Taxonomy RFI.pdf

TAXONOMY SERVER

REQUEST FOR INFORMATION (RFI)

Synopsis

Objective

Background

Required System Components & General Functions

Requirements for Specific Tasks & Components

Vendor Responses Requested

Point of Contact for Inquiries and Submissions:

Response Submission Deadline:

DISCLAIMER

Government Accountability Office Taxonomy Server

Request for Information (RFI)

GAO RFI #: RFI-000

Synopsis

The U.S. Government Accountability Office (GAO), is issuing this Request for Information (RFI) as a means of conducting market research (including cost estimates) to identify eligible parties. The eligible parties should have an interest in and the resources to support and furnish effort including labor and services that will be delivered as a web-based, commercial-off-the-shelf, managed services product in a secure cloud environment that is designed and configured within the continental United States for the GAO.

The Contractor supporting GAO shall follow the Federal Information Security Modernization Act of 2014 (FISMA) and, at a minimum, shall offer an IT solution that is compliant with the legislation’s Agency Program requirements. The Contractor shall incorporate both industry and federal government best practices and standards with the proposed solution.

This is a RFI only and does not constitute a commitment, implied or otherwise, that GAO will take procurement action in this matter. Further, neither GAO nor the Government will be responsible for any cost incurred in furnishing this information.

Objective

Procure a product that will provide a reliable taxonomy server to aid GAO’s taxonomy program in the implementation and management of proper taxonomies across the GAO landscape. This software will replace current infrastructure and allow for the growth, expansion and innovation of existing and new libraries. GAO anticipates a successful vendor with a compatible product can be found in the commercial market place.

Background

GAO is an independent agency that functions as the investigative arm of the United States Congress. As part of its investigatory function and at the request of the US Congress, GAO analyzes and evaluates executive branch agency programs.

As part of its publishing process, GAO assigns both high-level topics and more specific taxonomy terms to GAO reports and testimonies. GAO also foresees creating additional taxonomies to categorize legal products, multimedia, and internal documents, among other collections.

The Center for Library Science (CLS), Applied Research and Methods (ARM), Government Accountability Office (GAO), is the business owner of GAO’s taxonomy program. The Center for Library Science requires a commercial off-the-shelf (COTS) taxonomy system. This requirement also includes the need for the migration of data into the new system and then on-going support and maintenance of the COTS system.

The following is a profile of the GAO’s current taxonomy environment:

Currently, GAO’s taxonomy program supplies information to the Product Metadata Repository, which supports discoverability of GAO products on GAO.gov. Our current taxonomy server is the 2012 version of SAS Enterprise Content Categorization (ECC). The taxonomy server runs its rules against the full text of GAO products and suggests terms to GAO contract staff. Staff then assign terms to products based on those suggestions.

Updates to the rules running has not occurred for three years due to lack of product support from the vendor. The taxonomy is also in a non-WC3 standard form, which makes it difficult to export and share with W3C compliant platforms. A new taxonomy is being designed in Microsoft Excel with the intention it will be ingestible into a new taxonomy system.

Required System Components and General Functions

GAO requires the following high-level components and functionality:

A. Taxonomy Server and System Components

A.1 This taxonomy server and system component must comply easily integrate with other systems as described below:

A.1.1 The system must provide REST or SOAP web services.

A.1.2 The system must provide a database level API for integration into GAO internal systems and externally facing applications.

A.1.3 The taxonomy system must have a mechanism for accepting term suggestions and revisions through another system through web-based survey forms.

A.2 The system must be compliant with ANSI/NSIO Z39.19 and/or ISO 25964.

A.3 The system must use W3C standards for creating and editing taxonomies.

A.4 The system must have the ability to model vocabularies in SKOS and/or RDF.

A.5 The system modeling of ontologies must use OWL for its standard.

A.6 The system must meet the below accessibility standards as described below:

A.6.1 ISO/IEC 40500

A.6.2 W3C Web Content Accessibility Guidelines (WCAG) 2.0 Level AA

A.6.3 W3C Web Content Accessibility Guidelines (WCAG) 2.1 Level AA

A.6.4 Applicable revised Section 508 Standards

A.7 The taxonomy system must accept and output a variety of file formats as described below:

A.7.1 Import formats must include: .csv, .txt, RDF, SKOS

A.7.2 Export formats must include: .csv and/or .txt

A.7.3 Export formats must include: RDF (RDF/XML or Turtle serialization ) and/or SKOS format

A.8 The taxonomy system must support a robust and flexible yet straight-forward system for assigning roles and permissions to staff functions as described below:

A.8.1 The system must allow creation of at least five (5) user accounts that allow for the permission levels below:

A.8.1a The system must allow permissions assignment at the term level.

A.8.1b The system must allow at least these permissions levels:

A.8.1c Read-only access

A.8.1d Comment only access

A.8.1e Editor access

A.8.1f System administrator access (control for all system permissions)

A.9 The taxonomy system must be flexible for various knowledge organization and representation schemes’ creation, revision, and management as described below:

A.9.1 Controlled vocabularies

A.9.2 Taxonomies

A.9.3 Thesauri

A.9.4 Named entity lists

A.10 The system must have the following features for term and concept creation and revision:

A.10.1 Creation of unique identifiers for all concepts.

