Draft Statement of Work (SOW) _ 01.2025.pdf

Taxonomy Server Operations and Maintenance (O&M) RFI-0001 Draft Statement of Work (SOW)

Version_01.2025

1 | P a g e

I. Background

GAO is an independent agency that functions as the investigative arm of the United States Congress. As part of its investigatory function and at the request of the US Congress, GAO analyzes and evaluates executive branch agency programs.

As part of its publishing process, GAO assigns both high-level topics and more specific taxonomy terms to GAO reports and testimonies. GAO also foresees creating additional taxonomies to categorize legal products, multimedia, and internal documents and digital assets, among other collections.

The Center for Library Science (CLS) and Applied Research and Methods (ARM) / Government Accountability Office (GAO) are/is the business owner(s) of GAO’s Taxonomy Program. The Center for Library Science requires support for its implementation of PoolParty, a commercial off-the-shelf (COTS) taxonomy system. This requirement includes the need for the migration of the current implementation from a vendor’s Azure cloud environment to GAO’s Azure cloud infrastructure, and then on-going support and maintenance. There is also a need to provide support for integrating PoolParty with GAO’s implementation of SharePoint. Last, there is a need for periodic, on-demand support for technical support in using PoolParty’s user interface, API tools, and related technical functionalities.

The following is a profile of the GAO’s current taxonomy environment:

• GAO is moving from a legacy, on-premise solution to a cloud implementation.

• This process involves fully placing PoolParty into Authority to Operate (ATO)-approved development, staging, and production environments. These cloud environments are external to the agency.

A new GAO Product Taxonomy has been imported and further developed in PoolParty, and awaits full deployment and integration. This taxonomy and additional taxonomies will be integrated into other GAO systems

II. Objective

Provide migration, SharePoint integration, operations, and maintenance support to GAO’s implementation of Graphwise’s PoolParty, as well as on-demand, specialized technical consult, to aid GAO’s Taxonomy Program in the implementation and management of proper taxonomies and semantic data across the GAO landscape. GAO anticipates a successful vendor with the needed services can be found in the commercial marketplace.

2 | P a g e

III. Required System Components and General Functions

The Vendor shall migrate all existing PoolParty platform, services, data, and implementations within its current external cloud environments to GAO-hosted cloud infrastructure.

IV. Requirements for Specific Tasks and Components

a. Transition to New Implementation

As GAO migrates from its current taxonomy server implementation, the vendor shall provide the following to facilitate the transition:

• The name and contact information for a dedicated point of contact for customer service and technical issues (Technical POC) within 2 business days of signing the contract. The Technical POC shall provide a non-automated response within 1 business day after being contacted with an issue during the first 3 months of the contract or until the migration is successfully completed.

• Written system documentation, describing all functions of all modules included in the software as configured for GAO.

• Training to the GAO taxonomy team that will cover all aspects of the system.

b. System Architecture and Security

The system shall maintain the security requirements listed below:

• Adherence to records requirements, as detailed by GAO Privacy Program Order, 0450.1, GAO Records Management Program Order 0410.1 and GAO’s Records Retention Schedules;

• Adherence to all components running at a 98.5 percent uptime (down no more than 10 hours, 57 minutes and 26 seconds monthly);

• Maintain secured use of Web-based interfaces for all administrative functions;

and

• No local installation of software on GAO machines; and

• At minimum, a FIPS 199 Moderate impact Federal Risk and Authorization

Management Program (FedRAMP) certified Software-as-a-Service (SaaS) or Platform-as-a-Service (PaaS) solution with a current security assessment report (SAR) that includes a recommendation to authorize/re-authorize the system. If not FedRAMP-certified, the system shall be in compliance and in alignment with the National Institute of Standards and Technology (NIST) standardized security assessment, authorization, and continuous monitoring standards and guidelines.

• Provide security and privacy that are consistent with the NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing.”.

3 | P a g e

• Support the establishment of a virtual private network between GAO and the FedRAMP-certified system.

• Authenticate users through single sign on (SSO) using Active Directory Federation Services (ADFS) or through an agreed upon multi-factor authentication mechanism.

