eCCB Licenses and Hosting SOW.pdf

eCCB Case Act Hosting/Licensing Services

C.1 OVERVIEW

The Library of Congress (Library) requires contractor support to maintain an electronic filing and case management solution for the Copyright Claims Board (CCB). Throughout this document, the electronic system will be referred to as the eCCB.

C.2 SCOPE OF WORK

The contractor shall provide licensing and cloud hosting with maintenance and updates for the eCCB system.

C.3 REQUIREMENTS

C.3.1 Licensing The contractor shall provide all applicable application based licensing for eCCB including Accusoft, Deque, AWS Hosting and NIC Corporate Services.

C.3.2 Hosting Services The contractor shall provide the following hosting services:

C.3.2.1 Routine maintenance, bug fixes, and patches to correct programming errors, address security updates, and maintain capability and performance levels.

C.3.2.2 Support of at least four (4) technical inquiries requested per month and quarterly content updates to the eCCB system. The inquiries may increase or decrease. Support shall be provided as ad hoc telephone and/or email communication that address inquiries to cover any troubleshooting, web application error resolution, performance issue resolution, security issue resolution, and disaster recovery items. Problem resolution may coincide with the updates to the eCCB content.

C.3.2.3 Maintenance via ad hoc telephone and/or email support to include any advisory assistance. All application, system errors, issues, and bugs identified by users will be reported in accordance with the SLAs above.

C.3.2.4 Updated documents after any sort of software or architecture configuration change made by the contractor on its own or at the request of the CCB. System documentation shall include:

• Test results and analysis report.

• Updates to the Systems Administration Manual upon system completion that documents key information and Standard Operating Procedures (SOPs) necessary to maintain the system effectively.

C.3.2.5 eCCB system updates, patch required security findings, and install updates from external systems eCCB utilizes, such as Login.gov, Adaptive, and Accusoft. The contractor shall provide testing for related security patches and contractor updates.

C.3.2.6 Business Continuity and Disaster Recovery (BCDR) Requirement: The contractor shall update the IT Contingency Plan (provided in Section J) as needed per LCD 5-620 IT Business Continuity and Disaster Recover. The IT contingency plan includes the following:

• Business Impact Analysis:

o Maximum Tolerable Downtime o Recovery Point Objective o Recovery Time Objective o Special Circumstance Identification (e.g., requirements for operations outside business hours or in specific cycles)

• Data Backup:

o Application backup information o Application backup validation testing o Recovery and Reconstitution Procedures o Validation Testing

C.3.2.7 Data Transfer: The system shall include bi-directional data exchange with other Library managed systems. This data exchange shall be an interactive API, but shall also be a bulk style interface. These exchanges must be schedulable, auditable, fully instrumented and access controlled. The format of the data shall be in open standards such as JSON or XML.

C.3.2.8 Data Encryption: The system shall support an encrypted connection from the Library to the SaaS platform via Virtual Private Network, Transit Gateway or equivalent technology.

C.3.3 Maintenance and Support The contractor shall host the eCCB filing maintenance system and provide support including but not limited to the following:

C.3.3.1 Maintain and Operate the eCCB System

• Maintain operational readiness

• Address system Degradation issues

C.3.3.2 Customer Support to Internal USCO and CSD Users of The System

• Service Request

• Processes o The contractor shall provide general support and compliance with prescribed OCIO processes including but not limited to incident escalation.

