STATEMENT OF OBJECTIVES (SOO)

Freedom of Information Act (FOIA) Enterprise Capability Platform: Case Management and End-to-End Workflow

1.0 PURPOSE & SCOPE

The U.S. Army Records Management Directorate (ARMD) requires an enterprise-level, secure, and modern Freedom of Information Act (FOIA) and Privacy Act (PA) Enterprise Capability Platform. This platform must deliver a modern case management and end-to-end workflow solution operating horizontally across both unclassified (NIPRNet / Impact Level 5 / IL5) and classified (SIPRNet / Impact Level 6 / IL6) environments.

The scope of this initiative encompasses the procurement, configuration, onboarding, training, and lifecycle support of a performance-based Software-as-a- Service (SaaS) solution. This platform will operate natively and entirely within the secure Army-managed Microsoft 365 (M365) tenant utilizing Microsoft Search and Graph APIs to execute federated records searches. Absolutely no Government records, data, or metadata may be processed, stored, or transmitted outside the secure Army tenant boundary.

This platform will standardize FOIA processing across globally dispersed commands, installations, and echelons, reducing administrative burdens, eliminating backlogs, and ensuring full compliance with federal disclosure laws.

2.0 PROGRAM OBJECTIVES

To modernize FOIA processing, the Army seeks a commercial solution that fulfills the following core program objectives:

1. Modernize the User Experience: Transition from legacy, fragmented tracking tools to an intuitive, automated, and streamlined lifecycle workspace.

2. Ensure Absolute Data Security: Enforce zero-trust principles, ensuring all Government records, metadata, and case files remain entirely within secure, Army-controlled tenant boundaries.

3. Enhance Search and Processing Efficiency: Automate data retrieval across disparate repositories using modern native platform tools, dramatically reducing the response timeline for complex, multi-agency records requests.

4. Foster Modular Scalability: Ensure the underlying platform is built on an open, modular architecture that supports rapid capability updates and seamless integrations.

3.0 TECHNICAL & OPERATIONAL OBJECTIVES

The Contractor's proposed solution must achieve the following performance-based outcomes, mapped across five critical operational areas:

3.1 End-to-End FOIA Case Management & Workflow

The platform must automate and manage the entire FOIA and PA request lifecycle within a unified environment.

• Intake & Tasking: Deliver automated request intake capability with the ability to assign, coordinate, and track tasks across different Army commands (including ACOMs, ASCCs, DRUs, and installations).

• Tracking & Milestones: Provide real-time automated tracking of statutory deadlines, milestones, and warning alerts to prevent response delays.

• Collaboration: Enable secure, concurrent, multi-office review and cross-command coordination features to reduce email dependency.

• Compliance Reporting: Deliver real-time dashboards for backlog tracking, processing timeliness, workload distribution, and automated, one-click generation of Department of Justice (DOJ) Annual FOIA Report metrics on demand.

• Disposition: Standardize final administrative closure, archiving, and disposition workflows in compliance with federal records retention schedules.

3.2: Native Microsoft 365 Architecture & Federated Search To maintain strict data security boundaries, the solution must operate natively within the Army's existing Microsoft 365 (M365) tenant.

• Native Integration: Leverage only approved Army M365 services (e.g., SharePoint Online, Teams, OneDrive, Exchange Online, and Purview).

• Federated Search Capability: Utilize Microsoft Search and Graph APIs to execute federated, auditable records searches across all active Army repositories.

• Zero Data Export: Ensure absolutely no Government records, data, or search metadata are processed, stored, or transmitted outside the secure, Army-managed M365 tenant boundary.

• Audit Trails: Extract document metadata seamlessly and maintain complete, unalterable system-generated audit logs of all search actions and user activities.

3.3 Secure Review, Redaction, and Native AI Capabilities

The platform must provide robust tools to review and redact sensitive information securely.

• Multi-Format Redaction: Deliver Department of War (DoW)-compliant redaction tools supporting text, images, audio, video, and structured data formats.

• Data Protection: Enforce reliable information security controls to safeguard classified data, Controlled Unclassified Information (CUI), and Personally Identifiable Information (PII) with complete reviewer audit logs.

• Secure AI Assistance: Integrate native, secure AI-enabled capabilities (e.g., automated document triage, relevance scoring, duplicate detection, and smart redaction suggestions based on FOIA exemptions). All AI models and GenAI utilities must run strictly and natively within the secure Army M365 tenant boundary, preventing data leakage to external models and adhering to DoD Responsible AI guidelines.

