eDiscovery PWS.pdf

US Department of Agriculture (USDA)

Office of the General Counsel eDiscovery Litigation Support and Service

Performance Work Statement

United States Department of Agriculture e-Discovery Litigation Support and Service Draft Performance Work Statement

November 22, 2024 eDiscovery PWS Page 2

1 PERFORMANCE WORK STATEMENT (PWS)

1.1 Task Order Administration Data

1.1.1 Executive Summary

1.1.2 Description of Services/Introduction

1.1.3 Background

1.1.4 Objectives

1.1.5 SaaS Scope

1.1.6 Period of Performance

1.1.7 Quality Control

1.1.8 Quality Assurance

1.1.9 Recognized Holidays

1.1.10 Hours of Operation

1.1.11 Place of Performance

1.1.12 Type of Contract

1.1.13 Security Requirements

1.1.14 Physical Security

1.1.15 Post Award Conference/Periodic Progress Meetings

1.1.16 Contracting Officer Representative (COR)

1.1.17 Identification of Contractor Employees

1.1.18 Contractor Travel

1.1.19 Data Rights

1.1.20 Phase In /Phase Out Period

1.1.21 Applicable Documents

1.1.22 Government Furnished Property, Equipment, And Services

1.1.22.1 Services

1.1.22.2 Facilities

1.1.22.3 Utilities

November 22, 2024 eDiscovery PWS Page 3

1.1.22.4 Equipment

1.2 PWS SaaS Platform Requirements

1.2.1 SaaS Platform

1.2.2 Security

1.2.3 Data Ingestion and Processing

1.2.4 Data Analysis and Review

1.2.5 Redaction

1.2.6 Production Out

1.2.7 Other Requirements

1.2.8 Contractor Furnished Items and Responsibilities

1.3 PWS SaaS Services Requirements

1.3.1 Sub-Task 1 - Kickoff Meeting

1.3.2 Sub-Task 2 - Project Management Support

1.3.3 Sub-Task 3 - Contract Status Reports

1.3.4 Sub-Task 4 - Discovery

1.3.5 Sub-Task 5 - Implementation

1.3.6 Sub-Task 6 – Complete Privacy Impact Assessment (PIA) and Authority to Operate (ATO) - Risk Management Framework (RMF Steps)

1.3.7 Sub-Task 7 – Cloud Migration

1.3.8 Sub-Task 8 - Data Migration

1.3.9 Sub-Task 9 - Help Desk Support

1.3.10 Sub-Task 10 - Operations and Maintenance (Platform/SaaS Updates, 508 Compliance, Continuous Monitoring)

1.3.11 Sub-Task 11 - System/Data Integration

1.3.12 Sub-Task 12—Operating eDiscovery Program SharePoint Site, Tracking System, and Power BI Dashboards

1.3.13 Sub-Task 13 - Transition to Support

1.4 Minimum Corporate Capabilities and Key Personnel

November 22, 2024 eDiscovery PWS Page 4

1.4.1 Key Personnel

1.4.2 Minimum Corporate Capabilities

1.4.3 Testimony as a Fact Witness or Subject Matter Expert

2 Appendix A: FISMA Contract Language (IT Systems / Applications or Services) . 41 3 Appendix B: FedRAMP Standard Contract Language

3.1 Compliance Section

3.2 FedRAMP Information Technology Systems Security Requirements:

3.3 Additional Text for cloud services implemented or acquired before operation of FedRAMP:

3.4 FedRAMP Privacy Requirements:

3.5 Sensitive Information Storage

3.6 Protection of Information

3.7 Security Classification

3.8 Confidentiality and Nondisclosure

3.9 Disclosure of Information

3.10 Security Requirements Section

3.10.1 FedRAMP Security Requirements Overview:

3.10.2 FedRAMP Security Compliance Requirements:

3.10.3 Required FedRAMP Policies and Regulations:

3.10.4 Assessment and Authorization

3.11 Assessment of the System

3.11.1 Authorization of System

3.11.2 Reporting and Continuous Monitoring

3.11.3 Additional Stipulations

3.12 References

4 Appendix C: Section 508 Clauses 5 Appendix D: Cybersecurity Operational Cloud Requirements 6 Appendix E: Definitions and Acronyms

6.1.1 Contractor

November 22, 2024 eDiscovery PWS Page 5

6.1.2 Contracting Officer

6.1.3 Contracting Officer's Representative (COR)

6.1.4 Defective Service

6.1.5 Deliverable

6.1.6 Key Personnel

6.1.7 Physical Security

6.1.8 Quality Assurance

6.1.9 Quality Assurance Surveillance Plan (QASP)

6.1.10 Quality Control

6.1.11 Subcontractor

6.1.12 Work Day

6.1.13 Work Week

6.1.14 Acronyms

November 22, 2024 eDiscovery PWS Page 6

1 PERFORMANCE WORK STATEMENT (PWS)

1.1 Task Order Administration Data

The United States Department of Agriculture (USDA, Agency, Department or Government), Office of the General Counsel (OGC) (collectively, USDA-OGC) provides legal services and legal oversight required by the Secretary of Agriculture and USDA to achieve the Department’s mission and deliver programs and services to the American people. USDA-OGC serves as the law office of USDA and provides legal services to officials at all levels of USDA, as well as technical support to members of Congress concerning the programs and activities carried out by USDA.

