Draft SOW CRIMS Maintenance_FY25_12122024.pdf

DRAFT STATEMENT OF WORK

CRIMS Maintenance SOW– FY-25-FY26

C.1. BACKGROUND

The National Library Service for the Blind and Print Disabled (NLS) within the Library of Congress (LOC) provides nationwide support to visually impaired audiences seeking access to reading material in collaboration with state library systems. End-users for NLS programming are librarians and library patrons certified to receive specialized services. Patron services are increasingly managed through information management systems to connect patrons to resources.

Since 2014, NLS has provided various services under an inter-agency agreement between the Bureau of Engraving and Printing (BEP) and jointly operates the US Currency Reader Program. The US Currency Reader Program's principal goal has been to distribute assistive technology free of charge to eligible members of the public requiring assistance with reading paper money. This program has shipped thousands of currency reader devices to new and existing library patrons via USPS free-matter. It is projected to continue until raised tactile currency features are successfully implemented nationwide on US banknotes.

The information management system behind the US Currency Reader Program is known as the Currency Reader Information Management System (CRIMS). As part of the cooperative agreement with BEP, LOC operates and manages CRIMS. CRIMS maintains electronic records on physical package shipments to individuals who apply for a free currency reader device to facilitate inventory tracking and customer service. From initial request to fulfillment and shipment, CRIMS exclusively supports the workflow of the Currency Reader Distribution Project (CRDP). The current-state CRIMS is a cloud-based, database driven system are externally hosted and are currently managed by an outside vendor.

Since the CRIMS system was launched in 2016, a dedicated staff of NLS based users have added thousands of patron records to generate shipping requests for a currency reader device. The basis for these requests is a paper application form. Physical forms are delivered bi-weekly to NLS for processing and data entry. Applications forms are also received electronically through an Azure based webform known as Currencyreader.gov. Upon approval of either a paper or electronic application, NLS staff will create a patron record in CRIMS so that a device may be issued. Applicant supplied metadata is also leveraged to facilitate throughput and tracking of a request to assist with customer service and inventory management.

C.2. OVERVIEW

The vision for this acquisition is to maintain CRIMS and support recent legacy upgrades that use COTS software, and continue devolving paper-based workflows from the application process, continue migrating system user operations to a fully web-based electronic workflow so as to maximize efficiencies, improve system security using a more robust MS Azure based environment, and comply with a government wide initiative to reduce hard-copy paper in the workplace.

The intent of this acquisition is to achieve several key objectives:

1) Refresh Support new CRIMS user interface (UI) to reduce reliance on custom coded legacy operations modules in the CRIMS system. Further reduce reliance on the current, paper-based workflow that involves patrons submitting their applications via US Mail.

2) Develop Maintain digital signature capability as a surrogate to the current wet signature model

3) Enhance the patron customer experience through faster and easier order processing using an end-to-end electronic workflow.

4) Reduce reliance on paper forms used to generate patron records in accordance with government direction and policy to limit the use of paper forms wherever possible

5) Reduce error rate and guesswork on the part of staff users processing hand-written paper forms.

6) Adhere to all applicable Library information security regulations, policies, and best practices

C.3. Scope The Library of Congress seeks contract support to increase electronic patron engagement and patron record security through the implementation of a secure Azure web-based user interface and associated tools and functionality to enhance application throughput for the US Currency Reader Distribution Project.

C.4. Requirements Contractor shall enhancement, and upgraded reporting features, using MS Azure to maintain CRIMS operations for secure encrypted transmission of inbound patron metadata to improve external patron engagement, customer experience, request tracking, chain of custody and workflows currently in use by the US Currency Reader Distribution Project that support individuals requesting a free currency reader device.

C.4.1. Upgraded CRIMS User Interface (UI) Web Form Contractor shall support a new, system user interface (UI) for the existing project staff and maintain operational support for the Currency Reader request supply chain so as to sustain application throughput, staff reporting capabilities ( account management, log reports, other legacy reporting) tracking capability for the requestors using Currencyreader.gov and record management capability for internal staff to verify, process and facilitate individual application requests for a currency reader device against a legacy database.

• New UI is supported using MS Azure (COTS) software as a discrete application built upon the same technology stack as the existing Currecnyreader.gov portal presently administered by project staff to support external requestors who submit digital application forms for entry into legacy CRIMS.

• New Azure UI shall leverage the Currencyreader.gov technology stack presently in use including a middle tier built with Azure serverless technology and current versions of Angular and Microsoft .Net for program workflow support currently in use by staff. User management for the new UI will be supported through the Microsoft Azure portal.

• Maintain staff capacity to receive, process and manage applicant web forms submitted through Currencyreader.gov unimpeded except for executing a pre-scheduled production cut-over.

Maintain operations for both staff and applicants to sustain a request tracking workflow for said forms that uses a unique identifier to manage successfully submitted requests. Maintain capacity to generate reports with respect to patron applicants, system users, and logs.

