Attachment 8 - Base PWS FLASH (7 July 2021).docx

PERFORMANCE WORK STATEMENT (PWS)

For

Flexible Litigation Augmentation Support for HQDA (FLASH)

U.S. Army Judge Advocate General’s Corps (JAGC)

SOLICITATION NUMBER:

W91CRB-21-R-0018

7 July 2021

PART 1

GENERAL INFORMATION

1. GENERAL: This performance work statement (PWS) is for an indefinite-delivery indefinite quantity (IDIQ) non-personal services contract to provide professional legal support services for the U.S. Army Judge Advocate General’s Corps (JAGC). Professional legal support encompasses a wide range of professional services and products that help attorneys collect, organize, develop, and present evidence throughout the course of all types of litigation (civil or criminal) and board proceedings, from pre-filing investigation and early case assessment (ECA), through complaint, discovery, and trial, and through post-trial briefs and the appeals process. The types of professional legal support required under this contract will generally fall into the following worldwide services: (1) Hardcopy Document and Media Acquisition; (2) Hardcopy Document Preparation and Indexing; (3) Scan to Digital Image and optical character recognition (OCR) (including Hardcopy and Microfiche Scanning); (4) Blowback; (5) Photocopying; (6) Document Coding; (7) Electronic Files Processing (EFP) including Scanned Doc / ESI processing and production; (8) Standard Database Creation, Maintenance and Utilization; (9) Hosting; (10) Other Services (Language Translation and Document Storage); (11) Project Management and Technical Support (i.e., resource planning, implementation, and administration); (12) Electronic Data and Document Acquisition (forensic collection); (13) Pre-Trial, Trial, and Post-Trial Support; (14) Specialized Professional services (includes experts, historians, researchers, legal writing, etc.); (15) Managed Review services; and (16) Facility Space setup and maintenance (i.e., document center for legal review, sensitive compartmented information facility (SCIF), etc.). The Government shall not exercise any supervision or control over the contract service provider(s) performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The Contractor shall provide all administrative, logistical, professional and technical labor, equipment, supplies, facilities, transportation, tools, materials, supervision, technology, and other items and non-personal services necessary to provide a wide range of professional legal support services and products through the course of litigations, investigations, board proceedings, and responses to third party subpoenas, Congressional inquiries, and Freedom of Information Act (FOIA) requests. Contractor shall also prepare and present executive level briefings for JAGC personnel, Headquarters Department of the Army (HQDA) and Department of Defense (DoD) personnel concerning work performed. Contractor shall maintain all data in an electronic format available for analysis and reporting. Data remains the property of the Government. The Contractor shall perform to the standards in this contract.

1.2 Background: The JAGC provides legal services for the Army, its Soldiers, family members, and retirees. The JAGC is comprised of military Judge Advocates, civilian counsel, military para-professionals, and civilian paralegals that all serve in a variety of roles. Judge Advocates may serve as prosecutors and defense attorneys for criminal matters under the Uniform Code of Military Justice, while both Judge Advocates and civilian counsel may serve as litigation attorneys in civil litigation in both Federal and State venues (e.g., Courts and Boards), and practice operational, labor, contract, environmental, tort and administrative law, including investigations, and FOIA or Privacy Act matters. These legal matters require the JAGC, in often short suspense timeframes, to collect, scan, copy, decrypt, process, review, and produce increasingly large volumes of paper documents, emails, computer and network files, other electronically stored information (“ESI”), and utilize other professional legal support services (e.g., legal research and writing, translation and transcription, trial support, and expert testimony).

The U.S. Army Legal Services Agency (USALSA) is an Army field operating agency of the Office of The Judge Advocate General (OTJAG) that supports Army and Joint Force priorities by representing the Army in legal matters before courts and administrative bodies. This representation is accomplished in compliance with electronic discovery (eDiscovery) requirements found in the Federal Rules of Civil Procedure, Army policies and regulations, as well as Board and Court rules of practice. The Army eDiscovery Division (EDD), housed within USALSA on Fort Belvoir, VA, provides in-house litigation support for these legal matters, and is responsible for managing and coordinating legal support services for the JAGC relating to ESI and services utilizing ESI. These legal matters, however, increasingly involve urgent and/or large scale professional legal support needs beyond EDD’s existing capabilities.

