Exhibit_1_SOW_RFQ_1333BJ21Q00280093.pdf

RFQ 1333BJ21Q00280093

Exhibit 1 SOW

STATEMENT OF WORK

KUDO for Web Conferencing SaaS

1. Background

KUDO for Web Conferencing Software as a Service (SaaS) provides a cloud based full relay real-time language interpretation Collaboration Software as a Service. USPTO staff piloted KUDO in 2021 and were successful using the service to collaborate with external customers who speak a language other than English.

KUDO for Web Conferencing SaaS was designed from the ground up to support virtual simultaneous audio interpretation to enable participants to choose their language of choice to receive real-time interpretation of the other participants’ speech.

KUDO for Web Conferencing SaaS facilitates collaboration across multiple languages and provides:

• Drop-down selection of pre-set languages

• Automatic floor language feed-through

• Support for up to 32 languages per meeting

• Smooth and quiet audio channel switch

• support for any language

• Full language relay capabilities

• Accommodates on-site or off-site interpreters

• Interpreter-only document sharing

• All meetings recorded in every language

In addition to audio languages, KUDO also provides a convenient way for the hearing impaired participants to fully participate by providing options to select country specific sign language sets. After selection, a window pops up on the screen with the half-body image of a professional sign language interpreter in action.

KUDO provides for screen sharing features including capability to:

• Show slides from any computer

• Show a thumbnail of the speaker at all times

• Show any document format

• Run product demonstrations as presenter speaks

• Share a browser window or a video

KUDO provides a Push-to-talk mic button on desktop or mobile device for participants to ask questions.

KUDO provides Document Sharing and enables participates to upload documents during meetings and enables exclusive document sharing for interpreters.

2. Objective

To procure a FedRAMP Ready KUDO for Web Conferencing SaaS to provide a cloud-based solution for over-the-web meetings and video conferencing in multiple languages.

3. Scope

Provide KUDO for Web Conferencing (SaaS) and technical support (telephone, email, and web), and training for the period of coverage below.

4. Requirements / Deliverables

The Contractor shall provide the following:

Model Description Unit QTY

Base Year KUDO-OD20

100 HOURS prepaid usage of KUDO for up to 100 attendees, unlimited languages, full web/mobile support, document sharing, polling/voting, Q&A and screen-sharing.

Months 12

OY1 KUDO-OD20

100 HOURS prepaid usage of KUDO for up to 100 attendees, unlimited languages, full web/mobile support, document sharing, polling/voting, Q&A and screen-sharing.

Months 12

OY2 KUDO-OD20

100 HOURS prepaid usage of KUDO for up to 100 attendees, unlimited languages, full web/mobile support, document sharing, polling/voting, Q&A and screen-sharing.

Months 12

OY3 KUDO-OD20

100 HOURS prepaid usage of KUDO for up to 100 attendees, unlimited languages, full web/mobile support, document sharing, polling/voting, Q&A and screen-sharing.

Months 12

OY4 KUDO-OD20

100 HOURS prepaid usage of KUDO for up to 100 attendees, unlimited languages, full web/mobile support, document sharing, polling/voting, Q&A and screen-sharing.

Months 12

5. Period of Performance

This period of performance includes:

Base Period: Date of award through 12 months.

Option Year 1: 13 to 24 months from date of award.

Option Year 2: 25 to 36 months from date of award.

Option Year 3: 37 to 48 months from date of award.

Option Year 4: 49 to 60 months from date of award.

Security and FedRAMP Requirements

1. The contractor shall implement the minimum security controls contained within the FedRAMP Cloud Computing Security Requirements Baseline, FedRAMP Continuous Monitoring Requirements and any additional cloud service security capabilities.

2. The CSP shall create and maintain the FedRAMP System Security Plan (SSP) and applicable FedRAMP required appendices.

3. The CSP shall submit latest vulnerability and compliance scan results.

4. The CSP shall complete and submit documentation of implementation of minimum security capabilities.

5. The CSP provided solution must be assessed by an accredited independent third-party assessment organization (3PAO) to perform an initial and annual assessments whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

6. The contractor is responsible for mitigating all security risks found during the A&A and continuous monitoring activities.

7. The contractor shall identify all data centers that data backup will reside. All data centers must be guaranteed to reside within the United States.

8. The system implementation shall comply with FIPS 140-2 encryption standard that provides for origin authentication, data integrity, and signer non-repudiation.

9. As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104, if the system involves the design, development, or operation of a system of records on individuals, the contractor shall implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.”

10. The contractor shall cooperate in good faith in defining non-disclosure agreements that other third parties must sign when acting as the Federal government’s agent.

