SATPC0038668 Tab 04 SOW.pdf

STATEMENT OF WORK

Legal Files Software 06/18/2025

1. Objective/Requirements

Legal Files is an electronic software/platform that all OGC attorneys and legal professionals in the NASA legal offices currently use to provide legal services to the Agency.

2. Characteristics, Scope, and Specs

• The Contractor shall provide an uninterrupted access to the currently used Enterprise-level Legal Document Management and Case Management (“System”) using the Legal Files software for 210 user licenses.

• The Contractor shall provide user license/seat, annual maintenance and support, including patches and upgrades.

• The Contractor shall provide an ongoing maintenance, security patches, and vendor upgrades to assure the currency, security and interoperability of the System as necessary.

• The System shall provide a means for storing documents in a secure environment with access controls and document governance features. These features should include the capacity to track and edit metadata, limit access to specific users and groups across NASA legal offices, track document versions, and apply retention policies.

• The System shall provide a means for profiling and searching documents across NASA legal offices. The System should provide common search capabilities such as searching by full text, title, date, or category. The System should be capable of working with common electronic file formats such as Microsoft office products, .pdf, e-mails.

• The System shall provide a means for organizing documents by an Agency determined taxonomy or taxonomies, such as by case type or case identifier.

• The System shall record and track, at a minimum, the following document metadata:

document origin date, document origin (NASA center), all subsequent authors of the document, document file type (e.g. .doc, .pdf) as well as allow the addition of custom metadata fields.

• The System shall have the ability to create and track various legal actions with regularly updated and pre-populated rulesets to automatically calculate due dates.

• The System shall have the ability to create and track custom user actions (e.g. internal agreement/contract reviews with specified deadlines).

• The System shall have the capacity to generate custom reports on tracked legal and custom user actions based on fields such as due date and action assignee.

• At minimum, the System shall support Windows and MAC OS, and browser configuration requirements for NASA approved Desktop Operating Systems as referenced in NASA-STD-2804.

• The System shall integrate with NASA electronic authentication (eAuth) due to management of International Traffic in Arms Regulations (ITAR), Sensitive But

Unclassified (SBU), Personally Identifiable Information (PII), Export Control, and sensitive proprietary content and data. To meet this requirement, the system solution must support third-party Single Sign On (SSO) without enforcing local application login or Lightweight Directory Access Protocol (LDAP) authentication (username + password).

• The System shall capture non-modifiable audit logging for all pertinent actions, including system access, record access, data export, data import, and record modification. Audit data shall be provided to a NASA approved Security Information and Event Management (SIEM) solution (e.g. encrypted syslog) and capture user and application access including but not limited to success or failure, date/time, and source per NIST 800-53 AU controls.

• If the System is web enabled, then it shall utilize Hyper Text Transfer Protocol Secure (HTTPS) with Secure Sockets Layer / Transport Layer Security (SSL/TLS) certificates and Internet Protocol version 6 (IPv6) addresses for any data in transit (data moving between networks, e.g. between a browser and websites).

• The System shall integrate with leading office productivity software including at a minimum Microsoft Office 365.

• The System shall integrate with NASA’s Access Management solution using SAML 2.0 consistent with the FICAM Web SSO Profile (https://www.idmanagement.gov/wpcontent/uploads/sites/1171/uploads/SAML20_Web_ SSO_Profile.pdf). As part of this integration, the system shall support AES-256 encryption of the SAML response (e.g. attribute, assertion, and name_id), a SAML configuration method for updating certificates between the identity and service providers without a manual key exchange, and SHA-2 certificates for any related function (e.g.

SAML signing and SSL). The System shall also support session synchronization between the client software solution (agents / SAML) and the authentication source to facilitate single sign on sessions.

• The System shall be compliant with DHS Binding Operational Directive 18-01 (HSTS).

• The System shall implement multifactor authentication, using approved NASA

Smartcards, for network, local and remote access to privileged and non-privileged accounts.

• All cryptographic modules implemented or relied upon by or within the system shall be compliant with evaluation and approval requirements outlined in FIPS140-2. The System shall encrypt Controlled Unclassified Information (CUI), which encompasses PII data, as “data-at-rest” for data stored in databases, data warehouses, data on a hard drive, USB drives, spreadsheets/documents, archives, tapes, off-site backups, mobile devices, etc.

“Data-in-transit” shall also be encrypted per FIPS 140-2. Additionally, NIST 800-122 addresses confidentiality of PII data.

• The System shall be able to operate in a manner complicit with security controls specified in NIST 800-53r4 for a FISMA Moderate rated system.

• The System shall be available at all times with the exception of scheduled system maintenance and patching activities. Core hours are 6:30 am Eastern to 6:30 pm Pacific with downtime less than 1% (<= 4 days/year total). In the event of an unscheduled outage, the system shall support a restore capability with minimal data loss (less than 4 hours) and a return to service after unexpected failure of 8 hours.

• The System should provide the capability to disable immediately accounts of users posing a significant risk in coordination with NASA policies and directives or after sixty

(60) days of inactivity.

• The Contractor shall provide conversion costs, professional technical consultant services, and maintenance or enhancements for implementation as needed.

3. Place of Performance

On-premise.

The Contractor shall provide the System for use by approximately 210 users located at NASA’s Office of General Counsel (OGC) at NASA Headquarters in Washington, D.C., and at the Office of Chief Counsel at each of the following NASA Centers:

Ames Research Center (Mountainview, CA) Armstrong Flight Research Center (Moffett Field, CA) Glenn Research Center (Cleveland, OH) Goddard Space Flight Center (Greenbelt, MD) Johnson Space Center (Houston, TX) Kennedy Space Center (Cape Canaveral, FL) Langley Research Center (Hampton, VA) Marshall Space Flight Center (Huntsville, AL) NASA Management Office at the Jet Propulsion Laboratory (Pasadena, CA) NASA Shared Services Center (Kiln, MS) Stennis Space Center (Kiln, MS)

4. Period of Performance

This period of performance will run from 08/12/2025 through 08/11/2026.

*OGC needs to renew current Legal Files contract for another year since all option years of the current BPA have been exhausted and the contract expires 8/11/2025.