RFI Draft PWS eDiscovery-FOIA 04 30 2026.docx

U.S. Department of Treasury Office of the Chief Procurement Officer

FOIA and eDiscovery Management Systems and Supporting Services

Draft Performance Work Statement

TABLE OF CONTENTS

GENERAL INFORMATION

Purpose

The purpose of this Performance Work Statement (PWS) is to establish a department-wide Blanket Purchase Agreement (BPA) to provide a unified, secure, and scalable solution for managing all Freedom of Information Act (FOIA) and electronic discovery (eDiscovery) requirements across the U.S. Department of the Treasury. This BPA is intended to consolidate common FOIA and eDiscovery needs under a single, enterprise-wide contract vehicle to enable consistent operations, improve efficiency, and eliminate redundant and fragmented procurements across Treasury bureaus and offices.

The BPA will serve as a strategic vehicle for acquiring cloud-based software licenses, professional services, and related support necessary to fulfill Treasury’s statutory obligations under the FOIA, the Federal Rules of Civil Procedure (FRCP), applicable federal records, and cybersecurity requirements. It will provide the Department with an enterprise-ready platform capable of managing the full lifecycle of FOIA requests and litigation discovery, from data intake and processing to review, redaction, production, and archival, while ensuring compliance with Federal risk and Authorization Management Program (FedRAMP), Federal Information Security Modernization Act of 2014 (FISMA), Section 508, and Treasury cybersecurity directives.

This acquisition will promote standardization, scalability, and innovation across Treasury’s FOIA and eDiscovery operations by leveraging modern commercial technologies, including artificial intelligence (AI), machine learning (ML), and advanced analytics, to increase transparency, reduce backlogs, and enhance responsiveness to public and legal information requests.

Background

The mission of the U.S. Department of the Treasury is to maintain a strong economy and create job opportunities by promoting conditions that enable economic growth and stability, strengthening national security through financial enforcement, and managing the federal government’s finances effectively.

Treasury operates systems critical to the nation’s financial infrastructure, including the production of coin and currency, disbursement of payments, revenue collection, and debt management. It employs more than 100,000 personnel across 50+ offices and bureaus, such as the Internal Revenue Service (IRS), Bureau of the Fiscal Service (Fiscal Service), Bureau of Engraving and Printing (BEP), U.S. Mint, Office of the Comptroller of the Currency (OCC), Financial Crimes Enforcement Network (FinCEN), Alcohol and Tobacco Tax and Trade Bureau (TTB), Treasury Inspector General for Tax Administration (TIGTA), and the Office of Inspector General (OIG).

Treasury’s operations generate substantial volumes of Electronically Stored Information (ESI) such as correspondence, reports, emails, chat records, multimedia, and database content. These data sets are subject to frequent FOIA requests, litigation discovery obligations, congressional inquiries, and oversight investigations. Treasury currently relies on multiple vendor solutions, such as Nuix Discover, Relativity, and FOIAXpress, operating across both on-premises and software-as-a-service (SaaS) environments. The Department requires a transition to a single, secure, and scalable cloud-based eDiscovery/FOIA platform to streamline compliance, improve transparency, and ensure standardized records management across all bureaus.

Statement of Need

Treasury requires an enterprise-wide eDiscovery and FOIA platform that:

1.1.1 Supports the full lifecycle of FOIA and discovery, including preservation, collection, processing, review, analysis, redaction, and production of ESI.

1.1.2 Integrates with Treasury’s enterprise systems (MS Office 365, SharePoint, OneDrive, Email Servers, etc.)

1.1.3 Complies with:

1. Federal Rules of Civil Procedure (FRCP) governing discovery in litigation.

2. Freedom of Information Act (FOIA), 5 U.S.C. § 552, requiring timely responses to requests for agency records.

3. Privacy Act of 1974, 5 U.S.C. § 552a, safeguarding personal information.

4. Department of Justice (DOJ) Office of Information Policy (OIP) reporting requirements.

5. Records management directives under the National Archives and Records Administration (NARA) Universal Electronic Records Management (ERM) Requirements.

1.1.4 Incorporates advanced AI and Machine Learning (ML) capabilities, such as Technology-Assisted Review (TAR), continuous active learning, automated entity recognition, predictive coding, and intelligent redaction, to increase processing speed and improve accuracy.

Given Treasury’s growing data volumes, the system must scale to handle terabytes of information, many concurrent users, and simultaneous FOIA and litigation workloads.

SCOPE AND OBJECTIVES

The scope of this PWS encompasses the acquisition, implementation, and operation of an enterprise-wide, Federal Risk and Authorization Management Program (FedRAMP)-authorized eDiscovery and FOIA Software-as-a-Service (SaaS) solution for the U.S. Department of the Treasury. The resulting BPA will provide a secure, scalable, and unified platform that consolidates Treasury’s common eDiscovery and FOIA needs under a single enterprise contract vehicle. The Contractor shall provide all software, cloud hosting, migration, integration, training, and support services required to fulfill Treasury’s statutory and operational requirements while ensuring continuity of current operations until full transition to the new SaaS environment is complete.

The Contractor shall:

Provide and maintain a vendor-hosted, FedRAMP-authorized cloud-based eDiscovery and/or FOIA SaaS platform that is fully operational upon award and capable of scaling to meet Department-wide workloads.

Ensure the platform complies with the Federal Rules of Civil Procedure (FRCP), Freedom of Information Act (5 U.S.C. § 552), Privacy Act (5 U.S.C. § 552a), NARA records-management directives, and applicable Treasury cybersecurity and privacy policies, while supporting continued operation of existing authorized systems until transition is complete.