This contract shall serve as a flexible and responsive solution to meet such large scale and/or urgent professional legal support needs in support of the JAGC mission. While the primary focus of this contract is to support the civil litigation mission, the Army expects to use these professional legal support services in other areas of the JAGC practice, such as FOIA, military justice, and investigations. Moreover, any future contract may be utilized by the JAGC and other DoD affiliated entities.

1.3 Objectives: Obtain professional legal support services to augment Army’s internal eDiscovery Program for large scale and/or surge cases and/or cases that require resource support. The types of professional legal support services will generally fall into the following areas:

· Hardcopy Document and Media Acquisition

· Hardcopy Document Preparation and Indexing

· Scan to Digital Image / OCR (includes hardcopy and microfiche Scanning)

· Blowback

· Photocopying

· Document Coding

· Electronic Files Processing (includes scanned doc/ESI processing and production; audio/video digitization)

· Standard Database Creation, Maintenance and Utilization

· Hosting

· Other Services (includes Language Translation and Document Storage)

· Project Management and Technical Support (resource planning, implementation, and administration

· Electronic Data and Document Acquisition (forensic collection)

· Pre-Trial and Trial and Post-Trial Support

· Specialized Professional Services (includes experts, historians, researchers, legal writing)

· Managed Review Services

· Facility Space setup (for legal review, SCIF, etc.)

The services sought will help the JAGC in its large scale cases and/or cases with a short suspense, in the Continental United States (CONUS) and Outside the Continental United States (OCONUS), with the collection, scanning, processing, analysis, review, production, and presentation of evidence, for all types of litigation matters including civil or criminal matters in front of state and federal courts and magistrates, administrative hearings, and board proceedings, as well as responses to Congressional inquiries, third-party subpoenas, and Freedom of Information Act (FOIA) requests, from pre-filing investigation and early case assessment (ECA), through complaint, discovery, trial, and through post-trial briefs and the appeals process. The FLASH program will also provide the JAGC access to resources such as testifying subject matter experts, historians, researchers and legal writers, analysts, etc., to support their cases and investigations, CONUS and OCONUS. Primary services will be utilized to support the civil litigation mission. However, the Army also expects to use these professional legal support services in matters such as Freedom of Information Act (FOIA), military justice, and investigations.

1.4 Scope: This contract will be used to provide worldwide professional legal support products and services to the JAGC on an indefinite delivery, indefinite quantity task order basis. Individual task orders issued under this contract may support any Department of the Army (DA) agency on a local, nationwide, or worldwide basis. The professional legal support services include: project management; managed review; expert analysis; technology processes, and; products from early case assessment/pre-processing ingestion through trial presentation and post-trial phases. These services utilize state of the art technology, including analytics and technology assisted review (“TAR”), and employ eDiscovery best practices to collect, decrypt, process, ingest, analyze, review, host, and produce ESI for investigations, inspections, examinations, and/or litigation. Assistance may be required to respond to information requests from many sources, including, for example, Congressional requests for information and third-party subpoenas and audits, as well as to provide assistance to Judge Advocates and other professional staff members to acquire, organize, analyze and present evidence as part of unofficial or official discovery in a lawsuit or investigation. The prime Contractor shall be a FedRAMP certified (moderate level) litigation support provider.

1.5 Reserved

1.6 General Information:

1.6.1 Quality Control: The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. Through its Quality Control Plan (QCP), the Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which it assures itself that its work complies with the requirement of the contract. Work failing to meet these standards shall be rejected, and the Contractor shall be required to perform the work again at no additional cost to the Government. To ensure all deliverables conform to contract specifications, the Contractor shall implement quality control procedures for all tasks as delineated in its proposal. The Contractor shall stress to its staff the importance of quality control and quality assurance. The Contractor shall maintain quality control of all work performed, review the condition and appearance of output, check output for accuracy and consistency, ensure completion of all steps, and produce the required number of deliverables as specified by the task order. The QCP shall be delivered to the (KO and to the Contracting Officer’s Representative (COR) within 30 calendar days after contract award. Copies of changes made to the QCP shall be forwarded to the Contracting Officer (KO) and COR within 5 working days of when the changes are made. The importance to the Government of quality work cannot be overstated. The Government is committed to the production of deliverables that meet the contract specifications when first presented to the Government; the Government will reject work not meeting contract quality standards and will insist re-work be done at the Contractor's expense. Repeated failure to deliver acceptable work may result in contract termination. Thus, the Government views it as being in the Contractor's best interest to have in place a thorough and robust quality control program. After acceptance of the QCP the Contractor shall receive the KO’s acceptance in writing of any proposed change to his QC system.

