USPTO Trademarks WordandImage Searching SOW_Clean 11.26.25.pdf

United States Trademarks Word and Image Searching Patent and Trademark Office Statement of Work

Form # USPTO-OP-020 (08/2020) Page 1 of 17

STATEMENT OF WORK (SOW)

Trademarks Word and Image Searching

Form # USPTO-OP-020 (08/2020) Page 2 of 17

Table of Contents

1. Trademark Background

2. Trademark Purpose

3. Scope of Project

3.1 Trademark Product Requirements

3.2 Transparent and explainable AI/ML

3.3 AI/ML-powered word and image search tool

3.3.1 Functional Requirements

3.3.2 Database Requirements/Functions

3.3.3 Imaging Requirements

3.3.4 Search Design Code Requirements

3.3.5 Launch Requirements

3.4 Additional Requirements

3.4.1 Transition In Plan

3.4.2 Transition Out Plan

3.5 Privacy Requirements

3.6 (SLAs)

4 Deliverables

5 Training

6 Metrics

7 Terms and Conditions on Privacy and Retention for Non-public Data Requirements

8 Vendor Point of Contact

9 Cybersecurity Requirements

10 Authority to Operate (ATO)

Form # USPTO-OP-020 (08/2020) Page 3 of 17

1. Trademark Background The United States Patent and Trademark Office (USPTO) is the Federal Agency for granting U.S. patents and registering trademarks. By granting patents, the USPTO fulfills the mandate of Article I, Section 8, Clause 8, of the Constitution that the legislative branch "promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries." The USPTO registers trademarks based on the commerce clause of the Constitution (Article I, Section 8, Clause 3). The USPTO carries out its mission by examining patent and trademark applications, issuing patents and registering trademarks, disseminating patent and trademark information to the public, and by encouraging a domestic and international climate in which intellectual property can flourish.

The USPTO is guided by the Trademark Act of the United States Code (15 U.S.C. §1052) which states in relevant part that: “No trademark by which the goods of the applicant may be distinguished from the goods of others shall be refused registration on the principal register on account of its nature unless it . .

. (d) Consists of or comprises a mark which so resembles a mark registered in the Patent and Trademark Office, or a mark or trade name previously used in the United States by another and not abandoned, as to be likely, when used on or in connection with the goods of the applicant, to cause confusion, or to cause mistake, or to deceive…”

Applicants have a duty under this to file applications that will not result in a likelihood of confusion with earlier effectively filed or registered marks and thus often utilize the USPTO’s online trademark search system which consists of all pending and registered trademarks to ‘clear’ marks and make sure that they will not cause a likelihood of confusion. Examining attorneys are charged with searching the same database to determine any likelihood of confusion for each application.

Trademark applications can seek registration for a variety of types of trademarks, including those that consist in whole or in part of pictorial elements. These are difficult to search effectively and efficiently in that each recognizable element must be coded using the USPTO’s Design Code Manual, which assigns a series of two-to-six-digit codes for each such element. Effective searching thus requires mastering the use of the design code field of the search system, which is difficult and time-consuming to learn properly.

Additionally, marks that contain non-Latin characters (all of which are treated as pictorial elements) are unnecessarily time-consuming to search because they are all currently coded under a single design code (28.01.03) regardless of whether they feature Arabic, Chinese, Korean or Japanese characters and regardless of their meaning.

Offering both external customers, and later, examining attorneys, a service whereby a variety of artificial intelligence (AI)/machine learning (ML) models can compare words and images against those that exist in the USPTO’s database of all pending and registered trademarks and return the most relevant will improve the quality of applications filed by saving applicants from receiving and examining attorneys from issuing likelihood of confusion refusals that can be avoided based on a good clearance search

Form # USPTO-OP-020 (08/2020) Page 4 of 17

2. Trademark Purpose The USPTO has determined there is a need to acquire capabilities for external customer performing clearance searches, and eventually examining attorneys working on trademark applications, to search words and images in the USPTO’s database of all pending and registered trademarks by using words and images as a query (hereinafter referred to as word and image searching) using AI/ML technologies. The USPTO conducted market research to assess the maturity of such technologies as they specifically relate to word and image searching for trademarks and assess vendor capabilities. The USPTO requires access to the vendor’s AI/ML-driven word and image searching tool to perform clearance searching for trademark applications. This tool does not replace any tools that USPTO currently provides to customers or examining attorneys.

