Attachment II - Draft Performance Work Statement.pdf

Performance-Based Work Statement for FOIA Case Management System and Support Services

Department of the Navy Office of the Chief Information Officer (DON CIO)

1. Introduction

The Department of the Navy seeks to maintain and modernize the enterprise automation of its Freedom of Information Act (FOIA) and Privacy Act program by procuring a commercial, cloud-based FOIA Case Management System and associated support services. The existing contract for the incumbent FOIA case management system expires on September 25,2027.

The DON’s primary objective is to maintain uninterrupted operational capability, achieve lifecycle cost efficiencies, and, if transitioning to a replacement system, execute a seamless, risk mitigated data migration and deployment prior to the expiration of the incumbent service.

2. Background

The DON manages FOIA and PA operations across an enterprise hierarchy comprising the Office of the Chief Information Officer (DON CIO), the headquarters of the Navy and the Marine Corps, and its commands and activities.

The baseline processing lifecycle functions as follows:

• Intake & Multi-Tier Queueing: Requests are entered electronically through a public portal or manually logged from mail/email intake, including such a portal directly serving the Department of the Navy (DON) as well as those of external agencies, notably the Department of Justice (at foia.gov). Requests are perfected, assigned unique tracking identifiers, triaged into queues (Simple, Complex, Expedited), and routed to the cognizant FOIA-processing activity and, when a denial determination is required, to an authorized Initial Denial Authorities (IDA).

• Tolling & Case Milestones: Statutory processing clocks monitor active working days, account for federal holidays, and support administrative tolling for fee resolution or scope clarification.

• Review, Redaction & Exemption Tracking: Responsive records are processed, tagged, and redacted in accordance with statutory FOIA exemptions (5 U.S.C. § 552(b)(1)–(9)), including classification markings and proprietary business information determinations.

• Disposition, Publishing & Appeals: Determinations (full grant, partial denial, full denial, referral, or consultation) are executed with electronic correspondence. Records released to the general public are indexed in an electronic reading room, while records restricted to the individual requester or implicating privacy concerns remain protected. Appellate workflows track administrative appeals through designated DON appellate authorities.

• Oversight & Departmental Reporting: DON CIO continuously monitors system-wide performance, audits, and automated metrics required for the Department of Justice (DOJ) Annual FOIA Report and Department of War (DoW) quarterly reporting mandates as well as the DON’s own internal needs, including, but not limited to, data on the processing and disposition of all its FOIA—as well as some of its Privacy Act—cases (which may consist of requests, appeals, referrals, consultations), including backlogs, perfected-request status, fee-related matters, and performance (such as response time) of the DON as a whole, its constituent services (Navy and Marine Corps), its commands, its field FOIA activities, and its FOIA practitioners.

• Records Storage: A complete record of the case histories is maintained for as long as needed and in a way that is legally defensible and satisfactory to the DON’s mission as well as readily available to Government-authorized users on a need-to-know basis.

The DON requires a commercially available Software-as-a-Service (SaaS) solution capable of sustaining these enterprise requirements under strict federal and defense security authorizations.

3. Scope

The Contractor shall provide a fully functional, cloud-based, Software As A Service (SaaS) FOIA Case Management System (“the Solution”), along with associated hosting, system maintenance, customer help desk operations, data migration, and user training.

To satisfy the Government’s requirements, any proposed Solution must meet or exceed the salient characteristics specified below.

3.1 - Software As A Service (SAAS) Configuration: The Solution shall be Software As A Service (SaaS), Commercial-Off-The-Shelf (COTS), and cloud-based. It shall enable submittal by the public and administration by DON personnel through a website that affords processing, storage, management, communication, tracking, and the capability to generate extensive report with respect to requests, appeals, and consultations. The website needs to be user-friendly and afford access to the public at large to requests and records in accordance with a variety of privileges reflecting differences in authority. Desired is an Agile configuration approach to conform with changes in law and policy, to support an ongoing evolution in FOIA workflows and processes, workflows, and to reduce complexity, communications, and the training burden in the long term.