11. The contractor is responsible for mitigating all security risks found during A&A and continuous monitoring activities. Vulnerability remediation shall occur within the remediation timeframe(s) specified in the USPTO Vulnerability Management Policy. The Government will determine the risk rating of vulnerabilities.

12. Updated POA&Ms; Any updated authorization package documentation as required by the annual attestation/assessment/review or as requested by the System Owner or AO; and

13. Any configuration changes to the system and/or system components or CSP’s cloud environment, which may impact USPTO security posture. Changes to the configuration of the system, its components, or environment that may impact the security posture of the system under this contract must be approved by the agency.

14. The contractor shall follow secure coding best practice requirements, as directed by the United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP) that will limit system software vulnerability exploits.

15. The contractor shall ensure IT applications designed and developed for end users (including mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges.

16. Plan and perform the security aspects of configuration management. The contractor shall ensure that computer software developed on behalf of USPTO or tailored from an open-source product, is fully functional and operates correctly on systems configured in accordance with government policy and federal configuration standards. The contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the USPTO environment. No sensitive data shall be used during software testing.

17. The contractor shall protect information that is deemed sensitive from unauthorized disclosure to persons, organizations or subcontractors who do not have a need to know the information. Information which, either alone or when compared with other reasonably available information, is deemed sensitive or proprietary by USPTO shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all subcontractors that are performing under this contract.

Privacy or Security Safeguards (Aug 1996)

52.239-1 Privacy or Security Safeguards https://www.acquisition.gov/content/52239-1-privacy-or-security-safeguards i The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government.

ii To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

iii If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

(End of clause)

Sensitive Information Storage

Sensitive But Unclassified (SBU) information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following USPTO Media Sanitization Policy and NIST Special Publication 800-88, Guidelines for Media Sanitization.

The disposition of all data will be at the written direction of the COR, this may include documents returned to Government control; destroyed; or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the

COR.

Protection of Information

The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as sensitive information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor’s infrastructure, as well as maintains the right to request full copies of these at any time.

The data that is processed and stored by the various applications within the network infrastructure contains financial data as well as personally identifiable information (PII). This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure.

The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

In accordance with FAR Part 52-239-1, the Contractor shall not publish or disclose in any manner, without the Contracting Officer's written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. All requests for release must be submitted in writing to the COR/CO.

Data Availability

The data must be available to the Government upon request within one business day or within the timeframe negotiated with the Contractor, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

Data Release

Contractor will not disclose Customer Data to any government or third party or access or use Customer Data; except in each case as necessary to maintain the SaaS solution or to provide the SaaS solution to Customer in accordance with this contract, or as necessary to comply with the law or a valid and binding order of a governmental or regulatory body (such as a subpoena or court order). Unless it would be in violation of a court order or other legal requirement, Contractor will give Government reasonable notice of any such legal requirement or order, to allow Government to seek a protective order or other appropriate remedy.

Privacy Act Requirements

FAR 52.224-2 - Privacy Act (APR 1984) - If performance of this contract has been determined to involve the design, development, or operation of a system of records on individuals, the contractor must comply with the Privacy Act of 1974, and complete all DOC and USPTO Privacy Impact Assessment requirements as requested by the contracting officer representative. For contracts subject to the Privacy Act of 1974, the contractor shall support a system of records in accordance with any Privacy Impact Assessments (PIAs) required and generated by any Privacy Threshold Analyses (PTAs), and any applicable System or Record Notices (SORNs), in conjunction with the judgment of the Senior Agency Official for Privacy (SAOP), and NARA-approved records schedule(s) and protection requirements for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a).

PTO 24:

In accordance with CAR 1352.239-72 Security Requirements for Information Technology resources.

Security Requirements for Information Technology Resources (APR 2010)

(a) Applicability. This clause is applicable to all contracts that require contractor electronic access to Department of Commerce sensitive non-national security or national security information contained in systems, or administrative control of systems by a contractor that process or store information that directly supports the mission of the Agency.

(b) Definitions. For purposes of this clause, the term “Sensitive” is defined by the guidance set forth in the Computer Security Act of 1987 (Pub. L. 100-235), including the following definition of the term:

(1) Sensitive information is “…any information, the loss, misuse, or unauthorized access to, or modification of which could adversely affect the national interest or the, conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (The Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.”

(2) For purposes of this clause, the term “National Security” is defined by the guidance set forth in:

(i) The DOC IT Security Program Policy and Minimum Implementation Standards, Section 4.3.

(ii) The DOC Security Manual, Chapter 18.

