Attachment J-1 SOW.pdf

Solicitation 9594CS26R0004 Attachment J-1: Section C - Statement of Work

Public Safety Data Analytics Platform & Support Services C.1 Introduction.

C.1.1 The Court Services and Offender Supervision Agency (CSOSA), a federal, executive branch agency, created by Congress in 1997 to perform the offender supervision function for the District of Columbia. It does so in coordination with the Superior Court of the District of Columbia and the U.S.

Parole Commission. CSOSA's mission is to increase public safety, prevent crime, reduce recidivism, and support the fair administration of justice in close collaboration with the community.

C.1.2 The Office of Information Technology is responsible for providing information technology services to support the mission requirements of CSOSA. Organizational functions include a wide range of information technology products and services including the Agency’s case management system, other supporting applications, networking and telecommunication, management of operational technologies, software engineering, web technology, helpdesk, desktop support and information assurance/security.

C.2 Project Objectives. The project objectives are to:

C.2.1 Eliminate stove pipe data and enabling the effective use of all available data sources by integrating internal Case Management data with external law enforcement feeds in near real time.

This will enhance and bring efficiency to the operations of the Office of Community Supervision & Intervention Services (OCIS) staff in their daily duties ensuring access to timely factual data to the CSOs that will enable them to make informed decisions.

C.2.2 Enhance management’s capabilities to assess and monitor all operational activities, agency support components, and resources to improve management’s capability to make fully informed decisions on responding to the dynamic changes that evolve in the public, which requires the public safety, law enforcement community to instantly respond, and take action. These events directly impact performance, location, and how the Agency takes action in any given situation. These dynamic occurrences of events, situations, circumstances now require that management in is equipped with instant access to all available data at an enterprise level at any given time.

C.3 Project Management Plan (PMP). The Contractor shall provide a PMP to the Contracting Officer’s Representative (COR) within 60 days from date of contract award. The PMP shall detail the milestones for each deliverable, including but not limited to all tasks for completing:

• Deployment of a platform that meets all requirements outlined in this Statement of Work;

• Security Controls and System Security Plan (SSP);

• Data integration, validation from identified sources;

• Training Plan; and

• Developing work flows, publishing any templated reports, maps, dashboard. develop workflows, maps (graphical rendering of information), dashboards, analytics, and reports for use by CSOSA.

C.4 System Security Plan (SSP). No later than 75 days from contract award, the Contractor shall provide its existing SSP that explicitly defines the Authorization Boundary for the provided platform.

This boundary must encompass all hardware, software, interconnected APIs (Application Programming Interfaces), and storage components used to process, store, or transmit Agency data.

9594CS26R0004

Public Safety Data Analytics Platform

C.5 Public Safety Data Analytics Platform Requirements. The Contractor shall provide a public safety data analytics platform that meets the following requirements:

C.5.1 A Software as a Service (SaaS) solution;

C.5.2 Listed on the FedRAMP Marketplace as FedRAMP Moderate Authorized to Operate (ATO) (at minimum) for the duration of the contract;

C.5.3 Compliant with:

C.5.3.1 National Institute of Standards and Technology (NIST) SP 800-53 (Rev Moderate Baseline as defined in NIST SP 800-53B;

C.5.3.2 Criminal Justice Information Services (CJIS) Security Policy v5.9 (or later);

C.5.3.4 Section 508 of the Rehabilitation Act of 1973; and

C.5.4 Functional Requirements.

C.5.4.1 Has dynamic data modeling capabilities and can store correlate and present data in various forms to include data, pictures, graphs, interactive maps and data reports and dashboards.

C.5.4.2 Has universal search capabilities, i.e., aggregates data from multiple, disparate sources and displays it in a single, unified interface. Sources include, but not limited to CSOSA’s current case management system (Supervision & Management Automated Record Tracking (SMART 21)) and CSOSA’s SharePoint Data Library, and external (other public safety partners) i.e., external systems with local public safety law enforcement partners, such as Metropolitan Police Department of the District of Columbia (MPD), Prince George’s County Police Department (PGPD), Alexandria Police Department (APD), and Fairfax County Police Department (FCPD).

C.5.4.3 Has secure collaboration functionality with granular access control.

C.5.4.4 Has the capability to allow surfacing the data dynamically in different formats.

C.5.4.5 Has real time alerting functionality.

C.5.4.6 Has the capability to present data with auditable deduplication and merge data from various sources.

C.5.4.7 Possesses the capability to conduct automated searches and generate reports without altering the original data sources.