USDA-OGC determines legal policy and directs the performance of all legal work conducted for

USDA.

As part of its mission, USDA-OGC oversees the Department’s eDiscovery program that provides the Department’s 29 unique agencies, components, and staff offices with legal support and technology solutions to support the preservation, collection, processing, review, and production of electronically stored information (ESI) in administrative and judicial litigation, investigations, responses to requests made under the Freedom of Information Act (FOIA), and responses to oversight requests from Congress, the General Accounting Office (GAO), Office of Management and Budget (OMB), etc.

1.1.1 Executive Summary

The USDA-OGC is seeking a firm-fixed price agreement for a FedRAMP Moderate, Software-as-a- Solution (SaaS) eDiscovery vendor-hosted cloud-based platform that runs on an approved Government cloud instance. The platform shall be capable of eDiscovery processing, including forensic collections, early case assessment, review, analysis, and production to meet the agency’s needs for general-litigation and associated support services. This solution will allow USDA to effectively handle the Electronically Stored Information (ESI) generated by the below business processes and following the Electronic Discovery Reference Model (“EDRM”) process.

The e-discovery platform must be capable of integration with existing e-discovery and litigation tools, must be capable of reviewing ESI in a wide variety of formats (including chat communications, such as Slack, iMessage, SMS, and Teams), and must be able to facilitate collection of documents from MSOffice 365, FEITH, and related repositories.

Currently, USDA-OGC uses a vendor-hosted, on-premises version of Relativity Government, and other USDA agencies have licenses to utilize SaaS instances of CasePoint. USDA has a requirement to transition from these solutions to a single cloud-based solution to ensure continuity of operations: both for migration of existing workspaces and data and in terms of training by USDA personnel. Collections and preservation hold requests are currently fulfilled by the USDA Office of the Chief Information Officer (OCIO) utilizing Microsoft Purview eDiscovery Premium. While USDA-OGC anticipates that its collection and preservation process for M365

November 22, 2024 eDiscovery PWS Page 7 data will not change in the short term, it requires a system with collection capabilities should the Department determine that direct collection utilizing the eDiscovery tool is in its interest.

1.1.2 Description of Services/Introduction

The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and non-personal services necessary to provide the capabilities to USDA- OGC needed for collecting, preserving, processing, assessing, reviewing, analyzing, and producing ESI as defined in this Performance Work Statement.

1.1.3 Background

USDA is involved in many document requests, both as an originator and a respondent. These requests occur in the context of litigation, oversight, investigations and FOIA requests. A typical response to any of these requests can involve a range of data sizes, from hundreds of megabytes to terabytes of unstructured data and thousands to millions of native files that must be reviewed, analyzed, and eventually produced for the requester. A typical incoming production can also involve hundreds of megabytes to terabytes of unstructured data produced either as load files or native files that must be reviewed and analyzed. The legal staff assigned to this work can be as small as a single attorney to over a dozen individuals, all concurrently accessing the same dataset.

It is also expected that utilizing a contractor will provide much greater flexibility in terms of meeting evolving needs and integration with external parties such as the United States Department of Justice (DOJ).

1.1.4 Objectives

The SaaS objectives are as follows:

• A FedRAMP Moderate Platform SaaS.

• Vendor-hosted cloud-based instance running on Microsoft’s Azure Government cloud or a comparable government approved cloud platform.

• Provide 24/7 access to data in active review with a method acceptable to USDA-OGC.

• Ability to restore data in cold storage to active review within 5 business days.

• Provide tools to collect, preserve, process, ingest, and produce data in a wide variety of data formats including, but not limited to: Adobe files, AppleDouble, CAD files, Compressed files, Container files, Database files, Outlook Email, EnCase, Excel, Google Workspace, Hangul, HTML, iCalendar, Image Files, Lotus, JungUm Global, OneNote, OpenOffice, PowerPoint, Publisher, Project, Short message, Slack, Text, Vector, Visio, Word, and WordPerfect.

• Provide tools to index and conduct keyword searches on collected ESI based on parameters provided by users.

November 22, 2024 eDiscovery PWS Page 8

• Provide tools to analyze and review data utilizing advanced technologies and conduct redaction, tagging, and production of data.

• Provide tools and resources to transfer existing workspaces hosted by Deloitte on its Relativity Server to the new SaaS platform, as well as existing workspaces hosted in CasePoint instances.

• Provide integration between USDA systems, including third party systems such as MSOffice 365 (including Outlook, SharePoint, Teams, OneDrive, etc.), FEITH, and others that may import directly into the e-discovery/ESI review system.

• Provide mobile tools usable in the Android & IOS environments.

• Provide support services as requested by USDA-OGC, including processing preservation and collection requests in existing USDA platforms, processing/ingestion, end-user training, and consulting and technical support related to the e-discovery/ESI review process. These services would also include advising on advanced and complex use of tools, applications, or processes.