3.4 Compliance Metrics & Reporting

The platform must deliver real-time dashboards and automated analytics to support leadership decision-making and federal compliance reporting.

• Leadership Dashboards: Provide real-time dashboards for backlog tracking, processing timeliness, and workload distribution.

• Federal Reporting: Generate error-free, fully automated Department of Justice

(DoJ) Annual FOIA Report metrics on demand.

3.5 Enterprise Scalability & Cross-Domain Security Isolation

The solution must be scaled to meet the needs of the global Army Contracting and Records Management Enterprise.

• User Scalability: Support distributed operations with 500+ concurrent active users globally across CONUS and OCONUS environments.

• System Isolation: Maintain strict logical and physical separation between the unclassified (IL5) and classified (IL6) instances, preventing cross-domain data spills while maintaining consistent, parallel workflow behavior on both networks.

• High Availability & Ingestion: Process large, complex document sets efficiently, ensuring the platform is capable of digesting, indexing, and rendering at least 10,000 pages within a 24-hour window, with system uptime suitable for global operations.

3.6 Low-Code/No-Code Customization

The platform must empower Government administrators with accessible, secure, low-code/no-code configuration tools to adapt and adjust workflows as mission requirements evolve, without requiring proprietary vendor intervention and adhering to Modular Open Systems Approach (MOSA) principles.

3.7 Operational Onboarding, Training, and Technical Support

The implementation must guarantee rapid time-to-value with minimal disruption to ongoing operations.

• Rapid Deployment: Deliver a realistic and accelerated timeline transitioning from contract award to full operational capability. This includes delivering an initial onboarding timeline within five (5) business days of award and providing a designated Onboarding Point of Contact.

• Train-the-Trainer Program: Provide an effective training program tailored for FOIA officers, reviewers, and system administrators, supported by comprehensive user documentation. The curriculum must support a scalable "Train-the-Trainer" model to allow command-level instructors to independently onboard end-users, with initial and refresher training available.

• Technical Support: Deliver routine technical and customer support during core operational hours (0800 to 1600 Eastern Time, Monday through Friday, excluding Federal holidays and Government-directed facility closings). Provide highly reliable emergency technical support for critical system outages, platform downtime, or security incidents on a 24/7/365 basis.

3.8 Public-Facing Portals & Transparency

Integrate optionally with public FOIA reading rooms, automated posting of releasable records, and public request submission portals with live status tracking.

4.0 SECURITY, CYBERSECURITY, & COMPLIANCE CONSTRAINTS

The proposed solution must conform to all applicable security standards and retain the necessary authorizations:

• Cybersecurity Compliance: Adhere strictly to the Risk Management Framework (RMF) and NIST SP 800-53 security controls.

• Authorization to Operate (ATO): The platform must maintain active FedRAMP High or DoW Impact Level 5 (IL5) authorization for the unclassified environment, and an active DoW Impact Level 6 (IL6) authorization for the classified environment.

• National Security & Privacy: Maintain absolute compliance with AR 25-2 (Army Cybersecurity), AR 25-22 (The Army Privacy and Civil Liberties Program), and AR 25-55 (The Department of the Army Freedom of Information Act Program).

• Section 508: Ensure the user interface is fully compliant with Section 508 of the Rehabilitation Act to support accessibility.

5.0 KEY PERFORMANCE METRICS

The success of the platform will be measured by the achievement of these performance thresholds:

• System Availability: Achieve a mandatory 99.9% or greater system uptime across both unclassified (IL5) and classified (IL6) environments (Measured as a monthly average covering both core operating hours and emergency periods).

• Search Ingestion Capacity: Process, digest, index, and render up to 10,000 pages of complex documents within a 24-hour window (Evaluated per system outage or maximum load event).

• Emergency Support Response: Acknowledge and initiate triage for critical system outages, platform downtime, or security incidents within 1 hour or less of occurrence (Measured per critical event on a 24/7/365 basis).

• Routine Support Response: Resolve standard technical tickets and customer inquiries within 4 business hours or less (Measured as a monthly average during standard operating hours).

• Low-Code Modifications: Successfully implement and deploy workflow configuration changes with zero system downtime (Measured per configuration deployment).

• Reporting Accuracy: Generate error-free, fully automated DOJ Annual FOIA Report metrics on demand (Evaluated during standard reporting intervals).