CUI RFI Attachment A - iPRISM Requirements Desired Capabilities.xlsx
XLSX spreadsheet 59 KB Posted
- Attached to
- Case Management System (CMS)
- Solicitation number
- 89303026NIG000059
- Issued by
-
Department of Energy Headquarters
About this file
This is a Requirements and Desired Capabilities Questionnaire for the Investigations Paperless Records and Information Systems Manager (iPRISM), a cloud-based case management system for the U.S. Department of Energy Office of Inspector General (OIG). The document outlines comprehensive functional and technical requirements that prospective vendors must address, organized into ten major requirement categories and corresponding desired capability sections. Vendors are required to respond to each requirement by indicating whether it is "Met," "Partially Met," "Not Met," or "N/A," with explanatory comments required for any non-fully-met responses.
The requirements specify that the solution must be a FedRAMP-authorized (moderate level minimum) commercial off-the-shelf platform designed to manage federal criminal, civil, and administrative investigations alongside OIG hotline submissions and complaints. Critical technical requirements include cloud-based delivery with support for 1 to 300 concurrent users (approximately 150 initial licenses), 24/7 availability, Windows 11 and modern browser compatibility, IPv6 capability, RESTful API exposure, and robust security controls including FIPS 140-3 encryption, HSPD-12/PIV card authentication, and phishing-resistant multi-factor authentication. The system must also incorporate comprehensive case management functionality with support for multiple case types, detailed documentation workflows with signoff and audit trails, evidence management with chain-of-custody tracking, time recording for Law Enforcement Availability Pay (LEAP) hours, advanced reporting and dashboard capabilities with customizable key performance indicators, records retention for at least 10 years post-closure, and centralized administration with role-based access controls. Desired capabilities include offline case document access with synchronization, generative AI for investigative report generation, DoD Impact Level 5 authorization, and advanced features for expense tracking, mobile evidence management, and electronically-stored information (ESI) processing. The solution vendor must commit to at least five years from end-of-life with documented vendor support, provide maintenance patches within 30 days for high-severity vulnerabilities, and demonstrate Section 508 accessibility compliance through submission of a Voluntary Product Accessibility Template (VPAT).
View the file
Other files
| File | Type | Posted |
|---|---|---|
| CUI RFI - iPRISM.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Lookup
| <Select a response> |
| Met |
| Partially met |
| Not met |
| N/A |
&"Calibri"&17&K000000 CUI//SP-PROCURE&1#_x000D_
_x000D_&1#&"Calibri"&10&K000000 Controlled by: The U.S. Department of Energy, DOECUI@hq.doe.gov
Definitions
| Definitions of Terms Used in Requirements and Desired Capabilities Questionnaire | ||
| Term | Definition | |
| Case | A formal, documented investigation into a specific incident, individual, or organization suspected of violating United States federal laws. | arrangement that an auditor has with a client to perform an audit of the client's accounting records and financial statements |
| Complaint | An allegation of a violation of federal law, regulation, or policy that initiates an investigation or inquiry by the agency. It is preliminary and unverified. | a type of engagement that provides a limited level of assurance that a company's financial statements comply with the applicable financial reporting framework. |
| Excludable | For the purposes of calculating Law Enforcement Availiability Pay (LEAP) hours, any day of the week that is NOT a regular workday. A "regular workday" includes each day in the criminal investigator's basic workweek in which the criminal investigator completes at least 4 hours of work. Hours that do not count include overtime hours, unscheduled duty hours, hours when the employee is traveling outside the official duty station, hours of approved leave, holiday hours, and hours of excused absence. (See 5 CFR 550.183(b) for additional information.) |
&"Calibri"&17&K000000 CUI//SP-PROCURE&1#_x000D_&"Arialri"&12&K000000Revised 9/12/2024
_x000D_&1#&"Calibri"&10&K000000 Controlled by: The U.S. Department of Energy, DOECUI@hq.doe.gov
Requirements
| Investigations Paperless Records and Information Systems Manager Requirements Questionnaire | ||||
| Please respond to the following requirements by selecting a response in the column labeled 'Response' (column D) and providing any comments in the column labeled 'Comment' (column E). If your response in the column labeled 'Response' (column D) is 'N/A' or 'Partially Met', please provide an explanation in the column labeled 'Comment' (column E). | ||||
| Section | Requirement Number | Requirement Description | Response | Comment |
| 1. GENERAL TECHNICAL REQUIREMENTS | 1.1 | The solution must be a cloud-based, commercial, off-the-shelf management information system designed to manage federal criminal, civil, and administrative investigations in addition to Office of Inspector General hotline submissions and complaints and, as such, must have established workflows for managing cases and complaints. | <Select a response> | |
| 1.2 | The solution, meeting the minimum requirements as defined in the 'Requirements' worksheet of this attachment, must be available for demonstration no later than four weeks (28 calendar days) following the RFI due date. | <Select a response> | ||
| 1.3 | The solution must use technologies commonly used across industry in the United States. | <Select a response> | ||
| 1.4 | The solution must be cloud-based and be Federal Risk and Authorization Management Program (FedRAMP) authorized at the moderate level, at a minimum. | <Select a response> | ||
| 1.5 | The solution must be scalable from 1 user to 300 concurrent users. (Initial licensing is anticipated to be approximately 150 users.) | <Select a response> | ||
| 1.6 | The solution must have a documented vendor commitment to be at least five years away from end of life and shall have at least five years of customer support available. | <Select a response> | ||