1.1.5 SaaS Scope

• Hosted storage capacity minimum (anticipated these numbers will grow significantly year over year):

o Review 15TB (60%) o Cold Storage 7.5TB (30%) o Staging 2.5TB (10%)

• Capacity for 50 concurrent end-users in the SaaS with the ability to scale.

• Accommodate any data generated for electronic discovery, litigation, oversight, FOIA response, and other needs.

• Collect, process, ingest, and support analysis of said ESI in alignment with the EDRM process.

• Provide end-users within USDA with the necessary tools to analyze said ESI utilizing an array of Technology-Assisted-Review or other analytical tools to produce data out in accordance with the agency’s requirements.

• Provide support services (e.g., processing/loading, help desk, training, workflow analysis, etc.) to assist USDA users with its use of tools.

• Provide sufficient access rights so that USDA components with sufficient personnel can perform processing/loading functions directly.

• Provide and maintain documentation to support USDA’s use of contractor’s tools, including but not limited to process manuals and user guides.

1.1.6 Period of Performance

The period of performance shall be for one twelve-month base period and four twelve-month option periods, commencing on the date of award.

November 22, 2024 eDiscovery PWS Page 9

1.1.7 Quality Control

The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

The contractor’s quality control program is the means by which it assures its work complies with the requirements of the contract. At a minimum, the contractor shall develop quality control procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary.” The Quality Control Plan (QCP) shall be submitted within 30 calendar days after contract award to the Contracting Officer’s Representative (COR) and within 5 business days when changes are made thereafter. The COR will provide acceptance of the QCP.

1.1.8 Quality Assurance

The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards identified in Technical Exhibit 2. The QASP defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.1.9 Recognized Holidays

The platform and tools provided by (the) contractor are expected to be available on all state and federal holidays, including the following:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Juneteenth

1.1.10 Hours of Operation

• USDA-OGC anticipates availability of the platform and tools to be 7 days a week, 24 hours a day with level of service of at least 99.9% availability.

• Data in active review should be available 7 days a week, 24 hours a day with level of service of at least 99.9% availability. Data in cold storage should be returned to active review, upon request, within 5 business days.

• Help Desk availability: 6 AM to 10 PM Eastern on weekdays. Help desk will be reachable via telephone, email, and web form.

• After hours technical support available on as-needed basis.

November 22, 2024 eDiscovery PWS Page 10

1.1.11 Place of Performance

The work to be performed under this contract will be performed at the contractor’s facilities.

1.1.12 Type of Contract

The government anticipates a firm fixed price order, based on the storage and other commitments above.

1.1.13 Security Requirements

Contractor personnel performing work under this contract must be cleared for staff-like access per applicable USDA guidance.

All facilities and systems must be FedRAMP Moderate authorized and in compliance with all applicable USDA standards as established by USDA OCIO. See 5.1.2 below for additional discussion on security.

For the initial and ongoing efforts supporting the selected application/system the Contractor/Sub-Contractor] will be required to provide ongoing agency system technical information and inform threat awareness to USDA to support security requirements in accordance with Risk Management Framework (RMF), Federal Information Security Management Act (FISMA), and 508 Compliance. The vendor will also be required to provide technical information supporting security control documentation supporting continuous monitoring efforts and support agency IT system Authorization to Operate (ATO) documentation/artifacts submissions.

1.1.14 Physical Security

The contractor shall be responsible for safeguarding all government equipment, information, and property provided for contractor use.

1.1.15 Post Award Conference/Periodic Progress Meetings

The contractor agrees to attend any post-award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5.

As appropriate, the COR and other government personnel may meet periodically with the contractor to review the contractor's performance. At these meetings, the Contracting Officer’s Representative will apprise the contractor of how the agency views the contractor's performance, and the contractor will apprise the agency of problems, if any, that are experienced. Appropriate action shall be taken to resolve the issues that are outstanding. These meetings shall be at no additional cost to the agency.

November 22, 2024 eDiscovery PWS Page 11

The contractor also agrees to attend bi-weekly status meetings to discuss activity under the contract along with issues/concerns. The contractor shall provide the agenda and any needed slides for the bi-weekly meetings.

1.1.16 Contracting Officer Representative (COR)

The COR will be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract;

perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.1.17 Identification of Contractor Employees

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.1.18 Contractor Travel

No travel is anticipated or will be funded.

1.1.19 Data Rights

USDA has unlimited rights to all documents/material produced under this contract. All data stored, ingested, or otherwise provided to contractor from USDA remain the exclusive property of the agency and the contractor shall permit and assist with removal or transfer of data to agency or third parties on demand as directed by agency. See section 1.1.13. All documents, data and materials produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. The Government shall always have full rights of access to all documents, data and materials, which shall be made available to the Government on demand at no additional cost to the Government. These documents, data and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All documents, data and materials supplied to the Government shall be the sole property of the Government

November 22, 2024 eDiscovery PWS Page 12 and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.1.20 Phase In /Phase Out Period

To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the contract will encompass a phase in and phase out period. For the phase in period, the Contractor shall have personnel on board during a phase in period of 28 business days from the start of the contract to when end-users will begin to use the process and tools, referred to as the “go-live date”. The phase in period may be extended by mutual agreement between the Contractor and Government. During the phase in period, the Contractor shall become familiar with performance requirements, produce a tailored process manual and a user guide. In addition, the Contractor will begin to receive and process data from the Government so that users can immediately begin review of data on the go-live date. During the phase out period of 60 business days, the Contractor will provide all necessary assistance and support (including the use of any external media) to move data from Contractor’s systems per the agency’s determination and will verify at end of phase out that all data has been removed and destroyed from Contractor’s systems. During the phase out period, the Contractor will coordinate with any successor contractor as necessary and directed by the Government.

