CORHQ-25-R-0409-Amendment 0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF AWARD

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicble)

7. ADMINISTERED BY (If other than Item 6) CODE

FDIC 3700/56 (3-08)

FACILITY CODE

9A. AMENDMENT OF SOLICIATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 11)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offer must acknowledge receipt of this amendment by signing in Block 15b below and including the signed amendment with the offeror's proposal.

12. N/A

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO THE CHANGE ORDERS CLAUSE

B. THIS MODIFICATION IS ENTERED INTO PURSUANT TO THE AUTHORITY OF THE FDIC CONTRACTING OFFICER

C. THIS MODIFICATION IS ENTERED INTO PURSUANT TO MUTUAL AGREEMENT OF THE PARTIES

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remain unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

CORHQ-25-R-0409 / 0001

NONPUBLIC//FDIC BUSINESS#

Applicable Document Page # Question FDIC Response 1 CORHQ-25-R-0409, 7.3.2-06 - Questions Regarding

Solicitation 74 Would the FDIC please extend the proposal deadline by three weeks? The FDIC will extend the proposal due to to October 13, 2025.

2 CORHQ-25-R-0409, 7.1.2-03 - Pre-Award Supply Chain Risk Management (SCRM) Information

72 Please clarify that the SCRM information should be included in Volume 4 - Additional Information.

Yes. Please include the SCRM information in Volume 4 - Additonal Information of your proposal.

3 Price Schedule The RFP states there is 330TB on file shares but requests a 100TB quote. Is it anticipated that this will be a phased deployment and additional data volumes will be required at a later date?

Yes, the FDIC will use a phased deployment. The 330TB estimate includes all storages/volumes identified by FDIC.

4 https://sam.gov/workspace/contract/opp/22d9979a1a 394fd0bc3e514636822cc1/view

Product Service Code

7A21 - IT AND TELECOM - BUSINESS

APPLICATION SOFTWARE (PERPETUAL

LICENSE SOFTWARE)

The RFP on Sam.gov indicates a perpetual license – is a subscription license also an option?

FDIC will update the RFP to reflect this procurment is for a Subscription License only

5 CORHQ-25-R-0409, Appendix B - Non-Functional Requirements

17 Attachment B – Non-Functional Requirements does not appear to be present in the bid documentation. Will the FDIC please provide?

Appendix B - Non-Function Requirements have been provided as a separate attachment.

6 CORHQ-25-R-0409, Appendix A – Business Requirements

14 Does FDIC have a Microsoft G5 license and is the labeling and migration of content (Retention and Sensitivity) in-scope for this project?

Yes, the FDIC has a Microsoft G5 license. Labeling and migration of content (Retention and Sensitivity) are in-scope for this project

7 CORHQ-25-R-0409, 7.3.2-16 - Past Performance - Proposal Instructions 77

The requirements call for past performances. Is FDIC looking for up to 3 past performances between the prime and any sub-contractor or 3 from each? Is it acceptable to provide 3 Government past performances from our partner/sub-contractor?

The FDIC is looking for 3 past performances of work similiar to the requirements as defined in the Statement of Objectives of the solicitation. The FDIC will accept past performances from partners/sub-contractors that the prime has identified they plan to work with on this solicitation.

8 CORHQ-25-R-0409, Attachment L-1 – Proposal Content and Evaluation Factors

82 Is it acceptable to embed the price workbook in Volume 3? Yes, but we will still need a separate excel spreadsheet attachment.

9 CORHQ-25-R-0409, 7.3.2-27 - Oral Presentation

Will we have the opportunity to demonstrate our ability to meet the use case requirements through a product demonstration or will the orals consist solely of slideware presentation?

The Oral presentation should include the Offeror's Product Demonstration as well.

CORHQ-25-R-0409 - Statement of Objectives

9 of 87 How do you define a file as "trivial"? Do you have any examples that could help us understand?

Trivial - files that are NOT necessary to retain, not business related, draft or temporary files, not needed for decision making.

CORHQ-25-R-0409 - Statement of Objectives

Software - Is "Record Lifecycle and Policy Enforcement Software" in CLIN0001 a new Records Management platform or integrtating with an existing Records Management Platform?

No

CORHQ-25-R-0409 - Statement of Objectives

Software - What is the current Records Management Platform? The FDIC does not have a single formalized "records management platform."

FDIC uses a Content Manager for FDIC’s primary recordkeeping system.

Records also may be maintained in any other FDIC information system with an approved records retention schedule.

CORHQ-25-R-0409 - Statement of Objectives

18 of 87 Content Management - What are the Content Management systems being used?

(i.e. MS Sharepoint)

The Content Management systems being used include Microsoft SharePoint and Microsoft Teams.