Develop and implement data-migration tools and processes to transfer documents, metadata, and workspaces from legacy systems to the new SaaS environment, including validation and quality-assurance checkpoints.

Provide access to both active-review data and cold-storage repositories sized to meet Treasury’s maximum projected consolidated capacity requirements.

Support collection, preservation, processing, ingestion, review, and production of data in a wide range of formats, including but not limited to: Adobe PDF, AppleDouble, CAD, compressed and container files, database exports, email, EnCase, Excel, Google Workspace, Hangul, HTML, iCalendar, image files, Lotus, JungUm Global, OneNote, OpenOffice, PowerPoint, Publisher, Project, short-message and chat data (e.g., Slack), text, vector graphics, Visio, Word, WordPerfect, and multimedia files.

Deliver AI/ML-powered capabilities that enhance eDiscovery and FOIA workflows, including continuous active learning, technology-assisted review (TAR), automated redaction, privilege assessment, predictive coding, data visualization, and standardized templates for data ingestion and case processing. These capabilities shall reduce manual workload, improve classification accuracy, and ensure consistent application of FOIA exemptions and legal-privilege protections across large datasets.

Provide granular access controls enabling restriction of access at the document, workspace, or user-role level and support multi-factor authentication consistent with Treasury identity-management policies.

Integrate seamlessly with Treasury and third-party systems, including Microsoft 365 (Outlook, SharePoint, Teams, OneDrive), FOIA.gov, Pay.gov, and other approved repositories and monitoring tools.

Ensure cross-platform compatibility across major browsers and mobile operating systems and maintain full Section 508 accessibility compliance.

Provide professional support services, including data processing and ingestion, end-user and administrator training, help-desk support (Tier I–III), and consulting on the use of advanced tools, analytics, and best-practice workflows.

Obtain and maintain an Authority to Operate (ATO) and Privacy Impact Assessment (PIA) for the SaaS solution in accordance with Treasury Cybersecurity and Privacy directives and sustain compliance through continuous monitoring.

Maintain interim continuity by supporting existing Treasury-authorized cloud or on-premises systems until the new SaaS platform receives an ATO and all bureaus have transitioned.

Accommodate future expansion of eDiscovery/FOIA scope and incorporation of new data types, AI capabilities, or regulatory changes aligned with Treasury’s evolving mission and statutory obligations.

The services below shall meet Internet Protocol Version 6 (IPv6) compatibility.

E-DISCOVERY/FOIA TASK DESCRIPTIONS

TASK SUMMARY TABLE

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and non-personal services necessary to provide the capabilities to the Department of the Treasury needed for collecting, preserving, processing, assessing, reviewing, analyzing, and producing ESI as defined in this PWS.

TASK 1: INTEGRATED E-DISCOVERY SOLUTION

(SHARED REQUIREMENTS)

1.1.5 Current and SaaS Solution Shared Technical and Functional Capabilities

The Contractor shall provide and maintain an Integrated eDiscovery Platform that supports Treasury’s eDiscovery operations and includes shared technical, security, and infrastructure requirements common to both eDiscovery and FOIA solutions. These shared requirements include hosting, authentication, data management, logging, accessibility, and security compliance capabilities that apply across Treasury’s records management and disclosure processes. The existing solutions shall have received, and currently be, ATO-cleared by Treasury Cybersecurity. Existing solutions will be used in the interim before a future SaaS is available. All requirements apply to both the current and future SaaS solutions unless noted inline. Unique requirements pertaining only to the SaaS solution are listed in section 3.1.10 (eDiscovery/FOIA AI - Shared Future State Specific Requirements).

1.1.5.1 The existing solutions shall be able to host 240 TB of ESI available for agency review upon initial service phase-in. The SaaS solution shall be able to host 480 TB of ESI.

1.1.5.2 The existing solutions shall provide scalable storage to seamlessly accommodate growth in data volume up to 400 TB in 5 TB increments. The SaaS solution shall provide scalable storage for growth up to 1500 TB of data in 10 TB increments. Data growth requirement is subject to change.

1.1.5.3 For the SaaS solution only: Treasury offices have approximately 180 TB of data located in 1,000 workspaces from the on-premises solution, which will migrate to the cloud-based solution. The anticipated storage capacity breakdown is as follows, but is subject to change:

· Active Review – 240 TB

· Cold Storage – 480 TB

· Staging – 60 TB

1.1.5.4 Shall support up to 225 eDiscovery/335 FOIA concurrent users with minimal reduction in performance in comparison to a single user.

1.1.5.4.1 Shall be capable of supporting additional concurrent users, up to 750 concurrent users, with minimal reduction in performance.

1.1.5.4.2 Shall have the ability to report on user management.

1.1.5.5 Network element under the control of the Contractor shall be robust enough to accommodate 560 concurrent users with minimal reduction in performance.

1.1.5.6 Network element under the control of the Contractor shall be robust enough to accommodate additional concurrent users, to 750 concurrent users, with minimal reduction in performance.

1.1.5.7 Shall provide a means of accessing the internal systems for end-users that is compliant with Homeland Security Presidential Directive 12 (HSPD-12), using the Personal Identity Verification (PIV) credentials or equivalent thereof.

1.1.5.8 Shall be able to verify all end-users are accessing the internal systems from the Treasury network or Treasury furnished equipment.

1.1.5.9 Shall provide a means for registering and accessing the internal user portals that is compliant with multi-factor authentication (MFA) at National Institute of Standards and Technology (NIST) AAL2.

