Final SOW.pdf

United States DAV RPA OCR Capability Patent and Trademark Office Statement of Work

Form # USPTO-OP-020 (08/2020) Page 1 of 9

1. Requirement Title: Docket and Application Viewer (DAV) Relevant Prior Art (RPA)

Optical Character Recognition (OCR) Capability

2. Background

2.1. Mission. The mission of the United States Patent and Trademark Office (USPTO) is to foster innovation, competitiveness and economic growth, domestically and abroad, by providing high quality and timely examination of patent and trademark applications, guiding domestic and international intellectual property (IP) policy.

2.2. The Office of the Chief Information Officer (OCIO). The Chief Information Officer (CIO) is the principal advisor to the Undersecretary of Commerce for intellectual property and director of the United States Patent and Trademark Office on the application and transformation of information technology (IT) for the USPTO’s business. The organization leads IT strategy and management in support of the Agency’s mission, including big data, cybersecurity, cloud computing and emerging technology.

2.3. Business Product Delivery Office (BPDO). The BPDO is a product-centric, DevSecOps organization that delivers business value to customers via software, from initial design to the deployment and ongoing operation.

2.4. Patent Product Delivery Division (PPDD). The PPDD is a product-centric DevSecOps organization that delivers business value to Patents customers via software, from initial design to the deployment and ongoing operation.

2.4.1. Patent Product Delivery Branch 3 (PPDB3). The PPDB3 provides end-to-end business product delivery (i.e., Development, Security, and Operations), including product management, in support of the Patent Exam Center (PEC) product of the Patent Product Line (PPL).

2.5. PPL PEC. The PEC Product allows users to manage patent applications, search prior art, and make patentability determinations.

2.5.1. Docket and Application Viewer (DAV). A component of PEC, the DAV provides examination tools for patent examiners to track and manage the cases in their docket and view documents in image and text format.

2.5.2. Relevant Prior Art (RPA). The new RPA service for DAV will increase patent examination quality and efficiency by automating the import of relevant prior art and other pertinent information and automatically map citations to the documents in a patent application.

2.5.2.1. Pursuant to Federal Rules 37 Code of Federal Regulations (CFR) 1.97 Filing of information disclosure statement and 1.98 Content of information disclosure statement, a patent applicant may submit documents for consideration by the Patent Examiner during the examination of their patent application. The documents may take the form of prior domestic or foreign patent documents, or non-patent literature (NPL). The documents are submitted to USPTO with a list of citations recorded on a form PTO/SB/08a (07-09) Information Disclosure Statement (IDS) completed by the Applicant.

The IDS is included in the file wrapper of the application for subsequent https://www.ecfr.gov/current/title-37/chapter-I/subchapter-A/part-1/subpart-B/subject-group-ECFR2896c671410fb75/section-1.97 https://www.ecfr.gov/current/title-37/chapter-I/subchapter-A/part-1/subpart-B/subject-group-ECFR2896c671410fb75/section-1.97 https://www.ecfr.gov/current/title-37/chapter-I/subchapter-A/part-1/subpart-B/subject-group-ECFR2896c671410fb75/section-1.98 https://www.ecfr.gov/current/title-37/chapter-I/subchapter-A/part-1/subpart-B/subject-group-ECFR2896c671410fb75/section-1.98 https://www.uspto.gov/patents/basics/patent-process-overview#step6 https://www.uspto.gov/patents/search/patent-public-search https://worldwide.espacenet.com/ https://www.uspto.gov/web/offices/pac/mpep/s707.html https://www.uspto.gov/web/offices/pac/mpep/s707.html#d0e73405 https://www.uspto.gov/sites/default/files/documents/sb0008a.pdf https://www.uspto.gov/sites/default/files/documents/sb0008a.pdf https://www.uspto.gov/web/offices/pac/mpep/s719.html

Form # USPTO-OP-020 (08/2020) Page 2 of 9 consideration by a Patent Examiner. In turn, the Patent Examiner will provide a Notice of References Cited (PTO-892) to the patent applicant.

2.5.2.2. For Portable Document Format (PDF) Image or Tag Image File Format (TIFF), the RPA Service shall utilize commercial-off-the-shelf (COTS) OCR products to extract image content to hyper-text markup language (HTML) text, improving quality and accuracy. Figure-1 below provides a high-level view of the RPA process and the role of the required OCR capability.