The vendor must provide unlimited searches in the USPTO’s database of all pending and registered trademarks to support the USPTO’s requirements to allow applicants to perform clearance searches prior to filing trademark applications and eventually, to allow examining attorneys to conduct likelihood of confusion searches. The vendor must provide details on which capabilities of the tool are driven by AI/ML.

3. Scope of Project The vendor must provide USPTO a FedRAMP certified SaaS AI driven word and image search tool that is scalable. The vendor must operate and maintain the IT infrastructure necessary to meet security, performance, and compliance, and provide documentation to support training of USPTO users as set forth herein. The vendor must provide usage data and metrics to the USPTO.

Period of Performance

One 12-month base period and two 12-month option periods.

Anticipated start date of January 30, 2026.

3.1 Trademark Product Requirements

The vendor must provide access, search, and retrieval of information from the USPTO’s database of all pending and registered trademarks and make available through an API such that USPTO can integrate the results within the current user interface (UI) for trademark search that appears at https://tmsearch.uspto.gov/. Access must be controlled in accordance with USPTO policies and procedures. USPTO customers and eventually examining attorneys can search, retrieve, and save content provided by the AI/ML-powered word and image search tool in accordance with USPTO procedures.

3.2 Transparent and explainable AI/ML

As a federal agency, it is important for the USPTO to be able to explain all trademark prosecution decisions made. Because of this, solution capabilities must be transparent to the USPTO and as well as to the general public. The USPTO requires an AI/ML solution that complies with Executive Order (EO) 13960 and EO 14110 and deviations will not be accepted. The USPTO must be able to explain and generate a full and clear record to explain how prosecution decisions are made. Examination augmented by an automated decision process must therefore ensure full algorithmic transparency to ensure that any proposed algorithmic option is fully explainable, free of bias, and transparent to the public.

Form # USPTO-OP-020 (08/2020) Page 5 of 17

The vendor must furnish to the Contracting Officer (CO) any information pertinent to determining whether vendor's AI/ML capabilities are rights-impacting or safety-impacting. If the USPTO determines that vendor's AI/ML capabilities are rights-impacting or safety-impacting, the vendor must cooperate with the CO to help the USPTO comply with the provisions governing rights-impacting or safety-impacting

AI/ML.

3.3 AI/ML-powered word and image search tool

3.3.1 Functional Requirements

The tool compares uploaded words and images, with words and images in the USPTO’s database of all pending and registered trademarks and yields word and image results based on similarity and is sortable by similarity. The tool: uses a variety of AI/ML models in combination; is regularly benchmarked against newly developed AI/ML models; and regularly updates AI/ML models to include newly filed USPTO trademark applications.

3.3.2 Database Requirements/Functions

The available database includes access to the USPTO’s database of all pending and registered trademarks, including newly filed USPTO trademark applications, which are generally added on a daily basis.

3.3.3 Imaging Requirements

a) Upload a word/image view to the AI/ML search tool with user-controlled weighting of visual features on user defined critical view. The tool must further provide:

• An enhanced selection tool, or partial selection tool, of a word/image to identify specific visual features or region(s) within a source word/image to search. (i.e. lasso feature, automatic lasso based on input word/image outline).

• Words and images uploaded for query can be automatically lassoed to focus on the word and image outline and the lasso can be adjusted by the user. Areas outside of the lasso are not included in the query.

• Ability to quickly deselect a word/image in order to maintain efficiency by eliminating the creation of a separate, user-entered query and providing rapid re-ranking (re-sorting) of results.