1.1.5.10 Shall have all hardware (virtual and physical) dedicated to the platform deployed in facilities physically located within the United States (U.S.).

1.1.5.10.1 All data stored, processed, analyzed, etc. within the system shall be stored on servers located within the U.S.

1.1.5.11 Shall be capable of hosting an individual case comprised of more than 25 TB of data.

1.1.5.12 Shall comply with Treasury IT Security Baseline:

1.1.5.12.1 All Treasury systems, services, and Contractors shall comply with Treasury-wide IT security policies and standards, which incorporate baseline controls such as IRM 10.8.1 (Information Technology Security, Policy and Guidance) and relevant technical and Web Server Security Standard.

1.1.5.12.2 The Contractor shall implement, maintain, and demonstrate compliance with these policies and standards, which are aligned with FISMA, NIST Special Publications (SP 800-53, SP 800-171, SP 800-137), OMB A-130, and other federal cybersecurity mandates.

1.1.5.12.3 Future state SaaS solution only: These requirements shall apply across all Treasury bureaus and systems, ensuring consistent IT security governance, configuration baselines, monitoring, logging, and vulnerability management.

1.1.5.12.4 Contractors shall meet or exceed those requirements Treasury-wide, unless otherwise directed by the Department of the Treasury.

1.1.5.12.5 Future state SaaS solution only: bureau specific requirements must be considered during implementation stage.

1.1.5.13 Desired Outcome:

A uniform Treasury-wide security posture that ensures:

1.1.5.13.1 Consistency across all bureaus in applying IT security standards.

1.1.5.13.2 Resilience against cyber threats through proactive controls and rapid remediation.

1.1.5.13.3 Accountability through auditable, standardized documentation and reporting.

1.1.5.13.4 Compliance with federal law and Treasury directives, reducing risk of breaches, audit findings, and operational disruptions.

1.1.5.14 Shall be, and remain, compliant with FISMA.

1.1.5.14.1 Future state SaaS solution: shall be, and remain, authorized at minimum as FedRAMP Moderate.

1.1.5.15 Shall be, and remain, compliant with Treasury Information Technology (IT) and Cybersecurity Operational Cloud requirements for both Vendor hosted SaaS or Treasury hosted cloud solutions.

1.1.5.16 Shall be, and remain, compliant with Treasury externally hosted computing standards as set by Treasury Cybersecurity.

1.1.5.17 Shall have access controls for users at the case, item, and field level with the tool(s) supplied by the Contractor for processing, reviewing, production, etc.

1.1.5.17.1 The tools shall have the ability to customize access permissions or apply a standardized template.

1.1.5.18 Shall provide end-users with the necessary tools to analyze data utilizing an array of Technology-Assisted-Review (TAR) or other analytical tools to produce data out in accordance with the Agency’s requirements.

1.1.5.19 Shall be capable of reporting and maintaining a full audit trail of reviewer and administrator activity, including user- and administrator-retrievable individual user search and result histories.

1.1.5.20 Shall provide Treasury technical and application support personnel sufficient level of access to perform remote processing, ingestion, production, and export.

1.1.5.21 Shall accommodate any data generated for FOIA, eDiscovery, tax litigation, and internal investigations, congressional inquiries, and tracking responses to public comments.

1.1.5.22 Provide and maintain documentation to support the Treasury’s use of the provided tools, including but not limited to process manuals and user guides.

1.1.6 Platform Records Management

1.1.6.1 The Contractor shall establish and maintain a comprehensive Records Management solution that complies with the Department of the Treasury’s policies, NARA regulations (36 CFR Chapter XII), and applicable federal statutes (e.g., Federal Records Act, FOIA, and eDiscovery requirements). The program shall include:

1.1.6.2 Secure creation, classification, storage, retrieval, and disposition of records (electronic and paper).

1.1.6.3 Implementation of retention schedules consistent with Treasury and NARA guidance.

1.1.6.4 Ensuring records are complete, accurate, and accessible throughout their lifecycle.

1.1.6.5 Support for litigation holds, FOIA requests, audits, and eDiscovery processes.

1.1.6.6 Use of automated tools and metadata standards where applicable to improve efficiency and traceability.

1.1.6.7 Integrate with Treasury wide Records Management Tools

1.1.6.8 Desired Outcome

1.1.6.8.1 Compliance & Risk Reduction: All records are managed in accordance with Treasury, NARA, and federal compliance requirements, reducing legal, regulatory, and security risks.

1.1.6.8.2 Efficiency & Accessibility: Records are organized, digitized, and easily retrievable to support FOIA responses, eDiscovery, audits, and program operations.

1.1.6.8.3 Transparency & Accountability: Proper documentation and retention ensure transparency of government operations and accountability to stakeholders.

1.1.6.8.4 Cost Savings: Reduction in paper storage, duplication, and manual handling through digitization and automation.

1.1.6.8.5 Continuity & Resilience: Records are securely backed up and recoverable in the event of a system outage, disaster, or cyber incident.

1.1.7 Data Ingestion and Pre-Processing

The tool(s) used for data ingestion and processing shall meet the following requirements:

1.1.7.1 Be robust enough to ingest a minimum of 500 gigabytes (GB) of data per day.

1.1.7.1.1 A higher rate of ingestion is preferred.

1.1.7.1.2 Shall be capable of scaling to seamlessly ingest up to 1 TB of data per day, and to store increasing data volume.