• Non-Routine Tasks to include but not limited to the following tasks:

o The contractor shall support unforeseen issues i.e. Pay.gov crashes or database goes down and provide proper resolution.

o Security Incidents: Technical staff will immediately notify their designated counterparts by telephone or e-mail when a security incident(s) is detected, so the other party may take steps to determine whether its system has been compromised and to take appropriate security precautions. The Information System Business Owner (ISBO) will receive formal notification in writing within five (5) business days after detection of the incident(s).

o Disasters and Other Contingencies: Technical staff will immediately notify their designated counterparts by telephone or e-mail in the event of a disaster or other contingency that disrupts the normal operation of one or both of the connected systems.

o Material Changes to System Configuration: Planned technical changes to the system architecture will be reported to technical staff before such changes are implemented. The initiating party agrees to conduct a risk assessment based on the new system architecture and to modify and re-sign the Interconnection Security Agreement (ISA) within one (1) month of implementation per LC52.239- 2 through LC52.239-4.

o New Interconnections: The initiating party will notify the other party at least one

(1) month before it connects its IT system with any other IT system, including systems that are owned and operated by third parties.

o Personnel Changes: The parties agree to provide notification of the separation or long-term absence of their respective Information System Business Owner or technical lead. In addition, both parties will provide notification of any changes in point of contact information. Both parties also will provide notification of changes to user profiles, including users who resign or change job responsibilities.

C.3.4 Remediate Software Vulnerabilities The contractor shall remediate software vulnerabilities in accordance with the minimum response and resolution times listed in the Service Request Priority Response matrix below.

Priority Significance Response Time Resolution Time P1 Critical 15 minutes 4 hours P2 High 30 minutes 1 day P3 Standard 4 hours 5 days P4 Low 1 day 10 days P5 Routine Process 1 day 30 days P6 Non-Routine Tasks 1 day 3 months

C.3.5 Service Level Agreements Implementation of the following Service Level Agreements (SLAs) to include monthly performance and reliability data consistent with SLA measurement requirements reported to the COR no later than seven

(7) days from the end of each month. The Contractor shall meet the Excellent Quality Level for each SLA.

In the event the Contractor misses the Excellent Quality Level for a month then they shall provide the COR with a corrective action plan to address the issue. In the event the Contractor is rated as unsatisfactory for any SLA then the Contractor shall reduce the CICD monthly invoice by the weighting amount in the Monitoring Method column below.

SLA Standard Quality Level Monitoring Method

1 Availability meets agreed upon service level

Excellent:

Monthly availability is >= 99.9 %

Very Good/Satisfactory: Monthly availability is 99.6%–99.9%

Unsatisfactory:

Monthly availability is less than 99.6%

100% surveillance – 2% Weighting

2 Throughput meets or exceeds agreed upon service level

Excellent: Meet both of the following SLAs: (a) Monthly data throughput rates exceed 80% of 400 Mb / second for sustained periods longer than 5 minutes; and (b) do not exceed 50% of installed capacity for sustained periods longer than 60 minutes

Very Good/Satisfactory: Meet one of the following SLAs: (a) Monthly data throughput rates do not exceed 80% of 400 Mb / second for sustained periods longer than 5 minutes; or (b) do not exceed 50% of installed capacity for sustained periods longer than 60 minutes Unsatisfactory: Monthly data throughput rates exceed 80% of 400 Mb / second for sustained periods longer than 5 minutes, and exceed 50% of installed capacity for sustained periods longer than 60 minutes

Unsatisfactory: Monthly data throughput rates exceed 80% of 400 Mb / second for sustained periods longer than 5 minutes, and exceed 50% of installed capacity for sustained periods longer than 60 minutes

100% surveillance – 2% Weighting

3 Average download file transfer speed meets or exceeds agreed upon service level

Excellent/Very Good/Satisfactory: Monthly average download time is <= 16 seconds for 100% of all downloads synthetic transactions

Unsatisfactory: Monthly average download time is more than 16 seconds for all download synthetic transactions

Synthetic transaction on fixed interval.

Transaction will be based on download of a standard file - 2% Weighting

4 Average upload file transfer speed meets or exceeds agreed upon service level

Excellent/Very Good/Satisfactory: Monthly average download time is <= 84 seconds for 100% of all upload synthetic transactions

Unsatisfactory: Monthly average download time is more than 84 seconds for all upload synthetic transactions

Synthetic transaction on fixed interval. Transaction will be based on upload of a standard file. 2% Weighting

C.3.5.1 The contractor will address security updates and/or deficiencies to meet the ATO requirements.