C.5.4.8 Has Multi-Factor Authentication (MFA) capability, i.e., mandatory integration with agency Identity Providers (IdP) using SAML 2.0 or OIDC, requiring phishing-resistant MFA (like PIV/CAC cards or hardware tokens).

C.5.4.9 Has capability to fully function on Government mobile devices, specifically iOS devices and Android devices.

Public Safety Data Analytics Platform

C.5.4.10 Has continuous system operation, monitoring, and availability defined as:

• 24x7x365 automated monitoring of the solution and data environment including:

o Vulnerability Management, i.e., monthly vulnerability scans and remediation of

"High" vulnerabilities within 30 days and "Moderate" within 90 days;

o Incident Response, i.e., standardized notification window to the Agency and US- CERT in the event of a suspected security breach;

o Annual Assessment, i.e., participation in an annual security assessment by a Third Party Assessment Organization to maintain the FedRAMP status.

• An availability level of 99.9%, excluding scheduled maintenance windows provided in advance to the COR.

C.5.5 Third-Party Dependencies. Any third-party Software-as-a-Service (SaaS) or managed service utilized by the Contractor to support the delivery of this platform (including but not limited to logging, monitoring, data visualization, or ticketing systems) that touches Agency data or metadata must reside inside the Authorization Boundary or hold an independent FedRAMP Moderate (or higher) Authorization.

C.5.6 Data Residency and Personnel.

C.5.6.1 All data, including metadata and backups, must reside within the continental United States in a GovCloud or equivalent CJIS-compliant data center.

C.5.6.2 The Authorization Boundary, including all primary and failover data centers, must reside strictly within the geographic United States (e.g., AWS GovCloud or Azure Government).

C.5.6.3 In accordance with 22 CFR § 120.15, all personnel with physical or logical access to the Authorization Boundary (including administrators, database architects, and developers) must be U.S.

Persons as defined by 22 CFR § 120.15.

C.6 Boundary Integrity. The Contractor shall ensure that no Agency data, including Criminal Justice Information (CJI) or Personally Identifiable Information (PII), is transmitted to or stored in any corporate system (e.g., corporate email, Slack, or unencrypted storage) that sits outside the defined Authorization Boundary.

C.7 On-Site Full-Time Technical Analyst.

C.7.1 The Contractor shall provide one on-site full-time equivalent (FTE) technical analyst for the period of performance identified in section C.20 below (i.e., 36 months from date of award). The on-site technical analyst shall:

C.7.1.1 Perform a minimum of 1,920 productive hours during each 12-month period of performance for the life of the purchase order. Productive hours are defined as hours spent

Public Safety Data Analytics Platform performing actual work on-site at CSOSA and explicitly exclude vendor employee paid time off (PTO), sick leave, and corporate holidays.

C.7.1.2 Shall be on-site at CSOSA Monday through Friday, 8 hours a day, excluding federal holidays.

C.7.1.3 Shall have a minimum of three years of experience in Criminal Justice Data Modeling.

C.7.2 The on-site technical analyst shall, at a minimum:

C.7.2.1 Integrate CSOSA’s current case management system (SMART 21) and CSOSA’s SharePoint Data Library into the platform.

C.7.2.2 Connects Government mobile devices, specifically iOS devices and Android devices, to the platform so that CSOSA personnel can use the platform via assigned mobile devices.

C.7.2.3 Develop workflows, maps (graphical rendering of information), dashboards, analytics, and reports for use by CSOSA; and

C.7.2.4 Configure an automated process for real-time alerting that identifies critical "matches" across live data streams and immediately notifies relevant personnel.

C.7.2.5 Integrate two external data sources (to be identified by the COR) in the platform once implementation of the platform is completed.

C.8 Public Safety Data Analytics Platform Maintenance. The Contractor shall provide maintenance for the duration of the contract to include:

C.8.1 Preventative Maintenance: Routine updates, security patching, and database optimization.

C.8.2 Corrective Maintenance: Bug fixes and resolution of system errors discovered post-deployment.

C.8.3 Adaptive Maintenance: Minor configuration changes to accommodate browser updates or OS updates on mobile devices (Android/iOS).

C.9 Public Safety Data Analytics Platform Support.

C.9.1 The Contractor shall provide 24x7x365 technical support, issue triage, troubleshooting, and issue response and resolution. 24x7x365 support must be provided by U.S.-based personnel.

Support shall be provided in accordance with the Contractor’s defined service level agreement.

C.9.2 The Contractor shall provide the COR with a monthly Support and Uptime Report detailing all tickets opened, the resolution time for each, and the overall system availability for the period.