• Acceptable word and image formats for uploading must include: to jpeg, gif, png, bmp, tif, pdf and similar type of software applications.

• Ability to recognize non-Latin characters and search those based on meaning as well as words and images.

• Ability to word and image search using natural-language text descriptions of words and images.

• Ability to recognize colors within a word/image and incorporate those in results based on parameters set by users.

Form # USPTO-OP-020 (08/2020) Page 6 of 17

• Ability to allow users to set personal preferences on the number of returns per page and visualization display of result set.

• Ability to capture and export search history with appropriate detail.

• Ability to provide options to filter results at least by status of application/registration at USPTO;

classification of goods; text of identification of goods/services; literal element, if any, in mark word/image; text of mark description, if any; filing date; publication date and registration date.

b) The tool provides word and image quality and resolution that matches source word and image data from USPTO’s database of all pending and registered trademarks.

3.3.4 Search Design Code Requirements

The tool must provide the ability to provide the design codes associated with a word/image from the Design Code Manual.

3.3.5 Launch Requirements

USPTO will release this tool to the public upon authority to operate (ATO) approval and then to the examining attorneys at a later date.

3.4 Additional Requirements

3.4.1 Transition In Plan

The vendor must provide a Transition In plan at least five business days before the kick-off meeting, which will be reviewed and updated by the COR.

The updated plan swill be finalized at the kick-off meeting and this SOW must incorporate the finalized Transition In plan.

The vendor must follow the procedure outlined in the Transition In plan as part of the service launch and obtain COR written approval prior to and after conclusion of the Transition In.

3.4.2 Transition Out Plan

The vendor must provide a Transition Out plan at least five business days before the kick-off meeting, which will be reviewed and updated by the COR.

The updated plan will be finalized at the kick-off meeting and this SOW must incorporate the finalized Transition Out plan.

The vendor must follow the procedure outlined in the Transition Out plan with written approvals from the COR prior to and after conclusion of the Transition Out phase of the service termination.

3.5 Privacyand Vendor Data Security Requirements

All vendor employees, including sub-vendors and 3rd party partners, that have access to USPTO data must be US. Citizens. Data received by the vendor from the USPTO cannot be used without USPTO Contracting Officer’s (CO’s) written consent identifying the specific information that will be used. Work by green card holders must only be performed in the CONUS.

Form # USPTO-OP-020 (08/2020) Page 7 of 17

The cloud service provider must host the tool within the United States.

Personal Identifiable Information (PII), Business Identifiable Information (BII), and other confidential data, belonging to USPTO must not be exported/transferred and used outside continental U.S.

3.6 Software as a Service Availability, Responsiveness, and Incident Service Level Agreements (SLAs) The vendor’s provided system must be accessed, and search results delivered via the Internet/Web. The system must allow for all USPTO licenses to access simultaneously. The system must be available 24 hours a day, 7 days a week except for allowed pre-scheduled maintenance performed between the period beginning Sunday 12:01 AM to 5:00 AM Eastern Standard Time or as approved by the USPTO COR. There must be no downtime during the “quiet period” of elevated USPTO activities, defined as September 1 through October 1.

The vendor must provide written reports regarding the vendor’s compliance with the service level agreement (SLA) specified for this system availability requirement. System Availability Service Levels and System Responsiveness Service Levels include the set of SLAs related to customer support provided by the vendor. The following minimum service levels are required. The Contractor must meet or exceed the following service support SLAs:

Service Level System Availability Service Level

Description Percentage of time which the vendors tool and portal/site is available with full/ally functionality as specified within the SOW and normal business operations can be carried out with no data loss, minimal downtime, or performance degradation.

Availability is defined as the time during which the vendor tool and portal/site is available with full/ally functionality as specified below and normal business operations can be carried out with no data loss, minimal downtime, or performance degradation.

Pre-scheduled downtime requirements

All pre-scheduled maintenance must be performed between the period beginning Sunday 12:01 AM to 5:00 AM Eastern Standard Time, or as determined by COR with a written approval notice.