| 1.7 | The solution must include ongoing support and maintenance services including, but not limited to, security updates/patches, bug fixes, and updates/patches to address compatibility with operating systems, browsers, and complementary applications for the duration of the licensing period or agreement. Maintenance support must include the production of patches or mitigations within 30 calendar days for published vulnerabilities with a common vulnerability scoring system (CVSS) version 4.0 score between 7.0 and 10.0 (reference the National Vulnerability Database at https://nvd.nist.gov/vuln-metrics/cvss). Additionally, maintenance support must include major releases, service pack releases, or patches at least 90 calendar days prior to the published end-of-support date for any required solution component (including third-party components). | <Select a response> | ||
| 1.8 | If the solution relies upon third-party tools or applications, support for those tools or applications must extend throughout the support lifecycle of the solution. | <Select a response> | ||
| 1.9 | The solution must be available for use 24 hours per day, 7 days per week, without disruption except during system updates which must be scheduled at least 2 weeks in advance and must occur on Saturdays, Sundays, and/or United States federal holidays, unless a newly identified security vulnerability is identified that requires immediate attention, in which case as much advance notice as possible must be provided. | <Select a response> | ||
| 1.10 | The solution must provide the ability for team collaboration and online working. | <Select a response> | ||
| 1.11 | The solution must provide controls to prevent data loss when multiple users work concurrently. | <Select a response> | ||
| 1.12 | The solution must comply with Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 794d) and must demonstrate compliance by submitting a Voluntary Product Accessibility Template (VPAT). | <Select a response> | ||
| 1.13 | The solution must be compatible with Windows 11 operating systems. | <Select a response> | ||
| 1.14 | The solution must be compatible with the versions of Google Chrome or Microsoft Edge currently in mainstream support. | <Select a response> | ||
| 1.15 | The solution must not restrict the number of databases containing application data that may be connected. (For example, OIG has a requirement to connect to a copy of the production database for security testing purposes.) | <Select a response> | ||
| 1.16 | The solution must be capable of operating in an IPv6-only environment. | <Select a response> | ||
| 1.17 | The solution must have ability to handle slow or latent connections through VPN or remote connections and performance of the solution should not degrade such that users are prevented from using any and all solution functionality over such connections. | <Select a response> | ||
| 1.18 | The solution must provide the ability for the agency to test updates/patches prior to being moved into a production environment. | <Select a response> | ||
| 1.19 | The solution must provide agency administrators the ability to extract all source data on an ad-hoc basis for developing custom reports and other agency purposes. | <Select a response> | ||
| 1.20 | The solution must provide a RESTful API that exposes solution data and metadata to external systems. | <Select a response> | ||
| 2. SECURITY REQUIREMENTS | 2.1 | The solution must comply with the following U.S. federal government security requirements, at a minimum: |
i. Federal Information Security Management Act (FISMA).
ii. National Institute of Standards and Technology (NIST) Special Publication 800-53 REV5;
iii. Federal Information Processing Standards (FIPS) 199; and,
| iv. Federal Risk and Authorization Management Program (FedRAMP). | <Select a response> | |||
| 2.2 | The solution must have achieved Federal Risk and Authorization Management Program (FedRAMP) authorization at the moderate level, at a minimum. | <Select a response> | ||
| 2.3 | The solution must encrypt data at rest and data in transmission. | <Select a response> | ||
| 2.4 | The solution must use Federal information processing standard (FIPS) 140-3 certified cryptomodules for all encryption. The solution provider must provide the National Institute of Standards and Technology (NIST) validation certificate number from https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules wherever contractor uses encryption anywhere in the system. | <Select a response> | ||
| 2.5 | The solutions' database must have Data at Rest (DAR) encryption at AES 256 minimum. | <Select a response> | ||
| 2.6 | The solution must utilize Transport Layer Security (TLS) 1.3 or later to secure data transferred over a network. | <Select a response> | ||
| 2.7 | The solution must capture full logs of all user activity including, but not limited to, login attempts (both successful and unsuccessful), password changes, failed accesses related to systems, security or privacy attribute changes, administrative privilege usage (case deletion, user account creation/modification/deletion, etc.), external credential usage, changes to settings/policies, changes to documentation, changes to case management information, and deletions of documentation and case management information. Activity logging must include user identifiers and date/time stamps and must be protected from unauthorized modification or deletion and retained for a configurable period. | <Select a response> | ||
| 2.8 | The solution must provide agency administrators the ability to extract all user activity logging data on an ad-hoc basis. | <Select a response> | ||
| 2.9 | The solution must support authentication with Homeland Security Presidential Directive 12 (HSPD-12) badges/personal identity verification (PIV) cards. | <Select a response> | ||
| 2.10 | The solution must support the requirement for phishing-resistant multi-factor authentication for all user access (such as PIV authentication) to include privileged access such as by system administrators. | <Select a response> | ||
| 2.11 | The solution must display a logon/warning banner with agency-specific language with end-user acknowledgement to proceed with login. | <Select a response> | ||
| 2.12 | The solution must provide the ability to assign role-based permissions across the solution. | <Select a response> | ||
| 2.13 | The solution must provide the ability to assign users to different cases and/or complaints with roles/permissions specific to each 'Case' and/or 'Complaint'. | <Select a response> | ||
| 2.14 | The solution must have the role of 'Read Only' (or similar) with privileges to view and export data for only those 'Cases' and/or 'Complaints' to which they are given access. | <Select a response> | ||
| 2.15 | The solution must have the role of 'Administrator' (or similar) with privileges to delete 'Cases'/'Complaints', re-open 'Cases'/'Complaints', configure application settings, create user accounts, deactivate user accounts, and perform other administrative tasks. | <Select a response> | ||