1.1.7.2 Be able to process 1TB of data daily.

1.1.7.2.1 Shall be capable of scaling to up to 2 TB per day or more, based on the needs of the Treasury.

1.1.7.3 Be capable of ingesting and processing American National Standards Institute (ANSI) and Unicode (all common variants) character sets.

1.1.7.4 Support foreign language detection, including the ability to identify primary and secondary languages in documents, ability to filter or categorize collection by language.

1.1.7.5 Be capable of processing and ingesting:

1.1.7.5.1 All types of unstructured native-format text-based data commonly found in a Federal agency business environment including but not limited to the following file types: Adobe files, AppleDouble, CAD files, Compressed files, Container files, Database files, Email, Excel, Forensic container fields (e.g., EnCase), Google Workspace, Hangul, HTML, iCalendar, Image Files, Lotus, JungUm Global, OneNote, OpenOffice, PowerPoint, Publisher, Project, Short message, Slack, Text, Vector, Visio, Word, WordPerfect. The additional capability to process and ingest multimedia files will be expected in future the SaaS solution and is not required in the current solution.

1.1.7.5.2 Load files created in accordance with Department of Treasury and DOJ specifications such as, comma delimited, EDRM XML, and Concordance load files.

1.1.7.6 Provide ingestion error reporting and correction.

1.1.7.7 Provide processing error reporting and remediation capabilities.

1.1.7.8 Be capable of rendering for redaction all embedded content (e.g., images, links), and content available in alternate displays such as tracked changes, comments, and speakers’ notes.

1.1.7.9 Be capable of deduplication using MD5 or SHA hash algorithms. Deduplication using family MD5 algorithms will be required as an added capability in the SaaS solution.

1.1.7.10 Be capable of pre-processing loaded collections, including NIST, flatten, extract text and metadata, perform Optical Character Recognition (OCR), and create image versions (e.g., TIFF, PDF, JPEG formats) of native-format and other image format files. Decryption of Secure/Multipurpose Internet Mail Extensions (S/MIME) encrypted files (customer-supplied certificates) will only be required in the current on-premises solutions.

1.1.7.11 Be capable of incremental deduplication when additional documents are added to the collection. The SaaS solution shall maintain records of custodial and file location information for all deduplicated materials.

1.1.7.12 Be capable of maintaining parent/child association and document family identification and grouping during all analytic processes.

1.1.7.13 Be able to create and maintain processing templates.

1.1.7.14 Allow end-users to directly upload ESI to the system for processing.

1.1.8 Data Analysis and Review

The tool(s) used for data analysis and review shall meet the following requirements:

1.1.8.1 Be capable of analyzing all types of unstructured native-format text-based data commonly found in a Federal agency business environment (with particular emphasis on Microsoft Office (Word, Excel, PowerPoint, etc.) and related formats, including Exchange, SharePoint, Teams, etc.). Additional capability to support analysis on Microsoft Office OneDrive will be expected in the SaaS solution.

1.1.8.2 Maintain parent/child association and document family identification and grouping during all review processes.

1.1.8.3 Give users the ability to choose a broad spectrum of analytic techniques to efficiently review and analyze collections.

1.1.8.4 Offer deduplication and near-deduplication, with customizable deduplication parameters (e.g., minimum similarity %).

1.1.8.5 Competently handle all common search and Technology-Assisted Review (TAR) techniques including:

1.1.8.5.1 Predictive coding functionality with Continuous Active Learning (CAL) algorithm with validation reporting; also, with user-created training sets.

1.1.8.5.1.1 Predictive coding powered by AI is expected to become available in the SaaS solution.

1.1.8.5.2 Algorithm-based document concept clustering capability (with user-specified generality/coherence levels); cluster visualization; ability to specify a user-selected training set in document indexing and categorization; ability to add documents to an existing clustering or indexing/categorization scheme.

1.1.8.5.2.1 Machine Learning is expected to be incorporated in the SaaS solution.

1.1.8.5.3 Data visualization capability.

1.1.8.5.3.1 Pre-defined and custom reports/ dashboards must become available in the SaaS solution.

1.1.8.6 Have an advanced search and tagging/coding capability suite available including:

1.1.8.6.1 Complex Boolean operator string searching, wildcards, stemming, and proximity searching.

1.1.8.6.2 Ability to search by Regular Expression (RegEx) character string format rather than keyword (e.g., search for SSNs, telephone #s, or email address formats).

1.1.8.6.3 Fuzzy search, dictionary search, concept search (keyword-independent), keyword expansion search, “find similar” search (e.g., utilizing algorithmic/statistical similarities such as latent semantic indexing).

1.1.8.6.4 Ability to save and recall searches; search result reporting, including number and document location of search term hits; ability to group search reports by custodian or other defined categories.

1.1.8.6.5 Ability to specify custom tagging or coding templates by case or reviewer type.

1.1.8.6.6 Ability to apply rule- or keyword-based persistent highlighting throughout entire collection or a subset thereof. Ability to jump to next highlighted (or responsive) term in document or in collection.

1.1.8.6.7 Multiple filtering by metadata fields and user-generated tagging/coding.

1.1.8.6.8 Batch or bulk document tagging/coding capability.

1.1.8.6.8.1 Ability to propagate decisions to other documents based on varying criteria including families and near duplicate similarity.

1.1.8.6.9 Ability to create customized fields, choices, and coding panels.

1.1.8.7 Have full email threading (including ability to leverage header metadata and normalize for differing server timestamps); ability to identify, group and analyze divergent branches from a parent thread; ability to analyze emails added to the collection against existing thread groups; thread visualization.