Downtime due to planned maintenance must be limited to less than eight (8) hours per year.

There must be no downtime during the “quiet period” of elevated USPTO activities, defined as September 1 through October 1.

Form # USPTO-OP-020 (08/2020) Page 8 of 17

Formula [(Actual Uptime plus Excusable Downtime during the Measurement Interval) divided by

(Scheduled Hours during the Measurement Interval)] multiplied by 100 %]

= [percentage of Availability of the Contractor Portal or Database]

Target Performance The quality of service, consistent with an average of 99.9% up-time per year, with the 0.1% down-time including scheduled maintenance and repairs performed at a time to minimize inconvenience to the Subscriber and its Authorized Users, and to restore service as soon as possible in the event of an interruption or suspension of service.

Performance Requirement

99.9%

Measurement Interval Monthly

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System (CPARS) report. Additionally, failure to meet the Acceptable Quality Levels may result in adjustments made to the payment and recuperation of fees.

Service Level System Responsiveness Service Level

The system must meet the following SLA performance requirements for all simultaneous users.

Open home page of system

Required load time <= 1 second.

Search query execution and display of results in selected view

Required load time <= 2 seconds.

Form # USPTO-OP-020 (08/2020) Page 9 of 17

Load of next page of search results upon scroll

Required load time <= 1 second.

Display of document upon selection from results view

Required load time <= 2 seconds.

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System (CPARS) report. Additionally, failure to meet the Acceptable Quality Levels may result in adjustments made to the payment and recuperation of fees.

The vendor must provide a customer service telephone number and a customer service email address in order to field questions about the tool functionality from users and technical issues such as availability or performance reported from users. The vendor must maintain an incident report noting the date and time of the question or reported issue, detail about the question or reported issue, and date and time of the question response or issue resolution. The vendor must provide written reports regarding the vendor’s compliance with the service level agreement (SLA) specified for this service support. Service Support Service Levels include the set of SLAs related to customer support provided by the vendor. The following minimum service levels are required. The Contractor must meet or exceed the following service support SLAs:

Service Level Incident Response and Resolution Service Level – Tool Accessibility

Description Tool accessibility issues are incidents that impact the ability of users to access the system including connectivity and system availability. The elapsed time from when the incident is alarmed or escalated from the Service Desk to the COR to the time the critical incident is responded to by the Contractor.

Formula [(Actual Uptime plus Excusable Downtime during the Measurement Interval) divided by

(Scheduled Hours during the Measurement Interval)] multiplied by 100 %]

Form # USPTO-OP-020 (08/2020) Page 10 of 17

Service Level Incident Response and Resolution Service Level – Tool Accessibility

= [percentage of Availability of the Contractor Portal or Database]

Target Performance 100% of customer support and technical assistance is provided in a timely and professional manner. Customer receives regular communication regarding progress to incident response.

Performance Requirement

99.9%: The Contractor must provide immediate verbal notification of issues, and then in writing to the COR within 1 hour after the identification of the problem. The resolution to the problem/issue must be 2 hours, unless longer deadline is agreed to in writing by the COR.

Measurement Interval Monthly

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System (CPARS) report. Additionally, failure to meet the Acceptable Quality Levels may result in adjustments made to the payment and recuperation of fees.

Service Level Incident Response and Resolution Service Level – Interface Issues

Description Interface issues are incidents that impact the user experience or functionality of the system. The elapsed time from when the incident is alarmed or escalated from the to the COR to the time the major incident is responded to by the Contractor.

Formula Number of instances within Performance Target ÷ Total number of instances during Measurement Interval

Multiplied by 100%

= “Percent (%) Attained”

Target Performance 100% of customer support and technical assistance is provided in a timely and professional manner. Customer receives regular communication regarding progress to incident response.

Form # USPTO-OP-020 (08/2020) Page 11 of 17

Service Level Incident Response and Resolution Service Level – Interface Issues

Performance Requirement

98.00%: Resolution to problem/issue must be within 12 hours, unless longer deadline is agreed to in writing by the COR.

