Draft SOW 10-2-2020.docx

Legal Hold, Identification, Preservation, and Collection (HIPC)

HIPC Draft Statement of Work (SOW) October 2, 2020

Contents

1 Introduction

1.1 The OCC and its Legal Department

The Office of the Comptroller of the Currency (OCC) is an independent, non-appropriated bureau within the U.S. Department of the Treasury. The OCC charters, regulates, and supervises all national banks and federal savings associations as well as federal branches and agencies of foreign banks. Headquartered in Washington, D.C., the OCC has district offices located in New York, Chicago, Dallas, and Denver and a data center in Ashburn, Virginia. Bank supervision is the core activity of the agency.

The OCC’s Chief Counsel’s Office (CCO) centrally manages four legal practice areas in the Law Department, including those addressed by the OCC’s Litigation and Enforcement groups. The Litigation and Enforcement groups, and occasionally attorneys practicing in other groups, utilize eDiscovery systems and services to support legal matters routinely handled by the OCC, including responses to subpoenas, Freedom of Information Act (FOIA) and Congressional requests, OCC investigations, OCC administrative enforcement proceedings, and civil litigation before courts and administrative tribunals. The OCC employs approximately 167 attorneys and 17 legal support staff,[footnoteRef:1]including approximately 47 attorneys in the Litigation and Enforcement groups who routinely use eDiscovery systems and services in their daily work. [1: In this document, references to "legal staff" include both OCC attorneys and support staff.

1.2 Scope of the Statement of Work

The scope of this requirement is for eDiscovery solutions to support its internal legal holds, Identification, Preservation and Collection (HIPC) activities within the agency.

The OCC is engaged in a multi-year and multi-step effort to create an end-to-end, cloud-based eDiscovery program consisting of a fully integrated tool set, covering the full scope of the Electronic Discovery Reference Model (EDRM). Previous efforts have included: (a) the 2019 implementation of a cloud-based Relativity solution for document processing and document review; and (b) the augmentation and realignment of current staff that perform the hands-on identification, preservation and collection activities of the OCC, known as the "eDiscovery support services." The Relativity solution, which is externally hosted by an integrator, is known within the OCC as the Alternative Litigation Support System (ALSS). The HIPC solution is expected to interoperate with the OCC's Relativity solution.

To modernize and complete its end-to-end, fully integrated cloud-based eDiscovery program, the Contractor shall provide significant and demonstrated experience in implementing commercial, off-the-shelf (COTS) solutions to address organizations’ identification, collection, and preservation needs. For the left side of the EDRM,[footnoteRef:2] the Contractor shall provide a managed service supported by a single suite of tools, or a collection of fully integrated tools. The HIPC solution is intended to be used enterprise-wide by: (1) legal staff primarily in Litigation and Enforcement, but occasionally in the other CCO practice areas; and (2) Information Technology Services (ITS) employees and contractors. [2: The OCC defines the left side of the EDRM as including the identification, preservation, and collection of ESI, as well as implementing legal holds and issuing legal hold notifications.]

2 Background

2.1 Current HIPC eDiscovery Process

The eDiscovery HIPC activities are currently being performed by CCO legal staff and the eDiscovery Data Management Support team (EDMS), staffed by five (5) ITS employees and contractors.

This EDMS team provides the following eDiscovery services to CCO Legal Staff:

1. eDiscovery consultation services;

2. eDiscovery project management, which includes the planning, management and execution of all tasks for the collection of agency electronically stored information (ESI) and delivery of that ESI to ALSS;

3. HIPC policy and procedure development, in close coordination with CCO and various parts of the ITS organization;

4. Assistance with preserving ESI for custodians who are subject to a legal hold; and

5. Collection and/or preservation of ESI from a custodian off-boarding from the agency.

Primary Sources of ESI at the OCC

1. Common Data Sources:

· OCC Intranet (internal OCC website, HTML published by Rhythmyx Content Management System);

· OCC Public Websites (external, public-facing OCC websites like occ.gov, HelpWithMyBank, careers.occ.gov, etc., HTML websites published by Rhythmyx Content Management System);

· SharePoint (on-premise SharePoint 2013 implementation, with approximately 1,100 sites and total content size of 5 TB);

· PC Hard Drives (OCC staff have Dell laptops, a small percentage have Dell workstations, refreshed every three years);

· Network Shares (each OCC employee has a personal drive (their “P:\ drive”) and access to a number of enterprise NAS shares; shares contain a total of approximately 1 billion files on a 500 TB NAS footprint);

· External Hard Drives (OCC employees are issued a USB thumb drive and can request larger external drives if there is a demonstrated need);

· Mobile Devices (including OCC-issued iPhone 6s, iPads, and tablets); and

· PC Backup v8.8.8 (PC software used to back-up selected folders on an end-user’s PC, collection performed by restoring a selected user backup to a network share and searching against contents of restored data).