• Support of new UI shall permit for identification and recommendation of additional deprecations of degraded legacy system modules that either pose a security risk or are recognized as obsolete functionalities. All other legacy functionalities are to be maintained.

• New UI shall provide ongoing capability for staff to support and report on manual entry of patron metadata should automated form fail for any reason (e.g. Improperly completed forms, software bug, or unsuccessful submission attempts) and permit staff to seek remedy or escalation for help support. Prompts shall state specific field error or diagnostic statement to assist with troubleshooting a received form.

• New UI shall maintain existing workflows that permit user to agree to the terms and conditions of accessing CRIMS website/webform and includes a link to those terms and conditions.

Authentication and authorization for system users shall be upgraded to MSAzure ADB2C.

• Contractor shall deliver upgraded security logging and reporting with MS Azure Monitor.

• Contractor shall implement security event management and automated response using basic application of Microsoft Sentinel. Security management using MS Azure portal. Upgrade security report delivery and sustain relevant aspects of existing CRIMS security reports and alerts. Upgrade report scheduling software.

• Front end workflows include receipt of validated information submitted by an applicant certifier to request a free currency reader device that staff may verify against an existing patron database.

C.4.1.2 Maintain Web Form (Currencyreader.gov)

• Web form (Currencyreader.gov) shall be maintained in English and Spanish.

• Submitted web form shall generate a confirmation to the applicant upon successful submission and contain a unique identifier for tracking.

• Webform shall provide prompts for improperly completed forms or unsuccessful submission attempts back to sender for remedy or escalation for help support. Prompts shall state specific field error or diagnostic statement to assist with troubleshooting.

• Web form shall incorporate digital signature via a notice that clicking "Submit" acknowledges that the user agrees to the terms and conditions of the website/webform and includes a link to those terms and conditions.

• Digitally signed forms shall be stored by the system and include retrieval capacity for certifying history for a particular certifier.

• Web form shall validate information entered as the applicant certifier initiates the form to request a free currency reader device.

• Form to includes following required fields for successful request submission o Applicant Name o Applicant Street address, city, state and zip code, o Phone (included but not a required field) o Email address as a required field for applications submitted via the web form only for use with communication with the applicant. Certifier email may be substituted as necessary.

o Radio button(s) to select Yes/No certification of prior and/or current NLS membership to activate Certification requirements.

o Radio button for self-certification of US citizenship.

o Certifier Name o Certifier Organization o Certifying Organization Street Address, email, and phone number o Certifying Organization City, State and Zip Code o Digital Signature capability -- implemented as a notice that clicking "Submit" acknowledges that the user agrees to the terms and conditions of the website/webform, and includes a link to those terms and conditions o Radio Button for Certifier to confirm a hand-delivered transaction for a currency reader device for NLS review and validation in CRIMS.

C.4.2. Review, Validation, and Analytics

C.4.2.1 NLS Review and Validation Web form solution shall permit NLS staff or other reviewers to review all forms submitted by applicants and certifiers for batch processing for the purposes of validating if the application meets eligibility requirements. This step shall occur prior to the record being imported into CRIMS.

The review and approval workflow shall allow for the review, editing, updating, or deleting of all patron data in the application by NLS staff.

The system shall allow for the viewing by NLS staff of all pending, approved, and denied applications in a sortable, filterable, and searchable manner.

C.4.2.2. Data and Analytics Solution shall include capabilities for user to perform data analysis and reporting activities on a common web interface. This includes the ability to export all data in the system into a Comma Separated Value (CSV) file and dashboards to track metrics. The system shall maintain all applications as records and shall not delete legacy records regardless of if they were approved, denied, or no action was taken.

C.4.3. Integration with CRIMS User Experience The new MS Azure UI shall integrate with the legacy CRIMS system operations to permit users of the existing CRIMS system to edit and accrete records to the existing CRIMS patron record database based on the approved data in the application form. The update shall update the CRIMS database no less than once every 10 minutes. Average accretion rate to patron record database is approximately 200 entries per week resulting in approximately 10,000 shipments per year. New and existing patron records shall be tied to a unique patron ID in the same manner as the legacy workflows. Solution shall be compatible and interoperable with CRIMS legacy database and system architecture to maximize efficiencies at the patron record level and in the cloud including by:

• Permitting CRIMS users to manually edit, manage duplicate/multiple patron entries, issue replacement devices to legacy patron applicants.

• Maintaining legacy records and history for all device transactions.

• Maintaining Service Level Agreement and Service Availability with parity to CRIMS

• Maintain role-based reporting capability for both front end and backend CRIMS users according to least privilege.

C.4.4. Provide cloud hosting environments, operations, and cloud support Contractor shall provide OCIO-approved cloud hosting environments to support the system’s development, testing, production environments. The contractor shall also provide production disaster recovery capabilities operational in a different availability zone.

The contractor shall also provide business-hour help-desk support to authorized NLS project staff interfacing with individual applicants.