A.10.2 Ability to develop a concept’s properties, labels, and relationships from a single screen

A.10.3 Ability to edit hierarchies with drag-and-drop

A.10.4 Ability to create poly-hierarchical structures (multiple inheritance)

A.10.5 Ability to create global edits, across taxonomies, to:

A.10.5a Concept attributes

A.10.5b Concept relationships

A.10.6 Ability to browse records:

A.10.6a Alphabetically

A.10.6b Hierarchically

A.10.6c Chronologically (Date created and Date last edited)

A.10.6d Ability to search and filter records by:

A.10.6e Keywords (exact, fuzzy or phrase searching)

A.10.6f Approval/review status

A.10.6g Date created and/or modified

A.10.6h Preferred/non-preferred term status

A.11 The system must have automatic mechanisms for:

A.11.1 Prevention of term duplicates (disambiguation)

A.11.2 Reciprocal relationships

A.11.3 Prevention of circular references

A.11.4 Prevention of non-preferred terms from hierarchical and associative relationships

A.11.5 Detection of orphan terms

A.12 The system must manage the quality control, production, and archival versions of vocabularies or collections of vocabularies.

A.13 The taxonomy system must be integrated with an auto-categorization mechanism to classify documents with terms stored within it as described below:

A.13.1 The taxonomy module and the auto-categorization module must be preconfigured to be integrated when the software is implemented.

A.13.2 The auto-categorization module must provide relevancy scoring for terms present in the taxonomy module as follows:

A.13.1a The scoring must be provided on both an individual document and multiple document basis.

A.13.1b Users must be able to select tagging for documents based on the scoring provided.

B. Auto-Categorization Components

B.1 This auto-categorization component must meet the requirements listed below:

B.1.1 The module must have a mechanism for writing classification rules with:

B.1.1a Boolean logic (AND, OR, NOT);

B.1.1b Proximity (x within # words of y);

B.1.1c Truncation/wildcards (crim* for crime, criminal, etc.); and

B.1.1d Regular expressions.

B.2 The module should offer at least one preloaded statistical models for classification and include the following documentation:

B.2.1 How the classifier was trained;

B.2.2 Its prediction statistics;

B.2.3 The ability of the model to be retrained with additional data

Requirements for Specific Tasks and Components

A. Transition to New System

As GAO migrates from its current taxonomy server, the vendor shall provide the following to facilitate the transition:

A.1 The vendor shall supply the name and contact information for a dedicated point of contact for customer service and technical issues (Technical POC) within 2 business days of signing the contract. The Technical POC must provide a non-automated response within 1 business day after being contacted with an issue during the first 3 months of the contract or until the migration is successfully completed.

A.2 The vendor shall provide written system documentation, describing all functions of all modules included in the software as configured for GAO.

A.3 The vendor shall provide initial training to the GAO taxonomy team that will cover all aspects of the system.

B. System Architecture and Security

The system must meet the security requirements listed below:

B.1 All information entered into the system by GAO is to be owned by GAO. GAO retains the right to export, import, alter, and back-up data while using the software.

B.2 The vendor must adhere to records requirements, as detailed by GAO Privacy Program Order, 0450.1, GAO Records Management Program Order 0410.1 and GAO’s Records Retention Schedules.

B.3 The vendor shall allow on-site access to the data center where the system is hosted upon request by authorized representatives of GAO in order to observe security measures in place at the data center. The system must adhere to leading privacy practices including requirements in the Privacy Act of 1974 and GAO’s Privacy Program Order, 0450.1.

B.4 All components must run at a 98.5 percent uptime (down no more than 10 hours, 57 minutes and 26 seconds monthly).

B.5 Web-based interfaces must be used for all administrative functions.

B.6 The proposed solution shall not require any software to be installed locally on GAO machines.

B.7 The system must meet security standards as described below:

B.7.1 A minimum, a FIPS 199 Moderate impact Federal Risk and Authorization Management Program (FedRAMP) certified Software-as-a-Service (SaaS) or Platform-as-a-Service (PaaS) solution with a current security assessment report (SAR) that includes a recommendation to authorize/re-authorize the system. If not FedRAMP-certified, the system shall be in compliance and in alignment with the National Institute of Standards and Technology (NIST) standardized security assessment, authorization, and continuous monitoring standards and guidelines.

B.8 The vendor shall ensure that GAO has an opportunity to review the FedRAMP or NIST artifacts, to include the vendor’s current IT security white papers/documentation, that support the solution’s overall security posture, to include its infrastructure, platform, and software components, at the time of the award. The IT security documentation should include information such as access controls, authentication, boundary protection, change management, customer segregation, encrypted data transmission capabilities, log management, restricting website access, security monitoring, among other security capabilities.

B.9 The vendor shall provide access to GAO, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. GAO reserves the right to conduct on-site inspections. The vendor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

B.10 The system shall provide an automated mechanism to collect log files (including syslogs, Apache logs, etc.) for security and other analysis purposes. The vendor shall ensure that the automated mechanism allows GAO to periodically review the logs.