| 2.16 | The solution must have the ability to create separate user accounts for a single user to segregate their transactions when performing system administration actions. | <Select a response> | ||
| 2.17 | The solution must automatically disable user accounts when the accounts have been inactive for 60 days. The solution must allow system administrators to configure these time periods. | <Select a response> | ||
| 2.18 | The solution must warn users when they are inactive for 60 minutes and the solution must save any open documentation and automatically log out users when they are inactive for 120 minutes. The solution must allow system administrators to configure these time periods. | <Select a response> | ||
| 2.19 | The solution must prevent unauthorized access to controlled data and programs. | <Select a response> | ||
| 2.20 | The solution shall incorporate mechanisms for data backup and recovery to minimize data loss in the event of a solution failure or disaster. These mechanisms must ensure a Recovery Point Objective (RPO) of no more than 2 hours, meaning that in the event of a solution failure, data loss will not exceed the data generated or modified within the preceding 2 hours. | <Select a response> | ||
| 2.21 | The solution must include features to detect and report security incidents in real-time to the organization and must provide capabilities for forensic analysis to investigate security breaches. | <Select a response> | ||
| 3. CENTRALIZED ADMINISTRATION REQUIREMENTS | 3.1 | The solution must provide a centralized means for agency administrators to manage solution configurations including any policy settings for user preferences and 'Case' settings. | <Select a response> | |
| 3.2 | The solution must provide an interface for agency administrators to configure input field names, input field types, and input field controls. | <Select a response> | ||
| 3.3 | The solution must provide an interface for agency administrators to add/edit/remove/enable/disable user accounts. | <Select a response> | ||
| 3.4 | The solution must provide an interface for agency administrators to add/edit/remove 'Cases'. | <Select a response> | ||
| 3.5 | The solution must provide a centralized means for agency administrators to manage permissions associated with roles. | <Select a response> | ||
| 3.6 | The solution must provide a means for agency administrators to establish security groups for users. | <Select a response> | ||
| 3.7 | The solution must provide centralized access to security/activity logs. | <Select a response> | ||
| 3.8 | The solution must provide the ability for the organization to create multiple 'Case' templates which include baseline case input fields, documentation organization structure/tagging, documentation categories, and baseline 'Case' content, at a minimum. | <Select a response> | ||
| 3.9 | The solution must provide the ability for agency administrators to update 'Case' templates. | <Select a response> | ||
| 3.10 | The solution must provide the ability to maintain a library of standard forms/templates for 'Case' documentation/attachments from which users can add to their 'Cases' on an ad-hoc basis. | <Select a response> | ||
| 3.11 | The solution must provide an interface for system administrators to configure email notifications. | <Select a response> | ||
| 3.12 | The solution must provide an interface for system administrators to configure user dashboards by role. | <Select a response> | ||
| 3.13 | The solution must provide an interface accessible to system administrators only to configure agency-defined key performance indicators (KPIs). Examples of KPIs include, but are not limited to, the following: 90% of all complaints are triaged within 10 business days of receipt; 50% of investigations opened during the reporting period and closed with no reportable outcome are closed within 180 days of initiation; draft Investigative Reports submitted to supervisors within 21 workdays of the last significant investigative activity in at least 75% of investigations; at least 4 Fraud Awareness Briefings (FABs) are conducted annually; and, 15% of investigations opened during the reporting period are joint investigations with other agencies. | <Select a response> | ||
| 3.14 | The solution must provide an interface for system administrators to configure timesheets. | <Select a response> | ||
| 3.15 | The solution must provide an interface to update the timesheets of any selected user accessible to system administrators only. | <Select a response> | ||
| 3.16 | The solution must provide an interface for system administrators to configure 'Case' milestones. | <Select a response> | ||
| 4. CASE MANAGEMENT REQUIREMENTS | 4.1 | The solution must organize documentation by 'Case'. | <Select a response> | |
| 4.2 | The solution must allow multiple users to collaborate on a 'Case' in real-time. | <Select a response> | ||
| 4.3 | The solution must provide multiple types of 'Cases' and each type must have its own agency-configurable templates for forms and documentation organization. Case types may include 'Complaint', 'Investigation', 'Developmental', 'Case Support', 'Forensic', 'Whistleblower', or similar. (Also see requirements 3.8 and 3.9.) | <Select a response> | ||
| 4.4 | The solution must restrict the creation of a 'Case' to those roles authorized by the agency to create 'Cases'. | <Select a response> | ||
| 4.5 | The solution must generate and store a unique code, 'Case Number', for each 'Case'. | <Select a response> | ||
| 4.6 | The solution must capture the following fields (or similar) for each 'Case', at a minimum: Case Number, Title, Initiated Date, Summary of Allegations, Date Received, Primary Investigator, Type, Others Assigned, OIG Sensitive (Y/N), HQ Special Interest (Y/N), Current Status, Current Status Date, Method of Receipt, Category, Complaint Source, Primary Violation, Subject Type, Additional Violation, Allegation Location, Hotline (Y/N), Program Office, INV Assigned Office, Use Name Outside of OIG, Acknowledgement of Confidentiality, OIG Confidentiality Exp, Referred to OIG Website, Advised of OIG Disposition, Retaliation, Qui Tam (Y/N), Mandatory Disclosures, Contains Classified - Information outside system (Y/N), Covid-Related (Y/N), Grant Contract or other Assistance Award Number, IIJA (Y/N), IRA (Y/N), CHIPS (Y/N). | <Select a response> | ||
| 4.7 | The solution must maintain the 'Current Status' with agency-cofigurable 'Case' status selection. | <Select a response> | ||
| 4.8 | The solution must allow users to record zero or more (up to an unlimited number) 'Initial Allegations' and 'Additional Allegations' for each 'Case'. 'Initial Allegations' and 'Additional Allegations' each must include the following fields, at a minimum: Description, Summary, Investigation to Date, Anticipated Activity, Allegation Location, Finding Summary. | <Select a response> | ||