3.2 - FOIA Case Management System: This shall be a solution (and the “Solution”) to all of the DON’s processing needs under the Freedom of Information Act (FOIA), whether express or implied, including the extent to which the FOIA overlaps other statutes such as the Privacy Act. It shall consist of software as well as support services that are so effective and efficient that the DON shall never need to get involved in the operations, upkeep and updating of this system, except to the extent that it may wish, at its own discretion, to adapt this system to the peculiarities of its own operations and personnel. Accordingly, the Solution shall comply with and enable the DON efficiently to implement all applicable laws, regulations, and policies, including those pertaining to Controlled Unclassified Information (CUI), classified information, confidentiality requirements, non-disclosure requirements, confidential business information requirements, continuous service improvement requirements, staffing requirements, program management requirements, and include an appropriate phase-in plan and/or a phase-out plan. Specifically as to staffing, about 150 Full Time Equivalent (FTE) personnel (or about 500 individuals), possibly more, shall need accounts as privileged users (“Users”) of the Solution, and no limitation on this number of Users is preferred. Such accounts need to be organized, as well as easily revisable by the DON at its own discretion to reflect accurately the DON’s extensive, ramified hierarchy of commands and activities, such that an account may be easily looked up, as well as identified within the command structure, by either the name of the User or the User’s command. The Solution shall provide acceptable phase-in staging, including access to the system for security review and evaluation, data migration, helpdesk support services and training for both DON Users and public users by August 1, 2027 to ensure a smooth and effective transition to full operations that are anticipated to commence on September 25, 2027.

Thereafter, it shall, at the DON’s sole discretion, immediately provide the DON the complete means, including all of its program and system data that it may need to, switch to whatever other product, system, service, or operation it may choose in the future to serve as a replacement of the Solution, at any time. The Solution shall be secure, accessible, stable, up to date, cost efficient and sustainable, easy to use for both the public and DON users, and support efficient workflows with minimal manual steps, and will be regularly updated with enhancements. Specifically, by September 25, 2027, it shall need to be approved by the applicable authorities (e.g., the September 25, 2028 at Impact Level 4 or higher.

3.3 - Operations and Maintenance: The Solution shall be a continuously accessible, operational, and secure FOIA Case Management System, providing optimal experience and functionality for all DON Users and public users, such that they shall have accounts that are easy for them to create and to revise, with such accounts for DON Users to be organized in a convenient, ongoing, and useful representation of the DON’s organization, such that the arrangement may be easily revised. In addition, a User with appropriate permissions should be able independently to look up any other User either by the User’s name or the User’s Command as well as to generate a report that displays all Users and their associated commands or offices in a way that shows how these Users fit into this organization’s hierarchical, multi-tiered and compartmentalized structure.

3.4 - Help Desk Support: This shall provide timely resolution of reported issues to ensure professional and positive end-user experience and the ability to elevate unresolved issues to appropriate personnel. It should be available by either email or telephone number, though the main means of communication is expected to be by email.

3.5 - Training: The DON requires effective training and documentation for end-users and administrators on the Solution to ensure Users are proficient in its features and in its functionality and are able to use the Solution effectively and efficiently and to have a positive experience doing so. Such training should be available in a variety of modes, including on-line and in person, though it may be mostly on-line.

3.6 - Interoperability: The Solution must be flexible so that it allows maximal use of DON-designated IT systems that are both internal and external (new and existing) to leverage capabilities, to ensure compliance, and to optimize cost. The Solution will not be a shared federal service, but it should be easy to integrate with other such systems maintained by the DON’s parent agency, the Department of War (DoW)—also known as the Department of Defense—as well those of DoW component agencies. In addition, it must be compatible with FOIA.gov, a website of the Department of Justice Office of Information Policy (DoJ OIP) and any other similar such systems of FOIA oversight agencies. Specifically with respect to FOIA.gov, the Solution must furnish an Application Programming Interface (API) in compliance with the requirements of the DoJ and the DoW.

3.7 - Transition Support: The contractor for this selected product shall provide the resources sufficient to ensure seamless continuity of operations, system performance, and data integrity.

3.8 - Records Management: The Solution shall enable the public and DON personnel to easily store, search, retrieve, and dispose of records.

3.9 - Support for data migration: The DON requires complete support for all data migration needed to implement the Solution as well as for data migration to any future system that might replace the Solution in the event that the DON determines this to be appropriate.

4. Tasks

4.1. SaaS Configuration

4.1.1. The Solution shall be delivered as a cloud-based SaaS deployment accessible to internal DON personnel and the public via standard, modern web software applications.

4.1.2. The Solution shall maintain a Federal Risk and Authorization Management Program (FedRAMP) Moderate authorization. The Contractor shall achieve and sustain a DOW Impact Level 2 (IL2) authorization by September 25, 2027, and transition to Impact Level 4 (IL4) or higher by September 25th 2028.