14 CORHQ-25-R-0409 - Statement of Objectives

Software - Are the Content Management System(s) being used currently and/or intended in the furture to store the unstructured documents and maintain the records lifecycle and policy enforement? Yes

15 CORHQ-25-R-0409 - Statement of Objectives

Migration - Is data to be migrated to an identified platform (Content Management) or into this new "Record Liefecycle and Policy Enforcement Software"? 100 TB is referred to as the size of the platform.

Data will be migrated from existing FDIC on-premise file share drives and Content Management Systems to the FDIC cloud system where FDIC will continue to enforce the records lifecycle policy

16 CORHQ-25-R-0409 - Statement of Objectives

Regulation Process - Is this "Record Lifecycle and Policy Enforcement Software" working independently of the Content Management System(s) used in the regulation process to enforce the lifecycle and policies? Yes

17 CORHQ-25-R-0409 - Statement of Objectives 18 of 87 Content Management - Is this "Record Lifecycle and Policy Enforcement Software" duplicating content within the technology supporting Content No

18 CORHQ-25-R-0409 - Statement of Objectives

In Section 1 and 2 for Introduction, Process, and Background; please clarify the relationship of the CIM initiative, the FCMAT tool and/or project, and the ROT Tool? FMCAT is stated as both a tool and project. ROT tool is repeatedly stated within the document independently and interchangeably with the FMCAT tool which is confusing.

FMCAT is a project under the CIM program. One of the goals/scope of the FMCAT project is to procure a ROT tool.

19 CORHQ-25-R-0409 - Statement of Objectives

Is the ROT tool a capability within a larger FMCAT tool or is the ROT a separate tool informing and/or integrating with other tools for RM and CM platforms within the FMCAT project?

FDIC is seeking a tool to provide ROT file capabilities, so that on-premise files can be identified, reviewed, and taken action on prior to migrating files that meet the FDIC records retention schedule to the cloud

20 CORHQ-25-R-0409 - Statement of Objectives 15 of 87 Does the on-prem environment offer GPU compute resources?

Yes, the on-prem environment offers GPU compute resources.

21 CORHQ-25-R-0409 - Statement of Objectives 14 of 87 What file types should be included as part of the solution? Please see Appendix D - File Types

22 CORHQ-25-R-0409 - Statement of Objectives

When you state that "The ROT tool should be capable of flagging or tagging files and data", does "data" mean a data file or can it also include columns in a database, for example? Only unstructured data - no databases

23 CORHQ-25-R-0409 - Statement of Objectives 14 of 87 Are files that are on Legal Hold currently identified in some way? Yes

24 CORHQ-25-R-0409 - Statement of Objectives 15 of 87 Can you provide an example of how an end user might want to customize a report?

A sample report could be showing how many files are in certain time range, how many files are older than 5 years, 10 years or any time length.

25 CORHQ-25-R-0409 - Statement of Objectives 14 of 87 What is the appropriate numbering for "1. System Integration"? Should it be part of 7.11, 7.12, or separate?

The FDIC has adjusted the numering scheme so that "System Integration" will be identified as 7.14.

26 CORHQ-25-R-0409 - Statement of Objectives

The goal to "Ensure compliance with retention and data governance policies" appears to be a Records Management function outside the bounds of FMCAT and ROT.

Yes that is correct. FDIC will reference the existing records management system, and use the ROT tool to "identify/flag" an on-premise unstructured file.

27 CORHQ-25-R-0409 - Statement of Objectives

Is the the alternative flow to upon "A3. Legal Hold Detection" protect files from deletion, flag, and inform for manual review and expectain for the ROT tool to not "automatically delete files within the patfrom and workflows" and/or is it for the ROT tool to prevent "anyone from deleting" the file.

Any actions including deletion will be manually reviewedby an appropriate FDIC personnel after the ROT tool has identified a file based on the appropriate tagging

28 CORHQ-25-R-0409 - Statement of Objectives

4 of 87 and followin

Business Requirements in Appendix A can be interpeted to both Records Management and FMCAT/ROT for enforcement and retention? terminology such as ensure, enforce, prevent, ... are Records Maangment Fucnitons requiring integration and/or duplicaiton of capabilties. Items such as "7.3.2 Deletion - The ROT tool should be able to prevent Legal Hold files/data from being deleted or altered" and "7.5.7 Identify - The ROT tools should be able to recognize files/data that are on Legal Hold." and "7.8.2 - Processing - The ROT tool should be able to process actions such as identify, select, delete, move, etc.

in bulk." to name a few.

Any actions including deletion will be manually reviewedby an appropriate FDIC personnel after the ROT tool has identified a file based on the appropriate tagging.

29 CORHQ-25-R-0409 - Section B 5 of 87 For CLINS 0004-0006, is the quantity of hours provided the total hours or the total hours per month? The Total Hours

30 CORHQ-25-R-0409.pdf Are U.S. citizens required for all project roles, or are Legal Permanent Residents (green card holders) acceptable for some or all positions?