1.1.21 Applicable Documents

• Executive Order (E.O.) 10450;

• National Institute of Standards and Technology (NIST), Special Publication (SP) 800-53, Revision 5, “Security and Privacy Controls for Information Systems and Organizations”;

• NIST, SP 800-53B, Control Baselines for Information Systems and Organizations;

• NIST, SP 800-37, Revision 2, “Risk Management Framework (RMF) for Information

Systems and Organizations”;

• NIST, SP 800-39, “Managing Information Security Risk: Organization, Mission, and

Information System View”;

• OMB Circular A-130, “Managing Information as a Strategic Resource”;

• Federal Information Security Modernization Act of 2014 (FISMA), 44 U.S.C. §§3351, et seq.;

• Titles 5 and 44 of the U.S. Code;

• All applicable USDA Departmental Regulations and Manuals including but not limited to:

o USDA DM 3180-001, “Information Technology Standards Procedures,” July 29, 2019;

o USDA DR 3180-001, “Information Technology Standards Procedures,” Jan. 5, 2021;

o USDA DR 3185-001, “Enterprise Architecture,” April 19, 2022;

o USDA DR 3185-002, “Enterprise Architecture IT Asset Definitions,” Sept. 22, 2020;

o USDA DR 3185-003, “Enterprise Architecture IT Asset Data Element Requirements,”

Feb. 23, 2021;

November 22, 2024 eDiscovery PWS Page 13 o USDA DR 3505-003, “Access Control for Information and Information Systems,” July 17, 2019;

o USDA DR 3505-005, “Cyber Security Incident Management,” Nov. 30, 2018;

o USDA DM 3505-005, “Cybersecurity Incident Management Procedures,” Nov. 30, 2018;

o USDA DM 3510-000, “USDA Information Technology (IT) Restricted Space, Aug. 19, 2004;

o USDA DM 3510-001, “Physical Security Standards for Information Technology (IT)

Restricted Space,” Aug. 19, 2004;

o USDA DR 3515-001, “Use of Web Measurement and Customization Technologies,”

Oct. 21, 2011;

o USDA DR 3515-002, “Privacy Policy and Compliance for Personally Identifiable

Information (PII),” Oct. 30, 2020;

o USDA DR 3520-002, “Configuration Management,” July 17, 2019;

o USDA DR 3530-007, “Encryption Security and Public Key Infrastructure,” Aug. 5, 2024;

o USDA DR 3540-003, “Security Assessment and Authorization,” Aug. 12, 2014;

o USDA DR 3545-003, “Suitability Requirements Permitting Personnel Access to

Information Systems,” Sept. 16, 2021;

o USDA DR 3575-002, “System and Information Integrity,” Aug. 16, 2018;

o USDA DR 3575-003, “Information Systems Log Retention Requirements,” July 7, 2022;

o DR 3575-004, “Information Technology Security Baselines and Security Control

Tailoring,” Nov. 21, 2023);

o DR 3580-004, “Securing Remote Access to USDA Information Systems and Client

Devices,” Nov. 30, 2018;

o USDA DR 3650-001, “Cloud Computing” (May 24, 2023).

1.1.22 Government Furnished Property, Equipment, And Services

1.1.22.1 Services

The Government will provide a COR to serve as liaison with contractor.

1.1.22.2 Facilities

Not applicable.

1.1.22.3 Utilities

Not applicable

1.1.22.4 Equipment

USDA will provide no other equipment beyond what is required for end-users in the regular performance of their duties. No special equipment or accommodations will be made to satisfy any element of this performance work statement.

November 22, 2024 eDiscovery PWS Page 14

1.1.22.5 Materials

USDA does not expect to produce any additional materials.

1.2 PWS SaaS Platform Requirements

1.2.1 SaaS Platform

The SaaS must meet the following requirements:

a. Must be able to host 25 TB of Electronically Stored Information (ESI) available for agency review upon initial service phase-in. Contractor must provide scalable storage to seamlessly accommodate growth in data volume in follow on year(s) of contract.

b. Primary platform review tool must support up to 50 concurrent users in first year of contract with minimal reduction in performance in comparison to a single user.

i. Contractor must have capability to support additional concurrent users beyond 50 on the platform with minimal reduction in performance.

ii. Contractor must have ability to report on user management.

c. Must have reporting capability and maintain full audit trail of reviewer and administrator activity including user- and administrator-retrievable individual user search and result histories.

d. Contractor must maintain an issue log of any issues with collecting or producing any requested ESI including identifying the issue (i.e., corrupted file, password protected file, etc.) and coordinate with the Government to resolve the issue if possible.

