DRAFT SOW - Judiciary Personal Security Risk Reduction and VM Support.pdf

STATEMENT OF WORK (SOW)

JUDICIARY SECURITY PERSONAL RISK REDUCTION AND VULNERABILITY MANAGEMENT SUPPORT

1.0 GENERAL

1.1 BACKGROUND

Prominence of the judiciary in the news and social media sites has resulted in amplified negative public perceptions of the judiciary, increasing physical security risks to judiciary facilities, judges, and judiciary executives. Judiciary facilities have become focal points for potential acts of civil unrest, which, combined with the age of judiciary infrastructure, makes them increasingly susceptible to operational disruptions and increased security risks resulting from all-hazards incidents. Exacerbating this is the increased vulnerability of judges and employees when located outside of the physical security protections afforded by judiciary facilities and offices because of the prevalence of their personally identifiable information (PII) being made publicly accessible on the Internet. Specifically, the internet has made information such as home addresses, social security numbers, personal emails, and financial information easily available to potential threat actors, increasing the vulnerability of judges and judiciary staff to anything from physical attack to doxing and identity theft.

1.2 INTRODUCTION

The Administrative Office of the U.S. Courts (AOUSC), Department of Administrative Services (DAS), Facilities and Security Office (FSO), Judiciary Security Division (JSD) Threat Management Branch (TMB) is responsible for programmatic delivery of Judiciary Security Personal Risk Reduction and Vulnerability Management Program services and support. This is a mission critical judiciary protection and prevention initiative to safeguard judiciary people, property, and critical functions from threats, hazards, or harmful events, with program elements including: personally identifiable information (PII) Reduction and Redaction, Vulnerability Management, Geospatial Information Services, Training and Education, and Technical Services in support of the broader Judiciary and Administrative Office Security, Response, and Preparedness program delivery within the Judicial Branch.

2.0 REQUIREMENTS

The government has a requirement for a contractor with demonstrated experience to provide personnel and services necessary to perform Judiciary Security Personal Risk Reduction and Vulnerability Management Program support as outlined in this statement of work.

3.0 DEFINITIONS

All JSD-TMB legislatively and national policy definitions relevant to the delivery of services associated with this statement of work are derived from judiciary policy and guidance, public safety and security industry standards, the Daniel Anderl Judicial Security and Privacy Act of 2022, P.L. 117-263 § 5931 through § 5939;

Court Security Improvement Act of 2007, P.L. 110-177; and the National Security Presidential Directive (NSPD) 51; and include:

3.1 Vulnerability Management: Continuous monitoring process by which potential and actual judiciary physical security and emergency management programmatic weaknesses are identified, evaluated, prioritized, and mitigated.

3.2 All-Source Monitoring: Continuous collection, analysis, and correlation of judiciary relevant information from all available data sources (e.g., open-source intelligence (OSINT), geospatial data, external threat and hazard feeds, etc.) to create a comprehensive understanding of the judiciary operating environment, environmental and operational risks, and operational vulnerabilities.

3.3 All-Hazards: Risk-planning approach that considers multiple sources of potential threats or disasters (e.g., natural, technological, public health, human-initiated) rather than focusing on a single specific hazard.

3.4 Judiciary Protectee: Judiciary and non-judiciary employees and family members identified either by statute, judiciary policy and guidance, or the U.S. Marshals Service as someone who faces increased threats and requires tailored protective measures. This is also referred to as “At-Risk Individual” within the Daniel Anderl Act, and “Covered Person” and “Immediate Family” within the Court Security Improvement Act. Examples include, but are not limited to: federal judges (Article III, Magistrate, Bankruptcy, Court of Federal Claims, Court of Appeals for Veterans Claims, Court of Appeals for the Armed Forces, Tax Court, and those in senior, recalled, or retired status); spouse, parent (either by birth or in loco parentis), sibling, or child of a judge; other individuals living in the household of a judge; Court Unit Executives (i.e., Clerks of Court, Chiefs of Probation and Pretrial, Federal Defenders); jurists; and officers of the court.