2. COTS Products (system API or built-in discovery tool available for automated collection)

· Cisco Voicemail (Cisco Unified Communications Manager Version 11.5);

· OpenText eDocs (eDocs DM 10 patch 2 and Content Server RM 16.0.4 update with CS Patch 2017-03); and

· O365 items (including email, calendars, Skype messages, and tasks).

3. Systems with a SQL Server Database (collections perform via SQL Server)

1. OCC Enterprise Information Repository (EIR) / Datamart (most OCC systems synchronize their data with the EIR via a “push” into the EIR; this will be the primary source of collection for the collection tool for all OCC systems with a SQL Server back-end);

1. SIS-Examiner View (commonly referred to as “SIS-EV,” system outputs include examination results, problem bank reports, resource reports);

1. CAG-Remedy (database of consumer complaints processed by the OCC); and

1. CATS (Central Application Tracking System, is an Appian product used to track bank licensing applications and manager other licensing functions, current version is CATS 2020.3.2, Appian Platform is v.20.2).

Identification, Preservation and Legal Holds - The OCC's Current Process Currently, Identification and legal holds are completed and managed largely by CCO legal staff. Legal staff use several tools to identify potential custodians and sources of potentially relevant ESI, including the OCC’s Active Directory, organization charts available on OCC Intranet, attorney interviews of potential custodians, a variety of internal, custom-developed proprietary systems used for managing OCC examination staff and bank examination planning, and learned knowledge of common sources of ESI. Legal staff utilize O365 to manually send legal hold notifications via email to identified custodians. Because CCO has no standardized system of tracking legal hold notifications or custodial responses, the attorneys use a variety of methods to track the process, including Excel spreadsheets, O365 email voting function, and SharePoint.

Legal support staff in Litigation and Enforcement each maintain an Excel spreadsheet of all active legal holds and the custodians associated with the legal hold. Legal support staff receive an automatically generated email from the Office of Security (internally referred to as a “Personnel Administration and Security System (PASS) Notification”) when an OCC employee is scheduled to leave the agency, and they visually compare the PASS Notification to the Excel spreadsheet of custodians. Legal support staff then manually send email notifications to the managing attorney to consider further preservation or collection for that custodian prior to their departure. Where appropriate, legal staff work with the EDMS team and others from ITS to arrange for departing custodians’ OCC-issued computers, mobile devices, and/or network shares to be preserved for possible collection at a later date.

The OCC has no centralized system or process for preservation, and the work is primarily managed by the individual custodians and/or a mix of legal Staff and IT staff. Some sources of ESI have no preservation features that can prevent destruction or loss of ESI, or facilitate preserve-in-place ESI, during the scope of a legal hold. The agency currently utilizes a cloud-based instance of O365 (G5) but has not implemented any automated retention (scheduled destruction) policies around email data collected from O365 (resulting presently in all items being preserved on the cloud indefinitely). However, the OCC anticipates instituting such retention policies in the future. Therefore, no efforts are currently needed to preserve agency emails or items maintained in the O365 cloud.

Cisco voicemails are digital and preserved through O365, but they are not transcribed or indexed beyond logging the incoming phone number and date and time.

At this time, OCC Skype messages are not automatically preserved as a rule; preservation is optional, and employees must affirmatively configure their Skype options to preserve messages. When preservation is needed for newly created ESI, the custodian must take affirmative steps to turn on message preservation through the cloud.