| 4.9 | For each 'Initial Allegation' and 'Additional Allegation', the solution must allow the user to add zero or more associated 'Violations' (up to an unlimited number) which must include the following fields (or similar), at a minimum: Summary, Basis, Description, Other, Subject, Result. | <Select a response> | ||
| 4.10 | The solution must provide the capability to link a 'Case' to zero or more (up to unlimited) related 'Cases'. | <Select a response> | ||
| 4.11 | The solution must limit access to a 'Case' to agency-designated users. The solution must provide the ability to dynamically update access to a 'Case' at any time in the lifecycle of a 'Case'. | <Select a response> | ||
| 4.12 | The solution must provide the following text formatting capabilities for all freeform text form fields: |
- Selection/modification of font type, color, and size
- Ability to apply bold, italics, underline, or strikethrough to selected text
- Ability to highlight selected text in color of user's choice
- Ability to add superscript and subscript text
- Ability to indent/outdent selected text
- Ability to align text to the right, left, or center
- Ability to add/modify/delete/format tables
- Ability to add/modify/delete bulleted or numbered lists
- Ability to set line spacing and paragraph spacing options
- Ability to copy/cut/paste selected text
| - Ability to find user-supplied text and replace it with user-supplied text throughout the field | <Select a response> | |||
| 4.13 | The solution must provide the ability to add workflow 'Task' items to each 'Case' that include the following fields (or similar), at a minimum: Title, Due Date, Assigned to, Assigned from, and Status (New, In Progress, Invalid, and Complete), Date Completed, Comment/Note, Attachment. | <Select a response> | ||
| 4.14 | The solution must provide a view to display workflow 'Task' items assigned to the user across all 'Cases'. | <Select a response> | ||
| 4.15 | The solution must provide the ability to record zero or more (up to an unlimited number) 'Process' entries for each 'Case' that include the following fields (or similar), at a minimum: Action Date; Type (Admin Status, Administrative Actions, Hotline Actions, Hotline Referral Actions, Legal/Enforcement Actions, Prosecutive Referral Statuses, Techniques Actions); Action (Complaint Referred, Referred Audits/Inspection, Referred Legal, Administrative Agreement, Admonished/Reprimanded, Clearance Suspended/Revoked, Contract/Grant Modification, Debarment, Employee Suspended from Work, Employee Terminated/Removed, Letter of Concern Issued, Policy/Program Improvement, Reassignment/Demotion, Referred for Debarment, Referred for Suspension, Referred to Personnel Security, Resigned/Retired Before Adjudication, Suspension, Action Not Taken, Complaint Resolved, Notable Positive Change, Oral/Written Reprimand, Other Management Action, Reassigned, Received, Under Pre-CCC Review, Admin Review, Approved, Returned for Editing, Sent, Submitted to AIGI, Submitted to ASAC, Submitted to DAIGI, Submitted to SAC, Arrested/Summons, Case Dismissed, Civil Complaint, Deferred Prosecution, Guilty/Conviction, Indictment Returned by Grand Jury, Information Filed by Prosecutor, Legal Compliance Agreement, Legal Opinion, No True Bill by Grand Jury, Not Guilty/Acquittal, Other, Plea of Nolo Contendere Entered, Plea of Not Guilty Entered, Pretrial Diversion, Proffer, Proposed Debarment, Psychiatric Hold, Federal Accepted, Federal Declined, Federal Referred, Pending Prosecutive Determination, Prosecutive Closure, State/Local Accepted, State/Local Declined, State/Local Referred, Civil Demand Letter, Consensual Monitoring, FinCEN Query, Online Covert Activity, Surveillance Technical); Person (Selection of available people in case); Notes. | <Select a response> | ||
| 4.16 | The solution must allow users to record zero or more (up to an unlimited number) 'Financial Action' for each 'Case'. 'Financial Action' must include the following fields (or similar), at a minimum: Financial Action (Other, Asset Forfeiture, Fines/Penalties Imposed - Civil, Fines/Penalties Imposed - Criminal, Funds Returned to DOE, Recovered Funds - Admin, Recovered Funds - Civil, Recovered Funds - Criminal, Restitution - Civil, Restitution - Criminal, Savings/Funds Put to Better Use - Admin, Seizures, Victims Compensation), Person, Financial Action Date, Amount, Notes. | <Select a response> | ||
| 4.17 | The solution must allow users to record zero or more (up to an unlimited number) 'Referrals and Recommendations' for each 'Case'. 'Referrals and Recommendations' must include the following fields (or similar), at a minimum: Type (Recommendation To, Recommendation From, Referred From, Referred To), Agency, Referral Date, Close Date, Status (Referred for Action/Response Required, Referred for Information/No Response Required), Person, Notes. | <Select a response> | ||
| 4.18 | The solution must allow users to record zero or more (up to an unlimited number) 'Chronology' entries for each case. 'Chronology' records must include the following fields, at a minimum: Type (Case Notes, CIFA Analysis, File Review, Hotline Only - Other Notes, Investigative Workplan, Legal Notes), Date, Person, Chronology Entry. | <Select a response> | ||
| 4.19 | The solution must allow users to record zero or more (up to an unlimited number) 'Legal Requests' for each 'Case'. 'Legal Requests' must include the following fields (or similar), at a minimum: Type (Ethics, General Legal Request, Subpoena, Suspension & Debarment), Name/Entity, Date Opened, Date Closed, Status (Completed, Declined, In Progress, Referred, Under Evaluation), Status Date, Final Action Date, Notes. | <Select a response> | ||