3.5 Data: Raw information that is collected, stored, processed, and analyzed to generate insights into judiciary risks and vulnerabilities. Potential sources of data include government and non-government agencies, organizations, and relevant entities; data-brokers (i.e., entity that collects and sells or licenses to third parties the individual’s personal information); open-web (portions of the web publicly accessible without specialized access); deep-web (portions of the web not indexed by standard search engines, but accessible with normal browsers and credentialing); dark-web (portions of the web deliberately hidden and requiring specialized software to access); social media (online content sharing and interactive platforms); and public records (online platforms created to provide legally accessible government agency information to the public).

3.6 Personally Identifiable Information (PII): Any data that can be used to identify, contact, or locate a judiciary protectee on its own or when combined with other information. This is also referred to as “Covered Information” within the Daniel Anderl Act, and “Restricted Personal Information” within the Court Security Improvement Act. Examples include, but are not limited to, the following: home address, including primary residence or secondary residences; home or personal mobile telephone number;

personal email address; social security number; driver’s license number; bank account or credit or debit card information; identification of children of an at-risk individual under the age of 18; full date of birth;

information regarding current or future school or daycare attendance; information regarding the non-government employment location of an at-risk individual.

3.7 Intelligence: Data obtained from an agency that utilized a structured analytical process to produce actionable insights regarding public safety or security incidents or trends for use by the JSD-TMB in further evaluating AO and judiciary risks and/or impacts. Sources include, but are not limited to, national and state fusion centers; online secure networks such as the Law Enforcement Enterprise Portal (LEEP) and Regional Information Sharing Systems (RISS) portals; federal, state, and local law enforcement and public safety agencies.

3.8 Assets: AO and judiciary facility portfolio, as provided by AO-FSO-Space and Facilities Division, and employees of the AO and judiciary.

4.0 SCOPE OF WORK

The contractor shall perform the following activities:

Provide program management assistance, project management and development support, and staffing for the delivery of the five JSD-TMB program elements specified in 4.1 thru 4.6.

Assist with JSD-TMB portfolio management, providing documentation and reporting regarding current projects, strategic alignment and integration of projects to meet JSD-TMB objectives, project resourcing estimates, potential project risk and constraints, and project optimization recommendations..

Aid in coordination of project formulation and delivery across JSD-TMB and AO stakeholder groups when directed by JSD-TMB Geospatial Intelligence and Technology Section Chief or Chief, JSD-TMB.

Prepare JSD-TMB portfolio management leadership briefing products and provide support to related stakeholder and leadership meetings.

Maintain a JSD-TMB lessons learned program, establishing and maintaining a data-collection, analysis, recommendation, tracking, and reporting process focused on JSD-TMB key performance indicators, provided by the COR, within the five JSD-TMB program elements.

Assist with organizing, implementing, and tracking a JSD-TMB outreach and engagement strategy to develop and implement JSD-TMB AO, judiciary, national and local security and public safety, and data privacy data and intelligence sharing requirements and processes, and codifying sharing agreements.

4.1. VULNERABILITY MANAGEMENT SERVICES:

1. Research and analyze all-hazards (defined in 3.3) data and intelligence (defined in 3.5 and 3.7 respectively) to assess and report on AO and judiciary all-hazards risks and vulnerabilities to judiciary protectees (defined in 3.4) due to the presence of publicly accessible PII (defined in 3.6) and AO and judiciary assets (defined in 3.8).

2. Identify all data containing potentially threatening language to JSD-TMB Vulnerability Management Section Chief and the Chief, TMB, for forwarding to partner security agencies (i.e., U.S. Marshals Service, Federal Protective Service, local law enforcement and public safety agencies) as appropriate.

3. Provide intelligence, incident impact, and security and public safety reports and information products to the JSD-TMB Vulnerability Management Section Chief and the Chief, TMB for dissemination to AO and judiciary leadership and facility and security partner agencies. Products will communicate relevant judiciary risks, judiciary operational impacts, inter- and intra-agency actions, judiciary public safety and security trends, as applicable, AO and/or judiciary risk mitigation strategies.

4. Assess risks to judiciary protectees when requested to make recommendations to the PII Reduction and Redaction Section for prioritization and conducting of out-of-cycle online exposure assessments.

5. Seve as a JSD-TMB liaison officer (LNO), when requested, to partner agencies to facilitate communication, coordination, data and intelligence (as defined in 3.5 and 3.7 respectively) exchange, and operational collaboration to support shared missions or incident response.