Measurement Interval Monthly

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System

Service Level Incident Response and Resolution Service Level – Vendor Identified

Description The elapsed time from when the incident is alarmed or escalated from the Contractor to the COR. The Contractor is required to notify the COR upon discovery of any service level incidents impacting system functionality.

Formula Number of instances within Performance Target ÷ Total number of instances during Measurement Interval

Multiplied by 100%

= “Percent (%) Attained”

Target Performance 100% of reported technical assistance is provided in a timely and professional manner. Customer receives regular communication regarding progress to incident response.

Performance Requirement

98.00%: Resolution to problem/issue must be within 12 hours, unless longer deadline is agreed to in writing by the COR.

Measurement Interval Monthly

Effective Date Upon first use

Incentive Failure on the Vendor’s part to meet the Performance requirements will be reflected in the Contractor Performance Assessment Reporting System

Form # USPTO-OP-020 (08/2020) Page 12 of 17

4 Deliverables Item Deliverable Delivery Dates

1 Kickoff No later than 10 business days after award

2 Customer Responsibility Matrix No later than 30 calendar days following the effective date of the contract award

3 System Security and Privacy Plan (SSPP) for ATO is delivered.

No later than 60 days following the effective date of the USPTO contract award

4 Full ATO is achieved and (AI) tool is ready for use by public user.

Within 90 days of receiving an initial ATO.

5 Licenses for all users Next business day after the ATO is granted

6 Remediate both Critical and High Plan of Action & Milestones (POAMs)

30 calendar days from notifications

7 Support of ATO processes As determined in accordance with the cybersecurity schedule

8 Meeting agenda, minutes, and action items (1) Business Day before for Agenda

(1) Business Day after for minutes and Action items

9 Problem Notification Reports, Issues, Risks, and Mitigation Strategies

Verbal: During normal work hours that day or by 8:00 AM EST at the beginning of the next USPTO workday.

Written: Within 24 hours after the identification of the problem.

10 Executive status meeting As requested

Form # USPTO-OP-020 (08/2020) Page 13 of 17

11 Metrics Deliverables Weekly for 1st 90 days after system offered to public and then monthly

5 Training The vendor must provide training in the use of the system, including in-person (which may by video conference in order to support USPTO teleworking programs and nationwide workforce) and computer-based training as requested by the COR. The vendor must provide an initial training course for up to fifty

(50) seats where training materials must be provided for Government usage. This training must encompass everything a trainer needs to know to provide training others in use of the system.

USPTO, training must be tailored to address specific user needs. USPTO will collaborate with the vendor and provide guidance on the presentation and content of the training. The training must include initial sessions for 1 hour to explain functionality of the word and image search tool and follow up sessions at later dates for 1 hour each to answer user questions. The training sessions will be scheduled by the USPTO to enable users’ multiple options for each of the sessions and include enough to support the total number of licenses. The initial training must be between 1-2 hours while the follow up mustl be 1 hour only.

The vendor must provide electronic manuals, quick reference guides, and other help files for specific USPTO needs. Paper copies of electronic manuals and other materials must be provided, as requested by the Contracting Officer's Representative or the Technical PoC. All electronic manuals and materials must be Section 508 compliant.

6 Metrics In order to allow USPTO to analyze patterns in their usage, the vendor must provide the Contracting Officer's Representative (COR) with electronic data about USPTO’s use of their products/services weekly during the 1st ninety (90) days then monthly after that or upon request from the CO or COR. The usage data must include at least:

• Number of unique users;

• Number of sessions for each user;

• Length of each session;

• Number of queries for each user;

• Number of total search exports;

• Number of word and image imports;

• Number of word and image imports per user;

• Number and type of further refined searches for each word/image import;

Form # USPTO-OP-020 (08/2020) Page 14 of 17

• Number of documents exposed to each user in preview;

• Criteria used by users to fine-tune the search results;

• List of documents by trademark application number or registration number selected by each user for viewing. For each document selected, the data must contain similarity indicator of “exact”, “similar”, and “other”;

• List of documents by trademark application number or registration number selected by each user for exporting. For each document selected, the data must contain similarity indicator of “exact”, “similar”, and “other”;

• Response rate for each query to load results; and

Details of formatting and data file of the report are to be agreed upon by the Vendor and the Contracting Officer's Representative (COR) at time of kick off meeting and subject to refinement at the conclusion of the pilot by the COR. The Vendor must provide other ad-hoc reports as requested by the Contracting Officer's Representative or the Knowledge Management Point of Contact (KM PoC).