REF: CDRL No. A001

1.6.2 Quality Assurance: The government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). The QASP is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The Contractor is not required to perform services on Government holidays.

Independence Day

1.6.4 Hours of Operation: When performance is at a Government specific-site / facility, the Contractor is responsible for conducting business customary for that specific-site / facility. Typically, this will be between the hours of 8:00 AM and 5:00 PM (at the time zone of the Contractor’s specific location, locally, nationwide, or worldwide) Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: This contract requires worldwide support. The Contractor should plan to provide accommodations for any personnel used to support this requirement. In select circumstances (i.e., SCIF on Government facilities, or resource support for Army’s internal eDiscovery Division at Fort Belvoir, Virginia), the Government will provide space to accommodate the required contract personnel, locally in the national capital region, nationally, or worldwide. Government locations would be specified by COR during issuance of the Task Order, and would be made available at Government locations, if required.

1.6.6 Period of Performance: A five (5) year ordering period per Section F of the contract.

1.6.7 Security Requirements: All security requirements shall be in accordance with the DD254 referenced in Section J of the contract. The Contractor shall not use, disclose, or reproduce any proprietary data, other than as required in the performance of this PWS. The Contractor shall not divulge or release data or information developed or obtained in the performance of this contract except upon written approval from the Government Representative and the COR.

Contractor personnel are subject to all local installation rules and procedures. Site-specific approval regarding access, issue of security badges, etc., will be coordinated as required. Contractor personnel should be aware at all times of any unusual persons or packages in their work area and immediately report those to the building security staff. If Contractor personnel become aware of any person seeking unauthorized access to classified materials, they should immediately report this to the COR.

The Contractor shall conform to all applicable federal and industry security standards. In addition, the Contractor shall work closely with Army and DoD Security Teams to ensure the implementation comports with the DoD’s internal security requirements and appropriate FedRAMP certification in order to ensure the overall protection of data due to loss, disaster or malicious attack. Contractors shall meet all existing DoD security requirements. Any Contractor hosting Army data will also be required to submit a System Security Plan (“SSP”) that meets or exceeds the requirements of NIST SP 800-171, and any amendments or replacements to NIST, FIPS, or other security standards.

All work under this effort is proprietary to Army and DoD; the Contractor shall not release any information regarding the work to anyone without written permission by the Government.

1.6.7.1 Applicability: All OTJAG Army organizations residing, traversing or furnishing and receiving Department of Defense information network–Army (DODIN–A) information technology (IT) services, products, and support through the established contract for support to or on the local area network JAGCNet System Identification: 3575 Registration Type: Assess and Authorize System Acronym: Judge Advocate General's Corps Network System Name: JAGCNET Version / Release Number: 1.0 Information System Owner: HQDA Office of the Judge Advocate General The Department of Defense information network (DODIN) includes DoD IT (e.g., DoD-owned or DoD-controlled information systems (IS), platform IT systems, and IT products and services) that are operated by or on behalf of DoD components as defined in DODI 8500.01 and control systems and industrial control systems (ICS) as defined in National Institute of Standards and Technology (NIST) Special Publication 800–82.

All information management, information technology Task-orders/ Delivery-orders within this contract will integrate security early and throughout the IT development life cycle, capital planning, investment control, portfolio management, and enterprise architecture processes in accordance with the DoD Cybersecurity Architecture and other applicable DoD and Army issuances. Contractor shall ensure the security standards are integrated into the acquisition planning and contract administration in accordance with this PWS, and issued Task-orders/ Delivery-orders within this contract. Agency cyber security representatives will ensure that contracts and other agreements include specific requirements to provide cybersecurity for information and the IT used to process that information in accordance with DODI 8500.01 and DODI 8510.01. Document baseline cybersecurity requirements as a condition of contract award for acquisitions utilizing information technology.