6. Manage Administrative Office of the U.S. Courts (AOUSC) Emergency Notification System 2.0 alerting and messaging.

7. Support AOUSC NSPD 51 Continuity of Government (COG) initiatives.

4.2. PII REDUCTION AND REDACTION:

1. Implement and maintain a PII Reduction and Redaction Program judiciary protectee engagement plan to maximize awareness of and participation in the program, enroll non-participants, update participant enrollment information, and provide individualized training on personal PII risk-reduction best practices.

2. Maintain a biennial schedule of judiciary protectees for use in scheduling and conducting PII Reduction and Redaction initial enrollment, biennial engagement, and follow-up meetings with judiciary protectees, providing program information, accomplishing enrollment, educating on personal PII risk-reduction best practices, discussing overall risk to the protectee based upon types of PII publicly available, providing feedback on TMB mitigation efforts.

3. Develop judiciary protectee personalized mitigation strategies based upon PII vulnerabilities identified through Vulnerability Management Services, reference 4.1 (1). This includes developing and providing individualized reports to judiciary protectees regarding the assessment of their current online exposure and associated risk, and the mitigation strategies to be implemented by JSD-TMB towards lowering their exposure and reducing their risk and qualifying any remaining risk at the end of each individual assessment and mitigation effort.

4. Lead, facilitate, and track individual mitigation actions for judiciary protectees utilizing TMB Technology and Data Integration established services.

5. Provide redaction services to judiciary protectees based upon the individual post-research mitigation strategy utilizing various tactics (e.g., DeleteMe custom removal requests, direct engagement with data broker, site/host/content creator, direct online data manipulation, or direct engagement with public records agencies) based upon data type. Track the outcome of each redaction effort.

6. Assess and process redaction requests on behalf of at-risk individuals for potential DOJ injunctive relief. Prepare, and submit requests for Department of Justice injunctive relief support for qualified judiciary protectees to the JSD-TMB PII Reduction and Redaction Section Chief and Chief, TMB.

Assist with the submission and tracking the progress of the request following established AO processes.

7. Provide legislative and legal support for research and review of past, current, and/or proposed state data privacy legislation to judiciary protectees as they engage in state legislative processes related to development and refinement, and internally to the PII Reduction and Redaction program in tracking and interpreting legal coverages afforded by the enacted state legislation.

8. Assist with the analysis of PII Reduction and Redaction Program historic data to identify patterns and trends within judiciary data privacy discovered issues, evaluate PII Reduction and Redaction mitigation strategies, and inform the future refinement of existing program strategies or the development of new approaches.

4.3 GEOSPATIAL SERVICES:

1. Utilize ESRI IaaS and SaaS (e.g., ArcGIS Online, ArcGIS Enterprise, and ESRI Managed Cloud, licensing, etc.) to support developing and maintaining JSD-TMB geospatial services, geospatial indoors services, and web applications.

2. Identify, configure, and manage all-hazards data sources and feeds needed to support live/near-real time identification of potential incidents for use in the JSD-TMB ArcGIS environments.

3. Support the development of customized ArcGIS solutions and workflows for JSD-TMB non-standard data ingestion from sources such as emails, mass data pulls from other JSD-TMB or AO systems of record, and/or manually created data tables.

4. Develop and integrate non-ESRI field data collection and data analysis and visualization services (e.g., OutSystems, PowerBI, MS Forms, etc.) into the JSD-TMB geospatial environments.

5. Utilize, when approved by the Chief, TMB or Geospatial and Technology Services Section Chief, the Department of Homeland Security Geospatial Information Infrastructure (GII), Law Enforcement Enterprise Portal (LEEP) and other secure government portal sites to exchange judiciary and non-judiciary geospatial information.

6. Collect, organize, store, manage, analyze, and distribute data and intelligence to promote an understanding of relevant AO and judiciary geospatial relationships and all-hazards risks, to include, but not limited to, AO and judiciary assets, AO and judiciary security, and judiciary probation/pre-trial mission sets, to facilitate better informed decision making.