4.1.3. The Solution shall enable reporting to the DON sufficient to meet its hosting environment and application audit requirements for accounts and configuration/patch management in compliance with the DON’s internal and external assessment and security needs.

4.1.4. The Solution shall enable DON Users to establish and to maintain role-based access on an individual account basis to allow for a least-privilege configuration.

4.1.5. The Solution shall provide low-code/no-code workflow generation and modification by DON Users to maintain appropriate processes for DON FOIA processing and application management without the need for application developer interaction.

4.1.6. The Solution shall provide automated and custom triggers to remind DON Users of deadlines and tasks set by individual DON Users or as an administrative FOIA processing function.

4.1.7. The DON requires the Solution be available to DON Users through an enterprise-wide (i.e., serves everyone in the DON in entirety, not just as an individual or group of individuals therein) license to be offered at a firm fixed price, preferably with no limitation on the number of User accounts or on the quantity of information processed.

4.1.8. The Solution shall enable DON system administrators to create and to revise User accounts in a way that fits them together within the complex, hierarchical, multi-tiered structure of the DON’s organization in a way that may be easily viewed within the system, re-arranged immediately to reflect changes in this structure, and depicted in readily available reports, such that one may look up any particular User either by name or by unit within the hierarchy.

4.2. FOIA Case Management

4.2.1. The contractor shall migrate all records, structured data, and unstructured data from the current systems into the replacement Solution for equally convenient and controlled use by all DON Users and by all public users.

4.2.2. The Solution shall satisfy all requirements of Section 508 of the Rehabilitation Act throughout the contract term.

4.2.3. The Solution shall satisfy the requirements of Department of Defense Directive 5015.2, Electronic Records Management Software Applications Design Criteria Standard throughout the contract term.

4.2.4. The Solution shall comply with National Archives and Records Administration Electronic Records

Management regulations (36 C.F.R. Part 1236) throughout the contract term.

4.2.5. The Solution shall provide out-of-the-box low code/no code configurable FOIA case management workflows based upon role-based permissions.

4.2.6. The Solution must be able to create reports on all data and metadata maintained in the system for use by

DON Users.

4.2.7. The Solution shall create and assign unique, standardized identifiers for each FOIA request (hereinafter “request”), allowing for each record to be controlled by a unique identifier, with a tracking number system,

4.2.8. The Solution shall accurately compile raw data and perform accurate calculations within the system in accordance with Department of Justice guidelines for the FOIA Annual Report and such data are to be available on demand as reports suitable for submission to the Department of Justice and the DoW.

4.2.9. The Solution shall provide DON Users the ability to create standard reporting.

4.2.10. The Solution shall provide DON Users the ability to create ad-hoc reporting sufficient to meet all program administrator and audit needs concerning the system, the program or staff performance.

4.2.11. The Solution shall record, calculate, and manage all statutorily required timeframes in accordance with the FOIA and DON regulations.

4.2.12. The Solution shall record and calculate time periods between all actions within the system (i.e., audit log) from which DON Users can generated ad-hoc reports.

4.2.13. The Solution shall provide DON Users the ability to generate correspondence templates.

4.2.14. The Solution shall provide the ability to create customizable public-facing instructional text for FOIA request submissions, allowing public users (requesters) to attach files to their request and accept the submitted request into the system.

4.2.15. The Solution shall provide the ability to create customizable public-facing instructional text for fee waiver submissions, allowing public users (requesters) to attach files to their request, and accept the

4.2.16. The Solution shall provide the ability to create customizable public-facing instructional text for expedited processing submissions, allowing public users (requesters) to attach files to their request, and accept the

4.2.17. The Solution shall provide the ability to create customizable public-facing instructional text for FOIA appeal submissions and enable public users (requesters) to attach files to their request and accept the

4.2.18. The Solution shall provide the ability to create customizable public-facing instructional text for certain

FOIA request submissions (e.g., for the Navy, the Marine Corps, the Naval Criminal Investigative Service, the Office of the Inspector General, the Office of the Judge Advocate General) and to enable public users (requesters) to attach files to their request and accept the submitted request into the system.

4.2.19. The Solution shall provide the ability to create customizable public-facing instructional text for Privacy

Act submissions and to enable public users (requesters) to attach files to their request and to accept the

4.2.20. The Solution shall support unique configuration of rules and workflow for proprietary business information determinations.