(iii) Executive Order 12958, as amended, Classified National Security Information. Classified or national security information is information that has been specifically authorized to be protected from unauthorized disclosure in the interest of national defense or foreign policy under an Executive Order or Act of Congress.

(3) Information technology resources include, but are not limited to, hardware, application software, system software, and information (data). Information technology services include, but are not limited to, the management, operation (including input, processing, transmission, and output), maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

(c) The contractor shall be responsible for implementing sufficient Information Technology security, to reasonably prevent the compromise of DOC IT resources for all of the contractor's systems that are interconnected with a DOC network or DOC systems that are operated by the contractor.

(d) All contractor personnel performing under this contract and contractor equipment used to process or store DOC data, or to connect to DOC networks, must comply with the requirements contained in the DOC Information Technology Management Handbook (see DOC, Office of the Chief Information Officer Web site), or equivalent/more specific agency or operating unit counsel guidance as specified immediately hereafter [insert agency or operating unit counsel specific guidance, if applicable].

(e) Contractor personnel requiring a user account for access to systems operated by the contractor for DOC or interconnected to a DOC network to perform contract services shall be screened at an appropriate level in accordance with Commerce Acquisition Manual 1337.70, Security Processing Requirements for Service Contracts.

(f) Within 5 days after contract award, the contractor shall certify in writing to the COR that its employees, in performance of the contract, have completed initial IT security orientation training in DOC IT Security policies, procedures, computer ethics, and best practices, in accordance with DOC IT Security Program Policy, chapter 15, section 15.3. The COR will inform the contractor of any other available DOC training resources. Annually thereafter the contractor shall certify in writing to the COR that its employees, in performance of the contract, have completed annual refresher training as required by section 15.4 of the DOC IT Security Program Policy.

(g) Within 5 days of contract award, the contractor shall provide the COR with signed acknowledgement of the provisions as contained in Commerce Acquisition Regulation (CAR), 1352.209-72, Restrictions Against Disclosures.

(h) The contractor shall afford DOC, including the Office of Inspector General, access to the contractor's and subcontractor's facilities, installations, operations, documentation, databases, and personnel used in performance of the contract. Access shall be provided to the extent required to carry out a program of IT inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DOC data or to the function of computer systems operated on behalf of DOC, and to preserve evidence of computer crime.

(i) For all contractor-owned systems for which performance of the contract requires interconnection with a DOC network on which DOC data will be stored or processed, the contractor shall provide, implement, and maintain a System Accreditation Package in accordance with the DOC IT Security Program Policy. Specifically, the contractor shall:

(1) Within 14 days after contract award, submit for DOC approval a System Certification Work Plan, including project management information (at a minimum the tasks, resources, and milestones) for the certification effort, in accordance with DOC IT Security Program Policy and [Insert agency or operating unit counsel specific guidance, if applicable]. The Certification Work Plan, approved by the COR, in consultation with the DOC IT Security Officer, or Agency/operating unit counsel IT Security Manager/Officer, shall be incorporated as part of the contract and used by the COR to monitor performance of certification activities by the contractor of the system that will process DOC data or connect to DOC networks. Failure to submit and receive approval of the Certification Work Plan may result in termination of the contract.

(2) Upon approval, follow the work plan schedule to complete system certification activities in accordance with DOC IT Security Program Policy Section 6.2, and provide the COR with the completed System Security Plan and Certification Documentation Package portions of the System Accreditation Package for approval and system accreditation by an appointed DOC official.

(3) Upon receipt of the Security Assessment Report and Authorizing Official's written accreditation decision from the COR, maintain the approved level of system security as documented in the Security Accreditation Package, and assist the COR in annual assessments of control effectiveness in accordance with DOC IT Security Program Policy, Section 6.3.1.1.

(j) The contractor shall incorporate this clause in all subcontracts that meet the conditions in paragraph (a) of this clause.

End of Clause

Governing Provisions and Clauses Incorporated By Reference

The following clauses and provisions apply to this contract and are inserted by reference:

1. FAR 52.204-21 - Basic Safeguarding of Covered Contractor Information Systems (JUN 2016)

2. FAR 52.204-23 - Prohibition on Contracting for Hardware, Software and Services Developed or Provided by Kaspersky Lab… (JUL 2018).

3. FAR 52.204-24 - Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (OCT 2020).

4. FAR 52.204-25 - Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020)

5. FAR 52.204-26 - Covered Telecommunications Equipment or Services – Representation

(OCT 2020)

6. FAR 52.224-1 - Privacy Act Notification (APR 1984)

7. Insert in solicitations and contracts when the design, development or operation of a system of records on individuals is required to accomplish an agency function.