7 Terms and Conditions on Privacy and Retention for Non-public Data Requirements Terms and Conditions on data privacy for non-public (35 U.S.C. § 122) data: Words and images uploaded for query and any representations derived from the uploaded words and images necessary for delivery of functionality for this SOW (e.g. embeddings or feature representations) are removed from systems upon completion of a user session (i.e. sign out, close browser, etc.). Any Government data, including 35 U.S.C.

§ 122 patent data, must only be used for the stated purposes of this SOW as explicitly stated in the Order.

Any Government data must not be used in any way for current or future research, materials or work products.

8 Vendor Point of Contact The vendor must provide the COR in writing a primary single point of contact (POC) who must serve as the USPTO contact for all claims, inquiries, and issue resolution within fourteen (14) business days after contract award. The vendor is required to provide a back-up point of contact in the event of the primary single point of contact's unavailability.

The vendor must assign a customer service representative within fourteen (14) business days after contract award that works specifically with the USPTO account on a daily/on-demand basis and provide a toll-free number and an e-mail address for the assigned customer service representative.

The vendor must notify the COR and CO immediately of all problems that impact or potentially impact the performance of this contract including any ordering, or invoicing. The Technical POC must also be notified of any service issues. Such notifications must be made verbally to the COR (or the Technical PoC if appropriate) as soon as possible, and then in writing within twenty-four (24) hours after the identification of the problem. Resolution to service issues must be within twenty-four (24) hours, unless longer deadline is agreed to in writing by the COR (or the Technical PoC if appropriate)

Form # USPTO-OP-020 (08/2020) Page 15 of 17

9 Cybersecurity Requirements

1. Vendors (including sub-vendors) entering into an agreement for services to the U.S. Patent and

Trademark Office (USPTO) and its Federal customers must be contractually subject to all USPTO and Federal IT Security standards, policies, and reporting requirements. The vendor must meet and comply with all applicable Federal, Department of Commerce (DOC), and USPTO laws, regulations, standards, policies, and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

2. The vendor must comply with all applicable Federal Information Processing Standards (FIPS).

National Institute of Standards and Technology (NIST) Special Publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

3. The Vendor is hereby made to be aware that, all Information systems supporting USPTO must meet the minimum security and privacy requirements using security controls in accordance with NIST Special Publication 800-53, (Current Revision), “Security and Privacy Controls for Federal Information Systems and Organizations.”

4. The Vendor must use USPTO technical guidelines, NIST guidelines, and industry best practice guidelines in hardening their systems.

5. All USPTO systems and Vendor systems used in the execution of the awarded contract and corresponding Task Orders must receive a full Authorization to Operate (ATO) from the USPTO Co-Authorizing Officials. The system must be re-authorized on an annual basis based on the completion of annual assessments and continuous monitoring activities. Any changes to the system after it was authorized, must be assessed and documented in accordance with OMB Memo 10-15 and 12-20.

6. The Vendor must appropriately address NIST SP 800-53 (Current Revision) controls, assisting USPTO Cybersecurity Division, as necessary, to ensure security and privacy controls are in place and operating as intended

7. The Vendor must comply with security assessment and authorization (A&A) of all systems developed for support of the contract/task order in conformance with the standards set forth by the FISMA and NIST SP 800-37 (Current Revision), Risk Management Framework for Information Systems and Organizations.