C.3.5.2 The contractor will back up the data using a system that will enable the contractor or the Library of Congress to promptly and easily recover data if necessary.

C.3.5.3 As part of the Library’s continuous security monitoring program, software used by the agency is subject to routine security scanning, whether it is hosted internally or externally. These security scans may result in the identification of software security vulnerabilities that need to be mitigated within the following timeframes:

High-Priority Vulnerabilities 30 calendar days Medium-Priority Vulnerabilities 180 calendar days Low-Priority Vulnerabilities 360 calendar days

Upon notification of a security vulnerability, the contractor will correct the vulnerability within the specified timeframes, including the modification, testing, and installation of code on all Library instances of the software. The contractor will also provide documentation, such as release notes, installation guides and user guides, to document the changes made to the software to address the identified vulnerability(ies). Costs associated with addressing software security vulnerabilities are not reimbursable separately and should be included as part of the contractor’s price for provisioning the Library’s software licenses or software maintenance.

C.4 Knowledge Preservation Requirements

C.4.1 The Systems Administration Manual (Manual) documents key information and Standard Operating Procedures (SOPs) necessary to maintain the system effectively. The Manual provides the definition of the software support environment, the roles and responsibilities of the various personnel, and the regular activities essential to the support and maintenance of the system. The contractor shall update the Manual and SOPs with any application infrastructure or configuration changes within 30 days of a production system change. The Manual and SOPs shall be provided by the contractor in electronic form.

C.4.2 The contractor will back up the data and source code using a system that will enable the contractor or the eCCB to promptly and easily recover data if necessary, in accordance with the IT Contingency Plan.

C.5 Key Personnel and Contractor Staff C.5.1 Key Personnel. The following positions are considered key personnel:

Position Qualifications

Project Manager

• Extensive experience in all aspects of project management using established Project Management Institute (PMI) practices and methodologies.

• Extensive experience leading enterprise level technical projects with accountability to multiple stakeholders.

• Extensive experience in the execution of System Development Life Cycle (SDLC)

• Hold a PMI certification or equivalent experience with a minimum of five (5) years demonstrated on-the-job experience in technical project management.

• Demonstrated ability to plan, organize, and deliver projects within schedule, budget, and scope

• Demonstrated ability to lead and facilitate teams of both senior managers, technical staff, and administrative staff to achieve project outcomes

• Demonstrated experience using Microsoft Project Management, Microsoft Office tools

• Demonstrated experience writing presentations, complex briefs, decisions papers, and various technical documents

Technical Support Designee

• The technical support designee shall be ultimately responsible for management and provision of all technical support to users of the System, both at the Library and in the public.

• The technical support designee shall have superior technical knowledge and experience with the System or similar systems.

• The technical support designee may delegate support authority to other staff so long as the technical support designee remains available to answer questions and troubleshoot issues that other staff cannot resolve.

• The technical support designee shall be fluent in written and spoken English and able to “translate” computer software terminology to Standard English for users.

C.5.2 Contractor Staff. The contractor shall provide a program manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer.

The program manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The program manager or alternate shall be available between 8:00 a.m. to 5:30p.m., Monday thru Friday eastern time except Federal holidays or when the government facility is closed for administrative reasons.

Qualifications for all key personnel are listed below:

• Technical expertise and experience in maintaining similar electronic filing/case management systems.

o Experience working with courts and with governmental agencies or political subdivisions.

o Knowledge of and ability to accommodate the special security requirements of a government client.

o Exceptional oral and written communication skills to assure effective implementation of and training regarding the System.

o Exceptional “people skills” to accommodate the support needs of the CCB and other users outside the Library of Congress.

(End of the Statement of Work)