Certain folders from individual OCC computers (primarily the contents of C:\Users\<profile_name>, including a user’s Desktop, My Documents, etc.), are backed up daily via PC Backup, and the data is stored in the cloud for as long as the employee remains employed at the OCC. Current PC back-up rules dictate that: (a) only the previous five (5) versions of a file are retained and (b) files that are deleted from a custodian’s file system are deleted from PC Backup after 33 days. PC Backup has a preservation feature for legal holds, which must be manually applied for each custodian by the system administrator. At this time, application of the preservation feature is only routinely done when specifically requested by the Litigation of Enforcement divisions at the OCC (for a list of files that are routinely preserved with PC Backup, see Appendix 2).

All OCC Network shared files have a full backup once a week, and incremental backups each weekday, and the system maintains the data for roughly 180 days. At this time, the OCC does not routinely preserve data from network file shares for legal-hold preservation nor does it routinely access the file share backups as part of collection efforts. For a schedule of network file shares that are backed up, see Appendix 3.

A few other agency sources of ESI are stored in systems that have preservation functionality, but those functionalities must be administered by the custodian, rather than by any database administrator or data steward. At this time, preservation is not routinely done in response to legal holds. Individual custodians are expected to preserve documents on their own, including ESI maintained in the OpenText eDOCS system, on phones and mobile devices, and on computer hard drives, along with any paper or tangible objects (primarily notebooks or other bounded paper). More details about these systems are contained in the Requirements Traceability Matrix (RTM), attached as Appendix 1.

Collection and Review – The OCC's Current Process The OCC currently has limited on-premise collection capabilities, utilizing Pinpoint Labs Harvester Portable (network version, 6.x) and cloud-based O365 (G5). ESI collected is temporarily preserved or housed on OCC network file shares until it is transferred to Relativity for review and/or production to third parties. The EDMS team is currently responsible for collecting data from custodians, leveraging a combination of Harvester Portable and custom keyword and regular expression searches against each source of relevant agency ESI.

Between the Enforcement and Litigation groups, the OCC has approximately 50 active cases. Within the last year, approximately 45 collections were completed for internal ESI, stemming from 15 active cases that collected ESI from an average of three custodians per case (please note, however, that the number of custodians for a case can sometimes be in the low hundreds). Currently, there is 4 TB of ESI collected from custodians stored on file shares, which does not include O365 data. The OCC collected 398 GB of data from O365 in the past 12 months.

The OCC also utilizes manual self-collection by employee-custodians of documents maintained on multiple OCC specific custom SQL Server applications, customized open API sources (primarily OpenText eDOCS), SharePoint, shared network folders, and C drives of employee laptops. The OCC has no process for collection of information from mobile devices outside of manual workarounds such as screen shots and text forwarding. More details about these systems are contained in the RTM, Appendix 1.

CCO currently utilizes Relativity 10 (version 10.1.290.1), without customization, through a managed-services contract with Innovative Discovery, for the following phases of the EDRM: Processing, Review, Analysis, and Production. The ALSS contract, with a three-year period of performance, was awarded in August 2019.

2 Tasks This section defines the specific tasks required for the implementation of the HIPC solution and presents other general requirements for successful and timely completion of these tasks.

2.1 Task 1: Project Management

The Contractor shall provide project-management services to facilitate on-time, on-budget, and high-quality execution of all tasks described in this SOW.

Deliverable 1: The Contractor shall create and maintain a project schedule that addresses the full scope of work described in this SOW. Created in Microsoft Project Server, this schedule shall be fully resourced and shall include tasks, milestones, and all dependencies. The Contractor shall deliver the initial draft of the project schedule within 10 business days of the contract kickoff meeting, and it shall be updated on a weekly basis. After acceptance of the schedule by the Contracting Officer's Representative (COR), the schedule shall be baselined.

Deliverable 2: The Contractor shall update and maintain a SharePoint site within the OCC environment to use as a depository for all contract deliverables and project-related documentation.

Deliverable 3: The Contractor shall create a weekly status report for the duration of the contract. The report shall document progress on outstanding project tasks and identify issues that require the OCC’s attention. The report shall include: (i) notable activities performed during the previous week on all tasks in the SOW; (ii) planned work for the upcoming week; and (iii) project-related issues and their resolutions, including a discussion of any issues requiring OCC resolution.

Deliverable 4: The Contractor shall create a risk register that is updated on a weekly basis. This risk register shall document all risks associated with the project, as well as proposed mitigations. The risk register shall be maintained in SharePoint.