7. Utilize spatial analytics to determine the relationship of emergent all-hazards incidents and other AO and judiciary security and emergency management concerns to judiciary operations and assets, provide insights into potential incident impacts or increased vulnerabilities to AO and judiciary assets, and analyze past incidents and trends to provide insights into enduring systemic judiciary security program issues to support future program improvements.

8. Develop and utilize templated approaches to provide geospatial data visualizations for vulnerability management reporting products.

9. Monitor geospatial services for breaks in services, trouble shoot and remediate issues, report on related service downtimes and/or performance degradation issues.

10. Provision continued ArcGIS Enterprise service support to probation and pretrial officers to facilitate monitoring of at-risk individuals, as well as support for facility management data collection and indoor floor plan visualization.

4.4 TRAINING AND EDUCATION

1. Develop a categorized list (i.e., data privacy, geospatial services use, emergency notification services, etc.) of potential skill and knowledge items that should be considered for inclusion into a prioritized JSD-TMB training development plan.

2. Utilize accepted Instructional Design and Curriculum Development processes (e.g., define learning objectives and outcomes, design curriculum and lesson plans, develop instructional materials (slides, manuals, handouts), choose delivery methods (e-learning, classroom, blended), select or create assessments and evaluations, etc.) to construct and provide data privacy training (e.g., self-guided handouts, hybrid instructor-led, self-paced modules for judiciary protectees.

3. Coordinate, as needed and identified within the project plan, training development initiatives with AO, judiciary, federal and state law enforcement, public safety, and data privacy partners, and non-government organizations/entities.

4. Establish a review and revision cycle of all implemented training products designed to identify and incorporate curriculum changes based upon continuous assessment of learning needs and the evolution of on-going JSD-TMB programmatic implementation.

4.5 TECHNOLOGY AND DATA INTEGRATION AND SUPPORT

1. Research, implement, and maintain directly provided or third-party managed sub-vendor IaaS, SaaS, and other data and service providers necessary to support the JSD-TMB mission sets described in section 4 of this solicitation. This includes maintaining the current JSD-TMB mission critical services of ESRI ArcGIS, OnSolve, DeleteMe, and OutSystems.

2. Facilitate and support JSD-TMB service delivery, to include support to AO IT security testing and remediation processes, integration of IT security processes, and development and implementation of JSD-TMB standardized data and information security, file management, and change management processes.

3. Map JSD-TMB processes and associated data needs to develop JSD-TMB normalized master data schema and associated JSD-TMB business rules, establish data cleansing and data enrichment processes, and support the development and management of a standardized JSD-TMB data pipeline.

4. Ensure all directly provided or third-party managed sub-vendor PaaS. IaaS, and SaaS services are compliant with the Judiciary Information Security Framework (JISF), equivalent to NIST Risk Management Framework and NIST SP 800-53 Rev. 5, and provide all compliance documentation for review by the AO.

5. Support JSD-TMB related AOUSC IT system and service development and IT security evaluation and testing initiatives.

4.6 OPTIONAL: SURGE SUPPORT SERVICES

The contractor shall have the capacity and ability to provide additional personnel to provide surge support services, as needed, to cover a short-term surge event1 to accommodate temporary, increased incident support need. Requests for surge support services shall not be transferable to other actions that may be ongoing at the impactful time the bona-fide need is established.

1 Surge event is defined as a large national or regional impactful incident where additional LOE is required but not anticipated to exceed 90 days.

The COR will provide the contractor the following information at the time a bona-fide need is established:

1. Clear description of services required and applicable SOW Section

2. Applicable SOW sub-section (e.g. Section 4.1.7 – with description added).

3. Estimated surge support service level of effort (LOE).

4. Estimated period of performance need.

The Contracting Officer (CO) will memorialize a surge event with the issuance of a bilateral modification to the contract, providing additional funding for the surge event upon establishment of the bona-fide need.

5.0 TASKS

5.1 PROGRAM MANAGEMENT TASKS

The Contractor shall:

1. Assist the COR with the development of Key Performance Indicators (KPIs) to measure and track

JSD-TMB program health and progress using a value delivery approach.

2. Assist the COR with the development and implementation of JSD-TMB portfolio management processes, to include short- and long-term strategic planning and process documentation.