It is expected that the vendor shall provide:

• Project management for enhanced system approval, development, testing, operations, maintenance and reporting capabilities as acceptable to LC/NLS Change Control and in conformity with CRIMS SLA and software tools defined by OCIO.

• Daily harvesting of submitted applicant requests by staff for the purposes of verification and response to a valid request with a device shipment.

• Implemented functionality and integrated enhancement with existing operations to meet the objectives of the CRIMS Service Level Agreement and to continuous monitoring. The contractor shall produce documentation routinely and upon request.

• Recommendations for COTS software or custom coding as needed to mitigate system vulnerabilities using recognized standards (e.g. NIST)

• Reviewed implemented capabilities with ISSO and CRIMS stakeholders. Provide analysis on routine (weekly, 30 days, annual) basis.

• Compliance with all Library of Congress IT security policies and directives.

• Deploy and monitor added system enhancement(s)/features to the Prod/Test/DR environment(s).

• Support for NLS during user acceptance testing of UI and fillable form enhancement(s) and related system reporting functions.

• Management for system recovery to the production and disaster recovery environments to ensure successful system operation in both environments.

• Communication/correspondence with service desk(s) for parent database(s), system back-up and other 3rd party stakeholders to manage system interconnectedness.

• Proposed System Architecture Enhancements

• IT security “lessons learned” to minimize administrative burden of managing enhancements to system configuration so as to pre-screen for future state enhancements to CRIMS system and its web-based user interface. Proposed enhancements include diagrams ensuring IP level specificity actionable by change request.

• An implementation-ready timetable for associated security enhancements to CRIMS inclusive of cloud based virtual machines

• Upon request, tests for 508 Compliance and provide feedback with respect to any proposed updates, solutions or system modifications during the performance period.

C.4.5. Additional Documentation The following documentation shall be provided by the contractor:

Concept of Operations for Change Control Board Contractor shall deliver maintain performance reporting and documentation to include proposed enhancement architecture solution (Concept of Operations) to LC Change Control Board, CRIMS Information System Security Officer and authorized users prior to development.

Boundary and Architecture Diagrams Contractor provided architecture and associated deliverables shall conform to current system security requirements applicable to CRIMS. Performance and operations of deliverables shall be compliant with annual ATO security obligations. This diagram shall include Prod, Test, DR and Dev environments for CRIMS to effect implementation of web-based fillable form solution to upgrade patron applicant experience, inclusive of application submission, and tracking, of new requests for a currency reader device.

IT Security Documentation

Provide all IT Security documentation for the system as required by the Library Office of the Chief Information Officer.

C.5. SCHEDULE OF DELIVERABLES

Paragraph Reference Description of Event Due Date Provide operations and cloud support

Maintain CRIMS operations, system security under Service Level Agreement

Ongoing

Maintain fillable form enhancement in conformance with legacy system support and implement modifications described below and Section J Attachments

Help-Desk, System Security, to include ongoing version control of CRIMS documentation and Concept of Operations including diagrams, documented Use Cases and Stories.

Ongoing

Maintain all aspects of CRIMS cloud environment in Azure to ensure secure encrypted transmission of currency reader requests between stakeholders, protect data.

Weekly reporting and updates to CRIMS users using JIRA communications tool. Participate in ATO compliance meetings.

Ongoing

Support web-based workflows for authorized staff to ensure repeated access to customer data, provide routine customer service

Includes CRIMS and Azure software, reporting and support of Currencyreader.gov portal.

Qualys tools and reporting.

Ongoing

Perform legacy service, support and upgrade

Manage Version Control of SLA, suggest improvements

Ongoing

C.2 Support new Azure log-in capability for CRIMS system users. C.4.1-C.4.4

Maintain UI build using Angular to support new CRIMS UI.

Ongoing

(C.4.1-C.4.4) Maintain middle tier built with Azure serverless technology and current version of Microsoft .Net.

Ongoing

(C.4.1-C.4.4) Maintain updated authorization and authentication using Microsoft ADB2C

Ongoing

(C.4.1-C.4.4) Maintain using Microsoft Azure portal

Ongoing

(C.4.1-C.4.4) Support new security reporting to replace old security alert and reporting management screens using Azure Monitor.

Ongoing

(C.4.1-C.4.4) Maintain security event management and automated response using Microsoft Sentinel.

Ongoing

C.6. Government Furnished Property (GFP):

The Government will provide the contractor with the following:

• Network Accounts

• Access to appropriate development, testing, and production environments in accordance with IT Security and OCIO directives and procedures.

• Access to Library intranet and Network Systems as deemed necessary to fulfill the requirements.

• Access to existing system documentation and subject matter experts, as needed.

The contractor shall be responsible for providing Library-compatible workstations (as outlined in LC52.239-1 Information Security) for remote work, all reference tools, training tools, and additional supplies to its personnel, as required.

(End of Statement of Work)