1.1.8.8 Required for the SaaS solution only: Shall have short message review capabilities including the ability to display conversations and individual messages sent using SMS, iMessage, Skype, Teams, Slack, Bloomberg, and other instant message services.

1.1.8.9 Have the ability to search and review ANSI and Unicode (all common variants) character sets.

1.1.8.10 Be able to associate, view and conduct full array of search and analysis functions on translations produced with foreign language original documents, either by file association or placement of translation in additional extracted text metadata field.

1.1.8.11 Be able to batch or folder review sets and assign review batches by user.

1.1.8.11.1 Not have a limit on number of batches, folders or review sets that can be created.

1.1.8.12 Be able to display any loaded version of a document, including image (TIFF/PDF/JPEG), native format, extracted text, production version.

1.1.8.13 Have a broad portfolio of viewer-supported document filetypes, and ability to create images-on-the-fly or bulk convert loaded native documents (e.g., if native application is unavailable on user’s computer).

1.1.8.14 Be capable of rendering for review all embedded content (e.g., images, links), and content available in alternate displays such as tracked changes, comments, and speakers’ notes. The SaaS solution must include adding the ability of assigning review layer tasks to multiple users.

1.1.8.15 Have the ability to zoom in/out on view of displayed document image, including full-page view.

1.1.8.16 Allow end-users to export image (e.g., PDF) of an individual document while viewing it.

1.1.8.17 Give end-users the ability to re-unitize a document image into multiple documents (i.e., redefine where document boundaries begin and end).

1.1.9 Redaction

Trial teams are required to redact filings with the U.S. Courts and other judicial bodies to remove sensitive personally identifying information (PII). Tools will need to be able to detect PII in documents, accurately identify the PII, and redact the information so that it is masked when it is produced.

The tool(s) used to redact shall provide a robust redaction capability, including the ability to run rules-based redaction jobs, and at a minimum enable:

1.1.9.1 User-definable multiple redactions.

1.1.9.2 Defined character string recognition-based redactions (including searching and redacting using RegEx).

1.1.9.3 Ability to identify and suggest additional redactions based on previous user-specified redactions.

1.1.9.4 Inverse redactions.

1.1.9.5 Multiple full-page redaction capability.

1.1.9.6 Ability to insert and customize text boxes within redactions.

1.1.9.7 Ability to customize or configure appearance of redactions.

1.1.9.8 Ability for other users to review and edit (transparent) redactions prior to burn-in.

1.1.9.9 Reporting capability to list redactions and associated text box content by document and page number (to assist with privilege log and Vaughn Index creation).

1.1.9.10 Redaction capability for Microsoft native or near-native(including Excel spreadsheets), and for text, image, audio, and video files while preserving underlying data, structure/formulas and functionality, without data loss.

The above capabilities can be native to tool(s) or via an add-on enhancement tool that operates within the user interface environment.

1.1.10 Production Out

The tool(s) used for production out shall meet the following requirements:

1.1.10.1 Be Capable of producing load files created in accordance with Department of Treasury and Department of Justice load file specifications for comma delimited, EDRM XML, and Concordance load files.

1.1.10.2 Be Capable of producing partial or full native format productions.

1.1.10.3 File names for native format productions must be preserved from the original native file ingested into the system.

1.1.10.4 Files produced in the native format must not be modified from the original.

1.1.10.5 Files produced in non-native format must be:

1.1.10.5.1 TIFF (300 DPI resolution minimum), JPEG, image-only PDF, or text-searchable PDF as determined by end-users.

1.1.10.5.2 Black and white, grayscale, or color as determined by end-users and within the limits of the technology.

1.1.10.5.3 Producible out of the same dataset with either redactions burned in or with no redactions as required by end-users.

1.1.10.5.4 Document control numbered or otherwise alphanumerically identified, and ability to:

1.1.10.5.4.1 Track numbers/character strings already used with in a case to ensure all pages are uniquely identified.

1.1.10.5.4.2 Suggest to the end-user the next incremental number or character string when beginning a new production within the same case.

1.1.10.5.4.3 Able to accept and display header/footer information as determined by end-users.

1.1.10.6 Be capable of producing any subset of relevant data (metadata or tags/coding) associated with the documents or files in a user-specified format, (e.g., end-user-specified Vaughn index or privilege log formats).

1.1.10.6.1 End-users must be able to configure what fields to include in index, log or load file. User configurations should be saved and re-usable with in a case and across multiple cases.

1.1.10.7 Be capable of producing load files with limited redaction codes implemented (i.e., specify that only redactions with certain redaction codes be burned-in for production).

1.1.10.8 Allow users to configure the appearance of redactions.

1.1.11 Additional General Solution Requirements

The Contractor shall provide additional support as follows:

1.1.11.1 Tool(s) must be Americans with Disabilities Act (ADA) Section 508 compliant.

1.1.11.2 Provide external media to ship data to Treasury personnel or third parties as specified by end-user.

1.1.11.2.1 Data must be encrypted and shipped to the specifications as detailed by the Treasury. A minimum of FIPS 140-2 validated encryption shall be applied to all data stored on external media.

1.1.11.3 Receive and utilize data on external media shipped from the Treasury or third parties to load to system.

1.1.11.3.1 Data must be encrypted and shipped to the specifications detailed by the Treasury. A minimum of FIPS 140-2 validated encryption shall be applied to all data stored on external media.