e. Contractor system must be robust enough to accommodate 300 concurrent users with minimal reduction in performance. Network elements under the control of the contractor should be robust enough to accommodate additional users with minimal reduction in performance.

f. Must provide a means of accessing the system for end-users that is in compliance with Homeland Security Presidential Directive 12 (HSPD - 12) using the Personal Identity Verification (PIV) credentials or equivalent thereof.

g. Must be able to verify that all end-users are accessing system from USDA network or USDA furnished-equipment.

h. Must have all hardware (virtual and physical) dedicated to platform deployed in facilities physically located within the continental United States (CONUS). All data stored, processed, analyzed, etc. within the system must be stored on servers located within CONUS.

i. Must be robust enough to ingest minimum of 500 GB of data per day (higher rate preferred) and scalable to seamlessly store increasing data volume.

j. Must be able to support an individual case comprised of more than 10 TB of data.

k. Must comply with standards outlined in USDA DR 3180-001 and 3650-001.

https://www.usda.gov/directives/dr-3180-001 https://www.usda.gov/directives/dr-3650-001

November 22, 2024 eDiscovery PWS Page 15

l. Must be authorized as FedRAMP Moderate and FISMA compliant at the time of proposal submission. See Appendix A for FISMA language and Appendix B for FedRAMP Contractual language and Appendix D for USDA Cybersecurity Operational Cloud requirements.

m. FedRAMP Moderate should be for a Software as a Service model.

n. Must be able to achieve compliance with USDA externally-hosted computing standards as set by the Office of the Chief Information Officer and other Security Officers.

o. Solution must be compliant with Section 508 of the Rehabilitation Act, 29 U.S.C.

794d, as amended in 1998. Contractor must provide evidence of Section 508 compliance to the Government.

1.2.2 Security

The platform and tool(s) provided by contractor:

a. Must comply with USDA DRs 3180-001 and 3650-001 standards.

b. Must be authorized as FedRAMP Moderate and Federal Information Security

Modernization Act of 2014 compliant at the time of proposal submission. See Appendix A for FISMA language and Appendix B for FedRAMP Contractual language.

c. FedRAMP Moderate should be for a Software as a Service model

d. Must be able to achieve compliance with USDA externally-hosted computing standards as set by USDA OCIO. See Appendix C and D for further information.

e. Must have access controls for users at the case, item and field level with the tool(s) supplied by contractor for processing, review, production, etc. Tool(s) must have the ability to customize access permissions or apply a standardized template.

f. Must allow USDA’s technical and application support personnel sufficient level of access to perform remote processing, ingestion, production and export.

1.2.3 Data Ingestion and Processing

The tool(s) used for data ingestion and processing:

a. Must be robust enough to ingest minimum of 500 GB of data per day (higher rate preferred) and scalable to seamlessly store increasing data volume.

b. Must be able to index and process 1TB of data daily with scalability to higher processing amount based on needs of the USDA.

c. Must have the ability to ingest and process American National Standards Institute (ANSI) and Unicode (all common variants) character sets.

d. Must support foreign language detection, including ability to identify primary and secondary languages in documents, ability to filter or categorize collection by language.

e. Must be able to process and ingest:

https://www.usda.gov/directives/dr-3180-001 https://www.usda.gov/directives/dr-3650-001

November 22, 2024 eDiscovery PWS Page 16

i. all types of unstructured native-format text-based data commonly found in a Federal agency business environment including but not limited to the following file types: Adobe files, AppleDouble, CAD files, Compressed files, Container files, Database files, Outlook Email, EnCase, Excel, Google Workspace, Hangul, HTML, iCalendar, Image Files, Lotus, JungUm Global, OneNote, OpenOffice, PowerPoint, Publisher, Project, Short message, Slack, Text, Vector, Visio, Word, and WordPerfect

ii. load files created in accordance with all USDA and DOJ specifications such as, comma-delimited, EDRM XML, and Concordance load files.

f. Must provide ingestion error reporting/correction.

g. Must provide processing error reporting and remediation capabilities.

h. Must be able to pre-process loaded collections, including deNIST, flatten, decrypt

Secure/Multipurpose Internet Mail Extensions (S/MIME) encrypted files (customer-supplied certificates), extract text and metadata, perform Optical Character Recognition (OCR), and create image versions (e.g., TIFF, PDF, JPEG formats) of native-format and other image format files.

i. Must offer deduplication and near-deduplication, with customizable deduplication parameters (e.g., minimum similarity %).

j. Must have ability to incrementally deduplicate when additional documents are added to the collection.

k. Must maintain original metadata related all requested ESI during all data ingestion and processing

l. Must maintain parent/child association and document family identification and grouping during all analytic processes.

m. Collection requests to be completed within 5-14 calendar days of receipt of the request.

n. Must have the ability to create and maintain processing templates.

o. Ability to allow end-users to directly upload ESI to the system for processing

p. Must coordinate with OCIO to ensure all USDA IT policies and procedures are followed during the ingestion process.

1.2.4 Data Analysis and Review

The tool(s) used for data analysis and review:

a. Must have the ability to analyze all types of unstructured native-format text-based data commonly found in a Federal agency business environment (with particular emphasis on Microsoft Office and related formats, including Exchange, SharePoint and Lync).

b. Must maintain original metadata related all requested ESI during all data review processes.