Please see section 7.5.2-08 (c) page 39 Personnel performing functional responsibilities designated at the High risk level must be United States Citizens. Personnel assigned to provide services under functional responsibilities designated as Moderate or Low risk do not need to be U.S. citizens or Lawful Permanent Residents (LPR) of the United States. Non-U.S. citizens without LPR status are permitted to work on a FDIC contract with functional responsibilities designated as Moderate or Low risk provided that they:

1. Meet the requirements of being legally admitted to the United States; and

2. Hold a valid authorization to work in the United States.

FMCAT RFP Q&A

31 CORHQ-25-R-0409.pdf Are individuals with valid work authorization (e.g., H-1B, L-1, TN) eligible to participate in any roles?

Please see section 7.5.2-08 (c) page 39 Personnel performing functional responsibilities designated at the High risk level must be United States Citizens. Personnel assigned to provide services under functional responsibilities designated as Moderate or Low risk do not need to be U.S. citizens or Lawful Permanent Residents (LPR) of the United States. Non-U.S. citizens without LPR status are permitted to work on a FDIC contract with functional responsibilities designated as Moderate or Low risk provided that they:

1. Meet the requirements of being legally admitted to the United States; and

2. Hold a valid authorization to work in the United States.

32 CORHQ-25-R-0409.pdf Do different roles (e.g., project management, technical implementation, support) have different citizenship requirements? No.

33 CORHQ-25-R-0409.pdf Can contractor personnel perform work remotely, or are there specific location restrictions?

The FDIC does not anticipate any on-site personnel. Contract personnel shall adhere to section 7.4.02 in working remotely. Specifically - "The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose FDIC information outside the United States, unless specifically directed by the contract or otherwise authorized by the Contracting Officer."

34 CORHQ-25-R-0409.pdf Can most project work be performed from contractor facilities, or is onsite presence at FDIC required for certain activities?

The licensed software will be installed on FDIC on-premise system. It is expected that the contractor resource(s) will assist/guide FDIC personnel on installing, configuring and training. The FDIC does not anticipate any on-site personnel.

35 CORHQ-25-R-0409.pdf What are the security requirements for contractor remote work locations (home offices, contractor sites)?

The security requirements for remote work locations will be provided in the Workplace Security Training post-award as defined in sections 7.5.2-14.

36 CORHQ-25-R-0409.pdf Can you confirm whether NIST 800-171 compliance certificate is a mandatory requirement? No, the compliance certificate is not a mandatory requirement.

37 RFP Section B

CLIN 1002 requests pricing for 4 months of Business Support & Updates, whereas CLIN 1001 calls for 12 months of software subscription. Typically these go hand-in-hand. Is there a reason that the Business Support & Updates should only be for 4 months, or should this be the full 12 months of the Option Year?

The FDIC has updated the pricing schedule to include 12 months of Business Support and Updates.

38 RFP Appendix A 7.5.6 14 of 87 Please clarify the definition of a dormant folder. A dormant folder has no activity/update to any files for at least one year.

39 RFP Appendix A 7.4.3

Please define SII.

Sensitive Identifiable Information (SII) - Information that with another piece of information could identify a person or has been identified by FDIC as not to be disclosed.

RFP

Para 1, sentence 2 states that "...Offeror shall support all applicable non-functional requirements proposed by the Offeror and agreed to by the FDIC from those listed in Appendix B…", however Appendix B was blank. Please confirm that there are no additional non-functional requirements.

Appendix B - Non Functional Requirements (NFR) have been provided as a separate attachment.

could you please provide us with the current user count within the environment? This data is crucial for ensuring accurate and comprehensive pricing. 8700

Total Price Base Period + Option Period $ -

Time of Delivery:

Technical Point of Contact:

Company:

Phone:

Email Address:

Instructions for Offerors: Offerors are to insert Unit Price, any discount information, and total price for each CLIN. Offeror must use this Pricing Workbook for Pricing submission.

CLIN Description QTY Period of Performance Unit Price Total Price Discount Applied

0001 Records lifecycle & policy enforcement software - max 100TB 1 12 Months -$ -$ -$ 0002 Business Support & Updates 1 12 Months -$ -$ -$ 0003 Limited Extended Support 1 12 Months -$ -$ -$

Planning, Workshops, Installation, Testing, PM (hours) NOT TO EXCEED 200 12 Months

Configuration, Training and Knowledge Transfer (hours) NOT TO EXCEED 400 12 Months

0006 Lead 1st round repositiories migration (hours) NOT TO EXCEED 200 12 Months

Total Base Period Price

NTE

1001 Records lifecycle & policy enforcement software - max 100TB 1 12 Months -$ -$ -$ 1002 Business Support & Updates 1 12 Months -$ -$ -$

Miscelleneous - reserve for 2nd round of repository migration (hours) NOT TO EXCEED 150 4 Months