Agencies’ cybersecurity program manager(s) shall ensure that the personnel, processes, and IT for which the contract supports the development, procurement, integration, modification, operation and maintenance, and/or final disposition responsibility in acquiring information technology will include the appropriate information technology security policies and requirements, including use of common security configurations available from the National Institute of Standards and Technology’s (NIST) website at http://checklists.nist.gov. Agency contracting officers should consult with the requiring official, local information assurance officers, and information security system managers to ensure the appropriate standards are incorporated. All Cybersecurity Request for Proposal (RFP), Task-Orders, Delivery-Orders and IM/IT considerations will be submitted to the agency Information Assurance officer and agency portfolio manager to assist in developing the risk management framework that reflects the specific stakeholder cybersecurity requirements and the specifics of the solution under development.

DoD organizations that use external IT services provided by a non-DoD U.S. Government agency must ensure the categorization of the system delivering the service is appropriate to the confidentiality, integrity, and availability needs of the information and mission. DoD organizations must also ensure that the system delivering the service operates under a current authorization from that agency. In accordance with DoDI 8500.01, the external government agency and the DoD organization need to develop an interagency agreement or government statement of work for this application with requirements for service level agreements (SLAs) that include the application of appropriate security controls which will be reviewed by the agency information assurance officer, information system security manager and agency cyber security division.

Agency command senior intelligence official or information security manager shall approve or validate the need-to-know for individuals (contractor) requiring SCI access and validate the need to establish SCIFs, SCI communications, and information systems (classified and unclassified).

Regulations:

· Department of Defense INSTRUCTION, NUMBER 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) 12/29/2020

· AR 25-1, Army Information Technology, 07/15/2019

· AR 25-2, Army Cybersecurity (Previously: Information Management Information Assurance) 04/04/2019

· AR 380-5, Army Information Security Program, 10/22/2019

· Department of the Army Pamphlet 25–2–14 Information Management: Army Cybersecurity Risk Management Framework for Army Information Technology 04/08/2019

· DOD Instruction 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011

· Department of the Army Pamphlet 25–1–1 Information Management: Management of Sub-disciplines Army Information Technology Implementation Instructions 15/07/2019

· National Institute of Standards and Technology (NIST) Special Publication 800–82.

· Army Regulation 380–28 Security Army Sensitive Compartmented Information Security Program

1.6.7.2 Clearance: Contractor personnel shall possess a minimum of an Interim SECRET security clearance and must be a United States citizen. The Contractor shall forward security clearances to a person designated by the COR for all personnel assigned to work on this contract/task order(s).

1.6.7.3 Non-Disclosure Statement: All personnel who support this contract shall be required to sign an Army Non-Disclosure Statement prior to obtaining access to the Army Local Area Network (LAN), and/or to classified information.

1.6.7.4 Antiterrorism/Operations Security:

1. AT Level I Training. All Contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 10 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee, to the TM or to the KO, if a TM is not assigned, within 15 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://jko.jten.mil/courses/atl1/launch.html.

2. Access and General Protection/Security Policy and Procedures. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

2a. For Contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

2b. For Contractor not eligible for CAC, but requires access to DoD facility or installation: Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05-AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

3. AT Awareness Training for Contractor Personnel Traveling Overseas. The standard language required US based contractor employees and associated subcontractor employees to make available and to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

4. iWATCH Training. The Contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 10 calendar days of new employees commencing performance with the results reported to the COR NLT 45 calendar days after contract award.

5. Army Training Certification Tracking System (ATCTS) registration for Contractor employees who require access to government information systems. All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DoD Information Assurance Awareness prior to access to the IS and then annually thereafter.

6. For contracts that require a formal OPSEC program. N/A

7. For contracts that require OPSEC Training. Per AR 530-1, Operations Security, new Contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All Contractor employees must complete annual OPSEC awareness training.

8. For Information assurance (IA)/information technology (IT) training. All Contractor employees and associated sub-Contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter.

9. For information assurance (IA)/information technology (IT) certification. Per DoD 8570.01‐M, DFARS 252.239-7001 and AR 25‐2, the Contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon contract award.

10. Contractor Authorized to Accompany the Force clause. N/A

11. Access to Government information systems (Antiterrorism/Force Protection for Defense Contractors Outside the US). For all Contractors requiring performance or delivery in a foreign country, all non-local national contractor personnel shall comply with theater clearance requirements that allow the combatant commander to exercise oversight to ensure the Contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

12. For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires Contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); (2) any revisions to DoD 5220.22‐M, notice of which has been furnished to the Contractor.

