OIG-SOW-Wingswept(Amended).pdf

STATEMENT OF WORK (SOW)

EXPORT-IMPORT BANK ON BEHALF OF

OFFICE OF INSPECTOR GENERAL FOR PROCDUREMENT OF AN

INVESTIGATIVE CASE MANAGEMENT APPLICATION

HISTORY

The Export-Import Bank of the U.S. (EXIM) is an executive agency and a wholly owned U.S.

government corporation organized as a District of Columbia banking corporation in 1934. EXIM is the official export credit agency of the United States, and its obligations carry the full faith and credit of the U.S. Government.

The Office of the Inspector General (OIG) is an independent office within EXIM. The EXIM OIG was statutorily created in 2002 and organized in 2007. The mission of the EXIM OIG is to conduct and supervise audits, investigations, inspections, and evaluations related to agency programs and operations.

EXIM OIG requires a case management platform to track OIG administrative, civil, and criminal caseload.

STATEMENT OF NEED

EXIM OIG, Office of Investigations (OI) requires the services of a software vendor for a Commercial off the Shelf (COTS) investigative case management system. The desired platform needed is a comprehensive case management interface capable of handling the complexities associated with indexing, filing, categorizing, and capturing investigative case information in multiple ways with the capacity to run numerous types of reports.

The case management system stores and retrieves the complaint supporting information that could be a paragraph, a page, or hundreds of pages. The following electronic file folders are part of the current application: Hotlines, Contacts, Complaints, Assignments & Activities, Subpoena Issuance, Outreach, Actions, and metric reporting.

This system, the associated software and database, will be hosted on a Federal Risk and Authorization Management Program (FedRAMP) approved cloud. This system will be utilized by all members of our unit in the EXIM OIG OI and will be allotted for fifteen users.

The contractor will provide technical support and maintenance of the product. All work must be performed and in compliance with Federal and Department regulations.

BACKGROUND

EXIM OIG request the procurement of a case management software with a secure cloud storage capacity that meets all our business needs and expectations. This system shall provide flexibility to users and management to centralize the location of all case-related files and makes the entire database searchable, including the related uploaded case documents.

The OIG requires this system provide investigative personnel with a mechanism to process numerous types of complaints and investigations to effectively maintain and catalog case relevant information. This is essential to the timely disposition of the OIG’s critical mission objectives and organizational benchmarks. The system also retain the ability to upload documents, track training commitments, time, evidentiary items, and inventory sensitive law enforcement equipment.

We need a system configuration for 15 users. This includes an information technology specialist, six investigators, two analysts, counsel, the Deputy Inspector General and the Inspector General.

OIG users access the current system using Government issued laptops, a Windows domain account, a PIV card, and SQL user accounts. The government issued computers comply with the United States Government Configuration Baseline (USGCB) and currently run the Windows 10 Enterprise Operating System and Internet Explorer 11. We use Microsoft Office version 2102.

Any COTS product will need to be accessible using the same configuration.

On average, we receive approximately 50-100 hotline complaints, 50-100 Complaints, and open nearly 25-50 investigations each year.

SCOPE

The procurement shall:

1. Provide COTS case management software (CMS) that meets the objectives and that is customizable by non-information technology personnel.

2. Provide hosted COTS CMS software that has agency FedRAMP Software as a Service (SaaS) authorization. This includes the implementation of all FedRAMP security controls, independent assessment conducted by an approved third-party assessment organization (3PAO), and the creation and submission of all required documentation.

3. The product must meet the technical requirements necessary to adhere to security requirements and system configurations requirements as necessary for the FedRAMP Software as a Service (SaaS) authorization.

PERSONNEL

Any contractor personnel who have access to the investigative data or administrator level access to the database or the case management system is required to have and maintain a 6c, or above, public trust clearance (noncritical-sensitive ADP) and provide documentation to the COR prior to start of the project. Personnel will also provide standard non-disclosure statements for system administration personnel who may have access to government data in the course of their duties.

ACCESSIBILITY

The system must meet technical standards for Section 508 compliance at 36 C.F.R. 1194.21 and

1194.22. Information about the Section 508 Electronic and Information Technology (EIT)Accessibility Standards are found via the Web at the following URL:

http://www.Section508.gov.

DATA ISOLATION AND PORTABILITY

All data (e-mail traffic, contact information, calendar contents, etc.) remains the property of the government. The contractor must ensure that the government retains access and download capability of all data for research, investigation, transfer, or migration to other systems.

COSTS AND PERIOD OF PERFORMANCE

The base Period of Performance will be one (1) year from the date of award with four (4), one year options. This contract and subsequent option years will be for the continued procurement of software licensing, software maintenance (software patches/upgrades) and secure cloud hosting.