2.2 Task 2: Provide Authority to Operate (ATO) for the Solution's Test and Production Instances

After award of the contract, the OCC will perform a review of the FedRAMP Authorization package, including a risk analysis and a security assessment on controls identified as “Customer Responsible.” The cloud environments provided by the Contractor to host OCC data must maintain a FedRAMP authorization for the duration of the contract.

Deliverable 5: To facilitate the use of OCC production data for User Acceptance Testing (UAT), the Contractor shall create the Authority to Operate for Interim Testing (ATO-FIT) package. For its internal planning purposes, the Contractor should assume that the OCC’s review and approval of the ATO-FIT packages will be approximately 12-14 weeks.

Deliverable 6: To facilitate the implementation of the HIPC solution in the Production environment, the Contractor shall create the ATO package. For its internal planning purposes, the Contractor should assume that the OCC’s review and approval of the ATO packages will be approximately six (6) months.

2.3 Task 3: Integration of Identity and Access Management and Cloud Access Security Broker Capabilities for the HIPC Solution

In late 2019, the OCC implemented Okta’s Identity and Access Management (IAM) solution for single sign-on and Netskope’s Cloud Access Security Broker (CASB) for cloud services. The implementation of the HIPC solution requires the integration of the solution with these IAM and CASB capabilities. The integration activities shall include configuration and testing of the HIPC solution in both test and production environments. The Contractor shall utilize the Security Assertion Markup Language (SAML)-based user account management solution for provisioning and de-provisioning. The solution shall support forward proxy and API integration with the CASB solution.

The requirement to utilize the Okta IAM solution to establish single sign-on includes situations where a user accesses the solution from a deep link (i.e., a link that references a specific piece of web content rather than a home page or similar type of landing page.) This requirement excludes situations where the user is using a personal identity verification (PIV) card to apply a digital signature and situations where identifying information is needed to authorize a role change (e.g., elevating user privileges to an administrator level).

The single sign-on implementation shall use the SAML version 2.0 or later. The implementation shall also support an attribute in the SAML assertion that puts the HIPC solution into web accessibility mode for the user.

OCC personnel will work with the Contractor to develop, test, and implement the IAM/CASB solution; however, the implementation is ultimately the responsibility of the Contractor.

The IAM/CASB integration shall include implementation of automated management of user accounts in the HIPC solution. Automated account management includes creation (i.e., provisioning) of new accounts, maintenance of existing accounts, and deletion of existing accounts. Maintenance includes updates to account data elements, assignment of user roles, and changes to account status (e.g., active vs. inactive).

The Contractor’s automated user account management implementation shall implement the provisioning capacity from the SAML certificate for the HIPC solution. The implementation shall maintain existing user accounts by updating user account data from data in SAML assertions when a user accesses the HIPC solution. The implementation shall also provide a set of web services to create new accounts, maintain existing accounts, and delete existing accounts. The Contractor’s web services shall be based on the Simple Object Access Protocol (SOAP), Microsoft Windows Communication Foundation (WCF), or Representational State Transfer (REST).

2.4 Task 4: User-Acceptance Testing (UAT)

In preparation for the deployment of the solution, the Contractor shall provide support for UAT. The Contractor shall provide an environment that emulates the production environment where the solution will ultimately reside. This test instance shall be maintained as operational after the production implementation of the HIPC solution to support general testing, troubleshooting, and problem-resolution needs that may arise throughout the period of performance of this contract. These needs may include testing of patches and upgrades to both the HIPC solution, as well as the identity and access management (IAM) solution, and the OCC's cloud-access security broker (CASB) solution with which HIPC is integrated.

The Contractor shall provide technical support during the UAT cycle and shall modify any configurations whose settings need to be changed to facilitate successful testing. The OCC anticipates that the test cycle will last no longer than 20 business days.

Deliverable 7: The Contractor shall create a system design document that describes the design concepts, workflows, and data flows for the solution. A preliminary design will be submitted in support of UAT, and this design will be finalized for the Release Readiness Review to be conducted prior to the production implementation of the solution.

Deliverable 8: The Contractor shall create a system architecture diagram that depicts the integration points between all tools in the production instance of the solution, including the OCC's ALSS instance, the OCC's IAM solution, and the OCC's CASB solution. A preliminary architecture will be submitted in support of UAT, and the architecture will be finalized for the Release Readiness Review to be conducted prior to the production implementation of the solution.

