20240523 eDiscovery BOA Attachment A_SOO_Amendment 002.pdf

FDIC DATA HOSTING EDISCOVERY VENDOR 1

STATEMENT OF OBJECTIVES 2

Version – May 23, 2024 3

1.0 OVERVIEW 5

The overall objective of the Basic Ordering Agreement (“BOA” or “Agreement”) is to obtain 7 best-in-class legal support eDiscovery services. 8

Objectives include obtaining: 10

• cloud-based managed hosting and processing of host electronically stored information 11

(“ESI”) that may be part of investigations, inspections, examinations, and/or litigation. 12 The timing of this support may include from early case assessment/pre-processing 13 ingestion through trial utilizing state-of-the-art technology, including analytics and 14 technology assisted review (“TAR”), and employing e-discovery best practices to 15 preserve, collect, process, review, analyze, produce, and ESI for FDIC investigations, 16 inspections, examinations, and litigation; 17

• assistance with responding to information requests from many sources, including, for 18 example, Congressional requests for information, third-party subpoenas and audits, 19 FOIA requests, internal and external investigations; and 20

• assistance to Legal Division personnel and FDIC outside counsel and other legal support 21 providers and other professional staff members to collect, organize, review, analyze, 22 produce, and present evidence as part of unofficial or official discovery in a lawsuit or 23 investigation. 24

2.0 IN-SCOPE SERVICES 26

The BOA’s scope includes all of the following services — as well as tasks encompassed by, derived 28 from, or logically related to the following — in relation to any phase of the eDiscovery Reference 29 Model (EDRM)1: 30

2.1 Managed data hosting. Secure hosting of data for access by the FDIC (or others as 32 designated by the FDIC), including nearline and cold storage options; disaster recovery; 33 administration and support of web-based database/legal review applications, and discovery 34 platforms; documenting procedures; purchase, testing, and implementation of FDIC-required 35 software programs; and performing quality control. 36

2.2 Database creation. Creating databases or database load files (e.g., dat; csv; eDII); 38 document coding/data entry; documenting procedures; and performing quality control. 39

2.3 Paper document acquisition, preparation, and unitization. Organizing documents; 41 identification of document boundaries (inserting slip sheets); scanning, OCRing, and 42 numbering documents; creating box or file level indices; capturing document images (single-43

1 The eDiscovery reference model is an industry-standard approach to ESI that incorporates the following phases: information governance, identification, preservation, collection, processing, review, analysis, production, and presentation.

page TIFF format or PDF format); copying documents; preparing documents for production; 44 documenting procedures; and performing quality control. 45

2.4 Early data assessment, pre-processing, and processing. Extracting and converting data 47 files, including email files and other files in their native formats; optical character recognition 48 (“OCR”) of documents; rendering single page TIFF images (or other image formats), as 49 needed; automated and manual analysis of files to identify relevant or priority material utilizing 50 culling tools, analytics, and TAR; analyzing and reporting file type and other data metrics; 51 documenting procedures; and performing quality control. 52

2.5 Analytics and TAR. Use of analytics and TAR or similar tools; providing consulting 54 services and workflows for analytics and TAR to locate potentially relevant information 55 efficiently; and providing expert testimony, if necessary. 56

2.6 Managed review. Review of documents for, e.g., relevance, identification of legal 58 privileges, identification of Suspicious Activity Reports and/or Reports of Examination among 59 other categories; redaction; creation of privilege logs; documenting procedures; and 60 performing quality control. This may or may not include hosting data, depending on whether 61 the Contractor has received an Authority to Operate that permits hosting of FDIC Data. 62

• Personnel performing managed review will be under the supervision of FDIC counsel 63 or counsel hired by the FDIC and will not be engaged in the practice of law. 64

• Unless expressly agreed to by the FDIC in writing for a specific project, all categories 65 of managed legal review must be performed by a licensed attorney, in the United 66 States, who is a member in good standing of the bar of a state, territory, the District of 67 Columbia, or the Commonwealth of Puerto Rico. 68