This package will include all required system maintenance administration, help desk support and security services.

For option years, the contractor will provide COTS licensing, software maintenance (software patches/upgrades), help desk support for administrators, and secure cloud hosting services, to include all required system administration, maintenance, and security services. The contractor will perform the required work off-site. In Person meetings are not required due work performed on previous contract to include the initial configuration of the system and other necessary development during that earlier period. This contract will mainly be a continuation of services.

DELIVERY OR PERFORMANCE PERIOD REQUIREMENTS

The contractor shall be able to fully perform the services aimed at being fully functional on day one. This contract must be the best value to the Government.

Any contractor personnel who have access to the investigative data or administrator level access to the database or the case management system is required to have and maintain a 6c, or above, public trust clearance (noncritical-sensitive ADP) and provide documentation to the COR prior to start of the project. If contractor personnel do not already have appropriate clearances, the agency will pay for the background investigation; however, the contractor is still required to comply with the timelines of the contract.

Standard non-disclosure statements must be provided as required for system administration personnel who may have access to government data in the course of their duties.

CONFIDENTIALITY, SECURITY, AND PRIVACY

The contractor shall be responsible for the following privacy and security safeguards:

a. The work on this project may require or allow contractor personnel access to Privacy Information. The contractor shall be responsible for complying with the requirements of the Privacy Act, 5 U.S.C. 552a, the E-Government Act of 2002, 44 U.S.C. § 101, the Federal Information Security Management Act, 44 U.S.C. §3541 (FISMA), as well as OMB directives OMB M-06-16, OMB M-07-16, FIPS 201 and FIPS 140-2. The Contractor shall abide by and follow all applicable federal and state regulations, such as the FAR, and all departmental privacy policies, procedures, processes, and standards.

b. All data at rest will reside within the contiguous United States, the District of Columbia, and Alaska (CONUS) with a minimum of two data center facilities at two different and distant geographic locations.

PERFORMANCE OBJECTIVES

1.1. SECURITY AND DATA INTEGRITY

1.1.1. For base year and option years, the procurement shall include maintenance support/assistance calls with OIG key personnel.

1.1.2. The system must support and require two-factor user authentication via HSPD-12 PIV card.

1.1.3. The procurement shall provide maintenance support to include security and other patching for system as well as all updates that provide new capabilities, in base and option years.

1.1.4. The system must have a pre-logon warning banner (Accept or Decline). The language.

1.1.5. System vulnerabilities identified by the contractor or EXIM Bank/OIG shall be remediated within 30 days or in accordance with requirements specified in approved FedRAMP documentation.

1.1.6. The contractor shall develop application databases in accordance with FIPS 140-2 data encryption requirements.

1.1.7. All communications to and from the case management system and hotline servers must be established in accordance with FIPS 140-2 data encryption requirements (e.g., TLS). Any temporary files stored on the server must be encrypted.

1.1.8. The system must provide the ability to set a user’s session to automatically end or time out within a specified length of time.

1.1.9. The system security and access to records is controlled by role-based permissions.

1.1.10. The role-based permissions must have the ability to assign read only or read-write access to cases and to fields/areas within a case.

1.1.11. Users must not be able to bypass role-based permissions by running reports or conducting searches.

1.1.12. The system shall provide additional security protection to case documents or chronology entries marked as grand jury, sensitive, or ex-parte. The access to this information must be limited to a case-specific list of users (trumps other role-based security) defined by the case agent or supervisor respective to each marking (grand jury, sensitive, ex-parte).

1.1.13. The system shall provide additional security protection to a case marked as sensitive. The access to the entire case must be limited to a case-specific list of users (trumps other role-based security) defined by the case agent or supervisor or predefined role (non-administrator) that has access to all sensitive cases.

1.1.14. The system shall provide the ability to limit editing of information in a case based on its status such as not allowing edits to fields after a case is closed.

1.1.15. The system shall have system auditing capability to track user activity. This includes logging changes made to a case along with the date/time stamp and the user. The access to and ability to clear the logs must be restricted to a specific role.

1.1.16. The system shall limit one session per user at any given time.

1.1.17. Appropriate OIG personnel must be able to add/disable users, assign/change roles, define permission-based roles, and other administrative functions without the assistance of the contractor or information technology specialist.

1.1.18. Security roles must support organizational structure.

1.2. SYSTEM

1.2.1. The system shall provide a single easy to use Graphical User Interface into the system.

1.2.2. The system shall allow for multi-user simultaneous access to CMS and individual cases.

The system shall support a total of 15 active users with 15 simultaneous users accessing the system at any given time.

1.2.3. The system shall support the upload of all industry standard document, audio, video, and picture formats.

1.2.4. The document section shall support Web Distributed Authoring and Versioning (WEBDav), enabling the online creation, editing, and version control for standard Microsoft Office products such as Microsoft Word, Excel, and InfoPath.

1.2.5. The text entry areas shall have a Spell-Checking feature.

1.2.6. The system must be scalable such that custom fields can be added to case screens or individual/entity screens by EXIM OIG personnel without the assistance of the contractor or an information technology specialist. The field types shall include text boxes, text areas, check boxes, date, multi-select pick lists, dropdowns, number fields, and supports data validation.

1.2.7. The system must be configurable such that field labels and messages can be altered to match the organizations standard terminology.

1.2.8. The system shall have the ability to identify and prevent entry of duplicate entities based on specific unique fields such as SSN or DUNS number to ensure standardized/consistent entry and linking of records, as needed.

1.2.9. The system shall have a customizable Home Page Dashboard based on user role.

1.3. CASE MANAGEMENT (Universal to Complaint, Preliminary, or Investigation)

The system shall:

1.3.1. Act as the single repository for all case related information;

1.3.2. With appropriate permissions allow users the ability to initiate a case type (e.g., complaint, preliminary, or investigation);

1.3.3. Generate a unique case number that incorporates the fiscal year and that resets and assigns a next number by fiscal year. It is preferred that the case number be maintained as case changes from a preliminary to an investigation;

1.3.4. With appropriate permissions, allow users the ability to convert a Complaint to a Preliminary, and a Preliminary to an Investigation while preserving associated data and documents.

1.3.5. Have the ability to assign users to an investigation and specify investigative role in investigation (e.g., lead agent);

1.3.6. Have the ability to create spin off investigations (e.g., tracks related cases);

1.3.7. Retain all case numbers associated or preceding a complaint, lead, or investigation;

1.3.8. Have the capability of assigning and tracking multiple violations to each subject in the case;

1.3.9. Support various case categorization fields to include complaint source, crime type (multi-select), proactive/reactive/source generated, suspect type, and affected program (multi-select);

1.3.10. Allow users to create entities, associate them with a case, and categorize the type within a case (Subject, Victim, Witness, Incidental);

1.3.11. Allow the ability to change the status of an entity (witness to subject);

1.3.12. Be capable of recording multiple investigation techniques (search warrant, wiretap) for a case to include the date the technique was used. This may include multiple activities on the same date for the same case (e.g., multiple warrants on the same day);

1.3.13. Have the ability to sort documents and other items in the case based on type and date;

1.3.14. Maintain and display a running online chronology of case events/notes entered by the case agent, including who added the entry;

1.3.15. Categorize chronology entries, but with a default value (e.g., General Comment, Case Review, etc.)

1.3.16. Automatically enter events in the chronology based on the entry of specific information within the case (e.g., when an interview is uploaded, a chronology entry documenting the event is automatically created);

1.3.17. Require supervisor approval for specified case document types;

1.3.18. Have the ability, with appropriate permissions, to delete approved documents;

1.3.19. Automatically deletes draft revisions after a document is marked final/approved or the ability to mass delete drafts for a case;

1.3.20. Maintain record/log, preferably in the case chronology, of changes to case type (Complaint, Preliminary, Investigation) and case status (Opened, Closed, Closed Pending) including date, person performing action, and previous and new state;

1.3.21. Have the ability to have all interviews, indictments, convictions, sentencings, and acceptances/declinations associated with an entity in the case;

1.3.22. Have the ability to logically attach files to documents and number the attachments. For example, a memorandum of interview (MOI) may have a waiver of rights and a document shown during the interview attached to the MOI;

1.3.23. Have the ability to delete all records associated with an investigation once a records retention period has been reached (e.g., 10 years after the end of the fiscal year when the case was closed); and

1.3.24. Have the ability to track the referral of cases to other agencies/organizations.

1.4. INVESTIGATION

The system is capable of:

1.4.1. Assigning and tracking multiple administrative actions to each subject in a case;

1.4.2. Assigning and tracking multiple legal actions to each subject in a case;

1.4.3. Assigning and tracking multiple statutes and sentencing actions (fines, assessments, restitution, confinement, probation, supervised release, community service) to each subject in a case;

1.4.4. Assigning and tracking multiple financial results (recoveries, fines, savings) to each subject in a case;

1.4.5. Creating electronic templates (e.g., interviews and Reports of Investigation) with automated population of certain case information;

1.4.6. Assigning and tracking multiple case statuses and properly route the case based on the status for appropriate action;

1.4.7. Creating automated workflow processes with the ability to document to approve and assign tasks;

1.4.8. Having time and event notification;

1.4.9. Locking a case to prevent further editing;

1.4.10. Closing a case with follow-up actions pending in order to lock all case information with the exception of the follow-up action/results fields;