November 22, 2024 eDiscovery PWS Page 17

c. Must maintain parent/child association and document family identification and grouping during all review processes.

d. Must give users the ability to choose a broad spectrum of analytic techniques to efficiently review and analyze collections.

e. Must competently handle all common search and Technology-Assisted Review (TAR) techniques including:

i. Predictive coding functionality with Continuous Active Learning (CAL) algorithm with validation reporting; also with user-created training sets.

ii. Algorithm-based document concept clustering capability (with user-specified generality/coherence levels); cluster visualization; ability to specify a user-selected training set in document indexing and categorization; ability to add documents to an existing clustering or indexing/categorization scheme.

iii. Data visualization capability.

f. Must have an advanced search and tagging/coding capability suite available including:

i. Complex Boolean operator string searching, wildcards, stemming, and proximity searching based in keywords provided by users.

ii. Ability to search by Regular Expression (RegEx) character string format rather than keyword (e.g., search for SSNs, telephone #s, or email address formats).

iii. Ability to search data between two or more identified custodians.

iv. Fuzzy search, dictionary search, concept search (keyword-independent), keyword expansion search, “find similar” search (e.g., utilizing algorithmic/statistical similarities such as latent semantic indexing).

v. Ability to save and recall searches; search result reporting, including number and document location of search term hits; ability to group search reports by custodian or other defined categories.

vi. Ability to conduct multiple searches on the same data set based on refined keywords or other user requirements.

vii. Ability for users to create a variety of saved searches within review functionality.

viii. Ability to specify custom tagging or coding templates by case or reviewer type.

ix. Ability to apply rule- or keyword-based persistent highlighting throughout entire collection or a subset thereof. Ability to jump to next highlighted (or responsive) term in document or in collection.

x. Culling requests will be completed within 5-10 calendar days of receipt of the request.

xi. Multiple filtering by metadata fields and user-generated tagging/coding.

November 22, 2024 eDiscovery PWS Page 18

xii. Batch or bulk document tagging/coding capability.

1. Ability to propagate decisions to other documents based on varying criteria including families and near duplicate similarity.

xiii. Ability to create customized fields, choices, and coding panels.

xiv. Ability to create a privilege log based on user-generated tagging/coding.

g. Must have full email threading (including ability to leverage header metadata and normalize for differing server timestamps); ability to identify, group and analyze divergent branches from a parent thread; ability to analyze emails added to the collection against existing thread groups; thread visualization.

h. Must have short message processing capabilities including the ability to display conversations and individual messages sent using SMS, iMessage, Skype, Slack, Bloomberg, and other instant message services.

i. Must have the ability to search and review ANSI and Unicode (all common variants) character sets.

j. Must be able to associate, view and conduct full array of search and analysis functions on translations produced with foreign language original documents, either by file association or placement of translation in additional extracted text metadata field.

k. Must be able to batch or folder review sets and assign review batches by user.

i. Must not have a limit on number of batches, folders or review sets that can be created.

l. Must be able to display any loaded version of a document, including image

(TIFF/PDF/JPEG), native format, extracted text, production version.

m. Must have a broad portfolio of viewer-supported document filetypes, and ability to create images-on-the-fly or bulk convert loaded native documents (e.g., if native application is unavailable on user’s computer).

n. Must be capable of rendering for review all embedded content (e.g., images, links), and content available in alternate displays such as tracked changes, comments, and speakers’ notes.

o. Must have the ability to zoom in/out on view of displayed document image, including full-page view.

p. Must allow end-users to export image (e.g., PDF) of an individual document while viewing it.

q. Must give end-users the ability to re-unitize a document image into multiple documents (i.e., redefine where documents begin and end).

r. If the tool has generative artificial intelligence (Gen AI) functionalities, the tool must allow for the functionality to be deactivated at an administrator level to ensure that usage fully corresponds with USDA’s policies regarding the use of Gen

AI.

November 22, 2024 eDiscovery PWS Page 19

s. Must provide technical assistance to users as requested during review phase to provide an overview of review tool functionality including providing a 30 minute “Kick Off” call as requested with case teams conducting an ESI review.

1.2.5 Redaction

The tool(s) used to redact:

a. Must have robust redaction capability, including the ability to run rules-based redaction jobs, and at minimum enable:

i. user-definable multiple redactions.

ii. defined character string recognition-based redactions (including searching and redacting using Regular Expressions (RegEx)).

iii. ability to identify and suggest additional redactions based on previous user-specified redactions.

iv. inverse redactions.

v. multiple full-page redaction capability.

vi. ability to insert and customize text boxes within redactions.

vii. ability to customize or configure appearance of redactions.

viii. ability for other users to review and edit (transparent) redactions prior to burn-in.

ix. reporting capability to list redactions and associated text box content by document and page number (to assist with privilege log and Vaughn Index creation).

x. redaction capability for native or near-native Excel spreadsheets, while preserving formulas and other spreadsheet functionality:

xi. the above capabilities can be native to tool(s) or via an add-on enhancement tool that operates within the user interface environment.

b. Compatibility with DOJ redaction tool:

i. at minimum permitting transfer of work product between client and DOJ prior to redaction burn-in (i.e., transfer of ESI containing editable transparent redactions).

ii. this capability can be native to tool(s) or via an add-on enhancement tool that operates within the user interface environment.

c. Must be capable of rendering for redaction all embedded content (e.g., images, links), and content available in alternate displays such as tracked changes, comments, and speakers’ notes.