1.1.11.4 Collect ESI directly from online repositories and content providers.

1.1.11.5 Produce ESI directly to online repositories.

1.1.11.6 Browser-based, browser-agnostic user interface.

1.1.11.7 Support for multiple browser windows/screens (e.g., viewer image on one screen, user workspace on another).

1.1.11.8 User interface functionality on the SaaS solution shall be customizable by bureaus/office workspace, case types, requester profile, reviewer profile, or reviewer status (with multiple interfaces available for different types of users in a single case or across cases). The SaaS solution shall also provide the ability to clone/copy case/request data set or subset of case/request data. The existing solutions at minimum are expected to provide customizability by case and by reviewer status.

1.1.11.9 All tools supplied by Contractor must be able to report usage, data processing, error identification and activities as specified by Treasury personnel.

1.1.11.10 Permit customized scripting produced by the Treasury or by the Contractor.

1.1.11.11 Ability to handle deposition or transcripts, including:

1.1.11.11.1 Boolean searching and search result highlighting/tagging/reporting.

1.1.11.11.2 Transcript redaction capability.

1.1.11.11.3 Linking transcripts to exhibits or other documents in the collection.

1.1.11.11.4 Creating word indices/concordances.

1.1.11.12 The SaaS solution shall have the ability to export, or link specified documents, transcripts and excerpted text from documents or transcripts to LexisNexis CaseMap, Microsoft OneNote, or any similar applications. The existing solutions at minimum are expected to support LexisNexis CaseMap and Microsoft OneNote.

1.1.11.13 Agency technical personnel must be able to remotely manage processing and administrative functions in the tool, as well as have the option to utilize Contractor personnel to do so at the agency’s discretion.

1.1.11.14 Produce documentation to support Treasury’s use of Contractor’s capabilities. Of the below documentation, the existing solutions shall at minimum have process manuals and user guides.

1.1.11.14.1 Process Manuals: these documents will provide specific instructions on all processes needed to utilize the capabilities provided by Contractor.

1.1.11.14.2 System Administration, Power User, End-User Guides: these documents will be distributed to all Treasury system support users/power users/end users and will serve as an internal guide.

1.1.11.15 Support by contributing information and documentation for security and integration processes as required by Treasury IT to incorporate capabilities into enterprise architecture.

1.1.11.16 Must have ability to support high volume bulk data transfers to and from the Treasury to the Contractor’s systems.

1.1.11.16.1 A solution ready to use (such as being a Netbond partner or Netbond-compatible connection) by end of phase-in period is preferable but must be able to support this requirement before the start of option year one.

1.1.11.17 Must have ability to support Treasury user traffic to and from platform and tools systems. The SaaS solution shall have the ability to support user traffic across all Treasury bureaus and offices.

1.1.11.17.1 A solution ready to use (such as being a Netbond partner or Netbond-compatible connection) by end of phase-in period is preferable but must be able to support this requirement before the start of option year one.

1.1.11.18 Ability to communicate directly (or through end-user’s browser interface) with printers established in Treasury’s environment and allow scanning and printing of individual or batches of documents at the end-user’s discretion. The existing solutions shall at minimum allow printing of documents at the end-user’s discretion.

1.1.11.19 Ability to save exported ESI directly (or through end-user’s browser interface) on network storage established in Treasury’s environment and allow saving of individual or batches of documents at the end-user’s discretion.

In addition, the tool(s) used by or provided by the Contractor shall meet the following requirements:

1.1.11.20 Tool(s) should have an existing or planned functionality able to accomplish the following tasks:

1.1.11.20.1 Handle Electronic Discovery Reference Model (EDRM) collection phase for unstructured native files from any Treasury location.

1.1.11.20.1.1 Same tool(s) should be implementable in a hybrid solution consisting of both a Treasury-managed on-premises solution (for collection and initial processing of Treasury-hosted ESI) and a SaaS vendor-managed/hosted environment (for processing/review/analysis/production).

1.1.11.20.1.2 Integrate with agency’s current collection and processing tools in either hybrid on-premises/hosted or full hosted SaaS environments.

1.1.11.21 Ability to add other integrated third-party or SW developer enhancement modules to base tool(s) at request of agency. Desired future add-on functionality, in addition to collection feature noted above, includes integrated module(s) that allow end-user information disclosure specialists/attorneys to manage records and legal holds within a tool capable of implementing

1.1.11.21.1 Legal holds by technical tagging of custodian-based ESI in Treasury-hosted Active Directory environment.

1.1.11.21.2 Either natively or through an integrated add-on module, must have the ability to support processing, indexing, automated transcription, and searching of audio and video files. The existing solutions shall at minimum support audio files.

1.1.11.21.3 Either natively or through an integrated add-on module, must have functionality that supports processing and review of other non-text file types/multimedia files; processing and review of messaging platform content; processing and review of mobile device ESI (e.g., from Cellebrite collection); processing and review of web or social media ESI analysis. The current solution is not required to support multimedia files.

1.1.11.22 Ability to import and export ESI and work product from one or more commercially available specialized eDiscovery/FOIA review and administration/reporting platforms (bidder should list all such platforms with which the tool(s) can interoperate). The current solution shall at minimum be interoperable with specialized FOIA review platforms.

1.1.12 Reporting Requirements

The below reporting requirements apply to both current and future SaaS solutions, unless noted otherwise. The SaaS cloud solution shall provide robust reporting functionality to support eDiscovery/FOIA compliance, oversight, and operational accountability.

1.1.12.1 Reporting

1.1.12.1.1 The system shall generate prepopulated Annual and Quarterly Reports by gathering required data across the enterprise into a single reporting product.

1.1.12.1.2 Reports must require minimal data cleanup and user input.

1.1.12.1.3 The system shall provide an existing option or planned capability for integration with external and internal systems via API

1.1.12.1.4 Users shall have the ability to export both raw data and the final report for posting on internal and external systems.