• The vast majority of work will be performed at vendor facilities or remotely, and work 69 is priced under that assumption. For the occasional Task Order that may require travel, 70 travel and related expenses are reimbursable as set forth in BOA section 4.3. 71 o [Optional Scope] The exception to remote managed review is the pricing for 72 on-site managed review at a FDIC-directed location in New York. This work is 73 optional scope, and if ordered, shall be performed in New York City without 74 reimbursable travel. 75

2.7 [Optional Scope] Pre-trial and trial support, including courtroom services. Providing, 77 administering, operating and maintaining equipment and other resources in support of 78 litigation; exhibit preparation; courtroom presentation; remote depositions, sworn statements, 79 and interviews; other audio/visual services; and performing quality control. 80

2.8 Forensic services. Forensic data collection performed by forensics professionals with 82 proper local, state, or federal certifications as needed at sites throughout the United States, U.S. 83 Territories, and other countries and territories, as needed or requested; data analysis and 84 reporting; documenting procedures; decryption; and performing quality control. 85

2.9 [Optional Scope] Transcription/Translation. Automated language transcription and/or 87 translation services. Vendors are invited, but not required, to propose for these optional 88 services. 89

3.0 SECURITY REQUIREMENTS2 92

(All security-related requirements are at Contractor expense and all must be completed prior to any 94 Task Order awards.) 95 At all times for the duration of the BOA, all of the Contractor’s managed hosting and processing of 97 FDIC electronically stored information must be either: (1) performed by a solution that has a 98 Federal Risk and Authorization Management Program (FedRAMP) MODERATE Impact Level 99 authorization, or (2) performed entirely within a FedRAMP MODERATE Impact Level authorized 100 environment. 101

3.1 System Security Assessment and Authorization Requirements 102

3.1.1 Authority to Operate 103

The Contractor shall not input, store, process, output, and/or transmit FDIC data within a 104 Contractor IT system without an Authority to Operate (ATO) signed by the FDIC Authorizing 105 Official (AO) granted via the System Security Authorization (SSA) process. The FDIC process for 106 obtaining and maintaining ATO, is in accordance with NIST SP 800-37 Risk Management 107 Framework for Information Systems and Organizations. The Contractor shall adhere to current 108 FDIC policies, procedures, and guidance for the SSA process as defined below. 109 Complete the Security Authorization Process. The SSA process shall proceed according to the 111 NIST SP 800-37 Risk Management Framework for Information Systems and Organizations or any 112 successor publication including templates. 113

a. System Security Assessment and Authorization Process Documentation. 115 SSA documentation shall be developed by the Contractor using the FDIC provided 117 security documentation templates. SSA documentation consists of the following: 118 Security Categorization Worksheet, System Security Plan, Contingency Plan, 119 Contingency Plan Test Results, Configuration Management Plan, Security 120 Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. 121 Additional documents that may be required include a Plan(s) of Action and 122 Milestones and Interconnection Security Agreement(s). 123

b. Independent Assessment. 125 Contractor shall have, at its expense, an independent third party perform an 127 assessment of the FDIC-prescribed security and privacy controls as outlined in 128 NIST SP 800-53 to determine the extent to which the selected controls are 129 implemented correctly, operating as intended, and producing the desired outcome 130 with respect to meeting security and privacy requirements for the system and the 131 FDIC. Should the independent assessment find deficiencies, the Contractor must 132 follow the direction of the FDIC to create and track Plans of Action & Milestones 133 (POA&Ms) to be included in the final authorization package. FDIC has the 134 unilateral right to determine if the results and mitigation strategy are acceptable. In 135 the case of unacceptable results or mitigation strategy, or if the Contractor does not 136