| 4.20 | The solution must allow users to record one or more (up to an unlimited number) 'Subject' for each case. 'Subject' must include the following fields (or similar), at a minimum: Entity Type as either 'Person' or 'Company'. If the Entity Type is Person, the following fields must be captured, at a minimum: Person Info Type (Subject, Complaintant, Witness, Victim, Investigative Team), First Name, Middle Name, Last Name, Title, Suffix, AKA, Email, Date of Birth, SSN, Sex, Race, Hispanic Origin, Image (Ability to upload photo file), Work Address, Work Address 2, Work City, Work State, Work Zip Code, Country, Work Phone Number, Home Phone Number, Mobile Phone Number, Other Phone Number, Employee Pay Band (GS1-13, GS14, GS15, N/A, Political Appointee, SES, Unknown), Bargaining Unit Employee (Y/N), Victim (Y/N), Fugitive (Y/N), Program Office or Contractor Name, Employment Status (DOE Contractor/Subcontractor, DOE Employee, DOE Grantee/Financial Assistance Awardee, Former DOE/NNSA Employee, Local Government Employee, NNSA Employee, Non-Employee-General Public, Other Federal Government Employee, Power Administration Employee, State Government Employee), Waive Confidentiality (Yes, No, N/A), Location, Office Info, Position/Title, Home Address, Home Address2, Home City, Home State, Home Zip Code, Drivers License Number, Passport Number-Country, Home Email, Comments. If the Entity Type is Company, the following fields must be captured, at a minimum: Person Info Type (Subject, Complaintant, Witness, Victim, Investigative Team), SAM UEI#, DUNS#, Cage Code, Company Name, Work Address, Work Address2, Work City, Work State, Work Zip Code, Country, Work Phone Number, Home Phone Number, Mobile Phone Number, Other Phone Number, Bargaining Unit Employee (Y/N), Victim (Y/N), Fugitive (Y/N), Program Office or Contractor Name, Waive Confidentiality (Yes, No, N/A), Location, Office Info, Position/Title, Home Address, Home Address2, Home City, Home State, Home Zip Code, Home Email, Comments. | <Select a response> | ||
| 4.21 | The solution must allow users to record zero or more (up to an unlimited number) 'Complainant' for each case. 'Complainant' must include the following field, at a minimum: Entity Type as either 'Person' or 'Company'. If the Entity Type is Person, the following fields must be captured, at a minimum: Person Info Type (Subject, Complaintant, Witness, Victim, Investigative Team), First Name, Middle Name, Last Name, Title, Suffix, AKA, Email, Date of Birth, SSN, Sex, Race, Hispanic Origin, Image (Ability to upload photo file), Work Address, Work Address 2, Work City, Work State, Work Zip Code, Country, Work Phone Number, Home Phone Number, Mobile Phone Number, Other Phone Number, Employee Pay Band (GS1-13, GS14, GS15, N/A, Political Appointee, SES, Unknown), Bargaining Unit Employee (Y/N), Victim (Y/N), Fugitive (Y/N), Program Office or Contractor Name, Employment Status (DOE Contractor/Subcontractor, DOE Employee, DOE Grantee/Financial Assistance Awardee, Former DOE/NNSA Employee, Local Government Employee, NNSA Employee, Non-Employee-General Public, Other Federal Government Employee, Power Administration Employee, State Government Employee), Waive Confidentiality (Yes, No, N/A), Location, Office Info, Position/Title, Home Address, Home Address2, Home City, Home State, Home Zip Code, Drivers License Number, Passport Number-Country, Home Email, Comments. If the Entity Type is Company, the following fields must be captured, at a minimum: Person Info Type (Subject, Complaintant, Witness, Victim, Investigative Team), SAM UEI#, DUNS#, Cage Code, Company Name, Work Address, Work Address2, Work City, Work State, Work Zip Code, Country, Work Phone Number, Home Phone Number, Mobile Phone Number, Other Phone Number, Bargaining Unit Employee (Y/N), Victim (Y/N), Fugitive (Y/N), Program Office or Contractor Name, Waive Confidentiality (Yes, No, N/A), Location, Office Info, Position/Title, Home Address, Home Address2, Home City, Home State, Home Zip Code, Home Email, Comments. | <Select a response> | ||
| 4.22 | The solution must allow users to record zero or more (up to an unlimited number) 'Witness' for each case. 'Witness' must include the following fields (or similar), at a minimum: Entity Type as either 'Person' or 'Company'. If the Entity Type is Person, the following fields must be captured, at a minimum: Person Info Type (Subject, Complaintant, Witness, Victim, Investigative Team), First Name, Middle Name, Last Name, Title, Suffix, AKA, Email, Date of Birth, SSN, Sex, Race, Hispanic Origin, Image (Ability to upload photo file), Work Address, Work Address 2, Work City, Work State, Work Zip Code, Country, Work Phone Number, Home Phone Number, Mobile Phone Number, Other Phone Number, Employee Pay Band (GS1-13, GS14, GS15, N/A, Political Appointee, SES, Unknown), Bargaining Unit Employee (Y/N), Victim (Y/N), Fugitive (Y/N), Program Office or Contractor Name, Employment Status (DOE Contractor/Subcontractor, DOE Employee, DOE Grantee/Financial Assistance Awardee, Former DOE/NNSA Employee, Local Government Employee, NNSA Employee, Non-Employee-General Public, Other Federal Government Employee, Power Administration Employee, State Government Employee), Waive Confidentiality (Yes, No, N/A), Location, Office Info, Position/Title, Home Address, Home Address2, Home City, Home State, Home Zip Code, Drivers License Number, Passport Number-Country, Home Email, Comments. If the Entity Type is Company, the following fields must be captured, at a minimum: Person Info Type (Subject, Complaintant, Witness, Victim, Investigative Team), SAM UEI#, DUNS#, Cage Code, Company Name, Work Address, Work Address2, Work City, Work State, Work Zip Code, Country, Work Phone Number, Home Phone Number, Mobile Phone Number, Other Phone Number, Bargaining Unit Employee (Y/N), Victim (Y/N), Fugitive (Y/N), Program Office or Contractor Name, Waive Confidentiality (Yes, No, N/A), Location, Office Info, Position/Title, Home Address, Home Address2, Home City, Home State, Home Zip Code, Home Email, Comments. | <Select a response> | ||
| 4.23 | The solution must allow users to record zero or more (up to an unlimited number) 'Investigative Team Members' for each case. 'Investigative Team Member' must include the following fields (or similar), at a minimum: Person Info Type (Subject, Complaintant, Witness, Victim, Investigative Team), First Name, Middle Name, Last Name, Title, Suffix, AKA, Email, Date of Birth, SSN, Sex, Race, Hispanic Origin, Image (Ability to upload photo file), Work Address, Work Address 2, Work City, Work State, Work Zip Code, Country, Work Phone Number, Home Phone Number, Mobile Phone Number, Other Phone Number, Employee Pay Band (GS1-13, GS14, GS15, N/A, Political Appointee, SES, Unknown), Bargaining Unit Employee (Y/N), Victim (Y/N), Fugitive (Y/N), Program Office or Contractor Name, Employment Status (DOE Contractor/Subcontractor, DOE Employee, DOE Grantee/Financial Assistance Awardee, Former DOE/NNSA Employee, Local Government Employee, NNSA Employee, Non-Employee-General Public, Other Federal Government Employee, Power Administration Employee, State Government Employee), Waive Confidentiality (Yes, No, N/A), Location, Office Info, Position/Title, Home Address, Home Address2, Home City, Home State, Home Zip Code, Drivers License Number, Passport Number-Country, Home Email, Comments. | <Select a response> | ||
| 4.24 | The solution must provide the ability to add case documentation/attachments to each 'Case'. | <Select a response> | ||
| 4.25 | The solution must provide users the ability to import an unlimited number of documents/attachments of unlimited file size (created externally to the solution) into each 'Case'. Document/attachment file formats include, but are not limited to, the following: MS Office (*.docx, *.xlsx, *.pptx, *.msg), Portable Document Format (*.pdf), Pictures (*.jpeg, *.jpg, *.img, *.bmp, *.tiff, *gif, *.png), and other audio and video formats. | <Select a response> | ||