1.1.12.2 Bureau and Office Accountability Reports

1.1.12.2.1 The Office of General Counsel (OGC) and FOIA managers within the Bureaus and in Departmental Office (DO) shall have the ability to generate audit and accountability reports to monitor the work of employees.

1.1.12.2.2 Reports shall track case assignments by employee and provide a wide range of reportable information, including but not limited to:

· eDiscovery/FOIA case number,

· Case Description,

· FOIA Description to omit PII data if applicable

· Date requested received, created, perfected, assigned, closed, etc.

· Received Method

· Request status within the process (i.e.: received, perfected, documents uploaded for redaction, under review, documents delivered, closed, etc.) includes detailed internal statuses and sub-statuses, while only a simplified, controlled subset is made visible to the public based on defined visibility rules,

· Backlog status,

· Categorization (simple or complex, or other categories defined by Treasury),

· Request type (Litigation, FOIA, Privacy, FOIA/Privacy, Consultation, Appeal, etc.),

· Notes or flags applied,

· Requester name and organization,

· Payment method and amount if applicable

· The Future state SaaS solution should also provide a customizable dashboard for displaying this information.

1.1.12.3 System Audit and Security Reporting

1.1.12.3.1 The eDiscovery/FOIA system shall automatically create an audit trail at both the request level and user action level, capturing actions made within the system.

1.1.12.3.2 The future state SaaS eDiscovery/FOIA system shall also capture and report user logins, filterable by bureaus/offices, date and time ranges or other data points as required by Treasury.

1.1.12.3.2.1 The existing solutions shall capture system logins by users that can be limited to certain dates and times including the method of authentication used to login into the system.

1.1.12.4 Ad Hoc and Customizable Reporting

1.1.12.4.1 The system shall allow employees at various levels of the organization to generate ad hoc customizable request reports, offering a wide range of reportable data fields covering processes at both the individual request level and across the enterprise. All work processes performed in the system must be trackable and reportable.

1.1.12.4.2 Users shall be able to create templates of commonly used reports.

1.1.12.4.3 Users shall be able to schedule reports for automatic generation and delivery at defined times.

1.1.12.4.4 The system shall allow report template permissions to be limited or expanded based on a user’s role.

1.1.13 eDiscovery/FOIA Platform Security Controls

The system shall implement security controls that align with Treasury, federal, and industry standards to protect sensitive data, ensure accountability, and maintain compliance.

1.1.13.1 Authentication and Identity Management

1.1.13.1.1 The system shall align with Treasury’s Authentication Structure requirements.

1.1.13.1.2 The system shall use the enterprise PIV/single sign-on for internal user authentication, eliminating the need for separate login/passwords and providing IAL3.

1.1.13.1.3 The system shall leverage third-party identity proofing tools (e.g., ID.me, Login.gov) on the public portal, including IAL1 (e.g., FOIA requests) and IAL2 (e.g., FOIA/Privacy (PA) requests) connections where needed.

1.1.13.1.4 The system shall enhance user experience by providing multi-factor authentication (MFA) for both internal and external portals, with phishing resistance and identity proofing features when applicable.

1.1.13.2 Access Control and Security Roles

1.1.13.2.1 The system shall implement security controls and access management protocols to ensure that access to records is restricted to individuals with a documented need-to-know, commensurate with the sensitivity of the information. Access authorizations shall be configurable and enforceable at the bureau and DO level and may be managed on a case-by-case basis in accordance with Treasury security and privacy policies.

1.1.13.2.2 The system shall provide access controls at the workgroup level, allowing users to be members of multiple workgroups. Tools must allow customized permissions or standardized templates for processing, review, and production activities.

1.1.13.2.3 The system shall provide multi-level security roles (e.g., Admin, Attorneys, FOIA/Disclosure Manager, FOIA/Disclosure Specialist/Caseworker, Analyst, Record Custodian, Legal, etc.).

1.1.13.2.4 The system shall maintain and export user validation information such as last login, roles granted, name, SEID, and account status.

1.1.13.2.5 The system shall allow Treasury technical and application support personnel sufficient access to perform remote processing, ingestion, production, and export.

1.1.13.2.6 The system shall provide the ability to lock final redactions on documents approved for release. Once locked, only users with specific role-based permissions may adjust redactions.

1.1.13.3 Audit and Monitoring

1.1.13.3.1 The system shall provide audit capability by capturing system events, creating logs based on specific user actions, and exporting audit logs daily in XML format for external review.

1.1.13.3.2 The system shall integrate with Cybersecurity monitoring tools (e.g., Splunk or equivalent). The integration includes developing a solution for exporting and ingesting data into Treasury’s Cyber Risk Management tool/dashboard. The (future state SaaS solution only). For the existing solutions, the integration must include ingesting and presenting data into Splunk or Cyber Security tools.

1.1.13.3.3 The system shall provide reporting capability and full audit trails of reviewer and administrator activity, including retrievable user search and result histories.

1.1.13.4 Compliance and Standards

1.1.13.4.1 The system shall comply with all Treasury standards.

1.1.13.4.2 The system shall be at minimum a FedRAMP Moderate and FISMA compliant at the time of proposal submission.

1.1.13.4.3 The system shall achieve compliance with externally hosted computing standards as defined by Treasury Cybersecurity.

1.1.13.4.3.1 Additional Security requirements are covered under Program Security Management, Helpdesk Support, and System Operation & Maintenance and Continuous Monitoring sections.