Deliverable 9: The Contractor shall create detailed test scripts, based on the RTM for the selected solution, that OCC users will execute during UAT. These test scripts/scenarios should be sufficient to test all requirements (documented in the RTM, Appendix 1) that are either fully or partially satisfied by the solution. The test scripts shall address the IAM/CASB integration, as well as the requirements in the RTM.

Deliverable 10: The Contractor shall create an UAT Test Report, including an updated RTM, that summarizes the results of UAT. The COR will be responsible for ensuring that all test results from OCC testers are shared with Contractor upon completion of UAT, enabling the Contractor to create the Test Report. Delay on the part of the OCC in providing timely test results to the Contractor will enable the Contractor to request a schedule extension for the delivery of the UAT Test Report.

2.5 Task 5: Implementation of the HIPC Technology Solution

Upon submission of the ATO package and completion of UAT, the Contractor shall proceed with deployment, implementing any configuration changes for the solution that were identified as necessary during UAT. The Contractor shall conduct a Release Readiness Review (RRR) and seek formal approval from the OCC for the solution to go live.

The initial production deployment of the HIPC solution is subject to the OCC’s software change management process, which is governed by the Enterprise Change Control Board (ECCB). Please see Appendix 4 for information about this process.

Deliverable 11: The Contractor shall create an RRR Report no later than five business (5) days prior to the completion of Task 5 and the solution going live. Based on the report, the COR will provide formal concurrence for the solution to go live.

2.6 Task 6: Training for OCC Users

The Contractor shall design and deliver training for OCC Legal Staff, members of the EDMS team, members from the eDiscovery Support Services, and ITS users of the HIPC solution, for all technologies implemented under this contract. The Contractor shall provide training for end-users (for the roles identified below). The Contractor shall provide formal, classroom-based (live)[footnoteRef:3] training for the for Attorney-user and EDMS-user roles only; other user roles will self-train by utilizing the Custodian/Data Steward User Guide (Deliverable 13). The OCC will identify which employees will need each type of training prior to the scheduling of training; however, the OCC anticipates that approximately 60 OCC employees will need Attorney-user training, and seven (7) OCC employees will need EDMS user role training. The training shall be interactive and include test/use cases for trainees to practice using the technology during the class. Training topics shall focus on how to use the technology to demonstrate the capabilities identified in the RTM. [3: Remote, but live, training will be acceptable as well.]

The live training will be recorded by the OCC to facilitate on-demand, self-training for class attendees after the classroom training is completed. The training will take place in the OCC’s Washington, D.C., headquarters, which is equipped with standard technology and equipment for live classroom-based training. Training for end-users shall be offered no more than three (3) times per week, between Monday - Thursday during the hours of 9am - 4pm EST, over the course of one (1) month. The training sessions for end users should have no more than 10 attendees per class.

The Contractor shall also provide additional training for new end-users, or as a refresher training for existing end-users, twice a year during the fall and spring seasons (at most, two (2) classes per season and approximately 5 students – depending on need).

OCC end-users are categorized into the following roles:

This user role will self-train by utilizing the user guide.

Deliverable 12: The Contractor shall provide two versions of a comprehensive, electronic training manual for each of the configured technologies deployed under this contract. The first version shall be designed for the Attorney-user role, and the second shall be designed for the EDMS-user role. Both training manuals shall be comprehensive enough to cover all functionality of the solution for each user roles. Both training manuals shall be updated whenever major releases are deployed for the solution.[footnoteRef:4] [4: If the new releases do not include the type of functionality that is associated with the sections of the RTM referenced for the Attorney-user and EDMS-user roles, then updates to the training manual will not be required. Training documentation shall only be updated when the major releases deploy new functionality that is utilized by these two types of users.