4.2.21. The Solution shall support creation of cases by DON Users for FOIA requests submitted by non-electronic means (e.g., U.S. Mail, overnight delivery, hand-delivery).

4.2.22. The Solution shall assign unique standardized identifier when the request is submitted by the requester.

4.2.23. The Solution shall enable authorized DON Users to assign designated fee categories to submitted requests.

4.2.24. The Solution shall provide the ability to add notes to the case record for efficient case-record keeping.

4.2.25. The Solution shall be capable of designating a request as perfected.

4.2.26. The Solution shall automatically assign processing statuses to requests (e.g., Submitted, Intake -Initial Evaluation, Perfected Requests, Assignment Determination).

4.2.27. The Solution shall assign and track tasks (e.g., initial review, expedited review, search pending).

4.2.28. The Solution shall enable the uploading of all task-related documents and supporting files to facilitate efficient task completion.

4.2.29. The Solution shall enable the cancellation of assigned tasks.

4.2.30. The Solution shall enable DON Users to identify and to create views of all cases received by the agency.

4.2.31. The Solution shall identify requests received but not assigned to a DON component.

4.2.32. The Solution shall enable the assignment of subject metadata to requests.

4.2.33. The Solution shall make possible permission-based DON User views of individual staff workloads.

4.2.34. The Solution shall provide for the capability of recording assignment dates.

4.2.35. The Solution shall provide dynamic search capabilities to identify duplicate requests.

4.2.36. The Solution shall provide for automated notification of staff assignments.

4.2.37. The Solution shall enable staff to add notes to the case record.

4.2.38. The Solution shall enable DON staff to create and manage requests, referrals, consultations, appeals, and proprietary business information cases.

4.2.39. The Solution shall provide the capability for assigning expedited processing tasks.

4.2.40. The Solution shall provide for the capability of assigning fee waiver tasks.

4.2.41. The Solution shall provide the capability to search for and identify delinquent fees to aid in overdue fee collection.

4.2.42. The Solution shall make possible the assignment and reassignment of all requests, appeals and consultations and provide automated notifications about the assignment/reassignment.

4.2.43. The Solution shall provide real-time dashboards and analytics, creating views of all requests’ processing status and metrics.

4.2.44. The Solution shall enable the viewing of all requests, appeals, and consultations assigned by the DON

User.

4.2.45. The Solution shall create and manage DON User lists and designate each DON User’s permission level.

4.2.46. The Solution shall enable the configuration of internal DON FOIA offices and regions for each request assignment.

4.2.47. The Solution shall create and manage a multi-tier tracking system (e.g., simple, complex, expedited, fee waiver).

4.2.48. The Solution shall be able to create and manage a FOIA Exemption 3 statute list.

4.2.49. The Solution shall enable permission-based DON Users to override date calculations that are part of processing workflows.

4.2.50. The Solution shall provide a processing clock that tracks working day (excluding weekends and federal holidays) processing time and that has stop/hold capabilities to allow clock tolling for request clarification purposes and fee related reasons.

4.2.51. The Solution shall allow permission-based DON Users to manage the request clock, including the ability to stop the clock for request clarification purposes and fee related reasons and to extend due dates with fields to record the basis for time management decisions.

4.2.52. The Solution shall provide permission-based DON Users the ability to close or re-open requests.

4.2.53. The Solution shall provide a view of all requests, appeals and consultations assigned to each component.

4.2.54. The Solution shall allow permission-based DON users to notify a request processor when the request is assigned.

4.2.55. The Solution shall allow permission-based DON users to re-assign requests and to notify the newly assigned processor.

4.2.56. The Solution shall be able to unpublish records previously released to the public.

4.2.57. The Solution shall be able to store and retrieve all released and unreleased records according to a defined records management structure.

4.2.58. The Solution shall have the ability to upload released and unreleased records with any size limitations higher than 750 GB, i.e., there shall be no requirement to break down a large file into separate documents if below this size.

4.2.59. The Solution shall enable the public to access and download released records.

4.2.60. The Solution shall be able to manage correspondence logs, allowing DON users to sort by fielded data in terms such as “correspondence subject,” “date sent/received,” “sent by,” and “sent to.”

4.2.61. The Solution shall be able to process, store, track and manage Privacy Act requests.

4.2.62. The Solution shall be able to apply certificate-based e-signatures to correspondence, which complies with the DON’s e-signature policy (SECNAVINST 5239.24) and PL 115-36 (21st Century Integrated Digital Experience Act).