Public Safety Data Analytics Platform

C.10 Training.

C.10.1 The Contractor shall provide a training plan to the COR with 30 days from contract award for three tiers of users: Administrators, Power Users (Analytic staff), and End Users. Specific training dates to be determined by the COR.

C.10.2 The Contractor shall provide on-site and virtual training for each above identified user tier as follows:

C.10.2.1 Administrator Training. For each 12-month period of this contract, the Contractor shall provide:

• One virtual (live instructor; not on-demand) training class (total three classes over 36 months) for up to five CSOSA personnel per class; and

• One on-site in-person training class (total three classes over 36 months) for up to five CSOSA personnel per class. On-site training is at a CSOSA facility (as determined by the COR) located in Washington, DC.

C.10.2.2 Power User Training. For each 12-month period of the term of this contract, the Contractor shall provide:

• Nine virtual (live instructor; not on-demand) training classes (total 27 classes over 36 months) for up to 20 CSOSA personnel per class; and

• Nine on-site in-person training classes (total 27 classes over 36 months) for up to 20 CSOSA personnel per class. On-site training is at a CSOSA facility (as determined by the COR) located in Washington, DC.

C.10.2.3 End User Training. For each 12-month period of the term of this contract, the Contractor shall provide:

• 13 virtual (live instructor; not on-demand) training classes during the first 12 months of the contract performance period for up to 30 CSOSA personnel per class; and

• Three virtual (live instructor; not on-demand) training classes for each the second and third 12-month periods of the contract (total 6 classes over 24 months) for up to 30 CSOSA personnel per class.

C.11 Technical Documentation.

C.11.1 The Contractor shall provide the following technical documentation:

C.11.1.1 System Architecture Diagram. A high-level view showing data flow from ingestion points to storage and the end-user interface.

Public Safety Data Analytics Platform

C.11.1.2 Interface Control Document (ICD). Detailed specifications for every "secure connector."

It must define data mapping (e.g., how "CAD Event Type" maps to "Analytics Incident Category") and API protocols.

C.11.1.3 Data Dictionary: A comprehensive guide defining every data element, its source, and any transformations applied during ingestion.

C.11.1.4 Administrator Guide. Instructions for managing users, configuring Role-Based Access Control (RBAC), and setting up automated data purge/retention scripts.

C.11.2 All technical documentation must be updated and resubmitted to CSOSA for review annually, whenever a significant “version update” occurs and/or when the two external data sources required by C.7.5 above are implemented

C.11.3 Technical Documentation Review.

C.11.3.1 Upon receipt of the above identified technical documentation, the COR will review and provide comments as follows:

• 10 business days for architect diagram;

• 15 business days for ICD;

• 10 business days for final data dictionary; and

• 5 business days for admin guide.

C.11.3.2 Any comments to any technical documentation submitted shall be addressed by the Contractor within 3 business days. The COR will review re-submitted technical documentation within 3 business days. This same process will continue until the COR accepts the technical documentation submitted.

C.12 Data Sources. CSOSA’s current Case Management System (SMART 21) and SharePoint Data Library which consists of:

• SMART 21: Azure SQL Database (~75–99 GB), containing:

o Approximately 96,000 archived files; and o Approximately 10,000 active.

• CSOSA SharePoint Data Library: 151 SharePoint sites and corresponding libraries, including:

o Approximately 260,000 documents; and o Approximately 40,000 photo files.

C.13 Data Rights and Ownership.

C.13.1 All data provided by the Agency to the Contractor, and all data generated, processed, or derived from Agency data by the Analytics Platform, shall remain the sole and exclusive property of the Agency. The Contractor shall acquire no rights or licenses to the Agency’s data, including 'metadata' or 'derived data,' except for the limited, non-exclusive right to use the data solely for the

Public Safety Data Analytics Platform performance of this contract. Upon expiration, termination, or non-renewal of this contract, as outlined in section C.17 below, the Contractor shall provide the Agency with a complete export of all data in a machine-readable format and subsequently certify the permanent destruction of all Agency data residing on Contractor systems.

C.13.2 CSOSA shall retain full and exclusive ownership of all 'Derived Data.' Derived Data is defined as any data, insights, metadata, reports, analytics, or predictive models generated by the Contractor’s software through the processing of Agency Data. The Contractor acknowledges that Derived Data is a 'work made for hire' under U.S. Copyright law. The Contractor is prohibited from using Derived Data for any purpose other than providing services to the Agency under this contract, including but not limited to training external machine learning models or improving products for other customers.