2 Note: This same information is also included in the Basic Ordering Agreement for ease of reference.

remediate control weaknesses in a timely manner as established in POA&Ms, FDIC 137 may treat the failure as an event of default. 138

c. Support the Completion of the Privacy Compliance Documentation. 140

As part of the SSA process, the Contractor may be required to support the FDIC in 142 the completion of a Privacy Threshold Analysis (PTA). The requirement to 143 complete a PTA is triggered by the creation, use, modification, upgrade, or 144 disposition of a contractor IT system that will store, maintain and use personally 145 identifying information (PII), as defined by the Privacy Act, 5 U.S.C. § 552a. Upon 146 review of the PTA, the OCISO Privacy Section determines whether a Privacy 147 Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), 148 or modifications thereto, are required. The Contractor shall provide all support 149 necessary to assist the FDIC in completing the PIA in a timely manner and shall 150 ensure that project management plans and schedules include time for the 151 completion of the PTA, PIA, and SORN (to the extent required) as milestones. 152 Support in this context includes responding timely to requests for information from 153 the FDIC about the use, access, storage, and maintenance of PII on the Contractor’s 154 system, and providing timely review of relevant compliance documents for factual 155 accuracy. Information on the FDIC’s privacy compliance process, including PTAs, 156 PIAs, and SORNs, is accessible at www.fdic.gov/privacy. 157

d. Authorization to Operate. 159 Upon completion of the SSA documentation and independent assessment, the 161 Contractor shall submit a signed SSA package, validated by the independent third 162 party, to the Oversight Manager for acceptance by the FDIC AO, or designee, at 163 least thirty (30) days prior to the use of the system. The FDIC is the final authority 164 on the compliance of the SSA package and may limit the number of resubmissions 165 of a modified SSA package. Once the ATO has been granted by the FDIC AO the 166 Contracting Officer shall incorporate the ATO letter into the contract as a 167 compliance document. The FDIC’s issuance of the ATO does not alleviate the 168 Contractor’s responsibility to ensure the controls are implemented and operating 169 effectively. The SSA package must include the following: 170

Deliverables (30 Days Prior to System Use) Security and privacy plans Security and privacy assessment reports Plans of Action & Milestones Supporting assessment evidence or other documentation, as required.

e. Continuous Monitoring/Ongoing Assessment. 173

After an initial authorization, the Contractor shall have the security and privacy 175 controls assessed on an ongoing basis in accordance with NIST SP 800-37 and 176 based on the FDIC Control Assessment Frequency. Ongoing assessment of the 177 control effectiveness is part of the continuous monitoring activities of the FDIC. 178 Adherence to the terms and conditions specified by the AO as part of the 179 http://www.fdic.gov/privacy authorization decision are also monitored. Ongoing control assessment continues as 180 the information generated as part of continuous monitoring is correlated, analyzed, 181 and reported to the Oversight Manager for acceptance by the FDIC AO. The system 182 needs to undergo a Security Impact Assessment (SIA) whenever any 183 changes/modifications are made to the system. Should the independent assessment 184 find deficiencies, the Contractor must follow the direction of the FDIC to create and 185 track POA&Ms to be included in the final authorization package. FDIC has the 186 unilateral right to determine if the results and mitigation strategy are acceptable. In 187 the case of unacceptable results or mitigation strategy, or if the Contractor does not 188 remediate control weaknesses in a timely manner as established in POA&Ms, FDIC 189 may treat the failure as an event of default. 190

4.0 CONTRACTOR RESOURCES 192

The Contractor will be responsible for providing contract and corporate level resources, including a 194 dedicated FDIC Project Manager, for performing all work ordered under the BOA. One of the 195 purposes of a dedicated project manager is to provide the FDIC a single-point-of-contact/entry to 196 the vendor. This project manager may be located anywhere within the United States and the FDIC 197 does not require that this be a full-time role, provide the FDIC can reach this individual within 24 198 hours. 199 The Contractor shall provide all management, staffing, planning, scheduling, procuring, pickups 201 and deliveries for all items/services required under the BOA. This includes, but is not limited to: 202