4.2.63. The Solution shall enable permission-based DON Users to create custom tasks.

4.2.64. The Solution shall enable permission-based DON Users to delete cases.

4.2.65. The Solution shall enable access through the Common Access Card (CAC)/ Personal Identity

Verification (PIV) authentication process.

4.2.66. The Solution shall allow DON software administrators to create and manage account profiles and all role-based permissions, including those for: Software Administrators, Operations & Maintenance Staff, Public Requesters, Public Viewers, FOIA Leadership & Management, Report Processors, Intake Review Processors, Expedited Processing Processors, Fee Waiver Processors, Awareness Notification Processors, Privacy Act Processors, Appeals/Litigation Processors, FOIA Officers/Coordinators, Case Processors, Subject Matter Experts, Document Reviewers, Final Determination Signatories.

4.2.67. The Solution have the ability to create a non-public/internal view for Privacy Act requests and provide a public view with the ability to post a comment such as the follows: "For statutorily protected requester privacy, this description is not available to the public” or “For statutorily protected requester privacy, these attachments are not available to the public.”

4.2.68. The Solution shall be able to designate uploaded records by standard FOIA parameters (e.g., UU unredacted unreleasable, RU redacted unreleasable, RR redacted releasable, RU redacted unreleasable) and sort records by those parameters.

4.2.69. The Solution shall accept the following file types for upload: 'bmp', 'jpg', 'jpeg',' gif',' png', 'odt', 'txt', 'pdf', 'docx', 'xlsx', 'pptx', 'mp4', 'mp3', 'mpg', 'mov', 'avi', 'wav', 'wmv'.

4.2.70. The Solution provide the public full-text records search capability for all FOIA requests and released records residing in the repository.

4.2.71. The Solution shall provide a means for an explanation of the way in which and the frequency with which backup files are validated and tested and how these test results are communicated to DON Users.

4.2.72. The Solution shall test and validate backup files to ensure data backup access and data redundancy in case of a system failure.

4.2.73. The Solution shall be able to create the FOIA Annual Report in accordance with Department of Justice guidelines and handbook for the FOIA Annual Report.

4.3. Operations and Maintenance

4.3.1. The Solution shall be accessible through the internet for DON Users and public users on a continuous basis for on-demand access at all times, subject only to scheduled and non-scheduled downtime no greater than 1% of the time.

4.3.2. The Solution shall enable DON Users and public users to establish appropriately privileged accounts on-demand using a government approved authentication process such as login.gov without the need for additional account management.

4.3.3. The Solution shall enable public users to manage their own profile information on demand to allow them to update their electronic and physical contact information and payment settings.

4.3.4. The Solution shall enable public users to access records ondemand pertaining to their FOIA submission(s) as authorized by DON Users.

4.3.5. The Solution shall enable DON Users to manage all records pertaining to FOIA requests, appeals, and consultations, including items published to the public as well as items restricted to DON Users only.

4.3.6. The Solution shall meet all DON cybersecurity requirements.

4.4. Help Desk Support

4.4.1. The contractor shall deliver a service level agreement (SLA) in writing for all customer support services both public users and DON Users.

4.4.2. The contractor shall provide help desk support through both email and phone. The contractor shall staff the help desk Monday through Friday from 7am eastern time to 5:30pm eastern time, except Federal Holidays.

4.4.3. The contractor provide email support with a support request ticket number to track and identify the request, containing an acknowledgment response time and an estimated resolution time.

4.4.4. The contractor shall provide a status email for all requests taking longer than one business day by providing a daily status update

4.4.5. The contractor shall provide timely resolution within 3 business days of reported issues to ensure the system functions as intended and meets the DON User and public user needs.

4.4.6. The contractor shall retain, store, and archive all support request ticket contents for reporting and review.

4.4.7. The contractor shall provide monthly reports detailing each request by support ticket number, including the level assigned, the requester name, the issue description, the dates, and times from initial contact to resolution.

4.4.8. The contractor shall provide a monthly system usage metrics report that includes data growth and DON

User and public user account activities, e.g., disabled, locked, new, deleted, inactive.

4.5. Training

4.5.1. The contractor shall provide a training environment that replicates the production system so that DON

Users may conduct the training exercises.

4.5.2. The contractor shall, if requested, provide live instructor-led hands-on training sessions for approximately 500, possibly more, DON employees so that DON Users obtain the knowledge to complete their job duties. The training sessions shall be as long as appropriate or as requested, be conducted virtually if appropriate, and the contractor shall providing recording for future use upon request by the DON.