3. Create and maintain programmatic reporting services utilizing provided AO and JSD-TMB services

(i.e., Microsoft Project, Power BI, ESRI, etc.) to provide contract status (e.g., burn rates, remaining funding, invoicing status, deliverable status, etc.).

4. Provide program status reports, briefings, and updates to the COR and stakeholders.

5. Develop supporting JSD-TMB project plans for COR review and approval, capturing work breakdown structures, timelines, and milestones with detailed execution plans.

6. Develop and implement program wide quality assurance processes to ensure deliverable and outcome expectations are consistently met.

7. Develop and maintain JSD-TMB wide standard operating procedures to codify branch processes towards ensuring delivery of repeatable and consistent services and support.

8. Institutionalize standardized approach to the collection and documentation of JSD-TMB lessons learned, development of process improvement suggestions, and capturing of best practices across all projects within the program.

9. Develop and implement program wide risk management methodologies to identify, assess, report, and mitigate project-level risks and issues to avoid scheduling or resourcing impacts.

10. Support the development of JSD-TMB programmatic change management strategies and processes.

11. Identify reoccurring training required to maintain currency in required JSD-TMB skillsets of data privacy, law enforcement intelligence and analysis, and related technical services (e.g., ESRI ArcGIS, OnSolve, OutSystems, programming languages/coding, etc.)

5.2 VULNERABILITY MANAGEMENT SERVICES TASKS

The Contractor shall:

1. During operational hours, continuously monitor and research data and intelligence for potential risks and vulnerabilities to AO and judiciary assets, and judiciary protectees.

2. Maintain the JSD-TMB case management process used to capture incident specific activities and documentation associated with judiciary relevant all-hazards incidents, both live and historic data.

3. Provide analysis and reporting on potential and actual AO and judiciary operational impacts to assets and judiciary protectees risk and vulnerabilities based upon research findings.

4. Conduct timely and actionable all-hazards incident reporting through the production of regular and ad hoc reports that clearly communicate risk status, trends, and local mitigation actions.

5. Fulfil requests for information related to TMB Vulnerability Management data, intelligence, and analytical findings as needed.

6. Perform retrospective analysis on historical data and information to identify risk and vulnerability trends and develop forecasts of potential future incident patterns.

7. Support JSD-TMB outreach through the identification, establishment, and maintaining of public safety and security federal, state, and local agencies.

8. Continuously improve intelligence and data analysis capabilities by incorporating lessons learned from post-event reviews to refine risk identification and analysis processes.

9. Support inter- and intra-agency collaboration to facilitate data and intelligence sharing and coordinated messaging between AO departments and judiciary security partners (i.e., FPS, USMS, GSA) to develop and implement mitigation strategies for identified risks.

10. Standardize risk assessment methodologies using consistent criteria and tools (e.g., risk matrices, threat modeling, likelihood-impact scoring) to evaluate the severity, likelihood, and potential impact of identified risks.

5.3 PII REDUCTION AND REDACTION TASKS

The Contractor shall:

1. Maintain the JSD-TMB case management process used to track and measure PII exposure over time using an auditable record of individual exposure and redactions, and a risk scoring methodology to qualify changes in protectee PII exposure and associated vulnerability levels on a recurring basis.

2. Enroll judiciary protectees into the Personally Identifiable Information (PII) Reduction and Redaction program, inclusive of DeleteMe data broker removal services, AO online exposure assessment services, and any available state public record redaction services.

3. Provide personalized online exposure assessments and privacy consultations to help protectees identify specific vulnerabilities and apply protective behaviors in their digital footprint.

4. Using JSD-TMB developed services, develop, report, deliver, and track results of tailored PII mitigation strategies to judiciary protectees based upon assessments of their online PII exposure.

5. Coordinate with DeleteMe and other web-based platform providers to remove or redact PII from online sources, public records, and data broker websites.

6. Using JSD-TMB developed services to track and measure PII exposure over time, maintaining an auditable record of individual exposure and redactions, and a risk scoring methodology to qualify changes in protectee PII exposure and associated vulnerability levels on a recurring basis.

7. Develop and monitor measurable indicators (e.g., reductions in exposed PII, increased use of secure tools, responsiveness to privacy program outreach or training, etc.) to track behavior change metrics over time.