Figure 1 RPA Process and Required OCR Capability

3. Purpose The purpose of this SOW is to secure a COTS OCR Capability for the DAV RPA

Service and software license support for the COTS OCR capability.

3.1. COTS OCR Capability Technical Requirements

3.1.1. Process specific range of pages in a TIFF document or an entire document.

3.1.2. OCR and accurately convert the table structure and table text content on each page.

3.1.3. Achieve OCR accuracy level that exceeds 99% for high quality images and 90% for poorer quality images.

3.1.4. Output and deliver the results for each page or the entire document in HTML format, accurately representing table structures.

3.1.5. Support a wide variety of source IDS form types with structured and unstructured tables.

3.1.6. Support special characters and multibyte languages.

https://www.uspto.gov/sites/default/files/patents/init_events/fai_example_1_enhanced.pdf

Form # USPTO-OP-020 (08/2020) Page 3 of 9

3.1.7. Support Java/Python/C# as a language.

3.1.8. Support memory streams or a memory mapped filesystem.

3.1.9. Scale efficiently to support high volumes with high performance.

3.1.10. Run within Docker containers on LINUX.

4. Scope

4.1. Task 1 – Kick Off Meeting

The Contracting Officer (CO) and the Contracting Officer Representative (COR) will hold a remote kick off meeting / post award conference at a time and with a meeting system determined by the CO with the Contractor’s team and other relevant Agency personnel to review and clarify the contract’s objectives, expectations from the Government, and address any questions the Contractor may have.

4.2. Task 2 – Software License Service Agreement

4.2.1. The agreement will cover the following topics at a minimum:

4.2.1.1. General information and parties involved.

4.2.1.2. Account management and technical support points-of-contact.

4.2.1.3. Definitions.

4.2.1.4. Payments.

4.2.1.5. Maintenance and support.

4.2.1.6. Warranties and limitation of liability.

4.2.1.7. Indemnification.

4.2.1.8. Confidential information and ownership.

4.2.1.9. Term and termination.

4.2.1.10. Applicable law and dispute resolution.

4.2.1.11. Permitted and prohibited means of software access, distribution, modification, and protection.

4.2.1.12. Developer’s right to ownership and control of the program’s intellectual property.

4.2.1.13. Users’ rights required to use software.

4.3. Task 3 – Initial installation and configuration support

The Contractor shall provide initial installation and configuration support. Pertinent task includes installation instructions, minimum system requirements, on-call and knowledge base support, and configuration support instructions

4.4. Task 4 – Supply Chain Risk Assessment (SCRA)

The Contractor shall comply with the USPTO and Department of Commerce SCRA process. A SCRA is a systematic examination of supply chain risks, likelihoods or their occurrence, and potential impact. NIST SP 800-161R1 https://csrc.nist.gov/pubs/sp/800/161/r1/final

Form # USPTO-OP-020 (08/2020) Page 4 of 9

5. Deliverables

Table 1 Deliverables

SOW

Section Deliverable Due Date Delivery Method

4.1 Kick Off Meeting Within one week of

award.

Virtual remote meeting with

CO/COR.

4.2 Software License

Service Agreement

Draft agreement submitted with proposal. Final agreement within two weeks of award.

Electronic to COR.

4.3 Initial installation and

configuration support

Within three weeks of award.

Electronic to Technical Leads and Product Owners.

4.4 SCRA

Draft responses with proposal. Final before contract award.

Electronic to SCRA assessment personnel.

2.5.2.2 3.1

COTS OCR Capability Software Development

Kit (SDK) for Linux 20-million-page volume

Within three weeks of award. Electronic to COR.

2.5.2.2 3.1

Western OCR Server for Linux

Within three weeks of award. Electronic to COR.

2.5.2.2 3.1

Recognition add-on servers

Within three weeks of award.

Electronic to COR.

2.5.2.2

3.1 Asian Add-on server Within three weeks of

award.

Electronic to COR.

2.5.2.2 3.1

Incident and bug fix support

Within four weeks of award.

Electronic to COR, Technical Leads, and Product Owners.