• Providing a single Program Manager/Point of Contact for the FDIC to engage regarding 204 the BOA. 205

• Screening prospective contractor staff for conflicts of interest, and ensuring employees 207 used under this BOA meet personnel hiring and employment security approval 208 requirements, and coordinating with FDIC, and other government personnel if directed by 209 the FDIC, as needed to complete the required clearances. Contractor must retain all 210 personnel security files for all individuals who perform work under the BOA for the life 211 of the Agreement. 212

• Ensuring facilities and computer networks and equipment used for the 214 Contractor’s performance of this Agreement meet all security requirements of the 215 Agreement, and coordinating with FDIC staff as needed. 216

• Completing and providing Background check and Confidentiality agreements 218 upon FDIC request. 219

• Conducting all activities associated with management and handling of interim and 221 deliverable pipeline products, such as media containing electronic data. For example, the 222 Contractor must forward, monitor, and track each “container” of documents, from receipt, 223 through data processing, delivery, recovery, and destruction. 224

The Contractor shall train its own staff so as to ensure that all personnel are able to perform their 226 duties under the Agreement satisfactorily. For example, the Contractor shall provide staff trained 227 and experienced in litigation processes and terminology, as well as specific software packages, 228 including database and processing software and/or other similar platforms used as early data 229 assessment/review applications. 230

5.0 ORDERING PERIOD 232

The ordering period of the BOA is five (5) years from award. Task Orders properly awarded 234 within the Ordering Period may extend to their natural conclusion, for a maximum of up to 12 235 months beyond the end of the BOA-level Ordering Period. 236

6.0 ORDERING PROCEDURES 238

The BOA is not a contract. It is a written instrument of understanding between the FDIC and the 240 Contractor for future delivery of unspecified quantities of goods or services. A BOA becomes a 241 binding contract when a Task Order is issued and for the period of the Task Order. The FDIC is 242 not obligated to place any Task Orders under the BOA. Each order becomes a binding 243 commitment upon acceptance of the Task Order. 244 At any time during the Period of Performance, the FDIC may send to Contractor, and any other 246 Contractors awarded a BOA, a Request for Task Order Proposal (RFTOP) describing the nature of 247 one or more specific tasks, the structure for Contractor’s task-level proposal, the evaluation 248 factors, and any other information relating to the task. Task Orders under the BOA may be 249 awarded either competitively or non-competitively (i.e., Direct Award): 250

• Competitive Award: The FDIC may solicit two or more Contractors holding a BOA for 252 the purpose of evaluating proposals and awarding a Task Order. Evaluation factor(s) for 253 the selection decision will be provided in the Request. 254

• Direct Award: The FDIC reserves the right to issue a Task Order directly, outside of any 256 competition, if the FDIC determines a direct award is in the FDIC’s interest. Reasons for 257 the use of a Direct Award may include: 258

• A need to rotate awards in order to keep a Vendor’s “production line warm” so 259 that all BOA holders are well positioned to support FDIC requirements in the case 260 of surge requirements; 261

• Low value Task Orders, typically less than $5,000, where a direct award is the 262 most cost effective approach; or 263

• Only one source is feasible for fulfilling the FDIC’s need under the circumstances 264 (for example, exigent circumstances, technical uniqueness, case-relatedness, or 265 follow-on engagements which would require cost to onboard or scale a new 266 vendor to an existing project). 267

If Contractor wishes to be considered for a Task Order award, it must comply with any 269 instructions in the RFTOP. Based on the task order proposals received, the FDIC may select one 270 or more Contractors to perform the tasks, or none at all. The Task Order must be executed by 271 authorized representatives of the Contractor and the FDIC after which there will be a binding 272 obligation between Contractor, and the FDIC under the terms of the BOA and the Task Order for 273 delivery of the goods or services described therein. Only the individual specified in the Task 274 Order as having authority to bind the FDIC will be authorized to execute the BOA on behalf of 275 the FDIC. 276