Total Option Period 1 Price NTE

-$ Total Discount Applied

Total Not to Exceed Ceiling

Labor Hour CLIN

Base Period

Labor Hour CLINS

Firm Fixed Price CLINS

Option Period 1 Firm Fixed Price CLIN

NONPUBLIC//FDIC BUSINESS

Statement of Objectives (SOO)

File Management Categorization and Analysis Tool (FMCAT) Version 1.1

TABLE OF CONTENTS

1. INTRODUCTION AND PURPOSE

2. BACKGROUND

3. OBJECTIVES

4. TECHNICAL SUPPORT

5. ASSUMPTIONS

6. BUSINESS REQUIREMENTS

7. DELIVERABLES

APPENDIX A – BUSINESS REQUIREMENTS

7.1 AUDIT

7.2 CRITERIA

7.3 DELETION

7.4 FLAGGING/TAGGING

7.5 IDENTIFY

7.6 NOTIFICATIONS

7.7 PERFORMANCE / SCALABILITY

7.8 PROCESSING

7.9 REPORTING

7.10 SEARCH/SORT/GROUP

7.11 SECURITY/PRIVACY

7.12 USABILITY

7.13 WORKFLOW

7.14 SYSTEM INTEGRATION

APPENDIX B - NON-FUNCTIONAL REQUIREMENTS

APPENDIX C – USE CASE SCENARIO

APPENDIX D – FILE TYPES

APPENDIX E – FILE TYPES ................................................................................... ERROR! BOOKMARK NOT DEFINED.

Statement of Objectives

1. Introduction and Purpose This Statement of Objectives (SOO) aims to secure authorization to procure and implement the File Management Categorization and Analysis Tool (FMCAT) within the FDIC environment. FMCAT is a critical enabler for successfully launching the Content Information Management (CIM) initiative, which seeks to transform how enterprise content is governed, accessed, and stored in the cloud. This initiative cannot proceed without conducting a comprehensive analysis and cleanup of redundant, obsolete, and trivial (ROT) content currently residing across the FDIC's network shares.

Implementing FMCAT addresses urgent business needs, including reducing compliance risk, eliminating ROT content, ensuring adherence to records management retention policies, and improving operational efficiency in preparation for future cloud migrations.

The FMCAT initiative directly supports:

• The CIM Program’s core requirements for data preparation.

• FDIC’s enterprise data governance strategy.

• Security, privacy, and compliance mandates under federal guidance and NIST standards.

• IT modernization and digital transformation by reducing technical debt and streamlining operations.

2. Background

The Federal Deposit Insurance Corporation (FDIC) is facing mounting challenges in managing its growing volume of unstructured and semi-structured data. Legacy content—much of it duplicative, outdated, or irrelevant—poses a significant obstacle to efficient operations while creating compliance, legal, and financial risks. Network shares are burdened with data left by former employees, improperly stored PII, inconsistent naming conventions, and a lack of unified retention enforcement. This has made it increasingly difficult for staff to locate important information, assess the value of stored files, and ensure content complies with federal records and privacy mandates.

The CIM initiative is a strategic enterprise effort to modernize organizational content lifecycle management. However, this initiative cannot begin without the foundational step of analyzing and cleansing existing file shares. FMCAT provides the technology and functionality needed to empower Division Subject Matter Experts (SMEs) and Records Management Officers (RMOs) to apply consistent retention logic and systematically and securely dispose of unneeded content.

3. Objectives This SOO sets forth the following objectives for the FMCAT project:

1. Acquire the software licenses and assist the FDIC with the installation, implementation, and configuration of an ROT tool on-premises that meets the capabilities outlined in sections 4, 5, 6, and Appendices A & B of this SOO for integration within the FDIC’s environment.

2. Provide comprehensive training for administrators and end users to support compliance with the Records Management Policy by offering a centralized, user-friendly solution that enables SMEs and RMOs to classify, tag, and dispose of files according to the FDIC’s records retention schedules, labeling guidelines, and legal hold requirements.

3. Support the FDIC in obtaining an Authority to Operate (ATO) for the proposed ROT as well.

4. Minimize Organizational Risk - Identify and flag sensitive information that is improperly stored (e.g., PII, SII), which may present security and privacy risks if retained unnecessarily or migrated incorrectly.

5. Optimize Storage and Lower IT Costs - Decrease the amount of stored data across FDIC file shares through intelligent categorization and disposal, thereby reducing infrastructure costs and storage overhead.

6. Provide guidance and support for the FDIC to establish sustainable File and Labeling Governance with consistent best practices. Lay the groundwork for a standardized, automated, and repeatable file management process that can be expanded across divisions and sustained in the long term.

The new solution must comply with FDIC security and privacy requirements and provide an administration tool for user and access management. Potential contractors will be asked to submit documentation regarding their solution's features, technical specifications, security, privacy, and integration capabilities outlined below.

From the preliminary submission, FDIC will evaluate contractor proposals and request selected contractors to demonstrate their product, as detailed below in Appendix C.