1.2.6 Production Out

a. Must have the ability to produce load files created in accordance with all USDA and DOJ load file specifications for comma-delimited, EDRM XML, and Concordance load files.

November 22, 2024 eDiscovery PWS Page 20

b. Must be able to produce partial or full native format productions.

c. File names for native format productions must be preserved from the original native file ingested into the system.

d. Files produced in the native format must not be modified from the original.

e. Files produced in non-native format must be:

i. TIFF (300 DPI resolution minimum), JPEG, image-only PDF, or text-searchable PDF as determined by end-users.

ii. Black and white, grayscale, or color as determined by end-users and within the limits of the technology.

iii. Producible out of the same dataset with either redactions burned in or with no redactions as required by end-users.

iv. Document control numbered or otherwise alphanumerically identified, and ability to:

1. track numbers/character strings already used with in a case to ensure all pages are uniquely identified.

2. suggest to the end-user the next incremental number or character string when beginning a new production within the same case.

3. Able to accept and display header/footer information as determined by end-users.

f. Must be able to produce any subset of relevant data (metadata or tags/coding) associated with the documents or files in a user-specified format, (e.g., end-user-specified Vaughn index or privilege log formats).

i. End-users must be able to configure what fields to include in index, log or load file. User configurations should be saved and re-usable with in a case and across multiple cases.

g. Must have the ability to produce load files with limited redaction codes implemented (i.e., specify that only redactions with certain redaction codes be burned-in for production);

h. Must have the ability to allow users to configure the appearance of redactions.

i. Must have the ability to provide a production report for each Government requested ESI production including production data counts by keyword or other user-generated parameter(s) and identify any issues producing any requested ESI.

1.2.7 Other Requirements

The contractor must be able to support other requirements as follows:

a. Tool(s) must be Americans with Disabilities Act section 508 compliant. See Attachment 2, 508 Instructions.

b. Provide external media to ship data to USDA personnel or third parties as specified by end-user.

November 22, 2024 eDiscovery PWS Page 21

i. Data must be encrypted and shipped to the specifications as detailed by USDA. A minimum of FIPS 140-2 validated encryption shall be applied to all data stored on external media.

c. Receive and utilize data on external media shipped from the USDA or third parties to load to system.

i. Data must be encrypted and shipped to the specifications detailed by the USDA OCIO. A minimum of FIPS 140-2 validated encryption shall be applied to all data stored on external media.

d. Collect ESI directly from online repositories and content providers.

e. Produce ESI directly to online repositories. Maintain sufficient licenses on

Box.com to facilitate large downloads and uploads.

f. Browser-based, browser-agnostic user interface.

g. Support for multiple browser windows/screens (e.g., viewer image on one screen, user workspace on another).

h. User interface functionality customizable (a) by case, and (b) by reviewer status

(with multiple interfaces available for different types of users in a single case or across cases).

i. All tools supplied by contractor must be able to report usage, data processing, error identification and activities as specified by USDA personnel.

j. Permit customized scripting produced by USDA or by the Contractor.

k. Ability to handle deposition or transcripts, including:

i. Boolean searching and search result highlighting/tagging/reporting.

ii. Transcript redaction capability.

iii. Linking transcripts to exhibits or other documents in the collection.

iv. Creating word indices/concordances.

l. Ability to export or link specified documents, transcripts and excerpted text from documents or transcripts to external sites such as Westlaw/Lexis Nexis and Microsoft OneNote.

m. Agency technical personnel must be able to remotely manage processing and administrative functions in the tool, as well as have the option to utilize contractor personnel to do so at the agency’s discretion.

n. Agency works closely with DOJ, and regularly transfers reviewed collections, including work product (e.g., coding, tagging, filtering, redactions), to and from DOJ. Ability to transfer review collections, including all work product, directly to and from contractor-hosted platform to DOJ litigation review tool (currently Relativity, Relativity One, and/or Everlaw), without necessity of exporting as load files and re-ingesting/processing load files.

o. Ability to handle incoming and produce outgoing electronic productions utilizing physical removable media (e.g., DVD or hard drive) in a manner that is fully compliant with USDA requirements for media protection.

November 22, 2024 eDiscovery PWS Page 22

p. Produce documentation to support USDA’s use of contractor’s capabilities

i. Process Manuals: these documents will provide specific instructions on all processes needed to utilize the capabilities provided by contractor.

ii. User Guides: these documents will be distributed to all end users and will serve as guide for end-users.

q. Support by contributing information and documentation for security and integration processes as required by USDA-OCIO to incorporate capabilities into enterprise architecture.

r. Must have ability to support high volume bulk data transfers to and from the USDA to the contractor’s systems directly in a manner approved by USDA OCIO.

s. Ability to save exported ESI directly (or through end-user’s browser interface) on network storage established in USDA’s environment and allow saving of individual or batches of documents at the end-user’s discretion.

