreement

1) Organization type (small business, non-profit, educational, etc.)

2) Organization city, state, and country

ii. Agreement type

iii. Agreement title

iv. Agreement summary

v. Agreement dates (execution date, start date, expiration date, termination date)

vi. Contacts for the agreement

1) Collaborator contacts (including name, phone number, email address)

2) MRDC/DHA lab contacts (including name, phone number, email address)

(h) System should be capable of configurable workflow for user regarding display of assigned tasks approaching deadline, tasks to be completed, or other steps and approvals required. Workflow tracks tasks between users.

(i) License Drafting. System permits drafting of patent licenses directly within the document management features and includes version control.

(j) It is anticipated that the module will allow for configuration for USAMRDC necessary workflow.

4.10 Contact and Organization Records:

(a) System should provide employment history per contact.

(b) Allow for historical employment history per contact to be visible across all records within the system.

(c) Allow for one contact record to display all previous email addresses and the most current email address without the need to create duplicate contact records. This will include dates that each change was applied to the contact record.

(d) Allow for the ability at the USAMRDC Administrative User level to merge existing contacts and organizational records, when necessary.

(e) Allow linkage for Organization records of subsidiaries to parent organization.

(f) Allow the historical per organization record to be visible across all records within the system.

(g) Allow for capture of any name changes of an organization record.

(h) It is anticipated that the module will allow for configuration for USAMRDC necessary workflow.

4.11. System User/Administration Guides:

(a) Contractor should provide digital copies of the system User guide and a separate Administration Guide to COR and other identified USAMRDC personnel. The guides should include standard configurations and custom configurations.

(b) Contractor should provide any and all “How to,” “Quick Reference,” and “Cheat Sheet” guides.

5. Specific Task Descriptions:

In addition to the required database system, the Contractor shall provide the following support services:

Task 1: Obtain all necessary authorizations for Operation and Access by the End User Task 2: Install, Implement, Configure and Test System Task 3: Perform Data Audit, Upload Legacy Data and Validate Data Task 4: Customer Support Task 5: Training Task 6: Implementation of Optional Modules Task 7: Outgoing Transition Support

5.1. Task 1: Obtain all necessary authorizations for Operation and Access by the End User

(a) After contract award, the Contractor Project Manager shall meet with the Government to present an overview of the draft/preliminary approach (“Task 1 Plan”) included in the non-cost/price proposal for obtaining all necessary authorizations for Cloud use and/or on-premises hosting (as applicable). During this meeting, the Government will coordinate with the Project Manager to establish schedules and procedures necessary to conduct the tasks outlined herein with specific focus on the Risk Management Framework.

The primary outcome of this meeting is to come to an agreement on the schedule and performance baselines in order to finalize the written plan outlining tasks and steps necessary for the process of obtaining all necessary authorizations required, based on the proposed solution (i.e., authorizations for Cloud use, authority to operate on the local network, etc.), as required by USAMRDC and DHA IT pursuant to applicable governmental regulations and processes. Submission of the finalized written plan is due to the COR no later than 30 days after kick-off meeting (Deliverable #3).

(b) The Contractor shall work collaboratively with USAMRDC OJSA and IM/IT Personnel (USAMRDC and/or DHA) to perform all tasks necessary for full operation and access by the USAMRDC end user of the docketing and patent database. The Contractor shall promptly comply with all reasonable requests for information in support of the approval process. Absent extraordinary circumstances, “prompt” shall mean no greater than seven (7) business days. The Contractor may be required to submit documentation to USAMRDC and/or DHA IM/IT Personnel and the COR to verify that all necessary approvals and authorizations have been successfully obtained (Deliverable #4). Such documentation will be identified at the time of deliverable submission.

(c) The Contractor shall remediate any network security vulnerabilities discovered during the approval process.

The Contractor shall provide status reports to the COR every two (2) weeks on the progress of the remediation of network security vulnerabilities until issues are resolved (Deliverable #5).

(d) Beyond the base period, if regular or periodic renewal(s) is required for…