Deliverable 13: The Contractor shall provide two user guides – one for custodian users and one for data steward users. The custodian user guide shall include simple instructions for custodian users to self-train on the solution functionality addressed by the following sections of the RTM: responding to hold notices and surveys under the Hold Notice and Identification section. The data steward user guide shall include simple instructions for data steward users to self-train on the solution functionality addressed by the following sections of the RTM: responding to hold notices and survey’s under the Hold Notice and Identification section, and any in-place preservation that is not completed by the EDMS-users. These user guide shall be updated whenever major releases are deployed for the solution.[footnoteRef:5] [5: If the new releases do not include the type of functionality that is associated with the sections of the RTM referenced for the Custodian-user and Data Steward-user roles, then updates to the training manual will not be required. Training documentation shall only be updated when the major releases deploy new functionality that is utilized by these two types of users.

2.7. Task 7: Post-Implementation Operation, Maintenance, and Support

Task 7.1: Operate and Maintain the Solution as a Managed Service The Contractor shall provide technical support to keep the solution running in production and fully functioning without major defects. The solution shall be kept up-to-date with the latest software per the OCC’s n-1 architectural principle (i.e., the Contractor shall ensure that the solution is no more than one major or minor update behind the most current version). The Contractor shall ensure that the solution is patched with all commercially available operating system and third-party software patches within 30 calendar days of issuance of the patch. For zero-day exploits or other high-priority, out-of-cycle patches released by the third-party vendor or the operating-system manufacturer, patch application timeframes shall be dictated by the severity of the potential exploit.

The Contractor shall notify the OCC COR in writing[footnoteRef:6] of scheduled maintenance no less than five (5) business days in advance of the maintenance taking place. In the event emergency maintenance is required, the Contractor shall notify the OCC COR, in writing and via telephone, as soon as possible after learning of the need for maintenance. [6: An email notification is sufficient.]

All releases of the HIPC solution are subject to the OCC’s software change management process, as described in Appendix 4.

Deliverable 14: The Contractor shall generate four (4) monthly audit reports specific to: (i) collections; (ii) administrator activity; (iii) system errors; and (iv) security groups and permissions. All four (4) monthly audit reports shall be delivered to the COR via SharePoint, with an email notification to the COR.

· Collection reports should include usernames, machine name, date collected, service account performing the collection, server or source from which the collection was performed, source locations, destination locations, and collection size.

· Administrator activity reports should include service account, logged in user, machine name, action performed, date, and time.

· Error logs reports shall include any and all errors available for review from the selected system.

· User and security group reports should include all system components and associated access levels by security group and the membership of each security group.

Task 7.2: Provide Technical Support for the Solution The Contractor shall provide technical support from 7:00 AM EST to 7:00 PM EST on weekdays, excluding Federal holidays, for technical issues related to the HIPC solution. The OCC uses Service-Now as its incident-management system for all systems utilized by its users. The OCC shall provide licenses for the OCC’s Service Now instance, and one or more queues will be designated for the Contractor’s personnel to access tickets for the purposes of providing Tier-2 and Tier-3 support, as defined below. As part of ongoing technical support, the Contractor shall provide both customer-facing and ITS-internal Knowledge Base Articles (KBAs) regarding common incidents[footnoteRef:7] being reported in Service Now for the solution. The KBAs shall be provided prior to the solution going live, and the Contractor shall provide new KBAs when the COR identifies the need for additional articles. [7: An ‘incident’ is defined as an unplanned interruption to or reduction in the quality of an IT service. Failure of a configuration item that has not yet impacted service is also an incident. An ‘outage’ is a complete disruption or interruption of an IT service or application. A ‘degradation’ is a decline in normal IT service or application service level which does not entirely disrupt or interrupt the service or application.]

The Contractor’s technical support services shall include support for the IAM/ CASB integration, including troubleshooting and resolution of:

Routine operational problems Problems resulting from upgrades and routine maintenance (e.g., patching) of the IAM and CASB applications Problems resulting from the integration of the IAM and CASB tools with the HIPC solution.

OCC Service Now Tiers In order to deliver the most effective and efficient customer/technical support services[footnoteRef:8] while maximizing the customer experience, the OCC leverages a four-tier system. [footnoteRef:9] : [8: A service (or catalog) request is a user request for information or advice, for a standard change (a pre-approved change that is low risk, relatively common and follows a procedure), or for access to an IT service.] [9: See Exhibit 5 for the more on the OCC’s Service Now priority process.

· Tier 0 – This is considered self-help. OCC employees can leverage the expanding Knowledgebase found on the OCC systems, as well as other means, such as email communications, pamphlets and other media provided to employees.