13. Threat Awareness Reporting Program. For all Contractors with security clearances. Per AR 381‐12 Threat Awareness and Reporting Program (TARP), Contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2‐4b.

1.6.7.5 Off-Site Processing and Storing of Government’s Information / Security and Privacy Compliance: The Contractor shall comply with all the Government’s information security and privacy directives, policies and requirements unless Contractor obtains a written waiver from Army and DoD Security Teams. These include, but shall not be limited to, the following provisions and any amendments or replacements of:

1. The Privacy Act of 1974 (5 U.S.C. § 552a), as amended;

2. Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources (Transmittal Memorandum No. 4), including Appendices;

3. E-Government Act of 2002 (P. L. 107-347), including Title II, Section 208 - Privacy Provisions and Title III - Federal Information Security Management Act of 2002 (FISMA), and related OMB guidance;

4. National Institute of Standards and Technology (NIST), including NIST SP 800-171, Federal Information Processing Standards (FIPS) and Special Publications and

5. Army Rules and Regulations, and DFARs clauses including protection of Controlled Unclassified Information (CUI).

1.6.7.6 Control and Protection of Government’s Information. The Contractor shall implement effective, administrative, technical, and physical safeguards to ensure that all of the Government’s information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification. The creation, collection, use, processing, storing, maintenance, dissemination, disclosure, and disposal of Government information shall comply with all applicable federal and state laws, Army Rules and Regulations, and DFARs regarding protection of information. The Contractor shall not use any such information except to the extent necessary to carry out its obligations under the contract. The Contractor shall not disclose such information to any third party unless (i) disclosure is authorized in the Agreement, (ii) the Contractor obtains the prior written consent of the COR, or (iii) to the extent expressly required by applicable law, in which case the Contractor shall notify the COR at least ten (10) business day before such disclosure, to allow the Government to object or concur. The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose such information outside the United States, unless specifically directed by the Agreement or otherwise authorized by the COR.

1.6.7.7 Return, Destruction and Retention of Government’s Information. All Government information remains the property of the Government. Upon completion or termination of the contract, or at any time upon request of the COR, the Contractor shall promptly return to the COR all such information in its possession and/or securely dispose of it as required in the contract, PWS, or as directed by the COR. Information shall be returned securely in a format directed by the COR. Retention of such information by the Contractor beyond the conclusion of the contract is only permissible in accordance with the COR’s direction.

1.6.7.8 Inspections / Assessments / Audits / Reviews / Examinations. Contractor shall grant Army and DoD Security Teams, the U.S. Government Accountability Office (GAO), or a selected third party acting on the Army’s behalf, permission to perform inspections, assessments, audits, reviews or examinations of all controls in Contractor’s physical and/or technical environment in relation to all Government information being handled and/or services being provided to the JAGC pursuant to this Agreement. The Contractor shall fully cooperate by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that collects, processes, transmits, or stores such information pursuant to this PWS. These inspections, assessments, audits, reviews, and examinations may be conducted either by phone, electronically or in-person. Nothing in this clause shall be viewed as limiting the federal government’s audit and inspection rights delineated in other clauses of this PWS or by statute.

1.6.7.9 Security and Privacy Incident Handling. The Contractor shall monitor its facility, premises and information systems for security and privacy incidents and provide the capability to respond to and resolve them effectively and in a timely manner, including allowing for inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M-17-12 (Preparing for and Responding to a Breach of Personnally Identifiable Information) and USALSA’s Breach Response Plan, and to assist in responding to a breach. USALSA’s Breach Response Plan is available through the organizational Information System Security Management Officer, Information Technology Division, Cyber Security department. The Contractor and subcontractors (at any tier) shall report a suspected or confirmed breach in any medium or form, as soon as possible and without unreasonable delay, consistent with USALSA’s Breach Response Plan. All security and privacy incidents that involve the Government’s information must be immediately reported to USALSA’s Computer Security Incident Response Team (CSIRT)/Information Security Manager (ISM) at the telephone/email address provided in paragraph 1.6.7.7.1 below. The Contractor and subcontractors (at any tier) shall cooperate and exchange information with agency officials in order to effectively report and manage a suspected or confirmed breach. The Contractor shall maintain capabilities to, at a minimum, determine what Government information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access the information, and identify the initial attack vector.