4. Technical Support The FDIC will require access to robust technical support from the vendor. This support will assist FDIC employees and contractors in configuring and implementing the solution, operating and maintaining the system during the contract performance period, and fully utilizing all the solution features to identify and categorize files as ROT.

Offerors may propose this technical support either as a fixed-price service or as consulting services billed by the hour. Regardless of the pricing model, this support will enable FDIC users to be self-sufficient in configuring, implementing, administering, operating, and maintaining the solution. Additionally, the FDIC will require access to technical support during business hours from 8 am to 6 pm. When there is a business need, we seek the ability to receive support outside of business hours in the evenings and on weekends.

5. Assumptions

FDIC seeks a solution to identify, analyze, and categorize redundant, obsolete, and trivial content (ROT) files. The deployment of a solution in the FDIC environment will enable users to efficiently analyze, categorize, and manage various file types based on defined criteria. This will improve our records retention compliance and risk mitigation.

Ultimately, the FDIC desires to reduce the footprint of network shares as relevant content is migrated to our cloud-based storage. As of the 1st quarter of 2025, it is estimated that there are roughly 330TB of files that need to be reviewed and flagged by the ROT tool.

Some of the pain points being experienced with redundant and obsolete files include:

• Many documents are redundant, particularly those left behind by previous employees.

• Files could be transferred without proper cleanup, leading to unnecessary or outdated data migration.

• Files that should have been deleted years ago are still retained on the shared drive, cluttering the data landscape.

• PII may be stored incorrectly in shared drives and migrated with other files, leading to potential compliance and security risks.

• The same documents are stored with different names.

• There is no cohesive retention policy, which complicates applying consistent rules to different documents with varying retention requirements.

• Files created by former employees are inaccessible to current users, making it difficult to assess their importance or determine if they should be retained or deleted.

• The absence of a consistent naming convention for documents creates challenges in identifying and organizing files.

• Multiple drafts are circulated, stored, and retained after a document is finalized, resulting in confusion about which version(s) should be kept and by whom.

6. Business Requirements

The new solution will incorporate capabilities to meet our needs for identifying and deleting redundant, obsolete, and trivial files. To assist FDIC in efficiently managing data, reducing storage costs, and maintaining compliance with data retention policies, FDIC plans to implement the ROT data management tool on the FDIC Enterprise Network Share Drives hosted at FDIC on-premises data centers. A network share, also known as a network drive, file share, or shared drive, is typically a folder on a network server that multiple users can access. The purpose of network shares is to make files available to FDIC users from a centralized location. These files may include business documents, multimedia files, software installation binaries, application log files, database files, and other data types intended for widespread distribution. Typically, users connect a drive to a network share to create a permanent shortcut to that location on their computers. The volume of files on the network share may range from 10TB to 100 TB. The FDIC will need to determine if there are any incremental costs associated with processing the volume of files.

7. Deliverables The contractor shall deliver these deliverables using an agile methodology whenever possible to the FDIC Oversight Manager (OM) and Technical Monitor (TM).

Deliverables Required Calendar Days (after award)

• Project Schedule and Implementation Plan

15 days

• Project Status Report Once a month

• Security-related reports as per OCISO requirements As needed basis

• Obtain ATO or appropriate security authorization

At least two months before the go-live date

• Training Plan Per the approved project schedule and release plan

• Training 15 days prior to production go-live. For new functionality and enhancements, provide virtual production release training and include written documentation as necessary that aligns with a train-the-trainer approach.

Updates for new functionality are included in subsequent releases 15 days before the production release.

• Standard Operating Procedures (SOPs)

Within 30 days before the implementation release date. Reflects solution capabilities, configurations, and the administrator's guide.

• Job Aids Within 15 days before the implementation release date. Reflects selected key user functions and processes.

• Delivery of a configured solution Per the approved project schedule and implementation plan

• Security and Privacy Plans Part of System Security Authorization Process Documentation

• Security and Privacy Assessment Reports

Part of System Security Authorization Process Documentation

• Plan of Action and Milestones Part of System Security Authorization Process Documentation

• Configured Solution (Go-live) Per the approved project schedule and release plan

• Initial categorization and workflows for one division

Per project schedule and implementation plan, no later than 30 days post-implementation.

• Categorization and updated workflows for each remaining division/office of the organization.

Per the project schedule and implementation plan, after acceptance of the initial categorization and workflows.

Outlined below are the categories for each requirement detailed in the Business Requirements section of Appendix A. Additionally, the Offeror shall support all applicable non-functional requirements proposed by the Offeror and agreed to by the FDIC from those listed in Appendix B – Non-functional Requirements.

Appendix A – Business Requirements

7.1 Audit

The ROT tool should offer a compliance-friendly deletion process that records and retains what was deleted, the reason for the deletion, and the date of the deletion.