B.11 The vendor shall have an incident/breach notification process that will ensure that GAO is notified within an agreed upon timeframe consistent with federal government guidance.

B.12 The vendor shall be prepared to discuss the feasibility of giving GAO the ability to monitor GAO’s hosted environment using a Cloud Management Platform service.

B.13 The vendor shall maintain all of GAO’s data, to include backup data, within the continental United States. The staff managing the data and/or systems maintaining GAO data shall be employed within and working from a system that is within the continental United States and should be United States citizens or current permanent residents.

B.14 The vendor shall implement a catastrophic/disaster failover capability to ensure that the high availability requirement of the system is achieved. The failover site shall be geographically disparate from the primary production location such that loss of the primary production location or functionality does not prohibit the use of the system. The failover site must be in the continental United States.

B.15 The vendor shall deploy strong end-to-end application layer cryptographic mechanisms that are compliant with the current Federal Information Processing Standards Security Requirements for Cryptographic Modules, level 2, at a minimum. The mechanism shall protect customer PINs, user passwords and other sensitive data in the network and data at rest.

B.16 The vendor shall encrypt customer account and transaction data which is transmitted, transported, delivered or couriered to external parties or other locations, taking into account all intermediate junctures and transit points from source to destination.

B.17 The vendor shall require all employees who will have access to GAO data, the architecture that supports GAO data, or any physical or logical devices/code to pass the appropriate background investigation required by the Government in compliance with HSPD -12.

B.18 The system shall provide security and privacy that are consistent with the NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing.”.

B.19 The system shall be able to support the establishment of a virtual private network between GAO and the FedRAMP-certified system.

B.20 The system shall authenticate users through single sign on (SSO) using Active Directory Federation Services (ADFS) or through an agreed upon multi-factor authentication mechanism.

B.21 The vendor shall provide access to GAO, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. GAO reserves the right to conduct on-site inspections. The vendor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

B.22 The vendor shall ensure that its environment remains compliant with the control standards of Federal Information Security Modernization Act of 2014 (FISMA), the current NIST standards in FIPS 140-2 or 140-3, FIPS 199, FIPS 200, FIPS 201 and current NIST Special Publications 800-37, 800-53, 800-60, 800-61, 800-70, 800-144, and 800-163. In addition, the Vendor must provide GAO with any documentation it requires for its security-related reporting requirements within 10 days of a request.

C. Support and Maintenance

C.1 The vendor shall provide live customer support (through telephone or real-time chat) every business day from 8:00 AM to 6:00 PM ET. This will entail intake of content errors and basic technical support issues. A ticketing process is required for tracking reported issues through the entire problem life cycle.

C.2 The vendor shall regularly enhance the products based on customer input and industry changes.

C.3 The vendor shall provide training in all aspects of the system as needed.

C.4 The vendor shall provide all updates to the system without further costs to the agency.

C.5 The vendor shall provide advance notice, of two business days, of any updates that shall require an interruption of service.

D. Implementation and Migration Services

D.1 The vendor shall provide support, for transitioning between the legacy data structures and processes and the new vendor’s data structures and processes. This support includes developing, testing and documenting of APIs or other data delivery structures for intake into GAO’s systems and developing, testing and documenting of workflow for inputting data into GAO systems.

D.2 The timeline for implementation shall be (3) months from the date of the contract signing.

Security All technical interaction with GAO infrastructure must be through Federal RAMP certified systems and software and/or systems compliant with ISO Standard 27001.

Physical Security:

The vendor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

Vendor Responses Requested

Disclaimer: This information is for GAO internal planning purposes only. All interested organizations are invited to respond. Please provide responses to the following statements and/or questions and organize your responses accordingly.

RFI responses must include:

· Name of Company

· Point of Contact for the response with Title/email/phone

· Be specific in your response about how your solution meets with reference to the requirements stated above.

· Include estimated price for providing this solution.

· Include if your solution is available open market and/or via a Government-wide

Acquisition Contract (GWAC) such as GSA, NASA SEWP, NITAAC, etc.

Vendor Responses are due no later than March 11, 2022 by 1:00 pm Eastern Time (ET).

Point of Contact for Inquiries and Submissions:

All inquiries regarding this RFI must be directed to Mr. Glenn Hamilton, Contract Specialist, via email to HamiltonGE@gao.gov, with “Taxonomy Server RFI ” in the subject line. Inquiries must be received no later than February 25, 2022 at 1:00 p.m. ET. Responses to all inquiries received by this deadline will be posted electronically and made publicly available at sam.gov

An email confirmation of receipt from GAO will be sent within a one-week period to the designated point of contact.

No solicitation exists; therefore, do not request a copy of the solicitation. If a solicitation is released, no decision where it will be published/synopsized. It is the responsibility of potential offerors/bidders to monitor these sites for the release of any solicitation or synopsis.

DISCLAIMER

GAO will not publicly disclose proprietary information obtained as a result of this RFI.

To the full extent that it is protected by law and regulations, information identified by a respondent as Proprietary or Confidential will be kept confidential.