1.6.7.9.1 Security and Privacy Incident Points of Contact. The Contractor shall appoint and provide points of contact (names, telephone numbers, e-mail addresses) for the officials who have overall accountability for incident response and protection of Government information and with whom the COR, KO, and/or other applicable DA staff may communicate throughout the duration of the contract about information security and privacy issues. These individuals or designees shall, at a minimum:

1. Be available to assist the Government as needed in resolving an incident;

2. Notify the Government of an incident immediately after the Contractor becomes aware of it; and

3. Notify USALSA’s Computer Security Incident Response Team (CSIRT) via email at Esmeralda.marrero3.civ@mail.mil as well as to the COR of an incident.

The Contractor shall take all necessary steps to effectively contain identified incidents and coordinate and cooperate with the Government in investigating and remediating the incident.

The Contractor shall, at its own costs and at a minimum, provide individuals affected by a breach involving personally identifiable information (PII) under its control with notice of the breach and access to two (2) years of complimentary credit monitoring and identity protection services to protect such affected individuals against risks posed by the breach.

1.6.7.10 NIST SP 800-171 Security Requirement.

1.6.7.10.1 Definitions.

1. “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

2. “Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

3. “Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

4. “Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

5. “Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

1.6.7.10.2 Covered Contractor Information System. This contract will or may involve the use of a covered contractor information system and work will or may involve the Government’s controlled unclassified information (CUI) being processed or stored off-site at a covered contractor information system.

1.6.7.10.3 Adequate Security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the contractor shall implement all security requirements contained in the latest published version of NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

1.6.7.10.4 Subcontracts. The Contractor shall include the substance of this clause, including this paragraph 1.6.7.10, in subcontracts under this contract, in which the subcontractor may have Federal contract information residing in or transiting through its information system. Contractor also must require its subcontractors (first tier) to include Section 1.6.7.10 in any of their subcontracts (second tier) to which the conditions and requirements of Section 1.6.7.10 would apply.

1.6.7.11 Physical Security: The Contractor shall be responsible for safeguarding all government supplied equipment, information and property provided for Contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

The Contractor shall be responsible for safeguarding and ensuring that storage containers and information processing equipment, which have been used to store or process classified information, and which is transferred to the Contractor’s facility for work performed under this contract, remains in a sensitive compartmented information facility (SCIF) space at the Contractor’s site. Classified information will be protected at all times, either by storage in an approved security container, or having it under the personal observation and physical control of the authorized contractor personnel.

1.6.7.12 Lock Combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.8 Special Qualifications: All personnel quoted for this contract shall be able to demonstrate competence in understanding, reading, speaking, and writing the English language.

1.6.8.1. The Contractor personnel assigned to the project shall be:

· Responsible for providing contract and corporate level resources, including a dedicated Army Program Manager and dedicated Army Project Manager(s) for performing all work ordered under the IDIQ contract that will also supervise each task order. The Contractor shall provide all management, staffing, planning, scheduling, procuring, pickups and deliveries for all items/services required under the IDIQ contract and any task order.

This includes, but is not limited to:

1. Screening prospective contract staff for conflicts of interest, and to ensure Contractor employees used under this IDIQ contract meet personnel hiring and employment security approval requirements, and coordinating with Army and OPM staff as needed to complete the required clearances. Contractor must retain all personnel security files for all individuals who perform work under the IDIQ contract for the life of the IDIQ contract plus five years.

2. Ensuring facilities and computer networks and equipment used for the Contractor’s performance of this IDIQ contract meet all security requirements of the Agreement, and coordinating with Army staff as needed.

3. All activities associated with management and handling of interim and deliverables, such as production media containing electronic data. For example, the Contractor must forward, monitor, and track each “container” of documents, from receipt, through data processing, delivery, recovery and destruction in a hardcopy chain-of-custody (COC) form or electronic COC process.

1.6.8.2. To ensure effective management of the project, the Contractor shall have the following:

· Experience in delivering innovative eDiscovery and litigation support solutions to the federal government,

· Experience and expertise in supporting large-scale (size and scope) and/or surge capacity cases, including investigations, inspections, examinations, and/or litigation,

· Experience in providing subject matter expert support for cases of various sizes, to review, document, and often testify on the underlying case subject matter, and provide support to Army organizations, Commands, Service Providers, and other external stakeholders,

· Use of best practices, as well as known and widely used quality commercial off the shelf (COTS) tools, techniques and templates to complete Electronic Discovery Reference Model (EDRM) workflows and processes,

· The ability to draw upon additional resources and maintain a “reach-back” knowledge base capability that can be drawn upon during workload peaks, and

· Compliance with Organizational Conflicts of Interest requirements; i.e., providing specific and clear advisories when personnel submitted for staffing for this project may cause a possible conflict of interest situation so that the Government may make a determination on acceptability in a timely manner.