· Tier 1 – Tier 1 serves as the entry point for all support and request services. The OCC Service Desk serves in the capacity of Tier 1. The Service Desk provides customers the ability to contact them via telephone, online chat, email, and through the GetHelp portal via self-submitted incident tickets.

· Tier 2 – Tier 2 is the second line of support. Tier 2 includes support groups with expertise in specific technologies and products. This tier includes local/on-site support in various office locations, specific application/product support teams, as well as preliminary support teams that are part of engineering teams. The Contractor shall provide Tier-2 support via a dedicated queue to which HIPC incidents will be escalated by the Tier-1 representatives manning the OCC Service Desk.

· Tier 3 – Tier 3 is the final level of support services provided. The expectation at this level is that support requires engineering work that could include code changes, infrastructure changes, and even procurement or vendor-specific support/services. Both OCC and vendor teams may provide Tier-3 support. The Contractor shall provide Tier-3 support via a dedicated queue to which HIPC incidents will be escalated by Tier-1 and Tier-2 representatives.

Incident/Request Recommended Performance Standards Table 1 depicts service-level requirements for Contractor technical support.

Table 1: Service Levels for Tier-2 and Tier-3 Incident Management

OCC has deviated from ITIL and Restored =Resolved Tier-2 queue <= 16 business hours after the ticket is escalated to the Tier-2 queue Tier 3 queue <= 24 business hours after the ticket is escalated to the Tier-3 queue Hours are business hours from 7 AM to 7 PM EST, Monday through Friday, Federal holidays excepted.

OCC has deviated from ITIL and Restored =Resolved

Deliverable 15: The Contractor shall create and maintain customer-facing KBAs for common or anticipated incidents for Tier-0 support of the Solution. The Tier-0 KBAs shall be provided 15 business days prior to the solution going live, and the Contractor shall continue to provide new, or updated Tier-0 customer-facing KBAs on an ongoing basis, based on like or similar incidents being reported three or more times within a 12-month period. The OCC anticipates six (6) to eight (8) Tier-0 KBAS being created for go-live deployment.

Deliverable 16: The Contractor shall provide ITS-internal KBAs regarding common or anticipated incidents for Tier-1 support of the solution. The purpose of these KBAs is to provide instructions to the Tier-1 representatives for resolving common technical issues with the solution. The Tier-1 KBAs shall be provided 15 business days prior to the solution going live, and the Contractor shall continue to provide new or updated ITS-internal KBAs on an ongoing basis, based on like or similar incidents being reported three or more times within a 12-month period. The OCC anticipates six (6) to eight (8) Tier-1 KBAS being created for go-live deployment.

Deliverable 17: No later than seven (7) calendar days prior to the production deployment of the solution, the Contractor shall conduct a virtual meeting/teleconference with selected Tier-1 representatives, the HIPC COR, and the OCC Incident Manager. During this meeting, the Contractor shall provide an overview of the HIPC solution, review the KBAs written for the solution, and explain the procedures for Tier-1 personnel to escalate HIPC incidents to the Tier-2/Tier-3 queue assigned to the Contractor. The Contractor shall document meeting minutes of the discussion to record the information shared with attendees and distribute those minutes to all attendees within two (2) business days of the meeting.

2.8. Task 8: Transition Services

Upon contract completion or termination, the Contractor shall be required to transfer all OCC data in the HIPC solution to another service provider. The Contractor shall meet with the OCC and the successful awardee to create and deliver a Transition Plan. During the transition, the Contractor shall maintain services in accordance with contract requirements until formal transition is complete. The transition process will be dictated in part by the successful awardee’s transition period as well as the transition guidance provided by the OCC. All data must be provided to the OCC in a fully delimited format that can be imported into the successful awardee’s eDiscovery platform. Transition services shall be provided over a period of 40 business days (i.e., approximately two calendar months).

Deliverable 18: At a minimum, the Transition Plan shall address the following topics:

· Transition resource needs;

· Transition schedule;

· Transition communications;

· Data migration activities;

· Testing of the data migration;

· Quality assurance of the migrated data;

· Technical support for the data migration;

· Contingency planning;

· Transition reporting;

· Configuration management of the HIPC and the new eDiscovery solution during the transition;

· Transition management controls; and

· Transition governance and approvals.