Training survey results shall have a 90% effective rating for contractor training to be accepted as complete.

4.5.3. The contractor shall, if requested, provide training exercises so that DON users may obtain self-paced, solo, hands-on training for specific training scenarios relative to their permission level and/or job duties.

4.5.4. The contractor shall make available to the DON training manuals that enable DON Users to efficiently utilize the system and to competently provide subsequent training to other DON personnel independently.

4.5.5. The contractor shall, if requested, provide live instructor-led administrator training for approximately 50, possibly more, DON employees so that DON Users with administrative privileges may obtain the knowledge to complete their job duties. The training sessions shall be as long as needed, conducted virtually, and recorded by the contractor for future use.

4.5.6. The contractor shall provide a comprehensive collection of short (of about 5 to 15 minutes), on-demand, topic/subject arranged training videos so that DON users may conduct self-paced, solo, training sessions.

4.6. Interoperability

4.6.1. The Solution shall be able to integrate with DON’s identity management system to provide identity verification for DON Users, e.g., Personal Identity Verification (PIV) card/ Common Access Card (CAC) card access.

4.6.2. The Solution shall provide a two-way Application Programming Interface (API) for integration with FOIA.gov for the purpose of updating DON instructions and contact information and for the receipt of any FOIA requests, appeals, consultations or referrals submitted through FOIA.gov in compliance with DOJ requirements.

4.6.3. The Solution shall be able to integrate with FOIA.gov for the purpose of transferring FOIA data, such as that of FOIA Annual Report and the FOIA Quarterly Reports, into FOIA.gov.

4.6.4. The Solution shall be able to provide two-way API integration with Login.gov.

4.6.5. The Solution shall be able to integrate with Lightweight Directory Access Protocol (LDAP) natively.

4.6.6. The Solution shall be able to provide two-way API integration with Pay.gov to ensure that payments received by Pay.gov are recorded in the system.

4.6.7. The Solution shall be able to integrate with and access to e-Discovery software, such as Relativity.

4.6.8. The Solution shall be compliant with the DON’s information technology, notably the Navy Marine Corps Intranet (NMCI), Teams, as well as its “Flank Speed” Microsoft Office 365 email, and have capabilities that include that of capturing correspondence sent to DON Users from any email system used by the requester.

4.7. Transition Support

4.7.1. The contractor shall provide support for the following: migration of legacy data; delivery of a data migration plan and schedule; defined procedures for data profiling, data quality assessments and data enrichment processes along with execution thereof; expertise in business and system data reconciliation strategies and execution across multiple test phases; execution in target data store architecture and optimization; Cloud transition services (including temporary hosting to ensure business continuity in the event that the DON terminates the SaaS contract), data availability upon termination of the contract, data portability (making available to the DON all data needed for its FOIA and PA programs in a structured, commonly used DON format and machine readable formats. Data should be returned to the DON in both the SaaS vendor’s data form and DON used format. Once a successful hand-off of that data has been confirmed by the DON, the vendor shall remove this data from all SaaS vendor servers).

4.7.2. The contractor shall designate and make available a primary lead and project manager to the DON data migration team.

4.7.3. In the case of a replacement of the product made available under the Deloitte contract, the contractor shall complete data migration to the Solution by July 1st 2027; in the case of a replacement of the Solution, by three months in advance of the expiration of the contract for the Solution

4.7.4. The contractor shall receive and process approximately 500 GB FOIAonline data package in an XML data interchange format with accompanying file system folders of multiple file types, i.e., 'bmp', 'jpg', 'jpeg',' gif',' png', 'odt', 'txt', 'pdf', 'docx', 'xlsx', 'pptx', 'mp4', 'mp3', 'mpg', 'mov', 'avi', 'wav', 'wmv'.

4.7.5. The contractor shall obtain a secure transfer method that is approved by the DON to access and download the secured, encrypted the DON data package.

4.7.6. The contractor shall download the DON data package from the incumbent and validate the package with a computed hash value as instructed by the DON team.

4.7.7. The contractor shall develop data importation scripts necessary to read and import the DON data package from the incumbent into the new system.

4.7.8. The contractor shall provide the DON team with application access to newly imported data so that the DON team may confirm and validate the import success.

4.7.9. The contractor shall temporarily keep the downloaded data package in a secure location until the DON confirms the importation was successful.