1.6.8.3 NON-DISCLOSURE STATEMENT. The Army has a Nondisclosure Agreement (NDA) requirement for each person supporting Army. The Contractor personnel shall complete and sign a Nondisclosure Statement prior to the commencement of the contract award. This requirement extends to all sub-contractors, affiliates, and teaming arrangements. The non-disclosure statement shall be provided to the COR. The Contractor is responsible to obtain all necessary approvals prior to obtaining access to proprietary information, in accordance with FAR 9.505-4(b).

1.6.8.4 Information Disclosure: All public release of information shall require authorization from the government in writing, however all information CUI or higher will be cleared IAW Section 12 of the DD Form 254. All information gathered by the Contractor to provide services to the US Government shall be considered contractually sensitive and shall not be released to any person or organization not part of the US Government, and shall become the property of the US Government.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the KO will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.10 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the KO and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel: The Contractor shall assign a Program Manager / Lead Project Manager at the start of the contract and for the duration of the contract. This Key Personnel shall oversee the FLASH program and serve as the Contractor’s main point of contact (POC) for the Government.

Other Key Personnel shall be assigned for the duration of the applicable task order. The Government reserves the right to review and approve resumes of candidates prior to their assignment. The Contractor shall maintain a list of all identified Key Personnel. All decisions relative to key personnel shall be coordinated with the COR, i.e., extended period of absence (more than 3 consecutive days), Corporate travel (more than 3 consecutive days), reassignments, vacations (more than 3 consecutive days), etc. The COR has authority to reject these proposed decisions if it is determined that the decision will critically impact the project and/or task. All unresolved issues will be decided by the KO. Key Personnel cannot be substituted without prior KO approval. Award of a Contract will constitute the government’s approval of Key Personnel.

The Contractor may propose individuals, regardless of labor category, as "key personnel" whenever the individual performs a function(s) that is believed to be critical to successful performance on any segment of this contract.

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. Contractor personnel are required to have a Government issued Common Access Card (CAC) but will not be required to wear badges.

1.6.13 Contractor Travel: Contractor may be required to travel CONUS, OCONUS, and within the National Capital Region (NCR) during the performance of this contract. Advance notification shall be provided to the appropriate Army POC to allow for clearances and site preparation. Reimbursement of expense shall be in accordance with the Joint Travel Regulation (JTR) and AR 715-9. Contractor shall submit any request(s) for travel exceeding $2,000 per contractor personnel per trip under five (5) days, or exceeding $5,000 per contractor personnel per trip five (5) or more days to the COR for approval. Any request to for travel totaling more than $10,000 per contractor personnel per trip regardless of days shall additionally be approved by the KO. Travel shall not commence until written approval is received. Occasional meetings may be held at Army Entity locations. Travel costs are expected to be high as field work will require extensive travel to Army Entity locations. Local travel at the Contractor’s ordinary course of business, and local travel in the NCR area, including to and from the Pentagon, performed in the course of contract performance, is considered the cost of doing business and will not be reimbursed as a direct charge to the contract. Receipts must support any local travel cost expenses over $75.00. Contractor may be required to ship training material to locations when training is required. Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel is reimbursable and will be evaluated via a modification if additional funding is required.

1.6.14 Other Direct Costs: Other Direct Costs/Incidentals. The Contractor may be required to provide incidental materials and supplies, and/or facility space for the performance of this contract. Contractor shall submit any request(s) to purchase ODCs exceeding $200 per incident for materials and supplies and/or facility space to the COR for approval. Any request to purchase ODCs totaling more than $10,000 shall additionally be approved by the KO. All materials purchased by the Contractor, for support of this contract, become property of the government. The Contractor shall document the transfer of the materials in accordance with established agency procedures.

1.6.15 Organizational Conflict of Interest: Contractor and sub-contractor personnel performing work under this contract may receive or have access to proprietary information which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5.