| 4.26 | The solution must capture agency-defined metadata fields for each document/attachment in a 'Case'. Metadata fields may include, but are not limited to, the following: description, notes, category, revision date, author, version, restricted access (y/n), parent document, sensitivity label. | <Select a response> | ||
| 4.27 | The solution must provide the ability to add, update, and delete metadata for each document/attachment added to a 'Case'. | <Select a response> | ||
| 4.28 | The solution must provide the ability for users with appropriate permissions to delete documentation/attachments prior to their finalization in a 'Case' until the 'Case' is 'Closed - Final'. | <Select a response> | ||
| 4.29 | The solution must provide the ability for users with appropriate permissions to replace documents/attachments prior to their finalization in a 'Case' until the 'Case' is 'Closed - Final'. | <Select a response> | ||
| 4.30 | The solution must record a signoff to indicate to a supervisor that a document/attachment in a 'Case' is ready to be reviewed. The solution must record the signer's name, date, and time for each signoff for a document/attachment in a 'Case'. | <Select a response> | ||
| 4.31 | The solution must record a signoff to indicate that a supervisory reviewer has reviewed and approved a document/attachment in a 'Case'. The solution must record the signer's name, date, and time for each signoff for a document/attachment in a 'Case'. | <Select a response> | ||
| 4.32 | The solution must not allow the user who added a signoff to indicate that the document/attachment in a 'Case' was ready to be reviewed to signoff as the supervisory reviewer. In other words, the solution must prevent a user from reviewing their own work in a 'Case'. | <Select a response> | ||
| 4.33 | The solution must not allow a supervisory reviewer to signoff on a document/attachment in a 'Case' unless there is a signoff indicating that the document/attachment is ready for review. | <Select a response> | ||
| 4.34 | The solution must provide users the ability to edit all documentation/attachments (both native and imported) after reverting the document/attachment signoff status until the 'Case' is 'Closed - Final'. |
tc={6CF5D91E-B37F-43A4-A604-E0AB898F8120}: [Threaded comment]
Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924
Comment:
| Change this – they MUST intentionally revert the status | <Select a response> | |||
| 4.35 | The solution must automatically mark documentation/attachments as 'Edited' (or similar) and revert its status to 'Edited' (or similar) when it has been edited after it has a signoff by a supervisory reviewer. | <Select a response> | ||
| 4.36 | The solution must record a complete audit trail of all documentation/attachment activities including user name, action (such as create, edit, signoff, and review), and date/time for each action taken in documentation/attachments in a 'Case'. | <Select a response> | ||
| 4.37 | The solution must allow users to add a document/attachment to a 'Case' of any case type from predefined agency templates. | <Select a response> | ||
| 4.38 | The solution must provide users the capability to export all information from a 'Case' to include information from all form fields and all documentation/attachments for the cases. | <Select a response> | ||
| 4.39 | The solution must capture the following milestones for each 'Case', at a minimum: Date of Last Investigative Activity, Date Agent Submitted IR to ASAC, Date ASAC Submitted IR to SAC, Date SAC Submitted IR to HQ OPS, Date IR Issued by HQ OPS. | <Select a response> | ||
| 4.40 | The solution must perform a verification of the completion status of agency-defined activities upon the user changing a 'Case' status to 'Closed - Pending' (or similar). Activities to be verified may include, but are not limited to, the following: Notification of eDiscovery Specialist Completed, all 'Evidence Items' processed, Grand Jury and Subpoenaed Material Processed, Discarded NCIC History/Printouts, Completed Coordination with CIFA Regarding Electronic Evidence, Completed Coordination with NCS Regarding Grand Jury and Other Materials. | <Select a response> | ||
| 4.41 | The solution must record the Reportable Outcome for each 'Case' as "Yes", "No", or "N/A" prior to allowing the user to change a 'Case' status to 'Closed - Pending'. | <Select a response> | ||
| 4.42 | The solution must record supervisory review and approval (including date/time of approval) to change a 'Case' status from 'Closed - Pending' (or similar) or 'Closed - Investigation Initiated' (or similar) to 'Closed - Complete' (or similar). | <Select a response> | ||
| 4.43 | The solution must limit the ability to re-open (in other words, change the status from 'Closed - Pending' or 'Closed - Complete' to 'Open - Active') a 'Case' to system administrators. | <Select a response> | ||
| 4.44 | The solution must prevent any further edits/changes to a 'Case' after a 'Case' status is set to 'Closed - Pending' or 'Closed - Complete' | <Select a response> | ||
| 4.45 | The solution must record the user name, date, and time for all 'Case' status changes. | <Select a response> | ||
| 4.46 | The solution must provide the ability to granularly control access to information in form fields and documents/attachments in a 'Case' for information marked as "Controlled Unclassified Information" or "Other Sensitive Information" (such as Grand Jury information), at a minimum. | <Select a response> | ||
| 4.47 | If the 'OIG Sensitive' field is 'Y', the solution must restrict access to the 'Case' to those users assigned to the 'Case' and exclude 'Case' data from any reports, dashboards, or views. | <Select a response> | ||
| 4.48 | The solution must allow users to create a new 'Case' of type 'Investigation' or of type 'Whistleblower' from a 'Case' of type 'Complaint', copying all data from the orginal 'Case' of type 'Complaint' to the new 'Case'. The solution must automatically link the new 'Case' to the original 'Case'. | <Select a response> | ||
| 4.49 | The solution must allow users to create a new 'Case' from an existing case with the ability to copy user-selected data from the original 'Case' to the new 'Case'. | <Select a response> | ||
| 4.50 | The solution must allow users to remove links between 'Cases'. | <Select a response> | ||
| 5. HOTLINE MANAGEMENT REQUIREMENTS | 5.1 | The solution must organize submissions to the OIG Hotline Team by 'Submission'. | <Select a response> | |