4.7.10. The contractor shall test the system to confirm that data migration is complete and confirm that data integrity is 99.9% acceptable to the DON.

4.8. Records Management

4.8.1. The Solution shall comply with the Federal Records Act (44 U.S.C. Chapter 31).

4.8.2. The Solution shall provide workflows implementing DON records schedules enabling the DON Users to create/receive, maintain and use, and dispose of records.

4.8.3. The Solution shall provide the ability for DON records schedules to be included in records’ meta-data, allowing for standardized classification and disposition rules to be applied to all records in the system.

4.8.4. The Solution shall identify and manage records released to the public, and records unreleased to the public, according to DON’s records schedules, allowing FOIA processors to manage all records related to each request.

4.8.5. The Solution shall provide DON users full-text document search capability for all records stored in the system, to include a search for any data by keyword.

4.8.6. The Solution shall provide the public full-text document search capability for all records released into the public repository.

5. Other Pertinent Information

5.1.1. Acronyms—

Abbreviation Definition AA Advanced Analytics AI Artificial Intelligence ACOR Alternative Contracting Officer Representative BAA Business Associate Agreement BUMED The Bureau of Medicine and Surgery BUMIS II BUMED Manpower Information System II BO Business Objective CAC Common Access Card CBA Capability-based Assessment CDD Certification of Data Disposition CDRL Contract Data Requirement List COR Contracting Officer Representative COTS Commercial Off The Shelf DHA Defense Health Agency DHS Department of Homeland Security DMDC Defense Manpower Data Center DMHRSi Defense Medical Human Resources System internet DMLSS Defense Medical Logistics Standard Support DoD Department of Defense DON Department of the Navy DON CIO Department of the Navy Chief Information Office DRRS Defense Readiness Reporting System DSA Data Sharing Agreement DSAA Data Sharing Agreement Application ECAT Medical Equipment Catalog EMPARTS Expeditionary Medicine Platform Augmentation, Readiness, and Training System ELT Extract-Load-Transform ETL Extract-Transform-Load FLTMPS Fleet Training Management Planning System FMF Fleet Marine Forces FOIA Freedom of Information Act FTC Federal Trade Commission FTR Federal Travel Regulations FYDP Future Years Defense Program GFMAP Global Force Management Allocation Plan HHS Health and Human Services HIPAA Health Insurance Portability and Accountability Act HMPDS Health Manpower and Personnel Data System IA Individual Augmentee IAW In Accordance With IDA Initial Denial Authority IMR Individual Medical Readiness IW Intelligent Workbook JCIDS Joint Capabilities Integration Development System JMPT Joint Medical Planning Tool JTR Joint Travel Regulations MeDMACRE Medical All Corps Requirements Estimator MELS Medical Equipment & Logistical Solutions MHS Military Health System MHQ Maritime Headquarters MOC Maritime Operations Center MPTk Medical Planners Toolkit

NMRTC/U Naval Medical Readiness Training Centers/Units M&S Modeling and Simulation MTF Military Treatment Facilities M2 Military Health System Mart NIST National Institute of Standards and Technology NDAA National Defense Authorization Act NES Navy Enlisted System NMFL Naval Medical Forces Atlantic NMFP Naval Medical Forces Pacific NMFSUPCOM Naval Medical Forces Support Command NMPBS Navy Manpower Program and Budget System NMRTC Naval Medical Readiness Training Commands NPI National Provider Identifier NRDW Navy Reserve Data Warehouse NTMPS Navy Training Management and Planning System OCO Overseas Contingency Operations OCIO Office of the DON CIO ODC Other Direct Costs OPINS Officer Personnel Information System OPNAV Office of the Chief of Naval Operations ORA-SME Operations Research Subject Matter Expert PA Privacy Act PAF Personnel Availability File PBIS Program Budget Information System PCLO Privacy and Civil Liberties Office PII Personally Identifiable Information PHI Protected Health Information POA&M Plan of Action & Milestones POC Points of Contact PoF Presentation of Forces PWS Performance Work Statement QC Quality Control RCRP Readiness Cost Reporting Program ROMO Range of Military Operations R2M2 Readiness and Risk Models Suite SaaS Software as a Service SABRS Standard Accounting, Budgeting, and Reporting System SDOB SecDef Orders Book Section 508 Section 508 of the Rehabilitation Act of 1973 SG Surgeon General of the Navy SME Subject Matter Expert Solution The FOIA Case Management System SORTS Status of Readiness and Training System TFMMS Total Force Manpower Management System TFRA Total Force Risk Analysis TMO The Medical Officer TOM Task Order Manager US-CERT United States- Computer Emergency Readiness Team

5.2. Period of Performance—The base period of performance for this requirement is May 1, 2027 through

September 25, 2027 for the website build and training. The resultant contract will feature four (4) one (1) year option periods consecutively following the base period to operate and maintain the website.