Form # USPTO-OP-020 (08/2020) Page 5 of 9

6. Period of Performance

6.1. Base – 12-months from the Date of Award.

6.2. Option Period 1 – 12-months from the end of the Base Period.

6.3. Option Period 2 – 12-months from the end of Option Period 1.

6.4. Option Period 3 – 12-monts from the end of Option Period 2.

7. Place of Performance

Work shall be performed remotely.

8. General Security Requirements:

8.1. Note that the Contractor agrees that all of the items specifically listed in this section apply to both the Prime Contractor and all Teammates, Subcontractors and/or Independent Contractors:

8.2. Contractors (including Subcontractors) entering into an agreement for services to the U.S. Patent and Trademark Office (USPTO) and/or its Federal customers shall be contractually subject to all USPTO and Federal IT Security standards, policies, and reporting requirements. The Contractor shall meet and comply with all applicable Federal, Department of Commerce (DOC), and USPTO laws, regulations, standards, policies, and guidelines, other Government-wide laws, and regulations for protection and security of Information Technology.

8.3. The Contractor shall comply with all applicable Federal Information Processing Standards (FIPS). National Institute of Standards and Technology (NIST) Special Publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

8.4. The Contractor is hereby made to be aware that, all Information systems supporting the USPTO must meet the minimum security and privacy requirements using security controls in accordance with NIST Special Publication 800-53, (Current Revision), “Security and Privacy Controls for Federal Information Systems and Organizations.”

8.5. The Contractor shall use USPTO technical guidelines, NIST guidelines, or industry best practice guidelines in hardening their systems.

8.6. All USPTO systems and Contractor systems used in the execution of the awarded contract and corresponding Task Orders must receive a full Authorization to Operate (ATO) from the USPTO Co-Authorizing Officials. The system must be re-authorized on an annual basis based on the completion of annual assessments and continuous monitoring activities. Any changes to the system after it has been authorized, must be assessed and documented in accordance with OMB Memo 10-15 and 12-20.

8.7. The Contractor shall appropriately address NIST SP 800-53 (Current Revision) controls, assisting USPTO Cybersecurity Division, as necessary, to ensure security and privacy controls are in place and operating as intended.

8.8. The Contractor shall comply with security assessment and authorization (A&A) of all systems developed for support of the contract/task order in conformance with the standards set forth by the FISMA and NIST SP 800-37 (Current Revision), Risk Management Framework for Information Systems and Organizations.

8.9. Vendors for external Contractor systems shall coordinate with an independent third-party assessment organization to perform initial and annual assessments to obtain and

Form # USPTO-OP-020 (08/2020) Page 6 of 9 maintain their system authorization consistent with NIST SP 800-53/53A, NIST SP 800- 30, and DOC and USPTO policies. An independent assessor is any individual or a team capable of conducting an impartial assessment of security and privacy controls employed within or inherited by an information system. Impartiality implies that security control assessors and privacy control assessors are free from any perceived or actual conflicts of interest with respect to the development, operation, and/or management of the information system or the determination of security or privacy control effectiveness.

8.10. Identified gaps between required NIST 800-53 controls and the Contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document.

8.11. USPTO systems shall maintain a System Security and Privacy Plan (SSPP). SSPP updates will be made as material changes occur to the system operated and or maintained by the contractor with updates occurring no more than 7 calendar days from the time when changes are made to the system. The system must also have a contingency plan and must regularly perform contingency tests to ensure the proper actions are taken in the event that the system fails.

8.12. The Contractor shall work with Cybersecurity Division after award to gain further details, ensure each stage maintains the proper level of security, and track any future enhancements.

8.13. A Security Impact Analysis (SIA) and/or risk assessment shall be performed whenever there is a change (major or minor) to a system.

8.14. The Contractor shall notify the responsible ISSO, CISO, and USPTO Computer Incident Response Team (CIRT) of any suspected incidents in a timely manner according to DOC/USPTO established guidelines and assist in the investigation of incidents as necessary.

8.15. As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104, if the system involves the design, development, or operation of a system of records on individuals, the Contractor shall implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.”

8.16. The Contractor shall follow secure coding best practice requirements, as directed by the United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP) that will limit system software vulnerability exploits.