1.1.13.5 Integration and Administration

The system shall provide an Application Programming Interface (API) or equivalent integration method for use by administrative staff. This API is to integrate with required systems by Department of Treasury including Pay.gov, FOIA.gov, Splunk, Records Management, Data Center, etc.

1.1.14 eDiscovery/FOIA AI - Shared Future State Specific Requirements

This section outlines requirements that are shared between eDiscovery and FOIA but are only expected to be available in the future state SaaS solution. The Contractor shall provide an AI-enhanced FOIA and eDiscovery solution that improves the speed, accuracy, compliance, and forensic defensibility of processing and reviewing ESI. The solution must assist with automation, classification, redaction, privilege review, and data analysis, while complying with all applicable federal data privacy and security regulations.

1.1.14.1 eDiscovery Intelligence

1.1.14.1.1 Use AI/ML to prioritize documents for human review based on relevance scoring (predictive coding/technology-assisted review).

1.1.14.1.2 Identify near-duplicates, email threads, conversation patterns, and concept clusters.

1.1.14.1.3 Detect potentially privileged or confidential material using natural language processing (NLP).

1.1.14.1.4 Maintain audit trails and logs of AI-assisted decisions for defensibility in court or administrative review.

1.1.14.2 FOIA Automation

1.1.14.2.1 Automatically extract metadata and context from uploaded files, email threads, and document collections.

1.1.14.2.2 Recommend responsive records automatically, based on learned FOIA criteria and historical decisions, with human analyst review prior to release.

1.1.14.2.3 Apply intelligent redaction suggestions for PII, CUI, and FOIA exemptions.

1.1.14.2.4 Provide adaptive workflows to segment FOIA and Privacy Act requests.

1.1.14.2.5 Summarize documents and flag high-priority or time-sensitive content.

1.1.14.2.6 Summarize case narrative and proposed release packages. The package includes timeline reconstruction capabilities across case correspondence, analyst notes, determinations, and response artifacts to support appeals processing, litigation readiness, and quality assurance reviews.

1.1.14.2.7 Automated identification of high-frequency, high-similarity, or high-likelihood of request topics

1.1.14.2.8 Establish an internal, AI-powered FOIA Knowledge Assistant to support FOIA staff by providing accurate policy-grounded responses to procedural, legal, and operational questions. The tool should be integrated with FOIA SOPs, guidance documents, training materials, and relevant memoranda, and explicitly constrained to prevent hallucination or speculative responses.

1.1.14.2.9

1.1.14.3 Automated Redaction and Exemptions

1.1.14.3.1 Ensure redactions are permanent, auditable, and Section 508 compliant.

1.1.14.3.2 Support redaction across all file types (text, Microsoft office files, image, audio, video, forensic images).

1.1.14.3.3 Recommend FOIA exemption codes for flagged content, with human validation.

1.1.14.3.4 Export clean, working, and final redacted files in DOJ/NARA-compliant formats.

1.1.14.4 Multimedia and Forensic Evidence Processing

1.1.14.4.1 Provide OCR for scanned or handwritten content.

1.1.14.4.2 Provide speech-to-text transcription for audio and video, with synchronized redaction capability.

1.1.14.4.3 Support image and video recognition to detect sensitive elements (faces, signatures, objects).

1.1.14.4.4 Ingest and analyze forensic images (e.g., EnCase, mobile device collections), logs, and digital artifacts.

1.1.14.4.5 Detect and surface deleted or hidden files, anomalous activity, and metadata irregularities.

1.1.14.5 Learning, Explainability, and Defensibility

1.1.14.5.1 Improve accuracy over time via supervised and unsupervised ML.

1.1.14.5.2 Allow Treasury users to train AI models using Treasury data.

1.1.14.5.3 Ensure AI features are explainable and interpretable per NIST AI RMF and OMB M-22-09.

1.1.14.5.4 Provide rationale, evidence highlights, and citations to support defensibility in audits, litigation, or appeals.

1.1.14.6 Technical Requirements

1.1.14.6.1 Operate within the eDiscovery/FOIA environment.

1.1.14.6.2 Be hosted in Azure Government, AWS GovCloud, or Treasury-approved equivalent.

1.1.14.6.3 Support ingestion from M365 GCC sources (Exchange, SharePoint, OneDrive, Teams, Slack, etc.).

1.1.14.6.4 Integrate with Treasury-approved document and records management systems.

1.1.14.6.5 Ensure redaction tools meet DOJ and NARA standards for FOIA compliance.

1.1.14.7 Security and Compliance

1.1.14.7.1 Comply with NIST SP 800-53r5 (AC, AU, IR, SC, SI families).

1.1.14.7.2 Enforce role-based access control (RBAC) and multi-factor authentication (MFA).

1.1.14.7.3 Support labeling and tagging of CUI, PII, SBU, and FOIA exemptions.

1.1.14.7.4 Maintain logs of AI decision-making for audit and chain-of-custody tracking.

1.1.14.7.5 Ensure all AI outputs, training data, and logs remain in Treasury-controlled environments.

1.1.14.8 Deliverables and Timelines

1.1.14.8.1 Provide an operational AI-enabled FOIA/eDiscovery system within the 6 months of the base year award.

1.1.14.8.2 Provide AI model documentation and explainability reports.

1.1.14.8.3 Deliver monthly AI performance and audit reports.

1.1.14.8.4 Baseline AI functionality shall be fully available at the time of contract award.

1.1.14.8.5 Any additional AI development needed to meet these requirements shall be delivered within (12) months of the base year award.

1.1.14.8.6 The Contractor…