| 5.2 | The solution must allow for the creation of a 'Submission' via the receipt of API request from the agency's public website. | <Select a response> | ||
| 5.3 | The solution must provide the capability to capture the following fields (or similar) for each 'Submission', at a minimum: Initiated Date, Summary of Allegations, Date Received, Primary Investigator, Type, Others Assigned, OIG Sensitive (Y/N), HQ Special Interest (Y/N), Current Status, Current Status Date, Method of Receipt, Category, Complaint Source, Primary Violation, Subject Type, Additional Violation, Allegation Location, Hotline (Y/N), Program Office, INV Assigned Office, Use Name Outside of OIG, Acknowledgement of Confidentiality, OIG Confidentiality Exp, Referred to OIG Website, Advised of OIG Disposition, Retaliation, Qui Tam (Y/N), Mandatory Disclosures, Contains Classified - Information outside system (Y/N), Covid-Related (Y/N), Grant Contract or other Assistance Award Number, IIJA (Y/N), IRA (Y/N), CHIPS (Y/N). | <Select a response> | ||
| 5.4 | The solution must, upon the receipt of an API request from the agency's public website, create a 'Submission' and put it in 'Pending' status or similar to segregate 'Submissions' from accepted 'Complaints'. | <Select a response> | ||
| 5.5 | The solution must, upon the receipt of an API request from the agency's public website, generate a PDF document with all data from the web submission and attach it to the submitted 'Submission'. | <Select a response> | ||
| 5.6 | The solution must, upon the receipt of an API request from the agency's public website, send an email notification to agency-configured email addresses. | <Select a response> | ||
| 5.7 | The solution must provide a view of all 'Submissions' which may be filtered by status of the 'Submissions' as 'Approved', 'Rejected', or 'Pending'. | <Select a response> | ||
| 5.8 | The solution must provide users the capability to search 'Submissions' by date range, status, or keyword, at a minimum. | <Select a response> | ||
| 5.9 | The solution must allow users with a role of hotline investigator (or similar) to view all 'Submissions'. | <Select a response> | ||
| 5.10 | The solution must allow users with a role of hotline investigator (or similar) to 'Approve' a 'Submission'. | <Select a response> | ||
| 5.11 | The solution must, upon the approval of a 'Submission', create a 'Case' of type 'Complaint' from it, populating relevant data fields in the 'Case' of type 'Complaint', including generating a unique 'Case Number'. | <Select a response> | ||
| 5.12 | The solution must allow users with the role of hotline investigator (or similar) to 'Reject' a 'Submission'. Upon rejecting a 'Submission', the solution will require the hotline investigator to complete the 'Justification for Rejection' (or similar) field. | <Select a response> | ||
| 5.13 | The solution must allow users with the role of supervisory hotline investigator (or similar) only to 'Un-Reject' a 'Submission'. Upon un-rejecting a 'Submission', the solution will change the status of the 'Submission' to 'Pending'. | |||
| 5.14 | The solution must provide users the capability to export data for one or more selected 'Submissions' in MS Excel format with all 'Submissions' data fields for each selected 'Submission'. | <Select a response> | ||
| 6. DASHBOARD AND REPORTING REQUIREMENTS | 6.1 | The solution must provide user-specific dashboards that are customizable by role. Dashboards may include My Open Cases, My Recent cases, My Pending Task Items, or similar. | <Select a response> | |
| 6.2 | The solution must provide users the capability to generate ad-hoc reports with current, real time data for the purposes of case management, documentation management, time and resource management, and stakeholder information sharing (such as required reporting in semi-annual reports to Congress), at a minimum. | <Select a response> | ||
| 6.3 | The solution must provide users the capability to develop and save customized report templates. | <Select a response> | ||
| 6.4 | The solution must provide the ability to generate reports containing real-time data across the solution and within cases based on any data captured in the solution. | <Select a response> | ||
| 6.5 | The solution must only display data in a report or dashboard if the user has access to that data (for example, only provide case data for cases to which the user has access). | <Select a response> | ||
| 6.6 | The solution must provide users the ability to save and export generated reports in MS Excel and/or CSV formats. | <Select a response> | ||
| 6.7 | The solution must provide dashboards and reports for tracking against zero or more (up to unlimited) agency-defined Key Performance Indicators (KPIs) for the fiscal year (Oct 1 to Sept 30). Examples of KPIs include, but are not limited to, the following: 90% of all complaints are triaged within 10 business days of receipt; 50% of investigations opened during the reporting period and closed with no reportable outcome are closed within 180 days of initiation; draft Investigative Reports submitted to supervisors within 21 workdays of the last significant investigative activity in at least 75% of investigations; at least 4 Fraud Awareness Briefings (FABs) are conducted annually; and, 15% of investigations opened during the reporting period are joint investigations with other agencies. | <Select a response> | ||
| 6.8 | The solution must allow system administrators to configure KPIs. | <Select a response> | ||
| 6.9 | The solution must allow for changes to KPIs on an annual basis based on the agency fiscal year (Oct 1 to Sept 30), at a minimum. | <Select a response> | ||
| 6.10 | The solution must provide hierarchical roll-up capabilities for KPI dashboards and reports, ensuring relevant data visibility for all organizational levels. For example, the solution shall display individual employees' KPIs, showing their current performance against defined targets while the solution shall display the employees' managers with a consolidated view of their team's performance. | <Select a response> | ||
| 6.11 | The solution must provide dashboards and reports for tracking Law Enforcement Availability Pay (LEAP) hours by leave calendar year. | <Select a response> | ||
| 6.12 | The solution must provide supervisors the ability to run LEAP reports to view subordinates' progress toward meeting their LEAP hours requirement. | <Select a response> | ||
| 7. TIME RECORDING REQUIREMENTS | 7.1 | The solution must provide the capability for users to record Law Enforcement Availability Pay (LEAP) hours per day for each of the seven days in a week. | <Select a response> | |
| 7.2 | The solution must require that users designated as Federal Law Enforcement Officers record LEAP hours. | <Select a response> | ||