In addition to the above, the tool(s) used by or capabilities provided by contractor should have the following characteristics:

u. Tool(s) should have an existing or planned functionality able to accomplish the following tasks:

i. Handle EDRM collection phase for unstructured native files from any USDA location.

1. Same tool(s) should be implementable in a hybrid solution consisting of both a USDA-managed on-premises solution (for collection and initial processing of USDA-hosted ESI) and a vendor-managed/hosted environment (for processing/review/analysis/production).

2. Integrate with agency’s current collection and processing tools in either hybrid on-premises/hosted or full hosted environments.

v. Ability to add other integrated third-party or SW developer enhancement modules to base tool(s) at request of agency. Desired future add-on functionality, in addition to collection feature noted above, includes:

ii. Integrated module(s) that allow end-user attorneys to manage legal holds within tool in hybrid on-premises/hosted solution (with on-premises portion capable of implementing legal holds by technical tagging of custodian-based ESI in USDA-hosted Active Directory environment).

iii. Either natively or through an integrated add-on module, must have the ability to support processing, indexing, automated transcription, and searching of audio files.

iv. Either natively or through an integrated add-on module, must have functionality that supports processing and review of other non-text file

November 22, 2024 eDiscovery PWS Page 23 types (e.g., video, graphics/images); processing and review of messaging platform content; processing and review of mobile device ESI (e.g., from Cellebrite collection); processing and review of web or social media ESI analysis.

w. Ability to import and export ESI and work product from one or more commercially-available specialized FOIA review and administration/reporting platforms (bidder should list all such platforms with which the tool(s) can interoperate. Note that USDA currently utilizes FOIAXpress).

1.2.8 Contractor Furnished Items and Responsibilities

1.2.8.1 General

The Contractor shall furnish all supplies, equipment, facilities, and services required to perform work under this contract that are not listed under Part 3 of this PWS.

1.2.8.2 Materials

The Contractor shall supply the materials it deems necessary to satisfy the terms of this PWS.

1.2.8.3 Equipment

The Contractor shall supply what equipment it deems necessary to satisfy the terms of this PWS.

Performance Requirements Summary The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

PERFORMANCE REQUIREMENT SUMMARY (PRS) – E-DISCOVERY LITIGATION SUPPORT

Required Service Performance Standard Acceptable

Quality Level (Minimum Acceptable Standard)

(MAS)

Method of Surveillance

Incentive/ Disincentive

Sample Size

Frequency

Data Capacity (start up)

Contractor must have 25 TBs of data ready for agency use at end of phase-in period. If agency has supplied less than 5 TBs then contractor must have 100% of data agency

100% 100 Percent Inspection

Impacts Contractor Performance Assessment Rating

1 Once

November 22, 2024 eDiscovery PWS Page 24 provided ready for agency use.

Data Capacity (periodic)

Contractor must be able to expand capacity beyond the initial 25 TB to accommodate anticipated growth of data volume.

100% Periodic Surveillance

Impacts Contractor Performance Assessment Rating

1 Quarterly

Availability Expected availability of system. The system and all user-accessible tools deployed in the system are expected to be available for users 24 hours a day, seven days a week.

Any outage or failure of tools caused by elements outside of vendor’s responsibility will not be included.

99.9% up

Periodic Surveillance

Prorated discount to monthly invoice per day of outage

1 Monthly

System performance for users

The system will provide comparable performance for multiple users as it does for single user.

The contractor will propose the details of the activities based on the capabilities of their tools.

Response times for certain activities will be within 95% of baseline

Random Sampling

Impacts Contractor Performance Assessment Rating

1 Bi-weekly

ESI Collection Requests

Upon request, the vendor will perform ESI collections using USDA’s existing systems. Vendor will provide a data summary for each request total data collection result count, total data count by data source, total data count by custodian, applicable date range, and any data that was unable to be collected.

Collection requests to be completed within 5-14 calendar days of receipt of the request.

Periodic Surveillance

Impacts Contractor Performance Assessment Rating

1 Weekly

ESI Collection- Culling

Upon request, vendor will assist with culling search results using keywords, search conditions, metadata fields, etc. to cull ESI to be ingested into review platform. Vendor will provide requestors

Culling requests will be completed within 5-10 calendar days of receipt of the request.

Periodic Surveillance

Impacts Contractor Performance Assessment

1 Weekly

November 22, 2024 eDiscovery PWS Page 25 with keyword search summaries to include total keyword search result count, total culled data count by data source, total culled data count by custodian, applicable date range, and any keyword(s) that did not return any results.

Processing and Review- kick off meetings

The vendor will provide a 30 minute “kick off” call each review team to provide an overview of the technical features available within the review platform and to answer any questions.

Kick-off call will be conducted within 2 business days of creation of work space.

Periodic Surveillance

Impacts Contractor Performance Assessment Rating

1 Monthly

Processing and Review-review documentation and support

The vendor will assist USDA users with advanced search support and folder designation within the review platform, production of search…