C.14 Restrictions on De-identification and Aggregation. The Contractor shall not de-identify, anonymize, or aggregate Agency Data for any purpose outside the scope of this contract without express written consent from CSOSA. Even if de-identified, such data remains the property of the Agency. The Contractor is strictly prohibited from selling, sharing, or commercializing de-identified Agency Data. Any automated processes within the platform that utilize Agency Data for 'product improvement' must be disabled by default and shall only activated upon express written election by the Agency.

C.15 Right to Audit and Compliance Verification.

C.15.1 CSOSA, or its designated representative, reserves the right to conduct an audit of the Contractor’s data management practices, cloud environments, and internal processes to ensure compliance with data ownership and sovereignty requirements.

C.15.1.1 Audits may include reviews of data logs, deletion certificates, sub-processor agreements, and independent third-party audit reports (e.g., SOC 2, FedRAMP).

C.15.1.2 Audits may be conducted annually or upon 'for cause' suspicion of data mishandling.

The Contractor shall provide requested documentation within 10 business days of the audit request.

C.15.1.3 If an audit reveals unauthorized data retention or usage, or storage outside of CONUS, the Contractor shall be liable for the costs of the audit and must immediately purge the unauthorized data, providing a notarized Statement of Destruction.

C.15.2 The Contractor shall ensure that all Agency data, including backups and metadata, resides exclusively on servers located within the Continental United States (CONUS).

C.16 Technical Requirements for Data Portability. The Contractor shall:

C.16.1 Utilize exclusively non-proprietary, industry-standard data schemas. The Contractor is prohibited from using proprietary formats or "data wrapping" techniques that prevent CSOSA from migrating data to a different platform, internal database, or successor service provider.

C.16.2 Provide full, unrestricted Application Programming Interface (API) access to allow CSOSA to pull both raw ingested data and processed analytical outputs in real-time.

Public Safety Data Analytics Platform

C.16.3 CSOSA has reserves the right to download its data at any time during the contract term without additional “retrieval fees.”

C.16.4 Data must be exportable in machine-readable, non-proprietary formats (e.g., CSV, JSON, XML, and Apache Parquet) to ensure it can be migrated to any entity CSOSA determines appropriate (Government or private sector source).

C.16.5 Provide API Availability as follows:

C.16.5.1 Provide comprehensive, up-to-date API documentation (e.g., OpenAPI/Swagger specifications) and a Data Dictionary defining all exported fields and relationships.

C.16.5.2 Ensure the API supports high-volume, bulk data requests to allow for full system backups or migrations without performance degradation.

C.16.5.3 Utilize secure, industry-standard protocols (e.g., REST, HTTPS, OAuth 2.0) for all programmatic access.

C.16.5.4 Maintain API availability at a rate of no less than 99.9%, consistent with the primary platform's Service Level Agreement (SLA).

C.16.5.5 Provide at least 180 days' notice before making "breaking changes" to the API to ensure CSOSA's internal integrations do not fail.

C.17 Delivery of Data at End of Contract.

C.17.1 The Contractor shall ensure the orderly and secure transfer of all Agency data to CSOSA or its designated successor upon the expiration, termination, or non-renewal of this contract.

C.17.2 Final Data Export. Within 10 calendar days of the end of the period of performance, the Contractor shall deliver a complete and final export of all Agency data.

C.17.2.1 The delivery shall include all Original Data, Derived Data, and Metadata in machine-readable, non-proprietary formats (e.g., CSV, JSON, and Apache Parquet).

C.17.2.2 The export must include all historical records, audit logs, and system-generated insights created during the life of the contract.

C.17.2.3 This final delivery shall be performed at no additional cost to the Government.

C.17.3 Data Integrity and Validation. To ensure the data is usable after transfer, within 10 calendar days of the end of contract the Contractor shall also provide:

• Checksums. Cryptographic hashes (e.g., SHA-256) for every file delivered to verify that no data was corrupted during the transfer; and

• Schema Map. A final, updated Data Dictionary that explains the relationships between all tables and fields within the export.

Public Safety Data Analytics Platform

C.17.4 Verification Period. CSOSA shall have 15 calendar days to inspect and validate the data. If the data is found to be incomplete or corrupted, the Contractor shall rectify the delivery within 5 business days at no additional cost.

C.17.5 Certified Destruction (Sanitization).

C.17.5.1 Following written confirmation from the COR that the final data export has been successfully received and validated, the Contractor shall permanently delete all Agency data from all primary systems, backups, and staging environments.