| 7.3 | The solution must provide biweekly timesheets covering 14 days that commence on Sunday and end on Saturday and correspond with the established US Department of Energy pay periods. (The first US Department of Energy pay period for 2024 commenced on Sunday, January 14, 2024, which can be used as reference to calculate all future pay period start dates.) | <Select a response> | ||
| 7.4 | The solution must allow the user to categorize each of the days in a timesheet as 'Excludable'. | <Select a response> | ||
| 7.5 | The solution must allow time entries in hours and portions of an hour as a decimal number. | <Select a response> | ||
| 7.6 | The solution must validate that time entries do not exceed 24 hours in a day. | <Select a response> | ||
| 7.7 | The solution must prevent users (with warning) from entering negative time. | <Select a response> | ||
| 7.8 | The solution must allow users to add optional comments for each day in a timesheet and/or each entry in a timesheet. | <Select a response> | ||
| 7.9 | The solution must allow users to 'submit' timesheets when complete and record the user's name and the date and time of the submission. | <Select a response> | ||
| 7.10 | The solution must allow users to 'un-submit' timesheets (not previously approved) and record the user's name and the date and time of the un-submission. | <Select a response> | ||
| 7.11 | The solution must allow administrators to designate at least one supervisor/reviewer for timesheets for each user. | <Select a response> | ||
| 7.12 | The solution must allow administrators only to change supervisor/reviewer for timesheets for each user. | <Select a response> | ||
| 7.13 | The solution must allow users who are supervisors to review the timesheets of those users assigned to them. | <Select a response> | ||
| 7.14 | The solution must allow supervisors/reviewers to record agreement with time charges of their assigned staff with a signoff to include the supervisor/reviewer name and the date and time of the approval. | <Select a response> | ||
| 7.15 | The solution must allow supervisors/reviewers to record disagreement with time charges of their assigned staff with a rejection to include supervisor/reviewer name, the date and time of the rejection, and an optional rejection reason comment. | <Select a response> | ||
| 7.16 | The solution must allow users to revise rejected timesheets and re-submit them. | <Select a response> | ||
| 7.17 | The solution must allow system administrators to input, submit, un-submit, approve, reject, and delete timesheets for all users. | <Select a response> | ||
| 7.18 | The solution must send email notifications to the assigned supervisor(s)/reviewer(s) upon a user's timesheet submission. | <Select a response> | ||
| 7.19 | The solution must send email notifications to the user upon the rejection of their timesheet. | <Select a response> | ||
| 7.20 | The solution must provide optional email notifications to the user upon the approval of their timesheet. The option for receiving email notifications must be available for the user to set/configure without system administrator intervention. | <Select a response> | ||
| 7.21 | The solution must provide system administrators a view of timesheet history listing for each timesheet including, but not limited to, action (submit, un-submit, approve, reject), user, and date/time. | <Select a response> | ||
| 7.22 | The solution must allow for timesheets to be printed in a clean and concise format. This includes allowing users to print their own timesheets or an agency administrator to print the timesheet of any user. | <Select a response> | ||
| 7.23 | The solution must provide the ability for users to run ad hoc reports that display LEAP hours as well as the number of excludable days for a user-specified time period. The report must include totals and subtotals for LEAP hours and excludable days as well as the LEAP balance. The user may only generate LEAP reports for their hours and the hours of their subordinates. | <Select a response> | ||
| 8. EVIDENCE MANAGEMENT REQUIREMENTS | 8.1 | The solution must provide full evidence management capabilities in accordance with CIGIE Quality Standards for Investigations, federal rules of evidence, and other applicable federal statutes. | <Select a response> | |
| 8.2 | The solution must provide system roles specific to evidence management to include 'National Evidence Program Manager (NEPM)' (or similar), 'Evidence Custodian' (or similar), 'Case Supervisor' (or similar), and 'Case Agent' (or similar), at a minimum. | <Select a response> | ||
| 8.3 | The solution must allow 'National Evidence Program Manager (NEPM)' to perform any evidence management function on behalf of 'Evidence Custodian'. | <Select a response> | ||
| 8.4 | The solution must organize 'Evidence Items' (or similar) by case. | <Select a response> | ||
| 8.5 | The solution must record zero or more 'Evidence Items' for each case. | <Select a response> | ||
| 8.6 | The solution must capture the following fields, at a minimum, for each 'Evidence Item': UID, Category Type, Item Description, Seizing Address, Evidence Room, Storage Location, Container, Reason, Case Number, Case Agent, Evidence Custodian, Seized Date. | <Select a response> | ||
| 8.7 | The solution must allow users to add zero or more (up to unlimited) attachments to each 'Evidence Item'. | <Select a response> | ||
| 8.8 | The solution must allow system administrators to configure 'Evidence Item' form fields based on Evidence Item - Category Type | <Select a response> | ||
| 8.9 | The solution must record zero or more entities (subject, witness, complainant, or other) for each 'Evidence Item' with the following fields, at a minimum: Entity Type (Person, Business), First Name, Last Name, Business Name, Phone Number, Address, Email. Or, ties each evidence item to zero or more entities ('Subject', 'Witness', 'Complainant', or Other) associated with a case (per requirements 4.20, 4.21, 4.22) | <Select a response> | ||
| 8.10 | The solution must allow only primary 'Case Agents' and 'Evidence Custodians' to input 'Evidence Items' | <Select a response> | ||
| 8.11 | The solution must prohibit 'Case Agents' from inputting 'Evidence Room' and 'Storage Location'. | <Select a response> | ||
| 8.12 | The solution must allow system administrators and 'National Evidence Program Manager (NEPM)' to establish one or more 'Evidence Rooms' to contain 'Evidence Items'. | <Select a response> | ||
| 8.13 | The solution must allow system administrators and 'National Evidence Program Manager (NEPM)' to establish one or more (up to unlimited) 'Storage Locations' associated with each 'Evidence Room'. | <Select a response> |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .