RedactionServicesIDIQSOW_11062024.pdf

Table of Contents

Contents

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 PRICE/COST SCHEDULE

ITEM INFORMATION

B.2 SUPPLIES OR SERVICES AND PRICES

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

SECTION D - PACKAGING AND MARKING

D.1 DELIVERIES

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE AMOUNT

5-Year Ordering Period for Redaction of Information in Government Information Products

(See Attachment 2)

LOT

SUPPLIES OR SERVICES AND PRICES

B.1.1. This is an Indefinite Delivery, Indefinite Quantity (IDIQ) contract. Orders may be placed on a Firm Fixed Price (FFP) basis. Prices are per each publication and its constituent files (PII detection) and redacted (PII redaction performed).

B.1.2. This is a single-award IDIQ.

B.1.3. Travel No travel costs may be included in specific task order. All work will be performed remotely, or through virtual environments, and deliverables will be provided through SFTP. Costs associated with hard-drive delivery will be provided by GPO.

B.1.4. Program/Project Management Any contractor program/project management costs shall be included as a direct labor cost in the price of each task order, if required. PM costs shall not be authorized as an indirect cost under any order.

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

C.1. PROJECT TITLE

Discovery and Redaction of Information in Government Information Products

C.2. BACKGROUND

GPO was established with the core mission of Keeping America Informed. GPO provides publishing and dissemination services for the official and authentic government publications to Congress, Federal agencies, Federal depository libraries, and the American public. GPO is a legislative branch agency mandated to provide Federal Government information products to the public through several information dissemination programs specifically the Federal Depository Library Program (FDLP), and the Access to Federal Electronic Information program. GovInfo serves as the electronic access system and digital preservation repository for Federal electronic information from all three branches of the Federal Government. GovInfo provides free online access to official Federal Government publications.

In January of 2009, GPO launched the Federal Digital System (FDsys) which has since been replaced by GovInfo (www.govinfo.gov). GovInfo is a content management system, preservation repository, and public website that manages, preserves, and provides free online access to current and historical information from the legislative, executive, and judicial branches of the United States Federal Government today and into the future. The scope of GovInfo includes all known Federal Government documents within the scope of the FDLP. More detailed scope information can be found online at https://www.fdlp.gov/file-repository/about-the-fdlp/policies/superintendent-ofdocuments-public-policies/2738-content-scope-for-gpo-s-system-of-online-access. Through GovInfo, the public can search, browse, access, and download Federal Government publications or metadata in multiple renditions or file formats. GovInfo securely controls electronic content throughout its lifecycle, guarantees long-term preservation and access to digital content, and provides a quality search experience through modern search technology and extensive metadata creation. GovInfo is available 24/7 and is accessible by the general public.

As Federal depository libraries and other entities acquire born-digital content, initiate digitization projects, and harvest content that they subsequently make accessible online, the potential for instances of Personally Identifiable Information (PII) to appear within the online publications and documents exists. PII is defined as “Information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc., alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. [OMB Memorandum for the Heads of Executive Departments and Agencies, M-07-16]. As GPO increases the availability of digitally reformatted content to the public on GovInfo, GPO shall require effective strategies to redact or remove sensitive content and privacy information found in digital renditions of historical documents.

In accordance with Superintendent of Documents Policy, GPO seeks a service to proactively detect and redact high-impact PII from content discovered in or being readied for ingest into GovInfo.

C.3. SCOPE

GPO defines “high impact” PII as personal identification numbers issued by government or financial institutions printed in conjunction with an individual’s name, such as full or partial Social Security numbers, passport numbers, driver’s license numbers, taxpayer identification numbers, patient identification numbers, financial account numbers, or credit card numbers.

The vendor selected shall be able to provide the necessary technology and business practices to support large-scale, as http://www.govinfo.gov/ https://www.fdlp.gov/file-repository/about-the-fdlp/policies/superintendent-ofdocuments-public-policies/2738-content-scope-for-gpo-s-system-of-online-access https://www.fdlp.gov/file-repository/about-the-fdlp/policies/superintendent-ofdocuments-public-policies/2738-content-scope-for-gpo-s-system-of-online-access well as “one-off”, discovery and redaction of PII within its digital collections. The scope of content for this service includes:

1. Digitally imaged text-based (e.g. PDF) and raster image (e.g. JPEG2000, TIFF) files from historic federal publications which shall be provided to the contractor via an agreed upon file transfer or directory access method

2. Both digitally imaged and “born digital” PDF files which are currently accessible to the public, but may erroneously contain PII, via the GovInfo digital repository (www.govinfo.gov) which will be provided to the contractor for redaction only after identified as containing PII discovered by the contractor.

3. PDF files provided for redaction may or may not contain searchable text, or they main contain optical character recognized text but not at high accuracy rates.

4. Information which falls beyond the definition of high-impact PII, but is sensitive, or inappropriate for public use, and is identified by GPO, and exact locations within-text are provided by GPO for redaction.

At minimum, the service selected shall perform these activities to scale (across terabytes of content) based on nominal workflows and rule-based systematic approaches to PII removal. Through this IDIQ vehicle, the vendor shall perform redaction of ongoing, simultaneous tasks of varying sizes. Each task may require as little as 2TB or as a great as 15 TB of PDF and other file formats to be processed. Work shall be performed across multiple tasks, and more than one delivery of content may be provided to GPO at a time. Approaches which allow GPO to retain digital content on local servers without hosting or performing the redaction technologies shall be considered optimal. GPO is seeking to obtain services from a solution that can demonstrate experience with industry leading PII redaction technologies and one that can provide GPO with an innovative, clearly articulated approach to achieving the program’s objectives.

C.4. CONTRACT PERFORMANCE

C.4.1.1. PROJECT MANAGEMENT

The contractor shall manage all technical and administrative tasks associated with the planning, initiation, execution, and completion of each detection/discovery and redaction request from GPO. The contractor shall establish schedules, monitor performance, report progress/delays, and coordinate the logistics of providing redacted files. The contractor shall furnish all materials and staff, facilities, equipment, and supplies needed to fully carry of the requirements as described in this contract.

A project manager shall be designated by the contractor who is thoroughly familiar with the terms of this SOW, has a thorough knowledge of current relevant techniques, best practices, and standards, and has in-depth knowledge of the contractor’s processes and procedures and the day-to-day operation of the contractor’s facility. The contract project manager shall monitor all work performed under this contract. This individual shall have the ability and authority to make inquiries of the GPO point of contact regarding questions of a technical and administrative nature, answer any questions from GPO concerning work performed and resolve problems.

C.4.1.2. QUALITY CONTROL/QUALITY ASSURANCE

Quality Control/Quality Assurance shall be integrated into the service and project implementation. The contractor shall provide a Quality Control/Quality Assurance Plan as part of their proposal. These plans may be written for individual task orders, or a process which accounts, universally, for all task orders in this IDIQ vehicle. GPO has 30 business days from the day of receiving deliverables to provide acceptance or failure of work performed and approval of invoicing. The vendor will perform rework within 30 business days for all deliverables which are not accepted by GPO.

C.5.1 TASK ORDER DELIVERABLES

This service is expected to be performed on an as-requested basis. The volume and frequency of task orders to be processed is dependent upon GPO priorities and projects. The contractor must be able to initiate work on a specified volume of data within 30 days or less after being notified and provided access to the content. Project timelines will be developed and coordinated with the successful contractor based on GPO established deadlines.

Specific services to be performed and/or products to be furnished will be identified on individual task orders. The contractor shall be expected to be able to perform the following to complete the anticipated task orders for this contract

1. Host redaction technologies and perform all redaction services off site of the GPO premises.

2. Perform all redaction services and necessary activities, including interfacing with GPO virtually.

3. Maintain the capability to deliver a minimum of 10 TB of data per quarter, not to exceed 50 TB total per fiscal year.

4. Comprehensively and systematically detect high-impact PII from digital documents in file formats including PDF, XML, HTML, PowerPoint, MS Word, spreadsheets, TEXT, ePub, JPEG2000, and TIFF, providing fully redacted documents in their native file format. This includes content that has embedded OCR as well as content that does not have OCR or may not be able to have OCR technology applied.

5. Remove or redact high-impact PII such as full or partial Social Security numbers, passport numbers, driver’s license numbers, taxpayer identification numbers, patient identification numbers, financial account numbers, credit card numbers, personal cell phone numbers and other personal information.

6. Provide the ability to customize specific rule-based redaction actions.

7. Implement a quality control methodology to ensure 100% redaction of all high-impact PII.

8. Perform rework if GPO identifies a missed redaction of any delivery within the year of performance.

9. Support multiple redaction profiles for different types of documents. For example, some information may be retained in court cases which might be redacted from a different class of document. The service should provide the ability to establish separate redaction rules for use in those instances.

5. Perform redaction in languages in addition to English, including non-Latin writing systems.

6. Perform redaction in multiple instances within a file (e.g. as text and in an image form) when detected and discovered.

7. Enable the permanent removal of parts of or whole embedded images and/or other embedded information when required by GPO.

8. Redact selected or all document metadata, document property information (including information about who carried out the redaction and when it was carried out) and other “secondary” information when required by GPO

9. Provide final deliverables in a pre-defined folder-directory format as defined by GPO per each task order.

10. Provide final deliverables of redacted content alongside its unredacted original content, as requested, by GPO per each task order.

11. Provide regular reporting of PII discovered and characterization of the PII (i.e. location in document, PII type).

12. Provision of redacted files which maintain the features and usability of the original files including compliance to

PDF/A-2b file format standards and embedded OCR and any bookmark or navigation features when present in original file.

13. Provide final deliverables to GPO using BagIt technologies https://libraryofcongress.github.io/bagit-python/.

Generally, the following deliverables may be required, tailored to each order:

• Folder structure and file-naming conventions for deliverables

• File formats to be redacted

• Task-specific requirements for redaction methodologies such as replacement of text, or “black bar” text covering

• Task-specific requirements for the redaction of information, as discovered by GPO and exact location within document provided by GPO

• Task-specific BagIt specifications for deliverables

• Regular status reports

• Project closeout report

Unless otherwise specified, order-level data deliverables and reports shall be submitted to the COR on the task order, who shall have 30 business days to review and provide feedback. The contractor shall address any and all COR feedback prior to acceptance of the deliverable.

C.5. GOVERNMENT FURNISHED PROPERTY.

All work will be performed off-site.

C.6. OPERATIONAL ENVIRONMENT, DATA RIGHTS AND OWNERSHIP OF DELIVERABLES.

C.6.1. OPERATIONAL ENVIRONMENT

https://libraryofcongress.github.io/bagit-python/

C.6.1.1. All services to be performed are expected to be hosted outside of GPO facilities and system.

Accordingly, the contractor should include the cost of hardware, associated infrastructure or operational support in its response.

C.6.1.2. Redaction service shall operate in compliance with ISO/IEC 27038.

C.6.1.3. The service shall provide a secure means of transmitting or delivering digital files between GPO and the service provider or work with GPO to find an agreed upon mechanism for sharing access to files to be redacted. The vendor will provide SFTP services for the transfer of files. When appropriate, GPO and the vendor will transfer files via external hard drives if SFTP transfer is not appropriate for the volume of content to be sent at one time.

C.6.1.4. Electronic redaction shall be carried out in a controlled environment that provides access only to those trained and authorized to carry out redaction. Files shall only be accessible to individuals authorized to access them.

C.6.1.5. The service shall support both basic redaction and enhanced redaction. (Note: This requirement and its sub-bullets are secondary requirements – “shoulds” – not applicable to current processes, but may have future use.)

• When contextual information is unlikely to indicate the content of the redacted information, basic redaction shall be used.

• Where contextual information is likely to give concordant clues about the nature or meaning of the redacted information, then enhanced redaction shall be used.

• Where enhanced redaction is required, the text of a document shall be reflowed with the original locations of all redacted text marked in a consistent manner. Such marking can be used to remove “contextual” details such as the length of the redacted text information.

• The contractor shall not keep copies of any digital or print material provided by GPO, both redacted or un-redacted, after redaction service has been rendered and redacted files transferred to GPO.

C.6.2. SECURITY CONSTRAINTS (FROM GPO)

C.6.2.1. DATA

All data (e-mail traffic, contact information, calendar contents, etc) is and shall remain the property of the government. The Contractor shall ensure that the government retains access and download capability of all data for research, investigation, transfer, or migration to other systems.

C.6.2.2. CONFIDENTIALITY, SECURITY, AND PRIVACY

In accordance with the Materials Management Acquisitions Regulations (MMAR) the Contractor shall be responsible for the following privacy and security safeguards:

a. The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards used by the Contractor under the resulting contract or otherwise provided by or for the government.

b. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public government data collected and stored by the Contractor, the Contractor shall afford the government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

c. If new or unanticipated threats or hazards are discovered by either the government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

d. The Offeror's solution must comply with the GPO CIO IT Security Procedural Guide CIOIT Security-09-48, Security Language for IT Acquisition Efforts (see Attachment 2) as required for a Moderate Impact system.

e. Work on this project may require or allow contractor personnel access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

f. All data at rest will reside within the contiguous United States, the District of Columbia, and Alaska (CONUS) with a minimum of two data center facilities at two different and distant geographic locations.

(End of Statement of Work)

SECTION D - PACKAGING AND MARKING

D.1 DELIVERIES

Deliverables will be made over SFTP or mailed, trackable hard-drive. All deliveries submitted to the CO or the COR or other GPO personnel designated to receive deliverables shall clearly indicate the following information:

a. Agency/Requiring Library Service Unit and MAIL STOP/Room Number

b. Description of information/data being submitted

c. Contract Number

d. Contractor Name and Address

SECTION E - INSPECTION AND ACCEPTANCE

GPO has 30 business days from the day of receiving deliverables to provide acceptance or failure of work performed and approval of invoicing. The vendor will perform rework within 30 business days for all deliverables which are not accepted by GPO.

SECTION F - DELIVERIES OR PERFORMANCE

F1. Ordering Period

The ordering period for this IDIQ shall be 5 years as indicated in section B.

F2. Hours of Operation

The contractor is responsible for determining its hours of operation in fulfilling the requirements of this contract.

GPO’s standard operating hours are from 8:30 AM through 5:30 PM, Monday through Friday, excluding federal holidays.