5.3. Place of Performance—100% of performance will be at the contractor site.

5.4. Government Furnished Equipment/Property/Information—There is no GFE for this requirement.

5.5. Security Requirements—The highest level of security required for this requirement is UNCLASSIFIED. See the Local Security Clause for details.

5.6. Travel—There is no travel for this requirement.

5.7. Other Direct Costs (ODCs)— There are no ODCs for this requirement.

5.8. Other Information—

5.8.1. The below statutes and regulations apply:

• Federal Records Act (44 U.S.C. Chapter 31)

• DON Records Schedules (see secnav.navy.mil/doni/default/aspx)

• The Freedom of Information Act (5 U.S.C. § 552)

• Privacy Act (5 U.S.C. § 552 (a))

• SECNAVINST 5720.42G, the DON FOIA instruction

• SECNAVINST 5211.5F, the DON PA instruction

• SECNAV M-5239.3, the DON Cybersecurity Manual

• SECNAVINST 5210.8F, the DON Records Management instruction

• M-5210., the DON Records Management manual

• DON Records Management Regulation, 32 C.F.R. § 701

• DoD FOIA Regulations 32 C.F.R. § 286 et seq

• DODM 5400.07, the DoD FOIA manual

• DoDI 5200.48, Controlled Unclassified Information (CUI)

• Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d)

• Administrative Procedures Act of 1946

• 21st Century Integrated Digital Experience Act (PL 115-36) •SECNAVINST 5239.24, DON Electronic Signature Policy

• Department of Defense Directive 5015.2, Electronic Records Management Software Applications Design Criteria Standard

• National Archives and Records Administration Electronic Records Management Regulations (36 C.F.R.

Part 1236)

• Government Paperwork Elimination Act of 1998 (Pub. L. 105-277)

• EPEAT compliance for covered asset acquisition requirements (www.epeat.net)

• Capability Maturity Model Integration (CMMI) Level 3 Certification

• Clinger-Cohen Act of 1996 and associated OMB guidance and directives

• Federal Register Act of 1935

• Federal Enterprise Architecture and associated guidance and models

6. List of Deliverables

PWS

Section: Deliverable Recipient Level of

Inspection Frequency

All Kick-off meeting & minutes COR 100% 5 days after award All Draft Project management plan COR 100% 15 days after award

All Final Project management plan

COR 100% 5 days after DON comments

4.4.7 Support Ticket Report COR 100% Monthly

4.4.8 Usage Metrics Report COR 100% Monthly

4.2.75 FOIA Annual Report COR 100% Annually

6.1. Deliverable Detail— All reports shall be submitted in Microsoft Office Suite compatible files

7. Performance Standards

7.1. The Contractor is responsible for reviewing all work for proper accuracy and content. The Contractor shall document progress and produce required status reports that itemize and explain applicable deliverables. The COR/ACOR and/or TA will review contractor deliverables and reports to validate end products were delivered IAW specifications stated in the PWS. The COR/ACOR who have sole authority to inspect and accept or reject contractor deliverables. The acceptance of deliverables and satisfactory work performance required herein shall be based on the timeliness and accuracy of the products received.

Performance Element

Performance Requirement Surveillance Method

Frequency Acceptable Quality Level

Contract Deliverables

Contract deliverables furnished as prescribed in the PWS, attachments, CDRLs, Task Orders, etc., as applicable.

100% inspection by the recipient or COR

100% inspection of all contract deliverables.

>95% of deliverables submitted timely and without rework required.

Overall Contract Performance

Overall contract performance of sufficient quality to earn a Satisfactory (or higher) rating in the COR’s annual report on Contractor Performance

100% inspection by the recipient or COR

Annual All performance elements rated Satisfactory (or higher)

Invoicing Monthly invoices per contract procedures are timely and accurate.

Review & acceptance of the invoice

Monthly 100% accuracy

Contractor Quality Control Plan

QC activities, inspections, and corrective actions completed as required by the plan

Inspection by the COR

Quarterly for overall QC activities; as required for corrective actions

100% compliance with the contractor plan