8.17. The Contractor shall protect information that is deemed sensitive from unauthorized disclosure to persons, organizations or Subcontractors who do not have a need to know the information. Information which, either alone or when compared with other reasonably available information, is deemed sensitive or proprietary by the USPTO shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all Subcontractors that are performing under this awarded contract.

8.18. The Contractor shall use the Cybersecurity Assessment Management (CSAM) tool, or equivalent as determined by the USPTO CISO, to manage POA&Ms and to store official security documentation for DOC and Office of Inspector General (OIG) review.

The USPTO will provide the Contractor with a CSAM account.

Form # USPTO-OP-020 (08/2020) Page 7 of 9

8.19. The Contractor shall provide information as required by any USPTO or DOC OCIO data calls subject to third party Contractor access who support such data calls.

8.20. The Contractor shall adhere to DOC’s Vulnerability Disclosure Policy and publish necessary information banner(s) and links on the main website page for any Contractor public-facing websites owned and/or operated on behalf of the USPTO to allow the public to report any discovered vulnerabilities.

8.21. The Contractor shall complete the USPTO Information Technology Security Awareness Training.

9. Information Technology (IT) Security Implementation

9.1. USPTO and Contractor information systems must meet Federal and Agency security requirements. Control and security of all USPTO data in the possession of the Contractor and its subordinates (subordinates meaning Subcontractors, consultants, employees, teammates, independent contracts, consultants, vendors, and/or any individual with access to the system or its data) under this awarded contract is a primary responsibility of the Contractor at all times and under all circumstances. The Contractor must assure the integrity of the USPTO data, take no action, or permit any action that will cause or give the perception of a breach of USPTO data integrity and or confidentiality. The Contractor shall notify the CIO Command Center with a copy to the Contracting Officer within two hours of becoming aware of any problems or potential problems (risks/threats), including possible solutions or mitigation strategies, which may affect the availability, confidentiality, or integrity of the system and or USPTO data and must provide all information required in accordance with – https://uscert.cisa.gov/sites/default/files/publications/Federal_Incident_Notification_Gui delines.pdf.

9.2. All reporting obligations under this awarded contract must be met and nothing in the provision of this notice removes the Contractor’s obligation from providing notice under any other part of the awarded contract. This shall include theft, misappropriation, significant misuse, criminal activity, and or significant malfeasants by the Contractor’s staff and its subordinates (subordinates meaning Subcontractors, teammates, independent Contractors, and/or any individual with access to the system or its data) if such circumstances affects the performance of the work, safety of personnel performing the work and or the confidentiality, integrity, or availability of Government furnished data and or Authority to Operate (ATO) system of the awarded contract.

9.3. The USPTO has developed Security Assessment and Authorization processes to ensure the integrity, confidentiality and the availability of its data and information systems.

National Institute of Standards Technology (NIST) Special Publication (SP) 800-37 (Current) or superseding language and NIST SP 800-53 (current) or superseding language serve as baselines to inform of DHS understanding and implementation of all CA controls.

9.4. The Contractor’s systems must have a valid ATO [signed off by the USPTO co-AO(s) or designee] prior to deploying the product in production and processing live patent data. If the Contractor proposes cloud-based solutions, the Contractor’s cloud services must be FedRAMP compliant and must have a valid ATO (signed off by the USPTO AO, co- AO, or designee) prior to going into operation and processing USPTO information.

Form # USPTO-OP-020 (08/2020) Page 8 of 9

9.5. If the Contractor has an existing ATO previously approved by the USPTO at the moderate or high risk level for a current contract, the Contractor shall submit to the Contracting Officer’s Representative, within 15 days of award, an updated system authorization package and associated artifacts [e.g. System Security Plan (SSP), Risk Assessment Report (RAR), existing ATO letter (Authorization Decision Document), and current/active Plan of Action and Milestones (POA&Ms)] to reflect any changes in the system authorization boundary including, but not limited to, system components implemented and managed by Subcontractors. The USPTO must review and approve the system authorization package to determine if significant changes to the system authorization boundary have occurred to warrant a re-assessment and re-authorization of the system before work on the awarded contract can commence. If the USPTO determines a new security assessment and authorization is required, the Contractor shall ensure an independent third-party assessment of all applicable security and privacy controls outlined in NIST 800-53 (current version) or superseding language and shall submit an updated system authorization package for an ATO decision.