8. Provide direct support to judiciary protectees, communicating identified vulnerabilities and risks, mitigation measures, and additional data-privacy preventative measure recommendations (e.g., use of anonymous web browsing, anonymous email, IP masking, anonymous phone numbers, etc.).

9. Identify, monitor, assess, and capture applicable federal and state data privacy laws.

10. Provide support to judiciary judges and court unit executives who are engaged within their states in the development and/or modification of data privacy laws and/or statutes.

5.4 GEOSPATIAL SERVICE TASKS:

The Contractor shall:

1. Define and standardize spatial risk metrics and thresholds and develop a consistent framework for quantifying spatial risks (e.g., crime rates, natural disaster zones, proximity to critical infrastructure, geopolitical instability, etc.) using validated data sources.

2. Consolidate spatial risk data from multiple sources (e.g., government databases, threat intelligence, satellite imagery, GIS platforms) into a centralized ArcGIS platform to support development of data visualizations, spatial analysis, and decision support services.

3. Map judiciary assets against spatial risk layers to visualize organizational assets, personnel locations, and operations overlaid with judiciary relevant risks and exposure patterns.

4. Provide ArcGIS geospatial services (i.e., dashboards, storyboards, web apps, etc.) to produce visualizations and analysis of intelligence and information for briefings and reports to relevant stakeholders (e.g., executive leadership, field teams, policy makers) to support timely and informed all-hazards incident decision-making.

5. Establish and maintain data collection and data clean-up processes necessary to support the generation of geospatial products and services.

5.5 TRAINING AND EDUCATION TASKS:

The Contractor shall:

1. Create training products that address common personal data privacy threats (e.g., phishing, oversharing on social media, insecure devices, etc.) and provide clear, easy-to-follow methods (e.g., mobile settings, password management, app privacy reviews) to encourage immediate application of best practices.

2. Develop and monitor measurable indicators (e.g., reductions in exposed PII, increased use of secure tools, responsiveness to privacy program outreach or training, etc.) to track behavior change metrics over time.

3. Manage JSD-TMB learning management system, to track learner enrollment, progress, and completion rates, and host e-learning training modules.

4. Establish customer feedback and other evaluative mechanisms for training products to identify potential areas of product improvement and/or revisions.

5.6 TECHNOLOGY AND DATA INTEGRATION TASKS

The Contractor shall:

1. Construct a comprehensive JSD-TMB workflow model that includes all JSD-TMB PaaS, IaaS, and

SaaS services in use, and categorizes them by risk, function, and criticality.

2. Create and maintain a representative JSD-TMB systems architecture, inclusive of IaaS, SaaS, PaaS service environments, configurations, and data flows.

3. Build or adopt scalable integration layers to securely connect PaaS, IaaS, and SaaS environments, enabling data flow, system interoperability, and secure communication between services.

4. Manage commercial infrastructure, platform, and software services that provide need based analytical and data visualization services to stakeholders in support of JSD-TMB program delivery.

5. Develop, implement, and maintain extract, transform, load/extract, load transform (ETL/ELT) solutions to facilitate automated data sharing between JDS-TMB Branch Chief approved and identified systems and services.

6. Assist JSD-TMB Chief in drafting formalized data sharing agreements between cooperating inter-and intra-agency partners. Track and report on submitted requests.

7. Maintain JSD-TMB Vulnerability Management and PII Reduction and Redaction case management related services.

8. Create and maintain custom services when requested by Chief, TMB. Customized services needing to be maintained currently include a multi-platform (e.g., google, bing, etc.) query based open-web search service, and a searchable State and local PII research library.

9. Utilize data science principals to provide recommendations and support for the development of data collection strategies, statistical models, and related domain knowledge to extract insights, patterns, and knowledge from data and intelligence, and build predictive or analytical models.

10. Create, maintain, and troubleshoot custom coding solutions in support of JSD-TMB services.

6.0 DELIVERABLES

Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

Section(s) Deliverable Description Due Date

4.5 (1) Licensing (ESRI ArcGIS) DeleteMe, OnSolve, and OutSystems)

ESRI ArcGIS: geospatial software

DeleteMe: coverage provisions for 3700 seats and platform fees

Onsolve: 44,675 users; premier support;

text to keyword functionality for messages both 250 and 50 words in length

OutSystems: coverage provisions for 65 seats and associated platform fees

Immediately upon award

4.5 (1) Licensing (OSINT services)

OSINT: coverage for up to 15 analysts use, to include OSINT search tools/services, secure/masked internet browsing, and secure/safe file download and review capabilities.