C.17.5.2 Destruction must be performed in accordance with NIST SP 800-88 Revision 1, "Guidelines for Media Sanitization."

C.17.5.3 Within 10 days of the purge, the Contractor shall provide the COR a notarized Certificate of Destruction signed by the Contractor’s Chief Information Security Officer (CISO).

C.18 Monthly Performance and Analytics Report. The Contractor shall provide a Monthly Performance Report to the COR no later than the 5th business day of each month. The report shall include, at a minimum:

• System Availability: Total system uptime percentage for the preceding month, including a log of any scheduled or unscheduled downtime.

• API Performance: Statistics on API availability, average response times, and a summary of any bulk data extractions performed by the Agency.

• Support Ticket Summary: A table of all support tickets opened during the month, categorized by Severity Level (1, 2, or 3), including time-to-triage and time-to-resolution.

• Data Residency Affirmation: A statement confirming that all data remained within the approved CONUS authorization boundary and was accessed only by authorized U.S. Persons.

• Data Integrity Check: Results of automated monthly checksum validations to ensure no data corruption has occurred within the database.

C.19 Period of Performance. The total contract period of performance is 36 months from date of contract award. Specific due dates for deliverables and services are identified in section C.20 below.

C.20 Deliverables.

C.20.1 Table 1 below summarizes deliverables required by this Statement of Work.

C.20.2 Established due dates for deliverables shall be included in the Contractor's Project Management Plan. Any changes to the established due dates for any deliverables identified in Table 1 below shall be documented via a modification to the contract.

C.20.3 All deliverables are to be approved by the COR before any invoice for the deliverable is submitted.

Public Safety Data Analytics Platform

Table 1: Deliverables Table Days listed in the table below are calendar days unless otherwise stated.

SOW

Section Deliverable Due Formats C.3 Project Management Plan (PMP) 60 days from contract award MS Project or

Excel C.4 System Security Plan 75 days from contract award PDF C.5 Public Safety Data Analytics Platform w/ all capabilities identified in C.5 Per due date identified by the COR/as included in the PMP

Web-based

C.7.2.1 Integrate CSOSA’s case management system (SMART

21) and CSOSA’s SharePoint Data Library into the platform; to be performed by the On-Site Full-Time Analyst required by section C.7

Per due date identified by the COR/as included in the PMP

Web-based

C.7.2.2 Connect Government mobile devices, specifically iOS devices and Android devices, to the platform so that CSOSA personnel can use the platform via assigned mobile devices; to be performed by the On-Site Full-Time Analyst required by section C.7

Per due date identified by the COR/as included in the PMP

C.7.2.3 Develop workflows, maps (graphical rendering of information), dashboards, analytics, and reports for use by CSOSA; to be performed by the On-Site Full-Time Analyst required by section C.7

Per due dates identified by the COR/as included in the PMP

Web-based or other format as determined by the COR

C.7.2.4 Configure real-time alerting; to be performed by the On- Site Full-Time Analyst required by section C.7

Per due date identified by the COR/as included in the PMP

Web-based

C.7.2.5 On-Site Full-Time Analyst to integrate of Two External Data Sources

Per due dates identified by the

COR

Web-based

C.8 Public Safety Data Analytics Platform Maintenance Upon platform activation cont’d thru end of contract.

Web-based

C.9.1 Public Safety Data Analytics Platform Support Upon platform activation cont’d thru end of contract.

On-line and via phone

C.9.2 Monthly Support and Uptime Report Monthly Electronically C.10 Training for Administrators, Power Users (Analytic staff), and End Users Per due dates identified by the

COR.

Electronic training documentation

C.11.1.1 Technical Documentation: System Architecture Diagram At completion of integration of first data source and prior to platform implementation

PDF

C.11.1.2 Technical Documentation: Interface Control Document

(ICD)

At completion of integration of first data source

PDF

C.11.1.3 Technical Documentation: Data Dictionary At completion of integration of first data source and prior to platform implementation

PDF

C.11.1.4 Technical Documentation: Administrator Guide At completion of integration of first data source

PDF

C.11.2 Resubmission of technical documentation As required by C.11.2 PDF

Public Safety Data Analytics Platform

C.17.2 & C.17.3

Final Data Transition Package Within 10 calendar days of the end of contract

Encrypted Electronic Delivery

(CSV/JSON/P

arquet)

C.17.5 Certificate of Data Destruction Within 10 days of the Contractor Agency date purge

Signed/ Notarized PDF

C.18 Monthly Performance Report 5th of every month thru contract period of performance identified in section C.19

Electronic (PDF or Dashboard Export)