The vendor shall do the following regarding security requirements:

• Agree that all information entered into the system by GAO is owned by GAO in perpetuity, and that GAO retains the right to export, import, alter, and back-up data while using the software;

• Ensure that GAO has an opportunity to review the FedRAMP or NIST artifacts, to include the vendor’s current IT security white papers/documentation, that support the solution’s overall security posture, to include its infrastructure, platform, and software components, at the time of the award. The IT security documentation should include information such as access controls, authentication, boundary protection, change management, customer segregation, encrypted data transmission capabilities, log management, restricting website access, security monitoring, among other security capabilities.

• Provide access to GAO, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. GAO reserves the right to conduct on-site inspections. The vendor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

• Provide an automated mechanism to collect log files (including syslogs, Apache logs, etc.) for security and other analysis purposes and ensure that the automated mechanism allows GAO to periodically review the logs.

• Maintain an incident/breach notification process during migration that will ensure that GAO is notified within an agreed upon timeframe consistent with federal government guidance.

• Maintain all of GAO’s data, to include backup data, within the continental United States. The staff managing the data and/or systems maintaining GAO data shall be employed within and working from a system that is within the continental United States and should be United States citizens or current permanent residents.

• Implement a catastrophic/disaster failover capability to ensure that the high availability requirement of the system is achieved. The failover site shall be geographically disparate from the primary production location such that loss of the primary production location or functionality does not prohibit the use of the system. The failover site must be in the continental United States.

4 | P a g e

• Deploy strong end-to-end application layer cryptographic mechanisms that are compliant with the current Federal Information Processing Standards Security Requirements for Cryptographic Modules, level 2, at a minimum. The mechanism shall protect customer PINs, user passwords and other sensitive data in the network and data at rest.

• Encrypt customer account and transaction data which is transmitted, transported, delivered or couriered to external parties or other locations, taking into account all intermediate junctures and transit points from source to destination.

• Require all employees who will have access to GAO data, the architecture that supports GAO data, or any physical or logical devices/code to pass the appropriate background investigation required by the Government in compliance with HSPD -12.

• Provide access to GAO, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. GAO reserves the right to conduct on-site inspections. The vendor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

• Ensure that its environment remains compliant with the control standards of Federal Information Security Modernization Act of 2014 (FISMA), the current NIST standards in FIPS 140-2 or 140-3, FIPS 199, FIPS 200, FIPS 201 and current NIST Special Publications 800-37, 800-53, 800-60, 800-61, 800-70, 800-144, and 800-163. In addition, the Vendor must provide GAO with any documentation it requires for its security-related reporting requirements within 10 days of a request.

c. Support and Maintenance

The vendor shall provide live customer support (through telephone or real-time chat) every business day from 8:00 AM to 6:00 PM ET. This will entail intake of content errors and basic technical support issues. A ticketing process is required for tracking reported issues through the entire problem life cycle.

The vendor shall provide all updates to the system without further costs to the agency.

The vendor shall provide advance notice of two business days of any updates that shall require an interruption of service.

d. Implementation and Migration Services

The vendor shall provide support, for migrating, and transitioning, between the previous vendor’s PoolParty implementation and hosting and the new vendor’s data structures and processes. This support includes developing, testing and documenting

5 | P a g e of APIs or other data delivery structures for intake into GAO’s systems and developing, testing and documenting of workflow for inputting data into GAO systems.

The timeline for implementation shall be three (3) months from the date of the contract effective date.

V. Security

All technical interaction with GAO infrastructure shall be through Federal RAMP certified systems and software and/or systems compliant with ISO Standard 27001.

Physical Security:

The vendor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

VI. Period of Performance (Pop)

a. Total Contract PoP: August 1, 2025 – July 31, 2030

i. Base Period: August 1, 2025 – July 31, 2026

ii. Option Period I: August 1, 2026 – July 31 – 2027

iii. Option Period II: August 1, 2027 – July 31, 2028

iv. Option Period III: August 1, 2028 – July 31, 2029

v. Option Period IV: August 1, 2029 – July 31, 2030