Immediately upon award

5.0 (3) Project/Program Management Tracking Services

Tool(s) or service(s) to track current and legacy JSD-TMB projects, information inclusive of project goal, resources and budgets allocated for the project, identification of project risks, and project metrics for use in reporting on project performance.

3 months after award

5.6 (5) PII Case Management

Tool(s) or service(s) to track JSD-TMB PII Reduction and Redaction protectee program enrollment and supporting tasks.

This will include a unique identifier for the protectee, and all related PII research and mitigation assigned tasks, and any special

3 months after award requests received from the protectee or on their behalf from an authorized individual or agency.

5.6 (5) Vulnerability Management Case Management

Tool(s) or service(s) to track JSD-TMB Vulnerability Management program related actual or potential incidents and risks to the AO and judiciary, to include unique incident ID, incident categorization and sub-categorization, geographic location or boundary information, impacted AO and/or court unit facilities, and coordinating agency(ies) incident specific information.

3 months after award

5.6 (5) Data Sharing Agreement Template

Template capturing elements of information needed to facilitate codifying of formal data sharing of geo-spatial and non-geospatial information between the AO and a federal/state/local agency.

3 months after award

5.6 (5) Data Sharing Agreement Tracking

Standardized approach to tracking agency outreach, data sharing discussions, key agency partners, and progress to a full data sharing agreement.

3 months after award

5.1 (2) JSD-TMB Strategic Plan/Process Map

Codifies the 5-year outlook for integration of all JSD-TMB program (i.e., PII Reduction and Redaction, Vulnerability Analysis and Reporting, Geospatial and non-Geospatial Intelligence and Information, Training, and geospatial and non-geospatial technologies) activities, and the pathway into the larger JSD, FSO, AO, and judiciary program integration and support.

6 months after

5.6 (2) JSD-TMB System and Services Architecture

Design of JSD-TMB supporting systems and services focused on software and hardware, and protocols and access methods used in the entire system, and inclusive of all data flow/mapping.

8 months after award

5.5 (1) Training Product Format Templates

Standardized templates for creation of lesson plans, supporting presentations and handouts, and/or online presentation media standards for use in developing JSD- TMB educational products related to PII and Vulnerability Management Programs.

8 months after award

4.4 (1) Staff Training Plan

Identification of reoccurring industry standard training related to data privacy, OSINT, law enforcement intelligence, or geospatial services necessary to ensure JSD-TMB program evolves as industry best practices and changes occur. This will also identify methodology to track scheduled training and training completion.

8 months after

7.0 TRAVEL

Travel within the national capital region (NCR) during the performance of this contract is required to attend meetings and conferences. The contractor may be required to travel to off-site locations and to ship presentation aids to these locations in support of this SOW.

Authorized travel expenses shall be submitted in accordance with the substantive provisions outlined in the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires written government approval/authorization and notification from the COR.

4.0 Marketing Templates

Standardized templates for use in the creation of one-pagers, marketing presentations, or online media content related to JSD-TMB services.

8 months after award

5.6 (1) JSD-TMB Technology Strategy

Draft plan for JSD-TMB outlining alignment of technology to JSD-TMB business processes and goals, to include strategies for assessing and adopting new technologies when appropriate as services continue to evolve.

8 months after award

5.1 (2) Annual Implementation Plan

Review of annual service delivery;

recommendations for program refinements, new services, or applications clearly tied to lessons learned or industry best practices; and suggested changes to long-term strategic planning document.

2 months prior to end of PoP

5.1 (7) Standard Operating Procedures

Documentation of JSD-TMB workflows for day-to-day and emergent operations, internal and external communication mechanisms, file plans, and required information sharing to support each workflow. This will also include process maps related to each of the JSD-TMB daily and emergent operation, to include process functionality, any necessary data and information sharing, and the use of developed services, tools, and applications in support of the process.

30 days prior to end of PoP

STATEMENT OF WORK (SOW)