1.4.11. Automatically triggering actions, to include email notifications and dashboard indicators;

1.4.12. Providing notification on the user’s dashboard and/or by email;

1.4.13. Verifying specified information has been entered prior to allowing case closing; and

1.4.14. Customizing the case closing actions for investigations.

1.5. REPORTING (FOIA, eDiscovery, Indexing, Searching, and Reporting)

The system is capable of:

1.5.1. Generating reports on activities and investigations conducted by OIG personnel assigned to an investigation;

1.5.2. Performing full text searches and retrieval of documents;

1.5.3. Providing person search capabilities for fast name checks;

1.5.4. Performing quick searches based on the most common system fields;

1.5.5. Performing advanced searches with options to provide specific search criteria for most database fields;

1.5.6. Changing search result column displays, ordering and sorting characteristics;

1.5.7. Creating and producing ad hoc reports where multiple fields and criteria can be specified;

1.5.8. Producing complex ad hoc reports, such as all investigations associated with a query of entities (e.g., list all cases where an employee was a subject in the investigation);

1.5.9. Performing time computations to report information such as days in status, days since last investigative activity, and investigative results;

1.5.10. Producing reports in Excel/CSV format;

1.5.11. Producing reports in PDF format;

1.5.12. Saving ad-hoc reports including search criteria used and fields included and allow quick access for future use;

1.5.13. Creating and producing common reports, in multiple formats, to be used to meet the requirements of Semi-Annual Reporting to Congress, the CIGIE Report to the President, and other regularly repeated reporting such as performance metrics;

1.5.14. Downloading all documents for a case in a zip file;

1.5.15. Downloading multiple user-selected documents for a case in a zip file; and

1.5.16. Generating a report containing all case fields for a specific case.

1.6. TIME and COSTS

The system is capable of:

1.6.1. Tracking time charged by user to a case or non-case activity;

1.6.2. Creating a defined list of non-case activities to which time can be charged;

1.6.3. Tracking expenses associated with each case by user;

1.6.4. From a monthly entry screen, allowing users to add employee hours to cases and non-case activities for multiple cases; and

1.6.5. Tracking hours worked and calculate unscheduled duty hours as required by 5 U.S.C.

5545a, Availability pay for criminal investigators, and 5 CFR 550.183(b), Substantial hours requirement.

1.7. TRAINING

The system is capable of:

1.7.1. Acting as the repository for tracking agent completion of general training;

1.7.2. Allowing approved training instructors to enter a training class for multiple users at one time;

1.7.3. Allowing agents to view their training;

1.7.4. Allowing for setting expiration dates to specific training entries;

1.7.5. Allowing for the categorization of training;

1.7.6. Generating a report based by region, by expiration date, user, and/or category for a given time period; and

1.7.7. Sending automated emails 30 days before and upon expiration of training.

1.8. OTHER

1.8.1. The system will have the ability track outreach activity and fraud awareness briefings conducted by agents not associated with a case. (Desired, not required)

1.8.2. The system will have the ability to link outreach or fraud awareness activities to a specific case generated due to the activity. (Desired, not required)

1.8.3. The contractor shall provide a user manual in Microsoft Word outlining all functions of the system utilizing a hyperlinked table of contents for each portion of the manual.

1.8.4. The contractor shall provide a data dictionary table in Word or Excel that describes the fields and relationships in the system.

1.8.5. The contractor shall provide two remote or on-site training sessions for administrator functions. The training shall cover the creation of ad-hoc and common reports.

1.8.6. The system must be able to operate on a Windows 2012 Server virtual machine running Microsoft SQL Server version 2014.

1.9. DATA MIGRATION

The system shall be capable of:

1.9.1. Mass importing legacy case information (entity fields, result fields, case fields, etc.)

1.9.2. Mass importing legacy case documents in a variety of standard formats (.DOC, .JPEG, .WAV, .PDF) to include the importing of metadata such as upload date, description, user, etc.)

1.9.3. Mass importing individual case chronology entries per case.

OBJECTIVE

EXIM OIG investigations, audits, inspections, evaluations, referrals, and complaint allegations are expansive and require a system interface to manage every facet of the investigation. This system will assist with due diligence protocols and methodical examination of all EXIM OIG Office of Investigations matters under review. EXIM OIG work is pivotal in Criminal /Civil Prosecutions, and other Administrative Findings such as Suspension and Debarment proceedings.

EXIM OIG is seeking a database platform capable of suiting our specific business need.

DELIVERY AND INSTALLATION

The contractor will provide technical support and maintenance of the product. All work must be performed and in compliance with Federal and Department regulations.

PERIOD OF PERFORMANCE

The Period of Performance for this contract will be (1) year with (4) option years included.