8. Vendors for external contractor systems must coordinate with an independent third-party assessment organization to perform initial and annual assessments to obtain and maintain their system authorization consistent with NIST SP 800-53/53A, NIST SP 800-30, and DOC and USPTO policies. An independent assessor is any individual or a team capable of conducting an impartial assessment of security and privacy controls employed within or inherited by an information system. Impartiality implies that security control assessors and privacy control assessors are free from any perceived or actual conflicts of interest with respect to the development, operation, and

Form # USPTO-OP-020 (08/2020) Page 16 of 17 management of the information system or the determination of security or privacy control effectiveness.

9. Identified gaps between required NIST 800-53 controls and the vendor’s implementation as documented in the Security Assessment/Risk Assessment report must be tracked for mitigation in a Plan of Action and Milestones (POA&M) document.

10. USPTO systems will maintain a System Security and Privacy Plan (SSPP). SSPP updates will be made as material changes occur to the system operated and or maintained by the contractor with updates occurring no more than 7 calendar days from the time when changes are made to the system. The system must also have a contingency plan and must regularly perform contingency tests to ensure the proper actions are taken in the event that the system fails.

11. The Vendor must work with Cybersecurity Division after award to gain further details, ensure each stage maintains the proper level of security, and track any future enhancements.

12. A Security Impact Analysis (SIA) and risk assessment shall be performed whenever there is a change (major or minor) to a system.

13. The vendor must notify the responsible ISSO, CISO and USPTO Computer Incident Response Team (CIRT) of any suspected incidents in a timely manner according to DOC/USPTO established guidelines and assist in the investigation of incidents as necessary.

14. As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104, if the system involves the design, development, or operation of a system of records on individuals, the vendor must implement requirements in FAR clause 52.224-1, “Privacy Act Notification” and FAR clause 52.224-2, “Privacy Act.”

15. The vendor must follow secure coding best practice requirements, as directed by the United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP) that limits system software vulnerability exploits.

16. Plan and perform the security aspects of configuration management. The vendor must ensure that computer software developed on behalf of USPTO or tailored from an open-source product, is fully functional and operates correctly on systems configured in accordance with government policy and federal configuration standards. The contractor must test applicable products and versions with all relevant and current updates and patches updated prior to installing in the USPTO environment. No sensitive data must be used during software testing.

17. The vendor must protect information that is deemed sensitive from unauthorized disclosure to persons, organizations or subcontractors who do not have a need to know the information.

Information which, either alone or when compared with other reasonably available information, is deemed sensitive or proprietary by USPTO must be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all sub-vendors that are performing under this awarded contract.

Form # USPTO-OP-020 (08/2020) Page 17 of 17

18. The Contractor must ensure that all computer security violations and incidents involving PII are reported to the USPTO CO, COR, Cybersecurity Team and the Computer Incident Response Team (CIRT) within established timeline (one hour) of discovery/detection regardless of the incident category reporting timeframe. USPTO must be notified by the Contractor immediately if a CSP-related incident or suspected incident occurs.

All work performed under the requirements set forth in this contract to include POA&M remediation must be performed without additional compensation to the Contractor. Failure to address deficiencies identified in POA&M in agreed upon time frames will result in performance penalties to include such items as a reportable deficiency in contractual performance and seeking other remedies available to the CO.

Repeated failure to address deficiencies identified in POA&M in agreed upon time frames may at the Governments election result in reduction of the price of a fixed-price type contract and the total cost and fee under a cost-type contract by the amount of expense incurred by the government in pursuit of the deficiency and or directly related to any losses incurred therefrom as determined by the CO.

10 Authority to Operate (ATO) The USPTO is licensing this software as a Software as a Service (SaaS). This system, in line with the requirements above, must go through and pass the Assessment and Authorization by the USTPO and achieve an Authority to Operate (ATO).

The vendor must work through the Assess and Authorize process in order to achieve an Authority to Operate. Artifacts such as a System Security and Privacy Plan (SSPP) will include a Privacy Threshold Analysis (PTA), and if necessary, a Privacy Impact Analysis (PIA) is included in this process.