During transition planning, the OCC COR and the Contractor shall identify any additional topics that should be addressed by the Transition Plan.

3 Key Personnel The Project Manager and eDiscovery Technology Lead required under this SOW are critical to the success of the contract. Therefore, the Project Manager and eDiscovery Technology Lead are key personnel, and OCC requires the following expertise and experience for these roles:

Project Manager

· Minimum Qualifications

· A minimum of five (5) years, within the past eight (8) years, experience with managing eDiscovery technology implementation projects.

· Highly Desired Qualities:

· Possess a clear and comprehensive understanding of all components in the EDRM; and

· Have strong communications skills.

eDiscovery Technology Lead

· Minimum Qualifications

· A minimum of ten (10) years, within the past 12 years, of hands-on experience using eDiscovery solutions in an operational environment and/or providing technical and consulting support for eDiscovery solutions;

· At least one (1) year of hands-on experience implementing and configuring one or more of the eDiscovery technology tool(s) being proposed for the HIPC solution, within the past five (5) years; and

· Association of Certified E-Discovery Specialists (ACEDS) certification, or completion of eDiscovery training on the all phases of the EDRM within the last five (5) years.

· Highly Desired Qualities:

· Completed eDiscovery training and/or certification on one or more eDiscovery technology tools within the past three (3) years;

· Possess a clear, comprehensive understanding of forensics, specific to acceptable methods of collecting data from laptops, network file shares, COTs product APIs and from custom-developed software;

· Possess a thorough knowledge of FedRAMP-authorized eDiscovery technology and tools;

· Have experience implementing eDiscovery software within a government agency; and

· Have strong communication skills.

4 Document Deliverables Table 2 Document Deliverables Required to Support the Tasks Described in Section 2

Must be submitted prior to the UAT. The OCC will need approximately 12-14 weeks to review and approve the ATO-FIT package.

The OCC will need approximately 6 months to review and approve the ATO package.

*See Deliverable 7 for timing.

*See Deliverable 8 for timing.

One (1) 20 business days prior to the first training class

One (1) 20 business days prior to the first training class

5 Security Requirements The Contractor and all of its respective subcontractors shall follow and remain compliant at all times with all Federal Information Security Management Act of 2002 (Public Law 107-347) (FISMA), Office of Management and Budget Circulars, Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the development, operations, and protection of information systems and sensitive information and data. Additionally, the Contractor and all of its respective subcontractors shall follow and remain compliant at all times with OCC and Federal IT Security standards, policies, and reporting requirements.

The Contractor and systems supporting these services shall follow and remain compliant at all times with the security and privacy requirements for a FISMA MODERATE impact system, including those specified in the current version of NIST SP 800-53 which requires that all systems undergo a formal security authorization (i.e., Security Assessment and Authorization (SA&A)) and continuous monitoring of security controls. The Contractor’s continuous monitoring plan must be developed in accordance with the current version of NIST SP 800-137. The Contractor must meet these security requirements for any system, application, or environment being operated on behalf of OCC or being used to process any OCC information, including services that are either fully or partially provided, such as other agency hosted, outsourced, and cloud computing solutions.

Furthermore, for hosted or cloud computing services, the Contractor shall provide Federal Risk and Authorization Management Program (FedRAMP) authorized solution, including maintaining a FedRAMP security authorization and adhering to FedRAMP Continuous Monitoring requirements throughout the life of the contract. OCC preference is a Software as a service (SAAS) Cloud Service Provider solution.

Data Ownership and Use - The OCC shall maintain ownership of all government data, including data deployed in a cloud or offsite solution, and retains unrestricted rights to that government data. The government data may not be co-located with non-Government data; the Contractor shall isolate the Government data into a separate environment for clear demarcation of ownership. All data produced, stored, and processed under this contract are the property of the U.S. Government and cannot be reproduced, released, disclosed, or retained by the Contractor for any reason upon termination of services. The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order issued hereunder. Any authorized access to, use, or disclosure of Government data shall only be for purposes specified in this contract. The OCC reserves the right to conduct on-site inspections and the Contractor shall provide access to the OCC when requested.

Data Retention and Sanitation - The Contractor shall provide the means by which the Contractor will return to OCC, terminate storage, and delete government data from the Contractor system, as determined by OCC.