7.2 Criteria

1. The ROT tool should allow users to apply and implement multiple retention criteria.

2. The ROT tool should have the ability to accommodate many different criteria.

3. The ROT tool should allow authorized users to set criteria and cadence for the disposition of files/data.

7.3 Deletion

1. The ROT tool should be able to delete flagged files or data according to the approved criteria.

2. The ROT tool should be able to prevent Legal Hold files/data from being deleted or altered.

3. The ROT tool should enable users to review files or data before deletion.

7.4 Flagging/Tagging

1. The ROT tool should be capable of flagging or tagging files and data.

2. The ROT tool should enable users to flag files or data for deletion.

3. The ROT tool must be capable of flagging documents that contain SII and PII.

7.5 Identify

1. The ROT tool should be able to identify redundant files/data even if it is stored under different names or locations.

2. The ROT tool should be able to identify obsolete files/data.

3. The ROT tool should be able to identify trivial files/data.

4. The ROT tool should be able to recognize all file types (e.g., Excel, Word, Access

Database, PDFs, etc.).

5. The ROT tool should be able to identify empty folders.

6. The ROT tool should be able to identify dormant folders.

7. The ROT tools should be able to recognize files/data that are on Legal Hold.

7.6 Notifications

The ROT tool should be able to notify file owners before files/data are deleted.

7.7 Performance / Scalability

The ROT tool should be able to efficiently perform ROT identification on large volumes of data/files.

7.8 Processing

1. The ROT tool should be available for use as needed.

2. The ROT tool should be able to process actions such as identify, select, delete, move, etc. in bulk.

7.9 Reporting

1. The ROT tool should generate comprehensive and detailed reports and analytics on an ad hoc basis.

2. The ROT tools must have dashboards, key metrics, and timelines.

3. The ROT tool should be capable of generating a comprehensive data map detailing where data resides, its file formats, sensitivity levels, and the relevant custodians and owners.

4. The ROT tool should be capable of generating customizable, comprehensive, and detailed reports and analytics.

7.10 Search/Sort/Group

1. The ROT tool should be capable of searching files and data based on keywords, file properties, and metadata (e.g., matter/case numbers, author details, document type, who accessed and/or modified specific files and data, etc.).

2. The ROT tool should be able to sort and group files and data based on various criteria (e.g., creation date, version (draft or final), data labels/classifications (e.g., public, non-public, controlled, etc.), file size, file name, etc.).

7.11 Security/Privacy

1. The ROT tool must identify documents containing SII and PII.

2. The ROT tool must ensure that access controls are established to safeguard sensitive information.

3. The ROT tool should be capable of identifying password-protected, encrypted files or data.

4. The ROT tool must guarantee data security and privacy.

7.12 Usability

The ROT tool should provide a user-friendly interface and be simple to use.

7.13 Workflow

The ROT tool must be capable of creating workflows for the review and approval of files or data before their deletion.

7.14 System Integration

The ROT tool must integrate and function seamlessly within FDIC's IT structure.

Appendix B - Non-Functional Requirements

The FDIC has non-functional requirements for compliance by selected solutions. The Offeror shall support all applicable non-functional requirements proposed by the Offeror and agreed upon by the FDIC from those listed in Attachment B – Non-Functional Requirements.

Appendix C – Use Case Scenario

The purpose of a use case scenario is to clearly describe how a system, tool, or process will be used to achieve a specific business goal or outcome from the perspective of the end user or stakeholder. It defines the interactions between users (actors) and the system, capturing functional requirements in a practical, understandable, and real-world-focused manner.

Key Purposes of a Use Case Scenario:

1. Clarify Requirements It helps stakeholders (business, technical, legal, vendors, etc.) understand what the system should do, ensuring everyone shares a common vision of its functionality.

2. Define Scope and Boundaries It outlines where a process starts and finishes, what conditions must be satisfied, and what outcomes are anticipated, helping to manage project scope and expectations.

3. Support Communication Use cases connect technical and non-technical teams by using clear language to explain processes, decisions, and system behavior.

4. Guide Development and Design Developers and system architects utilize use cases to design features and workflows based on anticipated user interactions with the system.

5. Enable Testing and Validation Test cases can be developed directly from use case scenarios to ensure that the system operates as expected in both typical and edge-case conditions.

6. Drive Training and Change Management Use cases assist in creating realistic training materials and guiding end users on how the new system or tool fits into their daily work.

7. Support Business Justification A well-crafted use case can effectively illustrate the value of a system by showing how it addresses a real problem or improves a process.

1. Use Case Description

This case describes how the File Management Categorization and Analysis Tool (FMCAT) is used by FDIC personnel to identify, categorize, and take disposition actions on redundant, obsolete, and trivial (ROT) data in the FDIC on-premises network share drives. It supports the FDIC’s Content Information Management (CIM) initiative by ensuring data is organized, relevant, and compliant with labeling, security, and records management retention policies. It also improves operational efficiency, reduces storage costs, and enhances data security.

2. Actors

Actor Role Administrator Configures the tool, initiates scans, reviews reports, and manages ROT classification and cleanup IT Manager Overseas the cleanup process ensures policy compliance and validates that no critical data is lost.

End Users Provide input on file relevance and help verify data classification in cases of uncertainty.

3. Goals

• Identify and remove redundant, obsolete, and trivial (ROT) data from FDIC network shares.

• Enhance data organization and storage efficiency across the enterprise.

• Ensure compliance with retention and data governance policies.

• Lower storage costs and data-related risk exposure.

• Prepare content for migration to cloud-based repositories (e.g., SharePoint, Azure).

4. Preconditions

• The FMCAT has been fully installed and configured, received an ATO, and is operational in the FDIC product environment.

• User roles and permissions have been assigned as necessary.

• Retention policies, classification rules, and legal hold guidelines are integrated into the tool.

• FMCAT can access FDIC on the premise network share drives

5. Main Flow (Basic Scenario)

Step Action:

1 Log In – The Administrator logs into FMCAT.

2 Configure Scan – The Administrator selects network shares and initiates a data scan.

3 Scan Data Repositories – FMCAT scans selected locations for ROT data.

4 Identify ROT Data – The tool identifies redundant, outdated, or trivial files according to predefined rules.

5 Flag Sensitive Content – FMCAT automatically flags files with PII, SII, or legal hold indicators for review.

6 Generate Report – A detailed report of ROT findings is generated, including classifications and recommendations.

7 Review Report – The Administrator and End Users (as needed) review the report to confirm accuracy.

8 Approve Actions – Approved files are marked for deletion, archiving, or retention.

9 Execute Cleanup – FMCAT performs cleanup actions and retains an audit log of all changes.

10 Verify Cleanup – The IT Manager validates the cleanup process, ensuring no

Step Action:

critical data was removed.

11 Monitor Storage – The Administrator monitors post-cleanup storage usage and efficiency gains.

6. Alternative Flows

Alt Flow Description

A1. False Positives If FMCAT incorrectly identifies important data as ROT, the Administrator or SME reclassifies it as "retain," and it is excluded from deletion.

A2. Data Recovery If critical data is mistakenly deleted, FMCAT’s recovery feature allows restoration from backups or retention logs.

A3. Legal Hold Detection

Files under legal hold are automatically protected and flagged for manual review by the Records or Legal teams.

A4. PII/Sensitive Data Handling

Detected PII or sensitive content is redirected for review and secure handling and not automatically deleted.

7. Postconditions

• ROT content has been removed or archived according to retention and compliance rules.

• Network shares are streamlined and easier for users to navigate.

• Sensitive content has been flagged and addressed securely.

• Storage space has been reduced and associated costs lowered.

• Data is prepared for structured migration into cloud storage systems (e.g., SharePoint, Azure).

• Audit trails and reports are available for internal and regulatory review.

8. Exceptions

Exception Description Tool Malfunction

If FMCAT encounters a system or processing error, the Administrator notifies technical support for remediation.

Incomplete Scan

If network share access fails or is interrupted, the Administrator adjusts access permissions and restarts the scan.

Appendix D – File Types

Images: AI, BMP, EMF, EPS, GIF, JPG, JPEG, PNG, PSD, SVG, TIF, TIFF, WMF

SharePoint page: ASPX

Acrobat (PDF), PowerPoint (POTM, POTX, PPSM, PPSX, PPT, PPTM, PPTX), Rich Text (RTF), Word

(DOC, DOCM, DOCX, DOTM, DOTX).

3-D Modeling/Printing: 3MF, COOL, GLB, GLTF, OBJ, STL Apple: MOVIE, PAGES, PICT, SKETCH Adobe: AI, PDF, PSB, PSD (Adobe Portfolio PDF files are unsupported) Audio/Video Media Files: 3G2, 3GP, 3GPP, ASF, AVI, M2TS, M4A, M4V, MKV, MOV, MP3, MP4, MP4V, MTS, TS, WAV, WEBM, WMA, WMV

AutoCAD: DWG AutoDesk: FBX BioWare Game Engine: ERF Compressed File: ZIP Compressed File (Unix): Z DICOM Medical Images: DCM, DCM30, DICM, DICOM Finale: PLY HydroCAD: HCP Image Formats: GIF, HEIC, HEIF, JPEG, JPG, JPE, MEF, MRW, NEF, NRW, ORF, PANO, PEF, PNG, RW2, SPM, TIF, TIFF, XBM, XCF

License Key: KEY Log Files: LOG Microsoft Office (Word, PowerPoint, Excel): CSV, DIC, DOC, DOCM, DOCX, DOTM, DOTX, POT, POTM, POTX, PPS, PPSM, PPSX, PPT, PPTM, PPTX, XD, XLS, XLSB, XLSX, SLTX

Microsoft Outlook: EML, MSG Microsoft Visio: VSD, VSDX Microsoft Windows: CUR, ICO, ICON Open eBook: EPUB OpenOffice: ODP, ODS, ODT Photo: ARW, CR2, CRW, DNG Rich Text Format: RTF Text and Code: ABAP, ADA, ADP, AHK, AS, AS3, ASC, ASCX, ASM, ASP, AWK, BAS, BASH, BASH_LOGIN, BASH_LOGOUT, BASH_PROFILE, BASHRC, BAT, BIB, BSH, BUILD, BUILDER, C, C++, CAPFILE, CBK, CC, CFC, CFM, CFML, CL, CLJ, CMAKE, CMD, COFFEE, CPP, CPT, CPY, CS, CSHTML, CSON, CSPROJ, CSS, CTP, CXX, D, DDL, DI. DIF, DIFF, DISCO, DML, DTD, DTML, EL, EMAKE, ERB, ERL, F90, F95, FS, FSI, FSSCRIPT, FSX, GEMFILE, GEMSPEC, GITCONFIG, GO, GROOVY, GVY, H, H++, HAML, HANDLEBARS, HBS, HRL, HS, HTC, HTML, HXX, IDL, IIM, INC, INF, INI, INL, IPP, IRBRC, JADE, JAV, JAVA, JS, JSON, JSP, JSX, L, LESS, LHS, LISP, LOG, LST, LTX, LUA, M, MAKE, MARKDN, MARKDOWN, MD, MDOWN, MKDN, ML, MLI, MLL, MLY, MM, MUD, NFO, OPML, OSASCRIPT, OUT, P, PAS, PATCH, PHP, PHP2, PHP3, PHP4, PHP5, PL, PLIST, PM, POD, PP, PROFILE, PROPERTIES, PS, PS1, PT, PY, PYW, R, RAKE, RB, RBX, RC, RE, README, REG, REST, RESW, RESX, RHTML, RJS, RPROFILE, RPY, RSS, RST, RXML, S, SASS, SCALA, SCM, SCONSCRIPT, SCONSTRUCT, SCRIPT, SCSS, SGML, SH, SHTML, SML, SQL, STY, TCL, TEX, TEXT, TEXTILE, TLD, TLI, TMPL, TPL, TXT, VB, VI, VIM, WSDL, XAML, XHTML, XOML, XML, XSD, XSL, XSLT, YAML, YAWS, YML, ZSH

Web/Hypertext: HTM, HTML, Markdown, MD, URL

Emails

• (.dbx) – Outlook Express E-mail Folder

• (.ost) – Outlook Office File

• (.pst) – Outlook File

Database Files

• (.accdb) – Access 2007 Database File

• (.dat) – Data File

• (.db) – Database File

• (.dbf) – Database File

• (.fp7) – FileMaker Pro 7+ Database

• (.mdb) – Microsoft Access Database

• (.ndf) – SQL Server Secondary Database File

• (.xml) – XML File

Photo and Image Files

• (.gif) – Graphical Interchange Format File

• (.jpg) – JPEG Image

• (.png) – Portable Network Graphic

• (.tif) – Tagged Image File

Video Files

• (.3g2) – 3GPP2 Multimedia File

• (.3gp) – 3GPP Multimedia File

• (.asf) – Advanced Systems Format File

• (.asx) – Microsoft ASF Redirector File

• (.avi) – Audio Video Interleave File

• (.flv) – Flash Video File

• (.mov) – Apple QuickTime Movie

• (.mp4) – MPEG-4 Video File

• (.mpg) – MPEG Video File

• (.rm) – Real Media File

• (.srt) – SubRip Subtitle File

• (.swf) – Shockwave Flash Movie

• (.vob) – DVD Video Object File

• (.wmv) – Windows Media Video File

Audio Files

• (.aif) – Audio Interchange File Format

• (.iff) – Interchange File Format

• (.m3u) – Media Playlist File

• (.m4a) – MPEG-4 Audio File

• (.mid) – MIDI File

• (.mp3) – MP3 Audio File

• (.mpa) – MPEG-2 Audio File

• (.ra) – Real Audio File

• (.wav) – WAVE Audio File

• (.wma) – Windows Media Audio File

Compressed Files

• (.7z) – 7-Zip Compressed File

• (.gz) – Gnu Zipped Archive

• (.rar) – WinRAR Compressed Archive

• (.sitx) – StuffIt X Archive

• (.zip) – Zipped File

• (.zipx) – Extended Zip File

Backup Files

• (.bak) – Backup File

• (.gho) – Norton Ghost Backup File

DOA/ASB

3501 Fairfax Drive Arlington, VA 22226 ditoles@fdic.gov

(703) 5622778 ditoles@fdic.gov

The Proposal due date is extended to October 13, 2025 at 11:59pm.

See next pages for updated attachments and answers. (Appendix B of the SOO is posted to attachments on SAM.gov.)