9.6. The Contractor’s system to include but not limited to facilities, application information systems, supporting infrastructure, and related as defined in the USPTO authorized Contractor system boundary must have and maintain at all times a valid USPTO ATO for each system prior to going into operation, transporting, storing, and or processing USPTO information. The Contractor shall adhere to current Government policies, procedures and guidance for the Security Authorization process, including the Federal Information Security Management Act (FISMA), which requires initial and annual security assessments.

9.7. The Contractor shall adhere to all current Government policies, procedures and guidance for the USPTO Security Authorization and Risk Management processes, including FISMA, which requires initial and annual security assessments to include the Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) program related requirements.

9.8. The Contractor is hereby notified that USPTO is required under Federal law and directed in OMB memorandum M-21-02 Appendix A “Additional CISA Responsibilities and Agency Implications,” and related, to participate in the DHS Cybersecurity and Infrastructure Security Agency (CISA) scanning of Internet Accessible Addresses and Systems of Federal civilian agencies to include systems operated by and on behalf of the Agency. As such, and in support of the USPTOs internal monitoring and risk management programs, the Contractor shall notify the USPTO at least 30 days in advance of any planned changes, additions, and or discontinuances of:

9.8.1. IP Addresses and or IP address ranges

9.8.2. Internet Service Providers

9.8.3. Internet domains

9.8.4. Domain names of dynamically provisioned systems

9.9. The USPTO will then file such amendments in domain, scope, and or address range(s) with DHS/CISA as required as part of the overall agencies publicly accessible Internet presence.

Form # USPTO-OP-020 (08/2020) Page 9 of 9

9.10. The Contractor, Teammates, Subcontractors and/or independent Contractors, are hereby notified that the USPTO cybersecurity program manages risk of IT operations and systems through the implementation of a Continuous Monitoring and Residual Risk quantification and identification program. Therefore, the Contractor shall must be fully vested in the success of this program through active participation in order to achieve and maintain the required ATO of their system(s).

9.11. This program involves:

9.11.1. Formalized IT operational security monitoring and assessment activities including but not limited to FISMA, Agency and DHS/CISA scanning, and logical and physical operational assessments.

9.11.2. Active continuous monitoring and mitigation.

9.11.3. Announced and unannounced IT risk and mitigation effectiveness testing, to include penetration testing and red team activities (systems, networks, data, and facilities) will be performed by the Federal Government to test the protection of USPTO information and systems.

9.11.4. Active participation of USPTO Federal and Contractor Cybersecurity personnel as well as other critical partners with jurisdictional authority as necessary including Department of Commerce (DOC) Office of the Inspector General (OIG), DHS, Federal Bureau of Investigation (FBI), Federal Protective Services (FPS), local and state law enforcement, and related.

9.12. The Contractor, Teammates, Subcontractors and/or independent Contractors, shall permit, authorize, indemnify, hold harmless, and defend USPTO Cybersecurity personnel and support Contractors in their authorized performance of activities when acting in the official capacity and within the scope of employment related to carrying out the USPTO Continuous Monitoring and Residual Risk quantification and identification program in support of the system ATO requirement. The performance of tasks related to that program to include but not limited to announced and unannounced (as determined by the USPTO CISO):

9.12.1. Onsite and remote application, infrastructure, and system vulnerability scanning.

9.12.2. Onsite and remote application, infrastructure, and system compliance scanning.

9.12.3. Onsite and remote physical and logical penetration testing.

9.12.4. Onsite and remote capture of data and artifacts necessary to conduct, document, and support all aspects of the USPTO Information Security program inclusive.

9.13. Access to all logs and other application and system data produced by software

[including but not limited to commercial-off-the-shelf, contract specific custom (“software first produced in the performance of this contract), government-off-the-shelf, and or OSS] utilized in conjunction with or for the performance of this awarded contract and/or the USPTO data is in transit, resides, is stored or is at rest.

9.14. Production of system documentation that shall include: copies of pertinent documents prepared by the Contractor, and, if applicable, the Subcontractor(s), to support all production work; and other printed materials, pamphlets, books, drawings, etc., developed and acquired by the Contractor, and if applicable, the Subcontractor(s), during the term of the awarded contract and directly related to the subject of the services being rendered.